I'm fairly new to the world of Mac. I've had the administering of around 100 macs thrust upon me (previous guy left, little documentation. Only things like the images he used, no documentation of whats in them Merry Christmas to me! :( ) As far as I can tell, they had no Administration system in place. The solution was basically get everything the way you want it on the master, disable updates and things, clone to other machines. Repeat every several months/ year or so (based on image dates)

Anyway, my manager wants me doing things differently. I'm working on integrating the Macs into our AD somewhat. When I bind them to our AD with a name like M109831-TED117 it shows up in AD as m109831_ted117. While the capitalization isn't an issue, the underscore is very inconvenient.

We are on a Win 2008 DNS server. this is Binding Mac clients ranging from 10.5-10.7 and I tried both Directory Utility (like here http://blog.pluralsight.com/join-mac-to-windows-domain) and through the comparable dsconfigad commands


When binding to AD why does my dash become an underscore? Put in name M109831-TED117 when binding and it shows in AD as m109831_ted117. can this be changed?

  • I think that you're going to have to search through Microsoft to determine why AD is parsing the name the way that it is. For your other administration tasks for the Macs, I'd suggest looking at Apple Remote Desktop if it's not already in place.
    – douggro
    Commented Nov 20, 2014 at 15:54
  • I actually just finished getting ARD purchase pushed through! It looks like it's going to be a nice management console for them. My administrators aren't super into mac ecosystem and they aren't super thrilled about making changesin their side. They seem to expect I can manage it all without making any changes in any of their MS infrastructure. I'm not sure that will be possible. But, hey, it'll be an interesting experience that will certainly be going on my resume!
    – PsychoData
    Commented Nov 20, 2014 at 15:59
  • I just realized that my question title was still DNS related. (I started to ask a DNS question and then ended up writing about the binding dealio)
    – PsychoData
    Commented Nov 20, 2014 at 16:01
  • What version of Windows Server are your AD DCs running (2008; 2012?) What version of OS X are you attempting to bind to that domain (Mavericks; Yosemite?) How are you binding the machines (Directory Utility; System Preferences; dsconfigad?) FWIW, when binding a Yosemite machine to a 2008 AD domain, I'm seeing that both hyphens and underscores in the name work correctly, and are not changed. Both Directory Utility and ADUC reflect the correct client name in either case. Commented Mar 26, 2015 at 23:07

3 Answers 3


I thought it could be a machine based GPO that was applied to either the Mac clients or the DNS server.

However, I did a little digging and found this: http://www.bu.edu/tech/files/2009/10/AD-OD-10.6-1.pdf

Look on page 6. It specifically mentions about OpenDirectory and how it renames dashes to underscores. It looks like the change is coming from the Mac end of things. Why? I found this regarding OpenLDAP which is what Open Directory is based on: OpenLDAP Hyphens within attribute names considered as separate tokens

It appears to be a software bug.

  • So, basically Apple just purposefully ignored it and there is no fix
    – PsychoData
    Commented Mar 26, 2015 at 4:23
  • It appears that way. I haven't been able to find a workaround other than the underscores.
    – Allan
    Commented Mar 26, 2015 at 4:34

As per this Apple Support article it's a DNS limitation.

You might also want to check out the dsconfigad and scutil command-line tools.

  • 1
    I'm a bit confused da4. A. This article says the - is a valid character. B. I have several hundred other windows computers that all have dashes in their hostnames with no problem which work fine and are pingable from my Mac. C. The article says the underscore is not valid in DNS domain name. Not a hostname. There should be no problem having host_one.contoso.com but hostone.con_toso.com is not bueno.
    – PsychoData
    Commented Nov 20, 2014 at 16:16

Your problem sounds backwards. The minus "-" sign is an allowed character in DNS and NetBIOS and the underscore "_" is disallowed. See http://support.microsoft.com/en-us/kb/909264

If it is forcing a change, then there may be a GPO that is enforcing the name change.

  • Nope. All my macs are forcing - to _ and registers with AD and DNS as the _ variety. Now, in the part just below the list of DNS Disallowed characters it does say that it is properly used as the first char of srv records and may be supported anywhere by newer DNS servers. I don't think I can have a GPO on the macs...can I? anywho I have hundreds of Windows client's that are P109122-BLD123 or similarly formatted. the longest variety being P105122-BLD129a (15 chars to make windows happy, per your link)
    – PsychoData
    Commented Mar 25, 2015 at 21:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .