Before you can log in with Active Directory users and manage agent settings for users and computers, you must first join your macOS machine to an Active Directory domain.
Privileged Access Suite for UNIX
Installation
Safeguard Authentication Services macOS agent installation
Safeguard Authentication Services macOS components
Safeguard Authentication Services client configuration
Installing using the graphical system installer
Installing with the wizard
Custom installation
Command line installation
Agent upgrade
macOS agent removal
Joining the Active Directory domain
Special macOS features
Using QAS Join application
Unjoining an Active Directory domain
Command line join
Using Terminal.app to join and unjoin
System changes made by the join process
Verifying the installation and configuration
Logging in with Active Directory accounts
Troubleshooting connections to Windows SMB shares
Automatically mount network home folders
Local administrator rights for users
Active Directory user password hint
Configuring Apple FileVault disk encryption
Limitations on macOS
Group Policy for macOS
Profile-based policy
Certificate Autoenrollment
macOS management modes
Installing profiles on macOS 11.0 and later
Workgroup Manager Settings
Applications Properties
Dock Properties
Energy Saver Properties
Finder Properties
Login Properties
Media Access Properties
Network Properties
Parental Controls Properties
Printing Properties
Software Update Properties
System Preferences Properties
Time Machine Properties
Wireless Profile Properties
Preference Manifest settings
Certificate Autoenrollment on macOS
Certificate Autoenrollment requirements and setup
Glossary
Java requirement: Unlimited Strength Jurisdiction Policy Files
Installing certificate enrollment web services
Configuring Certificate Services Client - Certificate Enrollment Policy Group Policy
Configuring Certificate Services Client - Auto-Enrollment Group Policy
Configuring Certificate Templates for autoenrollment
Using Certificate Autoenrollment
Troubleshooting Certificate Autoenrollment
Certificate Autoenrollment process exited with an error
Enable full debug logging
Pulse Certificate Autoenrollment processing
Manually apply Group Policy
Command line tool
Safeguard Authentication Services client configuration
Safeguard Authentication Services client configuration
Joining the Active Directory domain
Safeguard Authentication Services provides both a graphical option and a command line option for joining the domain.
NOTE: You cannot manage agent settings by means of Safeguard Authentication Services Group Policy if you have joined with the Apple-provided Active Directory plug-in. If you are currently bound to the domain using Apple components, unbind before proceeding.
Using QAS Join application
Safeguard Authentication Services client configuration > Joining the Active Directory domain > Using QAS Join application
To join the domain using the QAS Join application
-
Open the QAS Join application located at /Applications/QAS Join.
-
On the Safeguard Authentication Services dialog, enter the name of the Active Directory Domain you want to join and click Join Domain.
-
On the Join Domain dialog, enter the Active Directory credentials to be used to join the domain.
From this dialog you can also specify a number of optional join arguments before continuing with the join operation. For example, you can specify a specific Active Directory container in which you want to create the new computer object (by default, it is created in the Computers container). For a detailed explanation of each join option, see the vastool man page located in the docs directory of the installation media.
-
Click OK to run the join operation.
The join operation may take several seconds, to several minutes depending upon your domain configuration. Domain Join progress is continuously updated as progress proceeds.
-
If any errors occur during join, an error dialog opens with a detailed error message as well as the option to view and save the join process log. As an example, the error message below is seen if you specified an incorrect password for the account you are using to join to the domain.
Unjoining an Active Directory domain
Safeguard Authentication Services client configuration > Joining the Active Directory domain > Unjoining an Active Directory domain
To leave the Active Directory domain, repeat the join steps, except click Leave Domain instead. You do not have to supply Active Directory credentials when unjoining if you do not delete the Active Directory computer object. This option is available in the Leave Domain dialog options.