4

My account is associated with an active directory of a previous company i was working at.

What is the best way to unbind my account from the AD without losing my files? I have admin access to the machine, and all the files are locally available.

The account is admin/managed and mobile.

Improve this question
0

1 Answer 1

Reset to default
5
  1. Login to a different admin account.
  2. Delete your account, choosing "Don't change the home folder" option.
  3. Open Terminal and rename your home folder, eliminating the " (Deleted)" part -- sudo mv "/Users/yourshortname (Deleted)" /Users/yourshortname
  4. Unbind your machine (Login Options tab, at the bottom)
  5. Create a new account with the same short name.
  6. Use the existing folder, when you're prompted.

An update to my comment of Sep 6 at 15:24 and part of #4 -- Apple has just issued a supplemental update that fixes this loophole. The text of their security announcement is:

APPLE-SA-2013-10-03-1 OS X v10.8.5 Supplemental Update

OS X v10.8.5 Supplemental Update is now available and addresses the following:

Directory Services Available for: OS X Mountain Lion v10.8 to v10.8.5 Impact: A local user may modify Directory Services records with system privileges

Description: A logic issue existed in Directory Services's verification of authentication credentials allowing a local attacker to bypass password validation. The issue was addressed through improved credential validation. CVE-ID CVE-2013-5163 : the rookies of 42

Improve this answer
4
  • Also, probably a good idea to delete the directory services and managed preferences from your library...but it probably won't be a huge problem if you don't do that.
    – gotshallmaxon
    Aug 27, 2013 at 19:48
  • thanks. i will test this over the long week-end and report back.
    – machunter
    Aug 29, 2013 at 18:55
  • you might want to expand your answer regarding unbinding: you need the AD admin account for step 4.
    – machunter
    Sep 2, 2013 at 17:36
  • In my experience, it asks for, but will still unbind without, the AD user/password.
    – gotshallmaxon
    Sep 6, 2013 at 15:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .