Group Policies for OS X users

Question

Level 2

420 points

Group Policies for OS X users

Hey folks,
I'm trying to determine approprate GPO settings for some computer-based OS X accounts. I have a computer in the bedroom and one in the kitchen that both auto-login as special domain accounts. One is something like kuser (for kitchen) and the other is buser (for bedroom). They are domain users b/c they need access to my photo library and itunes library (both shares on a 2003 member server).

Since printing in a domain enviroment pretty much requires storing the user/pass in the SMB URL and that is stored in plain text, I want to make sure these users have VERY limited access in the domain. I want to prevent login to anything other than the two special computers. However the AD "log onto" setting doesnt seem to effect OS X.

So, are there GPOs that will have ANY effect? Obvisouly the windows specific settings will have no effect, but can anyone recomend what I need to do to secure the domain against someone trying to use these special users?

Thanks!
-N

PowerBook g4 12, 2 Mac Minis 1.42, Powermac G5, Mac OS X (10.4.3), 2 linux, 2 xp, 3 windows server 2003

Posted on Dec 13, 2005 11:06 AM

Reply

Answer 1

mecklists

Level 4

1,795 points

Dec 28, 2005 9:54 PM in response to SpaceBass

I'm very confused by what you're trying to accomplish, but you don't necessarily need a GPO to grant or restrict access to resources. You'll use permisssions on computer objects in the Active Directory Users & Computers console.

For example, if you don't want a particular domain account to use a particular computer, you can simply deny access to that user in that computer object.

If I'm missing your point, can you please clarify what you're after?

bill

1 GHz Powerbook G4 Mac OS X (10.4.3)

Reply

Answer 2

Dec 29, 2005 8:20 AM in response to SpaceBass

The limit logon computer setting is not a GPO setting, but an account setting. However, no GPO setting will work on OS X since OS X isn't Windows.

You could use the same user for both locations and in the AD account just put in the two OS X computers. That will prevent it from logging on to any other Windows computer. Though if you have any other OS X computers, it won't be of much help.

Reply