#Mac os active directory mac os x

Is there a way to have the certificate request be for the computer account rather than a user? Is there a way to configure things so that the certificate/profile is only presenting the computer rather than the user that enrolled it if not?Īlternatively, is anyone familiar with all the changes in Profile Configurator 2/Ivanti and Mac OS X 10.14. Our key concern is to keep unauthorized (non-company) devices off of the network, so the only thing I really want to authenticate and authorize is the device, ideally using the computer account against AD. After the user logs in, it authenticates again, but this time as the computer. The oddness, though, is that on reboot, before the user logs in, it appears to be logging in as the user that enrolled the certificate, not as the machine. It authenticates using EAP-TLS for wired and wireless, and it connects before the user logs in so they can login to the domain properly. I setup OnBoard in ClearPass, with an intermediary CA, and set up the profiles through OnBoard, and it seems to work almost perfectly. We’ve tried “Profile Configurator 2” and Ivanti (LanDesk) to mimic the settings the Windows machines use onto the Macs but have had no luck. Within the Setup Assistant you will be asked to create a local admin user.

They’re domain members, they talk to the certificate server and generate their client certificates, the profile enables wired and wireless dot1x, sets them to use their certificate, trust the certificates presented by clearpass, etc. With your devices registered in ASM/ABM (Apple School/Business Manager) and synced to Intune you set up an enrollment program token that configures the Setup Assistant with Modern Authentication (ADE Automated Device Enrollment (formerly DEP)). For the windows devices, we set up a GPO, push it out to the machines and everything is great. We have a hybrid environment of Windows and Mac devices.

Mac os active directory