Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have deployed a new Windows Server 2012 Active Directory infrastructure for an environment that previously contained no central mechanism for user authentication. All client computers are Mac OS X 10.9 Mavericks that use local accounts. My objective is to retain the data in the local user accounts stored in /Users but allow the AD user to gain ownership so the local accounts can be decommissioned. The home folders will remain local - they will not be network or mobile homes.

For example: A computer has a local account with shortname johndoe and matching home folder /Users/johndoe. I create a new user in Active Directory with shortname john. I want to be able to remove the OS X local user johndoe leaving its home folder behind. Then rename /Users/johndoe to /Users/jon to match the AD user shortname and allow the AD user to adopt this local home folder.

How might I accomplish this?

share|improve this question
1  
Would it not be easier to create the AD account and mv the contents of /Users/johndoe inton /Users/john then chown -R the files to the new user? –  Shutupsquare May 20 at 20:58
    
Yeah that might be the best solution. I have been trying to figure out if it's possible to accomplish in one single action but haven't had any luck with my efforts. –  dean May 21 at 0:55
    
This is something I'm going to need to deal with soon on my network. If you don't get any good answers in a couple days, I'll throw a healthy bounty on it to try and draw some attention to it. –  EEAA May 22 at 0:49
    
@EEAA awesome, glad to hear I'm not alone. I'll be testing all day in my lab environment tomorrow and update the question with my findings. –  dean May 22 at 0:57
    
@dean - are you happy with the below answer? Seems like that might be as good as we're going to get. I'd like to award the bounty if you're happy. –  EEAA May 28 at 1:33

1 Answer 1

up vote 3 down vote accepted
+150

You can certainly do this, but unless you script it (see below) there's no single-step solution. The basic steps are going to be:

  1. Bind the Mac to AD.
  2. Delete the local account, but leave the home folder alone. This can be done from the command line with dscl, or in System Preferences -> Users & Groups (just be sure to select "Don't change the home folder").
  3. Rename the home folder to the AD account's name.
  4. Change ownership to the AD account's UID number. Use chown -R for this, not the Finder (it doesn't give you enough control over what's being changed).

...so, you really want to script this process. The good news is that it's been done. AFP548.com has a couple of scripts that handle step 1, and Rich Trouton's MigrateLocalUserToADDomainAcct.command script (based on one by Patrick Gallagher) handles steps 2-4. If you want to make it a true single-step process, you'll have to splice them together yourself.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.