Automatically assign admin rights in OS X based on Active Directory

Hi Hello
all is write in my question, i want when one users log of Mac book laptop is automatically admin of laptop
have you a solution ?
Thanks

Use the dseditgroup tool to add the ActiveDirectory user to the "admin" group of the Local OpenDirectory node.
http://managingosx.wordpress.com/2010/01/14/add-a-user-to-the-admin-group-via-co mmand-line-3-0/

Similar Messages

Automatically create users in SharePoint based on Active Directory OU

Hi,
This is one of our client's requirements.
Is it possible to automatically create a user in SharePoint and assign him/her read privileges on the portal when ever a new user is created in Active Directory?
To re-iterate the above question in a different way; when a new employee joins the organization, a user is created in the Active Directory OU. Is it possible to automatically create this user in SharePoint without any manual intervention?
If yes, how? Is it a third party synchronization tool or does SharePoint has a sync feature / service?
Thank you,
Regards,
Gagandeep Singh
My CRM blog |
My SharePoint blog

Hi,
user profile synchronization is responsible for that, once user are created in active directory you have syn service running on certain schedule and all users are grabbed the only left step is to either grant permission on SharePointor you have a generic
access to grant to all authenticated users or certain active directory groups that the user is assigned to
More about user profile :
https://technet.microsoft.com/en-us/library/ee721049.aspx
http://social.technet.microsoft.com/wiki/contents/articles/12545.sharepoint-2013-setting-up-user-profile-synchronization-12.aspx
https://technet.microsoft.com/en-us/library/ff382639.aspx
http://blog.sharedove.com/adisjugo/index.php/2012/07/23/setting-user-profile-synchronization-service-in-sharepoint-2013/
Kind Regards,
John Naguib
Senior Consultant
John Naguib Blog
John Naguib Twitter
Please remember to mark this as answered if it helped you

Need to automatically add newly created user account in an existing active directory group.

Hi All ,
In my environment we are having window server 2012 active directory environment.We need to have the newly created active directory user account to get added automatically to the existing active directory group after that new user account creation.
Please tell us the possible ways to achieve this scenario.
Regards
S.Nithyanandham
Thanks S.Nithyanandham

Hi,
Can you please confirm your requirement,
When you create a new user account in AD, based on the user's property like Department, Job or Location, the user need to be added to your specific AD groups?
Regards,
Gopi
JiJi
Technologies

Cisco ISE auth policy based on Active Directory domain membership

I am currently testing the Cisco ISE product and I am trying to find a way to assign an authorization policy based on domain membership. Our company sorts standard users and project team member into different domains so it seemed like the ideal thing to sort with. Unfortunately, I am no AD expert and there are a mind boggling number of conditions/expressions to choose from. I figured I would be the first person to try this. What have other done to solve this problem?
I have tried using the memberOf attribute and matching to .*(domain).* Basically looking to see if memberOf contains the domain name. It works for machine authentication, but when I log it the system cannot find my account info for some reason and boots me to the guest vlan.
Thank you.

Are the two sets of users actually residing on two separate and independent domains? If so then that is probably where your problem is as ISE can only integrate with a single domain. If you have multiple domains then there must be a trust relationship between them. Another solution is to use LDAP integrations as there is not a limit with LDAP integrations.
Thank you for rating!

Automatically Assign to user based on email

Hi Guys
One of our IT managers would like to be able to have service requests automatically assigned to members of his team based on emails he sends.
At the moment we have an exchange connector set up that logs Service Requests for his team, and assigns it to the their support group. I'm trying to figure out the best way to further refine it to then assign it to a support person based on some criteria
within the email itself. The way i figure it, I'll need to to do it via Orchestrator.
I'm thinking something like:
Email generated Service Request triggers a runbook, that either pulls the email attachment out of the SR and then does (something) to resolve the AD User from the CC field and assigns it to that person. Then he can just CC the team member and it will assign
it. The hard bit is figuring out how to resolve an AD user from a field in a *.eml file.
or
He types the AD name of the user on say line 1 of the email, then orchestrator reads that line and looks up the AD user based on that. Seems easy enough but then he will need to make sure he uses either the absolutely correct spelling of their name, or type
their SAMAccountName out.
By email CC field is the more user friendly option but I have no idea if that's even possible.
Does anyone have any thoughts about how to go about this?
Cheers

OK so he has changed his request now after I spoke to him.
He now wants any emailed service request to be automatically assigned to the sender.
So basically I need to create a runbook to set the Assigned To user to be the same as the Affected User.
Sounded easy enough, but the "assigned to" field is not present in the orchestrator update object action. I think this is now a question for the Orchestrator forum so i'll mark this off and start a new thread there.
Thanks.

Automatic assignment of Support Team based on processor

We have a help desk team creating Service Desk messages directly into SOLMAN (not from satellite system) using transaction NOTIF_CREATE and assigning processor. After they save the message, they open the message again in transaction CRM_DNO_MONITOR and change the Support Team manually based on the processor's Support Team. They are requesting if
the assignment of Support Team can be done automatically based on the processor assigned during creation of message and
when processor is changed/re-assigned after message has already been created.
I've read some suggestions in the blogs and forums that partner determination can be done by creating your own BADI.
So I've created a new BADI "Z_FIND_TEAM" (copied from BADI CRM_DNO_PARTNER_1) and commented the logic which derives the support team based on the rule in transaction PFAC, and replace this with my own logic of getting the processor's Support Team. Then I assign this to the action. When I tested the action during creation of message (NOTIFCREATE), the action failed to get the support team because the CRM documents (where I'm getting the processor) is not created yet at the time that the BADI is executed.
I also tested the same action (but I didn't schedule it to run automatically) during changing of message (in CRM_DNO_MONITOR). The action successfully assign the correct Support Team when I already saved the new processor before choosing the action.
But if I change the processor and do not save first before choosing the action, the support team of the old processor is assigned.
In both cases, I need to get the value of the processor in the screen and pass this to the BADI.
Can anyone help me how to pass the screen value of processor to the BADI.
Or do you have other suggestions on how I can automatically assign the Suport Team based on processor.
Thanks in Advance.
Regards,
Tess

Hi Ragu.
Thanks for your quick response.
I've already tried assigning some standard access sequence in the support team's partner determination although the assignment of the support team always returns with the BP of the top organization unit in our org chart that's why I tried using the BADI afterwards.
Our org chart is defined something like :
IMS Support Team org unit
      Help Desk org unit
           Person 1
      Functional Team org unit
           Person 2
      Technical Team org unit
           Person 3
I've tried access sequence like "Organizational Data: Employee for an Org. Unit" and "Organizational Data: Organizational Unit for a User", but when I test this the support team is always defaulted with the "IMS Support Team's" BP Number (the top org unit).
I'm not sure which access sequence I can use to assign the support team, for example, processor = "person3", the support team should be "Technical Team".
Or do I need to create my own access sequence?
I'm not familiar with these access sequence and not really sure how it works.
Thanks.
Tess

Rule Modeler - Automatic assignment Partner Function based on PC of IBASE

Hi Experts,
I have the following requirement. The IC Agent when receiving a call has to create a Service Ticket (Service Order). By creating the Service Ticket the responsible Service Partner has to be assigned to solve the service incident based on the Postal code of the IBase (Installed Base).
The following steps I have done:
1. I have created the Service-ID Z_RE_RULE_EXEC (Rule Invocation) with the following properties:
    CONTEXT               Context
    DEF_ROUTING    Default Routing
    LOG_LEVEL        Logging Level
    POLICY                Root Policy
2. Under Repository I have defined a new context: Z_TICKET_ASSIGMT with the following properties:
Context Properties: No Customizing
Authorization Groups: No Customizing
Attributes:
Name: ZPOST_CODE1_IB
Show Attribute: Flag marked
X Path Expression: /parts/currentIbase/ComponentAddress/POST_CODE1/text()
Fact Gathering Service: FG_IC_REF_OBJ
Attrib. Ext. Class: CL_CRM_ERMS_ATXT_TEXT_NCAT
Actions:
Action-ID: Z_PARTNER_ID
Show Action: Flag marked
Action Service ID: DD_AH_PARTNER_ID
Action Parameters:
Parameter-ID: PARTNER_ID
Display Mode: O
Inp Spt Class: CL_CRM_DD_F4_BP
Afterwards I created the Rule Policy: Z_PRUEBA2 with the condition that if the Postal Code of the IBase is 08030 or 08035
the Partner Function ID 56 has to be assigned to the Service Ticket. I have released the Rule Policy afterwards.
Into the standard Service Manager Profile SAP_ORDERROUTING I have added the created
Service-ID Z_RE_RULE_EXEC with the following properties:
CONTEXT:     Z_TICKET_ASSIGMT
LOG_LEVEL:     0
POLICY:     Z_PRUEBAS2
Now I want to test the rule policy by entering with the ROle SAP_CRM_UIU_IC_MANAGER (IC Manager) but I can not see any possibility to do that. So my questions is how I can test the rule policy Z_PRUEBAS2? Do I have to assign the Service Manager Profile to the IC Center Agent Role?
Best Regards
Oliver

Solution: Problem solved. Error was the name of the attribute. It has to be POST_CODE1_IB
and not ZPOST_CODE1_IB.

