Scripting the creation of AD Mobile Accounts in OS X?

You can modify the settings in your Directory Binding object (via JSS web pager) to enforce the creation of Mobile Accounts. However this won't give you admin rights to accounts by default.

If your after a scriptomatic way, add theses lines to a "at reboot" script in Casper Imaging:

/System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n $4 -h /Users/$4 -P
dscl . -append /Groups/admin GroupMembership $4

hope this helps!

The setting of making sure the computer creates mobile accounts / forces home directories is separate from creating making sure that account has local admin control.

Here's the man page for dsconfigad which you will use to bind / make sure the options for mobile, confirm mobile acc ount creation, force home folder, etc. etc. are set.

http://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man8/dsconfigad.8.html

If all the users that you want this to happen also belong to the same AD group, you can specify which AD groups are local admins also using dsconfigad. If they are not all in the same AD group, you maybe able to pre populate an admin user in dscl . -append /Groups/admin GroupMembership username (not exactly sure) but worst come to worst, you can have it set as a login hook, have it run as a Casper Policy for those computers. Here's the dscl man page

http://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man1/dscl.1.html

Hi Sonic84,
Thanks for this info. I've has success with:

/System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n $4

What's the significance of "-h /Users/$4 -P" ?

Thanks!

Also, has anybody figured out how to prevent the benign error response? If this is run in a policy or self-service item, I get the mobile account, but I also get a log marked "failed". I hate having to explain that it works when it fails, but it might fail when it fails.

Redirecting to stdout or /dev/null doesn't work.