I have converted an Active directory network account to a mobile one and now I can't login at all

Reid,

I know it is much later, but I am having almost the identical issue as this guy was having. I posted this thread late last week with no replies (Mobile Account Sync/AD Home Folder Question). I've been working in IT for this company since 2009. Its a large enterprise company with thousands of users and computers...all Windows-based PC's and servers. I used to work for the managed workstation team which supported hardware inventory, software delivery and the standard OS image used by all PC's and users.

I've always been a Mac guy outside of work and took a position for a retiree who introduced Macs to the Graphic Services dept some 25+ years ago. She was a Designer trying to be an IT person. Everything done currently is with local admin accounts where users have to access everything on the network manually. This is causing file permission issues, you name it!

Based on the thread above and the similarity to the issue you replied to here, any chance I might be able to contact you outside of here by some means to go over what I'm trying to do and what I need to ask IT for in order to make this setup work?

Mobile accounts normally require a valid network home directory on a server, which is kept in sync with local home directory on the client. My guess is that whatever AD is telling your client to use for this purpose is not playing ball.

C.

AD integration is generally one of the easiest configurations for Macs. However, as cdhw put it, your relationship is only as good as the AD domain. Bad data in, bad data out.

Now, here are a few items that are commonly overlooked.

1: Make sure all devices agree on time. Yes, time. If the time on the Mac is not within a specific delta of the domain controller, authentication will fail. Best advice is to point the Macs at the DC as it is likely running time services already. Test your time skew from the Mac with:

ntpq -p

2: DNS is vitally important. Your AD domain should have all the SRV, A, and PTR records defined. But, it can't hurt to confirm. OS X relies on the ldap, global catalog, and kerberos SRV records to locate services. Also, if you are on a .local domain you may be dealing with other issues.

3: Disable "Use UNC path from Active Directory to derive network home location" under the options in Directory Utility. You can also use the dsconfigad command to disable this feature also. (dsconfigad -useuncpath disable) There is a chance that an attribute in AD is pointing to a home sync location for Windows users. This can cause issues with Macs. Disable the feature to test the initial login.

4: What do you mean by:

We converted the network account to a mobile one and now when ever we try to login with that user the wheel keeps turning indefinitely and we cant login.

Did you define a network home folder path on the AD account? Were your users true network home folder accounts? If you no longer want that you must edit the AD record and remove the path under Profile > Home Folder > Connect.

I assume you checked the "Create mobile account at login" box in the AD config in Directory Utility.

5: What happens when you login to the machine with a user who never used the machine before?

Reid

Apple Consultants Network

Author "El Capitan Server – Foundation Services" :: Exclusively available in Apple's iBooks Store

Author "El Capitan Server – Control & Collaboration" :: Exclusively available in Apple's iBooks Store

Author of Yosemite Server and Mavericks Server books

So here is my thoughts.

1: Your time drift (jitter) is a little high. However, not likely the cause. You can reset by stopping time sync and then restarting it. I never like seeing whole numbers in the jitter column.

2: Good. That is key.

3: See troubleshooting below.

4: Ah, so the account was working as a network account and now can not access. Logically, this should solve it. Is the Force Local home folder checkbox checked in Directory Utility? You may also consider unbinding from the AD domain and resetting the preferences. Then binding fresh.

5: What mode is login window in? Name and Password or list of users? Temp switch to list of users. Reboot the machine and time how long it takes for Other... to appear. How complicated is your corporate network?

Now, troubleshooting. I suggest the following:

1: Enable SSH on the machine giving you trouble

2: Reboot to the login window

3: SSH into the machine so you can watch logs. Open multiple sessions if needed.

4: Tail the system.log at minimum.

5: Enable Open Directory debug logging

sudo odutil set log debug

6: Tail the OD log:

tail -f /var/log/opendirectoryd.log

7: Once you have the troubleshooting windows open, then try logging in, watching what happens. Also, a window showing top can be helpful.

Any chance you once had Centrify? In some cases this sounds like a hung up MCX issue.

Reid

Apple Consultants Network

Author "El Capitan Server – Foundation Services" :: Exclusively available in Apple's iBooks Store

Author "El Capitan Server – Control & Collaboration" :: Exclusively available in Apple's iBooks Store

Author of Yosemite Server and Mavericks Server books