Recent Issues Binding to Active Directory

New Contributor II

This is not necessarily a Jamf/JSS question but there are a lot of smart people here so I figured it would be a good place to ask. I have always done my binding manually and not through our JSS.

I am having issues binding any Mac system to Active Directory. I have bound hundreds of Mac’s to our 2008 R2 domain now for the past 5 years without any issues. It appears that about a month back this stopped working and I cannot figure out how to get it working again. Here are the troubleshooting steps I have tried to far:

Tried binding two different machines
Tried binding clean install 10.9, 10.10 and 10.11 systems
Tried binding on two different VLAN’s
Tried binding connected to different network ports
Tried binding using Apple’s time server and our local NTP server
Tried binding manually using “dsconfigad”

It does not matter what I try to do it will not work. The error I get every single time is:

“Unable to add server.”
“Authentication server could not be contacted. (5200)”

I can ping the domain and nslookup resolves correctly for both the workstation and the server.

If anyone else has a suggestion it would be greatly appreciated. Thanks!


New Contributor II

Anyone have an idea?

New Contributor III

Can you manually get a kerberos ticket (kinit $USER@DOMAIN.COM)? This will positively rule out any possible time related issues and prove you can actually get to the domain server. If that works or throws an error that doesn't take sense, the next best thing to do is to run on debug logging for opendirectoryd.

sudo odutil set log debug

The log is in /var/log/opendirectoryd.log. Then try to bind with dsconfigad. This will give you more than enough information to diagnose the problem. Once you've finished, you'll want to turn off debugging with:

sudo odutil set log default


New Contributor

Configure Client Machine DNS