Mac in multiple domain forest

[FN-GM]

Hi there

I have just added my brand new MacBook to our domain. But when i try to login it is saying my username & password is incorrect.

Any thoughts please?

Z

[FN-GM]

^^BUMP^^

[kingswood]

^^BUMP^^

Hi there,

Assuming you have checked all the usual suspects- which you no doubt have- I would in this case make sure to specify which domain controller I wanted the authenticate against, if only to check that it's an issue with authentication and not something more "Mac-obscure".

To do that just use the Directory Utility and Services > Active Directory > Administrative where you can specify "Prefer this Domain Controller". You will have already specified a forest, so here you are just nailing down which domain in that forest you want to use for all the other stuff the Mac needs to do. Check that the box is ticked to "Allow authentication from any domain in the forest"- and in that way you are kind of saying "I want to be loose about who I authenticate against". So what we are doing is really saying, "look I *prefer* marmite, but if it's vegemite I am offered then I'm up for it"

Let me know if that helps!

Paul

[DMcCoy]

I'd also check kerberos is working with kinit and having a look for anything obvious in the console/directory service logs.

Is it just a shaking login box, or an actual error?

[FN-GM]

It was just a shaking login box

i have fixed it now, i added the domain to the search policy. Abit naff that it doesnt do it automatically though.

Thanks allot

[pooley]

Is the time correct on the macbook? or at least within a few mins of your Server AD

[kingswood]

It was just a shaking login box

i have fixed it now, i added the domain to the search policy. Abit naff that it doesnt do it automatically though.

Thanks allot

Great stuff.

If you have multiple domains you can also add multiple paths in that domain search policy.

But at least you got it sorted!

Paul

[HodgeHi]

I don't think leopard adds them to the search path by default now although i may be wrong. IIRC if you script the AD connection, you need to add the path as well using the dscl command, although each time i tried it failed. There may be some underlying issue here...