Use AD group to scope policy

[KyleEricson]

I want to scope a VPN install at a AD security group. Can this be done and how?

[daniel_behan]

I have an Extension Attribute that lists the AD groups of the logged in user. You can list a smart group for that AD group and scope your policy to it.

#!/bin/sh

currUser=$( /usr/bin/who | /usr/bin/awk '/console/{ print $1 }' )

Groups=$( dscl /Active Directory/<DOMAIN>/All Domains read /Users/$currUser dsAttrTypeNative:memberOf | awk -F"OU" '{ print $1 }' | sed -e 's/CN=//g;s/,$//g;1d' )

echo "<result>$Groups</result>"

[cubandave · Accepted solution]

Scope to all computers but add a limitation to the LDAP group.

[nberanger]

@daniel.behan Hi Daniel. I just tried your script, and it does not appear to be working. We are on 10.8. Is it still working for you?

[mrheathjones]

@nberanger I also use an EA to grab the logged in user AD group membership. From there I create a smart group with the criteria of "User AD Group" -> "like" -> "<name of AD group to scope to>" this should drop devices into the smart group if the user is apart of the ad group I'm targeting. Below is the EA script.

!/bin/sh

loginUsername=$(stat -f "%Su" /dev/console)

Groups=$(dscl '/Active Directory/DOMAIN' -read /Users/"$loginUsername" | awk '/^dsAttrTypeNative:memberOf:/,/^dsAttrTypeNative:msExchHomeServerName:/')

echo "<result>$Groups</result>"

[nberanger]

Thanks @mrheathjones I tried using your script, but it isn't returning any results for me. I should only have to change "DOMAIN" to our domain, correct? We do use the jamf infrastructure manager to connect to LDAP, so maybe that has something to do with it?

[dmw3]

We use a similar script to Daniel but target the computer not the user. Useful if multiple users login.

#!/bin/sh currComputer=$( dsconfigad -show | grep 'Computer Account' | awk '{print $4 }' ) Groups=$(dscl "/Active Directory/Domain" read /Computers/$currComputer dsAttrTypeNative:memberOf | tr " " " " | awk -F"OU" '{ print $1 }' | sed -e 's/CN=//g;s/,$//g;1d' ) echo "<result>$Groups</result>"

[JustDeWon]

.

[EUC600]

@nberanger Just curious if you figured this out? We are trying to do the same thing but get no results as well. We also use the JAMF Infrastructure Manager

[nberanger]

Hey @EUC600 I ended up giving up on this as I could not get it working. If you do manage to make it work though, I would love to hear how you did it :-)

Cheers!