opendirectoryd Scripting directory services events is one of the most common ways that the OS X community automates post-imaging tasks. As such, there are about as many flavors of directory services scripts are there engineers that know both directory services and have a little scripting experience. In OS X Lion, many aspects of directory services change and bring with them new techniques for automation. The biggest change is the move from DirectoryService to opendirectoryd. In Snow Leopard and below, when you performed certain tasks, you restarted the directory services daemon, DirectoryService. The same is true in Lion, except that instead of doing a killall on DirectoryService, you do it on…
-
-
Article on Directory Services Plug-ins on AFP548
I published an article up on AFP548 on how directory services plug-ins work. If you’re curious about directory services plug-ins or just unable to sleep and need something to knock you out, this should be an interesting read.
-
Mac OS X: Force LDAP Signing using dsconfigad
dsconfigad did not support signing of LDAP packets in 10.4.x. However, this was an upgrade that was introduced in the 10.5 version of the AD Plug-in. Provided that your Active Directory environment uses LDAP signing, a standard policy with DCs, you can mirror your settings on the DC in dsconfigad by using the -packetsigning option followed by either an allow, disable or require variable. To force LDAP signing, just run the following command: dsconfigad -packetsigning required To then disable signing if your environment doesn’t support it use the following command: dsconfigad -packetsigning disable The default variable is allow, which will use LDAP signing when possible.
-
Mac OS X Server 10.5: Customizing Trust Time for the adplugin
You can use the adplugin to customize the amount of time a client is trusted by Active Directory. It can be done by using the following command: dsconfigad -passinterval 30
-
Mac OS X: adplugin and printers
To find all the printers you have available through Active Directory: dscl ‘/Active Directory/All Domains’ -list /Printers PrinterURI
-
Bind to AD Using the Command Line
dsconfigad can be used to bind to Active Directory from the command line. Use as follows: dsconfigad -h dsconfigad -show [-lu username] [-lp password] dsconfigad [-f] [-a computerid] -domain fqdn -u username [-p password] [-lu username] [-lp password] [-ou dn] [-status] dsconfigad -r -u username [-p password] [-lu username] [-lp password] dsconfigad [-lu username] [-lp password] [-mobile enable | disable] [-mobileconfirm enable | disable] [-localhome enable | disable] [-useuncpath enable | disable] …
-
Mac OS X: Namespace support?
Tiger does not have any namespace support in dsconfigad. So no multi-domain same account name functionality. Hint: Might be in Leopard (might not).