New network users can't log in.

A quick wild shot here.

Make sure that clients and server are within 5 minutes clock time.

I had a bit of trouble setting up OS X server to sync to time dot apple dot com while y clients were either synched to the server or the internet.

François.

That is ALL clients and ALL server must be within 5 minutes clocktime of each other.

To stress things, if you have two server and 5 clients, the slowest one should be less that 5 minutes of the fastest of the seven ones.

This pertains a lot to Open Directory but it might affect local users somehow.

I don't see why computer should even be 5 seconds off!

Also check you regional settings to be the same. If I let Automatic detection of my time zone, It reads my Static IP in a (state or) province next to mine which has the same time zone but not every one is that lucky. If you VPN, remote, be carefull with those.

François

Many Open Directory problems can be resolved by taking the following steps. Test after each one, and back up all data before making any changes.

1. The OD master must have a static IP address on the local network, not a dynamic address.

2. You must have a working DNS service, and the server's hostname must match its fully-qualified domain name. To confirm, select the server by name in the sidebar of the Server application window, then select the Overview tab. Click the Edit button on the Host Name line. On the Accessing your Server sheet, Domain Name should be selected. Change the Host Name, if necessary. The server must have at least a three-level name (e.g. "server.yourdomain.com"), and the name must not be in the ".local" top-level domain, which is reserved for Bonjour.

3. The primary DNS server used by the server must be itself, unless you're using another server for internal DNS. The only DNS server set on the clients should be the internal one, which they should get from DHCP if applicable.

4. Follow these instructions to rebuild the Kerberos configuration on the master.

5. If you use authenticated binding, check the validity of the master's certificate. The common name must match the hostname and domain name. Deselecting and then reselecting the certificate in Server.app has been reported to have an effect in some cases. Otherwise delete all certificates and create new ones.

6. Unbind and then rebind the clients in the Users & Groups preference pane. Use the fully-qualified domain name of the master.

7. Reboot the master and the clients.

8. Don't log in to the server with a network user's account.

9. Disable any internal firewalls in use, including third-party "security" software.

10. If you've created any replica servers, delete them.

11. As a last resort, export all OD users. In the Open Directory pane of Server, delete the OD server. Then recreate it and import the users. Ensure that the UID's are in the 1001+ range.

If you get this far without solving the problem, then you'll need to examine the logs in the Open Directory section of the log list in the Server app, and also the system log on the clients.