Windows AD account

[cookiesnfooty]

Hello,

I have the macbook and Windows Server logging in and accessing all documents as you would expect. I do have one issue however, in the accounts screen it says that the account is an admin account but it doesn't have the same permission level as local admin account. I am unable to edit certain preferences and like logmein I am unable to close this down or edit the settings unless I login with the local admin account.

Can anyone offer advice on where I have gone wrong?

 

[Mattie Num Nums]

Hello,

I have the macbook and Windows Server logging in and accessing all documents as you would expect. I do have one issue however, in the accounts screen it says that the account is an admin account but it doesn't have the same permission level as local admin account. I am unable to edit certain preferences and like logmein I am unable to close this down or edit the settings unless I login with the local admin account.

Can anyone offer advice on where I have gone wrong?

Can you post a picture of your accounts pane so I can see what it says also can you do the following in terminal and post it.

su dscl . read /Users/username

Also, keep in mind when a user is a Network Admin, local admin rights disappear once you are off record unless you are in the correct group.

 

[cookiesnfooty]

Please see pictures attached.

I have looked around the internet and have yet to find a solution.

 

[rwwest7]

Do you have two accounts with the same name?

When you try to change a system setting, when it pops up for the password make sure you're using the shortname because it looks like the long names are identical so that might confuse it.

That is likely the root of your problem. I have network accounts working fine as admins but they don't have sister local accounts to make things act weird.

 

[cookiesnfooty]

Hi,

Thank you for your message, it does seem to work as an admin account but it doesn't seem to have the same level permissions as a local admin account.

The Full name is the same however the network has AD at the end of the username to identify It as a network account.

 

[rwwest7]

Do you have a very specific example? Maybe the problem you are having is normal.

You still should try another network admin account with a unique long name just to eliminate. Assuming is always bad troubleshooting.

----------

Also make the account mobile and see if that makes a differences.

 

[cookiesnfooty]

I've tested a unique account. Basically a local admin account can access extra options such as settings for logmein and also they can uncheck and check boxes such as Allow to administer etc.

 

[Mattie Num Nums]

One thing I notice is that the account is not managed meaning its local only.

Have you tried Mobile Accounts?

 

[cookiesnfooty]

I turned them to mobile accounts and it's still the same should network admin accounts have same power as local? Can you untick allow this user administrative controls?

 

[cookiesnfooty]

Does the staff account control local admin? If so is there away to add a windows AD to mac staff account group?