Join Active Directory in OS X Lion

From ITSCWiki

These steps are for joining a OS X Lion AND Mountain Lion to the CLLA AD domain.

NOTE: The AD record must exist prior to joining. Create the computer account first then follow these steps.

1. Open System Preferences (See Figure 1)
   • Or click the Apple in upper left corner then choose System Preferences

   

   Figure 1Click Image to Enlarge

2. Open User & Groups (See Figure 2)

   

   Figure 2Click Image to Enlarge

3. Click Login Options (See Figure 3 - Item #1)
   • Unlock if necessary (See Figure 3 - Item #2)
4. Click Join... (See Figure 3 - Item #3)

   

   Figure 3Click Image to Enlarge

5. At the next Dialog that comes up select Open Directory Utility... (See Figure 4)

   

   Figure 4Click Image to Enlarge

6. In Directory Utility click the Services Tab and select Active Directory then click the Edit button (pencil icon) (See Figure 5)

   

   Figure 5Click Image to Enlarge

7. Once the settings for Active Directory open Make fill the two settings (See Figure 6)
   • Active Directory Domain - clla.ad.tamu.edu
   • Computer ID - computer's name that matches existing AD record
8. Under the User Experience tab make the following changes (See Figure 6)
   • Uncheck Use UNC path...
   • Check Create mobile account at login
   • Uncheck Require confirmation before creating mobile account

   

   Figure 6Click Image to Enlarge

9. Leave all checkboxes unchecked under Mappings tab
10. Make the following changes under Administrative tab (See Figure 7)
    • Uncheck Allow authentication from any domain in the forest
    • Check Allow administration by:
    • Remove existing groups from Allow administration by
    • Add a domain admin group such as CLLA\CLLA dept-admins to the Allow administration by

    

    Figure 7Click Image to Enlarge

11. Enter your AD username and password and do not prefix the username with CLLA\ (See Figure 8)

    

    Figure 8Click Image to Enlarge

12. If prompted to replace existing account choose Replace
13. Once the bind is complete and the Bind button turns to Unbind click Ok to get back to Directory Utility
14. Select the Search Policy tab and under Authentication and Contacts delete the All Domains line.
15. Under both Authentication and Contacts click the + sign to and add the domain path (See Figure 9)
    • For CLLA use /Active Directory/CLLA/clla.ad.tamu.edu

    

    Figure 9Click Image to Enlarge

16. Double check that Authentication looks similar to Figure 10 (Note: /Local/MCX may not always be there)

    

    Figure 10Click Image to Enlarge

17. Double check that Contacts looks similar to Figure 11

    

    Figure 11Click Image to Enlarge

18. Click Apply then close Directory Utility.
19. Back under User & Groups in System Preferences you should see a green orb next to CLLA (See Figure 12)

    

    Figure 12Click Image to Enlarge