3

I have a handful of Mac's running Mavericks and up. Each Mac is generally used by 1-3 people. Each person is a member of a specific AD group.

Pre-deployment we added that AD group to the "Allow Administration By" field with "domain\groupname" format. Pre-deployment and shortly after deployment, the end users were able to administer the Macs without issue. They could escalate processes with their credentials.

Since then, none of the Macs recognize our users as administrators anymore, myself included (I'm in a separate AD group membership that was added at the same time). We then started going into each user profile and checking the "Allow user to administer this computer" checkbox, which again worked for a time but no longer does.

We have started falling back on the local administrator user account to manually authenticate when needed, but we're not able to share that password with end users.

The following link is what I used for reference: https://support.apple.com/en-us/HT202112

Is there something we're missing? Why would the administrative behavior work for a time then just stop?

Edit: This is not a duplicate to AD User as an administrator on the Mac?. I have tried all of the steps outlined in the link I originally referenced. The key issue is that I do actually get local administrator privileges for a short period, but then for some unexplained reason, all users but administrator lose their privileges and no longer escalate privileges.

Improve this question
1
  • This wasn't and still is no duplicate! But the wording of the catch line has to be improved... – klanomath May 19 '17 at 19:32
0

This sort of pain isn't practically avoidable. The solution is to unbind your macOS computers from the domain and use a product like Nomad or Apple Enterprise Connect to get the password sync, kerberos certificates that allow single sign on without all the pain of binding.

Alternatives are the open source Nomad (which exists alongside with it's commercial version Jamf Connect) and Enterprise Connect that integrates a local password without needing to bind to AD.

Improve this answer
2
  • Thank you for the recommendations! I know Apple has always been rough with AD integration but I was hoping it was something I was doing wrong. In the small reading I did, it looks like my issue is related to mobile account creation on the local Mac when bound to a domain. What exactly is breaking I'm still not sure, but at least I know it's not just me. Thank you again! – Residualfail Sep 25 '17 at 14:57
  • No - AD binding is a world of pain, you can sidestep it for a while or perhaps for ever, but most organizations / people eventually decide it's more hassle than benefit to bind over time as support costs erase any "gain" they thought they realized. – bmike♦ Apr 18 '19 at 11:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .