10.7.2 & Active Directory

Question

I know that Lion first two releases has issues with Active directory.. but Im using 10.7.2 now and I was able to bind my Mac to the main domain but not with the child domain..
main domain: domain.com
child domain: test.domain.com
I'm able to bind 10.5 & 10.6 with the child domain just fine.. but not 10.7, and when i try to bind 10.7.2 it goes through the process and then dsplay an error message: Authentication server failed to complete the requested operation.
Any idea ?

Answer 1

I was having the same issue and it seemed to stem from a mis configuration in Kerberos. I nuked the local KDC and the bind worked as expected.
Destroy Local KDC:
sudo rm -rf /var/db/krb5kdc
sudo rm -rf /etc/krb5.keytab
sudo rm -rf /Library/Preferences/edu.mit.Kerberos
Bind the Server to Active Directory.
Also - and I'm not sure if this had any effect, but in our Domain our Admin accounts are in a different forest than the computer accounts and standard user accounts, this is usually not an issue, but just to be safe, instead of allowing the AD plugin to create the computer object I created it in the correct OU first and made sure that my standard user which lives in the same forest had permission to join that object.