AD and Local Network accounts take three attempts to log in successfully

Question

Our lab's Mac Mini server is running a patched-up 10.9 + OS X Server (though this problem has persisted since 10.7)
Our server is 'local' to our laboratory and serves 4-5 machines, 10-15 people.
The server (and the connected machines) are bound to the college's Active Directory server.
We have a 'Local Network' group  (called FlipLab) on the Server that contains laboratory members from the AD server.
The lab client machines are set to only allow network logins from that group. We also have an occasional 'visiting' scholar who doesn't have a college-wide AD account, so we set them up as a 'Local Network' user and add them to the FlipLab group so they too can log in to the lab's machines.
About 75% of the time, a user logging into a lab machine take three attempts to get logged in successfully. We've noticed that they don't need to re-type the password or username each time, just once and hit 'enter/return' three times in the password field. It never takes two tries- only either one (very rarely, usually after successfully logging in earlier in the day) and more commonly three tries.
This doesn't seem to happen with file sharing (though I think one of the guys has noticed an occasional problem logging in to a SMB share from a Boot Camp'd machine). It isn't a problem w/ Time Machine backups either. BUT We recently noticed that even the 'Local Network' users (e.g. belong to the FlipLab group but don't have AD credentials) occasionally have this problem. Hitting 'return' three times in the password field gets you logged in though in any case (well, assuming you have your password correct).
I've tried moving around the directory search order on the client machines, but not in a systematic-enough way.
Since we can get logged in this isn't the worst problem ever. But I'd like to be able to figure out what is going on - and maybe learn something about configuring it in the process.

Answer 1

Thanks- good observation.
Unusual, perhaps, but it is what we need in our setting. And- allegedly this is supported / encouraged based on my understanding of the OS X Server docs. I don't have any control over the AD server (since it's in the university-level IT management's hands) but I -do-, of course, have control over my own server. So I just want to use their authentication (and save my students / lab folk the trouble of having multiple logins, etc).
You make a good point / observation / point-of-debuggery. Indeed, if I set the client machines to use -only- the main campus AD server (and thus allow logins from everyone on campus) it works first time. So it is some interesting interaction betwixt the Mac OS Server and the client methinks. In fact, across campus, all the 'public' machines are simply bound to the AD server and you can just log in that way.