Kerberos /SSO /Network polling latency

I have about 20 Macs bound to an Active Directory domain. For a year now, Single Sign On has worked flawlessly. Last month some of the users started having problems. After they logged in, AD then Exchange was asking some users to re-authenticate. I deleted their Directory access preferences, rebooted and rebound the Mac to the domain. In a few circumstances this temporarily solved the problem. This however, did not work every time and was not a permanent solution.

The SSO problem was happening to Intel iMacs with 10.5.5, G5 PowerPCs, G4 Powerbooks on 10.4.11. The problem is that they are logging on but not getting a Kerberos ticket. I have Directory access configured to create a mobile account, so when they log on, they authenticate against the local domain but don’t get the credentials to access the network. I talked to the network engineers and it seems that the PC were also having issues with Kerberos and they presumed, that when they solved their problem, the Macs would also be fixed.

In the mean time, I had a user leave the department. I unbound that Mac from the domain, deleted Directory access preference files and the local account. I set up the Mac to automatically log into a generic local account without password protected. I tried to add a file share to the login items, but that Mac couldn’t locate the server on the network. It didn’t have an IP address. It was taking up to 2 minutes before DHCP returned an IP address. Could this be the cause of the SSO issue?

I went back to the network engineers. They gave me a static IP for that workstation but it didn’t help. Was there a problem on our subnet? I took a completely different Mac to a part of the building that was on a different subnet. They pre-created a new computer object and I bound the Mac to the domain. Again, it took 2 minutes for it to receive an IP address. We gave it a static IP and still, it was not getting a Kerberos ticket and could not access the network for 2 minutes after log in. I rebooted the Mac and let it sit at the login window while they pinged it. We waited 2 minutes, the Mac started to receive the pings, I logged in and got a Kerberos ticket.

The conclusion was that the problem is with the workstations not the network. What’s happening in the 2 minutes it takes for the Macs to connect to the network? Doesn’t the network card initialize and connect to the network before the log in screen appears?

I’m not sure if I’m fighting one problem, two or more. My next step is to reinstall the OS to an older version and see if I can determine if a specific upgrade is causing the problem. Even I pin the problem to an upgrade, back revving all the user’s workstations is not an appealing option. I’m hoping someone can point me in the right direction.