Allow only specific AD users/groups to login

Question

I've been doing some testing as my company is planning to integrate our mac users into the windows active directory environment.

Joining/removing computers from a windows domain is cake, everything can be done via the Mac's Directory Utility.

Is there a way for us to control which active directory users or groups can login to this mac?

After joining a mac to a windows domain, anyone with a proper domain account can login to the computer. And by proper, I mean anyone from the domain by default.

Thanks!

Answer 1

You can modify the properties of com.apple.loginwindow.netaccounts and com.apple.access_loginwindow to create custom login access. This can also be achieve through third party vendors. Centrify is a good third party mac AD plugin that allows to set Zones(AD Users/groups) for login access. There are also MCX and profile options to set login window access. Below is the way I have gotten to work using the modifying com.apple files for custom access.

Centrify Link

Original Link to guide I used ---> Answer is about half way down in the comments.

You can manually edit and add AD groups with dseditgroup. First check to see if the two files exist:

/private/var/db/dslocal/nodes/Default/groups/com.apple.loginwindow.netaccounts

and

/private/var/db/dslocal/nodes/Default/groups/com.apple.access_loginwindow

If those files exist then move on to "Adding the groups to the access_loginwindow" below. If they don't exist you will need to create them with:

dscl . -create /Groups/com.apple.loginwindow.netaccounts
dscl . -create /Groups/com.apple.loginwindow.netaccounts PrimaryGroupID $GID1
dscl . -create /Groups/com.apple.loginwindow.netaccounts Password \*
dscl . -create /Groups/com.apple.loginwindow.netaccounts RealName "Login Window's custom net accounts"

dscl . -create /Groups/com.apple.access_loginwindow
dscl . -create /Groups/com.apple.access_loginwindow PrimaryGroupID $GID2
dscl . -create /Groups/com.apple.access_loginwindow Password \*
dscl . -create /Groups/com.apple.access_loginwindow RealName "Login Window ACL"

You will need to change $GID1 and $GID2 in the above script to a free GID number, for both the com.apple.loginwindow.netaccounts and com.apple.access_loginwindow files. You can use this script to check if a GID is being used by the system.

dscl . -list /Groups PrimaryGroupID | grep $desiredGID

Change $desiredGID to a number you want to check is free. (I used 206 for netaccounts and 235 for acess_loginwindow from the guide linked above, and they were always open)

"Adding the groups to the access_loginwindow"

dseditgroup -o edit -n /Local/Default -u admin -p -a ADgroup -t group com.apple.loginwindow.netaccounts

Change ADgroup to the name of the Active Directory group you want to allow access to at the login window. (ex. "Sales Team"). Also change admin to your local user admin account. It will prompt for password.

Then add the com.apple.loginwindow.netaccounts to the com.apple.access_loginwindow file.

dseditgroup -o edit -n /Local/Default -u admin -p -a com.apple.loginwindow.netaccounts -t group com.apple.access_loginwindow

dseditgroup -o edit -n /Local/Default -a localaccounts -t group com.apple.access_loginwindow

Again change admin to your local admin account. The first one adds the file that holds the AD groups nested in it, the second line allows for your local accounts on the computer to log in. Now if you go to System Preferences-->Users & Groups-->Login Options-->Options next to "Allow network users to log in at login window". You should see the AD groups listed that you want allowed to access the computer.