I'm looking for a way to add an Active Directory user to a Mac and let them administrate the machine, without making more than just that user an administrator.

Right now, I'm using Directory Utility to add an AD group, we'll call it Domain Devs, to the Allow Administration By: list. This would allow Bob, Nancy, Paul, and Bill to administer the computer. But this machine is supposed to go to Bob, so I only want him to administrate it. I then have to go to the login options and tell it to only allow Bob to log into the computer.

So while Bob, Nancy, Paul and Bill can administer it, only Bob can log in.

There is a concern that other users will be able to log into or gain access to the machine through another method of login or security breach and have administration rights to the system.

We're looking for a way to do something similar to what happens in Windows when you take a user in AD and add that specific user to the local Administrators group, so Bob could be added to that specific computer and have admin rights and any other domain user can log in and have just limited user rights.

Is there a way to do this, add a specific AD user to the Mac as an administrator without using a group in AD with just that user in it?

  • Did you ever figure out how to do this? I'm in the same situation with several users needing this after migrating to an AD domain.
    – user49099
    Commented Jun 17, 2013 at 16:51
  • Not really without the kludgey workaround. Basically we have all domain users able to administrate the machine, then only allow particular users to log into it. Not the best management scheme by a long shot. Commented Jun 17, 2013 at 19:23

2 Answers 2


Does this command not work for you?

dseditgroup -o edit -n /Local/Default -u localadmin -p -a networkuser -t user admin

details: Mac OS X: Allowing administration by network accounts


Here is a simplified version of a bash script that I used to connect all the computers in my workplace to the Windows AD.

#!/usr/bin/env bash
### Obtain AD credentials
function setupAD {
        echo "Enter computer name:"
        read macName
        echo "Enter domain:"
        read domainURL
        echo "Enter Active Directory username (e.g. [email protected]):"
        read adAccount
        echo "Enter Active Directory password:"
        read adPassword
        echo "Enter Mac local admin username:"
        read localAdmin
        echo "Enter Mac local admin password:"
        read localPassword

### Convert $macName to spaceless string
function macNameString {
        netBMacName=$(echo "$macName"  | sed 's/ /-/g')

### Configure Computer name for networking
function configNetBIOS {
        echo "$localPassword" | sudo -S scutil --set ComputerName "$macName"
        echo "$localPassword" | sudo -S scutil --set HostName "$macName"
        echo "$localPassword" | sudo -S scutil --set LocalHostName "$netBMacName"
        echo "$localPassword" | sudo -S defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server NetBIOSName -string "$netBMacName"

### Setup the AD connection between Mac and AD
function configureAD {
        echo "$localPassword" | sudo -S dsconfigad –f –a "$macName" –domain "$domainURL" –u "$adAccount" –p "$adPassword" –lu "$localAdmin" –lp "$localPassword"

### Convert $macName to spaceless string
function macNameString {
        comp=$(echo "$macName"  | sed 's/ /-/g')

### Run the setup
function runSetup {

exit 0
  • Just save it as something with .sh on the end, and chmod a+x that file to make it executable from Terminal. Commented Mar 8, 2014 at 8:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .