Macs frequently need to be restarted for Network logins to succeed

Showing results for 
Search instead for 
Do you mean 
Reply
Participant III
Posts: 13
Registered: ‎06-26-2013
#11 of 32 9,673

Re: Macs frequently need to be restarted for Network logins to succeed

Hi Brian, 

 

Thank you for your quick response. When you refer to the "computer account password" do you mean the account that was used to join the machine to the domain or the local administrator password? Neither of those passwords were changed in my environment... Any idea what else could have prompted that message?

 

Best,

Adam

Participant III
Posts: 13
Registered: ‎06-26-2013
#12 of 32 9,668

Re: Macs frequently need to be restarted for Network logins to succeed

By the way I did the reset with domain credentials, and that worked, but it is still in disconnected status. 

Posts: 532
Kudos: 210
Blog Posts: 24
Solutions: 25
Registered: ‎04-19-2012
#13 of 32 9,667

Re: Macs frequently need to be restarted for Network logins to succeed

Hi Adam,

 

Actually neither - I mean literally the computer's own account password that it uses to log into AD - it's automatically generated upon joining the domain and invisible to us mere humans. Sometimes it can fall out of sync as shown in your diagnostic logs.

 

If you go to the computer object in ADUC and right-click, you'll see the "Reset Account" option there:

 

Reset computer account.png

 

Click that and then restart the Mac, wait a few moments for the handshaking to complete and then check to see if it can come back online again.

 

Kind regards,

Brian

Participant III
Posts: 13
Registered: ‎06-26-2013
#14 of 32 9,664

Re: Macs frequently need to be restarted for Network logins to succeed

Resetting the machine account restored the connection. Now I have to figure out why it happens sporadically to various machines with no particular rhyme or reason...

Posts: 532
Kudos: 210
Blog Posts: 24
Solutions: 25
Registered: ‎04-19-2012
#15 of 32 9,650

Re: Macs frequently need to be restarted for Network logins to succeed

Hi Adam,

 

Good to see that you're connected and running again. 

 

It sounds like a good thorough check of your general network health might be in order.

 

From the Mac side - the AD Check tool in System Preferences > Centrify > AD Check might help highlight any potential issues. 

 

Kind regards,

Brian

Participant III
Posts: 13
Registered: ‎06-26-2013
#16 of 32 7,461

Re: Macs frequently need to be restarted for Network logins to succeed

Hi Brian,

This problem has cropped up again, except this time several computers are affected in several different locations across campus. Affected machines show a CentrifyDC mode of "<unavailable>". Resetting the machine account has no effect in this case, and neither does restarting the computer. I ran an AD check on a couple of the affected machines and everything passed. Any idea what could be going on?

Thanks,
Adam
Posts: 532
Kudos: 210
Blog Posts: 24
Solutions: 25
Registered: ‎04-19-2012
#17 of 32 7,455

Re: Macs frequently need to be restarted for Network logins to succeed

Hi Adam,

 

I received and took a look through your latest diagnostic pack - and the same "Computer account password has been changed" notification is shown there.

 

Did you try the adkeytab commands from my previous posting here?:
http://community.centrify.com/t5/DirectControl-Express-for-Mac/Macs-frequently-need-to-be-restarted-...

 

 

Additionally - the Mac is using an older version of the Centrify agent (version 5.1.0) which contained a known bug which did affect connectivity in certain environments.

 

I highly recommend you update to the latest version of the Centrify agent (version 5.1.1-920) which has quashed pretty much all the performance bugs and I've seen a much greater reliability rate with this new version:

http://www.centrify.com/express/download.asp?asset=centrifydc-5.1.1-mac10.7.dmg

 

 

With this new version though - you will need to bring the Mac back into a Connected state before it will allow an updated install.

 

If the adkeytab commands from the previous post fails to bring your Mac back online - try uninstalling the previous 5.1.0 version (which will also unjoin the Mac from the domain) then install the newer 5.1.1 and rejoin the domain.

 

You should see a much greater increase in performance with this new version.

 

Kind regards,

Brian

Participant III
Posts: 13
Registered: ‎06-26-2013
#18 of 32 7,100

Re: Macs frequently need to be restarted for Network logins to succeed

Hi Brian,

 

Thank you for that. We have deployed the updated client and are waiting to see if the connection is stable. According to our infrastructure follks the machine account password is not enforced centrally, therefore it would be happening at the client level. Do you know what the default timeout is for Centrify AD connections?

 

Best,

Adam

Centrify Guru I
Posts: 2,388
Registered: ‎07-26-2012
#19 of 32 7,092

Re: Macs frequently need to be restarted for Network logins to succeed

Adam,

 

By default, all computers participating in AD change their passwords every 30 days, or by the parameter set on your

Domain member: Maximum machine account password age  GPO under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

 

Reference: http://blogs.technet.com/b/askds/archive/2009/02/15/test2.aspx

 

If because of a connectivity issue the computer can't talk to AD over Kerberos to perform a password change, it will go offline.

 

Run the adcheck command against your domain and show us the output.

 

Regards,

 

R.P

Want to learn more about practical Centrify examples? Check out my blog at http://centrifying.blogspot.com
Follow Centrify:
Participant II
Posts: 11
Registered: ‎11-20-2013
#20 of 32 5,672

Re: Macs frequently need to be restarted for Network logins to succeed

In Windows we can disable the machine password we don't get this issue. Is there a way to disable the machine password on a Mac.