We have a domain running Microsoft Active Directory and in that domain there is a number of Mac computers running Leopard and later. Sometimes the users are met by a red dot at the login screen, saying "network accounts are not avalible". The user are still able to login, and we can SSH to the computer, but the user can't use all the domain functions. Is there a Terminal command that allows us to check if the user currently logged in is connected to the domain correctly?
A quick check that I will use is the id username command in terminal, replacing username with a user other than the one you are logged in with. For example, if I'm logged in as SJobs I would instead use the query id TCook, assuming that TCook is another user within the domain but not on this computer. This will attempt to query the domain for the specified username and return all of it's values. If you are not currently connected to the domain it will instead return "no such user".
If this fails I go back, check my binding, check my network connection, log out and login again.
Hope that helps!
From the Mac's shell, first try
dsconfigad -show to see what the binding is. If it returns nothing, then the Mac doesn't have any AD binding. You can also use
dsconfigad to force an unbind and then re-bind. In some cases it can be advantageous to delete the computer object from your AD.
If the binding appears correct, make sure that the Mac's system time is correct; too large a difference and AD won't allow a login. You can use
sudo ntpdate -u time.apple.com to update the system clock against Apple's time servers.
Finally, make sure that the Mac can communicate with your domain controllers; try the usual troubleshooting, such as pinging your PDC.