AD Integrated 10.9 - Login Error Cannot Log in at the time

[HereIGoAgain2601]

Hello,

 

Our AD integrated network users are having some problems. Occasionally random users on random macs will get the message "Cannot login to %USER% at this time please try again later". Restarting the Mac fixes the issue and they can login as normal.

 

No idea what is causing this!

 

 

Any suggestions?

 

Joel.

[AntonioRocco]

Unlike PCs Macs are very choosy about the environment you place them in. They're a little like Goldilocks because everything has to be 'just right'.

 

With that in mind I would start with the usual suspects. In no particular order these tend to be:

 

1. DNS

2. Where possible avoiding the use of a .local domain

3. If home folders are hosted on another server (i.e. not on the DC) or a network resource such as a NAS, make sure you specify the FQDN of that share when defining the home folder location in the Profiles tab. It's a good idea to do this anyway. Don't forget to add an A and PTR Record for that resource in case you haven't done so already.

4. DNS

5. Check permissions allow at least traverse/read rights from the parent folder downwards to user homes

6. Disable IPv6 on client workstations

7. Did I mention DNS?

 

How to check DNS? On any mac client login as the local admin and launch the Terminal App. You'll find it in /Applications/Utilities. Once launched use nslookup and verify you can resolve your DC on the forward and reverse pointers. Something like:

 

nslookup yourdc.yourdomain.yourtld

172.16.16.254

 

nslookup 172.16.16.254

yourdc.yourdomain.yourtld

 

By default the AD plug-in is set to re-authenticate mac workstations every 14 days. If your AD environment has no such requirement it's a good idea to disable the setting, which you can't using the GUI. Back to Terminal again and issue this command:

 

sudo dsconfigad -show

 

At the prompt key in the local admin's password. There's no echo in Terminal so you won't see this being typed. Inspect the settings. If you see an entry that lists 14 days issue this command:

 

sudo dsconfigad -passinterval 0

 

Issue the first command again and verify the setting has taken.

 

Hopefully the above should begin to help you track the problem down or at least help us help you a little more?

 

Antonio Rocco (Apple Consultants Network)

Edited January 29, 2014 by AntonioRocco

[drchrisdavis]

Do you have Mobile Accounts setup in your AD settings on the Macs? This essentially sets up a local profile for each user similar to on a PC. If they can't contact the network, at least they can log in.

[HereIGoAgain2601]

Thanks for your reply. We didn't set up Mobile accounts when we deployed the machines. If they had mobile accounts would their settings still get saved to the network and documents redirected?

[HereIGoAgain2601]

Unlike PCs Macs are very choosy about the environment you place them in. They're a little like Goldilocks because everything has to be 'just right'.

 

With that in mind I would start with the usual suspects. In no particular order these tend to be:

 

1. DNS

2. Where possible avoiding the use of a .local domain

3. If home folders are hosted on another server (i.e. not on the DC) or a network resource such as a NAS, make sure you specify the FQDN of that share when defining the home folder location in the Profiles tab. It's a good idea to do this anyway. Don't forget to add an A and PTR Record for that resource in case you haven't done so already.

4. DNS

5. Check permissions allow at least traverse/read rights from the parent folder downwards to user homes

6. Disable IPv6 on client workstations

7. Did I mention DNS?

 

How to check DNS? On any mac client login as the local admin and launch the Terminal App. You'll find it in /Applications/Utilities. Once launched use nslookup and verify you can resolve your DC on the forward and reverse pointers. Something like:

 

nslookup yourdc.yourdomain.yourtld

172.16.16.254

 

nslookup 172.16.16.254

yourdc.yourdomain.yourtld

 

By default the AD plug-in is set to re-authenticate mac workstations every 14 days. If your AD environment has no such requirement it's a good idea to disable the setting, which you can't using the GUI. Back to Terminal again and issue this command:

 

sudo dsconfigad -show

 

At the prompt key in the local admin's password. There's no echo in Terminal so you won't see this being typed. Inspect the settings. If you see an entry that lists 14 days issue this command:

 

sudo dsconfigad -passinterval 0

 

Issue the first command again and verify the setting has taken.

 

Hopefully the above should begin to help you track the problem down or at least help us help you a little more?

 

Antonio Rocco (Apple Consultants Network)

 

Thanks for you reply Antonio.

 

I'm pretty sure our DNS is working as it should but will double check on Monday. I think the issue is not with the AD authentication, as it does not shake the password box (which it used to do when our DNS was a bit wonky) it does try to login but is almost as if it cannot find the home folder which is saved on a Mac OS X Server.

[seawolf]

Hello,

 

Our AD integrated network users are having some problems. Occasionally random users on random macs will get the message "Cannot login to %USER% at this time please try again later". Restarting the Mac fixes the issue and they can login as normal.

 

No idea what is causing this!

 

 

Any suggestions?

 

Joel.

 

I would look at the console logs on a computer suffering this issue. It's best to do this immediately after getting the error. Just login on a local account and pull up console. Search for the username that tried to login. You should find a more non-descriptive error than the "cannot login...at this time" error message.

 

When I recently encountered this error for our student user accounts following a migration of student home drives to a new file server, the console revealed that the error was due to the home drives failing to mount, which stopped the login. A quick inspection revealed a very small problem with permissions on the home drive that once resolved fixed all login errors.

Edited February 1, 2014 by seawolf