AD bind with custom policies

[rskolden]

Hi all,

We are running about 1000 Macs, which are all bound to our AD.
On top of this we are running NoMAD on all these machines, which is working wonderful, and we have also disabled the login notification by deploying this to all computers (after the AD bind is done):

#!/bin/sh
defaults write /Library/Preferences/com.apple.loginwindow PasswordExpirationDays 0

Now to the issue, a couple of months ago we went from the default 90 days to 180 days password expiration and the Macs don't want to understand this change.
This means that when NoMAD comes down to 90 days, our Macs doesn't allow our users to login without changing the password.

This change is set via custom user policies in the AD, meaning the system default is still 90 days.

So, have anyone else encountered this and/or how did you solve this?
I also don't need to point out that the PCs have no problem following this change :P

[ICTMuttenz · Accepted solution]

Hi

You forgott the -inter in your code.

It should like so:

#!/bin/sh
defaults write /Library/Preferences/com.apple.loginwindow PasswordExpirationDays -inter 0

[rskolden]

@ICTMuttenz

Haha, you gotta be shitting me, I double checked and sure thing, it's stated as a string...

Thanks, i will test to add the -inter :D

[ICTMuttenz]

no problem ;) we are humans and we make mistakes. And this is good.

[joshuasee]

Uhm, based on my reading of the defaults man page the switch is -int or -integer , not -inter .