Report on "Mobile" AD Users

[Jason]

Has anyone done any work to create an Extension attribute to list systems that have a mobile account? Doesn't necessarily need to iterate what those accounts are (although it would be nice), just that there are 1 or more.

Reason I want it is that we use AD accounts, and FV2 can't be enabled for an AD account until they're mobile. So i want to scope my FV2 policy to only systems that have a mobile AD user.

[brad]

Hi Jason,

We have an extension attribute that looks to see if Mobile Accounts are turned on:

echo "<result>`dsconfigad -show | grep "Create mobile" | cut -f2 -d "=" | cut -f2 -d " "`</result>"

I am thinking to find if there is a mobile account on the machine you could do something like this:

accounts=`ls -l /Users | grep Domain | wc -l`
if [ $accounts = 0 ]
then echo "<result>No Mobile Accounts Found</result>"
else echo "<result>Mobile Accounts Found</result>"
fi

This assumes that Domain users is the group on the user folder permissions.

Good luck,

Brad

[Jason]

Hi @brad,

Create Mobile is showing disabled on my system. I'm not forcing it on for every AD user since a support person may need to log on temporarily and I don't want a mobile account created for them. It does continuously prompt at every logon though. So that wouldn't work for us to show if an account is mobile or not. The latter commands would only show if there is an AD account on the machine, not if it's mobile. I tested this by logging in with 2 AD accounts. One that is mobile, and one that is not. Both get listed with the 2nd set of code.

[brad]

Hi @Jason,

In my experience a folder is not created in /Users unless they are a mobile account. We force it on though so I could be mistaken. We could iterate through /Local/Default/Users as well. I think anything listed there would be a mobile account.

If they don't create a mobile account do they have their home folder on the network?

Would the smart group criteria "FileVault 2 Eligibility" give you what you need?

-Brad

[chriscollins · Accepted solution]

@Jason The authentication authority attribute for the user should tell you if its a cached/mobile user. This is the EA I use:

#!/bin/sh

userList=`dscl . -list /Users AuthenticationAuthority | grep LocalCachedUser | awk '{print $1}'`

echo "<result>$userList</result>"

[Jason]

@chriscollins, that's a fantastic solution. It does exactly what i'm looking for very cleanly. I really need to explore all of dscl more because it seems to be the solution to many of my recent questions.

Thanks