Joining a Mac to a new windows domain - HELP !!

[BrianG]

We've been banging our heads for the last couple of days on this, so if anyone can help it would be greatly appreciated.

 

We are in one of my Primary Schools. We've just installed a replacement Windows 2003 R2 server. It's running as the Domain Controller, DHCP and DNS.

 

The Macs ( both Macbooks wirelessly and iMacs cabled) are running Leapard 10.5.6. When we try to bind the mac to the domain it takes ages, asks for the local admin password half way through , then eventually binds. The computer account shows up in AD but you can't log on to the mac with a domain account. Are we missing something? Someone said there was something you had to chance on the server but didn't know exactly what it was.

 

I've rejoined the same mac back to the old domain and it rejoins straight away and logs on so I think the problem is with the new server.

 

ANy help would be great.. we had a week for this server install. We're now at the end of that week with no signs of getting the new server in today.

 

I should also mention, there are about 50 windows computers too, which is why we have a Windows server, a few selected as test machines all join the new domain fine. Money was a factor so weren't allowed to get a Mac server to manage the macs along with the windows server.

 

Cheers

 

Lee

[richardp]

Hi first thing I would check is that the time on the macs and windows server is identical. Make sure both of them are using the same NTP server to set the time.

 

Secondly after promoting a Windows Server 2003 to a Domain Controller, you must check the Domain Security Policy and change the "Always secured connection" policy to "only when available".

 

Hope that helps

[BrianG]

Checked the time, they are ok. Can you tell me where the domain security policy is? it something under default domain policy or domain controller policy?

 

Thanks again... thoughts are getting clouded here.. it's been 3 days trying to sort this .neither one of us has any mac experience

[richardp]

Hi, yes if you open up Domain Security Policy on your DC then go to Local Policies then Security Options. Approx half way down you should see "Microsoft network server: Digitally sign communications (always)" by default this is enabled, however Macs cannot do this so it needs to be disabled.

 

Directly below it there is another entry "Microsoft network server: Digitally sign communications (if client agrees)" which you can enable so that at least your windows computers will still encrypt communications.

 

Have you checked on the macs that you changed the preffered domain controller in the Directory Utility to your new DC ? If not then they may still be looking for your old DC and it might explain the slowness if nothing else. Also make sure your DNS info is correct, on a mac go to Terminal and type host and make sure it returns the FQDN of the DC server. Also are you using the FQDN when trying to bind the mac to the Domain? Have you changed the name of each mac in the Sharing entry of System Preferences ?

 

Richard

[BrianG]

Hey, thanks for your reply. I've tried those things and it's not working still. Would it matter, if the old domain name and the new domain name are the same? Could this cause any sort of conflict for the macs?

 

Thanks again for helping.. this is driving us up the wall at the moment

 

Cheers !!!

[richardp]

Hi, ...mmmm when you said that it "..asks for the local admin password half way through..." by that did you mean the local admin password of the DC or are you using the domain administrator account ? Or have you created a specific account for adding computers to the domain ?

 

This is a bit of a stumper at the moment, never had any problems joining a mac to a windows domain myself other than with the time being out of sync issue. When you get to the login window on the mac underneath where it says Mac OS X it should show the name of the mac. If you click this repeatedly it will show you different info. One bit is "Network Accounts Available" does this have a green sphere next to it ?

 

 

Richard

[BrianG]

I'm using the domain administrator account to add the mac to the domain. It gets to step 4 of 5 in the binding process and then asks for a password. It just asks for the administrator password, but the only one is will accept is the Macs own local administrator password, the domain admin password isn't accepted.

 

I'll check the log in bit now, to see if i have a green sphere. I'm positive it's going to be something really daft. All your help is greatly appreciated though..

[richardp]

Hi just something to check, in system preferences / accounts, go into the Login Options and make sure that the option "Allow network users to login to this computer" is ticked. Also click on options and select "All network users" or select "Only these network users" and select a domain account to test it with.

