Tag Archives: Active_Directory

MacOS – Add Active Domain group to local mac group

In testing, we found that remote connections from windows clients to the built-in macOS VNC server were not encrypted in any way. To resolve this we decided to use RealVNC as the screen sharing server on Macs. Also, since we envision making these remote lab computers available to only a few individuals that have no other way to access critical academic software, I needed a way to restrict which users could authenticate to create the VNC screen sharing sessions.

The following steps are how I enabled this access on our AD joined lab macs where our users are NOT given administrative rights on the macs with the AD join: (This was tested on MacOS 10.14.5 Mojave.)

1) Create the group in your Active Domain using Users and Groups. If you do not have access to AD Users and Groups, talk to your AD domain administrator BEFORE continuing this! Someone needs to be able to add users to the AD group that is created. If that isn’t going to be you figure that out before proceeding! This AD group should be a “global” group. In the example below I have used “LabUsers” as the AD group name.

2) Log into the mac that will be the VNC server with an administrative account.

3) If on, disable the default MacOS screen sharing and remote login in System Preferences.

4) Install RealVNC Server.

5) Create the local mac group. In the example below the local mac group I created was “RemoteUsers”.

6) In the options for the RealVNC server for Users and Permissions, add the local mac group “RemoteUsers” as a group that is authorized to open a screen sharing session. Also, so that you know, in the Security tab of RealVNC server options I use”Mac Password” for the authentication method with encryption “Always on”.

6) Open a Terminal window on the mac and give the following command: (This should NOT be done as super user! I don’t know why but that doesn’t work)

dseditgroup -o edit -n /Local/Default -u localadminusername -p -a "AD_Domaim\LabUsers" -t group RemoteUsers

( In the above command /Local/Default refers to the local directly node for authentication information. Also, the ” ” are required around the AD_Domain\LabUsers so that the \ isn’t interpreted as an escape and with “-p” this will prompt you for the password for your localadminusername which is required )

Note that you may never be able to see this AD group listed as a member of the local mac group! All I ever got was the above command to run without any errors or feedback.

7) Once the command above completes without error, only those AD users that are listed in the AD group should be able to authenticate to the VNC server using the username format below. All other users of the mac that would generally be able to log into the mac but that are not in the AD group, will get an “Access Denied” message when attempting to open the screen sharing connection.

Other useful commands: (using “RemoteUsers” as the example local mac group name)

To list local mac group membership: (this will not list the AD group! If you know of another way, please let me know!)
dscl . read /Groups/RemoteUsers GroupMembership

To list local mac Group properties:
dscl . -read /Groups/RemoteUsers

When researching this I found this post particularly useful:
https://blog.travismclarke.com/post/osx-cli-group-management/

Mac – NoMAD – AD functionality to macs without binding

You can add AD functionality to a Mac without having to “Bind” it to the domain …

See:
See: https://www.nomad.menu/

Mac – Active Directory Debugging and Logs

To debug an Active Directory binding issues

First set the directory error logging to “debug” with:
sudo odutil set log debug

then try the join …

set the error logging back to “error” with:
sudo odutil set log default

You’ll find the log file in:
/var/log/opendirectoryd.log

An excellent reference article with additional tips is at:
https://derflounder.wordpress.com/2012/03/29/diagnosing-ad-binding-problems-from-the-command-line/

Mac – Set NTP time server from command line

Active Directory login, Keyserver access, SafeConnect, etc all require the connecting client to have a time setting that is within 5 minutes or so of the server’s time setting. It is therefore useful to use a “network time protocol” server to set your local computer’s time to the “correct” time.

Macs typically use “time.apple.com” to set their time from the network. This is fine most of the time. 😉

In the rare times you want to set a different time server on a Mac, use Terminal and enter the command:

sudo systemsetup -setnetworktimeserver <timeserver>
(replace <timeserver> with the address of the time server 
you want to use as in 137.165.4.21 for Williams College)

Since this is a command run with “sudo”, you’ll be asked to enter the account password and that account needs to be authorized as a “Super User” or “root” user.

By the way – the GUI interface in the “Date & Time” System preference only allows you to choose time servers hosted by Apple.

For more details see the web page at:

http://hints.macworld.com/comment.php?mode=view&cid=98039

Mac – AD – Computer Check-In Interval

You’ll want to look at ‘dsconfigad -passinterval’
There’s no description for it in the manpage other than the usage syntax.
By default it’s set for 14 days. You can see the setting by running
‘dsconfig -show’.

-Eric

On 5/10/12 8:54 AM, “Steve Howe” wrote:

> I can’t answer for the built in as we don’t deploy that anymore but
> the Centrify has a timescale that can be set for how long the
> credentials are cache for. I would expect the built in Apple plugging
> to have a similar setting somewhere under the hood.
>
>
>
> On 10 May 2012, at 13:32, Eddie Wettach wrote:
>
>> We are about to deploy several hundred Macbook Airs (10.7.3) that are
>> bound to Active Directory (Windows 2008 R2). Our question is that if
>> these computers go off campus for a month and then come back will
>> everything still work? I have heard murmors of a machine password
>> that is initatied by the client and that if it doesn’t check in within
>> 30 days then the machine loses its bind or connection to Active
>> Direcotry? Is this true? Is there a way to change this to a longer
>> interval? Any other issues you can see with clients being off the
>> local network for that time?
>>
>> P.S. Our users will login once on campus to setup the mobile account.
>> They will then take them home for about a month and then bring them
>> back on campus.
>>
>> Thanks
>> – Eddie Wettach
>>
>> _____________________________________________________
>> MacEnterprise, Inc
>> http://www.macenterprise.org
>>
>> Subscription Options and Archives
>> http://lists.psu.edu/archives/macenterprise.html
>
> _____________________________________________________
> MacEnterprise, Inc
> http://www.macenterprise.org
>
> Subscription Options and Archives
> http://lists.psu.edu/archives/macenterprise.html

This electronic message, including any attachments, may contain proprietary, confidential or privileged information for the sole use of the intended recipient(s). You are hereby notified that any unauthorized disclosure, copying, distribution, or use of this message is prohibited. If you have received this message in error, please immediately notify the sender by reply e-mail and delete it.

