Skip to main content
Question

Add an Active Directory group to an existing LDAP Configuration

  • July 14, 2014
  • 1 reply
  • 0 views
R
Forum|alt.badge.img+5

Hi,

I currently have machines bound to AD with two AD security groups as admin groups. I'm trying to figure out how to add additional groups to the configurations remotely. I know i can run dsconfigad -group "DOMAINGROUPNAME,DOMAINGROUPNAME2", etc., but this seems to overwrite the existing one and prompt me for my credentials. Does anyone know how to add a group to an existing config using a JAMF policy? If I just make a new Directory Configuration in JAMF and push that to machines already bound, will it simply take over the existing configuration or fail and say that the machine is already bound.

Thank you,

Randy Shore

    1 reply

    spalmer
    Forum|alt.badge.img+22
    • spalmer
    • Valued Contributor
    • 166 replies
    • July 16, 2014

    You will need to script this. First you need to first grab the groups currently listed then append your new groups to that. See the script I use below. Note I am doing this from memory so it may not be 100% accurate or the best way to do this:

    currentGroups=`dsconfigad -show | grep "Allowed admin groups" | awk 'BEGIN {FS = "="};{print $2}' | sed 's/ //'`
newGroups="DomainGroupName1,DomainGroupName2"
dsconfigad -groups "$currentGroups,$newGroups"

    You may also want to add some code to verify that you are currently bound to AD before modifying the groups. OR you could just scope a policy to run this script only on Macs bound to AD. This also doesn't check to see if GroupName1 or GroupName2 are already added so you may need to add code for that as well.

    Reply


    Most helpful members this week

    Terms & ConditionsCookie settingsAccessibility statement

    Cookie policy

    We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

     
    Cookie settings