- This topic is empty.
-
Posts
-
Hello all, we recently performed a domain rename procedure of one of our active directory domains. As we feared, all of the mac clients that were bound to the renamed domain are no longer authenticating. We thought it would simply be a matter of unbinding them and rebinding them to the new name. However, when we tried to bind them to the new domain name, we get an error “This computer was unable to contact the domain controller for an unknown reason.” When we looked in the system log we found the error “Could not determine site for closest dc!”
We have checked DNS to make sure that the forward and reverse lookups for the domain controllers are correct. I have connectivity to the domain controllers from the OS X machines because I can ping them by hostname. I can successfully bind to another domain in our AD forest, however, I cannot authenticate as a user in the renamed domain even with the “allow logons in multiple domains” option checked. Authentication in all other domains works. We have tried setting the “use this preferred domain controller” setting and have set it to the fqdn of both of our domain controllers in the renamed domain.
We tried to bind a 10.4 machine and it bound successfully to the renamed domain. Is this a 10.3.9 limitation?
Is there something that could have changed in DNS that is preventing the 10.3.9 machines from being able to talk to the domain controllers? What causes the error message “cannot determine site for closest DC”? (We have only one site) I have not been able to find ANY documentation on how OS X computers react to a windows domain rename so any help or input would be much appreciated. Thank you in advance!
Okay we put one of the macs into debug mode and these are the errors in the log file:
No connection in connection mgr for user@MY.DOMAIN.COM@my.domain.com:389
GSSAPI FAILED doing gss_init_sec_context: Server not found in Kerberos database
Unable to read the schema, something wrong, using existing info…
Plug-in call “dsDoPlugInCustomCall()” failed with error = -14006
So the user@MY.DOMAIN.COM@my.domain.com:389 seems strange, why is it appending the domain name twice? It also lists a successful verification of the user account I am using (a domain admin) so I know on some level it is able to authenticate the user I am trying to bind with.
I’m not sure why it’s saying the “server cannot be found in the Kerberos database” because I checked the edu.mit.Kerberos file and it had the correct domain controllers listed for the domain to which I am trying to bind.
Any ideas?
We have figured out the problem!
When a domain rename is performed, there are a couple of final steps that are required, but you must wait for all member computers of the domain to be rebooted twice before you execute them. We expidited this process and made sure our windows computers were rebooted twice and correctly bound to the new domain name. We then executed the rendom /clean command. After this was complete, we had to use the “netdom computername” command to rename our domain controllers to the new DNS suffix. Once the domain controllers had been renamed the 10.3.9 macs bound with no problem.
Apparently OS X 10.3.9 cannot bind to a domain where the domain controllers have different DNS suffixes than the domain they are controlling.
Hope this helps anyone in a similar situation!
- You must be logged in to reply to this topic.