Garrett Stevens sent us a procedure to get around the problem of Macs losing administrator access when reconnecting to a network with access to a domain controller. Previously, a reader sent us an Applescript to get around the problem. Here is Steven's approach:

We have seen this issue in all versions of Leopard and Snow Leopard, I never did test in Tiger. Here are the steps I take to give our users those rights both on our network and off.

If you have not already done so, create a Mac security group in Active Directory for your Mac user(s) depending on who you want to have admin access to the computer(s). Add those users needing admin rights to the group. Add that group to the "Allow Administration by" section and verify the Mobile Login checkbox is checked in Directory Utility.

With the computer connected to the office network, we have the AD user (that is a member of the Mac security group) login. With that user logged in, we open Accounts under System Preferences and verify that the user has Admin, Managed, Mobile listed under their name. Try doing something that requires Administrator access to verify you do indeed have admin rights.

After you have verified the user has admin rights and that their mobile account is cached, disconnect from the office wireless and wired connections. Reboot. With the computer still disconnected from a wireless and physical network connection, login with a local administrator account for the computer and go to Accounts. In accounts you now see the cached user does not have Admin rights anymore. Select the user that used to have admin rights and simply check the box to allow the user to administer the computer.

Still disconnected from the network, reboot the system and log in as the mobile user we just edited. Open Accounts and verify they still have Admin rights, and proceed testing the user account to verify it can install software and unlock System Preferences, etc. Reconnect to the office network and reboot, everything should work as it should both on the office network and off.

If you've tried this approach