You are unable to log in to the user account "accountname" at this time

Question

You are unable to log in to the user account "accountname" at this time

Hi,

I have a fair bit of experience with Macs but cannot find a solution to the issue logging in as above.

This only happens when student users try to log in. I have the macs (4 in question) bound to AD and i can ping the dc/file server and browse to locations on that server from the Macs. I do not have an OD server. All the other installs i have done in the past i've done with xserve/ server app so dont know if that is the reason.

If i tick the box to allow local home directory to be mounted at startup the users can log in but there network home folder is just a question mark in the dock and of no use.

After the Macs have been bound then they have been moved into the relevant OU's. I dont have roaming profiles setup and all users have a network home folder on the dc/ fileserver.

Any suggestions are welcome.

Regards

Jim

Posted on Jul 14, 2014 6:46 AM

Reply

Answer 1

Jul 14, 2014 1:15 PM in response to Sensational Badger

What version of OSX Are you on?

Can students login immediately after a reboot?

There was a bug I dealt with once back in Leopard that exhibited these symptoms. The fix was to upgrade.

Reply

Answer 2

Jul 14, 2014 6:41 PM in response to Sensational Badger

i can ping the dc/file server

what is a dc/file server?

Reply

Answer 3

Jul 16, 2014 2:39 AM in response to piperspace

Thanks for your reply.

There on 10.6.8

Students cannot log in after reboot. I read somewhere about editing the Auto_Master file and that hasn't worked either.

Don't think upgrade is an option as these are 2008 Imacs.

Regards

Reply

Answer 4

Jul 16, 2014 2:41 AM in response to Grant Bennet-Alder

Hi,

A "dc/ file server" is a Domain Controller and a File Server.

Thought it was obvious, sorry.

Reply

Answer 5

Jul 16, 2014 9:09 PM in response to Sensational Badger

Different problem than the one we had. if you log in with a local account can you then use Finder => Go Server => smb://youfileserver/student home/ to mount the students network home using student credentials?

Reply

Answer 6

Jul 21, 2014 12:34 AM in response to piperspace

Hi,

Yes i can do that but thats not the way it needs to be setup. For security and safeguarding i want network accounts with home drives. I have this setup eslewhere but never without an Apple server as a proxy to AD.

Reply

Answer 7

Jul 21, 2014 5:07 AM in response to Sensational Badger

Often this symptom is due to permission issues mounting the home drive. My hope was that by doing it manually would reveal the problem.

AD login is a negotiation between a Mac client which is bound to AD and tthe closest AD domain controller. Mac server is never a proxy to AD.

Reply

Answer 8

Jul 21, 2014 6:10 AM in response to piperspace

Thanks, I'll go back to look at the windows side of things. Like you you said the permissions to the home folders may be off, although i can connect to them manually. These were setup before i took over support so i cant vouch for them.

Reply

Answer 9

Jul 21, 2014 6:49 AM in response to Sensational Badger

It's fairly standard policy to define a GPO/ACL that gives users read/write access to their own folders but no access (not even list or traverse rights) to parent containers further upstream. This works well for Windows but it won't work for Macs. You must allow at least list and traverse rights to any container/folder that contains users home folders otherwise you may well see the behaviour you're describing.

You may know some of the following but for the benefit of others some points to remember when integrating OS X in a mature Windows network are:

1 - DNS must be have fully resolving forward and reverse pointers to active DCs and partner servers

2 - Avoid the use of .local for the TLD suffix for your internal domain

3 - Allow list/traverse rights for parent containers containing users

4 - Avoid the use of miserly home folder quotas

5 - AD GPOs can't easily be used to 'manage' Macs

The above is not an exhaustive list by any means but should help for most integration scenarios

Reply

Answer 10

Mr.Dano

Level 1

0 points

Nov 17, 2014 2:13 PM in response to Sensational Badger

I ran into this issue also and had decrypted the filevault, reimaged the computer. i knew it wasn't a password issue as i could log into web mail with no issues.

I was able to resolve this issue by going to a PC and logged into AD brought up the account of the user i was trying to log in with. i went to the profile tab and changed the setting in Home Folder from connect "Drive Letter" to "share name" to local path, applied and rebooted the computer and was able to log i as the user

Reply