Can’t bind Mac’s to a w2k AD

[elvisizer]

hello, everyone. . . . .I did some searches on this in this forum, but didn’t find anything that seemed to relate. if I’ve missed a resource here that would help me, i apologize in advance . . . . . .
Anyway, I’m working on binding some Mac’s into an active directory domain running on windows 2k server.
Here’s the story- when i first started trying to do this, I found that the windows servers did not have reverse DNS entries set up, so I was unable to bind. I had the active directory admin set up the reverse DNS, and I was able to bind 2 macs running 10.3.6. the next day, I tried to bind some more macs, and they would not bind- the Ad plug in in Directory Access gets up to step five, and then tells me i’ve supplied an incorrect username and password. Unfortunately, that’s the correct username and password, and the same account info does successfully bind PC’s to the same AD. I tried un-binding one of the Macs that I had already bound, changed it’s name, and then tried to re-bind it, and got the same incorrect password error.
We are not using.local in the AD set up- it’s a .com domain.
I know the macs are finding the domain controller and are able to read the AD, because if i try to bind one using the same name as the single mac that’s still in there, it tells me that an account with that computer name already exists.
Also, the one mac that is still bound to the domain authenticates just fine and has no problems at all. argh.
i’m totally stumped. Why did it work for a couple of hours, and then NEVER work again?
Anyone have any ideas? i’ve spent over 6 hours on the phone with MS’s corporate support over the last 2 days, and they just gave up and refunded my incident (!) . . . . .
thanks . . . .
elvisizer

[elvisizer]

thanks, mactroll. good idea. i’ll try that tomorrow and post again.
elvisizer

[elvisizer]

ok, when i did the
sudo killall -USR1 DirectoryServices
it responded with ‘no matching processes’.
tried the join, and then looked in the log file.
here’s what it had from that particular login session:

2005-02-04 08:12:23 PST – DirectoryService 1.8.2 (v257.1) starting up…
2005-02-04 08:12:24 PST – Plugin , Version <1.6>, processed successfully.
2005-02-04 08:12:24 PST – Plugin , Version <1.6>, processed successfully.
2005-02-04 08:12:24 PST – Plugin , Version <1.6.5>, processed successfully.
2005-02-04 08:12:24 PST – Plugin

, Version <1.6.1>, processed successfully.
2005-02-04 08:12:24 PST – Plugin “Active Directory”, Version “1.0.5”, is set to load lazily.
2005-02-04 08:12:24 PST – Plugin “AppleTalk”, Version “1.1”, is set to load lazily.
2005-02-04 08:12:24 PST – Plugin “BSD”, Version “1.1”, is set to load lazily.
2005-02-04 08:12:24 PST – Plugin “PasswordServer”, Version “2.0.4”, is set to load lazily.
2005-02-04 08:12:24 PST – Plugin “Rendezvous”, Version “1.1”, loaded successfully.
2005-02-04 08:12:24 PST – Plugin “SLP”, Version “1.1”, is set to load lazily.
2005-02-04 08:12:24 PST – Plugin “SMB”, Version “1.1.3”, is set to load lazily.
2005-02-04 08:12:24 PST – Registered node ~Configure
2005-02-04 08:12:24 PST – Plug-in Configure state is now active.
2005-02-04 08:12:24 PST – Plug-in LDAPv3 state is now active.
2005-02-04 08:12:24 PST – Registered node ~NetInfo~DefaultLocalNode
2005-02-04 08:12:24 PST – Plug-in NetInfo state is now active.
2005-02-04 08:12:24 PST – Plug-in Rendezvous state is now active.
2005-02-04 08:12:24 PST – Registered Locally Hosted Node ~NetInfo~DefaultLocalNode
2005-02-04 08:12:24 PST – Registered node ~Search
2005-02-04 08:12:24 PST – Registered node ~Search~Contacts
2005-02-04 08:12:24 PST – Registered node ~Search~Network
2005-02-04 08:12:24 PST – Plug-in Search state is now active.
2005-02-04 08:12:25 PST – Plug-in SLP state is now active.
2005-02-04 08:12:25 PST – Plugin “SLP”, Version “1.1”, loaded on demand successfully.
2005-02-04 08:12:25 PST – Plug-in SMB state is now active.
2005-02-04 08:12:25 PST – Plugin “SMB”, Version “1.1.3”, loaded on demand successfully.
2005-02-04 08:12:25 PST – Plug-in AppleTalk state is now active.
2005-02-04 08:12:25 PST – Plugin “AppleTalk”, Version “1.1”, loaded on demand successfully.
2005-02-04 08:17:53 PST – Plug-in Active Directory state is now inactive.
2005-02-04 08:17:53 PST – Plugin “Active Directory”, Version “1.0.5”, loaded on demand successfully.

Doesn’t look like there’s anything that helpful in there to me, but that don’t mean much!

elvisizer

[elvisizer]

one other thing I just discovered- the macs WILL bind to the domain if I use the same computer name as the single mac i bound earlier- they only fail if i try to create a new computer account. I’d say it’s a permission problem with my account except that that same account can create new computer accounts when I add PC’s, and that this account has rights to do anything at all in the AD domain.
Anyway, I thought that info might be important!

[elvisizer]

yeah, since using the single existing computer account worked, i figured that could be a work around. haven’t tried it yet, though, and that would only work temporarily. I’m going to be upgrading about 75 macs to X soon, and they all need to be on the AD, so i’d rather not have to do it all manually.
you know, we have a really simple AD set up, too. one domain, 3 physical sites connected on a WAN, one DC @ each site. the other 2 sites don’t have this problem, so it seems like it HAS to be something funky on my DC.

Anyway, did the log file supply anything useful to you mr. mactroll?

[elvisizer]

hey again, guys. Thanks for the further help, macshome. I got more info from the logs this time, and now at least i know where the problem is occurring if not exactly how to fix it (yet!!)
So, after doing the tail command and trying to bind, here’s what I get:
sfmd1cking:~ cking$ tail -f /Library/Logs/DirectoryService/DirectoryService.debug.log | grep ADPlug
2005-02-08 09:47:47 PST – ADPlugin: Calling OpenDirNode
2005-02-08 09:47:47 PST – ADPlugin: Calling CustomCall
2005-02-08 09:47:47 PST – ADPlugin: Doing CheckServerRecords……
2005-02-08 09:47:47 PST – ADPlugin: Found Default Domain media.ziffdavis.com
2005-02-08 09:47:47 PST – ADPlugin: Found Forest Domain GC media.ziffdavis.com
2005-02-08 09:47:47 PST – ADPlugin: Finished CheckServerRecords……
2005-02-08 09:47:47 PST – ADPlugin: Rebuilt Kerberos File
2005-02-08 09:47:47 PST – ADPlugin: Calling CloseDirNode
2005-02-08 09:47:47 PST – ADPlugin: Calling OpenDirNode
2005-02-08 09:47:47 PST – ADPlugin: Calling CustomCall
2005-02-08 09:47:47 PST – ADPlugin: Doing CheckServerRecords……
2005-02-08 09:47:48 PST – ADPlugin: Good credentials for [email protected]
2005-02-08 09:47:48 PST – ADPlugin: No connection in connection mgr for [email protected]@media.ziffdavis.com:389
2005-02-08 09:47:48 PST – ADPlugin: Secure BIND Session with server medw2k001.media.ziffdavis.com:389
2005-02-08 09:47:48 PST – ADPlugin: Processing Site Search with found IP
2005-02-08 09:47:49 PST – ADPlugin: Site found of – SanFrancisco
2005-02-08 09:47:49 PST – ADPlugin: Added connection to connection mgr [email protected]@media.ziffdavis.com:389
2005-02-08 09:47:49 PST – ADPlugin: Found Default Domain media.ziffdavis.com
2005-02-08 09:47:49 PST – ADPlugin: Found Forest Domain GC media.ziffdavis.com
2005-02-08 09:47:49 PST – ADPlugin: Good credentials for [email protected]
2005-02-08 09:47:49 PST – ADPlugin: Retrieved connection from connection mgr [email protected]@media.ziffdavis.com:389
2005-02-08 09:47:49 PST – ADPlugin: Added connection to connection mgr [email protected]@media.ziffdavis.com:389
2005-02-08 09:47:49 PST – ADPlugin: Finished CheckServerRecords……
2005-02-08 09:47:49 PST – ADPlugin: Rebuilt Kerberos File
2005-02-08 09:47:49 PST – ADPlugin: Calling CloseDirNode
2005-02-08 09:47:49 PST – ADPlugin: Calling OpenDirNode
2005-02-08 09:47:49 PST – ADPlugin: Calling CustomCall
2005-02-08 09:47:49 PST – ADPlugin: Verify called for [email protected]
2005-02-08 09:47:49 PST – ADPlugin: Verify successful for [email protected]
