Nick Vasilopoulos sent us a fix for problems with mobile Active Directory accounts for Lion clients. He had tried a number of fixes we've reported, including last week's Apple IPv6 fix, to no avail. Finally, what worked was "ditching WINS" and binding in a particular manner:
Thanks for the great site. I've been battling this issue for quite some time now, sometimes it works, and sometimes it does not. But reading one of your users posts (it didn't work) led me onto a solution that worked for me. Here's my particular setup;
- Windows 2008 R2 DC (DNS, DHCP - domain name ends in .office)
- Windows 2003 DC (DNS, WINS)
- Lion 10.7.2 (MacBook Pro 13" purchased last week)
I had all the usual issues. Mobile accounts could not be created on startup, via the command line or the GUI. Tried all the fixes (permissions fix from recovery disk, IPv6 fix, adding domains to search for Auth and Contacts, etc) nothing worked. Then I noticed that one of the requirements for one of the fixes was to make sure that the DNS name and WINS name are being reported as the same in System Prefs. I started looking into it and found some funkiness with my WINS. I then looked around my network, realized most people are running either Mac OS X, Windows 7, or Linux with just a few people on XP. So I said fine, I'm ditching WINS. I ripped it out of DHCP (scope options too), DNS, restarted the services and tried again to bind with the following steps:
Users and Groups:
- Login Window: Name and Password (how can you specify which network user you want to create a mobile account for with the other method?)
- Allow Network Users to log in at Login Window (Checked)
In Directory Utility I did the bind as usual.
- In the Advanced Options, I selected "Prefer this domain server" and entered my win2008 server.
- Create mobile account on login - checked
- Use UNC from AD
- Protocol is smb
- I de-selected "allow authentication from any domain in the forest"
- In the Search Policy I added all the options it listed for Authentication and Contacts but made sure to put /Local/Default to the top in each instance.
- Pressed the lock icon.
I then backed out of the menus and restarted. Viola! It prompted me to create a mobile account, went ahead and did so. I then had to manually configure what gets sync'd from my home folder (I selected Desktop, Documents and Library only) pressed sync now and it was successful.
I still do get red/amber lights during login, but it works, I can login and sync. I'm now loading software and expect my outlook email, etc., to work once I load Office 2011 onto the mac. It's already sync'd my Microsoft folders and Library prefs.
I hope this gives some of you some more clarity. You really need to have your networking working 100 percent for this to be successful.
If you've tried this method
Nick Vasilopoulos reported back that his success with the suggestion he shared for fixing Lion 10.7.2 Active Directory problems was short-lived:
