This request is to help us out with a symptom where users' "login" keychain and AD become out-of-sync. In a good handful of these cases I'm seeing that a user attempts to actually change their password from the local machine as they should, but they are unable to because their Mac times out before reaching our DC. The fix? If we un-bind and re-bind the computer to our domain, accessing network resources and password resets seem to work just fine.
So, what I'd like to do is create something in Self Service where a user can kick off a policy/configuration and it will automatically unbind and rebind their machine to our domain.
I know there are Policy attributes in the GUI that will bind a machine to a domain, and we utilize this in our OS configurations -- it works find for binding a computer to the domain. However, there isn't a GUI-option to remove it from the current bound-domain, so I was thinking of scripting.
I am borrowing a script that Scott Blake has already created and slightly modified it for what I need:
#REFERENCE https://github.com/MScottBlake/mac_scripts/blob/master/bindMachineToActiveDirectory/bindMachineToActiveDirectory.sh
# Active Directory domain
domain="mydomain.com"
# Username/Password used to perform binding
username=""
password=""
## More variables - No need to edit
olddomain=$( dsconfigad -show | awk '/Active Directory Domain/{print $NF}' )
computername=$( scutil --get ComputerName )
adcomputerid=$( echo "${computername}" | tr [:lower:] [:upper:] )
prefix="${adcomputerid:0:6}"
echo "Using computer name '${adcomputerid}'..."
echo ""
## Unbind if already bound
# If the domain is correct
if [[ "${olddomain}" == "${domain}" ]]; then
# Check the id of a user
id -u "${username}" > /dev/null 2>&1
# If the check was successful...
if [[ $? == 0 ]]; then
echo -n "This machine is bound to AD. Unbinding..."
# Unbind from AD
dsconfigad -remove -force -u "${username}" -p "${password}"
# Re-check the id of a user
id -u "${username}" > /dev/null 2>&1
# If the check was successful...
if [[ $? == 0 ]]; then
echo "Failed (Error code: 1)"
exit 1
else
echo "Success"
echo ""
fi
fi
fi
## Perform bind
dsconfigad -add "${domain}" -username "${username}" -password "${password}"
-computer "${adcomputerid}" -useuncpath enable -mobile enable
-mobileconfirm disable -shell /bin/bash -ou "${ou}" -force Great! It seems to do everything I am asking right? Well...the problem I am stuck on now is that I cannot have a password in clear text in a script, but it seems to be required for the above to function. I have an existing service account used to bind other machines....how can I reference this account (and with NO clear text passwords)
Thanks in advance for any advice!
