We have three MacOS machines, all running 10.4.x, bound to our Active Directory network. The domain has two DCs on a single subnet (192.168.1.0/24). One of the DCs (the secondary one, which does not hold any of the 5 FSMO roles) is currently off-line. It's physically shut-down because its boot volume is hosed.
Since the secondary DC went off-line, two of the three Macs have been unable to do standard Active-Directory authentication. I can't log in to either of them as an AD user, I can't use AD credentials in a UAC prompt, and I can't even run "Directory Access" -- it starts up but then becomes unresponsive and I need to force quit to close it.
I can, however, get a Kerberos ticket for an AD user, with the "Kerberos" GUI utility. And when I run 'dsconfig ad -show' on one of the offending Macs, I see the primary DC (the one that's actually running right now) in the "Preferred domain controller" line.
And all of our Windows machines (running XP Pro) are authenticating just fine against AD -- which would rule out any replication problem, I think.
Just wondering what I can do next to troubleshoot this.
Update on Friday afternoon, August 7
Both machines just stopped having AD trouble. I did restart them both, but I had done that twice before with one of them, to no avail. So I guess the question has become academic at this point. Still interested in hearing how anyone else would troubleshoot this.