Logging into AD Account While Not Connected to a Network

[guzhogi]

Hi everyone. I work IT in a school district that mainly uses Apple devices and Open Directory for accounts. I don't really deal with the OD side of things that much, so forgive my ignorance. I'm curious, if we go to Active Directory (probably using Amazon Web Services), could users log into their AD accounts, even if they're not connected to a network? I think yes, if we set up mobile accounts, but a coworker says nope.

I ask because we use a bunch of different services, not all of which can use OD, but can use AD. It would significantly help with keeping passwords consistent. Thanks!

 

[chrfr]

Hi everyone. I work IT in a school district that mainly uses Apple devices and Open Directory for accounts. I don't really deal with the OD side of things that much, so forgive my ignorance. I'm curious, if we go to Active Directory (probably using Amazon Web Services), could users log into their AD accounts, even if they're not connected to a network? I think yes, if we set up mobile accounts, but a coworker says nope.

I ask because we use a bunch of different services, not all of which can use OD, but can use AD. It would significantly help with keeping passwords consistent. Thanks!

If a user has previously logged into the computer and thus the computer has a cached version of that account, then yes, they'll be able to log in. A new user will not be able to log in while the computer is off the network.

 

[hobowankenobi]

Yes. As stated above, the key is to log in once while on the network, once the machine bound to AD. Then the account is created locally, and the credentials are cached locally, so no network connectivity is required for subsequent log ins....for that account.

This assumes that when the Mac is bound to AD, the box is checked:

Create mobile account at login

More info on options.

 

[TriBruin]

Give serious thought to whether binding to AD is REALLY necessary. For most companies, the primary (or only) reason to bind to AD is to allow users to access network resources (and keep their user accounts/passwords) the same. Apple has introduced an alternate solution called Enterprise Connect (from Apple) or a 3rd party alternative called NoMAD. Effectively you create a local user and EC or NoMAD and links the local account to an AD account. The advantage is that both EC and NoMAD avoids having to create mobile accounts (which have their own problems) while keeping the the passwords between the user account and AD account in sync. Here is a link that gives an overview of EC, NoMAD, and direct binding to AD.

(There is a cool companion to NoMAD call NoLOAD. It replaces the standard Mac Login screen with a customer screen. At the custom login screen, a first time user can login with their AD account and password and NoLOAD will create a local, not mobile, account for the user. The account is NOT linked to the AD account, that would be handled by NoMAD. But, the next version of NoMAD is supposed to create the NoMAD keychain entry from NoLOAD automatically.)

 

[satcomer]

Hi everyone. I work IT in a school district that mainly uses Apple devices and Open Directory for accounts. I don't really deal with the OD side of things that much, so forgive my ignorance. I'm curious, if we go to Active Directory (probably using Amazon Web Services), could users log into their AD accounts, even if they're not connected to a network? I think yes, if we set up mobile accounts, but a coworker says nope.

I ask because we use a bunch of different services, not all of which can use OD, but can use AD. It would significantly help with keeping passwords consistent. Thanks!

You should put into one center network a strong VPN netwok Server program! Then on the machine from VPN to that setup server at school! The Home client then can log onto the network and do what he/she do without coming into work and be secure to do it if you setup with good security in the server!

 

[hobowankenobi]

Give serious thought to whether binding to AD is REALLY necessary. For most companies, the primary (or only) reason to bind to AD is to allow users to access network resources (and keep their user accounts/passwords) the same. Apple has introduced an alternate solution called Enterprise Connect (from Apple) or a 3rd party alternative called NoMAD. Effectively you create a local user and EC or NoMAD and links the local account to an AD account. The advantage is that both EC and NoMAD avoids having to create mobile accounts (which have their own problems) while keeping the the passwords between the user account and AD account in sync. Here is a link that gives an overview of EC, NoMAD, and direct binding to AD.

Yep. Rolling out NoMAD at work, and so far it has been good. One machine had weirdness with updating keychain, but it may have been something else going on. Outside of that one machine, every other machine (all previously bound to AD) have gone well.