_____________________________________________________
MacEnterprise, Inc
http://www.macenterprise.org

Subscription Options and Archives
http://lists.psu.edu/archives/macenterprise.html

Mac – AD Authentication to non-primary domain controllers details

Here are some details on how to make sure your non-primary AD authentication servers are available to macs running snow leopard …

This comes from the MACENTERPRISE list which always provides a wealth of information for people who support Macs …

======================================

Subject: Re: Mac Login issue
From: Tim Perfitt
Reply-To: Mac OS X enterprise deployment project
Date: Wed, 23 Feb 2011 20:14:28 -0600
Content-Type: text/plain
Parts/Attachments:

text/plain (64 lines)

There is no way to manually enter in the DCs, as this information is based on site. The important thing to check is that the SRV records for the DCs that are in your site are advertised at the top level of AD DNS as well. You can see which DCs are available by turning on verbose DS logging and looking at the logs:

sudo defaults write /Library/Preferences/DirectoryService/DirectoryServiceDebug “Debug Logging Priority Level” -integer 7
sudo touch /Library/Preferences/DirectoryService/.DSLogDebugAtStart
sudo killall DirectoryService

open Console and filter on “tory:” for this log: /Library/Logs/DirectoryService/DirectoryService.debug.log

You should see some lines like these:

2011-02-23 19:26:38 CST – T[0x0000000101981000] – Active Directory: Processing Site Search with found IP
2011-02-23 19:26:47 CST – T[0x0000000101981000] – Active Directory: Site found of – Default-First-Site-Name
2011-02-23 19:26:47 CST – T[0x0000000101981000] – Active Directory: Adding Server –

In order for a DC to be used, it must :

1. Have ldap and kerberos service records in the site specific DNS service records (_ldap._tcp.sitename._sites.dc._msdcs.domain.name and _kerberos._tcp.sitename._sites.dc._msdcs.domain.name)
2. Have its kpassword service records in the top level dns records (_kpasswd._tcp.domain.name)

If a DC fails either of those tests, it is not used. If you see “Adding Server – “, you know that it passed those tests and would be used in case of a failure and for load balancing.

The rules for GC are a bit different, since it doesn’t care about _kerberos or _kpassword (GCs aren’t used to to authenticate users or change passwords). The important thing for GCs is that the _ldap records are in the site specific DNS entries (_ldap._tcp.sitename._sites.gc._msdcs.domain.name). Again, if you see “Adding Server” in the GC section:

2011-02-23 19:26:51 CST – T[0x0000000101C10000] – Active Directory: Global Catalogs – Start checking servers for site “Default-First-Site-Name”

then you know it passed that test.

HTH,

tim

On Feb 23, 2011, at 11:15 AM, Logston, Alan wrote:

> When I came into work this morning and got a call that an entire Mac instructional lab would not allow domain/Student logins. Soon I got three more calls complaining of the dame situation all over campus. There was a very small handful of Macs able to authenticate and all the PCs were still logging in just fine.
>
> I dug into the problem and discovered that the Domain controller DC-1 was down. The PCs were falling back to other servers to authenticate but the Macs were only trying to authenticate to DC-1
>
> In the “Directory Utility” I have “Prefer this domain server” Blank. I thought this would make it so the Mac would auto discover the other authentication servers like the PCs.
>
>
> Is there any way I can manually enter these severs so this problem will not happen again?
>
>
>
> Thanks,
>
>
> Alan
> ITS
>
>

Windows – AD Management with PowerShell

Apparently, it is now possible to manage the AD with PowerShell. Since the GUI for active domain users and computers can typically only make changes one account at a time, this powershell access could be handy when you have to manipulate multiple accounts at once:

http://www.scriptlogic.com/smbit/article/track-user-password-expiration-using-active-directory?elq_mid=2220&elq_cid=786672&elq=938d349e11c845d681800dccd9b9246a

Mac – DeployStudio and AD join

Deploying a Mac OS image and adding the computer to the AD can all be accomplished using DeployStudio. I suggest that you set up your AD environment to use “OUs” (organizational units) for your computers rather than have them all in the one default “computers” OU. I have two production OUs of “Labs” and “Labs-Macs”. I’ll explain the “Labs” OU structure for windows in a different post …. For now, just add computer accounts for all your macs to an OU. The computer accounts should match exactly the host names you are using just like you would do for windows.

Then in DeployStudio –
Add the computers and set their “Local Hostname” and “Computer Name” to the same thing you entered in the AD for their computer accounts. Your workflow for the deployment should include a step to rename the mac and after that step the AD binding. In that AD binding window be sure to set the fields for the domain to join and the computers node. Here is a screen shot of my set-up …

Lynna Jackson

Lab/Classroom Computer and Software Managment