Understanding Account Creation Tools

When creating accounts, the logical choice for Mac OS X Server is Workgroup Manager. However, you can also use the Accounts pane of System Preferences and NetInfo Manager to create accounts.

Using the Accounts Preference Pane

The Accounts preference pane can be used on both Mac OS X and Mac OS X Server to create accounts in the local NetInfo database. When accounts are created, you have your choice of the following:

• Long Name

• Short Name

• Password

• Password Hint

• User Picture

• Limited Parental Controls (discussed in Lesson 9, "Defining the User Experience")

  Creating a new account with the Accounts preference pane.

  

Note

Creating accounts information is also discussed in Apple Training Series: Mac OS X Server Essentials and Apple Training Series: Mac OS X System Administration Reference, Volume 1 (both from Peachpit Press, 2006).

What you can't choose are the user ID, primary group ID, and several other attributes. User IDs start at ID 501, which is the first account created when a user first installs Mac OS X. Each subsequent account has an incremental user ID of 502, 503, and so on. The group ID for each user is the same as his user ID. So a user with a user ID of 502 would have a group ID of 502. This is how the Accounts preference pane handles new accounts.

Creating Accounts with NetInfo Manager

Administrators can also create accounts with NetInfo Manager (or its command-line equivalent, nicl). When creating an account using NetInfo Manager, you must ensure that all necessary attributes have the proper values. Normally, the Accounts preference pane does this for you; however, accounts can be created with NetInfo Manager as shown below.

Although you can create users with NetInfo Manager, you should focus your user-creation efforts on another tool, Workgroup Manager. Whereas NetInfo Manager does not create everything a user requires, Workgroup Manager does.

Using Workgroup Manager

Workgroup Manager is preinstalled in Mac OS X Server and can be installed on any Mac OS X computer as part of the Server Admin Tools package available for download in the Support section of Apple's Web site.

Workgroup Manager is the main tool for creating accounts on Mac OS X Server but can be used to create accounts on Mac OS X as well. When you first launch WGM, you are shown a dialog asking you to connect to a server.

If you are not connecting to a Mac OS X Server, you can ignore this dialog and proceed to the Server menu and choose View Directories. This directs Workgroup Manager to open the NetInfo database. A warning will appear, telling you that this is not a directory server node so some features may not work. Click OK. You are now viewing your local NetInfo database.

In order to manage these accounts, you must click the lock in the top right corner of the window and enter your administrator's user name and password.

You use Workgroup Manager just like you would use NetInfo Manager, except that Workgroup Manager has a more robust interface and allows a more granular level of management.

One main difference between the Accounts preference pane and Workgroup Manager is that accounts created with the Accounts preference pane identically number user IDs and group IDs starting with 501, whereas Workgroup Manager starts at 1025 for the user ID and the group ID is 20 for every single user created with Workgroup Manager. (The group with an ID of 20 is the "staff" group.)

Note the user ID (1025) and the group ID (20) for user Mark Henderson.

Workgroup Manager is also used to create accounts in an LDAP database. These user accounts have the same initial user ID and group ID values as users created in the local NetInfo database. To change to an existing LDAP database, you click the small globe at the left side of the Workgroup Manager window and choose LDAPv3/127.0.0.1 prior to adding any users.