Purpose: Centrify makes a special account which is not AD bound yet uses their own proprietary authentication mechanism. Before uninstalling Centrify, use this instruction set to demobilze the account to a standard local account.
- Download a copy of NoMAD Login (NoLOAD) from: https://files.nomad.menu/NoMAD-Login-AD.pkg
- Install the .pkg file
- In terminal, run the following command
sudo authchanger -reset -preAuth NoMADLoginAD:DeMobilize,privileged - In terminal, run the following command
sudo defaults write /Library/Preferences/menu.nomad.login.ad.plist DemobilizeUsers -bool TRUE - Log out
- Log in. You’ll see a normal macOS login screen, but the DeMobilize mech is still enabled to work. The user account is then converted from a Centrify user to a local user.
- Confirm by running sudo dscl . read /Users/[testedusername] AuthenticationAuthority
- The results should look something like:
AuthenticationAuthority: ;ShadowHash;HASHLIST:<SALTED-SHA512-PBKDF2... - and have no reference to LocalCachedUser or Centrify …
AuthenticationAuthority: ;LocalCachedUser;/CentrifyDC/Default:testedusername - Disable NoLOAD in terminal with the following command:
sudo authchanger -reset - If desired, uninstall NoLOAD by deleting /Library/Security/SecurityAgentPlugs/NoMADLoginAD.bundle and /usr/local/bin/authchanger and /Library/Preferences/menu.nomad.login.ad.plist
EA to test machines for additional mobile accounts stolen gratuitously from https://www.jamf.com/jamf-nation/discussions/10179/determine-if-an-account-is-a-mobile-or-local-account
#!/bin/sh NETACCLIST=`dscl . list /Users OriginalNodeName | awk '{print $1}' 2>/dev/null` if [ "$NETACCLIST" == "" ]; then echo "<result>No Network Accounts</result>" else echo "<result>$NETACCLIST</result>" fi exit 0 |
