AD user on encrypted MAC

using terminal:

sudo fdesetup add -usertoadd username -usertoadd username -keychain

and or:

1. Login as Local Admin
2. Add AD User to Filevault(you will need user to input AD Password)- Skip this step if you already added and rebooted and not seeing the AD User.
3. Log the Local Admin account out (Do not restart or shut down- just logout).
4. Now you should see the AD User(or Users list if multiple had signed in)
5. Login as AD USER. Then Log out(do not restart or shur down- just logout).
6. from the Login screen now reboot.
7. AD Users should now show up as an option to login in.

reference:

https://www.jamf.com/jamf-nation/discussions/25692/high-sierra-10-13-encrypted-users-not-showing-at-filevault-login-screen 

change pwdLastSet to reset user password last set in AD

 what worked for me was to change it to 0 first and then change it to -1

If set to 0 it will force user to change password on next login. (If user doesn’t have flag set to Don’t Expire Password)

If set to -1 the password change date will be set to current date and time.

 

reference:

http://ldapwiki.com/wiki/Pwd-Last-Set%20attribute

DeployStudio workflow with auto-join Active Directory

 After creating master image create workflow with these steps:

1:

restore HDD from MacBookAir2017.hfs.dmg disk image.

 

2:

Rename computer:

 

3:

Prompt for computer name during setup

 

4:

auto join computer to MS Active Directory.

 

5:

auto join computer to Open Directory Server.

windows 2012 R2 domain AD health check

 list of simple commands to check the health of AD

1. DCs replication status (CMD):
   repadmin /showrepl
2. domain replication status (CMD):
   dcdiag /v
3. MS AD replication status tool:
   https://www.microsoft.com/en-us/download/details.aspx?id=30005

Disable spellcheck word 2016

 Here is a solution on how to disable spellcheck in word 2016 using group policy:

 

 

reference: http://www.edugeek.net/forums/windows/181129-disable-spellcheck-word-2016-a.html

Additionally we create special domain user which is blocked at the firewall level from internet content.

Windows 10 Auto login in domain

 

Deploy using registry:
REG ADD “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon” /v AutoAdminLogon /t REG_SZ /d 1 /f
REG ADD “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon” /v DefaultDomainName /t REG_SZ /d *your domain* /f
—-if local domain is needed use “.” (without the “)
REG ADD “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon” /v DefaultUserName /t REG_SZ /d *User* /f
REG ADD “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon” /v DefaultPassword /t REG_SZ /d *password* /f
—If using special character use ^ before it

To remove:
REG delete “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon” /v AutoAdminLogon /f
REG delete “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon” /v DefaultDomainName /f
REG delete “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon” /v DefaultUserName /f
REG delete “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon” /v DefaultPassword /f