The most reliable way to tell if an account is an actual cached AD mobile account or a local account only is to use dscl to check for the OriginalAuthenticationAuthority key.
/usr/bin/dscl . read /Users/username OriginalAuthenticationAuthority
Only mobile accounts from a directory service should have that key in their account record. It usually displays something like:
OriginalAuthenticationAuthority: ;Kerberosv5;;username@DOMAIN.COMPANY.COM;DOMAIN.COMPANY.COM; ;NetLogon;username;DOMAIN
A local account will return:
No such key: OriginalAuthenticationAuthority
Using this, you can create an Extension Attribute that checks the logged in user, or any accounts and reports their status.
#!/bin/zsh
logged_in_user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" | /usr/bin/awk '/Name :/ && ! /loginwindow/ {print $3}')
mobile_account_check=$(/usr/bin/dscl . read /Users/$logged_in_user OriginalAuthenticationAuthority)
if [[ "$mobile_account_check" =~ "Kerberosv5" ]]; then
/bin/echo "<result>${logged_in_user}: Mobile</result>"
else
/bin/echo "<result>${logged_in_user}: Local</result>"
fi