2005-02-08 09:47:49 PST – ADPlugin: Calling CloseDirNode
2005-02-08 09:47:50 PST – ADPlugin: Calling OpenDirNode
2005-02-08 09:47:50 PST – ADPlugin: Calling CustomCall
2005-02-08 09:47:50 PST – ADPlugin: Doing DN search for account – sfmd1cking
2005-02-08 09:47:50 PST – ADPlugin: Good credentials for [email protected]
2005-02-08 09:47:50 PST – ADPlugin: Retrieved connection from connection mgr [email protected]@media.ziffdavis.com:389
2005-02-08 09:47:50 PST – ADPlugin: Added connection to connection mgr [email protected]@media.ziffdavis.com:389
2005-02-08 09:47:50 PST – ADPlugin: Calling CloseDirNode
2005-02-08 09:47:50 PST – ADPlugin: Calling OpenDirNode
2005-02-08 09:47:50 PST – ADPlugin: Calling CustomCall
2005-02-08 09:47:50 PST – ADPlugin: Looking for existing Record of sfmd1cking
2005-02-08 09:47:50 PST – ADPlugin: Doing DN search for account – sfmd1cking
2005-02-08 09:47:50 PST – ADPlugin: Good credentials for [email protected]
2005-02-08 09:47:50 PST – ADPlugin: Retrieved connection from connection mgr [email protected]@media.ziffdavis.com:389
2005-02-08 09:47:50 PST – ADPlugin: Added connection to connection mgr [email protected]@media.ziffdavis.com:389
2005-02-08 09:47:50 PST – ADPlugin: Attempting Add Record……
2005-02-08 09:47:50 PST – ADPlugin: Adding in OU = CN=Computers,DC=media,DC=ziffdavis,DC=com
2005-02-08 09:47:50 PST – ADPlugin: In Server = sfw2k008.media.ziffdavis.com
2005-02-08 09:47:50 PST – ADPlugin: Good credentials for [email protected]
2005-02-08 09:47:50 PST – ADPlugin: Retrieved connection from connection mgr [email protected]@media.ziffdavis.com:389
2005-02-08 09:47:50 PST – ADPlugin: Added record CN=sfmd1cking,CN=Computers,DC=media,DC=ziffdavis,DC=com using Server sfw2k008.media.ziffdavis.com
2005-02-08 09:47:50 PST – ADPlugin: Added connection to connection mgr [email protected]@media.ziffdavis.com:389
2005-02-08 09:47:50 PST – ADPlugin: Changing Password for User [email protected] as [email protected]
2005-02-08 09:47:50 PST – ADPlugin: Changing Password for User [email protected] as [email protected]
2005-02-08 09:47:50 PST – ADPlugin: Changing Password for User [email protected] as [email protected]
2005-02-08 09:47:51 PST – ADPlugin: Changing Password for User [email protected] as [email protected]
2005-02-08 09:47:51 PST – ADPlugin: Changing Password for User [email protected] as [email protected]
2005-02-08 09:47:51 PST – ADPlugin: Changing Password for User [email protected] as [email protected]
2005-02-08 09:47:51 PST – ADPlugin: Changing Password for User [email protected] as [email protected]
2005-02-08 09:47:51 PST – ADPlugin: Changing Password for User [email protected] as [email protected]
2005-02-08 09:47:51 PST – ADPlugin: Changing Password for User [email protected] as [email protected]
2005-02-08 09:47:51 PST – ADPlugin: Changing Password for User [email protected] as [email protected]
2005-02-08 09:47:52 PST – ADPlugin: Good credentials for [email protected]
2005-02-08 09:47:52 PST – ADPlugin: Retrieved connection from connection mgr [email protected]@media.ziffdavis.com:389
2005-02-08 09:47:52 PST – ADPlugin: Deleting Record CN=sfmd1cking,CN=Computers,DC=media,DC=ziffdavis,DC=com…
2005-02-08 09:47:52 PST – ADPlugin: Added connection to connection mgr [email protected]@media.ziffdavis.com:389
2005-02-08 09:47:52 PST – ADPlugin: Setting Computer Password FAILED Deleted Record……
2005-02-08 09:47:52 PST – ADPlugin: Closing All Connections – Connection Manager
2005-02-08 09:47:52 PST – ADPlugin: Closing Connection – [email protected]@media.ziffdavis.com:389
2005-02-08 09:47:52 PST – ADPlugin: Closing All Connections – Connection Manager Completed
2005-02-08 09:47:52 PST – ADPlugin: Calling CloseDirNode

So, it’s failing when trying to change the password for the computer account. at least, i THINK it’s the computer account- the fact that it says user sfmd1cking on those lines makes me wonder . . . . . . . . . .

[sketch]

just to check, does the account you’re using have permission to create new computer accounts in the OU where you’re putting your Macs in?

[elvisizer]

yes, i have rights using that account- it has domain admin privs. i use the same account to bind PC’s to the domain all the time, no problem.

[AMSR]

Try preferreing a domain controller and see if that helps.

[Anonymous]

Hey!
Don’t let this thread die… I am having an almost identical problem as well (and I do not mean to hijack this thread… I swear!). I get stuck at step 5 when trying to bind in Active Directory component of Directory Access, however I get “an unexpected error has occured”. this is what my grep-ed directoryservice.debug.log looks like :

marilyn:~ admin$ tail -f /Library/Logs/DirectoryService/DirectoryService.debug.log | grep ADPlug
2005-02-22 16:32:14 PST – ADPlugin: Calling OpenDirNode
2005-02-22 16:32:14 PST – ADPlugin: Calling CustomCall
2005-02-22 16:32:14 PST – ADPlugin: Doing CheckServerRecords……
2005-02-22 16:32:14 PST – ADPlugin: Failed getting credentials with error – -14090
2005-02-22 16:32:17 PST – ADPlugin: Found Default Domain edelbrockcorp.local
2005-02-22 16:32:21 PST – ADPlugin: Found Forest Domain GC edelbrockcorp.local
2005-02-22 16:32:21 PST – ADPlugin: Failed getting credentials with error – -14090
2005-02-22 16:32:21 PST – ADPlugin: Finished CheckServerRecords……
2005-02-22 16:32:21 PST – ADPlugin: Rebuilt Kerberos File
2005-02-22 16:32:21 PST – ADPlugin: Calling CloseDirNode
2005-02-22 16:32:21 PST – ADPlugin: Calling OpenDirNode
2005-02-22 16:32:21 PST – ADPlugin: Calling CustomCall
2005-02-22 16:32:21 PST – ADPlugin: Verify called for EDELBROCKCORP/[email protected]
2005-02-22 16:32:21 PST – ADPlugin: Calling CloseDirNode
2005-02-22 16:32:26 PST – ADPlugin: Calling OpenDirNode
2005-02-22 16:32:26 PST – ADPlugin: Calling CustomCall
2005-02-22 16:32:26 PST – ADPlugin: Doing CheckServerRecords……
2005-02-22 16:32:35 PST – ADPlugin: Found Default Domain edelbrockcorp.local
2005-02-22 16:32:38 PST – ADPlugin: Found Forest Domain GC edelbrockcorp.local
2005-02-22 16:32:38 PST – ADPlugin: Finished CheckServerRecords……
2005-02-22 16:32:38 PST – ADPlugin: Rebuilt Kerberos File
2005-02-22 16:32:38 PST – ADPlugin: Calling CloseDirNode
2005-02-22 16:32:38 PST – ADPlugin: Calling OpenDirNode
2005-02-22 16:32:38 PST – ADPlugin: Calling CustomCall
2005-02-22 16:32:38 PST – ADPlugin: Doing CheckServerRecords……
2005-02-22 16:32:38 PST – ADPlugin: Good credentials for [email protected]
2005-02-22 16:32:38 PST – ADPlugin: No connection in connection mgr for [email protected]@edelbrockcorp.local:389
2005-02-22 16:32:42 PST – ADPlugin: Secure BIND Session with server dc1.edelbrockcorp.local:389
2005-02-22 16:32:42 PST – ADPlugin: Processing Site Search with found IP
2005-02-22 16:32:42 PST – ADPlugin: Added connection to connection mgr [email protected]@edelbrockcorp.local:389
2005-02-22 16:32:42 PST – ADPlugin: PeriodicTask Called…….
2005-02-22 16:32:45 PST – ADPlugin: Found Default Domain edelbrockcorp.local
2005-02-22 16:32:48 PST – ADPlugin: Found Forest Domain GC edelbrockcorp.local
2005-02-22 16:32:48 PST – ADPlugin: Good credentials for [email protected]
2005-02-22 16:32:48 PST – ADPlugin: Retrieved connection from connection mgr [email protected]@edelbrockcorp.local:389
2005-02-22 16:32:48 PST – ADPlugin: Added connection to connection mgr [email protected]@edelbrockcorp.local:389
2005-02-22 16:32:51 PST – ADPlugin: Found Additional Domain forestdnszones.edelbrockcorp.local
2005-02-22 16:32:54 PST – ADPlugin: Found Additional Domain domaindnszones.edelbrockcorp.local
2005-02-22 16:32:54 PST – ADPlugin: Finished CheckServerRecords……
2005-02-22 16:32:54 PST – ADPlugin: Rebuilt Kerberos File
2005-02-22 16:32:54 PST – ADPlugin: Calling CloseDirNode
2005-02-22 16:32:54 PST – ADPlugin: Calling OpenDirNode
2005-02-22 16:32:54 PST – ADPlugin: Calling CustomCall
2005-02-22 16:32:55 PST – ADPlugin: Verify called for [email protected]
2005-02-22 16:32:55 PST – ADPlugin: Verify successful for [email protected]
2005-02-22 16:32:55 PST – ADPlugin: Calling CloseDirNode
2005-02-22 16:32:55 PST – ADPlugin: Calling OpenDirNode
2005-02-22 16:32:55 PST – ADPlugin: Calling CustomCall
2005-02-22 16:32:55 PST – ADPlugin: Good credentials for [email protected]
2005-02-22 16:32:55 PST – ADPlugin: Retrieved connection from connection mgr [email protected]@edelbrockcorp.local:389
2005-02-22 16:32:55 PST – ADPlugin: Added connection to connection mgr [email protected]@edelbrockcorp.local:389
2005-02-22 16:32:55 PST – ADPlugin: Updating Mappings from Schema……….
2005-02-22 16:32:55 PST – ADPlugin: Record mappings updated…
2005-02-22 16:32:55 PST – ADPlugin: Doing DN search for account – marilyn
2005-02-22 16:32:56 PST – ADPlugin: Good credentials for [email protected]
2005-02-22 16:32:56 PST – ADPlugin: Retrieved connection from connection mgr [email protected]@edelbrockcorp.local:389
2005-02-22 16:32:56 PST – ADPlugin: Added connection to connection mgr [email protected]@edelbrockcorp.local:389
2005-02-22 16:32:56 PST – ADPlugin: Calling CloseDirNode
2005-02-22 16:32:56 PST – ADPlugin: Calling OpenDirNode
2005-02-22 16:32:56 PST – ADPlugin: Calling CustomCall
2005-02-22 16:32:56 PST – ADPlugin: Looking for existing Record of marilyn
2005-02-22 16:32:56 PST – ADPlugin: Doing DN search for account – marilyn
2005-02-22 16:32:56 PST – ADPlugin: Good credentials for [email protected]
2005-02-22 16:32:56 PST – ADPlugin: Retrieved connection from connection mgr [email protected]@edelbrockcorp.local:389
2005-02-22 16:32:56 PST – ADPlugin: Added connection to connection mgr [email protected]@edelbrockcorp.local:389
2005-02-22 16:32:56 PST – ADPlugin: Attempting Add Record……
2005-02-22 16:32:56 PST – ADPlugin: Adding in OU = CN=Computers,DC=edelbrockcorp,DC=local
2005-02-22 16:32:56 PST – ADPlugin: In Server = dc1.edelbrockcorp.local
2005-02-22 16:32:56 PST – ADPlugin: Good credentials for [email protected]
2005-02-22 16:32:56 PST – ADPlugin: Retrieved connection from connection mgr [email protected]@edelbrockcorp.local:389
2005-02-22 16:32:56 PST – ADPlugin: Added record CN=marilyn,CN=Computers,DC=edelbrockcorp,DC=local using Server dc1.edelbrockcorp.local
2005-02-22 16:32:56 PST – ADPlugin: Added connection to connection mgr [email protected]@edelbrockcorp.local:389
2005-02-22 16:32:56 PST – ADPlugin: Changing Password for User [email protected] as [email protected]
2005-02-22 16:33:12 PST – ADPlugin: PeriodicTask Called…….

