Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of my Mac boot scripts needs to grab a property from AD that is not one of the ones I can see with the built in tool called dscl, which is pretty much limited to Users, Groups, and Computer searches. Normally I would just do a raw ldap query, but I need this to happen before there is a user logged in to provide credentials. The built-in dscl obviously can get data out of AD without a user authenticating, so I assume there must be a way to do so in the computer account context or something. Unfortunately my googlefu has completely failed me so far.

share|improve this question

I guess I'll answer my own question. For my needs it was in perl but it should be pretty obvious how to do the same in a straight shell script. I just needed to grab the machine credentials out of the ActiveDirectory.plist

sub get_LDAPEntries
    my ($LDAPServer, $LDAPPort, $LDAPsearchbase, $LDAPfilter) = @_;
    my $kerbID = `/usr/libexec/PlistBuddy /Library/Preferences/DirectoryService/ActiveDirectory.plist -c "print :'AD Computer Kerberos ID'"`;
    chomp $kerbID;

    my $password = `/usr/libexec/PlistBuddy /Library/Preferences/DirectoryService/ActiveDirectory.plist -c "print :'AD Computer Password'"`;
    chomp $password;

    my $LDAPSession = Net::LDAP->new($LDAPServer, port=>$LDAPPort);
    $LDAPSession->bind($kerbID, password => $password) or die("Could not connect to LDAP server.");

    my $results = $LDAPSession->search(base=>$LDAPsearchbase,filter=>$LDAPfilter);

    $results->code && die "There was an error in the LDAP search: " . $results->error;

    my @LDAPEntries = $results->entries;

    return @LDAPEntries;

Update: This only works on Snow Leopard (10.6). Lion (10.7) stores the AD password in the keychain and you will need to use the "security" command line utility to get to it... which is frankly kind of pain due to the password being output to stderr while the rest of the query is sent to stdout. I am going to decree Lion support as out of scope :-P

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.