If the user is a local admin the always settings can be changed.
1. Modify the /Library/Preferences/Quest/VAS/vas.conf file and add the following section to the
QAS configuration using a text editor:
admin-users = firstname.lastname@example.org
For example, with the pico text editor, enter:
$ sudo pico /Library/Preferences/Quest/VAS/vas.conf
Note: If there is already a [vas_macos] section in the vas.conf file, just add or modify the
admin-users key following the existing section. You can also manage this option through Group
For the value of the admin-users key, use a comma-separated list of Active Directory User Principal Names (UPN)
for QAS users with administrator rights. The Domain Users option also supports groups of users.
2. Specify the group in the form, Domain\groupname.
Note: You must specify the domain name as a DNS domain name NOT as a netbios domain. For
example, specify the group name as "EXAMPLE.COM\Administrators" NOT "EXAMPLE\Administrators".
Either step ensures that QAS processes the new configuration.
3. Verify that the configured users have administrator rights by checking their group memberships using the
following command line (the example is for a user called jdoe):
$ groups jdoe
If jdoe was correctly configured to have local administrator rights, you see the local admin, appserveradm, and
appserverusr groups listed in the output. The jdoe user is then able to use his user credentials for authorizing
administrative tasks started from the System Preferences application.
Our product acts similarly to how an OSX Server would work in terms of configuring the machines. QAS applying the settings works exactly the same as OSX Server applying the settings. Therefore the settings should work the same as they do with local account on the system.