Add or Remove Mac from Active Directory

There are two ways to add a Mac to Active Directory. The results are the same. Before proceeding make sure the Mac is connected to your network either via Ethernet or wireless. Macs can establish wireless connections at the login screen which is helpful for devices such as the MacBook Air that do not have Ethernet ports.

Open Directory Utility

1. Click on Apple in top left corner and click on System Preferences.
2. Click on Users & Groups.
   1. Make sure the lock in the bottom left corner of the window is in an unlocked position.
3. Click on Login Options.
4. Where it says Network Account Server, click on the button Join...
5. Click on Open Directory Utility...
6. Double click on Active Directory. Note, you may click on the lock in the bottom left corner to unlock and make edits.

Or alternatively...

1. Open Finder.
2. Click on Go menu and then Go to folder...
3. Type /System
4. Open Library folder
5. Open Core Services folder
6. Open Directory Utility.app
7. Double click on Active Directory. Note, you may click on the lock in the bottom left corner to unlock and make edits.

Add Mac to Active Directory using Directory Utility

1. Make sure the lock in the bottom left corner of the window is in an unlocked position.
2. You will see three tabs: Services Search Policy Directory Editor. By default you will be under the Services tab. If not, please click Services.
3. Double click on Active Directory.
4. Enter the following information:
   1. Leave Active Directory Forest alone.
   2. Active Directory Domain: enter your domain name (i.e. company.com for purposes of this guide)
   3. Computer ID: enter computer name
5. Click on arrow next to Show Advanced Options.
6. Click the User Experience tab. This should be the default tab you see anyways.
7. Check Create mobile account at login
8. Check Require confirmation before creating a mobile account. Otherwise you may see a prompt when you login with your AD credentials for the first time to create a mobile account folder which should be answered with Yes. And if given the option select Do not ask me again.
9. If you are not using network homes, then uncheck Use UNC path from Active Directory to derive network home location
10. If you want to make an AD group administrators on the computer, click the Administrative tab.
    1. Make sure Allow administration by: is checked.
    2. Click on the plus sign and type enter AD group name to allow AD group to be administrators on the machine.
11. Click on the Bind... button.
12. Enter your AD username in the Username: text field
13. Enter your AD password in the Password: text field
14. The next step requires you to fill out Computer OU: which can be handled one of two ways
    1. First method: in reverse name format, type out the Organizational Unit (OU) the machine is going to be added to. For example: OU=MacOSX,OU=Computers,DC=company,DC=com. You will most likely need to remote into a PC machine and look at the Active Directory hierarchy for the domain to see the structure of OUs using Active Directory Users and Computers if you cannot remember the hierarchy. Please notice the use of commas and OU= which is important otherwise this may fail.
       OU stands for Organizational Unit and DC stands for Domain Controller. CN stands for Class Name.
    2. Second method: leave Computer OU: as is which should be CN=Computers,DC=company,DC=com. Instead remote into a PC with Active Directory Users and Computers. Go to the proper OU where the Mac will go and right-click the OU and select New -> Computer. Enter the Computer Name which needs to match the Computer ID filled out earlier. On the Mac, in Directory Utility you should now be able to click Bind.
       OU stands for Organizational Unit. DC stands for Domain Controller. CN stands for Class Name.
       
       If you will used the second method of adding a Mac to Active Directory, you will see the following message:
       

       Join existing account?
       The account information you entered specifies an account that already exists. Do you wish to join this computer to the existing computer account? This operation cannot be undone.

       Please click OK. This is the Mac telling you that you will be overwriting a computer account in Active Directory which is fine and should not cause any problems.
15. Select OK.

Remove Mac from Active Directory using Directory Utility

It is possible to remove a machine from Active Directory from within Mac OS X. This assumes the machine is on AD domain.

1. First, you will need to open Directory Utility.
2. Make sure the lock in the bottom left corner of the window is in an unlocked position.
3. You will see three tabs: Services Search Policy Directory Editor. By default you will be under the Services tab. If not, please click Services.
4. Double click on Active Directory.
5. Click on the Unbind... button.
6. Enter your AD username in the Username: text field
7. Enter your AD password in the Password: text field
8. Select OK.