BLau

How to create a Hidden Local Admin account on Mac systems (Redux)

by Centrify ‎01-02-2014 11:09 AM - edited ‎01-07-2014 03:21 AM

Note: This is a repost of the same article found on The Centrify Apple Guys blog here:

http://community.centrify.com/t5/The-Centrify-Apple-Guys/How-to-create-a-Hidden-Local-Admin-account-...

 

===

 

In a previous article, Lance showed us a top tip for creating an invisible Local Administrator account by placing a period character (.) in front of the username. 

 

Doing this was handy for preventing the admin user from showing up in the Users & Groups System Preferences, but it was discovered that this would also cause the account to be skipped over when doing an OS upgrade (e.g., updating from 10.8 Mountain Lion to 10.9 Mavericks).

As a result - after the update; the user no longer exists under the new OS and thus needs to be recreated.

 

It's likely that this is because the period also stops the user from being listed in the Directory Service directory list:

 

dscl . -list /Users

 

 

 

So what can we do to ensure that the hidden local account stays put? 

 

There are actually multiple ways for creating hidden local accounts on Mac systems, and Apple has handily listed the different methods here: http://support.apple.com/kb/HT5017

 

The gist of the Apple article is that there is an attribute in the com.apple.loginwindow plist that we can set to hide all users with a UID below 500, and we can also move the user's home folder to the /var/ directory to keep it away from non-admin users.

 

Note:

As before - in order to create these hidden accounts, you DO need an existing Admin account on the Mac to begin with. This account could then be removed after creating its hidden counterpart.

 

 

 

== The GUI method (Basic):

 

  1. Login as your regular Local Admin, open the Terminal and run the command:

    sudo defaults write /Library/Preferences/com.apple.loginwindow Hide500Users -bool YES

     

  2. Go to System Preferences > Users & Groups

  3. Press the [ + ] button and create a new Administator user like normal.

    Note: Make sure not to login as that newly created user yet!

  4. Once the user appears in the list on the left, right-click on the name and select "Advanced Options..."

    Ninja right-click Advanced Properties.PNG


  5. Change the "User ID" to something in the 400-range, like: 401
    Change the "Home directory" path to: /var/username

    Ninja Advanced Properties.PNG


  6. Save the changes, go to the "Login Options" section and make sure the following is set:

    - Display login window as: Name and password

    This will ensure that the name and password box is immediately available without having to press the "Other..." icon at the login screen.

  7. Close and reopen the System Preferences > Users & Groups, your new user will now be hidden.

  8. Logout and login as the hidden user... Tadaaa!

 

 

 

 

 

== The command-line method (Advanced):

 

  1. Login as regular Local Admin and open the Terminal (or SSH in as Local Admin)

  2. Create the user.

    - The following will create a new user with the following properites:
    -- Username    : ninja_admin
    -- Password    : 123
    -- Home Folder : /var/ninja_admin

    - Feel free to change values as needed.

    sudo dscl . -create /Users/ninja_admin UniqueID 401 
    sudo dscl . -create /Users/ninja_admin PrimaryGroupID 20 
    sudo dscl . -create /Users/ninja_admin NFSHomeDirectory /var/ninja_admin 
    sudo dscl . -create /Users/ninja_admin UserShell /bin/bash 
    sudo dscl . -create /Users/ninja_admin RealName "Ninja Admin" 
    
    sudo dscl . -passwd /Users/ninja_admin 123 

     


  3. Create the user's home folder and own it to the new user:

    sudo mkdir /var/ninja_admin 
    sudo chown -R ninja_admin /var/ninja_admin 

     

  4. Add the user into the Local Admin group 

    sudo dscl . append /Groups/admin GroupMembership ninja_admin 

     
    - You could skip this command by setting the user's PrimaryGroupID to 80 (Administrators) in Step 2.
    - There seems to be no difference with either method of making the user an Admin, but this way seems to be the native way that OS X does things, so we'll go with that.

  5. Enable the hidden functions:

  6. sudo defaults write /Library/Preferences/com.apple.loginwindow Hide500Users -bool YES

     


  7. Ensure that the "Others" option will appear at the login window - in case the Login Options is still set to "List of users" (So that we can still get to the name and password login boxes).

    sudo defaults write /Library/Preferences/com.apple.loginwindow SHOWOTHERUSERS_MANAGED -bool TRUE

     


  8. Logout and login as the Hidden Admin.

  9. Logout and login in as the original Local Admin, look in System Preferences > Users & Groups...  Tadaaa!

 

 

The cool thing about the command-line method is that you can stick all the above commands into a bash script and run it off with a single command. 

 

Attached below is an example script that you can take a look at and try out for yourself.

