OD Replicating to AD. OSX Server 10.6 and Server 2008

So I have a unique and PITA situation here.
I have a school that is running Snow Leopard Server and Windows Server 2008.  They are 99% MAC Based in their workstations, but have a couple PCs.  They have file shares on both servers.  The are adamant about not removing the windows server from the network.
What they want to do is have the OSX Server be the master and replicate the user info (just Login Name, User Name, and Password) to AD so that file sharing and such won't be a problem regardless of the platform they are using.
My issue is getting the Two server to talk to eachother.  I have replicated a similar network in my office where I have a Snow Leo Server and Window Server 2k8 running on the same test network.  The win2k8 server is setup on domain dns.lan the OSX server is setup on DNS.lan as well.
The OSX server is called "server.dns.lan"
The Win2k8 server is called "winsrv.dns.lan"
when I go into Directory Utility and enable Active Directory then go into the settings to bind it I am leaving the Active Directory Forest set at " - Automatic - "
Active Directory Domain I input "dns.lan"
Computer ID I leave with the default which is "server"
I then click Bind and it brings up the Network Administrator Required field.
I put in the Username and password for the windows Server and Click OK and I get the attached error. Bind Error
So I turn to the experts that have been oh so helpful in the past.
they are also wanting this live in 2 weeks, even though I was originally told it wasn't happening until May.  -.-

Thanks in advance for any help!
dnetsolAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

gmbaxterCommented:
I think you'll struggle here. You cant replicate between OSX and Windows AD. OS X runs an outdated version of samba 3, itself which is based around NT4.

Your mac server isn't running a PDC role is it?

To bind it in, check that your mac server can resolve the name of the windows server ( set mac servers DNS server to the AD one) then bind it in via directory utility > Active DIrectory

Still don't see how this is going to assist you as previously stated. How about running AD/DNS/DHCP on the windows server, and using the OS X server bound to the domain as a member server as a file server?

You can then add another small windows box to the mix to add some redundancy.
0
dnetsolAuthor Commented:
Hi gmbaxter - Basically what they are trying to accomplish is having the same user accounts on either box w/o having to manually enter them twice.
To be honest I don't care which box they enter them on, but if (for example) they enter it on the Windows Server at least the name, shortname (login name) and password needs to be replicated over to the MAC Server so that they can then use the MAC Administration stuff for privilege restrictions and such on the MACs in the enviroment.

I don't know what their MAC server is running (in regards to PDC) the one I started I did from scratch and have just set it up as an open directory master but I can switch that.  The issue though is going to be I am pretty sure that the majority of their user accounts is on their MAC server currently.


Hopefully this didn't muddy the waters more...
0
dnetsolAuthor Commented:
So I have set the test bed up where OD it pulling its Data from AD, OD is not a PDC, and AD is doing the DNS, DHCP etc.
My biggest issue for what the client needs is that now I can not administer any of the preferences in Workgroup Manager for the people using MACs.
This functionality of being able to administer the settings for MAC Users, Groups and workstations via Work group manager is crucial.

Does anyone know how to make this work while still replicating the AD and OD to each other?
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

gmbaxterCommented:
This its usually achieved by making the OD server a member of the domain and nesting AD groups into OD groups which you can then apply managed preferences to.
0
dnetsolAuthor Commented:
Can I get some help on how to do that then?
I'll try to figure it out but I am not 100% sure on how to make it happen.
0
gmbaxterCommented:
Setup your domain controller to host AD and DNS.
Your OD server should be in standalone mode - not an open directory master, with AD as its DNS server.
Check DNS has A and PTR records for the OD server
Check OD server can resolve AD and vice-versa
Join the OD server into the AD domain using the AD plugin in directory utility in the /System/Library/Core Services
open terminal and type: sudo dsconfigad -enableSSO (this will join the OD server into AD's kerberos realm)
Reboot the OD server
Open Server Admin, and add open directory as a service in server admin
Select change role
Select remain connected and setup open directory master
Ignore error about kerberos being unavailable - you are using AD for kerberos
Reboot server
Open Server Admin, select Open Directory > Overview
You should have:

Open Directory is: Open Directory Master

LDAP Server is: Running
Password Server is: Running
Kerberos is: Stopped

Kerberos Realm: YOUR.AD.DOMAIN

Now create an AD group with some users in, eg Finance Users
Open Workgroup Manager and authenticate as the directory administrator
Create a similar group in OD, eg Finance User Management Group
Select the group
Select "Members"
Select +
In the slide out pane where it says "Directory:", click the drop down arrow and select Active Directory.
Add your AD group.

You now have a magic/golden triangle AD-OD setup.


0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Mac OS X

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.