This guide outlines how to configure macOS Directory Settings within the Mobile Guardian Dashboard to enable directory binding for managed Mac endpoints using Active Directory or Open Directory/LDAP.
macOS Directory Binding
Configuring macOS Directory Settings allows administrators to centrally bind managed Mac endpoints to an enterprise directory service. This enables domain users to authenticate on corporate Mac hardware using their standard directory credentials while automatically provisioning local accounts and mapping home directories.
Directory Configuration Parameters
Select Directory Service: Directory Type.
Log in to the Mobile Guardian Dashboard, navigate to Settings > Directory Settings > MacOS Directory Settings and choose your directory architecture:
- Active Directory: Binds macOS endpoints to Microsoft Active Directory domains.
- Open Directory / LDAP: Binds macOS endpoints to Apple Open Directory or RFC 2307-compliant LDAP directory servers.
Configure Connection Parameters: Server Credentials.
Input the required directory server binding details:
- Hostname: The Fully Qualified Domain Name (FQDN) or IP address of the primary directory server.
- Username & Password: Administrative credentials authorised to join computer objects to the directory.
- Client ID: Designated client identifier or workstation naming convention.
- Organisational Unit (OU): Target Active Directory OU container path where computer objects will be created.
Configure Mobile & Local Home Directory Options: User Accounts.
Set end-user account creation behaviours upon login:
- Create mobile account at login: Enables local caching of domain user accounts, allowing employees to sign in even when offline or disconnected from the corporate network.
- Require confirmation before creating mobile account: Prompts users to confirm before generating a local mobile account profile.
- Force local home directory on startup disk: Creates the user's home directory locally on the Mac startup volume rather than mounting a network drive.
- Use UNC path from Active Directory to derive network home location: Resolves home folder paths using Active Directory smb: network paths.
Configure Mount Style, Shell & Device Scope: Network & Shell.
Finalise system environment settings:
- Mount Style: Select the network file sharing protocol used to mount network home directories (SMB or AFP).
- Default User Shell: Define the default Command Line Interface (CLI) environment assigned to domain accounts (e.g., /bin/zsh or /bin/bash).
- Device Serial Numbers: Specify target Mac serial numbers or device tags to limit payload deployment to eligible Mac assets.
Commit Directory Profile: Save & Deploy.
Click Save to push the directory binding profile payload to eligible macOS endpoints during their next refresh cycle.
Open Directory / LDAP Configuration
The Open Directory / LDAP option provides a streamlined configuration tailored for Apple Open Directory servers or standard RFC-compliant LDAP directory systems.
Hostname: The Fully Qualified Domain Name (FQDN) or IP address of the Open Directory or LDAP server.
Username: The administrative or service account username used to authenticate and bind to the LDAP directory server.
Password: The password associated with the directory service account.
Client ID: The unique client identification string assigned to the binding endpoint.
Device Serial Numbers: Specific macOS hardware serial numbers or asset tags designated to receive this directory binding payload.