Active Directory user accounts have a property that allows admins to restrict them to specific machines. I.E. the user can only log onto a select list of Windows machines.

Why am I mentioning this on a Mac OS forum? Because for years, I counted on the fact that restricting a user account would prevent it from logging into any Mac. At some point in the last few years (I don't know when because I wasn't regularly testing it.), that has changed and for the worse.

Now, a restricted user account is still restricted to the specifically named Windows computers, but they can log into ANY (modern) Mac OS machine. That is bad! Attempting to log into a Windows machine still pops up a "you aren't allowed" message, but MacOS... eh, no problem.

Does anyone know when this change occured, and more importantly, how to fix it (on the MacOS side) so restricted AD accounts are still actually restricted?


Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.