AD Cache profile syncing

ChristopherGlov
New Contributor III

Has anyone figured out how to sync the cache profile with ad? Our company policy for passwords to expires every 60 days is starting to create a lot of tickets. I was thinking maybe doing something with a launch agent.

7 REPLIES 7

jason_bracy
Contributor III

Sorry, I'm confused as to what you are asking. Can you clarify? Are your Macs joined to AD? using mobile accounts? If so I don't understand why there would be an increase in tickets when passwords expire. Are the users not connected to the network so they are unable to change their passwords?

ChristopherGlov
New Contributor III

Some users have more than one Mac and or use a PC. So a lot of users will change their passwords on a PC or one of their macs but any other mac of theirs they have doesnt update so they have to go through the whole password change again on the secondary mac.

rqomsiya
Contributor III

@TheBeastie :

Why do they have to go through the entire reset again on their second macs? They should just be able to connect to the network and login with their new AD creds.

If these Macs are FV2 enabled, then they will need to enter their old PW (if it was changed) to authenticate. Then, i would recommend they log out and back in with their new creds to update keychain.

Might want to take a look at NoMAD. It can help sync up a users keychain... Just some thoughts....

-R

jason_bracy
Contributor III

@rqomsiya is correct. Assuming that your Macs can talk to Active Directory, then changing the password on one computer will change it in Active Directory and assuming that all of the Macs can talk to AD they should all be able to login with the new password. The issue comes with macOS 10.13 not being able to change the FileVault password for Mobile accounts if it was changed on a different computer. So the login password will change, but the FileVault password will still be the old password.

ChristopherGlov
New Contributor III

its odd because I original thought that too but from experience at least in this environment the mobile profile doesn't update with the new password from AD. I'm doing some digging to see why but that's where we are right now.

jason_bracy
Contributor III

You may want to look at using a Policy instead of a Profile for domain joining. I found that the AD Config Profile can be a bit flakey.

ChristopherGlov
New Contributor III

That's probably what it is.