Map the group ID to an Active Directory attribute in Directory Utility on macos 12

How did you do the mapping in the past? I've been binding Mac's to Active Directory for years and never actually needed to map UID, User GID nor Group GID to custom attributes. The detected defaults have always worked just fine. The mobile accounts pickup the default bindings.

Try binding without specifying any of the mappings. Then open Terminal and use the "id" command:

id user@domain.org 

It should return uid=##########, gid=##########(DOMAIN\Domain Users), groups=##########(DOMAIN\Domain Users), <all other group membership attributes>

The only reason you should require custom mappings is if Univention UCS did something unorthodox in their SAMBA 4 configurations.

Changing User and Group Mappings

By default, the Active Directory connector generates a unique user ID, or UID—dsAttrTypeStandard:UniqueID—for an Active Directory user record based on that user’s GUID attribute. The calculated UniqueID is unique across the domain, yet consistent across every Mac OS X computer in the domain. Likewise, the Active Directory connector generates a unique integer for each Active Directory group record as well (dsAttrTypeStandard:PrimaryGroupID).

However, if you have extended your Active Directory schema, or if you have appropriate values populated in the RFC2307 attributes (which are already part of the Active Directory schema in domains hosted by Windows Server 2003R2 and later, but are not populated by default), then you can use the Mappings pane to access these attributes.

The defaults should be enough without custom Mappings being set.

The Mappings pane, shown in the following figure, allows you to change the mappings for the following standard attributes:

• UID—dsAttrTypeStandard:UniqueID
• User GID—dsAttrTypeStandard:PrimaryGroupID
• Group GID—dsAttrTypeStandard:PrimaryGroupID

The point I was trying get across was that macOS really only uses AD for authentication. There are no GPO features in macOS. It's primarily for AD authentication and groups with Kerberos. All of which you can accomplish without binding the Macs to the domain.

Using NoMAD, Apple Enterprise Connect, Apple Kerberos SSO Extension or JAMF Connect removes the requirement to bind a Mac to a domain. All the authentication works and sync's the AD password to the local account on the Mac. When changing AD passwords, they get out of sync unless you are on a LAN all the time. Changing your password may result in complications with FileVault2 encryption as the pre-boot encryption password won't always update. NoMAD when it next connects to the domain will alert the user that the password on the network changed and prompts to them to authenticate and it will sync the new password to the local account, the keychain and the FileVault2 password. It also works better this way with FV2 recovery keys as there are problems with a traditional AD mobile user account. While a local account works fine.

You may be better served by asking this question at the MacAdmins Slack Channel. https://www.macadmins.org

Most enterprise IT departments are moving away from directly binding Macs to on-prem Active Directory. In favor of using Apple Kerberos SSO tooling introduced in Catalina or the venerable NoMAD Utility or if they have JAMF Pro MDM, the JAMF Connect add-on which is the big brother to the open source NoMAD that adds OKTA, Ping, AzureAD, etc. Everything is moving to the cloud, some companies are even choosing alternatives to Active Directory such as Jump Cloud, etc.

Apple's excellent tooling for ZeroTouch Deployment, Apple Business / Education and a cloud hosted MDM solution such as JAMF or a myriad of others makes it possible to ship Apple products direct to the user still in the shrink wrap and as soon as they connect online they are routed to the company MDM where they auto-enroll and are configured with no technicians needing to touch the device. This works for iPhones, iPads, AppleTV's and Macs.

By not using the macOS Active Directory plugin you avoid problems with sync'ing the password on the Mac. NoMAD stands for No More Active Directory and it does not require binding the Mac to AD. You sign-in to AD with NoMAD and it will sync the local account with the AD account, update the keychain and FileVault2 password. It will also SSO authenticate to anything with Kerberos. The Apple Kerberos SSO extension does much the same.

Most companies are moving storage to the cloud with OneDrive, Box.net, etc.