We've recently had a rash of systems that suddenly cannot talk to the Active Directory Domain. We haven't identified exactly what's happening, but the symptom is that the user cannot change their password from the Accounts Preference Pane, being told they do not have permission and to speak with an administrator. If they change their password externally to the Macintosh (using a Windows system, or another password management tool), then their keychain password and AD password get out of sync and various other issues ensue.
I wrote the following extension attribution after doing some research and we can now identify the systems having this problem and proactively fix them (the only fix we've found is to re-bind the system to the AD Domain):
#!/bin/bash
domain="YOURDOMAIN"
user="someuser"
# Can we query a UPN?
domainAns=`dscl /Active Directory/${domain}/All Domains -read /Users/${user} dsAttrTypeNative:userPrincipalName`
if [[ $domainAns =~ "is not valid" ]]; then
result="Invalid"
else
result="Valid"
fi
echo "<result>$result</result>"Now, hopefully we can figure out why it's happening and fix it.
