Dual Boot iMac - Bound Mac Side, now windows won't login

[stevenwba]

Hi,

 

I have a iMac that is dual boot, the windows partition was built on the network, and yesterday i bound the mac side to AD, and the mac side works fine, logging in etc, but since I've done it, the windows xp partition won't login, saying the domain controller is unavailable, or offline, or the computer account doesn't exist. I've checked the computer account is still there, so looking at why adding mac side to ad, has destroyed the windows bind

 

Any ideas??

[SC92]

If I remember rightly you're on RMCC4 aren't you? I assume you applied the bootcamp drivers/updates to the windows partition before building it to the network?

[Karamoja]

Make sure you are using different computer names for the Mac and PC binds.

[stevenwba]

If I remember rightly you're on RMCC4 aren't you? I assume you applied the bootcamp drivers/updates to the windows partition before building it to the network?

 

Yes we are, the windows side was working fine on the network, until we bound the macs then, once bound, the macs worked fine and the windows side did not.

 

Make sure you are using different computer names for the Mac and PC binds.

 

I made the mistake of adding them both as imac001, now i have named them like imac001osx and imac001win, I'm guessing the damage has been done to the computer account in AD?

 

i have unbound the macs, and locally logged in to windows and rejoined them to the network, which has resolved the issue, just wanted to know what having them both the same does, so i know what went wrong, just for my own curiosity

[AntonioRocco]

Hi

 

". . . just wanted to know what having them both the same does, so i know what went wrong, just for my own curiosity"

 

Just like PCs, Macs appear (when bound to AD) in the default Computers OU. You can move them afterwards if you want to or (better still) create a Mac specific OU and specify it in the path when binding. They are then authenticated using that computer account only. Users logging into Mac workstations will then be authorised using their accounts as they exist in AD. Using the same computer name for both platforms means you will see authentication issues depending which platform you were on when first logging in. If you logged in on the mac platform you won't be able to log in on the Windows platform. This is because (as far as AD is concerned) that workstation has already been authenticated (it only has the one unique name remember) and won't allow any further authentication until the Principal Ticket has expired.

 

You can use command line tools (on both the mac and PC side) to destroy and renew tickets at any time as a temporary fix if you wish?

 

Kerberos tickets (unless you change the default settings) generally last 10 hours.

 

HTH?

 

Antonio Rocco (ACSA)

Edited November 6, 2011 by AntonioRocco

[stevenwba]

Hi

 

". . . just wanted to know what having them both the same does, so i know what went wrong, just for my own curiosity"

 

Just like PCs, Macs appear (when bound to AD) in the default Computers OU. You can move them afterwards if you want to or (better still) create a Mac specific OU and specify it in the path when binding. They are then authenticated using that computer account only. Users logging into Mac workstations will then be authorised using their accounts as they exist in AD. Using the same computer name for both platforms means you will see authentication issues depending which platform you were on when first logging in. If you logged in on the mac platform you won't be able to log in on the Windows platform. This is because (as far as AD is concerned) that workstation has already been authenticated (it only has the one unique name remember) and won't allow any further authentication until the Principal Ticket has expired.

 

You can use command line tools (on both the mac and PC side) to destroy and renew tickets at any time as a temporary fix if you wish?

 

Kerberos tickets (unless you change the default settings) generally last 10 hours.

 

HTH?

 

Antonio Rocco (ACSA)

 

Thanks, i knew they had to be different, but now i know why, thanks for that information