Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've got a setup where I am trying to rescue a broken AD. We can no longer authenticate on the Workgroup manager, with passwords being rejected all the time - even though it is correct. I can connect using the workgroup manager on another server and I get the user list as expected, but when I click the padlock to make changes, I get the following screen:

enter image description here

The problem is, I know the password is correct, I just used it to connect to the server in the first place.

I can log into the server using the local admin, and services such as AFP, VPN and SMB continue to serve users. I have about 300 or so users on this server, and I would very much like to avoid having a rebuild.

As there is much configuration that has been done without my knowledge (it's a client machine), I'd like to attempt to fix it, and then create another server and migration OD off this broken machine, then decommission it "gently". Ultimately this would mean no disruption of services.

What I'd like it some tips as to how to fix the problem with authenticating to make changes in the work group manager, and maintenance on open directory in general.

share|improve this question

1 Answer 1

What URL are you using in WM? It should be whatever sudo changeip -checkhostname returns, but even if that fails, use Also if changeip returns a problem, make sure your DNS settings are OK.

It also looks like you're trying to manage your Open Directory instance. By default, Open Directory has a different primary admin username called diradmin, so using your built in admin account wouldn't work.

share|improve this answer
I am using the diradmin account - I will take a look at the DNS - thanks for the tip. I'm using the FQDN, but I havn't checked who the server itself thinks it is. I'll update you in a few moments! Thanks again –  Mister IT Guru Feb 23 '12 at 11:21
To further clarify - I can run WM and connect to the server, and enumerate users, it's when I click on the padlock to make changes, that I get the error in the screen shot above. –  Mister IT Guru Feb 23 '12 at 11:22
sudo changeip -checkhostname run locally on the server in question returns, "The names match. There is nothing to change." I was quite sure that my DNS was up to date and correct –  Mister IT Guru Feb 23 '12 at 11:38
You may have to revert to using dscl to work with it. man dscl for more info. –  churnd Feb 23 '12 at 11:59
I rebooted the server, logged in as diradmin, and everything seems to work just fine? Confused I am - I still get some errors adding users, but the users still add, and I've a number of updates to run on the server. I hope this will fix the remaining bugs. –  Mister IT Guru Feb 23 '12 at 14:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.