Integrate Mac computers with Active Directory
You can configure a Mac to access basic user account information in a Active Directory domain of a Windows 2000 (or later) server. The Active Directory connector is listed in the Services pane of Directory Utility, and it generates all attributes required for macOS authentication from standard attributes in Active Directory user accounts. The connector also supports Active Directory authentication policies, including password changes, expirations, forced changes, and security options. Because the connector supports these features, you don’t need to make schema changes to the Active Directory domain to get basic user account information.
Note: macOS won’t be able to join an Active Directory domain without a domain functional level of at least Windows Server 2008, unless you explicitly enable “weak crypto.” Even if the domain functional levels of all domains are 2008 or later, the administrator may need to explicitly specify each domain trust to use Kerberos AES encryption.
How Mac uses DNS to query the Active Directory domain
macOS uses the Domain Name System (DNS) to query the topology of the on-premise Active Directory domain. It uses Kerberos for authentication and the Lightweight Directory Access Protocol (LDAPv3) for user and group resolution.
When macOS is fully integrated with Active Directory, users:
Are subject to the organization’s domain password policies
Use the same credentials to authenticate and gain authorization to secured resources
Can be issued user and machine certificate identities from an Active Directory Certificate Services server
Can automatically traverse a Distributed File System (DFS) namespace and mount the appropriate underlying Server Message Block (SMB) server.
For more information on connecting to a DFS without binding, see Distributed File System namespace support below.
You can also use the Directory payload in a device management service to configure these settings, then push that payload to all of the Mac computers in your organization. For more information, see Directory Service device management payload settings.
Mac clients assume full read access to attributes that are added to the directory. Therefore, it might be necessary to change the access control list (ACL) of those attributes to permit computer groups to read these added attributes.
Domain password policies
At bind time (and at periodic intervals thereafter), macOS queries the Active Directory domain for the password policies. These policies are enforced for all network and mobile accounts on a Mac.
During a login attempt while the network accounts are available, macOS queries Active Directory to determine the length of time before a password change is required. By default, if a password change is required within 14 days, the login window asks the user to change it. If the user changes the password, the change occurs in Active Directory as well as in the mobile account (if one is configured), and the login keychain password is updated. If the user dismisses the password request, the login window asks the user until the day before expiration. The user needs to change the password within 24 hours for login to proceed. A macOS administrator can change the default expiration notification for the login window from the command line by typing defaults write /Library/Preferences/com.apple.loginwindow PasswordExpirationDays -int <number of days>.
Note: macOS doesn’t support fine-grained password policies using Active Directory’s Password Settings Object (PSO). Only the default domain policy is used when calculating password expiration.
Distributed File System namespace support
macOS supports traversing distributed file system (DFS) namespaces if a Mac is bound to Active Directory. A Mac bound to Active Directory queries DNS and domain controllers in the Active Directory domain to automatically resolve the appropriate Server Message Block (SMB) server for a particular namespace.
If a Mac with macOS 26.5 or later isn’t t bound to Active Directory, you can configure SMB to resolve server names using domain controllers. When you set srv_lookup_enabled in the nsmb.conf file, macOS performs DNS SRV lookups for _ldap._tcp.<serverName> and _gc._tcp.<serverName> to discover domain controllers. If the lookup returns domain controllers, the client attempts to connect to each one to resolve the SMB server for the namespace. If all domain controller connections fail, the client falls back to the original server name.
macOS also uses any available Kerberos tickets to authenticate with the file server.
Alternatively, you can use Connect to Server in the Finder to specify the fully qualified domain name (FQDN) of the DFS namespace including the DFS root. Click the desktop to open the Finder, choose the Connect to Server command from the Go menu, then enter smb://resources.melardclothing.com/DFSroot. To successfully connect, the Mac needs to resolve host and domain name DNS records. If your DFS referrals don’t use fully qualified domain names, populate the Search Domains field in the DNS configuration for the network interface with the appropriate domain name.