My basic requirement is to use a macOS Monterey machine as a server (without running macOS Server, which is deprecated) to host SMB shares while using Active Directory as my network accounts source (an Ubuntu server running Samba4 AD DC), and have other macOS machine's user's loging in using the Kerberos SSO Extension (in other words, without having to enter credentials for the shares). Seemed simple enough :) For the server, I initially explored the built-in smb setup in Monterey (ie: enabling "File Sharing") with the machine bound (authenticated bind) to the AD DC, but when trying to login via SMB from the client machines (click on the server on the left of a finder window), "Network Users" cannot see shares created by a local admin user (though the Kerberos SSO Extension handled passing the SSO credentials flawlessly). If I logged into the macOS Monterey server machine with an Active Directory account, it created a local home folder and then I could auto-log-in with the Kerberos-SSO extension for that same user as expected from a client machine (but could only see the home folder for that network user as a share - still couldn't see the ones that the local admin account created). Searched for a long time, tried lots of suggestions, but gave up on that option. Figured I'd try installing samba from samba.org so I did a brew install samba on the Monterey server machine. I set it up similar to another SMB file server I have running on Ubuntu (eg: security = ads, configured realm = AD.DOMAIN.COM, etc.) but I seem to be unable to get it to talk to the AD DC server to validate user accounts. I get a lot of "NT_STATUS_NO_LOGON_SERVERS" in the debug log along with "winbindd not running" (which of course, doesn't appear to be available for macOS these days unless I've missed it). So - samba.org's implementation doesn't seem to pick up the methods Apple has used to get the kerberos authentication and domain binding working despite having done that AD authenticated bind on the server machine and seeing proper output from sudo ktutil list (even when configuring the smb.conf to include password server - dc.ad.domain.com), and I don't seem to be able to figure out what those underlying components are without spending significantly more time here. (did notice that homebrew's formula code for samba compiled it by default using --without-ads, which was problem #7 or #8 I stumbled upon - which told me that the formula trimmed samba down to the basics to get it to compile on a mac). I've spent quite a bit of time searching for others who may have documented this same setup (host SMB shares on a mac using AD as the source for network accounts and Kerberos SSO Extension as the macOS client's authentication method (though I'd settle for simply entering a username/password and saving that to the keychain)) to no avail. Searching for macos and samba bring up a lot of stuff all the way back to 2004 (making it harder to sift through, as some of the older items are no longer relevant) **Question:** Rather than troubleshooting my setup, config files, etc. (which might take a while), I'm wondering if anyone can point me to a documented setup like this that they've seen that someone has managed to get working? I've just about exhausted the ways in which I can search for this setup. (I realize this looks like an ask to do my searching for me, but I'm really just looking to see if someone already has this running and can share a few tricks they used to get it going that I may not have run across yet - if my pain sounds familiar). Failing that, perhaps I'll start a new post with lots of detail on my two approaches here (including what I've already tried over the last few weeks) to see if I've missed something. I know - trying to get a mac to host a robust samba file server is probably not the best idea (but I'll cling to that requirement for a while longer before I elect to go with another option). Thank you in advance!

Our SBS2003 is basically only managing user IDs (aka Active Directory). Files shares are on a NAS and mail is to soon be on Google Apps. Can I replace SBS2003 with a MountainLion Mac Mini Server to manage Windows XP desktop logins?

We have begun the processing of syncing Apple Business Manager with our Microsoft Intune instance (all Azure Active Directory accounts) via SCIM. In the logs, for 2 of our accounts, I am given the error "Account Update Not Allowed." This error is not included on this page: https://support.apple.com/en-in/guide/apple-business-manager/apddc1fec242/web , nor is Google bringing up any hits, so I don't know what it means or how to fix it.

I have client stations (OS X Yosemite) bound into Active Directory services. When the user was authorized I prepared his profile from /System/Library/User\ Template/English.lproj/* and settings for machine is synced from Open Directory (practices named magic triangle.) The record in AD contains samba shared folder for every user. When I enable Show Connected Server in Finder preferences on Desktop, they have icons for this disk on desktop. How do I add this link into favorites in Finder sidebar? In section Servers there is a general link to Share Disk and I need link to a specific folder for every logged-in user as a link on their Desktops. Are there best practices I should be following? Without practise when every user drag and drop the link from desktop to favorite? My users every day change the working place and this practise is wrong. thanks for all answers.

