Setting up a new MBP (mojave) for a user to replace their iMac. Mac is bound to our Active Directory and test AD account can login and create mobile user without issue. The user that already has a Mac (managed, mobile account) cannot login using AD credentials. The user has never logged into the new MBP, and can still login to iMac with AD credentials. Things I have tried:

  • Unbind/Re-Bind to AD
  • Checked domain controller, no login attempt registered unless using incorrect password. The MBP computer object does authenticate with the DC and other user logins do too.
  • id <ad username> resolves properly showing the user.
  • Checked system.log, but nothing stands out. Searching username returns nothing.

Any ideas?

  • Date / time correct? Have you also checked System Preferences - Users & Groups - Login Options - Options - "Allow network users to log in at login window"?
    – Hefewe1zen
    Commented Mar 9, 2019 at 15:40
  • @Hefewe1zen Date/Time is correct. I made sure all users is selected in that preference. I also tried selecting only only the user as allowed to login via network. I'm focusing on it being something with the user account itself, since everything works for other users.
    – Arpan3t
    Commented Mar 9, 2019 at 23:46

1 Answer 1


Still not exactly sure what caused this, but here is what I did and it worked.

On the old iMac:

  • Unbound from domain and logged user out

In active directory:

  • reset the users password

Now I am able to login to the MBP with the AD network account to create the mobile account. Hopefully this helps someone else if they come across this. At first glance this just sounds like incorrect password, but using the right password would not add to the badpwdcount in AD, and using an incorrect one on purpose would. Also the original iMac & a Windows machine were able to login to the mobile account using the correct password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .