Binding macOS to Active Directory

You can bind from System Settings, but dsconfigad is scriptable and lets you set the options that actually matter, like the computer OU and mobile accounts. Pre-create the computer object in the right OU first so it does not land in the default Computers container.

Join

sudo dsconfigad -add corp.example.com \
  -computer "MAC-$(hostname -s)" \
  -username join-svc -password '••••••' \
  -ou "OU=Macs,OU=Workstations,DC=corp,DC=example,DC=com" \
  -mobile enable -mobileconfirm disable \
  -localhome enable -useuncpath disable \
  -shell /bin/zsh

Mobile accounts cache the network credentials locally so the laptop still logs in off the VPN. -localhome enable keeps the home folder on the internal disk instead of an SMB share, which you almost always want on a laptop.

Let admins log in

# allow a specific AD group to be local admin
sudo dsconfigad -groups "CORP\Mac Admins,CORP\Domain Admins"

Check it worked

dsconfigad -show
id someuser@corp.example.com
dscl "/Active Directory/CORP/All Domains" -read /Users/someuser

If lookups hang, it is almost always DNS. The Mac has to resolve the domain SRV records, so its DNS must point at the domain controllers, not a public resolver. Bind failures with "node name or service name not known" are DNS every single time.