Weird AD Issue?

[#1]

This past week, several Macs here have started exhibiting problems at the login screen. Basically, a little over half the time, it will report that network accounts are unavailable, and will refuse to allow any AD user to log in (it waits a bit and then shakes the window). When I try to log in as the local admin (or any local user), often it reaches the barber pole and then just stops. Remote can still log in and force a reboot, and sometimes that fixes it for awhile.

Our Macs are configured with Casper 7.31, and bound to AD using ADmitMac.

I've encountered 6 Macs so far that have shown the same symptoms. Any ideas?

[ImAMacGuy]

We've had A LOT of problems with binding through admit mac. AM seems to
randomly drop the bind and we have to login to local accounts and rebind
them, setup the admin group, etc and then everything functions. We had
areas where we were doing that everyday for quite a while.

That was older versions of AM though, since native OS binding came out,
we haven't gone back.

John Wojda
Lead System Engineer, DEI
3333 Beverly Rd. B2-338B
Hoffman Estates, IL 60179
Phone: (847)286-7855
Page: (224)532.3447
Team Lead: Matt Beiriger

[#3]

Okay, then this begs the question... If this really is caused by ADmitMac and would be fixed by using the built-in AD binding, what can we do to eliminate the problems that caused us to switch to ADmitMac in the first place? The biggest problem we had was the delay in accessing SMB shares (as well as a significant delay at login time). We would also miss the SSO functionality that we have enjoyed since we switched.

By the way, the count is up to 7 now.

[Kedgar]

I'll follow up with some of the tweaks that have helped in my
environment using the built-in ad plugin.

Sent from Ken's iPhone

[donmontalvo]

I remember telling an IT manager that DNS scavenging should be enabled...it was like watching this clip (replace the word "refund" with "scavanging")...

http://www.youtube.com/watch?v=MGMoalQ9A18

Don

[Kedgar]

I don't know anything about your environment, but here are some things that
helped our implementation work well.

- Tweak DNS Scavenging in AD to clean up your dhcp scopes often (setting this too often can overload your DC's) - Make sure that DNS is resolving properly - Set the search domains statically per interface - Turn off IPv6 on all interfaces - Create/Modify /etc/nsmb.conf - http://support.apple.com/kb/HT4017 - http://www.macwindows.com/nsmb-conf-and-slow-SMB-file-sharing.htm
<-- I just ran across this one which helped with a slowness of listing files on a windows smb share

[#7]

Not entirely sure it's ADmitMac that's the problem, as we're seeing
almost identical behavior using the built-in AD binding.

Not allowing AD users to log in, not being bound, being bound with
duplicate domains in the search policy, long logins, local admin account
not able to log in, etc.

Might have to look into some of Ken's suggestions, though. See what can
be helped.

Bob

[#8]

Well, this is starting to happen more and more frequently. What should I do about this? Switch back to the native AD plugin? Try to fix ADmitMac?

I'd like a solution that will last, but if it becomes too urgent I will accept a quick fix.

[#9]

I guess for now I'll try to fix ADmitMac.

Ken, can you go into some more detail with your suggestions? (Assume I know almost nothing about AD.) I'm specifically interested in the DNS suggestions.

Thanks.

[Kedgar]

Hi Ben,

A while ago I had began to notice that when you would open Terminal on a
Mac, it would show the incorrect host name. When I would use nslookup to
lookup my IP, I would see maybe 5 different machine names for my one IP. What was going on here was that Active Directory wasn't removing the
dynamic dns names once a dhcp lease would be severed. I'm not necessarily
sure it this was causing any issues, but if nothing else it was really
annoying. Tweaking the time for which Active Directory cleans up it's own
DNS names for it's DHCP scopes can really reduce this. I think we were only
scavenging every 7 days... I'm not entirely sure what our Windows AD
Engineer set the DNS Scavenging setting to after I requested the change...
but it has really cleaned itself up since.

Another thing that I noticed that may or may not change anything is that
when you setup a Mac and give it a name, it is not set in one spot. You can
see this if you use scutil: scutil --get HostName . This will return
"HostName not set". The other parameters; LocalHostName, and ComputerName
are set properly at install time. If not set, the Mac will use whatever
Active Directory DNS thinks your hostname should be. To fix this: "sudo
scutil --set HostName yourhostname"

Besides those, there is not much to worry about with DNS if you are able to
return forward and reverse lookups using dig and nslookup. Another good dns
lookup tool to play with is host.

As far as the /etc/nsmb.conf file... just test it out and see if it helps or
hinders your performance and needs. The file does not exist by default, you
will need to create it, I use vi or vim, but you can also use nano or
whatever text editor you prefer. Mine looks like this:
#####
[default]
streams=no
notify_off=yes
#####

I have always steered away from using AdmitMac or any other product that
helps you bind. One of our sites was using DAVE which really messed things
up as far as file forks and such on the servers. I've also not got a lot of
help from Apple whenever we have an AD problem, we've always been able to
resolve the issues before they can even figure out why something is
happening. My experience with Apple's support has been frustrating as they
have never ended up resolving any issue I have brought to them. I suppose
maybe you can get better support from AdmitMac than you may get from Apple.

Thanks,
Ken

[#11]

I noticed if you are using AD that if DNS updates are Secure only, my DNS table gets very cluttered. On all internal DNS servers I set updates to Secure and Non-secure. I removed all dynamic DNS records (after 5pm). The next day it started working properly.

Also, I set DHCP to "always dynamically update DNS A records..."

I work with many AD Networks and doing the above changes has helped me.

Geoff Hall
Office: (806) 677-5264
Cell: (806) 676-9741
geoff.hall at esc16.net
Networking Technology Specialist
Region 16 Education Service Center
MCP, MCSA+Messaging, ACSP, ACTC, ACMT

[tlarkin]

I don't use AD but read through countless threads and emails about it I know that the main culprits of problems like:

DNS Kerberos Bindings

[#13]

Ok, it looks like the logs are saying that the computer's account password is invalid. Could this be caused by DNS misconfiguration? I now have a computer that is exhibiting the issue to try things out on (for the day, then I have to get it back to the user).

[#14]

Ok, so it looks like it's getting eDSNodeNotFound (-14008) when it tries to access "/ADmitMac/WAS.INT.IMF.ORG". I tried "cd"ing to that node with dscl, and I got eDSUnknownNodeName (-14009). I've seen similar symptoms on my admin workstation (the only Mac bound using the native AD plugin) around the same time that this mess started. I can't imagine that the problem is originating from any workstation, so it must be one or more servers. What should I tell our server guys to look for?