5

I am running AD on Windows Server 2003 and made sure our account lockout policy is set to 5 attempts before an account gets locked. It works on any Windows computer running XP/Vista/7/8, but the problem lies when trying to connect to the domain account on a Mac. The Mac user only has one attempt to get their password correct, otherwise the account will be locked out. This happens to all of the Macs we have.

Any help would be greatly appreciated, thanks!

MDMarra
  • 100,734
  • 32
  • 197
  • 329
  • 1
    What version of OS X exactly? Verify the [correct settings are set](http://4sysops.com/archives/how-to-join-a-mac-os-x-computer-to-active-directory/) – Ramhound Jun 02 '14 at 16:34
  • Account lockouts and failed attempt counts are not processed by the client - they are processed by the domain controller doing the authentication. My guess would be that OS X is re-sending failed authentication attempts silently until the account is locked, for some reason. Sniff the traffic with Wireshark. I bet you'll see multiple attempts from the single logon. – MDMarra Jun 11 '14 at 16:17
  • Are/what events (IDs, event text, and count) are logged to the domain controller's security event log when the Mac user tries to logon? – I say Reinstate Monica Aug 08 '14 at 13:49

1 Answers1

0

OS X can have trouble sometimes with actually authenticating against active directory. It is therefore storing them as off-line accounts, and it may appear they are authenticating with the AD, when it is not necessarily true. It may be authenticated against a stored hash. If this is the case, lockout won't work, as it is never actually hitting the active directory server to see if you are indeed locked out.

One of the things we found to fix the problem was to set a custom search path. There is an apple message board thread about this bug, that I can't seem to find right now, but basically, manually adding your Active Directory domains in Directory Utility fixes the issue, and if I remember correctly confirming creation of mobile accounts. If I find the post, I'll update this.

David Eisen
  • 643
  • 5
  • 21