3

Using OSX server profiles to configure our fleet of Active Directory connected Macbooks.

When our laptops are not connected to the internal network (or via VPN), their AD group membership is lost. Sudo is locally configured to allow an AD admin group access to sudo, however when AD is unavailable, users can no longer sudo.

Best solution would be to allow group membership to be cached locally, but since I believe this to be impossible (read: undocumented), I'm searching for a plist that would allow me to add the local user (using %shortname) to the sudoers file.

|improve this question
  • I've tagged this with MDM - I don't think there is a plist to help for this and you'll need to script/automate it. Are your local users admin users by default? Shouldn't that solve the issue whether or not AD is present? – bmike♦ Feb 10 '16 at 18:19
  • They aren't local users. They're mobile accounts from Active Directory. – derjur Feb 10 '16 at 18:22
  • Using OSX Server, I see this as a configuration point: m.b33rti.me/c7857a.png – derjur Feb 10 '16 at 18:26
1

You can cache AD credentials by creating a "mobile account" on each machine. From Directory Utility > Active Directory > open disclosure triangle > User Experience > Create mobile account at login. Although, I will warn you, I have had some permissions issues when 'creating a mobile account' after the home folder/user has already been created.

|improve this answer
  • We have mobile accounts enabled. The problem is that their AD group membership is not maintained when they can't reach the domain controllers. – derjur Feb 10 '16 at 20:25
0

Your solution is likely going to make two changes to your workflow:

  1. Make a new local group that will allow sudoer access and modify /etc/sudoers to give that group access to sudo
  2. Modify the user creation steps to either add the local user to admin or to the sudoer group - that will allow them to be normal admins (and get sudo by default) or to get sudo on the coat-tails of the new group.

You could use puppet to make the file change - but you probably have another solution for making changes to your computers.

|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .