Relution Signet Customer Hub

Active Directory

With Relution it is possible to configure macOS devices in such a way that login with accounts from a Windows domain is possible. The domain controller must be accessible for this.

Prerequisite

The usual requirements for the domain controller apply. The following instructions are based on tests and experience with a Windows Server 2019 Standard Edition.

  • Domain Controller
  • Administrative permissions in the domain
  • The macOS device must be able to resolve FQDN from domain controller. (Entry in the hosts file is not sufficient).
  • The macOS device must be able to reach the domain controller
  • Computer account in the domain

Configuration of the Active Directory policy

The configuration shown here is only an example and has been tested with macOS 13 and higher.

  1. The Active Directory configuration is added to a policy for macOS.

  2. At least the following parameters are configured:

    OptionValue
    Name (optional)Name of the configuration; if left empty, the value of Active Directory domain to join is used
    Active Directory domain to joinName of the domain (e.g. relution.loc)
    User name of the account for the domainUsername of a domain administrator
    Password of the account for the domainPassword of the domain administrator
    Create a mobile account at loginON
    Active Directory groups with admin access (optional)DOMAIN\Group-name

    The only required field is Active Directory domain to join; the value must be a valid host name. The portal does not enforce user name and password, but they are needed to join the domain.

  3. Once the policy with the configuration has been applied to the Mac, the Mac should be restarted in any case to reduce login problems.

Optional settings

In addition to the parameters above, the configuration offers further settings that are only set when needed:

  • General: Client ID defines the name of the computer object in the domain. Allow authentication from any domain in the namespace permits logins from all domains of the forest.
  • Accounts: Organizational unit to add the joining computer object to defines the OU for the computer account. For the mobile account, Warn before creating the mobile account, Force a local home directory, Network home protocol (AFP or SMB), Use UNC path from Active Directory to derive the network home location, Default user shell and Primary user account naming convention (Domain or Forest) are available.
  • Advanced Options: Preferred domain server, Interfaces allowed for dynamic DNS updates, Packet signing policy, Packet encryption policy, the mapping of UID, GID and group GID to AD attributes, and Number of days before requiring a change of the computer trust account password (0 to 3650; 0 disables the change and is the default).

Further configuration

To enable login on a Mac, the Login Window configuration must also be added. The following parameters must be activated there:

  • Show name and password fields instead of user list
  • Show network users
  • Show ‘Other…’ in user list

The Login Window configuration is only available for devices with device enrollment, not for devices with User Enrollment →.

Possible Errors

  1. (1) The 'Directory Binding Account' payload could not be installed. Attempts to bind to the server 'rltn.mway' returned an unspecified problem. (-319)

    • It should be checked whether a computer account with the name of the device exists on the DC.

  2. (1) The 'Account for mounting in directories' payload could not be installed. The server 'rltn.mway' was not found or is not responding.

    • It should be checked whether the domain controller can be reached from the Mac. The FQDN must be resolvable.