Using AD accounts on macOS does not mean Windows device policies apply. I tested binding, GUI/SSH access, mobile accounts, and a GPO control on a macOS Sequoia lab VM. The useful result separates directory identity from device management.

PVE virtualization was the experiment's background, not an installation guide or compatibility guarantee for every Mac. Names, OU, accounts, and addresses are examples. corp.example.com is the DNS domain, while LAB is a separately chosen NetBIOS name.

Clients cannot reach the FSx file server via a DNS alias. Packet capture shows the network path is fully reachable; the failure is in Kerberos — the KDC cannot find the service principal for the alias. The root cause is the alias missing a HOST/ SPN registered on the FSx AD computer object.

After adding NTFS security permissions to an FSx ONTAP SMB share, users are still unable to access it. The key to this issue is: the effective Windows SMB permission is the intersection of share permissions and NTFS permissions, and Kerberos tickets do not automatically refresh group membership while the user remains logged in.