Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

We have a domain running Microsoft Active Directory and in that domain there is a number of Mac computers running Leopard and later. Sometimes the users are met by a red dot at the login screen, saying "network accounts are not avalible". The user are still able to login, and we can SSH to the computer, but the user can't use all the domain functions. Is there a Terminal command that allows us to check if the user currently logged in is connected to the domain correctly?

share|improve this question
    
I have been hunting this down for ages. I've seen this when the server is OS X based as well - mostly on Lion systems, but I saw it the other day for a while on Mountain Lion clients with a MoLo server. Since I see this red dot even before a user logs in, you might need a system level command and not one relating to the user currently logged in, but I can't yet say for sure that's the case. –  bmike Apr 3 '13 at 13:55
add comment

2 Answers

A quick check that I will use is the id username command in terminal, replacing username with a user other than the one you are logged in with. For example, if I'm logged in as SJobs I would instead use the query id TCook, assuming that TCook is another user within the domain but not on this computer. This will attempt to query the domain for the specified username and return all of it's values. If you are not currently connected to the domain it will instead return "no such user".

If this fails I go back, check my binding, check my network connection, log out and login again.

Hope that helps!

share|improve this answer
add comment

From the Mac's shell, first try dsconfigad -show to see what the binding is. If it returns nothing, then the Mac doesn't have any AD binding. You can also use dsconfigad to force an unbind and then re-bind. In some cases it can be advantageous to delete the computer object from your AD.

If the binding appears correct, make sure that the Mac's system time is correct; too large a difference and AD won't allow a login. You can use sudo ntpdate -u time.apple.com to update the system clock against Apple's time servers.

Finally, make sure that the Mac can communicate with your domain controllers; try the usual troubleshooting, such as pinging your PDC.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.