Newsroom Update

Beginning in May, a special Today at Apple series titled “Made for Business” will offer small business owners and entrepreneurs free opportunities to learn how Apple products and services can support their growth and success. Learn more >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Good tutorial for adding windows PC to Open directory

Hi all,
I've tried unsuccessfully for the last few hours to add windows computers to our Open directory. I have followed the instructions on page 85 of the Open Directory 10.5 Admin guide. However, whenever I try to make a Windows 7 workstation join the domain, I receive the error that I'm not authorized to add the machine. Any idea's what's going on? According to kerberos logs the password I'm not allowed to authenticate the machine (the windows one I'm trying to add).

Thanks,
Todd

MacBook Pro, Mac OS X (10.5.2)

Posted on Sep 16, 2009 10:09 PM

Reply
1 reply

Sep 17, 2009 9:22 PM in response to tnine

Just to be clear, this is what I've done

Chapter 5 Setting Up Open Directory Services 85
Setting Up a Primary Domain Controller
Using Server Admin, you can set up Mac OS X Server as a Windows primary domain
controller (PDC). The PDC hosts a Windows domain and provides authentication
services to other domain members, including authentication for domain login on
Windows workstations.
If no domain member server is available, the PDC server can provide Windows file and
print services, and it can host user profiles and home folders for users who have user
accounts on the PDC.
Important: When setting up Mac OS X Server as a PDC, make sure your network
doesn’t have another PDC with the same domain name. To set up more domain
controllers, make them backup domain controllers (BDCs).
To set up a Windows PDC:
1 Make sure the server is an Open Directory master.
To determine whether a server is an Open Directory master, open Server Admin, click
the triangle (to the left of the server), select Open Directory in the expanded list of
services, then click Overview.
The first line of status information states the role of the Open Directory server.
2 Open Server Admin and connect to the server.
86 Chapter 5 Setting Up Open Directory Services

3 Click Settings, then click Services
4 Select the SMB checkbox, then click Save.
5 Click the triangle to left of the server.
The list of services appears.
6 From the Servers list, select SMB.
7 Click Settings, then click General.
8 From the Role pop-up menu, choose Primary Domain Controller (PDC), then enter the
following:
Â
Description: This description appears in the Network Places window on Windows
computers and is optional.
Â
Computer Name: Enter the name you want Windows users to see when they connect
to the server. This is the server’s NetBIOS name. The name should contain no more
than 15 characters, no special characters, and no punctuation. If practical, make the
server name match its unqualified DNS host name. For example, if your DNS server
has an entry for your server as “server.example.com,” give your server the name
“server.”
Â
Domain: Enter the name of the Windows domain that the server will host. The
domain name cannot exceed 15 characters and cannot be “workgroup.”
9 Click Save.
10 Enter the name and password of an LDAP directory administrator account, then click
OK.
When authenticating, you must use an LDAP directory administrator account. You can’t
use a local administrator account, such as the primary server administrator account
(user ID 501), to create a PDC.
After setting up a PDC, you can change access restrictions, logging detail level, code
page, domain browsing, or WINS registration. Then if Windows services aren’t running,
you can start them. For more information, see Network Services Administration.
Setting Up Windows Vista for Domain Login
You can enable domain login on a Windows Vista computer by joining it to the
Windows domain of a Mac OS X Server PDC. Joining the Windows domain requires the
name and password of an LDAP directory administrator account.
You can delegate this task to someone with a local administrator account on the
Windows computer. In this case, you may want to create a temporary LDAP directory
administrator account with limited privileges. For more information, see User
Management.

Note: Only Windows Vista Ultimate and Business edition can be connected to a
domain.
To join a Windows Vista computer to a Windows domain:
1 Log in to Windows Vista using a local administrator account.
2 Open the Control Panel, then open System.
3 Click Change Settings.
4 Click Computer Name, then click Change.
5 Enter a computer name, click Domain, enter the domain name of the Mac OS X Server
PDC, and click OK.
To look up the domain name of the server, open Server Admin on the server or an
administrator computer, select SMB in the Servers list, click Settings, then click General.
6 Enter the name and password of an LDAP directory administrator and click OK.

Good tutorial for adding windows PC to Open directory

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.