Indexing Active Directory attributes for performance

[jaharmi]

From past information, I’ve heard that at least three attributes ought to be indexed in Active Directory for best performance with Mac OS X clients. I’ve seen this listed as whatever is mapped to “UniqueID,” “PrimaryGroupID,” and “MacAddress.”

Trying to correlate this information between the Open Directory Admin Guide (the only public Apple documentation on the matter, as far as I can tell) and what’s available through the Schema Manager snap-in for Active Directory has left me a little confused. The OD Admin Guide lists the mappings of the first two to “GUID,” which I cannot find in the AD schema. Although I can guess what it might mean, that leaves it open to my interpretation which makes it ambiguous.

I have found “uniqueIdentifier” (Unicode string, not indexed), “primaryGroupID” (integer, indexed), and “MacAddress” (IA5-String, not indexed, new in 2003 R2 schema).

I’m using the default settings and mappings for the Active Directory plugin with Tiger and Leopard.

Which exact attributes/OIDs ought to be indexed for performance with Mac clients?

Also, it would be helpful if the information on attribute indexing could be added to the OD Admin Guide, since it doesn’t even appear to be in v2 of the Leopard guide.

[jaharmi]

We have experienced slow logins in our environment, and this was discussed as one solution for slow logins and queries during an Apple presentation.

If I had to make a guess based on that presentation and the OD Admin Guide, I’d say the only unindexed attribute that we should consider indexing is “MacAddress.”

So, are the AD attributes used in computing the UniqueID and PrimaryGroupID are indexed by default in AD? Which attribute(s) are used as the basis of that computation? The OD Admin Guide lists it only as the “GUID.” Is it the SID?

[Author]

Posts