Skip to main content
Jamf Nation, hosted by Jamf, is a dynamic and knowledgeable community of Apple-focused IT admins and Jamf Pro users. Join us in person, in October, for the annual Jamf Nation User Conference (JNUC) to discover new and better ways to manage Apple devices.
CCT Badge CCA Badge CCE Badge

Automate account creation during Prestage Enrollment

Hi all,

For JSS 9.93, is there a way automate the account creation during the Prestage Enrollment? Please look at the screenshot below

Here is what we're trying to accomplish:

During DEP, the user is asked to enter their AD credential. With JSS 9.93, there is an option to skip local account creation. What we want to do is to create a local account base on the assigned user (whoever authenticate during DEP) and not using a standard local admin account. Is this possible? Thanks

Like Comment
CCA Badge CMA Badge
SOLVED Posted: 10/10/16 at 10:27 PM by stevevalle

We bind our Macs to AD at time of enrolment through the DEP process (add directory binding details to the Directory tab in your screenshot). This way, when the Mac is enrolled into Casper, it is also bound to AD and the user is able to login with their AD account. A local account is created based on the users username.

The only issue with this is that the user needs to be on the local network to bind to AD, but we are working on resolving this!

Like
CCT Badge CCA Badge CCE Badge
SOLVED Posted: 10/11/16 at 12:21 PM by vtran

@stevevalle Thanks for the fast response. The reason why I want to create a local account is because of the remote users who will not have local network to bind to AD. Please share the solution to this issue when you found out :)

Like
CCT Badge
SOLVED Posted: 3/29/17 at 2:37 PM by mabec

@stevevalle Have you been successful in binding to AD with the PreStage Enrollment for DEP? My team has everything set in the directory payload, but it is just not completing.

Like
CCA Badge CMA Badge
SOLVED Posted: 3/30/17 at 4:28 PM by stevevalle

@mabec Yes, every staff Mac deployed is bound to AD during the DEP enrolment process. By the time the Mac gets to the login screen, it is bound to AD.

The only issue with this is they need to enrol the Mac while on our network. They are unable to do this from home.

Like
SOLVED Posted: 3/31/17 at 3:18 AM by HangerS

We are using something like this to create mobile AD user account later on thru VPN during DEP enrollment process.

# Set cocoaDialog location
CD="/Users/Shared/CocoaDialog.app/Contents/MacOS/CocoaDialog"

# Dialog to enter the User name and the create $USERNAME variable
rv=($($CD standard-inputbox --title "Username" --no-newline --informative-text "Enter your Company Username"))

USERNAME=${rv[1]}

if [ "$rv" == "1" ]; then echo "User said OK"
elif [ "$rv" == "2" ]; then echo "Cancelling" exit
fi

# Dialog to enter the Password and the create $PASSWORD variable
rv=($($CD secure-standard-inputbox --title "Password" --no-newline --informative-text "Enter your Company Password"))

PASSWORD=${rv[1]}

if [ "$rv" == "1" ]; then echo "User said OK"
elif [ "$rv" == "2" ]; then echo "Canceling" exit
fi

#Create Mobile Account
/System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n $USERNAME -p $PASSWORD > /dev/null 2>&1
if [ $? -eq 0 ]; then
break
    fi
    sleep 1
done
Like
SOLVED Posted: 9/8/17 at 3:59 PM by shifty

@stevevalle I try (!) to accomplish the same thing which you already have running. Unfortunately I can not get it running so maybe you (or someone else) could gimme a hint on what to do or where I zigged when I should have zagged....

The goal is: Startup -> DEP Greeting -> User authetificates -> Machine binds automatically to AD, using ($SERIALNUMBER-$USERNAME) -> User gets login screen and can log in with the AD account -> login creates mobile account based on $USERNAME.

