Skip to main content
Question

AD user admin rights

  • February 27, 2015
  • 7 replies
  • 23 views

Forum|alt.badge.img+10

Is there a way for me to make a certain AD user an admin on a mac cart of 30 macbook air's?

7 replies

Forum|alt.badge.img+9
  • Contributor
  • February 27, 2015

In the directory bindings, under the Administration tab you can set a group or groups in the "Allow administration by" field to an AD security group that the user belongs to.

If you want it to be just that cart, create a separate binding for that cart specifically.


RobertHammen
Forum|alt.badge.img+28
  • Esteemed Contributor
  • February 27, 2015

Yes, in your AD binding prefs (must apply to all of the Macs in the cart), you can specify AD groups that are automatically admins on a machine.

Directory Utility->Active Directory->Administrative tab, checkbox for "Allow Administration by:" - click the + and add each AD group (must spell the group name correctly ;-)
If you do this via the JSS AD bind, it's very similar, except you get a text field and must type the groups, separated by commas. Be aware not to leave a space between the comma delimiting group names and the next name, or else those groups won't be admins (learned this the hard way once a long time ago ;-)

Hope this helps,

--Robert


Forum|alt.badge.img+10
  • Author
  • Valued Contributor
  • February 27, 2015

What if the cart has already been binded and enrolled in our systems...


Forum|alt.badge.img+14
  • Contributor
  • February 27, 2015

I use the following script to add AD groups as admins to an existing binding. To use it you would enter the security group name in the $4 parameter.

#!/bin/bash

CURRENTGROUPS=`dsconfigad -show | grep "Allowed admin groups" | awk 'BEGIN {FS = "="};{print $2}' | sed 's/ //'`
NEWGROUP="yourdomain\\$4"

dsconfigad -groups "$CURRENTGROUPS,$NEWGROUP"
VALIDATEGROUPS=`dsconfigad -show | grep "Allowed admin groups" | awk 'BEGIN {FS = "="};{print $2}' | sed 's/ //'`

if [ "$VALIDATEGROUPS" == "$CURRENTGROUPS,$NEWGROUP" ]
    then
        echo "$LOGHEADER $SCRIPTNAME result: Admin Groups configured successfully." >> /var/log/yourfile.log
        exit 0
    else
        echo "$LOGHEADER $SCRIPTNAME result: Unable to set admin groups." >> /var/log/yourfile.log
        exit 1
fi

RobertHammen
Forum|alt.badge.img+28
  • Esteemed Contributor
  • February 27, 2015

script to unbind, and a policy to rebind using the new AD binding settings.

https://derflounder.wordpress.com/2013/10/09/force-unbinding-with-dsconfigad-without-using-an-active-directory-admin-account/

Be aware that this won't remove the Computer Object from AD, but that shouldn't be a big deal in this situation.


bentoms
Forum|alt.badge.img+35
  • Hall of Fame
  • February 28, 2015

@EliasG, We did what @Josh.Smith recommended a while ago across our client estate.

We then added that group to our binding, & when building Mac servers via Casper we then added a step to remove the same group.

No need to unbind then rebind.


CavCurator
Forum|alt.badge.img+4
  • Contributor
  • August 9, 2024

I use the following script to add AD groups as admins to an existing binding. To use it you would enter the security group name in the $4 parameter.

#!/bin/bash

CURRENTGROUPS=`dsconfigad -show | grep "Allowed admin groups" | awk 'BEGIN {FS = "="};{print $2}' | sed 's/ //'`
NEWGROUP="yourdomain\\$4"

dsconfigad -groups "$CURRENTGROUPS,$NEWGROUP"
VALIDATEGROUPS=`dsconfigad -show | grep "Allowed admin groups" | awk 'BEGIN {FS = "="};{print $2}' | sed 's/ //'`

if [ "$VALIDATEGROUPS" == "$CURRENTGROUPS,$NEWGROUP" ]
    then
        echo "$LOGHEADER $SCRIPTNAME result: Admin Groups configured successfully." >> /var/log/yourfile.log
        exit 0
    else
        echo "$LOGHEADER $SCRIPTNAME result: Unable to set admin groups." >> /var/log/yourfile.log
        exit 1
fi

This worked beautifully - thanks for sharing!