It just sticks after that…. Maybe that can help you…. or maybe someone has a fix for me…. OH JOY

Neat site here….. I’ll be back….

[outlook]

I have been using it. [url=http://www.oemailrecovery.com/open-dbx-file.html]open dbx file[/url] and [url=http://www.mail-repair.com/recover-mailbox.html]recover outlook express messages[/url] more stable and secure than other programs.

[Anonymous]

Make Sure that your machine that you are trying to bind has its clock synced to the same time of your domain controller

[Anonymous]

I have a similar problem binding a Mac OS X Client (10.4.3) to an AD domain. The Directory Access App stops responding at step five. At this point, the DirectoryService.debug.log gets several entries like this:
“ADPlugin: PeriodicTask Called…….” (I don’t think that this is a hint to what the problem is, anyway).

Some things I tried and other hints:
– I synched the computer clock to the AD Server time
– I used a computer id which existed already
– I set up SMB in Directory Access
– I tried preferring a domain controller, but that didn’t help either
– the account I used for AD authentication IS an account who may add computers to the domain
– no errors in DirectoryService.error.log
– a weird side-note: I successfully bound a panther client to AD, then updated it to Tiger, no problem. Then I disconnected the client in Directory Access and tried to reconnect… same problem occurs.

My questions:
– Is there anybody who filed this as a bug at the apple bugreporter?
– are there any new findings?

[neilt]

I also have the same problem.
Other things I have tried.
I can bind Panther clients. I have one machine with 2 hard drives, 1 panther, 1 tiger. When booted from panther it will bind. when booted from tiger, it wont.
Also. I have an xserve with os x server 10.4.3 that wont bind either.

I have tried this on 5 different machines. One thing to note is that about a month and a half ago, I was able to get one mac in tiger to bind. I unbound that machine, and now it will not bind again.

[Anonymous]

I already got managed to turn on the DirectoryService debug log via “sudo killall -USR1 DirectoryService” but found nothing illuminating… Maybe I should try capturing network traffic, you’re right.

I have two more questions:
1) Are there any changes in the ADPlugin implementation from Panther to Tiger that are known to cause problems?
2) Are there solutions or workarounds that include changing the server configuration?

[Author]

Posts