Directory Utility question...how to make a domain a default domain?

[scentsy]

Directory Utility question...how to make a domain a default domain?

I'm trying to make a specific domain the default or make it the preferred domain (first in the order)

thank you for your help.

[mjsanders]

There is no default domain, but there is a search order (Top to bottom).
In the GUI one can drag and drop to change order.
With scripts I am not sure with 10.11.
It used to depend on the order of binding done by scripts (I remember that the last bound directory was ending at top, but the last time I really tested two domains was 10.8.x)
or change it with a defaults command, probably on this file: /Library/Preferences/OpenDirectory/Configurations/Search.plist

Do you really need two domains? and the order should not really matter, unless there are duplicate usernames.

Workaround: you can specify the domain by logging in as user@domain.local or user@domain.com to tell directory services which domain to use.

[scentsy]

I only need one domain, it automatically shows up with the "All Domains" I'm trying to find out a way to do it "automagically" with a script or something similar.

I'm trying to avoid doing it manually.

thank you for your help Maurits.

[jhalvorson]

In your Binding Directory or your script, you have the option set to "Allow authentication from any domain in the forest" checked or unchecked?

[Brad_G]

We had to adjust the search order as we have multiple domains in our forest. I didn't do it programmatically with a script but as a package pushed through Casper.

Change your search order as desired on your test machine, and drop the Search.plist file from /Library/Preferences/OpenDirectory/Configurations/ into Composer and that should do the trick.

[scentsy]

Thank you Brad I'll try that.

Jason (jhalvorson) I do have the "Allow authentication from any domain in the forest" unchecked.

I really appreciate everyone helping...thank you.

[scentsy]

one last question: is it possible to remove "/Local/Default" from the Directory Utility? (see on the screen shot the one that is gray-out).

[m_entholzner · Accepted solution]

you should not grab that plist... grabbing a plist should always be used with care, because plists may be different from machine to machine. directly modifying the needed things is a better idea :)

The script you need:

#!/bin/bash

# Removing "All Domains" from the search path
dscl /Search -delete / CSPSearchPath "/Active Directory/YOURDOMAIN/All Domains"

# Adding Domains to the search path
dscl /Search -append / CSPSearchPath "/Active Directory/YOURDOMAIN/subdomain.domain.com" 

# Removing "All Domains" from the contacts search path
dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/YOURDOMAIN/All Domains" 

# Adding Domains to the contacts search path
dscl /Search/Contacts -append / CSPSearchPath "/Active Directory/YOURDOMAIN/subdomain.domain.com"

Just put this one in a script you run after domain binding and you should be fine.

The /Local/Default path cannot be modified or removed. It is needed for authenticating any local accounts, including system accounts.

[scentsy]

@m.entholzner Thank you very much! that's what I was looking for.