In this lesson, we're going to demonstrate the difference between a network account and a mobile account.
When we joined the domain with our mobile config profile, we had enabled an option in profile manager
to create a mobile account upon Logan.
Now, when we joined with a script, we didn't have such an option.
So before this video started, I had joined the New York machine with the mobile config profile and
I joined the machine with the script.
So let's go ahead and compare the difference.
These two machines with the config add show, that's what this job does.
So as you can see, our New York machine says create mobile account that login enabled and relay machine
says create mobile account that login disable.
OK, so let's go ahead and compare the difference between the two machines.
All right, so first, our New York machine, you see that it was done with the profile and let's go
to users and groups and you can see it's logged in with a mobile user.
And if we go over to our L.A. machine, you can see that it's logged in with a network user.
So let's go ahead and log both of these machines out.
And what we're going to do is we're going to simulate pulling the network cable from both of them.
So let's go ahead and remove the network cable from the L.A. machine.
And that other is the way that you would be able to log in with a with a network account.
And so we're going to go ahead and do the same thing on the New York machine, we're going to go ahead
and disable the network cable.
And as you can see on the L.A. machine, which is the one with the network account, it can no longer
find the network.
And so you have no ability to log in with a network account.
And the only local user on the machine was administrator.
Thus, it's the only log inside.
So let's go ahead and plug the network cable back in.
And in the meantime, we're going to leave the New York account disabled, and as you can see, it comes
up with my mobile account name.
And let's go ahead and log in.
And so now that this computer is back on the network, it sees the active directory and it's giving
us the ability to log back in with our active directory account.
So let's go ahead and do that.
OK, and there you have it.
That's the difference between a mobile account and a network account.
All right, so I wanted to show you one one other thing about mobile accounts and active directory in
general.
So we've unbound our machines from active directory and one on the left, as we can see, has a a mobile
account.
And on the one on the right shows no account.
So if we go to a computer and we go to users, you can see that our active directory user folder was
there.
That's because the user had logged in.
So we unbound from the domain and it has a network account, but it does not mean that it raises the
home folder.
Likewise, on the one with the mobile account, the computer's unbound from the domain, but the user
still has the ability to log in because there's a mobile folder.
Now, if either or both of these computers are no longer being used by these users and we bring down
them from the domain, then we can go ahead and delete the user folder.
So on the one that has the mobile account, you would have to click on the user and then click delete
user and then say delete home folder and you can go ahead and do that in the home folder.
Delete.
Now on this one, since the account isn't there anymore, then you simply would need to log in as administrator
and then send the user folder to the to the trash.
All right, so I've got the computers back into the same position they were before we deleted the accounts,
and I want to show you how you can do this through the terminal.
So, again, on the high Sierra machine, there's no mobile account listed if we go to.
We go to the home directory.
You can see that the the active directory account is there where we're not on the domain, so on this
one, we're not on the domain.
We've got a mobile.
We've got a mobile account.
And if we go to users, then we're going to see that the the profile folders there, too.
All right.
So what I've done is I have created a two jobs.
One is going to list the accounts and profiles.
And let's take a look at this real quick.
And so I want to point out that it's really important that in your environment that you're probably
going to need to adjust this line.
So what I'm doing is I'm going to find all the folders in the user folder that are not named administrator
and not names shared.
So what that means is.
When we go up to the users folder, I want to know what's not called administrator and what's not called
shared now.
If you log if you create your computers and they all have an account called admin on it or something
completely different, then you would want to put that there.
If you have absolutely no consistency and in the user accounts that you use, there are all random.
And this strategy may not work for you.
You'll have to find another one.
But if all of your accounts, if all of your systems have an administrator account and a shared account
and you just want to know about the other ones, then this would work.
So anyway, we're finding them all and then we're going to list all the users on the system.
So that's what this second line does.
So let's go ahead and run it on both because the output is going to look a little bit different.
So on the first computer with the mobile account, you can see that it found an account for our active
directory user.
And if we scroll down now, this shows all the other accounts.
And so the account is there as well.
And on this machine.
It's now the active director user profile folder, and then if we scroll down, you'll see that that
account's not on the machine and that's because it is a it's a network account.
And so there's no mobile there's no mobile account on it because it's off the domain.
It doesn't know about that account anymore.
All right.
So now if we go to this account up script, what it's going to do is it's it's going to make.
An array called users based off of every subfolder that's in the user's folder that's not called administrator
or shared.
So in our case it was one on each and then it's going to loop through all of those names and it's going
to delete the account with the name on it, and then it's going to remove the folder with that name
on it.
So in the case of our machine with a network account, this line is going to give a failure, which
is fine.
It's just going to error.
It's not going to cause any harm, but it will delete the home folder.
And on our computer that's got the the mobile account, then both of the lines will work because.
The account is there and the profile holders there, so let's go ahead and run.
Let's go ahead and run this.
And just like I said, you know, we we got an error on deleting the account because it's invalid,
that account didn't exist.
And so when we go ahead and we look at the machine, so the that account is gone, and then if we go
and we look on the other machine, the again, the profile is gone.
Now, it still shows that this account is here.
But I think I'm going to have to reboot the machine for to disappear.
If I log that in again, it's possible that it's going to be gone.
But let's go ahead and take a look.
Well, as you can see, that we don't have the option for any of the mobile account login.
So the mobile account must be gone.
But let's go ahead to the user's system preference and see.
And it is indeed gone, so that's how you do it from the terminal.
So if you're in the situation where you need to delete the home folders or the mobile accounts on machines
that aren't accessible, then this is how you can do it.
When we joined the domain with our mobile config profile, it created a mobile account, and when we
use the script to join the domain, it created a network account.
So if we want to join the domain with a script and use a mobile account, we have to add a couple of
options that we didn't use before.
So at the end of this script that we use before I added a few options mobile enabled, mobile confirmed
disable that prevents the user from being asked if they want to create a mobile account and local home
enable which forces the user's profile onto the max internal hard disk.
So what we have here when we when we use this is, is that we're having our bound active directory.
We're using an active directory account to log in.
And after that, it would be identical to just creating a local account on a Mac.
All right.
So we have the job running.
And when it's done, we're going to go ahead and do a configured to confirm the results.
And here we are, so we have create mobile account enabled, required confirmation, disabled and force
home to start up disk enabled.
Those are the options we want.
We have them on both.
And that's how you would do it with a script.