Odd Problem logging on to Network Accounts on a Windows Domain

[Zoatibix]

Hello,

 

We just took delivery of forty brand new iMacs. All hardwired into our network.

 

I have gone through the initial set up and successfully joined them to our Domain. They pickup the DNS servers, gateway, identifies the domain, grabs a free IP address from DHCP. I can then log into them using my network account which authenticates to the domain server.

 

Until I either reboot or it goes to sleep...at which point I get a message that 'network accounts are unavailable'. If I log on locally I can see that all the settings are still there.

 

However, there is a message that ''The server is not in your authentication search policy.' despite the mocking green light next to our domain name

 

Oddly, when I look in DNCP I see that the iMac has a name of 'MACS-iMac' rather than e.g. 'b-imac-40'. The latter also shows up as its NETBIOS name. At one point I pinged its IP and got a response from 'windows phone.' As soon as I pulled the network cable the ping responses stopped.

 

I've tried the following:

 

• reserving it's chosen IP address in DHCP. (Tried also giving it the name it came up with.)
  
• Unbinding and rebinding.
  
• Giving it a completely different name.
  
• Setting it to look for our primary DC
  
• Giving it a completely different name.
  
• Setting all other network connections to inactive and putting Ethernet at the top of that list. At that point it grabs an IP address, etc
  
• I've unticked 'Allow authentication from any domain in the forest' (We currently have two domains but the test machine shouldn't be crossing any boundaries logically or physically)
  

 

Should I be binding it to the domain first and then changing settings or what?

 

We do have Lightspeed here but oddly only a few of the MACs seem to be being blocked by it and they just need network authentication.

 

Any ideas gratefully received!

[3s-gtech]

Check that the WINS name and sharing name are correct before binding it to AD. They go a bit nuts if they're duplicated, and when you clone them using DeployStudio or similar that is a common occurrence.

[sted]

set the time to be synced from a domain controller rather than an internet time server at least with older osx implementations I found a small clock discrepancy could cause logon issues

[3s-gtech]

Yeah, that too x1000. It's very irritating, Apple's time servers seem to be in their own universe.

[Zoatibix]

Thanks for the replies.

 

I've checked that the time matches our local network time - all fine.

 

Not sure where you mean I need to go when you say the 'sharing name'. I've made sure that I've used e.g. imac99 as the computer's name in both for NetBIOS in Network settings and as it's computer ID under Directory Utility.

 

However, I tried joining this test iMac to our old domain (we are migrating from one to the other). This works fine and after a reboot I can authenticate to the old domain.

 

If I log on locally both domains are still listed - and if I remove the old domain and reboot the iMac retains the settings for the new domain and lets me logon to the network.

 

I'm guessing there is either something extra on the old domain side or something lacking on the new...just have to figure out what.

 

Thank you for your replies so far, folks.

[3s-gtech]

Sharing Name is set in the Preferences pane. That can affect AD hostname.

[alfatec]

The procedure we use when joing Macs to the Windows network from scratch is:

1. Change the Sharing name in system preferences then restart the computer

2. Bind the computer to your windows domain by just putting your full domain name in. This will then add the domain as your search domain.

3. Add your workstation to Profile Manager and then add to appropriate device group.

4. Restart computer and make sure policies are applied.

[Zoatibix]

@alphatec: Thanks for the suggestion: I tried steps one and two - we don't have a MAC server up at the moment to run the Profile Manager.

 

Oddly, I've again tried joining the MACs to both our old domain (which is still Server 2003 at it's heart) and the new domain simultaneously. That will work and I can authenticate with credentials from either domain. And if I remove the old domain binding I can still authenticate to the new domain. (I actually powered the iMac off for half an hour) I will see if the settings still work over night.