To accomplish this I set up DEP like this:

Account Settings:
Local User Account Type = Skip account creation (so that no local user account will be created)

Directory:
(next to the obvious connection to our AD)
Client ID = $SERIALNUMBER-$USERNAME
User Experience = Create mobile account

The problem is, that when I start a new computer the only part which works is the first two parts, the DEP Greeting and the user authentification. After that the user is asked to add a local user and the machine will be set up with that user and no binding to the AD. And it shows up in JAMF as the default name: Usernames Machine....

First I assumed, that the AD Binding between JSS and AD maybe has a Problem, but as the authetification works, this can not be the problem, can it?

ANY idea on what I could be doing wrong?

Disclaimer: I am fairly new to this and maybe I am missing something obvious.

Like
CCA Badge CCE Badge
SOLVED Posted: 9/10/17 at 4:16 PM by Look

Did anyone actually get the skip local account function to work?
I have had it enabled on a few DEP machines and basically regardless of what else is configured it always seems to prompt.

Like
SOLVED Posted: 9/12/17 at 8:53 AM by shifty

@Look To me it looks like @stevealle achieved this in his first post. So I am guess it is possible. Anyhow, I can not get it to work. It just ignores that setting…

Like
SOLVED Posted: 9/12/17 at 9:19 AM by ClassicII

@shifty @Look

What version of the JSS are you using? We can not get this option to work correctly either and are on 9.100.

Jamf is saying that they can not replicate it on 9.101.

Could you file a support issue on this? As we sure could use some help as it seems like no one else is having the same issue.

Like
SOLVED Posted: 9/13/17 at 1:33 AM by shifty

@ClassicII We are using 9.99.0. Will try to update to latest version and will let you know if that changes anything.

Like
CCA Badge CCE Badge
SOLVED Posted: 9/13/17 at 5:06 PM by Look

@ClassicII We are on 100 as well.
Not sure when we will more to 101 though, but possibly soon as there are one or two other issues with 100 that are bugging me.

Like
SOLVED Posted: 9/14/17 at 8:06 AM by CCNapier

We have the same issue on 9.100, although this is me setting it up for the first time.
Going to schedule update to 101 for early next week if possible.

Currently the device gets registered in AD, but still prompts for local credentials even though "skip account creation" is selected.

Like
SOLVED Posted: 9/18/17 at 11:35 AM by ClassicII

@shifty @CCNapier @Look

We have upgraded our dev environment to 101 and issue looks to be fixed.

Like
SOLVED Posted: 9/18/17 at 12:00 PM by shifty

@ClassicII Thanks for the info. I have some news as well. We are still on 9.99.0. but I updated the Client to the latest OS. Before it was 10.10.5, now it is 10.12.6... and it works like wanted. Binding to AD and no local account.
Like I wrote before, I am fairly new to this and I did not know that the OS of the client has to be the latest. Is there a KB entry somewhere that shows which JAMF feature works with which client OS version?

Now I am interested to know which client OS versions you used, @ClassicII. Before and after the upgrade to 101.

Edit: I just realised, that one thing did not work: I told the machine to use the $SERIALNUMBER as machine name, which it did not use. Machin is just called "iMac".

Like
CCA Badge CCE Badge
SOLVED Posted: 9/18/17 at 5:33 PM by Look

Is binding to AD a requirement for automatic account creation?
I have create Local Admin configured, thought that should be enough.
Also what about require authentication during enrollment?

Like
SOLVED Posted: 9/20/17 at 9:51 AM by CCNapier

Problem still exists for me with 101.
Trying a few different options before I contact support.

Like
SOLVED Posted: 9/22/17 at 4:19 AM by shifty

@CCNapier Which MacOS Client Version are you using?

Like
SOLVED Posted: Today at 4:43 AM by CCNapier

@shifty Currently Sierra (recovery).
@ClassicII @Look

JAMF support are saying to me this morning it looks like a new Product Issue, but I have yet to hear full details. @ClassicII it's working for you though? Care to share your configuration?

Like