Active Directory Offline Login work??

Hey all,

I'm having an issue with loging in to a Leopard client which is bound to Active Directory. Whenever I unhook this MacBook, off the network, it won't allow me to login to the machine via the domain credentials. In Tiger, I remember there was a check mark option under the AD plugin referring to Caching login credentials for AD, but this is not present in the Active Directory plugin in Leopard.
I also read that caching is a bit dicey in Leopard, so users have just been check marking creating a Mobile User account, and this seems to offer the ability to signing in to your machine without being connected to the network.
But what happens in my case, is that the user goes from being an admin account to a standard account, when offline from the network. Once I re-hook the machine back on to the network, I regain admin control of the machine. This is very odd, as I have not run into this issue before. I am not interested in syncing the home folder to the server at all, and I hope I have not accidentally triggered this, although I think you have to set this up also on the server in order for the syncing to occur, right?
Anyway...all I want to be able to do, is setup offline login of AD credentials on a MacBook. Is this possible while retaining the admin rights of the computer?

Message was edited by: Syrcle

Posted on Jun 2, 2008 3:27 PM

Reply
7 replies
Sort By: 

Jun 3, 2008 2:47 PM in response to Syrcle

We've always used the "Create Mobile Account at Login" check in both 10.4 and 10.5, but I have experienced the admin coming and going like you mentioned (If I remember right 10.4 did it too). On my personal machine (and others in the tech department) I've just opened system prefs and checked the "Allow User to administer this computer" box which makes it permanant, though it's unfortunately not a good solution for large scale deployment.

It does work for our situation because generally we're the only ones administering machines and ours are the only ones we need the rights off the network, so it may be a solution for you as it sounds like you're only working with one machine.
Reply

Jun 13, 2008 8:58 AM in response to Reem Ali

In my experience with AD implementations (or any other) and OS X its never really a good idea to not have a local admin on the machine. What if the AD bind breaks, etc?

Even without the local admin, if you log into a mobile admin account while on the network you can use that account to check the "allow user to administer this machine" box if I recall correctly.
Reply

Jun 13, 2008 9:31 AM in response to Syrcle

My experience with offline login with Active Directory is that it take about 10+ minutes to boot the machine. The check box to allow the user to work remote is checked and the user has admin privileges, but as long as there is a network available (just not the internal work network), the machine spins for a VERY long time waiting to timeout. I think it is also related to the machine being setup to a dependency on a remote server for Home directory support.
Reply

Jul 11, 2008 12:19 PM in response to shadeDream

We have a local admin account. That's the tech department's account, and we have no interest in giving that password to users, even if they are getting admin privs on their particular computer.

I'm setting machines up right now for users who are not here. I'd really like to grant them admin privs as I go rather than have to come back as soon as the user does. These aren't laptops, they are desktops hooked into the AD.

Under 10.4 I could go into NetInfo and muck with the groups. I haven't found the equivalent method in 10.5 yet.
Reply

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Active Directory Offline Login work??

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.