3

In my company AD we have a user cannot log in the Mac. The mac has bounded to AD, and the other users can log in without issues.

It happens after I removed her mobile home directory on Mac. I thought the next time when she logs in, a new home directory will be created but Mac login dialog just shakes as if she typed a wrong password.

Output of dsconfigad -show:

Active Directory Forest          = sample.com
Active Directory Domain          = sample.com
Computer Account                 = samplemacmini$

Advanced Options - User Experience
  Create mobile account at login = Enabled
     Require confirmation        = Disabled
  Force home to startup disk     = Enabled
     Mount home as sharepoint    = Enabled
  Use Windows UNC path for home  = Enabled
     Network protocol to be used = smb
  Default user Shell             = /bin/bash

Advanced Options - Mappings
  Mapping UID to attribute       = not set
  Mapping user GID to attribute  = not set
  Mapping group GID to attribute = not set
  Generate Kerberos authority    = Enabled

Advanced Options - Administrative
  Preferred Domain controller    = not set
  Allowed admin groups           = domain admins,enterprise admins
  Authentication from any domain = Enabled
  Packet signing                 = allow
  Packet encryption              = allow
  Password change interval       = 14
  Restrict Dynamic DNS updates   = not set
  Namespace mode                 = domain

Besides, when Mac rejects her, I found an event of Kerberos pre-authentication failure:

Kerberos pre-authentication failed.

Account Information:
    Security ID:        domain\username
    Account Name:       username

Service Information:
    Service Name:       krbtgt/sample.COM

Network Information:
    Client Address:     ::ffff:(mac ip)
    Client Port:        55959

Additional Information:
    Ticket Options:     0x40000000
    Failure Code:       0x18
    Pre-Authentication Type:    2

Certificate Information:
    Certificate Issuer Name:        
    Certificate Serial Number:  
    Certificate Thumbprint: 

I found that when the Kerberos failures exceeds our login policy limit, she will be locked out.

I suspect a blank password is sent. Any ideas?

You must log in to answer this question.

Browse other questions tagged .