0

I have several Macs bound to a Windows domain with AD. The users login to the Macs with their Windows credentials and so far it has worked fine. Last week we changed the password policy so that password lifetime is now reduced. Since then two users (out of 100-something) have problems logging in to the Macs. One user keeps getting keychain-messages about Keychain not being able to access this and that (have updated the keychain-login). The other user can't log in at all. She keeps getting refused as if she had typed a bad password or username. She uses the same credentials on the PCs as she is using on the Macs, but the Macs just won't let her in. Does anyone have any ideas to solve this problem?

Improve this question
2
  • This is two separate questions and should probably be entered as such -- Your first user, the one with the keychain issues. Was this user required to reset their password after the policy change? and if so, did they reset it from the Mac or from a windows machine, or other agent?
    – TheWellington
    Oct 12, 2015 at 15:07
  • For your second user, the one who cannot log into the Mac, but can log into the Windows machine - what is the output of tail -f /var/log/system.log /var/log/opendirectoryd.log You can get that by ssh-ing into the machine as an administrator, and running this command while the problem user is trying to log in.
    – TheWellington
    Oct 12, 2015 at 15:09

1 Answer 1

Reset to default
1

My 5c from my AD experience long ago...

Let me guess: the user which can't get in at all has changed her password on Windows due to the new password policy. And she tries to login to the Mac with her new password and that doesn't work.

For me, this sounds to me that this is a problem of an authentication cache or AD replication problem. To verify this, could you ask her to try the login on the Mac with her old password? If that is the case, her changed PW has not been synched to the Mac bound AD.

How is the Mac configured? Did you attach it to a specific AD? Could you check this AD server in the event log for replication or quorum errors or for login errors of this particular user? Any hints from the Mac logfiles pointing to an authentication error?

Next idea would be to check her password, if she uses special chars which are on a Mac's forbidden character list (Colon etc.) But this is just a wild guess. You could try this by manually setting her PW as administrator on the AD server to some trivial stuff and let her try the login again.

Improve this answer
1
  • Thanks for your suggestions. You guessed right :). I had her try the old password but no luck (response looked like a bad password). I reset her password and had her use only letters and numbers. Restarted one of the Macs several times & it finally let her in. There are still "errors" popping up on the screen (She hasn't got time to showthem to me!). Can't see any replication errors on the AD, other users have changed their pw too since the pw policy was changed and they can logon to the same Macs as the two problematic users. Will have to check the logfiles for clues there.
    – Fischer
    Oct 13, 2015 at 16:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .