Skip to main content
Question

Local AD Binding Issues

  • Nov 5, 2026 2:03 PM UTC
  • 2 replies
  • 18 views
Forum|alt.badge.img+7

I know I will be flamed for still binding to Local AD in this day and age but this issue has come to light after changing out M1 MacBook Airs for M5 MacBook Airs.

 

The issue:

When a user initially logs in to their MacBook using their AD credentials, the mobile account is created and everything is great until the password is changed.

 

Example:

  1. Initial login on-prem with AD credentials, mobile account is created. Everything is happy. 

  2. User forgets or has to change their password.

  3. While connected to our network the user can successfully log in to the Mac. 

  4. When the MacBook is disconnected from the network or connected outside our network, neither password will work.

 

Troubleshooting:

  1. Rebooting on internal network, no change. 

  2. Un-bind and re-bind to AD, no change.

  3. Removing their account from Users & Groups and going for a fresh login, no change.

  4. A combination of the above steps, no change. 

  5. Resetting/re-syncing the SecureToken, no change (this has worked in previous macOS releases.) 

 

The only success I’ve had is wiping the machine and setting it back up again, but that is a lot of work and annoying for the user. And since we’re creating mobile accounts on initial login, I don’t think it’s possible to switch to Kerberos SSO; or at least not without converting everyones mobile accounts to local.

 

In the past we’ve tried to deploy JAMF Connect with no success; apparently it is not possible to utilize Cisco Duo MFA and LDAP with JAMF Connect.

 

I know this is happening for other folks but am not having any luck figuring out why this is happening. 

2 replies

Chubs
Forum|alt.badge.img+26
  • Chubs
  • Jamf Heroes
  • Nov 5, 2026 2:54 PM UTC

Yea DUO is like Shibboleth - “Supports OIDC” but no ROPG.

What that means is that you can use Jamf Connect Login, but not the password syncing utility (ask me how I know...I set this up with Shib).  

We ended up using Jamf Connect namely for the login piece and used the NoMAD client to sync on-prem creds to the device.  It was a hack job, but it worked.

The thing about your AD bind is that in a previous life to get it to work, I had to rebind on every reboot.  It was jankey.

I find your lack of faith disturbing
Person
Forum|alt.badge.img+12
  • Person
  • Jamf Heroes
  • Nov 5, 2026 3:45 PM UTC

I've used the Kerberos SSO extension with AD-bound mobile accounts, and it has worked fine for the most part. Apple does state that password synchronization through Kerberos SSO isn't supported with mobile accounts, but that didn't present a noticeable problem in our environment. The Kerberos extension would prompt them to authenticate again with their new AD password as long as they were on AD.  You don't really have to convert everyone to local accounts to take advantage of it.

The main problem with it is that password synchronization part. Kerberos SSO will still obtain tickets and authenticate against AD, but it won't automatically resync a mobile account's cached password following an external password reset off AD.  We stressed to our users to change via a web portal and wait a little. We also disable any notification at loginwindow to prompt for password change to help.  We also set PasswordExpirationDays to 0 under com.apple.loginwindow to prevent users from being prompted to change their AD passwords at the macOS login window. We preferred having password changes handled outside the login window to avoid synchronization issues and while they were using it.   
 

My biggest hurdle AD was Filevault password sync issues and turning off and on the SecureToken.

 

Terms & ConditionsAccessibility statement