AD Bind Issues

Question

Level 1

5 points

AD Bind Issues

Hi Forums,

I am maintains a large school network, we have all of our users log on using mobile accounts through our AD server. In X.5 we had the regular issues that everyone seemed to have, but so far our X.6 systems seem to be far worse.

It seems every time i reboot my test systems they loose the AD server. We can;t log in with an un-cached user and when i go to check the Network Account Server, out Open Directory server is registering fine, but our AD domain says "This domain is not responding".

It seems to be the same weather we are on wireless or ethernet.. and it really is very frustrating, it is the last issue we have preventing us from rolling out our X.6 image.

Posted on Sep 28, 2009 10:24 PM

Reply

Answer 1

dyelton

Level 1

0 points

Sep 29, 2009 5:41 AM in response to Matt James1

I am having this issue as well, though it appears to be sporadic.

Reply

Answer 2

Sep 29, 2009 11:08 AM in response to Matt James1

Hi

+". . . we had the regular issues that everyone seemed to have . . ."+

Everyone? Are you sure? I've done hundreds of AD-OD Integration Deployments and I've seen little or no problems at most of them.

If you have A/V Software installed try disabling it. Does it make a difference?

Tony

Reply

Answer 3

Matt James1 Author

Level 1

5 points

Sep 29, 2009 6:19 PM in response to Antonio Rocco

That was referring to X.5's known issues with binding to Windows 2003 AD servers, it was an issue related to the Kerberos Certificate refusing to allow the system to rebind.. i have found 100's of posts about it on the net, by saying everyone SEEMED to have, doesn't literally mean everyone had it, it means that a lot of people had it.

Now back to my issue (X.6 AD server not responding), I have noticed it seems to be most common when the Airport switches off or the systems gets Shut Down (note it doesn't happen every single time, but it is very frequent i.e. probably around 75% to 80% of the time), it doesn't happen as frequently when it is restarted, but it does happen on occasion.

If any one has any ideas, they would be appreciated.

Reply

Answer 4

ithier.j

Level 1

0 points

Oct 2, 2009 7:42 AM in response to Matt James1

I am experiencing the same issues. I have a lab of 30 iMacs all running 10.6 bound to both Open Directory and Active Directory and every time they are rebooted about 10 random machines loose their connection to Active Directory. I can rebind them and they will work but once they are rebooted again the same issue will happen on random machines. If anyone comes across a possible solution I would greatly appreciate it.

Reply

Answer 5

Oct 5, 2009 1:41 AM in response to Matt James1

Hi All,

I am having the same problem, only with 10.6. Basically on shutdown or reboot, we get the "domain is not responding" message. This is not replicated on 10.5.8. Exactly same problems being described by Matt James.

Reply

Answer 6

Matt James1 Author

Level 1

5 points

Oct 5, 2009 8:04 PM in response to Antonio Rocco

"If you have A/V Software installed try disabling it. Does it make a difference?"

No, we have no AV software on the systems, just the base OS, Office and some minor utilities (VLC etc).

Reply

Answer 7

Oct 7, 2009 12:42 PM in response to Matt James1

I am also having this same issue. I have tested it with a fresh install of 10.6.0, a fresh install updated to 10.6.1, and a system straight out of the box updated to 10.6.1. Each one works until the system is rebooted. I do not have them configured to create mobile accounts at logon. Our Tiger and Leopard systems do not have any problem connecting to our domain and they stay connected. It seems to only be a problem with Snow Leopard in our environment.

Reply

Answer 8

Oct 7, 2009 1:38 PM in response to Garrett Stevens

Having the same issues with a small lab of just 12 iMacs. Pre-10.6 they were fine. I've gone through and rebound all of them to AD (2003 R2), they're fine until they're rebooted - all are hardwired, wifi is disabled. On one, I rebound it, then rebooted and attempted to login and wasn't allowed, logged in with a local account, checked the settings (didn't change a thing), logged off and attempted to login and it worked fine.

Reply

Answer 9

ithier.j

Level 1

0 points

Oct 12, 2009 4:29 PM in response to Dave Eveland

I am in the same boat as everyone else here. No A/V software. Fresh out of box, updated to 10.6.1, makes no difference, still does same thing once it is rebooted!

Reply

Answer 10

Oct 14, 2009 10:39 AM in response to ithier.j

I am also seeing this behavior on reboots with a fresh install of 10.6 updated to 10.6.1. I also get the message "domain is not responding". A second reboot will sometime fix this, sometimes not. Snow Leopard is very sporadic and unreliable in it's ability to hold the bind to the AD DC.

Cheryl Tarbox
Binghamton University

Reply

Answer 11

Oct 15, 2009 11:32 PM in response to Cheryl Tarbox

Ends the domain name with .local?

Reply

Answer 12

Matt James1 Author

Level 1

5 points

Oct 15, 2009 11:58 PM in response to Peter-Erik

yes, the domain name does end with .local

Reply

Answer 13

Oct 16, 2009 12:09 AM in response to Matt James1

There is your problem i have the same problem here but i test it with an other server that ends on .lan (for example) and with this it works perfect.

in this document: http://images.apple.com/business/solutions/it/docs/BestPractices_ActiveDirectory.pdf

.local domains
Since Mac OS X uses the .local domain for Bonjour (link-local addressing), it will
conflict with any .local AD domain. To get around this, add .local to the search domain settings in the Network preference pane. All .local DNS queries will be unicast to the DNS servers before being multicast to the network.
Beginning with Mac OS X v10.5.4, the Mac OS X client recognizes .local domains, and the addition of .local into the search domain settings is not necessary

But for some reason this is not working in 10.6(.1) and now i am waiting for a fix from Apple 10.6.2?

Reply