Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My IT dept setup my new MacBook Pro with 2 accounts. One is a local account and the other is on the Active Directory server. Both have administrative privileges on the mac.

I've been using the AD account to setup apps while on the corporate network (wired and/or wi-fi). My standard 'shutdown' procedure is simply to close the lid. There's a setting that will prompt for password after 15 minutes, so I can close it, walk to a conference room, open it and start typing w/o password, whereas if I unplug and lock it in the desk drawer for the night, I'll need to type a password after flipping it open.

Today, for the first time, I opened it while NOT on the corporate network. Many miles away from it, infact. I had closed it while using my AD account, so I typed in those credentials--and was denied. I tried again, one careful keypress at a time, verified caps lock off, etc. and still I was told invalid username or password.

So I tried the local account credentials. Those also failed.

How do I get back into my Mac?

share|improve this question
Btw 300+ readers: There seem to be a reasonable handful of questions around here that could benefit from an active-directory tag. – Ctrl-Alt-Del Fatigue Jun 27 '11 at 18:48
up vote 2 down vote accepted

You might be out of luck. Sounds like the AD authentication isn't caching your credentials locally so you can login when you're away from your AD server.

You can go brute force on the problem:

Hold down the power button your MacBook Pro for ~5 seconds until the machine shuts itself off. Power it back on and use your local credentials to log in instead of your AD credentials.

Once you're back up and running run /System/Library/CoreServices/Directory Utility. Click the lock icon to unlock the settings. Highlight Active Directory in the list and click the pen icon to edit the settings. In the window that pops up click the Show Advanced Options and make sure that Create mobile account at login is checked. This ensures you can login when the AD server isn't present.

share|improve this answer
Out of luck = I lost my work in the AD session (pretty sure I saved most stuff, tho) and it was a bit annoying to have to go through all the same config on the local account that I had already done on the AD account, but it worked. Thanks! – Ctrl-Alt-Del Fatigue Jun 27 '11 at 23:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.