AD account Login problem with MAC 10.6.8

Question

Hi All,
We have around 50 odd MAC that are connected to windows server 2008 R2. the user were logining in to these MACs using their AD account. Recently few of the random MAC did not allow the user to login using their AD account.When analyzed though the MAC shows that it has connected to the Domain and the server is active with green button it has unbind itself from the server.I had to login in as local user bind the MAC back to get this resolved.
Now the same has started happeneing for most of the MAC that we have and every morning I have login as local Admin and unbind / bind the MAC with the server. this gets reset once the user reboots or shutsdown.
Have tried with few of the below solution but nothing helped:
Solution 1:
<key>mdns_timeout</key>
<integer>2</integer>
The integer value is in seconds; changing it to at least 5 should allow the Mac OS X client to reconnect to the Active Directory domain after a network interruption. In some configurations, a larger timeout value may be required.
You can change this value by using the sudo command and a text editor to edit the preference file directly. Or you can use the Terminal command below, making sure to enter it all on a single line:
sudo /usr/libexec/PlistBuddy -c 'Set :mdns_timeout 5' /System/Library/SystemConfiguration/IPMonitor.bundle/Contents/Info.plist
Solution 2:
I have seen all of the probable solutions and tried everything and still I am getting issues with 10.6.6 and after rebooting the Mac gets unbind. Or the Mac gets Network Accounts Available even when not accessing the list of users from AD. But the thing that I have done that has solved all my issues with AD on the Macs is to uncheck the box to search on all domains. For some reason I am seeing that when the Macs have this option checked, it searches through out the forest on the same domain controller more than once, so AD stops the handshaking of the authentication.
I hope this helps like it did on our Network, since then I have not seen the Macs lose the binding or slow SMB.
If you've tried this please let us know.
TIP: Uncheck Allow Authentication from any domain for Mac AD problems
Wednesday, April 20, 2011
Steven Wells sent a fix and an explanation of problems with Macs losing their binding to Active Diretory:
Unchecking "Allow authentication from any domain in the forest" is working at our college. We have been beating our heads on this for about 2 terms, with no understanding of why it works in some places and not in others. When we found this working, our IT guy said that the Security SID is being duplicated, when it looks in other domain forest, and that is what is causing the problem. This is the first time I have found an explanation for the problem.
If you've tried this approach please let us know.
Solution 3:
Solved it. Create a file in Textedit with the name 'auto_master' (no file extension) with the following contents:
# Automounter master map
+auto_master # Use directory service
/net -hosts -nobrowse,hidefromfinder,nosuid
/home auto_home -nobrowse,hidefromfinder
#/Network/Servers -fstab
/- -static
Place this in /etc/ folder
Hope this helps
solution 4:
TIP: a Kerberos fix for OS X 10.5 and 10.6 binding to Active directory
Friday, November 11, 2011
Mehdi Mafi forwarded a fix he found for problems with Leopard and Snow Leopard binding to Active Directory:
This was taken from Dane Riley's imaging building for DeployStudio.
With Mac OS X Leopard every Mac is now running a KDC (Kerberos Distribution Center). Basically each imaged machine is using the same security certificate and hash. Deploying a single image will deploy the same KDC to every system. This [Apple] article covers how to reset the local KDC so that each system is unique. Basically, do the following:
Launch Keychain Access
Search for com.apple.kerberos.kdc and delete all 3 items
Using Terminal type sudo rm -fr /var/db/krb5kdc
After deployment, perhaps using Apple Remote Desktop to all systems, re- establish the KDC by typing sudo /usr/libexec/configureLocalKDC
If you've tried this approach with Mac OS X 10.5, 10.6, or even Lion, please let us know. .
TIP: More on a kerberos fix for AD binding problems
Monday, November 14, 2011
Mehdi Mafi updated his Friday report about Mac OS X 10.6 problems binding to Active Directory:
You may want to add this. If the Mac keeps unbinding from AD (people can't log in to a Mac), here is how to fix it:
Unbind it from Domain
Launch Keychain Access
Search for com.apple.kerberos.kdc and delete all 3 items
Using Terminal type sudo rm -fr /var/db/krb5kdc
Re-establish the KDC by typing sudo /usr/libexec/configureLocalKDC
Bind it to domain again ( When you bind, uncheck allow authentication from any domain in the forest in: Directory Utilitiy-> Advanced Options\Administrative ) this fix the issue that sometimes it can' find AD under search space.
If you tried this please let us know.
Solution 5:
For Snow Leopard AD login issues, use upper case domain
Solution 6: for .local
To create this StartupItem, create the following directory as root:
/Library/StartupItems/FixADAuth
Then chown it to root:wheel and chmod it to 755. These must also be the owner/permissions on the two files it will contain, below:
Contents of our /Library/StartupItems/FixADAuth/FixADAuth:
#!/bin/bash
. /etc/rc.common
date > /var/log/FixADAuth.log
n=0
AuthSuccess=0
while [ $AuthSuccess != 1 ]
do
id Administrator && AuthSuccess=1 || networksetup -setsearchdomains Ethernet "Empty"; networksetup -setsearchdomains Ethernet middlewich.local; n=$(($n+1))
done
echo Authentication successful: $AuthSuccess >> /var/log/FixADAuth.log echo Operation count: $n >> /var/log/FixADAuth.log
date >> /var/log/FixADAuth.log
Contents of our /Library/StartupItems/FixADAuth/StartupParameters.plist:
Description = "Fixes Active Directory authentication issue";
Uses = ("Disks");
Obviously you'll need to change "middlewich.local" to your own domain name (and the network interface name if your connection is wireless). The script checks to see if it can see the user "Administrator" on the domain, as he's a fairly common bloke, but if you've renamed yours for security reasons then pick another one. I've also included some logging functionality for debug purposes, so you can verify how well the script is working if you need to and time it in your environment before telling the users how long to wait. The /var/log/FixADAuth.log file will contain the date/time the process started, the success variable set to 1 (just to verify), how many DNS operations were required to fix the problem, and the date/time it ended. For us the time difference is normally about +30-40 seconds with around 120-180 operations taking place. Once you're happy with the script, you can strip it down to its bare functionality if you like, like so for us:
#!/bin/bash
. /etc/rc.common
AuthSuccess=0
while [ $AuthSuccess != 1 ]
do
id Administrator && AuthSuccess=1 || networksetup -setsearchdomains Ethernet "Empty"; networksetup -setsearchdomains Ethernet middlewich.local
done
I hope this helps someone!
Regards

Answer 1

You are welcome.
But the question is 10.6 mac  just like 10.6.8  , as long  as its the same and works.
Yes. You can save some updates by using the combo update.
10.6.8 Combo Updater