KB-7425: What UID generation method should be used upon OS X Active Directory join?

Home >

KB-7425: What UID generation method should be used upon OS X Active Directory join?

Product:

Mac & PC Management Service ,

Published:

2 September,16 at 11:52 PM

Rating:

Applies to: Centrify Identity Service, Mac Edition

Question:

Which UID generation method should be used upon joining a Mac to Active Directory? Apple UID or Centrify UID?

Answer:

There are two UID generation methods that Centrify supports for joining Macs to Active Directory:

Centrify UID Generation (default):
- This method should be used if the Macs were never bound to Active Directory before using Centrify.
Apple UID Generation:
- This method should be used if the Macs were previously joined to Active Directory using Apple's native AD plugin. This ensures compatibility for existing users.
Enabling Apple UID Generation:
- AutoZone Mode:
  - During AD Join with Centrify Join Assistant:
    - In the "Advanced Options", click the checkbox next to "Utilize Apple UID generation scheme"
    - Please see the below screenshot for an example:

Using Group Policy:
- Enable the following Group Policy:
  
  Computer Configuration / Centrify Settings / DirectControl Settings / Adclient Settings / "Generate new uid/gid using Apple scheme in Auto Zone"
  
  (See the Explain tab of this GP for more information on this setting)

Zone Mode:

Using Centrify Access Manager:
- Open the DirectManage Access Manager and open the Zone properties where the user accounts have been added.
- Under the "User Defaults" tab, set the UID to "Use Apple UID scheme".
- If necessary, do the same for the "Group Defaults" tab and the GID value.
- Remove and re-add the users' UNIX Profile in that Zone
- Please see the below screenshots for an example: