One of the standard methods of configuring Mac OS X in the enterprise has become known as the magic triangle or golden triangle. This is generally described as a setup involving Active Directory (AD) for authentication of the clients and services and Open Directory (OD) for managing the client preferences. The triangle comes from the fact that you have the Mac clients talking to AD, the clients also talking to OD, and the Mac server talking to AD. (Apple officially calls this the magic triangle setup in the Snow Leopard Server Open Directory Administration documentation.)
One of the issues I ran into was granting a non-admin in AD the ability to perform administrative functions on the clients bound to AD. The way this is handled with the Windows clients is for the particular AD user to be a member of a group that grants local administrator privileges.
Unfortunately there is no simple equivalent on the OD side of the equation to allow this for the technicians working on the Mac OS X clients. If you add an AD user to the system level group Open Directory Administrators using Workgroup Manager (WGM) this has no effect on whether a user is granted local administrator privileges to a connected client machine.
The solution to this involves:
- creating a group in OD to hold the members of AD that should have local administrative privileges,
- adding this OD group to the requisite local workstation groups to mimic the standard administrative privileges, and
- adding the OD group to the sudoers file