Domain Join - Big Sur

[simon_brooke]

Hi All,

Before I start, yes I know domain join is now outdated, but we are still working through the POC for Jamf Connect.
This means our Big Sur machines will need to bind to the domain.

I am testing Public Beta 11, and for the life of me, I cannot get it to bind to our domain. The domain level is 2008.

Has anybody had this issue and found a fix?

[bejohnson]

Yes, I am seeing the same issue with binding to AD with the public Beta 11. I'm holding out hope it doesn't carry over when macOS Big Sur is released, but it has already added some more fuel to the conversation of moving away from AD bind.

[mm2270]

I'm not really surprised there are binding issues. First, being a beta still, it's possible issues will get worked out when the final release hits. OTOH, Apple has shipped many past versions of macOS 10.x.0 releases with broken AD binding present in them, only to fix it in some future point release. And given Apple's super strong push to get people to move away from direct AD binding, it's no wonder this is low priority for them in any new OS version.

I know it's not always up to you, but however it needs to happen I would make a strong push in any org to get away from direct AD binding at this point and move toward local accounts and using one of the various tools/methods of password syncing. You have to ask yourself what benefit you still get from binding your Macs to AD, and whether those same benefits can be achieved in a way that is more supportable going forward.

[mschroder]

Have you checkedd that your domain controller has the proper certificates? I also encountered problems binding and had thought about Apple strenghening the certificate requirements, but I have not yet checked whether this might be the issue.

I hope Apple will still give us some time before releasing BS...

[ryan_ball]

@simon.brooke It might help others to know if you are attempting to bind using:
- Configuration Profile
- Policy with the Directory Bindings payload
- Script using dsconfigad
OR if you've tried one/all of the three alternative options above with/without success.

[c_kay]

AD binding via config profile at enrolment time is working fine for we with 11.0.1 beta 1

[maristchris]

Possibly related...My Big Sur test machine is joining properly and works fine but for some reason does not seem to respect the "Allow Administration By Group" feature in my Bind command. Any input is appreciated.

[SGill]

"Allow Admin By Group" has been breaking on and off for a few macOS's now. It usually begins to work after about the .3 release IMHO, but even then can be slow to pick up on membership - depending on the size and speed of your AD.