I had a user that was set up to administer an OS X machine. That user is an AD account, with mobile accounts enabled. The user's AD group is set to allow administration using the directory utility.
I was contacted by the user while he was on the road, saying that he couldn't install a program. It would ask for an administrative user and password, and give a dialog bounce when he entered his information.
When he got to one of our offices, he connected to their network and it let him install the application.
Does the settings for users in an AD group allowed to administer the machine only work when the machine is in communication to AD servers, even with mobile accounts set up to allow caching of user credentials? Is there a way to cache the fact that user Bob is able to administer the machine without creating a separate user account?