4sysops readers have spoken: there are serious integration problems between Apple Mac OS X 10.7 Lion and Active Directory Domain Services (AD DS). Specifically, we are seeing (a) sluggish binding between the Macs and AD; (b) super-slow domain logons; and (c) completely blocked domain logons.
The biggest indicator of this problem is the red dot icon and “Network accounts are unavailable” message in the Mac OS X Lion logon screen; this is shown in Figure 1.
The dreaded “Network accounts are unavailable” error in Mac OS X Lion
For what one IT professional’s opinion is worth, here is my two-fold take on why this problem exists:
- Due to GPL license restrictions (among other reasons, I’m sure), Apple scrapped Samba and re-wrote their Server Message Block (SMB) and network directory services protocol stack. Check out this Apple Insider reference for more details.
- Apple released “half-baked” SMB/directory services components in Lion that will eventually be fixed in a software update.
A couple of weeks ago I attended a lecture given by Mark Russinovich, one of the world’s leading authorities on Windows internals. He made the offhanded but simultaneously serious statement that “Apple doesn’t know how to make Windows software.” In my opinion, Mark hit the nail squarely on the head.
Hey, all this jibber-jabbering doesn’t solve the problem, does it? Let’s get to some troubleshooting strategies.
Update all software ^
As I mentioned previously, I strongly believe that this issue represents a code problem on Apple’s side. Therefore, please keep a rigorous eye on Apple software updates over the coming days and weeks.
Some users have seen the “Network accounts are unavailable” error disappear after updating their Windows Server 2008 domain controllers, so keep these machines up-to-date as well.
Repair permissions ^
This tip is a possible quick fix that I include in this article for completeness’ sake. Boot your Lion computer into Lion Recovery by restarting the Mac and holding down Command + R.
Once you arrive in Lion Recovery mode, open Disk Utility, run a permissions repair, and reboot the system in normal mode.
Rebind Macs to Active Directory ^
You can try unbinding the Lion computer from Active Directory and then redoing the bind. The path to the Directory Utility in Lion has changed (again):
- Open Users & Groups from System Preferences.
- Select the appropriate user and click Login Options.
- By Network Account Server, click Edit.
- From the drop-down pane, select the Active Directory Domain entry and remove the binding. Next, click Open Directory Utility.
In the Directory Utility pane, please consider the following points:
- Computer ID: This is the system’s DNS host name. We will need to synchronize this name with the computer name listed in the computer’s Sharing preference pane.
- Create mobile account at login: Users have had success with enabling this option, even if the Mac system is not a laptop.
Binding Mac OS X Lion to AD
In the Advanced Options, navigate to the Administrative pane and consider testing the following option:
Prefer this domain server: You might want to “point” the Lion workstation to a nearby domain controller, preferably a domain controller that doubles as a DNS server.
Adjust authentication search policy ^
In Directory Utility, navigate to the Search Policy tab and move the /ActiveDirectory/DomainName entry to the top of the search list.
Reordering the search policy
Synchronize Mac host name ^
From System Preferences, open the Sharing pane and set the Computer Name field to the DNS host name of the Mac system. We want to ensure that this name matches the system name in the Directory Utility exactly.
Setting the Mac Hostname
Verify DNS and system time ^
You already understand that the Kerberos authentication protocol is highly time sensitive. On your Lion workstation, I recommend that you open the Date & Time system preference pane, navigate to the Date & Time tab, select Set date and time automatically, and fill in the DNS host name of your Windows Server 2008 Network Time Protocol (NTP) time server.
Synchronizing the Mac’s clock with AD
Use domain name with user name ^
This particular troubleshooting tip is a bit of a long shot, but desperate times call for desperate measures, right?
Try logging on to the Lion workstation by using the “old school” domain\username syntax instead of supplying either just the username or the username@domain syntax.
Reinstall Mac OS X Lion ^
Obviously, OS reinstallation is a worst-case scenario. However, some users have found that performing a clean reinstallation of Mac OS X Lion cleared up the problem.
I hope that you were able to find success with your Mac OS X Lion/Active Directory integration issues by applying one or more of these troubleshooting techniques. Please leave feedback in the comments portion of this post so that the 4Sysops community can benefit from your experience.