Network wide Admin accounts

Question

How can I make network-wide admin accounts. Like, if I have a user in OD which has Administrator rights it seems like that only applies to the OD master. If I log in to a client and do "sudo" in terminal it wont let me.

Answer 1

Let's say that your directory administrator account is an administrator for the Open Directory domain you created on your server. Let's also call that account diradmin. OK, so here's the scoop:
Diradmin is a directory administrator for the OD master domain (shared LDAPv3 domain) because that account is a member of the admin group in that domain. Similarly, diradmin is a local administrator on the server because that account is a member of the local admin group, which is stored in the server's own local directory domain. Thus, diradmin is a local administrator for the server as well as a domain administrator for the directory.
With Mac OS X 10.4 or Windows XP and later, directory administrators don't magically become local administrators for clients that are bound to the directory. (Now Windows does use a trick by automatically granting the group "Domain Admins" local administrative functions; more on this below.)
Here are a couple of ways to make a directory administrator a local administrator of client systems. This can most easily be accomplished via ARD's Send UNIX Command option.
If you just want to make the single user "diradmin" a local administrator; on each client, issue the following command to add diradmin to the client's local admin group:
*sudo dseditgroup -o edit -a diradmin -t user admin*
If you want to mimic Windows behavior, the simplest way to do this is as follows:
1. Create a new group in the server's shared OD master domain; let's call that group macdomainadmins using Workgroup Manager or dscl.
2. Add any users from the server's OD master domain to that group. You can use Workgroup Manager to add them or dseditgroup.
3. On each client that's bound to the server's OD master domain, issue the following command, which can also be sent out using ARD:
*sudo dseditgroup -o edit -a macdomainadmins -t group admin*
4. You can add or remove any users to macdomainadmins later without adjusting any client settings.
--Gerrit