I'm trying to connect a brand new MacBook Pro M4 with macOS 15.2 to an AD Windows (2012). I followed the procedure described at https://support.apple.com/en-bw/guide/directory-utility/diru11f4f748/6.4/mac/15.0 , but unfortunately, neither of the options (GUI nor terminal) worked. In both cases, I got the message: "Authentication server encountered an error while attempting the requested operation." Both server and Mac have the same time, which could be a reason for the error. Any idea what could cause this error?

**Background:** I am trying to deploy a custom backup strategy in my lab. A "trigger" script is executed periodically on the computer, fetches the most recent backup instructions for the machine from a network share (accessed via samba on the local network) and writes the resulting log files to that same shared folder. The first step in the trigger script is to mount the samba share to read/write files. **What works:** Our IT department has created an active directory security group containing the machines allowed to access the shared folder. Windows machines as well as MacOS machines are listed in the group members. On Windows, the "System" account can connect to the shared folder to read & write files without the need to provide any credentials. Mounting is not necessary as we can read files from \\serverip\share On MacOS, I can mount the shared folder using

if I provide the credentials of an authorized user. **The issue:** On MacOS, I am unable to mount without supplying user credentials. Mounting the shared folder with

fails with: "server rejected the connection: authentication error".

appears to expect authorized credentials, while I hope to mount without passing credentials, using the AD security group. I am running the commands as root. **What I have checked:** - Computers are joined to the domain - Hostnames match the object names in Active Directory - Using the hostname or domain\hostname as username for the share does not work - Using -N option to avoid password prompt does not solve the issue I have no control on the samba shares, they are handled by our IT department only. Is there some obvious information/configuration I am missing to mount a share as root without credentials on macOS?

I'm looking for a way to change the default Active Directory password expiration prompt at login from 30 days to our current IT policy of 14 days. Every time a user logs in on a Mac with Active Directory, they get a 30 day notice, but on a PC they get a 14 day notice, so I know it's something local to the Mac and not something controlled through the servers. I cannot for the life of me find the .plist that controls this and all other information I can find is extremely out of date. Any advice?

We have several Ventura Macs bound to our Active Directory servers. The Macs have SMB shares on them that are accessible to Windows machines on the network. The Mac users log in using the same AD credentials as they do on the Windows machines. Permissions are all fine on the Mac shares and both the Macs and the Windows machine scan read and write files and folders to the Mac shares. However, when a Mac user (using AD Credentials and login) or a Windows user (using AD Credentials and login) write to the Mac Shares, the files show no ownership from the Windows file properties dialog. This makes identifying who wrote the files/folders difficult. I don't wish to change the file ownership after they are written--I'd like the files & folders to show the owner/user that wrote them. Is there something in the MacOS that must be altered to use the file ownership of the AD User writing the files?

I'm on MacOS 13.5 on a Macbook. On the first login screen after turning my computer on (which I think it's for FileVault), a local admin user shows up (which I have the password to). I can login here, but then afterwards a new login screen shows up where this user is not there, only my Mobile account (connected to my org's AD). This user was supposedly hidden some time ago with a command like this: sudo defaults write /Library/Preferences/com.apple.loginwindow HiddenUsersList -array-add username I can't 'su' into this account or use it whenever an admin prompt shows up from my Mobile account. Any tips? Any way to log into it? Can't even click on "Other" and login from the Login Screen. The user shows up fine if I run this command from my mobile account: dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]' Thanks.

