How to unbind from active directory while preserving a user account?
-
28-09-2020 - |
Question
My account is associated with an active directory of a previous company i was working at.
What is the best way to unbind my account from the AD without losing my files? I have admin access to the machine, and all the files are locally available.
The account is admin/managed and mobile.
Solution
- Login to a different admin account.
- Delete your account, choosing "Don't change the home folder" option.
- Open Terminal and rename your home folder, eliminating the " (Deleted)" part -- sudo mv "/Users/yourshortname (Deleted)" /Users/yourshortname
- Unbind your machine (Login Options tab, at the bottom)
- Create a new account with the same short name.
- Use the existing folder, when you're prompted.
An update to my comment of Sep 6 at 15:24 and part of #4 -- Apple has just issued a supplemental update that fixes this loophole. The text of their security announcement is:
APPLE-SA-2013-10-03-1 OS X v10.8.5 Supplemental Update
OS X v10.8.5 Supplemental Update is now available and addresses the following:
Directory Services Available for: OS X Mountain Lion v10.8 to v10.8.5 Impact: A local user may modify Directory Services records with system privileges
Description: A logic issue existed in Directory Services's verification of authentication credentials allowing a local attacker to bypass password validation. The issue was addressed through improved credential validation. CVE-ID CVE-2013-5163 : the rookies of 42