Prerequisites:

1. Your macOS device is already enrolled in WS1.
2. The macOS device either has a wired connection to a campus network or is connected to a campus network through an active WiscVPN connection.

Creating a domain join user account in AD

Creating a domain join user account in your Active Directory that has permission to domain join devices is preferred. Using an existing domain join user account you have is also acceptable. Do this before proceeding with the rest of the steps in this document.

Creating a domain join user account is the same as creating a new user account in AD. The account once created does not need any special membership.

Identify an existing OU or create a new OU for devices joining your domain (Optional)

If you want to separate your devices once they’ve joined the domain, go ahead and create a new OU for this purpose.

Domain join service account delegation of control

1. Right-click on your newly created computer OU (or your existing computer OU) > Delegate Control.
2. Click Next on the Delegation of Control Wizard.
3. Click Add to search for and add the user account doing the domain join.
   
   
   
   
   
   
4. On the Task to Delegate window Select Create a custom task to delegate and click Next.
5. For the Active Directory Object Type window, select Only the following objects in the folder.
6. Check the box for Computer objects and Create selected objects in this folder.
   
   
   
   
   
   
7. Click Next.
8. In the Permissions window check the boxes for:
   1. General
   2. Creation/deletion of specific child objects
   3. Read
   4. Write
      
      
      
      
      
      
9. Click Next.
10. Click Finish.

Binding macOS devices to AD using WS1

1. In the WS1 console navigate to Groups & Settings > Groups > Assignment Groups.
2. Click Add Smart Group to create a new smart group for your macOS devices that will need to be bound to AD.
3. Assign macOS devices that need to be bound to AD to your newly created smart group.
4. In the WS1 console navigate to Devices > Profiles & Resources > Profiles.
5. Click Add to create a new profile.
6. Give the profile a Name and assign the profile to the smart group you created in step 2.
7. Select the payload Directory.
8. Fill in the following:
1. Directory Type: Active Directory
2. Server Hostname: ad.wisc.edu
3. Username: your AD domain join user account name
4. Password: your AD domain join account password
5. Organizational Unit: path to your computer OU
9. Under User Experience select Create mobile account at login.
   
   
   
   
   
10. Click Save and Publish.
11. Assign this newly created profile to your macOS device(s).