Pushing out software that "requires" admin rights....

I have a piece of software that needs installed on 200 users machines....however the software requires admin rights to install. So, by using group policy, I can successfully push out the software to users that have local admin rights, but it will not install
on machines that do not have local admin rights.
Whats the best way to accomplish this without giving 200 people admin rights?

How did you create a Distribution point ?
To publish or assign a computer program, you must create a distribution point on the publishing server (I am sure, you must have done that already)
However, FYI... Here are the steps
create a distribution point
Log on to the desired server as an administrator.
Create a shared network folder where you will put the Microsoft Windows Installer package (.msi file) that you want to distribute.
Set permissions on the share to allow access to the distribution package.(Authenticated Users should have
READ permissions)
Copy or install the package to the distribution point.
Assign a Package
Computer configuration / Policies / Software Settings / Software installation
Right-click Software installation, point to New, and then click Package.
In the Open dialog box, type the full Universal Naming Convention (UNC) path of the shared installer package that you want. For example,
\\FileServer\Share\software.msi
Important: Do not use the Browse button to access the location.
Make sure that you use the UNC path to the shared installer package.
Click Open.
Click Assigned, and then click OK. The package is listed in the right pane of the Group Policy window.
Close the Group Policy snap-in, click OK, and then quit the Active Directory Users and Computers snap-in or gpmc.
When the client computer starts, the managed software package is automatically installed.
Along with Software Distribution policy, you can set another policy "Always install with elevated privileges"
User Configuration\Administrative Templates\Windows Components\Windows Installer
This policy directs Windows Installer to use system permissions when it installs any program on the system.
This policy extends elevated privileges to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the desktop), assigned to the computer (installed automatically), or made available in Add/Remove Programs
in Control Panel. This policy lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers.
If you disable this policy or do not configure it, the system applies the current user's permissions when it installs programs that a system administrator does not distribute or offer.
Caution : Skilled users can take advantage of the permissions this policy grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this policy is not guaranteed
to be secure.
Important: This policy appears both in the Computer Configuration and User Configuration folders. To make this policy effective, you must enable the policy in both folders.
Hope that helps.
If it looks good, Eat it ! Likewise, If you don't know the answers, don't hesitate to ask questions !!
This posting is provided "AS IS" with no warranties or guarantees and confers no rights.
About Me !!!

Assigning Helpdesk rights to Mobility Service WebConsole

Would like to assign some basic help desk rights to be able to resync, delete, and block device without giving them full admin rights and access to the Config section.
Is there a way to do that? I can only find adding another Admin.

ochschr wrote:
>
> Would like to assign some basic help desk rights to be able to resync,
> delete, and block device without giving them full admin rights and
> access to the Config section.
>
> Is there a way to do that? I can only find adding another Admin.
Today it's all-or-nothing as we don't have any sort of role-based
administration within GMS.
Your world is on the move. http://www.novell.com/mobility/
Supercharge your IT knowledge. http://www.novell.com/techtalks/

Installation Server and Windows 7 - Admin Rights Issue

Here is a good one. Completely reproducible error when granting Local Admin Rights by the LSH Service.
For those with SAPGui Installation Server (SAPGui 7.20 Patch 6 or above) ... try this on a Windows 7 SP1 front end when you are NOT logged on with local admin rights.
1) Open the Windows RUN dialog
2) Type path to your installation server\setup\nwsapsetup.exe
3) You should find the install wizard starts (granting local admin rights) as expected.
NOW TRY THIS
1) Type path to your installation server\setup\nwsapsetup.exe /uninstall
2) You will find that you get a dialog about can't grant admin rights. Un-install will abort.
This only appears to happen with the /uninstall switch! Using /product= for example it will still grant admin rights.
BIZZARE ...
I've opened a Customer Support Message (Friday) priority - MEDIUM have not heard back from SAP Support yet.
Bob

Jude,
Thanks, it looks like that note has been getting a lot of update activity lately because the newly released Patch 8 has nwsapsetup.exe as version: 8.6.1.62 and that version also has the issue with the /nnnnnn switches.
I do have to say however, that this issue with nwsapsetup.exe and admin rights (requiring SapSetup.exe_Patch) first appeared with the release of Patch 6 for the Gui. It was fixed for WinXP (I had a customer support message opened on this). So why didn't anyone also test on Win7?
Who is QA-ing these software releases?
Patch 8 had the same problem.
The change log for SapSetup.exe_Patch, is up to 8.1.6.70 now.
How are we in large enterprises to feel comfortable deploying any of this?
End of rant ....
Bob
P.S. I really appreciate your presence here ... the tech assigned to my formal Support Message on the matter still has not gotten back advising of the updated release of SapSetup.exe_Patch.
Message: 0000746888
Edited by: Bob Held on Sep 16, 2011 10:30 PM

Delay when starting accdb without local Admin rights.

