Centrify Suite for Mac OS X enables a Macintosh OS X computer to participate seamlessly in a Windows Active Directory domain, with advanced Windows Group Policy support for desktop lockdown

DirectControl enables Active Directory-based authentication and access control for both PowerPC- and Intel-based Mac systems and is the first and most robust solution that enables IT managers to centrally secure and configure Mac systems through Active Directory Group Policy.

IT managers can streamline operations and strengthen security by establishing a single point of administration — Active Directory. And end-users gain single sign-on to their Macs through their Active Directory account.

Features and Benefits for IT Managers

Strengthen Security
DirectControl enables you to strengthen security and enhance IT efficiency in the following ways.

– Extend centralized, Active Directory-based single sign-on (SSO) to Mac users — no more manual provisioning of local accounts that may live on even after an employee leaves the company.
– Use DirectControl's unique Zone technology to enable users to log on only to the Mac sytems they really need to access. (See Zone-Based Access Control for more details.)
– Delegate administration of Mac systems to individuals without giving them privileges on any other systems.
– Use DirectControl's built-in reporting to verify for auditors who has access to which systems.
– Globally enforce Active Directory-defined password policies, regardless of where users log in.
– Enable offline login to Mac laptops with cached credentials (similar to Windows XP) without creating an account on the local computer.

Enhance IT Efficiency

– Use Windows Group Policy to bulk configure Mac systems centrally from Active Directory: control DirectControl configuration and sudo settings; lock down System Preferences; enforce screensaver locking, and more. See Bulk Configuration of Macs through Group Policy for more details.
– Perform large-scale remote installation through Apple Remote Desktop. See our application note, Using Apple Remote Desktop to Deploy Centrify DirectControl, for details.
– Centrally control configuration features that previously had to be managed (if it was possible at all) at each local computer: transparent SSO to Windows files shares; home directory automounts to Windows file shares; and assignment of UIDs and the groups and theirs GIDs that are used to assign and control access for file permissions consistency.

Smart Card Support

DirectControl for Mac OS X provides full smart card support on Mac OS X 10.6 and 10.7 for all CAC, CACNG, and PIV smart cards. This includes the Oberthur ID One 128 v 5.5 Dual Smart Card. In addition, Centrify's support for the U.S. Department of Defense's Common Access Card (CAC) standard is certified by the Joint Interoperability Test Command (JITC), bringing Mac OS X systems into compliance with HSPD-12. No special user configuration is required on the local system because all authentication and access control data is stored in Microsoft Active Directory. DirectControl supports both online and offline login with smart cards. This would enable an organization to, for example, require users logging on to a Macintosh on an airplane to authenticate using their smart card.

To streamline deployment of smart card-protected systems, DirectControl automates the configuration of the system to support smart card login as well as to ensure that the system trusts the root certificate authorities that are trusted by Active Directory when a Macintosh joins the domain. Active Directory enforces smart card access to Windows systems through the Account option "Smart card is required for interactive logon" policy. DirectControl enforces this policy on Mac OS X systems as well, giving you the ability to enforce smart card access consistently across your organization.

DirectControl also provides Group Policies to enable centralized management of smart card login. These Group Policies can be used to require a Macintosh system to go into screen lock or to force a logout when the smart card is removed from the reader during a session. This policy enforcement on Mac OS X systems enables organizations to easily enable the secured usage of Mac systems within their Windows environments leveraging the same tools, procedures and policies that they are already familiar with today.

Streamlined Deployment and Workstation Mode

Centrify DirectManage Deployment Manager can automatically detect Mac OS X systems within your environment and test them for readiness to join Active Directory, helping you identify and eliminate many common issues (such as DNS configuration problems) that slow down deployment of the Centrify DirectControl agent. Deployment Manager can then remotely install DirectControl on these Mac systems, automatically downloading the most current version for you from the Centrify website. You can also centrally update DirectControl on these systems as new releases become available.

The Centrify DirectControl for Mac OS X installation program is also provided in universal binary format, making it easy to deploy DirectControl on individual systems or across the enterprise. On individual systems, a graphic, interactive installation program walks users through the setup. System administrators can also extract the package file for use with Apple Remote Desktop; see Using Apple Remote Desktop to Deploy Centrify DirectControl on the Centrify website for instructions. The installation package can also be distributed using third-party systems management solutions such LanREV.

In many organizations, Mac OS X workstations can be treated just like Windows workstations for access control purposes, permitting anyone with an Active Directory account to log in once the Mac has joined the domain. For those organizations, DirectControl's workstation mode streamlines installation using the same methodology to add a Mac workstation to an Active Directory domain as that used to add Windows workstations. The interactive installation program offers users the option to add the Mac in workstation mode. Remote installations can specify workstation mode through command-line parameters.

Macs operating in workstation mode have almost identical features to Macs operating in standard DirectControl mode. For example, end-users have transparent access to local or network home directories, and they enjoy the same single sign-on benefits to other Active Directory integrated services and applications. Administrators can also use Group Policy to remotely manage security and configuration settings on DirectControl-managed Macs in workstation mode.

How DirectControl Differs from Other Solutions

Other solutions for integrating Macintoshes with Active Directory offer only limited integration. DirectControl is unique in its approach to providing enterprise-ready features for IT organizations responsible for managing large number of Mac systems.

– DirectControl's unique Zone technology enables granular access control and delegated administration that is simply not available in any other solution. You can create collections of Mac systems that can each have their own set of authorized users and administrators. Universities find this feature particularly helpful in setting up security boundaries around Macintosh labs while not exposing Macs in administrative offices to unauthorized access, but any organization with Macs that are "owned" by different departments will find they can centrally manage them without compromising security or flexibility and without stripping current system admins of their privileges.

– No other solution delivers the ease of use and robustness of DirectControl's Group Policy for the Mac. Other centralized management solutions require extensive Active Directory schema extensions or the deployment of additional server infras