Skip to main content
Question

Restrict Logins to specific AD group

  • November 16, 2016
  • 1 reply
  • 13 views
rstasel
Forum|alt.badge.img+13

Hi All,

I'm going to be rolling out new lab environments in the next few weeks, and part of that is integrating with AD, which is Campus Wide, rather than our OD environment that is only our school. Our labs are restricted to our students, however.

Apparently, Apple has had a bug since at least 10.9 that prevents Configuration Profiles from restricting logins to specific users in AD. And while I can set it manually on my test computer (System Prefs, Users, Login Options, Network Users), I obviously can't do that manually on 150 computers. Has anyone figured out how to script setting those restrictions so they can be set during imaging, or on startup via Casper? This is quite literally my last hurdle in this whole endeavor (well, until I round the corner and find others).

Thank you!

1 reply

rstasel
Forum|alt.badge.img+13
  • rstasel
  • Author
  • Valued Contributor
  • November 17, 2016

Think I figured it out. This seems to work.

https://www.jamf.com/jamf-nation/discussions/4591/restrict-logon-to-specific-active-directory-groups#responseChild22732

Script is: 

#!/bin/bash

dscl . -create /Groups/com.apple.loginwindow.netaccounts
dscl . -create /Groups/com.apple.loginwindow.netaccounts PrimaryGroupID 206
dscl . -create /Groups/com.apple.loginwindow.netaccounts Password *
dscl . -create /Groups/com.apple.loginwindow.netaccounts RealName "Login Window's custom net accounts"

dscl . -create /Groups/com.apple.access_loginwindow
dscl . -create /Groups/com.apple.access_loginwindow PrimaryGroupID 223
dscl . -create /Groups/com.apple.access_loginwindow Password *
dscl . -create /Groups/com.apple.access_loginwindow RealName "Login Window ACL"

dseditgroup -o edit -n /Local/Default -a ADGroup -t group com.apple.loginwindow.netaccounts
dseditgroup -o edit -n /Local/Default -a com.apple.loginwindow.netaccounts -t group com.apple.access_loginwindow
Terms & ConditionsCookie settingsAccessibility statement