Standardise Local User Set

Question

Hi all,
We're looking at moving over into an ADOD environment having previously only had local users on each machine. We have about 100 or so Macs all with various different local users on them (some with admin access and some without).
We'd like to standardise the local users to just two for each machine (each with a standard password) one 'Local User' for them to use if the network is down, and one 'Administrator' with local admin access.
We'd prefer to do it over Apple Remote Desktop if possible?
Cheers

Answer 1

I can tell you right now this will be a nightmare to setup, but it can be done if you're careful and take the time.
The issue is one of user IDs - even tough you see yourself as a username, everything on the inside uses an associated user ID to keep track of permissions - every file is 'owned' by a specific user ID (not a user name). When you create local accounts on a machine, the OS always starts at the same User ID number.
This means that on one machine, user Joe may have UID 501.
On another machine user Jane may also have UID 501.
That's OK as long as the machines are separate, but if you try to unify them there's no way the OS can tell who should own the file - as far as the OS is concerned the file is owned by user ID 501, and you can't have both Joe and Jane using the same ID.
So what you're going to have to do is create all the users in the main directory and note the user ID that's assigned (or assign a specific one for each user if you prefer).
Then when you bind the client system to the directory server you need to do several things.
First you need to change the ownership of all the files in the user's home directory to their new UID. For example, if user 'joe' on the machine has a new central account with UID 12345 then you could:
sudo find /Users -user joe -exec chown 12345 {} \;
The above command will find all files in /Users that are owned by 'joe' and change them to be owned by user 12345
Then remove the existing user account from the local directory (via System Preferences -> Accounts)
Then bind the client system to the directory server using /Applications/Utilities/Directory Utility
Now users should be able to log on using the central account.
Note, though, that this doesn't deal with using network home directories. In this scenario Jane won't be able to log onto the machine previously used by Joe and see her files because they'll be stored on some other machine.
If you're planning on implementing network home directories then there's an additional step of moving each user's data to the corresponding directory on the network file server that's storing home directories.