Issues with student logging in

[mellowip1983]

A number of our students are having issues logging onto our 10.6.8 iMacs

 

We are an RM CC4.3 network with windows server 2008 R2.

 

Users struggle with logging on to the Macs, come see us, we log them on to a PC successfully, then can log into macs.

 

Has anyone else encountered trouble with AD auth on macs?

[stevenwba]

Were on an rm cc4 network also, using the unmanaged mac script, but on macbooks only with no problems, are you getting no errors at all?

[mellowip1983]

we have a couple of different issues with them. Sometimes the login box responds "could not log you on at this time" even when directory status shows green, a reset of the password normally resolves this.

 

The other the login box just shakes rejecting the username/password combo. When this happens the users can still log in to a windows machine but again resetting password will resolve it.

 

i am wondering if it is unhappy the users are not in the OD but the AD. almost as if it is looking to OD over AD

[round2it]

make sure the time is synced to your DC this is the number one cause of failed logins here

goto the time preferences and put your dc name in and lock the settings

not had any problems so far 2 months since the install.

[iSteve]

What is your set up - just Mac clients authenticating to AD? What's your setup in directory utility? Is your DNS water-tight? What does your Mac's system log say?

[mellowip1983]

round2it - thanks for that suggestion, have set it on the teachers machine, will test how he gets on in the morning. The initial time server was set to our OD server rather than the AD.

 

iSteve - setup is 25 x iMacs running 10.6.8. Mac Pro server running 10.7.1 with server components installed. 2008R2 RM CC4 Windows AD holding user data. Machines are bound to OD and we configure settings using WGM. Machines are also bound to AD and all our user accounts are there. network was setup by RM so should be 'Magic Triangle' only user data OD knows about are the teachers, students and sysadmin groups from AD that have OD groups assigned.

[stevenwba]

sorry mellowip for the late reply, while setting up, i did experience login problems due to time settings, but do exactly what round2it said, and its been working perfectly ever since, let us know how you get on

[mellowip1983]

Just been having a look at the configuration, the iMacs are configured to sync to the Mac server, which in turn is set to sync to the AD Forrest Root, so in a round about way they were configured to. will keep an eye on and update the post with feedback from teachers.

[mellowip1983]

Just been called into the mac room as the teacher couldn't log in. attempted to use my AD credentials to log in but couldn't, logged into it using local admin fine, time is in sync with AD server. Tried resetting my password, still didn't let me in.

 

Went to Directory Utility and unticked the OD connection, rebooted computer and could log in fine. re activated the OD binding, rebooted again rejected. so have turned off for now and the teacher can log in using AD credentials, just doesn't get the drive maps the mac server should give. or restrictions

[andyturpie]

We had all sorts of issues trying to bind AD to our X-Serve we ended breaking the link and making each mac a stand alone with a local generic pupil log in with a mapped network drive.

[stevenwba]

Just been called into the mac room as the teacher couldn't log in. attempted to use my AD credentials to log in but couldn't, logged into it using local admin fine, time is in sync with AD server. Tried resetting my password, still didn't let me in.

 

Went to Directory Utility and unticked the OD connection, rebooted computer and could log in fine. re activated the OD binding, rebooted again rejected. so have turned off for now and the teacher can log in using AD credentials, just doesn't get the drive maps the mac server should give. or restrictions

 

Sounds like when they are bound to the mac server, they ignore the fact you have added AD as an accounts server, not finding the accounts in od, so giving up altogether.

 

Seen as though you have removed the OD bind, try removing the ad one as well, then readding both. I had one macbook that done this, and removing both the OD & AD account servers in directory utility and then readding solved the issue.

[dayzd]

I don't remember if it still makes a difference, but I'm sure in 10.5 it mattered which came first -AD or OD- in your directory search path.

 

Might it be worth swapping them on one of the clients and seeing if that helps?

[mellowip1983]

Just been to check the search policy on the machine that is having the issues and here is a capture of the search order, to the best of my knowledge on top first search item???

 

 

for now have turned OD back on again and after lessons will reboot the machine see if log in issues still remain.

[stevenwba]

Just been to check the search policy on the machine that is having the issues and here is a capture of the search order, to the best of my knowledge on top first search item???

 

[ATTACH=CONFIG]11532[/ATTACH]

 

for now have turned OD back on again and after lessons will reboot the machine see if log in issues still remain.

 

The screen you have is now exactly the same as what we have here

[slancaster]

"unable to login at this time" can sometimes relate to your AFP/SMB network settings.

 

If set incorrectly, you canne login.

 

Go to directory utility and check to see if "network protocol to use" is set correctly, under the active directory tab (if your DC is on a windows box)

[Karamoja]

Open the auto_master file in the /etc folder.

Hash out the /Network/Servers line so it looks like :-

# /Network/Servers -fstab

This will stop the "can't login at this time" problem