10.7.3 dsconfigad: The plugin encountered an error processing request. (10001)

Through the GUI, I screen-recorded the process so I can catch the messages that fly by when I hit Bind.

* Getting Active Directory domain information...

* Getting Active Directory settings...

* Finding domain controllers...

* Checking credentials...

* Checking for existing entry...

* Joining Active Directory domain...

and... FAIL.

Update: I've tried with both a premade computer account, and with no computer account.

Update: I've tried reinstalling (and reformating). Issue STILL persists, only on this one machine.

SOLVED! (no thanks to you!)

On all versions of OSX Lion (10.7, .1, .2, .3), it was giving the same error for all three accounts tested: built-in domain administrator, my account (member of domain admins), and a domain user account. Errors described above. When the password was typed incorrectly, it was giving another error, (10002).

All three accounts WERE successful on other machines, which is the entire key to this story, they were just NOT successful on the iMac. All three tested accounts were not locked out, and the accounts have no login restrictions.

"Solution" is incorrect. The WORKAROUND was to use yet another account. I'm not sure what is different between the fourth account and the three I tried, but the fourth account worked.

In the end, I do not know what the problem is, where the problem is (OSX or AD) or what the solution is, I just hope that someone finds this helpful in the future.

MORE INFORMATION!

This just happened on a laptop which had a mobile account. After rejoining the domain, I was able to log in as OTHER domain accounts, just not the domain account that had been used previously before the rejoin.

This helped: http://flybyunix.carlcaum.com/2010/05/fixing-corrupt-mobile-account-in-snow.html

It's rare, but sometimes mobile accounts (accounts that sync to an Active Directory/LDAP entry) can become corrupt and bad things happen as a result. Common symptoms are shells not being able to start, applications claiming you don't permission to do this-or-that, etc. I still haven't found a good reason for this happening, but have discovered the corruption exists in /Local/Default/Users/<user> in the local Directory Service on the mac. Since the data is synced to Active Directory/LDAP, the easiest thing to do is simply delete the entry in Directory Service using dscl. Then when you log in with the account (using the Other option in the Login Window,) it will create a new mobile account and take over the home directory for the old account that you DIDN'T delete. Since the uid is synced, the files in the home directory are owned by new mobile account. To delete the entry in Directory Service, run the following command replacing <user> with the username of the account to be removed.

dscl . -delete /users/<user>