Active Directory

com.apple.DirectoryService.managed

The payload that configures an Active Directory (AD) domain.

macOS 10.8+

macOS: device channel only

Configuration Keys (39)

Showing 39 of 39 keys

Key	Type	Description	Default	Range
`HostName`string HostName required	string	The Active Directory domain to join.	Default: —	Range: —
`UserName`string UserName	string	The user name of the account for the domain.	Default: —	Range: —
`Password`string Password	string	The password of the account for the domain.	Default: —	Range: —
`ClientID`string Client ID	string	The client's identifier.	Default: —	Range: —
`ADOrganizationalUnit`string ADOrganizationalUnit	string	The organizational unit to add the joining computer object to.	Default: —	Range: —
`ADCreateMobileAccountAtLoginFlag`boolean Enable ADCreateMobileAccountAtLogin Flag macOS 10.9+	boolean	If 'true', the system enables the 'ADCreateMobileAccountAtLogin' key.	Default: false	Range: —
`ADCreateMobileAccountAtLogin`boolean Create mobile account at login	boolean	If 'true', the system creates a mobile account at login. Depends on: ADCreateMobileAccountAtLoginFlag ∈ [true]	Default: false	Range: —
`ADWarnUserBeforeCreatingMAFlag`boolean Enable ADWarnUserBeforeCreatingMA Flag macOS 10.9+	boolean	If 'true', the system enables the 'ADWarnUserBeforeCreatingMA' key.	Default: false	Range: —
`ADWarnUserBeforeCreatingMA`boolean Require confirmation before creating mobile account	boolean	If 'true', the system enables the warning before creating the mobile account. Depends on: ADWarnUserBeforeCreatingMAFlag ∈ [true]	Default: false	Range: —
`ADForceHomeLocalFlag`boolean Enable ADForceHomeLocal Flag macOS 10.9+	boolean	If 'true', the system enables the 'ADForceHomeLocal' key.	Default: false	Range: —
`ADForceHomeLocal`boolean Force local home directory on startup disk	boolean	If 'true', the system forces a local home directory. Depends on: ADForceHomeLocalFlag ∈ [true]	Default: false	Range: —
`ADUseWindowsUNCPathFlag`boolean Enable ADUseWindowsUNCPath Flag macOS 10.9+	boolean	If 'true', the system enables the 'ADUseWindowsUNCPath' key.	Default: false	Range: —
`ADUseWindowsUNCPath`boolean Use UNC path for network home location	boolean	If 'true', the system uses the UNC path from Active Directory to derive the network home location. Depends on: ADUseWindowsUNCPathFlag ∈ [true]	Default: false	Range: —
`ADMountStyle`string Mount Style	string	The network home protocol to use: 'afp' or 'smb'.	Default: "smb"	Range: AFP (afp), SMB (smb)
`ADDefaultUserShellFlag`boolean Enable ADDefaultUserShell Key	boolean	If 'true', the system enables the 'ADDefaultUserShell' key.	Default: false	Range: —
`ADDefaultUserShell`string Default user shell	string	The default user shell. Depends on: ADDefaultUserShellFlag ∈ [true]	Default: "/bin/bash"	Range: —
`ADMapUIDAttributeFlag`boolean Enable ADMapUIDAttribute Key	boolean	If 'true', the system enables the 'ADMapUIDAttribute' key.	Default: false	Range: —
`ADMapUIDAttribute`string Map UID to attribute	string	The map UID to attribute. Depends on: ADMapUIDAttributeFlag ∈ [true]	Default: —	Range: —
`ADMapGIDAttributeFlag`boolean Enable ADMapGIDAttribute Key	boolean	If 'true', the system enables the 'ADMapGIDAttribute' key.	Default: false	Range: —
`ADMapGIDAttribute`string Map user GID to attribute	string	The map GID to attribute. Depends on: ADMapGIDAttributeFlag ∈ [true]	Default: —	Range: —
`ADMapGGIDAttributeFlag`boolean Enable ADMapGGIDAttribute Key	boolean	If 'true', the system enables the 'ADMapGGIDAttributeFlag' key.	Default: false	Range: —
