1

So, I thought this was the same issue I'd seen before with the old Home folder name conflicting, but it is not. The issue is the the iMac "shakes" and refuses her password at login, but I am 100% certain it is correct AND she can login to her PC without issue (and her AD account is not locked out from password attempts).
The iMac is running OS X El Capitan, 10.11.6. Windows DC is on Server 2008 (SBS 2008 to be exact).

The BIND from the Mac to our Active Directory (Windows) Domain seems fine since I can login as my AD user, but the owner of the Mac cannot login as herself, presumably because of something left over...? She is using a local account for now, but her Mapped Drives drop overnight, so we need to get her back to her AD account. So far I have tried:

  • Unbind/rebind the Mac to the domain
  • Checked to ensure all AD users can login to the Mac in System Preferences > Users & Groups > Login Options
  • Renamed her old local account AND the home folder and changed path
  • Disable "Force local home directory on startup disk" under Directory Utility > User Experience
  • Disable "Use UNC path from Active Directory to derive network home location" (also under Directory Utility > User Experience)

I can't find anything in the Keychain, but I don't know where else to look. What could be the issue here? Thank you.

Improve this question

2 Answers 2

Reset to default
1

could there be a local user with the same name? not sure this should cause a stoppage since you checked the home folder.

if you use something like

dscacheutil -q user

do you see a local account with that user name?

Improve this answer
12
  • Good God, 1294 lines of output from that command!! I'm wading thru it now via Notepad++.....negative, no local account with the same username. Anything else I can try?? Thank you, BTW!
    – SamAndrew81
    Oct 20, 2016 at 22:06
  • 1
    can you grab the system.log at the time of the denying 'shake' login? or watch it from ssh with something like tail -f /var/log/system.log or maybe the security log
    – neuralstatic
    Oct 20, 2016 at 22:13
  • 2
    @SamAndrew81 Note that each account has two names, the "Full Name" (generally something like "Sam Andrew") and account name (more like "samandrew" or "sam.andrew" or something similar), and either one can conflict with either one. Also, it's hard to properly change a local account's account name; depending on exactly how you changed it, there might still be a conflict lurking somewhere. One (not necessarily foolproof) test for conflict is the command id accountname -- if it returns the same uid and/or groups for the local vs. AD accounts, there's a problem.
    – Gordon Davisson
    Oct 20, 2016 at 22:19
  • 1
    Sam, try "tail -f /var/log/system.log" for a floating tail as entries occur
    – neuralstatic
    Oct 21, 2016 at 1:13
  • 1
    wow that's an extensive looking script. it just struck me, you did an id username and it came up with no such user? if you run an id youraccountname it shows all the right info (from AD, not local)? if it can look you up, it should be able to look her up, right?
    – neuralstatic
    Oct 21, 2016 at 19:19
0

Fixed, FINALLY!!! Deleting the local account with the similar name (but keeping Home drive on disk so I could migrate data) did the trick! Thank you all.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .