• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3906
  • Last Modified:

Mac will not authenticate to active directory

I have a MAC OSX version 10.5.8. It was binded to a Windows 2003 AD and worked fine. I unbinded it from the Windows 2003 AD and binded it to a new (different domain name) Windows 2008 domain. But when I attempt to login to with a domain account the login box just shakes like the password is incorrect. The strange thing is i performed the exact same steps on another MAC (earlier version) and I can log in fine. This tells me that it is not an AD problem, but a MAC machine problem. The only weird thing on the MAC is in the Directory Utility it says "This server is responding normally. This server is not in your authentication search policy". But the domain is in fact listed in the Search Policy for Authentication and Contacts. I can also search the directory for users successfully.

The domain has a .local name and I read that may be a problem but could not find a fix. But again I did successfully login in to the new .local domain with another MAC.

Could there be an issue with version 10.5.8 and binding to a second domain?
0
cto2008
Asked:
cto2008
  • 4
  • 3
  • 3
1 Solution
 
jhyieslaCommented:
Have you looked in Network System Preferences under the Advanced section for your Ethernet or wireless connection on the DNS tab to see if the new domain name is in the domain search box?
0
 
jklinger1975Commented:
Unbind the Mac.

Delete this folder /Library/Preferences/DirectoryService

Restart

Rebind

Try again
0
 
cto2008Author Commented:
The domain search box does have the correct domain name in the advanced DNS properties.
Jklinger - I tried your suggestion and it still does not allow me to login. It did however get rid of the message that reads "This server is responding normally. This server is not in your authentication search policy".  Now it just reads "This server is responding normally."

Any other suggestions?
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
jklinger1975Commented:
Could possibly be your AD settings. Perhaps no home folder is created.

In Directory Util, click the pencil to edit the AD settings. Click the arrow for Advanced Options and make sure "Force local home.." and "Create mobile account..." are checked.
0
 
cto2008Author Commented:
Both of those options have been checked.

I used the exact same options that I used on a MacBook that will authenticate. Only difference is that the MacBook is running an earlier version of OSX - 10.4 I believe.
0
 
jklinger1975Commented:
Was the 10.5.8 Mac upgraded from a 10.4 previous install? Or did the system come with 10.5 pre-installed?

I have seen the 10.4 to 10.5 upgrade have lots of odd issues. I usually install 10.5 from scratch.

Also check the console app for specific errors. Utilities/Console (Show log list)

The system.log file may help shed some light on the situation.
0
 
jhyieslaCommented:
Is the user you are logging in with also a local user on that Mac?  OS X defers to local user signons before AD ones. Try logging in with a different AD user.
0
 
cto2008Author Commented:
I will check the system logs.

The user is not a local user on the Mac.
0
 
jhyieslaCommented:
Can you ping the DC by name?  by IP?

If you can't ping by name, you might have a look at this:

http://www.experts-exchange.com/Apple/Networking/Q_24426155.html
0
 
cto2008Author Commented:
I resolved the issue. Very simple fix but since I am new to MAC's I did not know about this setting. In System Preferences > Accounts > Options there is a setting "Allow Network Users to login to this computer". It was checked but when I clicked on the "Options" button next to it there was a restriction in place to only allow the old domain account access. So I gave all accounts access and all is well. Only problem now is for some reason it will not let me create a mobile account but I have not had a chance to look in to that.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

  • 4
  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now