 

Also in the directory utility click on Search Policy and make sure that the Active Directory entry is higher up the list than any mention of LDAP.

 

Richard

[AntonioRocco]

Hi

 

"Would it matter, if the old domain name and the new domain name are the same?

 

It would only matter if they were different.

 

If they have differed because you've changed it for a known reason then yes this could cause problems. One thing you should know is successful mac integration into an AD environment - amongst other things - is mostly about the 'health' of internal DNS Services. Macs require correctly resolving DNS on both the forward and reverse pointers. The reverse pointer is extremely important as that is how macs 'discover/access' home profiles. In other words your AD environment must have a Reverse Lookup Zone configured. It will be in your DNS Snap-in Module.

 

Get this part of your environment right and things do go smoothly and what's more work - mostly. Internal DNS Services should be working correctly for AD to work optimally in any case. Another thing to remember is to avoid using .local as the basis for internal DNS Services. Not so much of a problem since 10.5.4 but can and still does cause slow log-ins as well as long binds. It can even cause macs to lose contact with the Domain Controller.

 

Typically when binding Mac clients to Active Directory if it's taking longer than 2-3 minutes you have a problem somewhere? It should not take any longer than 20-30 seconds - a minute at the most. This may not necessarily be down to DNS although you should eliminate any lingering DNS issues as soon as possible. The bind delay could also be down to in-appropriate OU permissions and/or poorly structured and confused OUs.

 

When binding you should only have to use an AD Account credentials that has authority for the Domain. The reason why you're being prompted to use the local admin account as well is because it's taking too long. Once you go beyond 5 minutes you've gone beyond the time sync value set by your KDC anyway. It's not surprising the whole thing fails thereafter.

 

You do know there is an option to extend the default 5 minutes to 10 minutes don't you? This is done on your KDC. It will be in the Kerberos Account Policy either at the Local, Domain or Group level. Depends where you have it set.

 

Can you actually resolve the PDC to itself on both pointers? Try not to use Ping as the only tool to resolve names to numbers. Can you do the same from a mac client? Use the host, nslookup and dig commands to do this. Is the DHCP Service 'pushing' out the correct information in terms of DNS Servers and Domain name? What happens if you try and resolve an assigned IP address given to a mac client on the reverse pointer?

 

Antonio Rocco (ACSA)

Edited November 13, 2009 by AntonioRocco

[sted]

that is apparently needed

 

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy enabled

 

just done 3 imacs (aluminium jobs on 10.5.?) and all i have done to get them domained and managed is the above setting ,added various bits to the schema and tell the schema to index mac addresses which apparently help a lot. its all in the apple whitepaper (Modifying the Active Directory Schema to Support Mac Systems in google gets it first hit)

 

i can post my ldif file if you want it seems to work for me but i cant gurantee it will for anyone else and as always use at your own risk)

[HodgeHi]

Hi, yes if you open up Domain Security Policy on your DC then go to Local Policies then Security Options. Approx half way down you should see "Microsoft network server: Digitally sign communications (always)" by default this is enabled, however Macs cannot do this so it needs to be disabled.

 

You shouldn't need to do this now since 10.5. I think it's also mentioned in the Apple whitepaper.

[BrianG]

Thanks for all your input guys. When I get to the school in question, later today.. I'll go through what you've suggested and get back to you with my results. All your help is greatly appreciated

 

Cheers !!

[BrianG]

It's now working.

 

The thing that thew me, about the DNS, was the old server, which the macs bind to without a problem, had no reverse look up zone installed. I've installed it on the new server and created a pointer resolving the domain to the IP of the DC. The macs now bind in a couple of seconds and the macs can log in with a domain account.

 

It's also gotten rid of the multiple entries in DNS for the one computer. I was getting 3 entries.. one with the correct, DHCP handed address, and two more, one starting 192.168 and one starting 172.10...

 

It's working now.. thanks guys for all your help it's greatly appreciated.

 

Cheers

 

Lee