#!/bin/sh
 
<pre lang="bash"># Random number of seconds to wait
# The more machines you use this with, the higher the number should be
sleep `expr $RANDOM % 120`

#!/bin/sh
# enable_firewall.sh
#
# Patrick Gallagher
# http://macadmincorner.com
 
# Stealth Mode - Set to 0 to disable
# Stealth mode prevents machine from responding to ping requestst
# Be aware that this would prevent tools such as ARD from discovering
# the machine, though bonjour on the same subnet will still work
 
osversionlong=`sw_vers -productVersion`
osvers=${osversionlong:3:1}
 
# Check if this is being run by root
if [ "$(whoami)" != "root" ] ; then
  echo "Must be root to run this command." >&2
  exit 1
fi
 
# Enable firewall for Tiger
if [ $osvers -eq 4 ]; then
	echo "Setting firewall on a ${osversionlong} machine"
	/usr/bin/defaults write /Library/Preferences/com.apple.sharing.firewall state -bool YES
	# UDP, change to 0 to disable
	/usr/bin/defaults write /Library/Preferences/com.apple.sharing.firewall udpenabled  -int 1
	# Stealth, change to 0 to disable
	/usr/bin/defaults write /Library/Preferences/com.apple.sharing.firewall stealthenabled -int 1
	/usr/libexec/FirewallTool
fi
 
# Enable firewall for Leopard or Snow Leopard
if [ $osvers -ge 5 ]; then
	echo "Setting firewall on a ${osversionlong} machine"
	# Globalstate - Set to 0 for off, 1 for on, 2 for "Block all incoming access"
	/usr/bin/defaults write /Library/Preferences/com.apple.alf globalstate -int 1
	/usr/bin/defaults write /Library/Preferences/com.apple.alf stealthenabled -int 1
fi

#!/bin/sh
 
# Patrick Gallagher
# http://www.macadmincorner.com
# Updated 12/11/2009
 
# These variables need to be configured for your env
odAdmin="" #enter your OD admin name between the quotes
odPassword=""  # Enter your OD admin password between the quotes
domain="od.school.edu" # FQDN of your OD domain
oldDomain="oldod.school.edu" # If moving from another OD, enter that FQDN here
oldODip="111.222.333.444" # Enter the IP of your old OD
ADdomain="ad.school.edu" # Enter your AD domain here
computerGroup=computers  # Add appropriate computer group you want machines to be added to, case sensitive 
 
# These variables probably don't need to be changed
computerName=`/usr/sbin/scutil --get LocalHostName`
nicAddress=`ifconfig en0 | grep ether | awk '{print $2}'`
check4OD=`dscl localhost -list /LDAPv3`
check4ODacct=`dscl /LDAPv3/${domain} -read Computers/${computerName} RealName | cut -c 11-`
check4AD=`dscl localhost -list /Active\ Directory`
osversionlong=`sw_vers -productVersion`
osvers=${osversionlong:3:1}
 
# Check if on OD already
if [ "${check4OD}" == "${domain}" ]; then
	echo "This machine is joined to ${domain} already."
	odSearchPath=`defaults read /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" | grep $domain`
	if [ "${odSearchPath}" = "" ]; then
		echo "$domain not found in search path. Adding..."
		dscl /Search -append / CSPSearchPath /LDAPv3/$domain
		sleep 10
	fi
else if [ "${check4OD}" == "${oldDomain}" ]; then
	echo "Removing from ${oldDomain}"
	dsconfigldap -r "${oldDomain}"
	dscl /Search -delete / CSPSearchPath /LDAPv3/"${oldDomain}"
	dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"${oldDomain}"
	echo "Binding to $domain"
	dsconfigldap -v -a $domain -n $domain
	dscl /Search -create / SearchPolicy CSPSearchPath
	killall DirectoryService
else if [ "${check4OD}" == "${oldODip}" ]; then
	echo "Removing from ${oldODip}"
		dsconfigldap -r "${oldODip}"
		dscl /Search -delete / CSPSearchPath /LDAPv3/"${oldODip}"
		dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"${oldODip}"
		echo "Binding to $domain"
		dsconfigldap -v -a $domain -n $domain
		dscl /Search -create / SearchPolicy CSPSearchPath
		killall DirectoryService
else
	echo "No previous OD servers found, binding to $domain"
	dsconfigldap -v -a $domain -n $domain
	dscl /Search -create / SearchPolicy CSPSearchPath
	sleep 10
	dscl /Search -append / CSPSearchPath /LDAPV3/$domain
	echo "Killing DirectoryService"
	killall DirectoryService
	fi
fi
fi
 
