Cannot Join Kerberos Realm Active Directory
Dear afp548 community
apologies in advance if i am missng something simple.
I have been trying to get our new Intel xserve(10.4.8) to talk to our existing win 2k native AD domain built on a single domain controller using the AD/OD integration white paper from this site, but i am faling over at the point where i have to join kerberos.
The network conistsof
Win 2k server runnking as Domain controler running AD, DNS, DHCP, Some file serverices
Intel Xserve running Tiger server 10.4.8 conected to an Xserve Raid.This machine is acting as a DNS secorndary for the AD domain, runs web server, ichat server and AFP and windows file services
20+ Mac clients (10.4 and 10.3)
20+ Windows clients 2k and xp
all servers and clinets are set to use AD domain controller as primary DNS source
I am trying to acheive single sign on from the mac and windows clients and windows, i dont need really need mapped home directories, i just need all machines to be able to login to the fileshares on the XRAID using AD credentials
I am able to bind the xserve to the domain without problems and can verify its machine account exists in Active directory users and computers.
When i press the 'Join Kerberos button, i am prestented with the Join kerberos relam window which only has a pull down list with "REALM: (null)(default)" as the only available option as well as boxes for usersname and password. when i enter my username and password (which is an AD domain admin)I receive this error
Computer Record Not Available
The Open Directory Administrator has not used this computers primary ethernet address when adding this computer to a computer list
my slapconfig.log looks like this
2007-01-05 06:51:03 +0000 - slapconfig -sso_util
2007-01-05 06:51:03 +0000 - command: /usr/sbin/sso_util useconfig -u -f . -a adadminuser -p **** -v 1
2007-01-05 06:51:03 +0000 - sso_util command output:
Contacting the directory server
Obtaining the Computer record
Unable to find the Computer record error = 2
2007-01-05 06:51:03 +0000 - sso_util command failed with status 2
2007-01-05 06:51:03 +0000 -
errorValue
2
this would indicate that sso_util can acces the directory server but cannot find the machine account in AD (even though its definitely there) so i am a bit stumped
i have setup home directories for all users (pointing to a share on the domain controller for now)
I have checked forward and reverse DNS and this seems to be fine to and from all servers on the network
my AD domain name does NOT end in .local
any ideas or further troubleshoting steps would be greatly appreciated
thanks in advance
Alasdair