Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Anyone have experience binding a 10.5+ workstation to a 2008 active directory structure. We tested this functionality in our test domain prior to upgrading and saw no issues. Now that we've upgraded the production environment, we're getting invalid username/password errors. We are pre-creating machine accounts (as we always do) and I've tried binding with OU admin level and enterprise admin level privileges. Same error comes back from both. Communication to the domain seems to be working, as it finds a DC properly (DNS forward and reverse are fine) and it also finds my pre-created computer object and asks to bind to it. I've also tried deleting the directory service info and tried to bind from scratch with no luck. I've been beating my head over this for a while and could use some help.

UPDATE 3: Traced back to possibly an issue with the krbtgt user. As binding fails when executing a changepw command on the computer object. Microsoft and Apple are currently working together on this, and I will update with a solution when one is reached.

UPDATE 4: Hotfix to correct this issue is in the answer below.

share|improve this question
Do you have alot of DCs? We were able to get Macs working great with AD in a smaller domain, but had zero luck once we went to our larger domain. – duffbeer703 Jul 21 '09 at 19:30
We have 4 DCs, not sure I'd call that alot. This error is a new development since the upgrade to 2008 (forest and domain functional level). Our # of DCs has not changed in many years. – Tatas Jul 21 '09 at 20:30
up vote 2 down vote accepted

Install this hotfix if you are suffering from this issue. It results from having previously performed an authoritative restore in your domain. This fixed our problem.

share|improve this answer

I am not at home at present so I can't look at my Mac. However I believe you are looking for the "Directory Utility" which would be installed in Applications->Utilities. Last time I had to do this config I did it in 10.4 but it well well then.

One problem I ran into though is sometime windows dynamic dns would get two records for the same machine and things would break. You can check for this by running "hostname" in terminal and seeing if you get more than one name.

Another problem is time sync. AD uses kerberos and time cannot drift more than 5 minutes between DCs and the client. I owuld set up the DC as your time server at least as part of a test to rule this out.

Next try creating a new AD object with a different name. Sometimes bot doing that caused problems. I found that with the right group membership (tt is slipping my mind, "Power User" perhaps) I didn't need to pre-stage my machines in AD. I would just move them to right OU later.

share|improve this answer
Thanks for the response. I know all about Directory Utility we've been binding our macs to AD for years. It's not a kerberos timesync issue, I've verified that already. And it's easiest for everyone here to pre-create our accounts, we have a highly distributed environment and do not allow our OU admins to create accounts in the default computers OU. What I'm seeing is a specific error that I get from Directory Utility. We've dealt with a similar error in previous versions of OSX when binding, but all the old fixes aren't working. Can post directoryservice debug log if you want. – Tatas Jul 21 '09 at 20:29
I am happy to take a peek. However I no longer have the Mac & AD environment to kick around though since I have changed jobs so my knowledge is a bit dated. – TimDaMan Jul 21 '09 at 21:03
Everything I see points to a kerberos issue. Some admins at a few other universities have confirmed that this is indeed an issue, however their fix of "rebuild the domain" isn't an option. :-( I'll post the debug log tomorrow. – Tatas Jul 21 '09 at 22:57

You may want to check these other questions on ServerFault as well for some hints:

Are you getting the errors during binding or after binding? What is being spit out in

share|improve this answer
The errors are during the bind process. Specifically at stage 5 of 5. I'm still heavily leaning towards a kerberos negotiation issue. It seems as if the AD servers do not like the kerberos credentials I'm passing to it. I plan to post the directory service debug log tomorrow when I get back into work. – Tatas Jul 22 '09 at 0:33

Not sure if it applies here, but I am having the same problems. Found this:

Good luck.

share|improve this answer
Thanks for the support! We are still working on this issue. Ughh. I've run those troubleshooting steps however. Thanks for them. I've narrowed it down to an issue with the krbtgt user. Apparently, the SPN associated with it "kadmin/changepw" is not being found properly in our production domain, but it is in our test. I'm still planning to update the ticket when I have more. – Tatas Aug 12 '09 at 16:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.