To test it, save the script to the Mac Desktop, TextEdit the parameters inside to your desired values, save and run the following command:

 

sudo sh ~/Desktop/create_hidden_local_admin.sh

 

************************************************************

************************** NOTE **************************

  

- The example script has been tested on OS X versions 10.7 - 10.9 and is provided as-is with the assumption that you know your way around the Terminal and bash commands.

- NO official support for this script will be provided by Centrify as this is all pure native OS X.

 

************************************************************

************************************************************ 

 

 

 

 

 

== Unhiding the account:


There are two options to unmask the hidden user:

 

Option 1:

- Turn off Hide500Users using:

 

sudo defaults write /Library/Preferences/com.apple.loginwindow Hide500Users -bool NO

- This can be done under the hidden account itself.

 

 

 

Option 2:

- Change the user's UID to the next available UID above 501 and then move and reset the permissions of the home folder:

 

sudo dscl . -change /Users/ninja_admin UniqueID 401 502
sudo dscl . -change /Users/ninja_admin NFSHomeDirectory /var/ninja_admin /Users/ninja_admin
sudo mv /var/ninja_admin /Users/ninja_admin
sudo chown -R ninja_admin /Users/ninja_admin

 - This CANNOT be done while the hidden user is still logged in.

 

 

 

 

If you just need to see if the hidden account is on the Mac, then you can use the following command to list all accounts with a UID higher than 400:

 

dscl /Local/Default -list /Users UniqueID | awk '$2 > 400 { print $1; }'

 

- To see what is happening here, check out this article.

 

If the account is in that list, but not seen in the Users & Groups System Preferences, then that's your hidden account. Alternatively, just look in the /var/ folder.

 

 

 

...and that's all that's needed to creating and managing your own hidden local admin accounts on Mac systems.

 

-- Hope that's handy!

BLau

New Demo Videos for Centrify User Suite, Mac Edition (aka "Centrify for Mac")

by Centrify ‎11-26-2013 10:25 AM - edited ‎12-03-2013 02:32 PM

Note: This is a repost of the same article found on The Centrify Apple Guys blog here:

http://community.centrify.com/t5/The-Centrify-Apple-Guys/New-Demo-Videos-for-Centrify-User-Suite-for...

 

===

 

We recorded a couple of new quick-start demonstrations showing the new Centrify Mac GUI in action. 

 

The first video shows all the steps from downloading the Suite to installation to joining the domain to your first login with an AD account. 

 

The second video gives a quick demonstration of how group policies (available to Licensed users) can be used to configure banner text, give Local Admin rights to certain AD groups and set up network shares to be automatically mounted at login.

 

Enjoy!

 

2013 Mac Quick Start Install & Setup Demo

- http://youtu.be/HfKjUDOv8hM

 

2013 Mac Quick Start GPO Demo

- http://youtu.be/3LuwXgzyHl0

 

Quick Start Deployment Manager Demo

- http://youtu.be/qOTs-wYYI8s

 

 

 

BLau

Centrify DirectControl for OS X 10.9 Mavericks

by Centrify ‎10-22-2013 12:02 PM - edited ‎10-22-2013 12:09 PM

Note: This is a repost of the same article found on The Centrify Apple Guys blog here:

http://community.centrify.com/t5/The-Centrify-Apple-Guys/Centrify-DirectControl-for-OS-X-10-9-Maveri...

 

 

===

 

 

With the announcement of the release of OS X 10.9 Mavericks by Apple today, an updated version of the Centrify Mac agent is also available for those will undoubtedly want to have Apple's latest and greatest immediately.

 

This DirectControl for Mac OS X 10.9 release is a required update for anyone wanting to run Mavericks on a Centrify-managed system.

 

In addition to bringing support for OS X 10.9, additional key updates for this release include:

  • Bugfixes for issues affecting offline logins
  • Support for remote silent installation via Apple Remote Desktop and other deployment solutions.
  • GUI enhancements for more informative descriptions of the various functions available in the agent.
  • Support for DirectControl for Mac OS X 10.6 has been discontinued with this release.


Read this first!


It is strongly recommended to upgrade the Centrify DirectControl agent in Connected mode first, before updating to Mavericks.

 

Here are the recommended steps:

 

  1. Login to the Mac as an AD user with Local Admin privileges, or with the Local Admin account.

  2. Download the latest version of the Centrify Mac agent.

    NOTE: If updating from an earlier version of Centrify, look in: System Preferences > Centrify > "CentrifyDC mode" and make sure it shows Connected

    servlet.png

  3. Install/Update the Centrify Mac agent

    NOTE: If updating from an earlier version of Centrify and cached logins are used. Then a Connected login will need to be performed at least once to update the cache schema. The easiest way to do this is with the following steps:

    --a. Double-check the Connected status again and make sure CentrifyDC mode is still connected.
    --b. Open the Terminal and run:

    login ad_username

    (Where “ad_username” is the username of the AD user. When the command-line login completes, the credentials will have been re-cached)

    servlet.png

  4. With the Centrify agent updated and AD credentials re-cached, the Mac system is now ready to be updated to OS X 10.9

  5. Update to Mavericks a-go-go!

 

 

 

Deployment Manager Notes:

For those deploying this update via Centrify Deployment Manager, when downloading the agent software in Step 2 – the "Show only the latest software" checkbox will need to be CLEARED to display the latest Mac agent for 10.9.