Hi,
I have a problem with one application, the front end of the application is MS Access DB that's connects to our SQL Server over odbc driver If the user is in a local administrator group everything is working fast. When the same user is put in the user group
without Administrative rights I recive a delay for about 60 sec then the error pops up
After I hit ok a new SQL login pops up and I just press second time ok and the application starts without entering any user and pass. This is not happening if the user is in the built in Administrators Group.
Thanks for the help
fract

Hi fract,
as a Microsoft partner I have asked support for help.
Here is their answer:
Hi Partner,
Thanks for your reply.
Based on my research, the issue is identified as a compatibility issue that Access 2010 has with SQL Server 2008 R2. Access uses PERMISSIONS function to check the privileges. The PERMISSIONS function is deprecated in SQL Server 2008 R2. I haven’t found
any workaround for this issue currently.
You can check the more detail information at below link:
PERMISSIONS (Transact-SQL)
http://msdn.microsoft.com/en-us/library/ms186915(v=sql.105).aspx
I think you need to access SQL Server 2008R2 with local admin right.
If you have any further questions, please let me know.
Best Regards,

User with no admin rights can not authenticate on wikis or blogs

I just set up my OD and proceeded to add users in the workgroup manager. I create an account for myself and gave it full admin rights under the privileges tab (in work group manager). I then created a test user account and gave it no privileges. My admin account can log on to wiki's and create blogs but my test account can not, It wont let me log in to any of the wiki's it's assigned to or set up a blog. I set the test account to have full privileges and then I was able to do these things.
I had this set up correctly before the 10.5.2 update came out and crashed my server, I had to re-install the OS and start from scratch again.
Any thoughts on what's wrong?
Thank You,
Message was edited by: pixelmnky

Are the users and groups local or in an OD master?

Adobe Updater 9.3.2 Admin Rights

Hi,
Simple question really. The updater feature in adobe reader 9.3.2, does a user need to have administrative rights to use the "Automatically Install Updates" option.
ive installed it for a test user without admin rights and it has the entire updater feature grayed out and the radio button is set to "Do not download or install updates automatically", even though i have the registry key [HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\1.0\ARM] "iCheck"=dword:00000003 set.
when i log in as someone with admin rights the setting to automatically install updates is selected.
thanks in advance
Eric

no replys to this? no one has an answer or can at least point me to an article with the answer?
thanks

SBS 2003 server admin rights dont work access denied on VSS and Network settings

Hi I have just taken over support for a company and have inherited a SBS 2003 Server.
The server has had no backup for over a year (when the last admin left).
VSS does not work, so the back does not work, unable to install any other backup as no admin rights.
I want to repair it so I can do a backup to move to a new server.
I did not know the administrator account password (the last admin didn't tell anyone)
So I used a password reset boot cd and then restarted Windows 2003 in Directory Service Restore Mode.
Copied SRVANY and INSTSRV to a temporary folder, mine is called D:\temp. Copied cmd.exe to this folder too. Next ran at a command prompt instsrv PassRecovery "d:\temp\srvany.exe"
next
Started Regedit, and navigated to
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PassRecovery
Created a new subkey called Parameters and added two new values:
name: Application
type: REG_SZ (string)
value: d:\temp\cmd.exe
name: AppParameters
type: REG_SZ (string)
value: /k net user administrator 123456 /domain
"123456 is substituted for the password I used" Im not daft enough to publish it lol
Next
opened the Services applet (Control Panel\Administrative Tools\Services) and opened the PassRecovery property tab. Checked the starting mode is set to Automatic.
to the Log On tab and enable the option Allow service to interact with the desktop.
Restart Windows normally, SRVANY run the NET USER command and reset the domain admin password.
OK so now I am logged in as administrator but guess what I still don't have admin rights???
I can add new user with admin rights and log in as them but they still don't have admin rights Im totally lost??????????? Help please

