Safeguard Authentication Services 5.1.2 - macOS Administration Guide

To grant Safeguard Authentication Services accounts administrator rights

1. Modify the /etc/opt/quest/vas/vas.conf file and add the following section to the Safeguard Authentication Services configuration using a text editor:

   [vas_macos]
   admin-users = pats@example.com

   For example, with the pico text editor, enter:

   $ sudo pico /etc/opt/quest/vas/vas.conf

   Note: If there is already a [vas_macos] section in the vas.conf file, just add or modify the admin-users key following the existing section. You can also manage this option through Group Policy.

   For the value of the admin-users key, use a comma-separated list of Active Directory User Principal Names (UPN) for Safeguard Authentication Services users with administrator rights. The Domain Users option also supports groups of users.

2. Specify the group in the Domain\groupname format.

   Either step ensures that Safeguard Authentication Services processes the new configuration.

3. Verify that the configured users have administrator rights by checking their group memberships using the following command line (the example is for a user called pspencer):

   $ groups pspencer

   If pspencer was correctly configured to have local administrator rights, you see the local admin, appserveradm, and appserverusr groups listed in the output. The pspencer user is then able to use his user credentials for authorizing administrative tasks started from the System Preferences application.