How do I troubleshoot AD authentication after a SUCCESSFUL bind?

Question

In the Domain Controller Security Policy on my active directory domain (w2k3), I opened Local Policies -> Security Options and changed "Microsoft network client: Digitally sign communications (if server agrees)" to Enabled, and I changed "Microsoft network server: Digitally sign communications (if client agrees)" to Enabled. I then did GPUPDATE from a cmd prompt on the domain controller and I was able to bind with my 10.4.7 PowerBook.
But now that I am bound I still cannot authenticate with domain credentials. Yes, in SMB/CIFS I have set the workgroup to be the netbios name of my domain. And the clock is synced with the domain controllers. I have even edited my smb.conf file with the "realm = MY.DOMAIN" and "security = ADS" and "spnego = yes" lines (where, of course, "MY.DOMAIN" = my domain name). But when I get to the login screen and type in my AD username and password, I get the shaking screen. It's like it isn't even trying to authenticate me with the domain.
The computer account appeared in Active Directory with no problems. I have bound and unbound and rebound, to no avail (but, notably, with no errors in binding at any point).
I'm not even sure which log will show me the authentication process so I can check for errors.
Please help...
PBG4 17" 1.67GHz 2GB 100GB   Mac OS X (10.4.7)  

Answer 1

Hi Eric!
Most of your steps for binding are correct, however you don't need to modify your smb.conf file.
A couple of things that come to mind are:
1. When attempting to log in you may be using a local user name that is the same as an AD user name. The local user name will always override an AD user name.
2. Your AD domain may be incorrect. You may be trying to use an incorrect domain such as "subdomain.domain.com" when all you really need is "domain.com". This could still result in a bind but incorrect authentication.
Also, this may sound simple but have you made sure the Active Directory plugin in the Directory Service application is checkmarked and that your domain is appearing under the Authentication section?
After binding, you should be able to immediately go into the Terminal application and issue a switch user command using an AD user name ("su shortname") for testing. This will make troubleshooting easier than logging out and logging in again.
The log your looking for can be found in the Console under /Library/Logs/Directory Service.
Hope this helps! bill
1 GHz Powerbook G4   Mac OS X (10.4.7)