Hi, sorry I dont check this account's posts very often.
Before I continue, I just want to tell you that for all those that dont believe this has to do with DNS specifically, you can contact a level 2 apple engineer and if he has any networking experience, he can confirm this to be the case.
The most probable cause (if computer was already bound and working fine) for Network Accounts unavailable has to do with DNS between the client computer and DNS server, in most cases the Active Directory server which is running the DNS as well.
Ok, so if you right click the DNS server and you change those settings to what I wrote, I can almost guarantee you will resolve your issue.
Which part of the process you dont understand so I can be more specific? (I edited post to include image of the scavenging settings I have).
The reason DNS breaks communication with client/host which in turn breaks AD communication is because the scavenging settings are sometimes too soon and remove DNS Host(A) records if the client and server dont have that constant communication which in turn break the communication between the client the server.
-ea
EA for determining AD bound status
#!/bin/bash
OSvers=$( sw_vers -productVersion | cut -d. -f2 )
## NOTE: Change "dc.domain.comp.org" to an internal master domain controller,
## or some other internal device for the ping command
if ping -c 2 -o dc.domain.comp.org; then
## Mac is on the network, continue
if [[ $(dsconfigad -show | awk '/Active Directory Domain/{ print $NF }') == "company.com" ]]; then
ADCompName=$(dsconfigad -show | awk '/Computer Account/{ print $NF }')
## Mac has correct dsconfigad info, continue
if [[ "$OSvers" -ge "7" ]]; then
## NOTE: Change the "DOMAIN" in the command below to your domain name
security find-generic-password -l "/Active Directory/DOMAIN" | grep "Active Directory"
if [ "$?" == "0" ]; then
## AD keychain file exists, continue
## NOTE: Change the "DOMAIN" in the command below to your domain name
dscl "/Active Directory/DOMAIN/All Domains" read /Computers/"$ADCompName" | grep -i "$ADCompName"
if [ "$?" == "0" ]; then
## Successful lookup of computer record. AD communication is working
res="Yes"
else
res="No - AD Lookup Failed"
fi
else
res="No - AD Keychain Not Found"
fi
else
if [[ "$OSvers" == "6" ]]; then
## OS is 10.6.x, moving on to AD lookup
## NOTE: Change the "DOMAIN" in the command below to your domain name
dscl "/Active Directory/DOMAIN/All Domains" read /Computers/"$ADCompName" | grep "$ADCompName"
if [ "$?" == "0" ]; then
## Successful lookup of computer record. AD communication is working
res="Yes"
else
res="No - AD Lookup Failed"
fi
fi
fi
else
## NOTE: Change the "domain.comp.org" in the command below to your fqdn
res="No - Not Joined to domain.comp.org domain"
fi
else
## Mac is not on the network or has no network connection
echo "Not connected to company network"
res="Remote"
fi
echo "<result>$res</result>"Force Unbind script
#!/bin/sh
# Use this to force a computer to unbind from Active Directory.
# Then use JSS to re-join to the domain
# https://derflounder.wordpress.com/2013/10/09/force-unbinding-with-dsconfigad-without-using-an-active-directory-admin-account/
dsconfigad -force -remove -u johndoe -p nopasswordhere
sleep 6Build a Policy that runs at recurring check in and is scoped to a smart group with the following criteria:
The Script is the one above.
Directory Binding is whatever you have configured for Directory Binding.
Maintenance is to run Inventory
-Ignore Files and Processes in this screenshot. I run an extra command for our internal purposes that has no bearing on the fix.
