Welcome to the MacNN Forums.

Tuoder · Jan 16, 2009, 02:10 PM

I help run a lab of 20 iMacs (C2D) at a university. I'm having an issue with active directory failing to allow users to log in using their Active Directory accounts. It worked the first few times in December, but now it has just stopped working for no apparent reason. We're running 10.5.6. Any ideas?

King Bob On The Cob · Jan 16, 2009, 06:15 PM

Is it the computer accounts are getting unbound, or is it just certain user accounts are losing the ability to log in?

There's a long standing bug in Apple's Directory Service implementation that causes the DS node to become populated with duplicate information. A disabled account (which appears first) and a working account. It will act as though the account was disabled, when, in actuality, it has not. Use dscl to check that out on a machine that won't let you log in. OS X also has some issues with password propagation (It will cache the old keys and use them), so if they changed passwords lately, it could be the issue as well.

OS X still doesn't play nice with Active Directory, which is, IMHO, the reason Apple still hasn't made significant headway in the enterprise markets.

King Bob On The Cob · Jan 16, 2009, 06:17 PM

You may also want to get in touch with one of the system engineers from Apple. We've had Mike Bombich come out and help us at University of Illinois. He is quite helpful.

Tuoder · Jan 21, 2009, 03:28 PM

The computers are unable to log in. The individual accounts continue to work elsewhere. What happens is that we put them on the domain, they work for a day, then they don't work the next day, while Directory Utility shows no change in status. We put 20 on yesterday, and tested them all. Only 5 still work today. We have a local backup account, so it's not as though the machines are down, but I'm not quite sure what is wrong, as I don't know much about Active Directory.

Cold Warrior · Jan 21, 2009, 09:01 PM

Will they let you login using an SA account? Not a local sysad account but an AD/Domain Controller SA account?

Tuoder · Jan 22, 2009, 12:55 PM

Originally Posted by Cold Warrior

Will they let you login using an SA account? Not a local sysad account but an AD/Domain Controller SA account?

Initially, yes. They will log on with anything. Then, after a day or two, they don't.

larkost · Jan 22, 2009, 02:36 PM

Can you go in and list anything through dscl? Are the computers keeping correct time with your AD server (they must be within 5 minutes... and booting into windows can play havoc with that). Have you made sure that all of your domain controllers have correct DNS information, both forward and reverse? If you log in with a local user, can you get a kerberos ticket from the AD KDC?