How a Dual Directory System Works

The OD Master will bind to the AD Server and join the Kerberos Realm of the AD server.  This will allow the OD Master to read all the users on the AD Server.

The client computer will bind to both the AD server and the OD Master.  This will allow a user to log into the client Mac with their AD credentials and provide computer group management on the OD Master.

All user policies are still managed on the AD server and all computer management is done on the OD Master.