Bind to AD using Apple Remote Desktop

Sunday, September 2, 2007

Bind to AD using Apple Remote Desktop

Need to bind a handful of Macs to Active Directory remotely? There are a couple scripts online already, including one from MacEnterprise and from Bombich. But I've never been able to get those to work when using with ARD. Either the AD plugin wasn't activated or AD wasn't added to the authentication path, etc. There's a lot of steps that has to occur to bind and sometimes timing is everything and at first I tried adding sleep commands all over the place but that didn't consistently work either.

So here is the script that is working consistently for us. It is basically Bombich's script slightly modified. His is intended to be used as a loginhook and works well for that purpose, but I needed to make some changes to get it to work over ARD.

There may be some options in there that I removed, so compare to Bombich's script for any options I may have omitted for my use.

You can download it from here or copy & paste from below:

#!/bin/sh

############################ AD_Bind_ARD ###########################
# Patrick Gallagher | patgmac@gmail.com
# http://patgmac.blogspot.com
# This is a script that will bind a Mac to AD from ARD.
# Modified from Mike Bombich's ad-bind-login-tiger.sh script
# which can be found at http://www.bombich.com/mactips/scripts.html
# Needs to be modified for your enviornment
####################################################################

computerid=`/usr/sbin/scutil --get LocalHostName`

# Standard parameters
domain="domain.school.edu" # fully qualified DNS name of Active Directory Domain
udn="username" # username of a privileged network user
password="password" # password of a privileged network user
ou="CN=Computers,DC=domain,DC=school,DC=edu" # Distinguished name of container for the computer

# Advanced options
alldomains="enable" # 'enable' or 'disable' automatic multi-domain authentication
localhome="enable" # 'enable' or 'disable' force home directory to local drive
protocol="smb" # 'afp' or 'smb' change how home is mounted from server
mobile="enable" # 'enable' or 'disable' mobile account support for offline logon
mobileconfirm="disable" # 'enable' or 'disable' warn the user that a mobile acct will be created
useuncpath="disable" # 'enable' or 'disable' use AD SMBHome attribute to determine the home dir
user_shell="/bin/bash" # e.g., /bin/bash or "none"
preferred="-nopreferred" # Use the specified server for all Directory lookups and authentication
# (e.g. "-nopreferred" or "-preferred ad.server.edu")
admingroups="YOURDOMAIN\domain admins" # These comma-separated AD groups may administer the machine (e.g. "" or "APPLE\mac admins")

# Login hook setting -- specify the path to a login hook that you want to run instead of this script

### End of configuration

# Activate the AD plugin
defaults write /Library/Preferences/DirectoryService/DirectoryService "Active Directory" "Active"
plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist
sleep 5

# Bind to AD
dsconfigad -f -a $computerid -domain $domain -u $udn -p "$password" -ou "$ou"

# Configure advanced AD plugin options
if [ "$admingroups" = "" ]; then
dsconfigad -nogroups
else
dsconfigad -groups "$admingroups"
fi

dsconfigad -alldomains $alldomains -localhome $localhome -protocol $protocol \
-mobile $mobile -mobileconfirm $mobileconfirm -useuncpath $useuncpath \
-shell $user_shell $preferred

# Restart DirectoryService (necessary to reload AD plugin activation settings)
killall DirectoryService

# Add the AD node to the search path
if [ "$alldomains" = "enable" ]; then
csp="/Active Directory/All Domains"
else
csp="/Active Directory/$domain"
fi

#dscl /Search -create / SearchPolicy CSPSearchPath
#dscl /Search -append / CSPSearchPath "/Active Directory/All Domains"
#dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
#dscl /Search/Contacts -append / CSPSearchPath "/Active Directory/All Domains"

# This works in a pinch if the above code does not
defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains"
defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3
defaults write /Library/Preferences/DirectoryService/ContactsNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains"
defaults write /Library/Preferences/DirectoryService/ContactsNodeConfig "Search Policy" -int 3

plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist

No comments:

Sunday, September 2, 2007