`ADMapGGIDAttribute`string Map group GID to attribute	string	The map group GID to attribute. Depends on: ADMapGGIDAttributeFlag ∈ [true]	Default: —	Range: —
`ADPreferredDCServerFlag`boolean Enable ADPreferredDCServer Key	boolean	If 'true', the system enables the 'ADPreferredDCServer' key.	Default: false	Range: —
`ADPreferredDCServer`string Preferred domain server	string	The preferred domain server. Depends on: ADPreferredDCServerFlag ∈ [true]	Default: —	Range: —
`ADDomainAdminGroupListFlag`boolean Enable ADDomainAdminGroupList Key	boolean	If 'true', the system enables the 'ADDomainAdminGroupList' key.	Default: false	Range: —
`ADDomainAdminGroupList`array Allow administration by specified Active Directory groups.	array	The list of Active Directory groups with admin access. Depends on: ADDomainAdminGroupListFlag ∈ [true]	Default: —	Range: —
`ADDomainAdminGroupListItem`string Domain Admin Group Item required	string	An active directory group	Default: —	Range: —
`ADAllowMultiDomainAuthFlag`boolean Enable ADAllowMultiDomainAuth Key macOS 10.9+	boolean	If 'true', the system enables the 'ADAllowMultiDomainAuth' key.	Default: false	Range: —
`ADAllowMultiDomainAuth`boolean Allow authentication from any domain in the forest	boolean	If 'true', the system allows authentication from any domain in the namespace. Depends on: ADAllowMultiDomainAuthFlag ∈ [true]	Default: false	Range: —
`ADNamespaceFlag`boolean Enable ADNamespace Key	boolean	If 'true', the system enables the 'ADNamespace' key.	Default: false	Range: —
`ADNamespace`string Set primary user account naming convention: "forest" or "domain"	string	The primary user account naming convention; either 'forest' or 'domain'. Depends on: ADNamespaceFlag ∈ [true]	Default: "domain"	Range: domain, forest
`ADPacketSignFlag`boolean Enable ADPacketSign Key macOS 10.8+	boolean	If 'true', the system enables the 'ADPacketSign' key.	Default: false	Range: —
`ADPacketSign`string Packet signing	string	The packet signing policy. Depends on: ADPacketSignFlag ∈ [true]	Default: "allow"	Range: allow, disable, require
`ADPacketEncryptFlag`boolean Enable ADPacketEncrypt Key	boolean	If 'true', the system enables the 'ADPacketEncrypt' key.	Default: false	Range: —
`ADPacketEncrypt`string Packet encryption	string	The packet encryption policy. Depends on: ADPacketEncryptFlag ∈ [true]	Default: "allow"	Range: allow, disable, require, ssl
`ADRestrictDDNSFlag`boolean Enable ADRestrictDDNS Key	boolean	If 'true', the system enables the 'ADRestrictDDNS' key.	Default: false	Range: —
`ADRestrictDDNS`array Restrict DDNS on interfaces macOS 10.8+	array	An array of strings that represent the interfaces allowed for dynamic DNS updates, such as en0 and en1. Depends on: ADRestrictDDNSFlag ∈ [true]	Default: —	Range: —
`ADRestrictDDNSItem`string Allowed DDNS Interface Item required	string	An interface name which is allowed to make DDNS updates	Default: —	Range: —
`ADTrustChangePassIntervalDaysFlag`boolean Enable ADTrustChangePassIntervalDays Key	boolean	If 'true', the system enables the 'ADTrustChangePassIntervalDays' key.	Default: false	Range: —
`ADTrustChangePassIntervalDays`integer Password trust interval	integer	The number of days before requiring a change of the computer trust account password. Set to '0' to disable the feature. Depends on: ADTrustChangePassIntervalDaysFlag ∈ [true]	Default: 14	Range: —
`Description`string Description	string	The directory service description.	Default: —	Range: —