Open Directory : can an accound be administrator on local machine ?

[Bpepermans]

Hello there,

New to OD, I’m looking for some answers that couldn’t be found…

After creating OD accounts, I manage to log in successfully on client machines but when it comes to install software on those machines, OS X keeps asking me an Administrator login/password to proceed. Is there a way for an OD account to administer a client machine ? How would I install software on each machine without remembering every admin account of every client we have ?

The same issue happens when I have to manage files on local hard drives, the system asks for the local admin account but I’d like my OD authenticated admin to be able to do that without any further authentication…

Is the Portable/Mobile account feature syncing everything in an account ? It seems that some of the user’s system prefs and local files are not…

Thanks !

[luke]

You need to make some changes in /etc/authorization on the client machines to grant administrator rights to a user or group from the directory.

See: https://www.afp548.com/article.php?story=20041027093216241

[kamil]

How do you run Workgroup Manager on a client machine? I installed the server admin tools but I can’t connect to the local directory.

[kamil]

I also tried doing it with dseditgroup and got the following message:

bash-3.2$ dseditgroup -o edit -a sysops -t group admin
Failed to convert legacy group to new group format. Cannot add member to group as legacy groups do not support GUID membership.

[kamil]

I don’t understand why I would need to upgrade the group? Both groups were newly created in Leopard, on the server and the local client respectively, when we set up our test network here.

[OD Master]

You have to upgrade the local admin group so it can contain nested groups.
By default, even on a fresh Leopard install, the admin group is still in legacy format which can only hold user accounts.

You can do all this easily in Workgroup Manager on each client Mac:

1. Open WGM.
2. Select Server > View Directories
3. Make sure you are in fact in the Local directory, authenticate.
4. Select View > Show System Users and Groups
5. Select the “admin” Group
6. Click the “Upgrade Legacy Group” button.

Now you can use the “+” button to add any group, local and from Open Directory to the admin group.
Account Preferences will honor that and display the correct admin status for all users that inherit local admin rights this way (check the tooltip for the check box in Account Preferences).

[kamil]

Excellent. That’s exactly what I needed.

[Author]

Posts