One of the problems facing many Mac administrators in Active Directory environments is how to give their users admin rights on their machines. When configuring Active Directory, it's easy to specify one or many AD groups that should have admin access, but this only works when the Mac is able to contact the domain controller to verify group membership. Furthermore, this can be a security risk, because this gives everyone in an AD group admin rights to every machine. How can you give each user admin rights to their machine only, and without the need to be in contact with the domain controller?
↧
