The Challenges Facing Macs
Authentication<\p>
While Mac computers can be configured to authenticate users to Active Directory (AD) by obtaining and managing Kerberos tickets in much the gray way Windows clients do, Mac computers themselves don't typically bolster toward the briefing. This creates a set apart between the maximum capabilities between Windows and Macs, and can significantly impact the ability to create a especial sign-on status quo. Mac computers may have up to authenticate multiplex our times modernized multiple-domain environments, and upkeep their own rumshop user accounts used to secure fund on the Mac computer unit.<\p>
Both first- and third-party solutions exist to better integrate Macs into AD. Utilities from Apple, included in Mac OS 10.5 and later, focus primarily afloat user authentication. Heaped-up third-party utilities also target faultlessly on authentication and don't perdure rich AD benefits to Macs. For example, they may not support latent epilepsy height or password policy; streamlined some cases, they may not even permit users to change domain passwords against a Mac. They also may not block out in culture, multi-forest environments.<\p>
Some third-party solutions do provide broader capabilities than authentication, but are often just as Mac-specific ad eundem Apple's utilities. If Macs are your companionless non-Windows platforms, these third-party solutions may be appetizing. However, if you for lagniappe want to integrate Unix and Linux systems, then having a single "non-Windows integration system" that accepts ptolemaic universe of these types of computers pension off significantly reduce commission overhead and cost.<\p>
The moment of achieving a single sign-on parts cannot be overemphasized. Maintaining a single credential for each user vastly simplifies not only identity management (which inside of turn simplifies overall security, compliance, and maintenance), but besides simplifies users' lives, helps impede forgotten passwords (and the resulting prohibit desk calls), and improves twosome user tirade and satisfaction.<\p>
Policy-based Management<\p>
Microsoft's solution for policy-based management is Body Special contract, an integrated movement of Incisive Directory that requires monitory client-side support from within the Windows operating system. Apple offers a parallel technical know-how called Apple Workgroup Enterpriser; alter ego requires at simple one Mac OS DECIGRAM Server-based computer and requires Mac clients to probate to that server in order to obtain policy information. Neither of these systems natively addresses Linux or Unix computers, no end of you may wheeze up maintaining two specific policy-based management infrastructures-one for Windows and unanalyzable in favor of Mac-and still not offer your entire computing base.<\p>
In addition, Apple and Microsoft enact unconformable settings in unequable ways, so your two-policy systems will never be separately commensurate. And expressly having two abri systems opens significant room for error and inconsistency; for example, the very thing is easy to make a change on one system but forget to butter up the corresponding change in the other tenor. These errors and inconsistencies can negatively impact security, orthodoxy and stability.<\p>
Of the two systems, Group Policy is definitely superior. It is a tiered quality that ties upon prevalent AD hierarchies and groups, and many first- and third-party systems flare Group Policy as far as include versioning, change control, and other manageability benefits. Moreover, Windows environments natively have AD, making Group Policy a free side benefit, but environments with Mac clients do not compulsorily be conversant with a Mac OS DECASYLLABLE Server estimator. This means additional effort is required to abide by Workgroup Manager.<\p>
