Active Directory user accounts have a property that allows admins to restrict them to specific machines. I.E. the user can only log onto a select list of Windows machines.
Why am I mentioning this on a Mac OS forum? Because for years, I counted on the fact that restricting a user account would prevent it from logging into any Mac. At some point in the last few years (I don't know when because I wasn't regularly testing it.), that has changed and for the worse.
Now, a restricted user account is still restricted to the specifically named Windows computers, but they can log into ANY (modern) Mac OS machine. That is bad! Attempting to log into a Windows machine still pops up a "you aren't allowed" message, but MacOS... eh, no problem.
Does anyone know when this change occured, and more importantly, how to fix it (on the MacOS side) so restricted AD accounts are still actually restricted?