Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Configuration: Mac OS X 10.7 and 10.8 Active Directory Server 2008 R2 Binding using AD Plugin or dsconfigad -add mydomain -username myuser -ou "OU=Computers,OU=Sites,OU=Mysite,DC=mycompany,DC=com"

Works fine. First login happens fine. Creates mobile account, no issues noticed.

However, after I logout, the next login attempt fails, and after only shaking one time, their AD account is locked out.

opendirectory.log makes a vague mention of account being expired but honestly I don't see much in the logs that pops out as useful.

Any help?

share|improve this question

I ended up using the AD plugin from Centrify which worked fine. I have abandoned the Apple plugin until they get their act together. Thanks!

share|improve this answer

Would the network time server have anything to do with it? Sometimes password reset events can cause locks due to the old credentials being rejected as multiple devices hit AD, but these are new accounts? You can turn up logging on the client, and even tail the logs in realtime over ssh if you'd like less vague of a picture of what's going on.

share|improve this answer

Interesting. I recently had a similar experience with 10.8 and 10.8 Server with Open Directory.

We applied a global policy to NOT have passwords expire (there's a bug where it defaults to expiring shortly after the account is created). That wasn't enough however: I then had to delete and re-create all of the OpenDirectory accounts. Smooth sailing after that.

I'm wondering if you're experiencing the same thing in AD.

share|improve this answer

It could possibly be (in order of likelihood):

  1. AD is creating the account with a one-time-use password: Make sure to change the password upon successfully logging in for the first time.
  2. A domain prefix might be required: OS X can be configured to imply the account's domain name, or explicitly require the account's domain name. Examples:
    1. A username with an implied domain name: username
    2. A username with an explicit domain name: DOMAIN\username or
  3. Time drift between AD server and Mac client: Make sure the sure the two machines are synched to the same time server.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.