@MTurnerFMRCO if you just plop the above line into your Terminal and run it, it will send back a help page showing the options for the binary, like this:
usage: createmobileaccount -n username [-h homepath] [-P | [-p password]] [-e] [-q] [[-x] | [-X]] [[-s] | [-S]] [-u syncURL] [-t urlPath] [-d] [-v]
-n username : user record name.
-h homepath : user home path; Default is "/Users/<username>".
-p password : user password.
-P : prompt for user password. A user password is required to create a FileVault home.
-e encrypt : encrypt new home with FileVault.
-q quota : max size in bytes of FileVault home.
-x : create as external account on non-boot volumes. Default.
-X : create as mobile account account non-boot volumes.
-d : disable external account creation.
-s : set home sync on if home created.
-S : set home sync off if home created. Default.
-u syncURL : server target of home synchronization.
-t urlPath : additional path after syncURL.
-v : verbose output.
Examples:
createmobileaccount -n jsmith
createmobileaccount -v -P -n jsmith
createmobileaccount -vsxn jsmith -h /Volumes/HD3/jhome
createmobileaccount -vsxn jsmith -h /Volumes/HD3/jhome -u nfs:/server.apple.com/bigs/homes -t myusers/macos/jhome
Notes:
- createmobileaccount must run as root.
- If you do not specify a password, the account's cached password will be created during the account's first log in.
The basic idea is, the Mac must be already joined to your domain, then you can add a cached AD mobile account to the Mac using a line like:
/System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n username -p somepassword
Or you can use the uppercase p (-P) to get prompted for a password to type in. You can also just leave the password blank. It will create the user, but their account password will not get cached. However, as long as the Mac is hardwired to the network or connected in some way at the login screen, when the client logs in, they will be able to get in and their password will get cached. But I don't know if that process would work if they were trying to log into it remotely. I've never tried that honestly.
Lastly, I see no reason to consider using FileVault for these. Not only will it add a layer of complication to the process, if they are going to be locked away in a server room, I don't see the need to encrypt them. That's great for mobile devices. Sort of pointless for devices locked to a desk or a rack.
