Integrating macOS systems with Active Directory (AD) is crucial for organizations that use a mixed environment of Windows and macOS. The dsconfigad command-line tool is specifically designed for this purpose. It allows macOS machines to bind to an Active Directory domain, enabling centralized management of user accounts, policies, and access controls. This article will guide you through the process of using dsconfigad to bind a macOS system to an Active Directory domain, configure necessary settings, and verify the integration.

Examples:

1. Binding macOS to Active Directory: To bind a macOS machine to an Active Directory domain, you can use the following command:

   sudo dsconfigad -add domain.example.com -username admin -password password -ou "OU=Computers,DC=example,DC=com"

   • domain.example.com: The fully qualified domain name (FQDN) of your AD domain.
   • admin: A user account with permissions to join computers to the domain.
   • password: The password for the admin account.
   • OU=Computers,DC=example,DC=com: The organizational unit (OU) where the computer account will be created.

2. Configuring AD Settings: After binding, you may need to configure additional settings such as the preferred domain controller, computer ID, and user experience settings. Here are some examples:

   • Set the preferred domain controller:

     sudo dsconfigad -preferred dc.example.com

   • Set the computer ID:

     sudo dsconfigad -computerid MacBookPro

   • Enable mobile accounts:

     sudo dsconfigad -mobile enable

   • Set the shell for AD users:

     sudo dsconfigad -shell /bin/bash

3. Verifying AD Integration: To verify that the macOS machine is correctly bound to the AD domain, use the following command:

   dsconfigad -show

   This command displays the current AD configuration and status, including the domain, computer ID, and other settings.

4. Unbinding macOS from Active Directory: If you need to unbind the macOS machine from the AD domain, use the following command:

   sudo dsconfigad -remove -username admin -password password

   Replace admin and password with the credentials of an account with permissions to remove the computer from the domain.