10.5.3: Can't Create Mobile Account

Question

I have a MacBook Pro that authenticates to Active Directory.
When I try to create a Mobile Account
[ System Preferences --> Accounts --> Mobile Accounts:Create ]
I get prompted to
"*Enter your password to create a mobile account*"
However, it does not accept the password, responding with
"*Incorrect password*"
After three attempts, I get
"*Mobile account creation canceled*"
and then logged off.
I've tried both my Active Directory account password, and the local administrator password. Neither work.
At least I can get that far; in 10.5.2, the Mobile Account:Create button was greyed out.
Is anyone else having the same problem? Is there a fix for this?
I'm going to be out of the office next week for a conference, and would really like to get this working before then.
UPDATE: When trying to enable FileVault for my A.D. account, I get the following message:
*You cannot turn on FileVault for this account.*
*This account is either a network account or the home folder is on a server. You cannot turn on FileVault for these types of accounts.*
This makes this problem more than a minor annoyance, as my company policy -- and plain common sense -- requires encryption enabled for laptops.
Message was edited by: Robert Racansky

Answer 1

Hi Robert
On the Active Directory Server SMB Digital Signing Requirements (there are two: Server and Client) need to be disabled. It's not enough to leave them undefined. Once that has been done make sure client clocks are within 5 minutes of the server's time clock. In the Network Preferences Pane make sure the mac is using the AD DC for resolving internal DNS Services and the Search Domain field is filled in with the appropriate AD Domain Name. It's also advisable to fill in the WINS Tab with the relevant information for the AD..
Launch Directory Utility and select the Services Icon (click Show Advanced Options to see this). Select the Active Directory plug-in and click the disclosure triangle to show Advanced Options. Leave everything as the default and select 'Create Mobile Account at Login'. Fill in the Active Directory Domain field with the relevant information. For example if the AD's FQDN is adserver.addomain.com then the information should be addomain.com. Now click Bind. In the resulting window key in authentication details for an account that has authority for the AD Domain. Typically this would be the AD admin account name and password. What follows next will be a 5 step process. Depending on how well the AD has been configured this should take anything from 5-10 seconds and possibly 1-2 minutes. If it takes a short time this will be a good sign as to the 'health' of internal DNS Services as well as the AD configuration. The longer it takes the more the likelihood of problems.
By the way there is no magic fix for integrating/binding mac clients to an AD Server. Over 90% of how well this goes will rest with how well the AD is configured.
If the bind has been successful you should see a Kerberos TGT (ticket granting ticket) has been created in /Library/Preferences. It will be a file called edu.mit.Kerberos. You can inspect this and it should show the relevant details regarding the KDC (Kerberos Distribution Center). If you now log out you should see the Log in window display the local admin user as well 'Other'. It should look like a shadowed head and shoulders in front of a star field. Select this and supply your AD name and password. Provided the AD admin has defined a UNC path in the Profiles tab for your account on the AD Server for home folder creation and that you have full read/write privileges for that folder then you should be logging into your locally created home folder that also gets created at the same time on the AD.
Its best if you sync when logging out as there have been problems syncing at other times. Mileage may vary.
Hope this helps, Tony