Skip to main content
Solved

This computer is already 'bound' to Active Directory. You must 'unbind' with '-remove' first.

  • April 3, 2013
  • 27 replies
  • 220 views

Show first post

27 replies

Forum|alt.badge.img+7
  • Contributor
  • August 24, 2015
@Bhughes So you have your AD binding triggered on enrolment? Why not scope to a smart group that has directory status "not bound" & the policy is triggered post enrolment?

Thanks for the idea @bentoms a co-worker was able to solve the issue by removing the ad bind: /usr/sbin/dsconfigad -remove -force -u a -p a

in our computer naming policy that runs first.

Then created a custom event called "adbind" to run after naming the computer.


Forum|alt.badge.img
  • New Contributor
  • March 22, 2016

If your AD binding account has permission to join an existing account, pipe the yes command. If unbinding did not happen or did not happen correctly, or if the machine account still exists, the system will continue to bind assuming 'Yes' to "join to existing account".
/usr/bin/yes | dsconfigad -add DOMAIN -computer scutil --get ComputerName -username binduser -password pass -ou "ou=path"