AD Binding - AD Accounts not working

[vfong1982]

Hi,

 

I have just unboxed a brand new iMac and went through the process of joining it to my school's domain. The computer appears in AD ok, but it still cannot detect AD user accounts. The message "Network Accounts are unavailable" appears on the logon screen. Is there something else that needs to be done?

 

The OS version is High Sierra.

[mavhc]

If your domain ends in .local you get a red dot for 60 seconds and then you can use network accounts

[vfong1982]

Yep - it ends in .local

 

I managed to get in with my own account - but I can't log on with another working account straight after. Is there a way around this?

[mavhc]

There's some dns settings

 

https://support.apple.com/en-gb/HT201275

 

https://support.apple.com/en-gb/HT203537

 

Not sure what specifically apply to.

[dhicks]

If your domain ends in .local you get a red dot for 60 seconds and then you can use network accounts

 

Ah - that's why that happens... Is that just Apple making a point that they don't think you should be using a .local domain, or is there some other more technical reason behind it?

[vfong1982]

Is there anything in the Console that I could search for that might be highlighting events where it triggers the "Network accounts are unavailable" message.

There is definitely at least 1 minute delay from the moment that error appears, and then disappears - after that, you can log in ok.

[Achandler]

There is some technical reason I can't remember which basically means it looks at itself for the .local accounts and times out or a similar reason before then actually going to the network to see the accounts.

 

Then there is another fun issue with mapped drives not being unmapped which can cause issues around one person logging off then the next not being able to login.

[Norphy]

Ah - that's why that happens... Is that just Apple making a point that they don't think you should be using a .local domain, or is there some other more technical reason behind it?

 

.local is the dns suffix that zeroconf DNS devices (Bonjour etc) use for discovery of services such as AirPlay etc. It has been best practice for at least 10 years now not to use .local as your DNS suffix. Ideally, with services like ADFS needing publicly signed SSL certificates to work you should be using a publicly routable domain (internal.school.uk or similar).

[Brimstone]

Yep - it ends in .local

 

I managed to get in with my own account - but I can't log on with another working account straight after. Is there a way around this?

.local should not be used, this is reserved for Bonjour services on the iMac....

[sparkeh]

The .local domain thing is an old problem, we have one and apple stuff works just fine

 

https://support.apple.com/en-gb/HT201275