I'm thinking the previous tech may have renamed the built-in domain Administrator and then created a new account called 'administrator' with lesser rights? He then used another domain admin account to manage the server.
If so, and given the fact that you don't know any domain admin account usernames or passwords, I think you may be in for a move to a new server without a proper NT backup of the SBS 2003.
However, If you can at least log into the SBS 2003, I wonder if you could download and run DIsk2VHD and create VHDs (not VHDX) of the current SBS 2003 drives, saving them to an external USB drive connected to the server.
You could then 'attach' the VHDs to a Win7 Pro computer and gain access to the files/folders, although not the Active Directory stuff. Moving Exchange and Sharepoint would impose additional pain. For Exchange, you could log
onto workstations as each user and export their Exchange mailboxes as .PSTs. I believe you could do the same with any Public Folders.
Disk2VHD
http://technet.microsoft.com/en-us/sysinternals/ee656415.aspx
How to Mount a Virtual Hard Disk in Windows 7
http://www.online-tech-tips.com/windows-7/mount-vhd-windows-7/
Of course, the owner could also have his attorney contact the previous tech and threaten legal action unless he coughs up the correct domain admin username and password. That username and password belong to the owner, not the
tech.
Merv Porter
=========================

Local admin rights when Edit locally

Hello, all!
We have the same problem as in
Local Admin rights to "Edit Locally" ?
"The end users do not have administrator rights on their local PCs , they logon to the domain server with restricted rights. When it comes to portal, when trying to edit a document with "Edit locally" it is not possible to do is even if the user has all the rights for the document in the Portal KM configuration. When we make the user local admin, everything is OK"
We are on SPS14, Windows XP SP2. Domain users can run corresponding applications and can create dirs or files in a temp directory. We also utilize env. variable SAPKM_USER_TEMP but with no success.
Could yoã please suggest, how to find rights needed to execute Local Edit. Are there any way to trace this Docservice ActiveX?

Hello Roman,
here a note which describes a solution for a user account wuth restricted rights:
The Edit Locally activex will be installed based on following
installation steps:
The browser will recognize that the KM DocService activex has to be
started.
In case of the activex isn't installed on the the PC, it will be
downloaded from the KM server (...etc/docservice/docservice.cab)
The browser will extract two DLLs from the docservice.cab file
(docservice.dll and sapkmprogressplayer.dll) and register them on the
local PC. To see if the installation succeed you can open within the
browser following dialog: Tools/Internet Options/Settings/View Objects,
look for program file SAP KM DocService Control.
Registry keys in following areas will be created:
Area HKEY_CLASSES_ROOT:
HKCR\AppID\{5F8983A6-347C-46B9-BA7A-1B87E5DAE0BC}
HKCR\ProgressPlayerMod.ProgressPlayer
HKCR\ProgressPlayerMod.ProgressPlayer.1
HKCR\CLSID
HKCR\TypeLib
Area HKEY_LOCAL_MACHINE:
HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINNT/Down
Downloaded Program Files/DocService.dll
HKLM\Software\Microsoft\Code Store Database\Distribution Units\
When finishing these steps successfully the installed version can be
located within the browser dialog Tools/Internet Options/Settings/View
Objects SAP KM DocService Control and den KM DocService will
start loading the document content from the KM server and starting the
corresponding application for editing.
Installation with restricted user accounts:
With restricted user accounts e.g. no access rights to create registry keys in the area of HKCR or HKLM etc., which lets the described installation fail, following installation procedure leads to success:
Register the needed DLLs manually on the PC (e.g. via a shell command script) with a user account having enough access rights.
1.1 Create an installation folder (don't use /windows/system32) on the PC and copy the DLLs (docservice.dll and sapkmprogressplayer.dll) to it (extract them from docservice.cab with a tool e.g. winzip).
1.2 Open a command shell on this installation folder.
1.3 Unregister possible existing versions with the following command:
"regsvr32 docservice.dll /U " and "regsvr32 sapkmprogressplayer.dll /U "
1.4 Register the both DLLs with: "regsvr32 docservice.dll" and "regsvr32 sapkmprogressplayer.dll "
1.5 If the two registration steps fail check the permissions to write
into the system registry.
1.6 The installation folder do not need special permissions, the linkage to the DLLs will be done via the system registry.
1.7 Additionally the following setting is mandatory to succeed the installation:
Disable the "ActiveX Version Check" function within the KM Configuration
SystemAdministration->SystemConfig->KnowledgeManagement->
->Configuration->ContentManagement->Utilities->Editing->LocalEditing-> ActiveX Version Check (Uncheck the checkbox)
Setting a different TEMP directory:
In cases that it is problematic to use the standard %TEMP% directory, setting the environment variable SAPKM_USER_TEMP pinpointing to a corresponding directory path (e.g. X:\SHARES\USERS\xxx\CheckedOutDocuments) will be also supported. If the access to that directory fails the standard %TEMP% directory will be used as fallback.
Hope this helps,
Michael
Message was edited by: Michael Braun

Automatically assign admin rights in OS X based on Active Directory

Similar Messages

Maybe you are looking for