Cannot login with Active Directory Account

Question

Hello,
I am testing SnowLeopard (10.6.1) for deployment in my labs for the Spring 2010 semester. We use local home directories. This is a brand new fresh install of SL, on a freshly formatted Hard Drive.
When bound to Active Directory I can get any AD account that I've tested (5 different accounts) to authenticate except one, which happens to be my own personal AD account.
The secure.log shows these entries when I attempt to login:
Oct 9 14:18:29 mac-0017f20fc40 SecurityAgent[209]: User info context values set for ctarbox
Oct 9 14:18:29 mac-0017f20fc40 authorizationhost[208]: Failed to authenticate user <ctarbox> (tDirStatus: -14090).
Considering that I could log in with other accounts, and after resetting my AD password then still not being able to authenticate, I came to the conclusion that I had a corrupt OU in Active Directory.
I contacted one of our AD admins and had him delete both of my AD accounts: ctarbox and ctarbox1 then recreate both accounts. I still cannot login to AD with my ctarbox account.
I can still login to my current lab machines anywhere on campus running 10.5.8 with ctarbox.
I am baffled by this. I have been authenticating to Active Directory since 10.1 and have never seen anything like this.
Any idea, anyone?
Cheryl Tarbox
Macintosh Support Specialist
Binghamton University

Answer 1

I have found the solution to my problem. I have accounts in two different domains in our AD tree. I'll called these domains Domain A and Domain B.
Domain A is the primary domain for authentication to our public computing labs.
Domain B is a secondary domain for authentication to shared resources for faculty/staff.
Both accounts have the same user ID, but different passwords. In my Directory Utility>Advanced>Administrative window I have the option "Allow authentication from any domain in the forest' checked.
With this option checked Directory Utility in 10.6.1 will allow me to authenticate Domain B, but not Domain A.
With this option checked in Directory Utility in 10.5.8 just the opposite is taking place, I can authenticate to Domain A, but not Domain B.
It seems that somewhere in the upgrade to 10.6.1 the search policy for Active Directory has changed. My workaround is to uncheck this option and specifically choose Domain A in the search policy.