DM 10.9.png

This is because the Mac agent for 10.9 was branched off especially for Mavericks, so is considered a separate branch from the main Centrify Suite 2013.3.

The Deployment Manager "latest software" filter only looks at the full Suite versions and so won't initially show the Mac agent for 10.9 in the list.

Don't worry though - everything will go back to normal when it all gets bundled back together come the next Suite iteration.

 

 

-- Happy updating!

So now that we know about the different types of accounts in OS X, it's time to learn about what to do if those accounts ever decide to play hide-and-seek.
 
There may come a time, either during the initial setup, or after some mysterious environment change that an account may fail to let the user in. After all, AD environments are like ice cream - they come in all kinds of flavours... some even have sprinkles on top.
 
99% of the time, login failures occur because of configuration error.
 
Here is a list of the most common types of login issues, in order of easiest to identify and diagnose...
 
 
 
Read more...

BLau

The Different Types of Accounts on Mac OS X

by Centrify on ‎07-04-2013 12:59 PM

Go into the System Preferences > Users & Groups on a Mac, look on the user list on the left side and you will invariably see at least one example of the three main types of accounts on Mac OS X:

 

Account Types.PNG

 

 

So what do all those little subheadings mean?

Read more...

BLau

A bit more on knowing when Account Migration is needed, and when it is NOT needed

by Centrify ‎06-10-2013 12:21 PM - edited ‎06-10-2013 12:27 PM

After my last article about Account Migration here, I realised that I missed out a quick and easy way to tell if a user needs to have their account migrated or not...

Read more...

BLau

Understanding Account Migration on Centrify for Mac OS X.

by Centrify ‎05-08-2013 10:03 AM - edited ‎05-08-2013 10:03 AM

Account Migration (sometimes referred to as Account Mapping) can mean different things for different people and it is easy to confuse when it is necessary and what it's actually used for.

 

On Centrify for Mac, Account Migration can be boiled down to one basic need: Reclaiming ownership of a local home folder.

 

Read on to see the full process in action.

 

 

Read more...

BLau

Introducing the New Mac Diagnostic Tool

by Centrify on ‎05-03-2013 07:26 AM - last edited 2 weeks ago

Introducing the new-and-improved Mac Diagnostic Tool - a very easy-to-use app for checking up on the Centrify configuration of a system.

 

It also allows for quickly verifying that group policies have been received, checking up on user attributes and presents a much clearer and simpler debugging flow for support situations.

 

 

 

 

Read more...

LMcAndrew

How to: Uninstall Centrify DirectControl from OS X

by on ‎02-14-2012 03:53 PM - last edited on ‎05-03-2013 07:42 AM by Centrify

This article includes command line instructions for removing DirectControl from your Mac. 

 

 

 

Read more...

Sumana_Centrify

Using .local domains with Centrify Directcontrol on the Mac

by Centrify ‎02-07-2012 09:35 AM - edited ‎02-07-2012 09:43 AM

Lot of environments have .local as their domain name and often run into issues with Bonjour on Mac. Below is the knowledge we gathered over the past few months. Please read carefully and raise questions if you have any.

Read more...

LMcAndrew

Macintosh Account Migration Tool

by on ‎03-14-2011 11:39 AM - last edited on ‎07-09-2013 09:39 AM by Centrify

This tool is designed to provide a simple, error free method for associating an existing home directory with an Active Directory Account on the Macintosh

Read more...

This video shows how to use Centrify's graphical interface t o quickly install DirectControl Express on a Mac system and join it to Active Directory


Sumana_Centrify

How to: Use Centrify Troubleshooting Tools for Mac OS X

by Centrify on ‎06-21-2010 04:20 PM - last edited on ‎05-03-2013 07:33 AM by Centrify

Note: The tools on this page have since been updated and combined into a single New Mac Diagnostic Tool. Please check the following link for the latest version of the tool:

http://community.centrify.com/t5/Express-for-Mac-Tips-and-Tricks/Introducing-the-New-Mac-Diagnostic-...

 

 

===

 

 

Centrify provides the Debug Switch and User Widget graphical interfaces to help you diagnose problems and do a status check. This video demonstrates some common tasks you can do with each.

 

The video for the old Diagnostic Tool has been archived at: http://youtu.be/8OPSise0ZZE