if [ "${check4ODacct}" == "${computerName}" ]; then
	echo "This machine has a computer account on ${domain} already."
else
	echo "Adding computer account to ${domain}"
	dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/${domain} -create /Computers/${computerName} ENetAddress "$nicAddress"
	dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/${domain} -merge /Computers/${computerName} RealName ${computerName}
	# Add computer to ComputerList
	dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/${domain} -merge /ComputerLists/${computerGroup} apple-computers ${computerName}		
 
	# Set the GUID
	GUID="$(dscl /LDAPv3/${domain} -read /Computers/${computerName} GeneratedUID | awk '{ print $2 }')"
	# Add to computergroup
	dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/${domain} -merge /ComputerGroups/${computerGroup} apple-group-memberguid "${GUID}"
	dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/${domain} -merge /ComputerGroups/${computerGroup} memberUid ${computerName}
fi
 
sleep 25 # Give DS a chance to catch up
 
# Fix DS search order
echo "Checking DS search order..."
if [ "${check4AD}" == "${adDomain}" ]; then
	dsconfigad -alldomains enable
	dscl /Search -delete / CSPSearchPath "/Active Directory/${adDomain}"
	dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/${adDomain}"
	dscl /Search -append / CSPSearchPath "/Active Directory/All Domains"
	if [ $osvers -eq 4 ]; then
		echo "OS detected as ${osversionlong}"
		echo "Setting AD, then OD to search order..."
		dscl localhost changei /Search CSPSearchPath 2 "/Active Directory/All Domains"
		dscl localhost changei /Search CSPSearchPath 3 /LDAPv3/$domain
		dscl /Search/Contacts -append / CSPSearchPath "/Active Directory/All Domains"
	else if [[ ${osvers} -eq 5 || 6 ]]; then
		echo "OS detected as ${osversionlong}"
		echo "Setting OD, then AD to search order..."
		dscl localhost changei /Search CSPSearchPath 3 "/Active Directory/All Domains"
		dscl localhost changei /Search CSPSearchPath 2 /LDAPv3/$domain
		dscl /Search/Contacts -append / CSPSearchPath "/Active Directory/All Domains"
	fi
fi
	else if [ "${check4AD}" == "All Domains" ]; then
	dscl /Search -append / CSPSearchPath "/Active Directory/All Domains"
	sleep 15
		if [ $osvers -eq 4 ]; then
			echo "OS detected as ${osversionlong}"
			echo "Setting AD, then OD to search order..."
			dscl localhost changei /Search CSPSearchPath 1 "/Active Directory/All Domains"
			dscl localhost changei /Search CSPSearchPath 2 /LDAPv3/$domain
		else if [[ ${osvers} -eq 5 || 6 ]]; then
			echo "OS detected as ${osversionlong}"
			echo "Setting OD, then AD to search order..."
			dscl localhost changei /Search CSPSearchPath 2 /LDAPv3/$domain
			dscl localhost changei /Search CSPSearchPath 3 "/Active Directory/All Domains"
			dscl /Search/Contacts -append / CSPSearchPath "/Active Directory/All Domains"
		fi
	fi
fi
fi	
 
echo "Finished. Exiting..."
exit 0

#!/bin/sh
Version=1.0
# Modified 1/14/2009
 
# MigrateLocalUserToDomainAcct.command
# Patrick Gallagher
# http://macadmincorner.com
#
 
# This script should not need any modification in most enviornments. 
# If the script does not execute when run, you may need to 'chmod +x /path/to/thisScript' to make it executable
 
clear
 
netIDprompt="Please enter the network ID for this user: "
listUsers="$(/usr/bin/dscl . list /Users | grep -v eccsadmin | grep -v _ | grep -v root | grep -v uucp | grep -v amavisd | grep -v nobody | grep -v messagebus | grep -v daemon | grep -v www | grep -v Guest | grep -v xgrid | grep -v windowserver | grep -v unknown | grep -v unknown | grep -v tokend | grep -v sshd | grep -v securityagent | grep -v mailman | grep -v mysql | grep -v postfix | grep -v qtss | grep -v jabber | grep -v cyrusimap | grep -v clamav | grep -v appserver | grep -v appowner) FINISHED"
FullScriptName=`basename "$0"`
ShowVersion="$FullScriptName $Version"
check4AD=`/usr/bin/dscl localhost -list . | grep "Active Directory"`
osversionlong=`sw_vers -productVersion`
osvers=${osversionlong:3:1}
 
echo "********* Running $FullScriptName Version $Version *********"
 
# If the machine is not bound to AD, then there's no purpose going any further. 
if [ "${check4AD}" != "Active Directory" ]; then
	echo "This machine is not bound to Active Directory.\nPlease bind to AD first. "; exit 1
fi
 
RunAsRoot()
{
        ##  Pass in the full path to the executable as $1
        if [[ "${USER}" != "root" ]] ; then
                echo
                echo "***  This application must be run as root.  Please authenticate below.  ***"
                echo
                sudo "${1}" && exit 0
        fi
}
 
RunAsRoot "${0}"
 
until [ "$user" == "FINISHED" ]; do
 
	printf "%b" "\a\n\nSelect a user to convert or select FINISHED:\n" >&2
	select user in $listUsers; do
 
		if [ "$user" = "FINISHED" ]; then
			echo "Finshied converting users to AD"
			break
		elif [ -n "$user" ]; then
			if [ `who | grep console | awk '{print $1}'` == "$user" ]; then
				echo "This user is logged in.\nPlease log this user out and log in as another admin"
				exit 1
			fi
 
			# Determine location of the users home folder
			userHome=`/usr/bin/dscl . read /Users/$user NFSHomeDirectory | cut -c 19-`
 
			# Get list of groups
			echo "Checking group memberships for local user $user"
			lgroups="$(/usr/bin/id -Gn $user)"
 
 
			if [[ $? -eq 0 ]] && [[ -n "$(/usr/bin/dscl . -search /Groups GroupMembership "$user")" ]]; then 
			# Delete user from each group it is a member of
				for lg in $lgroups; 
					do
						/usr/bin/dscl . -delete /Groups/${lg} GroupMembership $user >&/dev/null
					done
			fi
			# Delete the primary group
			if [[ -n "$(/usr/bin/dscl . -search /Groups name "$user")" ]]; then
  				/usr/sbin/dseditgroup -o delete "$user"
			fi
			# Get the users guid and set it as a var
			guid="$(/usr/bin/dscl . -read "/Users/$user" GeneratedUID | /usr/bin/awk '{print $NF;}')"
			if [[ -f "/private/var/db/shadow/hash/$guid" ]]; then
 				/bin/rm -f /private/var/db/shadow/hash/$guid
			fi
			# Delete the user
			/usr/bin/dscl . -delete "/Users/$user"
 
 
				# Verify NetID
				printf "\e[1m$netIDprompt"
				read netname
				/usr/bin/killall DirectoryService
				sleep 10
				/usr/bin/id $netname
				# Check if there's a home folder there already, if there is, exit before we wipe it
				if [ -f /Users/$netname ]; then
					echo "Oops, theres a home folder there already for $netname.\nIf you don't want that one, delete it in the Finder first,\nthen run this script again."
					exit 1
				else
					/bin/mv $userHome /Users/$netname
					/usr/sbin/chown -R ${netname} /Users/$netname
					echo "Home for $netname now located at /Users/$netname"			
				fi
			break
		else
			echo "Invalid selection!"
		fi
	done
done

(*
Add user to admin group
 
This script should not need any modification, unless you want to "brand" it. 
 
http://macadmincorner.com
*)
 
tell application "System Events"
	set shortName to name of current user
end tell
 
set userName to text returned of (display dialog "Enter the users shortname" default answer shortName)
 
do shell script "dseditgroup -o edit -a " & userName & " -t user admin" with administrator privileges
 
 
display dialog (do shell script "dscl . -read /Groups/admin users") with title "The following users are admins on this machine" buttons "Ok" default button 1