Home / Support / M-AD Help Center

M-AD Help Center

Setup, connection troubleshooting, directory management, security review, reports, privacy, and support export guidance for M-AD.

Feature Summary

M-AD is a native macOS Active Directory administration app for Mac-based directory operators. It supports everyday browsing, guarded object management, security review, diagnostics, and support-ready reporting without depending on a Windows ADUC workstation for routine work.

  • Browse users, groups, computers, contacts, OUs, containers, and domain roots.
  • Use LDAP, LDAPS, password, and Kerberos-oriented connection profiles.
  • Create, edit, move, rename, delete, reset, unlock, enable, disable, and manage membership where permissions allow.
  • Review security descriptors, diagnostics, password policy, GPOs, DC health, replication, SPNs, delegation, audit activity, and environment summaries.
No M-AD topics matched your search. Try broader terms like connect, LDAP, permission, report, or diagnostics.

Setup

Connect to a Live Directory

Topic ID: connect_live_directory

Open File > Connect..., enter the domain controller or AD DNS domain, choose the authentication method, and prefer LDAPS on port 636 unless your environment requires LDAP on port 389.

Good to know

  • Leave Base DN blank when you want M-AD to try RootDSE discovery.
  • Saved credentials are stored in macOS Keychain.
  • Write actions appear only when the session, selected object, and delegated permissions allow them.

Use Demo Mode

Topic ID: demo_mode

Demo mode uses a synthetic read-only directory. Use it for evaluation, training, screenshots, App Store validation, and safe exploration when no real directory should be contacted.

Connections

Domain Controller Discovery Fails

Topic ID: dc_discovery_fails

Confirm the Mac is using DNS servers that can resolve AD SRV records such as _ldap._tcp.example.com and _kerberos._tcp.example.com. If AD DNS is unavailable, enter a specific server hostname.

LDAPS Certificate Fails

Topic ID: ldaps_certificate_fails

Use a hostname that matches the certificate and install the issuing CA in macOS trust. Invalid-certificate acceptance should only be used in disposable labs and is not saved to exported profiles.

Base DN or Empty Tree Problems

Topic ID: base_dn_empty_tree

Leave Base DN blank to try RootDSE discovery, or enter the naming context manually, for example DC=example,DC=com. Confirm the connected account can read the selected Base DN and container.

Kerberos Does Not Bind

Topic ID: kerberos_bind_fails

Confirm a valid ticket exists, the realm is correct, the target hostname matches the expected ldap/fqdn service principal, and the Mac can reach the KDC. Direct IP targets are usually better served by password LDAP or LDAPS.

Management

Write Actions Are Disabled or Fail

Topic ID: write_actions_disabled

Demo mode is read-only, and live write workflows depend on delegated AD permissions. If browsing works but a write fails, the account may have read permission without write permission for that object or OU.

Common supported write workflows

  • Create users, groups, contacts, computers, OUs, and containers.
  • Edit common attributes and guarded raw allowlisted attributes.
  • Reset passwords, unlock users, enable or disable users and computers, and manage membership.
  • Move, rename, and delete supported objects with confirmation.

Search Returns Too Much or Too Little

Topic ID: search_scope_results

Use object-type filters, narrow the query, and use load-more when M-AD indicates server-side results were truncated. For explicit filters, open Tools > Advanced Search... and scope broad searches with a useful Base DN.

Security

Security Descriptor Review and Edits

Topic ID: security_descriptor_review

Open Actions > Security Descriptor... on a selected object to inspect permissions, ownership, auditing, effective access, inherited entries, and local backups. Edits require delegated rights and confirmation.

Important limits

  • Inherited entries must be changed at their source object.
  • SACL access depends on directory permissions and audit rights.
  • Backups are local and should be protected because they describe directory security.

Reports

Reports Have Warnings or Missing Sections

Topic ID: report_warnings

Some reports depend on access to specific naming contexts, DNS records, or domain controller ports. M-AD includes warnings when it cannot read a section instead of silently omitting it.

Available report areas

Password policy, fine-grained password policy, account lockout investigation, GPO inventory, domain-controller health, replication topology, SPNs, delegation, audit activity, environment summary, and operational handoff.

Support

Export Diagnostics for Support

Topic ID: diagnostics_support_export

Open Tools > Diagnostics & Error Reports..., enable diagnostics mode, reproduce the issue if safe, review the report, export it, and email it to support@byldya.com.

Include these details

  • A short description of what you were trying to do.
  • The exact error text shown by M-AD.
  • M-AD version and macOS version.
  • Connection mode: demo, password LDAP/LDAPS, or Kerberos.
  • Target style: AD DNS discovery, hostname/server override, or direct IP.

Privacy and Exported Data

Topic ID: privacy_exports

Credentials stay in Keychain, connection profile exports omit plaintext passwords, Keychain identifiers, and invalid-certificate bypass state, and diagnostics are generated locally. Review exported reports before sharing because they may include object names, DNs, policy values, trustees, and local audit context.