diff --git a/config/registration.php b/config/registration.php
index 82087799..b92f56a1 100644
--- a/config/registration.php
+++ b/config/registration.php
@@ -61,6 +61,7 @@ return [
         'group_assignment_mode' => getenv('LDAP_GROUP_ASSIGNMENT_MODE') ?: 'group_memberuid',
         'group_member_attribute' => getenv('LDAP_GROUP_MEMBER_ATTRIBUTE') ?: 'memberUid',
         'default_login_shell' => '/bin/sh',
+        'apple_schema_enabled' => filter_var(getenv('LDAP_APPLE_SCHEMA_ENABLED') ?: 'false', FILTER_VALIDATE_BOOL),
         'home_directory_prefix' => '/home',
         'uid_number_start' => (int) (getenv('LDAP_UID_NUMBER_START') ?: 1000010),
         'gid_number_default' => (int) (getenv('LDAP_GID_NUMBER_DEFAULT') ?: 1000012),
diff --git a/src/App/LdapProvisioner.php b/src/App/LdapProvisioner.php
index 9b652ec5..99b92fdd 100644
--- a/src/App/LdapProvisioner.php
+++ b/src/App/LdapProvisioner.php
@@ -321,16 +321,14 @@ final class LdapProvisioner
         $unixHash = $this->cryptSha512($plainPassword);
         $now = time();
         $shadowLastChange = (string) floor($now / 86400);
+        $appleSchemaEnabled = (bool) ($this->config['ldap']['apple_schema_enabled'] ?? false);
 
-        return [
+        $entry = [
             'objectClass' => [
-                'apple-user',
-                'extensibleObject',
                 'inetOrgPerson',
                 'organizationalPerson',
                 'person',
                 'posixAccount',
-                'sambaIdmapEntry',
                 'sambaSamAccount',
                 'shadowAccount',
                 'top',
@@ -342,14 +340,13 @@ final class LdapProvisioner
             'sn' => $familyName !== '' ? $familyName : $username,
             'uid' => $username,
             'uidNumber' => $uidNumber,
-            'apple-generateduid' => $appleGeneratedUid,
-            'authAuthority' => ';basic;',
             'displayName' => $displayName !== '' ? $displayName : $username,
             'gecos' => $gecos,
             'givenName' => $givenName,
             'loginShell' => $loginShell,
             'mail' => $mail,
-            'sambaAcctFlags' => '[U            ]',
+            'pwdLastSet' => '0',
+            'sambaAcctFlags' => '[U          ]',
             'sambaLMPassword' => 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',
             'sambaNTPassword' => $ntHash,
             'sambaPasswordHistory' => '0000000000000000000000000000000000000000000000000000000000000000',
@@ -363,6 +360,15 @@ final class LdapProvisioner
             'shadowWarning' => (string) ($this->config['ldap']['shadow_warning'] ?? 7),
             'userPassword' => $unixHash,
         ];
+
+        if ($appleSchemaEnabled) {
+            array_unshift($entry['objectClass'], 'extensibleObject');
+            array_unshift($entry['objectClass'], 'apple-user');
+            $entry['apple-generateduid'] = $appleGeneratedUid;
+            $entry['authAuthority'] = ';basic;';
+        }
+
+        return $entry;
     }
 
     /**
diff --git a/src/App/RegistrationLdifBuilder.php b/src/App/RegistrationLdifBuilder.php
index e0dcd6de..8adf6ba1 100644
--- a/src/App/RegistrationLdifBuilder.php
+++ b/src/App/RegistrationLdifBuilder.php
@@ -35,6 +35,7 @@ final class RegistrationLdifBuilder
         $mail = trim((string) ($request['email'] ?? ''));
         $appleGeneratedUid = trim((string) ($provisioning['apple_generateduid'] ?? $this->generateUuidV4()));
         $sambaSid = trim((string) ($provisioning['samba_sid'] ?? ''));
+        $appleSchemaEnabled = (bool) ($this->config['ldap']['apple_schema_enabled'] ?? false);
         $shadowExpire = (string) ($this->config['ldap']['shadow_expire'] ?? 1);
         $shadowFlag = (string) ($this->config['ldap']['shadow_flag'] ?? 0);
         $shadowInactive = (string) ($this->config['ldap']['shadow_inactive'] ?? 0);
@@ -77,16 +78,19 @@ final class RegistrationLdifBuilder
         }
 
         $lines[] = 'dn: uid=' . $username . ',' . $usersDn;
-        $lines[] = 'objectClass: apple-user';
-        $lines[] = 'objectClass: extensibleObject';
         $lines[] = 'objectClass: inetOrgPerson';
         $lines[] = 'objectClass: organizationalPerson';
         $lines[] = 'objectClass: person';
         $lines[] = 'objectClass: posixAccount';
-        $lines[] = 'objectClass: sambaIdmapEntry';
         $lines[] = 'objectClass: sambaSamAccount';
         $lines[] = 'objectClass: shadowAccount';
         $lines[] = 'objectClass: top';
+
+        if ($appleSchemaEnabled) {
+            $lines[] = 'objectClass: apple-user';
+            $lines[] = 'objectClass: extensibleObject';
+        }
+
         $lines[] = 'cn: ' . $cn;
 
         if ($gidNumber !== '') {
@@ -106,10 +110,13 @@ final class RegistrationLdifBuilder
             $lines[] = 'uidNumber: ' . $uidNumber;
         }
 
-        $lines[] = 'apple-generateduid: ' . strtoupper($appleGeneratedUid);
-        $lines[] = 'authAuthority: ;basic;';
         $lines[] = 'displayName: ' . ($displayName !== '' ? $displayName : $username);
 
+        if ($appleSchemaEnabled) {
+            $lines[] = 'apple-generateduid: ' . strtoupper($appleGeneratedUid);
+            $lines[] = 'authAuthority: ;basic;';
+        }
+
         if ($gecos !== '') {
             $lines[] = 'gecos: ' . $gecos;
         }
@@ -125,6 +132,11 @@ final class RegistrationLdifBuilder
             $lines[] = 'memberOf: ' . $groupDn;
         }
 
+        $lines[] = 'pwdLastSet: 0';
+        $lines[] = 'sambaAcctFlags: [U          ]';
+        $lines[] = 'sambaLMPassword: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX';
+        $lines[] = 'sambaPasswordHistory: 0000000000000000000000000000000000000000000000000000000000000000';
+        $lines[] = 'sambaPwdLastSet: 0';
         $lines[] = 'shadowExpire: ' . $shadowExpire;
         $lines[] = 'shadowFlag: ' . $shadowFlag;
         $lines[] = 'shadowInactive: ' . $shadowInactive;