EL CAPITAN and the Apple Directory Utility

Hi Guys,
I have to add some Macs to a Windows Server 2012 domain.

I was very excited when I found the Beyondtrust tool here.
http://download1.beyondtrust.com/Technical-Support/Downloads/PowerBroker-Identity-Services-Open-Edition/?Pass=True

It works very well with Yosemite, but it doesn’t work with EL CAPITAN.

The good people at Beyondtrust are planning to create a new version to support EL CAPITAN, but I can’t depend on that, especially when I’m using the Free Open version.

So the other free option is to use the Apple Directory Utility that comes with EL CAPITAN.

Question:
Can somebody please give me a step by step guide to add EL CAPITAN to a Windows Server domain using the Apple Directory Utility?

I tried to do it just using common sense, and I was able to add one computer, but when I restarted and tried to login using a domain account, it came back with the error “Network Accounts are unavailable”

Any help will be greatly appreciated.

Thanks in advance.
cargexAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

serialbandCommented:
It's easier to just join the domain from System Preferences --> Users and Groups.  Click on Login Options.  Once you've bound your Mac to AD, you can use Directory Utility to adjust some basic settings.

The main thing with Directory Utility is to Select Active Directory and click the Pencil Icon to edit.  Once opened, click on the triangle to expand the options.  The only thing you might click on is the Create mobile account at login if you have a laptop or any system that's not always connected to the AD.  This caches the login credentials so that the user can still log in with their AD account even when the AD isn't available.  Otherwise it's all the same.

The free PowerBrokerOpen shouldn't give you much more extra.  I've only ever used pbis for linux systems, since Macs already have their own built in method to bind to the domain for Single Sign On.  The only real advantage to PowerBrokerOpen is that you can more easily join an AD domain from the command line with the same single line syntax as all your other Linux and Unix systems, so you can mass script them.  The Mac command line commands for joining a domain requires several steps.
cargexAuthor Commented:
Hi Serialband,
Sorry for the delay.

I have followed your instructions and the computer gets added to the domain.

My guess is that once the Directory Utility gives me the "green light" signifying that it is connected to the domain, I can logout from the local account and login with a network account.

Now once I logout, when I type a network account in the username space a red icon pops up and it says "Network accounts are unavailable".
The Mac is connected to the network, and if I login with the local account again, and open the directory utility it still tells me that it is connected (green light).

So what am I doing wrong here?
serialbandCommented:
That "Network accounts are unavailable" message means that you don't have network access and therefore can't authenticate a new account.  Is this a laptop?  Are you on WiFi?  If you're using a laptop or are on Wifi you lose network connectivity when you are on the login screen.  If you have a wired network connection, you shouldn't have a problem.  If these are desktops you should use Ethernet cables, otherwise you're going to have to work around this limitation on the Mac.

I suggest you stay logged in and select Login Window from the pull down menu under the Account name in the top right of the screen and log in to the network user account.  If you've checked the option to automatically create a mobile account, then you will have a mobile account and won't lose the credentials when you log out.

The other method is to manually add the network account name so that you can switch users.  You will need to open a terminal and add the account name.
 /System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n Account_Name

Open in new window


Once you've added the user, if it's been created/tagged as a mobile account, you will continue to be able to log in with the cached credentials.  You won't need a network connection at the login screen.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
cargexAuthor Commented:
Mr. Serialband,
You are the best, now it works beautifully.
I'm a Mac newbie and still trying to understand how they work, so thank you very much.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Mac OS X

From novice to tech pro — start learning today.