More Integration With Active Directory

Integration with Active Directory does not stop with simple login support; other, more subtle features are supported through the plug-in:

• Users who have successfully logged in to Mac OS X can change their password through System Preferences. If the Active Directory administrator has password policies in place, they are fully enforced.

  

• Depending on the plug-in configuration, members of Active Directory admin groups will be treated as administrators.

  

• Address Book and other applications that use Address Book for contact searches can now search Active Directory for contact information.

  

• The command-line tool dsconfigad can be used to set all Active Directory bind settings shown in the plug-in. Because it's a command-line tool, it can be used in shell scripts. And since AppleScripts can call shell scripts, dsconfigad can be used with AppleScript as well. A login hook shell script that binds a computer to an Active Directory domain the first time the computer is booted without user or administrator interaction can be very useful when doing mass deployment of Mac OS X systems within an Active Directory environment.

Exploring the Active Directory Plug-in

In this exercise, you will explore the various options of the Active Directory plug-in and its counterpart, dsconfigad.

1.	Open Directory Access, located in /Applications/Utilities.
2.	Select the Services tab, and double-click the Active Directory plug-in to open it.
3.	Click the disclosure triangle on the left to show the advanced options.
4.	Click each option to observe the various choices you have when binding to an Active Directory domain.
5.	Close the plug-in, quit Directory Access, and open a Terminal window.
6.	Type man dsconfigad and press the Return key to view the man page for dsconfigad.
7.	Press the Space bar to view more of the man page. The dsconfigad tool is well documented.
8.	Quit the Terminal.