?
Solved

Mac will not authenticate to active directory

Posted on 2009-12-30
10
Medium Priority
?
3,708 Views
Last Modified: 2013-11-12
I have a MAC OSX version 10.5.8. It was binded to a Windows 2003 AD and worked fine. I unbinded it from the Windows 2003 AD and binded it to a new (different domain name) Windows 2008 domain. But when I attempt to login to with a domain account the login box just shakes like the password is incorrect. The strange thing is i performed the exact same steps on another MAC (earlier version) and I can log in fine. This tells me that it is not an AD problem, but a MAC machine problem. The only weird thing on the MAC is in the Directory Utility it says "This server is responding normally. This server is not in your authentication search policy". But the domain is in fact listed in the Search Policy for Authentication and Contacts. I can also search the directory for users successfully.

The domain has a .local name and I read that may be a problem but could not find a fix. But again I did successfully login in to the new .local domain with another MAC.

Could there be an issue with version 10.5.8 and binding to a second domain?
0
Comment
Question by:cto2008
  • 4
  • 3
  • 3
10 Comments
 
LVL 28

Expert Comment

by:jhyiesla
ID: 26150908
Have you looked in Network System Preferences under the Advanced section for your Ethernet or wireless connection on the DNS tab to see if the new domain name is in the domain search box?
0
 
LVL 1

Expert Comment

by:jklinger1975
ID: 26152475
Unbind the Mac.

Delete this folder /Library/Preferences/DirectoryService

Restart

Rebind

Try again
0
 

Author Comment

by:cto2008
ID: 26159794
The domain search box does have the correct domain name in the advanced DNS properties.
Jklinger - I tried your suggestion and it still does not allow me to login. It did however get rid of the message that reads "This server is responding normally. This server is not in your authentication search policy".  Now it just reads "This server is responding normally."

Any other suggestions?
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 1

Expert Comment

by:jklinger1975
ID: 26161487
Could possibly be your AD settings. Perhaps no home folder is created.

In Directory Util, click the pencil to edit the AD settings. Click the arrow for Advanced Options and make sure "Force local home.." and "Create mobile account..." are checked.
0
 

Author Comment

by:cto2008
ID: 26161501
Both of those options have been checked.

I used the exact same options that I used on a MacBook that will authenticate. Only difference is that the MacBook is running an earlier version of OSX - 10.4 I believe.
0
 
LVL 1

Expert Comment

by:jklinger1975
ID: 26161574
Was the 10.5.8 Mac upgraded from a 10.4 previous install? Or did the system come with 10.5 pre-installed?

I have seen the 10.4 to 10.5 upgrade have lots of odd issues. I usually install 10.5 from scratch.

Also check the console app for specific errors. Utilities/Console (Show log list)

The system.log file may help shed some light on the situation.
0
 
LVL 28

Expert Comment

by:jhyiesla
ID: 26161980
Is the user you are logging in with also a local user on that Mac?  OS X defers to local user signons before AD ones. Try logging in with a different AD user.
0
 

Author Comment

by:cto2008
ID: 26162011
I will check the system logs.

The user is not a local user on the Mac.
0
 
LVL 28

Expert Comment

by:jhyiesla
ID: 26162063
Can you ping the DC by name?  by IP?

If you can't ping by name, you might have a look at this:

http://www.experts-exchange.com/Apple/Networking/Q_24426155.html
0
 

Accepted Solution

by:
cto2008 earned 0 total points
ID: 26180985
I resolved the issue. Very simple fix but since I am new to MAC's I did not know about this setting. In System Preferences > Accounts > Options there is a setting "Allow Network Users to login to this computer". It was checked but when I clicked on the "Options" button next to it there was a restriction in place to only allow the old domain account access. So I gave all accounts access and all is well. Only problem now is for some reason it will not let me create a mobile account but I have not had a chance to look in to that.
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
Wouldn't it be nice if objects in Active Directory automatically moved into the correct Organizational Units? This is what AutoAD aims to do and as a plus, it automatically creates Sites, Subnets, and Organizational Units.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

862 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question