This is the script I created for this purpose. I just sanitized it so I haven't tested it in the form I am posting, but I think it's right.
It is designed to run in a policy or with Casper Remote, you would specify the group you want to add in the $4 variable (Script parameters). It will add to whatever existing admin groups are specified in the binding settings.
Yes that is Grep and Awk and Sed (oh My!) on the same line. We're not in Kansas anymore.
#!/bin/bash
#Purpose: This script will add the AD group specified when the script is run to the AD binding.
#Example:
#Entering "AD Group Name"(aka $4) as: AllTheAdmins
#Would add this to the binding: YourDomainAllTheAdmins
#########
#Variables
#########
#Change these:
DOMAIN="YourDomain"
YOURLOGFILE="/path/to/your/log/file.log"
#Don't change these:
CURRENTGROUPS=`dsconfigad -show | grep "Allowed admin groups" | awk 'BEGIN {FS = "="};{print $2}' | sed 's/ //'`
NEWGROUP="$DOMAIN\$4"
#########
#SCRIPT
#########
dsconfigad -groups "$CURRENTGROUPS,$NEWGROUP"
VALIDATEGROUPS=`dsconfigad -show | grep "Allowed admin groups" | awk 'BEGIN {FS = "="};{print $2}' | sed 's/ //'`
if [ "$VALIDATEGROUPS" == "$CURRENTGROUPS,$NEWGROUP" ]
then
echo "Admin Groups configured successfully." >> "$YOURLOGFILE"
exit 0
else
echo "Unable to set admin groups." >> "$YOURLOGFILE"
exit 1
fi
