Home › Forums › OS X Server and Client Discussion › Active Directory › Mac clients "unbinding" from domain??

Viewing 7 posts - 1 through 7 (of 7 total)
  • Author
    Posts
  • August 7, 2005 at 9:57 pm #362705
    fherbert
    Participant

    We have a 10.3.9 server and windows 2003 AD server. The mac clients are running 10.3.7 and 10.3.9. The machines are imaged, then joined to the AD, and also use the osx server for management. They work fine for about 1 or 2 days, then refuse to login any AD users…
    The only way around this is to delete the following files:
    [Quote]
    /Library/Preferences/DirectoryServices/ActiveDirectory.plist
    /Library/Preferences/DirectoryServices/SearchNodeConfig.plist
    /Library/Preferences/DirectoryServices/ContactsNodeConfig.plist
    [/Quote]

    Then I have to run dsconfigad and redirect the home folder to a network drive and also change the mountstyle to afp.

    Then I can rejoin the domain and login again for a while. If I do not delete these files, directory access indicates the machines are bound to the domain, but are unable to unbind due to the username and password supplied being incorrect.

    The following is content of the system log when this login issue occurs:
    [Quote]
    Aug 8 09:42:59 localhost /System/Library/CoreServices/SecurityAgent.app/Contents/MacOS/SecurityAgent: DSOpenNode(): dsOpenDirNode(“/Active Directory/our.domain.name”) == -14002
    Aug 8 09:42:46 localhost DirectoryService[200]: Active Directory DS Plugin: Could not determine site for closest DC!
    [/Quote]

    I have checked the dns and the clients are able to ping the DC by name and number and also perform full reverse DNS lookup on the domain controller. So it does not seem to be a dns issue.

    I have deleted the machine accounts of the AD server and rejoined the machines to the domain – but the issue still occurs.

    I have run the following command to see if it may be a cache issue. “lookupd -flushcache” but still no change.

    Apart from the workaround of deleting the preference files and rejoining the machines to the domain, does anyone have any ideas??

    Thanks
    Francois

    August 7, 2005 at 11:24 pm #362708
    fherbert
    Participant

    I checked that file after I posted this topic, and sure enought it looks like the system is overwriting the config.
    The working file is autogenerated by /Active Directory/my.domain.name, /LDAPv3/osxserver.my.domain.name and has info regarding ad domain controller
    The non-working file is autogenerated by /LDAPv3/osxserver.my.domain.name and does not have any ad info in it!!

    So i have corrected the file and removed the two lines which (hopefully) will stop the system from overwriting this file.

    Any ideas on why the system would be overwriting this file in the first place??

    Cheers
    Francois.

    August 8, 2005 at 8:52 pm #362724
    fherbert
    Participant

    KDC is not running on the OSX server so I’m not sure why this would be changing the client info??

    September 1, 2005 at 10:51 am #363052
    fherbert
    Participant

    I will have some time tomorrow to visit the site and check it out..

    Thanks.

    September 1, 2005 at 8:43 pm #363068
    fherbert
    Participant

    OK, so all my Kerberos clinet record file info is pointing to my OD server instead of my AD server.. is this safe just to manually type in the AD server details in place of the OD server??

    September 7, 2005 at 6:21 am #363140
    AMSR
    Participant

    Follow this article:

    http://docs.info.apple.com/article.html?artnum=300765

    Basically, both AD and OD push a kerberos config file to the clients. If you are bound to one or the other individually, this is what you want. If you are bound to both, you only want one. The client tries to be smart and merge the two, but sometimes the AD doesn’t respond fast enough and you only get the OD info. Then, when you try to go log in with an AD user it doesn’t work. This goes for both 10.3 and 10.4 OD masters in the “magic triangle” setup. Once you follow that article and change the KerberosClient record on your OD, you should reboot your clients so they re-generate their info. You may also want to re-establish any replicas you had made.

    September 8, 2005 at 12:37 am #363170
    fherbert
    Participant

    Excellent, that article explains all my questions.

    Thanks.

  • Author
    Posts
Viewing 7 posts - 1 through 7 (of 7 total)
  • You must be logged in to reply to this topic.

Comments are closed

Copyright © 2025 AFP548. All Rights Reserved.