Question

Macs Prompting for AD User Change

Forum|Forum|6 years ago
September 20, 2019
4 replies
22 views

+14

jared_f
Valued Contributor

Hello All,

We are running into an issue where any Jamf domain bound Mac is prompting for the user to reset his/her password on login. I have the bind pushing via a configuration profile (it was set up like that when I arrived). This only happens when a user arrives on campus for the first time or it is there first time logging into a campus Mac. As we are SSO w/ Google Apps this is causing loads of issue. AD team thinks it is our issue. Has anybody run into this?

Thank you,
Jared Flitt
John Carroll University ITS

A

+18

alexjdale
Contributor
Forum|Forum|6 years ago
September 20, 2019

Interesting. It sounds like the AD flag to require a password change at next logon is set for new users, which is a pretty common AD config. The AD team confirmed that's not the case?

Like

J

+14

jared_f
Author
Valued Contributor
Forum|Forum|6 years ago
September 20, 2019

@alexjdale They have confirmed so. These are users that have previously used their logins on campus. Weird issue :/

Like

+15

mark_mahabir
Jamf Heroes
Forum|Forum|6 years ago
September 24, 2019

Interesting. I have run into this over the last 12 months or so on our lab Macs, but don't yet have a solution.

The issue was present in macOS 10.12 and remains after upgrades to 10.14. We use an AD binding script rather than a configuration profile.

Incidentally, I've never seen the issue on our staff, non-lab Macs. The only difference there is that we re-use values for the uidNumber and gidNumber attributes in AD from our LDAP server (used for our linux machines). Our lab iMacs use system-generated values for these attributes.

The plan here is to move to either NoMAD or Jamf Connect in the next year or so and come away from AD binding. That project will also involve us leveraging the Jamf AD-CS Connector as our staff Wi-Fi network relies on device-based authentication from domain joined computers.