dsconfigad
Directory Services configuration

help:

Usage: dsconfigad -help
Usage: dsconfigad -add domain -username value [-computer value] [-force]
                  [-password value] [-ou dn] [-preferred server]
                  [-localuser value] [-localpassword value]
Usage: dsconfigad -leave [-localuser value] [-localpassword value]
Usage: dsconfigad -remove -username value [-force] [-password value]
                  [-localuser value] [-localpassword value]
Usage: dsconfigad -show [-xml]
Usage: dsconfigad [advoptions] [-localuser value] [-localpassword value]

  -add value            add computer to the domain
  -leave                leave the domain (preserving the computer account)
  -remove               remove computer from domain
  -computer value       name of computer to add to domain
  -force                force the process (i.e., join the existing account)
  -localuser value      username of a privileged local user
  -localpassword value  password of a privileged local user
  -username value       username of a privileged network user
  -password value       password of a privileged network user
  -ou dn                fully qualified LDAP DN of container for the computer
                            (defaults to CN=Computers)
  -show                 show current configuration for Active Directory
  -xml                  output configuration in plist format

Advanced Options - User Experience:
  -mobile flag          'enable' or 'disable' mobile user accounts for offline use
  -mobileconfirm flag   'enable' or 'disable' warning for mobile account creation
  -localhome flag       'enable' or 'disable' force home directory to local drive
  -useuncpath flag      'enable' or 'disable' use Windows UNC for network home
  -protocol type        'afp' or 'smb' change protocol used when mounting home
  -sharepoint           'enable' or 'disable' mount network home as a sharepoint.
  -shell value          'none' for no shell or specify a default shell '/bin/bash'

Advanced Options - Mappings:
  -uid attribute        name of attribute to be used for UNIX uid field
  -nouid                generate the UID from the Active Directory GUID
  -gid attribute        name of attribute to be used for UNIX gid field
  -nogid                generate the GID from the Active Directory information
  -ggid attribute       name of attribute to be used for UNIX group gid field
  -noggid               generate the group GID from the Active Directory GUID
  -authority value      enable or disable generation of Kerberos authority

Advanced Options - Administrative:
  -preferred server     fully-qualified domain name of preferred server to query
  -nopreferred          do not use a preferred server for queries
  -groups "1,2,..."     list of groups that are granted Admin privileges on local
                        workstation
  -nogroups             disable the use of groups for granting Admin privileges
  -alldomains flag      'enable' or 'disable' allow authentication from any domain
  -packetsign flag      'disable', 'allow', or 'require' packet signing
  -packetencrypt flag   'disable', 'allow', 'require' or 'ssl' packet encryption
  -namespace flag       'forest' or 'domain', where forest qualifies all usernames
  -passinterval days    how often to change computer trust account password in days
  -restrictDDNS list    list of interfaces to restrict DDNS to (en0, en1, etc.)

see dseditgroup

sudo dseditgroup -o edit -n /Local/Default -a everyone -t group lpadmin