We are trying to get binding working through Big Sur. Our configuration profile for binding worked previously in Catalina, but now it doesn't work on Big Sur.
When looking at Active Directory, the machine says it's binded but we can't seem to log in with our domain accounts.
Does anyone have this issue in Big Sur? Any suggestions/tips would be appreciated.
While binding might work for non-mobile, shared devices (e.g. iMac in a lab), it can be a headache for mobile devices deployed in a 1:1.
I'd recommend looking at alternatives to binding, like the Kerberos Single Sign-on
Extension. Pair this with authenticated enrollment and pre-setting the local account full name and short name to match the directory, and you have most (if not all) of the benefits of binding without the headache.
Just my $0.02
@cbrewer We were able to fix the plugin error by adding the computer to our Windows AD list. However, even though manual binding is a successful now, we still cannot log in with our domain accounts. We're pretty stumped at the issue. I will update this post once we figured whats with our binding method and Big Sur.
Do you have the same issue if you use a script? Sample below:
#Bind to AD computerid=`scutil --get ComputerName` dsconfigad -f -a $computerid -domain ad.yourcompany.com -u "adbindingaccount" -p "adbindingpassword" -ou "OU=OUWHERETHEYWILLLAND,DC=ad,DC=yourcompany,DC=com" sleep 1 #set advanced options dsconfigad -useuncpath disable sleep 1 dsconfigad -passinterval 0 sleep 1 # Enable encryption dsconfigad -packetsign require dsconfigad -packetencrypt require # Restart opendirectoryd killall opendirectoryd sleep 5
I have started experiencing this exact same problem on the new M1 Mac minis we have gotten. I have gathered the logs and submitted a report to Apple, and am now working with one of the techs on this issue. I have 31 Mac minis I need to get working, so it's a priority for me and will share whatever resolution Apple offers.
Any update on this? M1 Mac Mini's we are needing to bind for a shared lab setting. Having issues binding. 5200 error.
Console entry says 'KDC is unreachable - 'unable to reach KDC in realm '__our AD domain name__', tried 0 KDCs'
Was looking at this: https://www.blackvoid.club/how-to-join-a-mac-in-microsoft-active-directory/
That was published in 2019, these computers are 11.3 Big Sur and do not have a /etc/krb5.conf file, they have a krb5.keytab file though.
Has anyone received any updates? I am experiencing this issue with all M1 computers. I can connect to AD but no one but a specific group of users can sign in. Where as intel computer has no issue letting anyone sign in. (OS does not seem to be affected as some intel computers are on Big Sur 11.5 and bind and connect with no issue)
Apple is aware of the issue, as I have put in a support ticket. They don't plan on addressing it, until the release of Monterey. I had to find some intel Mac minis and not replace some iMacs while I wait for Apple to iron out the problem. Something about DNS not being updated correctly, when binding to AD and a multiple domain environment. The ticket is still open with Apple.
Long story, short, I have to wait for Monterey but still could not get a clear definitive answer if it would actually fix the problem.