• Domain name for Active Directory
• User details which can bind your computer to Computer OU

Once you have these details you then need to navigate to finder and go to Macintosh HD/System/Library/Core Services and run the Directory Utility App. If you are struggling to find this you can search for Directory Utility in the spotlight search at the top right of your screen.

Once you load Directory Utility it will look like the following.

Then you need to select Active Directory and then click the pencil down the bottom left. If you cannot access the pencil you may need to unlock by click the pad lock and authenticating.

Then a pop up will appear like the following.

Then you simple fill in the fields required then click Bind and then your Mac will be binded to your Active Directory server.

This can start to be a problem if you make a certificate change to the “Default website” directory as it inherits all settings.

#!/bin/sh

#####################################
#Created by Ross Hamilton
#Clock restart / Remove existing settings
#Join to Open Directory and Active Directory
#
#####################################

#Restart ntpdate
StartService ()
{
if [ "${TIMESYNC:=-YES-}" = "-YES-" ] &&
! GetPID ntpd > /dev/null; then

CheckForNetwork

if [ -f /var/run/NetworkTime.StartupItem -o "${NETWORKUP}" = "-NO-" ]; then exit; fi
touch /var/run/NetworkTime.StartupItem

echo “Starting network time synchronization”

# Synchronize our clock to the network’s time,
# then fire off ntpd to keep the clock in sync.
ntpdate -bvs
ntpd -f /var/run/ntp.drift -p /var/run/ntpd.pid
fi
}

# Remove exisiting
logger “Removing existing DS Config”

if [ ! -d "/Library/Preferences/DirectoryService/ActiveDirectory" ]; then
rm -R /Library/Preferences/DirectoryService/ActiveDirectory*
fi

if [ ! -d "/Library/Preferences/DirectoryService/DSLDAPv3PlugInConfig" ]; then
rm -R /Library/Preferences/DirectoryService/DSLDAPv3PlugInConfig*
fi

if [ ! -d "/Library/Preferences/DirectoryService/SearchNode" ]; then
rm -R /Library/Preferences/DirectoryService/SearchNode*
fi

if [ ! -d "/Library/Preferences/DirectoryService/ContactsNode" ]; then
rm -R /Library/Preferences/DirectoryService/ContactsNode*
fi

if [ ! -d "/Library/Preferences/edu.mit.Kerberos" ]; then
rm -R /Library/Preferences/edu.mit.Kerberos
fi

# Restart DirectoryService (necessary to reload AD plugin activation settings)
killall DirectoryService

# BInd machine to OD
dsconfigldap -v -sgme -a MACSERVERNAME # fully qualified DNS name of Macserver

computerid=`/usr/sbin/scutil –get ComputerName`

# Standard parameters
domain=”DOMAIN>COM” # fully qualified DNS name of Active Directory Domain
udn=”DOMAIN USERNAME” # username of a privileged network user
password=”PASSWORD” # password of a privileged network user
ou=”CN=Computers,DC=DOMAIN,DC=COM” # Distinguished name of container for the computer

# Advanced options
alldomains=”enable” # ‘enable’ or ‘disable’ automatic multi-domain authentication
localhome=”disable” # ‘enable’ or ‘disable’ force home directory to local drive
protocol=”smb” # ‘afp’ or ‘smb’ change how home is mounted from server
mobile=”disable” # ‘enable’ or ‘disable’ mobile account support for offline logon
mobileconfirm=”disable” # ‘enable’ or ‘disable’ warn the user that a mobile acct will be created
useuncpath=”enable” # ‘enable’ or ‘disable’ use AD SMBHome attribute to determine the home dir
user_shell=”/bin/bash” # e.g., /bin/bash or “none”
preferred=”-nopreferred” # Use the specified server for all Directory lookups and authentication
# (e.g. “-nopreferred” or “-preferred ad.server.edu”)
admingroups=”" # These comma-separated AD groups may administer the machine (e.g. “” or “APPLE\mac admins”)

# Login hook setting — specify the path to a login hook that you want to run instead of this script

### End of configuration

# Activate the AD plugin
defaults write /Library/Preferences/DirectoryService/DirectoryService “Active Directory” “Active”
plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist
sleep 5

# Bind to AD
dsconfigad -f -a $computerid -domain $domain -u $udn -p “$password” -ou “$ou”

# Configure advanced AD plugin options
if [ "$admingroups" = "" ]; then
dsconfigad -nogroups
else
dsconfigad -groups “$admingroups”
fi

dsconfigad -alldomains $alldomains -localhome $localhome -protocol $protocol \
-mobile $mobile -mobileconfirm $mobileconfirm -useuncpath $useuncpath \
-shell $user_shell $preferred

# Restart DirectoryService (necessary to reload AD plugin activation settings)
killall DirectoryService

# Add the AD node to the search path
if [ "$alldomains" = "enable" ]; then
csp=”/Active Directory/All Domains”
else
csp=”/Active Directory/$domain”
fi
sleep 5

# This works in a pinch if the above code does not
defaults write /Library/Preferences/DirectoryService/SearchNodeConfig “Search Node Custom Path Array” -array “/Active Directory/All Domains” “/LDAPv3/FILL IN MAC SERVER LDAP k” # ‘Fill in this section with mac server
defaults write /Library/Preferences/DirectoryService/SearchNodeConfig “Search Policy” -int 3

plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist
Dsconfigad -passinterval 0
sudo killall DirectoryService

Please feel free to contact me with any download suggestions.

Solution

In order to authenticate Active Directory users and/or users stored in other third-party LDAP servers, you must enable clear text authentication for wikid. Note: In order to prevent sending passwords in the clear across the network, it is recommended that you also configure the wiki server for SSL.

Enabling clear text authentication for wikid

Open Terminal and type these commands on one line each:

sudo serveradmin settings teams:enableClearTextAuth = yes
sudo serveradmin stop teams
sudo serveradmin start teams

Taken from http://support.apple.com/kb/TS1619

Deploy studio offers the same as netrestore with many other potentials. A few extras I have found to be helpful are the following.

1. Capture of image over a netboot image. (This means no need to take image then copy to the server. It can all be done from the same netboot for imaging)
2. Easy to alter settings and make new workflows (All done from an admin console)
3. Options for adding a new image to active directory as a post action script.
4. No long waiting for changing a net install set.

Instead of explaining how to setup deploystudio you may find it more helpful to read the quick install guide on the deploystudio website. You can access it by clicking HERE.

In order to restrict students and teachers from playing around with the operating system you will need a mac server. Now in most cases you hear the word “server” and expect a mass of expenses. Well that is where Apple most definitely have an advantage over Microsoft for its great cost for licencing.

So here is what you need and this is the cheapest option. 

The Hardware 

First you will need the hardware to drive the server software. 

The minimum Spec for OS X 10.5 is the following

Mac server or desktop computer with an Intel, PowerPC G5, or PowerPC G4 (867MHz or faster) processor; 1GB of physical RAM; 20GB of available disk space.

Extracted from Apple.com

Now the cheapest option for this is to use a Macmini

MacMini (Due Refresh)

1.83GHz or 2.0GHz Intel Core 2 Duo processor
Up to 2GB memory
Intel GMA 950 graphics processor
DVI connector, VGA adapter
Slot-loading optical drive
Up to 160GB hard drive
Built-in Gigabit Ethernet
Expansion via USB and FireWire

Average Education price exp: £330 + Vat

The Software

Now you have the hardware which will come with OS X 10.5 you will need to install OS X 10.5

To take you over the features I may as well write a whole book. To find out more information as to what 10.5 server has to offer you can visit the Apple site page on OS X 10.5 Server or you can click HERE

The average price for OS X 10.5 server is £350 + Vat 
This price includes unlimited client access. 

Remote Management

Now you have your server setup you will now want to be able to see what is happening on your network. This is where once again Apple has made another product which makes all of us Network Administrators happy. One product which allows administrators to view an entire network with thumb nails. One product which allows you to Remotely install software, send unix commands, lock computers and share screens plus many many more. 

Average price for remote desktop 3 is £240  + Vat
This price includes unlimited client access

SO as you can see above it cost less than £1000.00 to have a Apple server with no hidden or extra costs. 

To see the UK Education price list from Apple you can visit their education store by clicking HERE 

If you wish to deal with someone in your area you can contact a Apple reseller by visiting HERE

If you have a query on any prices feel free to contact me and I can tell you if you are paying a fair price.

Over these past few weeks I have been trialing the freeware software called deploystudio. To give you a little background as to what deploy studio has to offer.

• Imaging of OSX
• Imaging of Windows XP/Vista
• The ability to have a net install for all images
• No need for several net installs like net restore or OS X Netinstall
• The ability to bind OS X installs to Open Directory and Active directory as post action.
• Ability to auto partition and reimage