In my company AD we have a user cannot log in the Mac. The mac has bounded to AD, and the other users can log in without issues.
It happens after I removed her mobile home directory on Mac. I thought the next time when she logs in, a new home directory will be created but Mac login dialog just shakes as if she typed a wrong password.
Active Directory Forest = sample.com Active Directory Domain = sample.com Computer Account = samplemacmini$ Advanced Options - User Experience Create mobile account at login = Enabled Require confirmation = Disabled Force home to startup disk = Enabled Mount home as sharepoint = Enabled Use Windows UNC path for home = Enabled Network protocol to be used = smb Default user Shell = /bin/bash Advanced Options - Mappings Mapping UID to attribute = not set Mapping user GID to attribute = not set Mapping group GID to attribute = not set Generate Kerberos authority = Enabled Advanced Options - Administrative Preferred Domain controller = not set Allowed admin groups = domain admins,enterprise admins Authentication from any domain = Enabled Packet signing = allow Packet encryption = allow Password change interval = 14 Restrict Dynamic DNS updates = not set Namespace mode = domain
Besides, when Mac rejects her, I found an event of Kerberos pre-authentication failure:
Kerberos pre-authentication failed. Account Information: Security ID: domain\username Account Name: username Service Information: Service Name: krbtgt/sample.COM Network Information: Client Address: ::ffff:(mac ip) Client Port: 55959 Additional Information: Ticket Options: 0x40000000 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint:
I found that when the Kerberos failures exceeds our login policy limit, she will be locked out.
I suspect a blank password is sent. Any ideas?