Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

8 points

big sur - active directory logon without office network

Hello,

one of my user recently updated to big sur his macbook pro.

From that moment he can't login outside office network; osx join an AD domain (win 2019 server) and we use AD account (mobile account is created on /User during the first login).

I also tryied to turn off the network, reboot (inside the office) and he was right, without our network, he has the error "account is locked".

We don't use JAMF.

We use the same setup from about 2005, never had this kind of issues (we also avoid upgrading osx before 9/10 months of testing)

Thanks

Posted on Nov 30, 2020 9:06 AM

Best reply

chopni

Level 1

4 points

Posted on Jun 11, 2021 4:17 PM

Wow, literally just resolved this on a whim. I have posted in this thread (https://discussions.apple.com/thread/252264961?answerId=252264961021&page=2) too, but here is a recap:

Based on this article (https://support.apple.com/en-ca/guide/directory-utility/ior6d33c187e/mac), the password needs to be updated in 3 different places. Re-joining the laptop to domain and purging the keychain did not help, but this did it.

- connect to the domain (ethernet cable preferred)

- go to System Preferences > Users & Groups > click on "Change Password" for the domain account (the affected user profile) > change your password

- verify the password is updated somehow -- "net user THEUSERNAME /domain" in Command Prompt -- or just wait a couple of minutes for the change to sync to AD

- disconnect from the domain (go offline with no WiFi connection)

- try logging back in with the newly changed password

The password needs to be updated in 3 different places, so deleting the user profile, resetting the keychain, or re-joining to domain, or whatever else you do will not be sufficient. On the Mac OS backend, it needs to find and update all 3 of those different stores simultaneously -- and it's only through this method that that works.

Give this a shot! It has worked for our user. I'm just wondering if the user profile will break again... and I won't be surprised if it does. One step at a time though!

View in context

Similar questions

27 replies

Feb 18, 2021 2:55 AM in response to mz_teddy

We have the same issue. Mobile account created during the first boot.

Initially we tested Big Sur on several MacBooks and we didn't had any problems.

One week after we installed Big Sur on all MacBooks some users couldn't login and got "account is locked" error.

Since the user can not connect to VPN before login to account we can't do anything about it.

Mar 23, 2021 4:45 PM in response to Ces_123

I found that re-setting the password in AD and re-binding the computer has worked - but this is happening more often and not a solution I can use for a mobile account. Will have to revert to using local accounts for those users if they have upgraded to Big Sur

chopni

Level 1

4 points

Jun 11, 2021 1:20 PM in response to Bursy

@Bursy: The Fast User Switching method will only work if you sign in to VPN first. Once you're signed in to VPN, then you can switch users to log in your domain account -- the domain account's password should work from there. Hope that works for you!

Also, it seems like Big Sur 11.4 has bricked the domain account password again. We had a user that got a freshly-installed Big Sur laptop and had no issues -- but after upgrading to 11.4 Big Sur over a week ago, they weren't able to sign in.

When plugged in to the office network, they can log in. But when unplugged/off the network, they can't log in.

Tried to leave and re-join domain. Still the same issue. I really don't want to purge the profile if possible.

Mac and AD integration is just so frustrating.

Is Jamf really the only solution? Hah.

Jan 14, 2021 4:24 PM in response to venicejeff

VeniceJeff,

did erasing and restoring solve the issue? Did you just do a time machine backup?

Jan 15, 2021 8:15 AM in response to venicejeff

venicejeff

Has erasing and restoring been successful? Did you just create a time machine backup and then restore the user from that?

I might be to this point in trying to figure out what's going on.

mz_teddy Author

Level 1

8 points

Feb 18, 2021 6:22 AM in response to mz_teddy

After 2 month using a local account (and no fix from apple), i made a backup (manually copying the folder in /user/...) and reinstalled Catalina (and disable auto updates).

maro215

Level 1

4 points

Feb 27, 2021 9:21 AM in response to 8leonn

Tried this and it is not working.

Mar 11, 2021 2:48 PM in response to MikiVP026

so you left them unable to use a their computers?

Mar 23, 2021 4:48 PM in response to maro215

If possible, try resetting the user account - then Re-bind the computer to AD and try logging in with the new password. Seems to be more of an issue since I enabled FileVault.

Apr 29, 2021 12:39 PM in response to PaulCarmona

Jamf Pro here - Sending the Unlock user command has worked for us. It would seem the commonality is users upgrading to Big Sur without a domain connection.

jwit01

Level 1

4 points

May 11, 2021 4:18 AM in response to mz_teddy

I have the same issue with a single user on Catalina. Did anyone figure out a solution for this? Currently having them log in as local admin and connect to the VPN every time.

kvellano

Level 1

9 points

May 11, 2021 6:35 AM in response to jwit01

I am told the workaround is to back up the profile, delete it, rebind, and create a new one.

Hardly zero-touch..

big sur - active directory logon without office network