0

How do I join an Active Directory domain when I get the 10001 error? What is the real cause of the failure?

This question is about the famous failure to join an Active Directory from OS X which seems to appeared somewhere around 10.7 or so, but which seems to still be consistent, even with 10.9 or 10.10 (beta).

Assumptions:

  • ABC hostname of the OS X machine
  • EXAMPLE.COM is the domain to be joined (not a .local domain)

Checklist (collected from various sources)

  1. Current OS X username does is admin and does not overlap with an AD username.
  2. OS X hostname resolves with the DNS of the domain to be joined to (ABC.EXAMPLE.COM). Test that it works from other machines too. This is a documented reason for failure to join on Linux machines, tested it myself and solving this solved the problem on Linux.
  3. Machine is on LAN during the Join (better to disable Wireless while doing this)
  4. AD user is allowed to add machines to the domain. In some cases this does not require the user to be an Admin (that's my case)

In progress (bring more info and a full join script with debug logging)

    8544.14278, Node: /Active Directory, Module: ActiveDirectory - Authenticate to LDAP using Kerberos credential - 0
    8544.14278, Node: /Active Directory, Module: ActiveDirectory - verified connectivity to '10.80.0.150' with socket 13
    8544.14278, Node: /Active Directory, Module: ActiveDirectory - Computer account either already exists or DC is already Read/Write
    8544.14278, Node: /Active Directory, Module: ActiveDirectory - Adding record 'cn=nibbler,OU=MAC Machines,OU=EMEA,DC=example,DC=com' in 'example.com'
    8544.14278, Node: /Active Directory, Module: ActiveDirectory - ODNodeCustomCall failed with error 'Plugin error' (10001)

Resources:

  • Err, and the question actually is what exactly? – nohillside Jul 31 '14 at 13:57
  • 1
    How to join a the domain, this errors seems to be one of the big unknowns. – sorin Jul 31 '14 at 13:59
  • Do you know which version of Windows Server is being used on the Domain Controller(s) you are trying to join? – Alistair McMillan Aug 2 '14 at 15:40
3

in my case, I got this error when tried to Bind MacBook Pro to Windows Domain. I had to shorten Mac Computer name by few characters to make it work. I guess there is a limitation in Windows AD on computer names.

  • 1
    Can confirm. AD seems to have a 15 character name limit for machines/devices. – puredevotion May 11 '17 at 9:55
1

In my case, I found the issue to be with how long the username I was trying to use was. Once I shortened it by one character, it worked.

1

I got this problem this afternoon and was able to resolve it after some googling and poking around local setup. Here is what I found.

There is very informative discussion here, unfortunately I did not have enough patience to try every single thing suggested there, and found that solution to my problem was listed there towards the end of discussion.

What really helps to understand what's going on is to enable debug logging of directory issues using this command

odutil set log debug

then run this command in a terminal window to see logs:

tail -f /var/log/opendirectoryd.log

remember to turn it off after you done using this command:

odutil set log default

Once you have logging turned on, use dsconfigad to join your Mac to the domain. Command line tool is more flexible than GUI, it provides a lot of options that control tons of minute details of domain joining process. More information about the tool is here.

Using both of these tools I saw that my problem of joining the Mac to the domain was caused by the tool not being able to create computer account in the Active Directory. Once I created the account by hand and tried to join domain again the tool informed me that the computer account already exists, and asked whether I wanted to re-use it. After answering yes the tool proceeded and successfully joined the domain.

  • In macOS Mojave odutil set log debug doesn't create log files. Any alternative? – Giovanni Lovato Mar 19 at 14:21
0

I'm having exactly the same issue and we're using Windows Server 2008. Not R2. We have plans to upgrade to 2012 soon. Interestingly, we've added Macs to the domain before without problems. I had the same error yesterday and, after removing the Client Computer Name from the DNS records and waiting overnight, I was able to successfully join another Mac.

0

We cant add mac machine on domain controller installed on OS windowserver 2003 and less..update os to 2008 or more Hope this may help

-2

firs step Check the date and time of the AD and your compiuter

  • 1
    Welcome to Ask Different! We're trying to find the best answers and those answers will provide info as to why they're the best. Answers should be self-contained so explain why you think the answer you provided will solve the problem or is better than others out there. Providing links as supporting information can also help the OP, and others, find additional info for themselves. See How to Answer on how to provide a quality answer. - From Review – fsb Jun 13 '17 at 21:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .