Feature Request - Do not sync local admin accounts keychain password

An option to not sync keychain passwords with the local admin account would be a great option.

If you specify an account in the plist file with a specific username that doesnt follow the rules of nomad. The computer is still connected with AD but it doesnt do things like sync keychain or force the signin box. This would be useful to sign into a domain admin account or helpdesk admin account and not sync their password to keychain. This would be easiest if it were a local account in the .plist.

I would also be able to use this feature, to prevent clueless help desk techs from logging into our local admin account on any given Mac, and then signing in to NoMAD with their own credentials, thereby auto-syncing their domain password to the local admin account.

So this would potentially be a local account block list, into which we could enter the name of a local account, and NoMAD would then disallow syncing from the domain to that account.

To unpack this some.

1. AD user is sam
2. local account is bob

You want to be able to specify the local group "admins" and if bob is a member of that group don't sync?

The AD account, in this case, is irrelevant to what happens.

assigned to @Mactroll

changed milestone to %Barzona

Hey Joel;

Not exactly; What we’re requesting is “if local account is called bob, don’t sync.” So we’re asking to specify a specific account, as opposed to specifying an admin group.

That way any of our tech staff (sam) can log into the local admin account (bob) on any of our Macs, and then sign into NoMAD as sam, and it won’t sync, because the local account bob is excluded from syncing.

But I think you already covered this with LocalPasswordSyncDontSyncLocalUsers -array bob joe sally, right? I mean that totally does what we were asking for.

I think what happened is that we were talking about this in #nomad and then @Demon1337 wrote up this FR, and then you almost immediately added the features we were asking for, haha. So @Demon1337 can confirm or deny, but I think as far as this FR goes you already fulfilled it in the form of LocalPasswordSyncDontSyncLocalUsers -array bob joe sally.

assigned to @Demon1337 and unassigned @Mactroll

I'll assign this over to @Demon1337 and let him close.

closed