OS X 10.3.8 and Active Directory issue

F

fixxxer

Registered
Hi there.

We are doing some testing of about 40 G5 dual processor machines running OS X 10.3.8. These machines have all been imaged using a master image via Net restore. We have created all the computer accounts in our active directory, and have bound the machines to the domain. We are testing OS X server in a Directory master role. The OS X server is running 10.3.8 as with all the latest updates. Here is the issue we are encountering. We are able to login using network accounts and receiving active directory authentication for a day or two, afterwards we are no longer able to authenticate to the network. When we enter in the credentials, the screen just shakes and we have to try again. Logging in with a local machine account still works.

I took a look at Active Directory and noticed the following computer account was automatically generated CREATIVE23004
CNF:67aaa54f-5424-47c4-b370-6dad10892ff1

The original account was also present (CREATIVE23004). It looks like the equivalent of a windows SID.

I logged in again to the machine using a local account with admin priviledges. I tried to unbind the machine from the directory using the domain admin account we initially used to bind the machine. We get a message that it is an invalid user/password combo. We tried with a few other domain admin accounts and the same message popped up. The only thing left to do seems to reimage the machine again.

Funny thing is that this is only happening on machines that are using the Open directory server. We are using this server to test having a managed desktop environment for our clients.

Could the OS X server or software build (10.3.8) be an issue here?

The OS X server is an open directory master, it has a static IP and is registered in our DNS. It looks to apple server for network time. The OS X server is NOT BOUND to our AD domain. We have created local groups in the LDAP directory, and have added active directory accounts to these local groups from a bound AD machine using Workgroup manager.

We are looking for a solution to our problem seeing that I need to justify the use of two OS X servers, and can't have our production MAC clients experience authentication issues and down time.

Any help or advice would be great.

Thanks, and sorry for the lengthy post.
 
Hmmm, you have quite an issue there! :)

First thing that came to mind is that the DirectoryService process is crashing on the local machines. That happens in my AD environment every now and again as well, but your second paragraph is more interesting.

The image you created, it wasn't bound to AD, was it? Meaning, you didn't image a bound machine so that the clones where therefore bound and then you simply renamed the computer accounts? That can cause some issues and won't be supported in 'future releases'.

Your AD, is it 2000 or 2003? Multiple DCs? I find better performance in specifying a preferred DC in AD environments.

So, you created accounts in AD for the machines, but now they've changed with extra info that AD added itself?

Personally, I believe 10.3.5 to be the best cross platform build.

Here are some other things to try:

First, put lookupd in debug mode by issuing this UNIX command:

sudo killall -USR1 DirectoryService

Now, use this command to allow you to view the debug info of the AD plugin:

tail -f /Library/Logs/DirectoryService/DirectoryService.debug.log | grep ADPlug

Try performing activities that will use the AD plugin now. Everything should be logged for you pretty nicely. Use the tail command to find new entries as you try binding, unbinding, logging in, etc.

Hope this gets you started!
 
The image you created, it wasn't bound to AD, was it? Meaning, you didn't image a bound machine so that the clones where therefore bound and then you simply renamed the computer accounts? That can cause some issues and won't be supported in 'future releases'.
Click to expand...

No, each machine is bound individually after the imaging process.

Your AD, is it 2000 or 2003? Multiple DCs? I find better performance in specifying a preferred DC in AD environments.
Click to expand...

Our AD is 2000, we have multiple DC's, but we have specified a preferred DC in the AD plugin.
 
Thanks for the advice. Turns out that we had a DNS issue that was causing our clients to lose their bindings to AD.

On another note, we are having an issue with some managed dock settings that we are applying to our clients. For some reason, aps like Itunes, Safari, Mail, Iphoto, etc are still appearing on the dock after we explicitly remove them from the dock restrictions in workgroup manager. Anyone else experience this? The dock positioning and any additional apps I add to the dock take effect. Very strange. :confused:
 
What was your DNS issue? I'm havinf a similar problem with our AD binding after about 24 hours.
 
You must log in or register to reply here.
Back
Top