Deploying local user accounts - Best Practice?

[eob455]

I want to deploy a local account to a group of student machines for teachers to use if the network is unavailable. I have a script that will do it, and it works fine. However, the script contains the account password and can be read by anyone if they browse to the JSS file share.

Is there a way to deploy local accounts without using a script, or a way to compile the script into a binary executable?

[alexjdale]

I would use CreateUserPKG, personally. The password is hashed.

[pat_best · Accepted solution]

Edit: this is more of a preemptive strike.... create the accounts beforehand...

Have you looked at using a policy to create the account? This data is stored in the JSS database and not on the file share. You could create the process in automator and capture it as an application if you wanted to, but I would suggest a policy. Here are screen shots of what I am describing:

Policy:

and automator:

In automator you can save your workflow as an app when you have finished building. Let me know if you would like more info on this.

[stevevalle]

I add and remove generic users when needed via two ongoing policies. One adds the user at startup, the other removes the user at logout. This also ensures data from the one user is not accessible by the next user. I also have the Make Available Offline checkbox checked, so if the laptops are not on the network, the policy still runs.