Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I'm looking for a way to add an Active Directory user to a Mac and let them administrate the machine, without making more than just that user an administrator.

Right now, I'm using Directory Utility to add an AD group, we'll call it Domain Devs, to the Allow Administration By: list. This would allow Bob, Nancy, Paul, and Bill to administer the computer. But this machine is supposed to go to Bob, so I only want him to administrate it. I then have to go to the login options and tell it to only allow Bob to log into the computer.

So while Bob, Nancy, Paul and Bill can administer it, only Bob can log in.

There is a concern that other users will be able to log into or gain access to the machine through another method of login or security breach and have administration rights to the system.

We're looking for a way to do something similar to what happens in Windows when you take a user in AD and add that specific user to the local Administrators group, so Bob could be added to that specific computer and have admin rights and any other domain user can log in and have just limited user rights.

Is there a way to do this, add a specific AD user to the Mac as an administrator without using a group in AD with just that user in it?

share|improve this question
    
Did you ever figure out how to do this? I'm in the same situation with several users needing this after migrating to an AD domain. –  user49099 Jun 17 '13 at 16:51
    
Not really without the kludgey workaround. Basically we have all domain users able to administrate the machine, then only allow particular users to log into it. Not the best management scheme by a long shot. –  Bart Silverstrim Jun 17 '13 at 19:23

2 Answers 2

Does this command not work for you?

dseditgroup -o edit -n /Local/Default -u localadmin -p -a networkuser -t user admin

details: Mac OS X: Allowing administration by network accounts

share|improve this answer

Here is a simplified version of a bash script that I used to connect all the computers in my workplace to the Windows AD.

#!/usr/bin/env bash
### Obtain AD credentials
function setupAD {
        echo "Enter computer name:"
        read macName
        clear
        echo "Enter domain:"
        read domainURL
        clear
        echo "Enter Active Directory username (e.g. userid@domain.com):"
        read adAccount
        clear
        echo "Enter Active Directory password:"
        read adPassword
        clear
        echo "Enter Mac local admin username:"
        read localAdmin
        clear
        echo "Enter Mac local admin password:"
        read localPassword
        clear
}

### Convert $macName to spaceless string
function macNameString {
        netBMacName=$(echo "$macName"  | sed 's/ /-/g')
}

### Configure Computer name for networking
function configNetBIOS {
        echo "$localPassword" | sudo -S scutil --set ComputerName "$macName"
        echo "$localPassword" | sudo -S scutil --set HostName "$macName"
        echo "$localPassword" | sudo -S scutil --set LocalHostName "$netBMacName"
        echo "$localPassword" | sudo -S defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server NetBIOSName -string "$netBMacName"
}

### Setup the AD connection between Mac and AD
function configureAD {
        echo "$localPassword" | sudo -S dsconfigad –f –a "$macName" –domain "$domainURL" –u "$adAccount" –p "$adPassword" –lu "$localAdmin" –lp "$localPassword"
}

### Convert $macName to spaceless string
function macNameString {
        comp=$(echo "$macName"  | sed 's/ /-/g')
}

### Run the setup
function runSetup {
        setupAD
        macNameString
        configNetBIOS
        configureAD
}

runSetup
exit 0
share|improve this answer
    
Just save it as something with .sh on the end, and chmod a+x that file to make it executable from Terminal. –  Danijel J Mar 8 at 8:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.