My Mac at work is bound to our Active Directory domain. It's managed with JAMF, and I have NoMAD installed. The last time I came due for a password change (every sixty days), an unknown issue prevented me from executing the change from my Mac. Our IT folks couldn't figure out the issue, so I was forced to do my AD password change from a Windows PC elsewhere on the network. This left my Mac's login password, as well as my Keychain and Filevault passwords, the same as before. As I understand it, NoMAD was supposed to detect that they were out of sync and automatically fix it for me, but that hasn't happened. I have not been able to determine why. Our IT folks are Windows guys. One of them knows the Mac reasonably well, but he's not an expert in this area and he's stumped. This was all 56 days ago, so I'm about due to change my password again. I tried to do it in System Preferences -> Users & Groups, which is my normal method, but it fails with the same mysterious error I got last time -- it says the server is not available. As far as I can tell, the server _is_ available. But this isn't the point. When that failed, I tried changing with NoMAD, but I can't. The error message is the generic "local password doesn't meet policy requirements", and I assume it's because my local password isn't the same as the one in AD, so when it tries to confirm my old password, it can only succeed for one of the two backing systems. I've tried both old passwords; same error. So, my question: **What, if anything, can I do to update my Mac's local, keychain, and Filevault passwords that will _not_ try to update AD?** Things I've tried: 1. Users & Groups sysprefpane, as described above 2. Changing with NoMAD, as described above 3. Using passwd at the terminal. Same results for both old passwords: % ~ passwd Changing password for jrobb. Old Password: New Password: Retype New Password: passwd: general failure 4. Repeat #1 while disconnected from the network. Same "server is not available" message -- and this time I believe it! 5. Repeat #2 while disconnected from the network. Same "local password doesn't meet policy requirements" as before. If it matters, I'm running 10.14.6. UPDATE: After unbinding and re-binding my Mac to the AD domain, my Mac's password was sync'd up with AD. But then I encountered the same "server is not available" error when trying to change the password from Users & Groups, forcing me to use another method to update my AD password, and now they're out of sync again. 😭

I have a Macbook Pro that uses ActiveDirectory for authentication. However, when I go to System Preferences to make changes, it gives me the following error: If I run dscl . -read /Users/ AuthenticationAuthority, everything seems to be ok but I think that the local password has become out of sync with ActiveDirectory. Is there a way to tell my local account to resync with ActiveDirectory? Or is there a different interpretation of what might be going on? I tried this soln (seen here https://www.reddit.com/r/macsysadmin/comments/ahhpdd/password_mismatch/?utm_source=share&utm_medium=web2x) root> Sysadminctl -secureTokenOff -password interactive but am not able to disable my own SecureToken.

I have a really strange problem with my macOS Sierra Server. It is connected to the Active Directory server and limited access to the login window only for few people. This is working without any problem. (Really only these users are allowed to login on mac server with their domain credentials) Now I activated SSH because I need this for GIT repositories. I gave the domain user access rights on using ssh **but** I always get "Permission denied" when I try to connect. If I use a local account it works. In the logs I only can find: >com.openssh.sshd.... Service exited with abnormal status code 255 >com.openssh.sshd.... Service exited with abnormal status code 1 Do you have any idea whats going wrong here?

In our organization, we have 25 Active Directory Domain Controllers. For our big sites, we have 2 DC per site. We have about 50 MacBooks, with the rest being Windows laptops that doesn't have the same issue at all. Users sometimes move from one site to another one so we can't just force one or two DC. In our organization, LDAP and Kerberos protocols are blocked by firewall except to the site Domain Controller. I'm trying to configure **Kerberos SSO Extension** through Airwatch but unfortunately I can't log in with my credentials. So I tested manually with kinit and I saw this: me@MAC ~ % kinit me@SUB.AD.DOMAIN me@SUB.AD.DOMAIN's password: kinit: krb5_get_init_creds: unable to reach any KDC in realm SUB.AD.DOMAIN, tried 10 KDCs I checked on our firewall and I saw that it tried to connect to 10 differents DCs but not the good one, and since it says "tried 10 KDCs" I can only conclude that it didn't tried the one I want it to use. MacBooks aren't bound to the AD and are used with local account. My question is, is there a way to make Kerberos try ALL the KDCs in the realm and not just 10 ? If so, is there a way to set it in the Airwatch profile I made? Or is there a way for macOS to understand which in site they're located in and connect to the right Domain Controller instead of trying 10 bad DC on the list then give up trying? Of course the easier would be to just open the firewall let all LDAP / Kerberos packets pass through, I tried and it worked, but we don't want to do that for security reasons. Considering how specific this question is I don't have a lot of hope but hey ... never try never knows.

I wonder if there's any equivalent terminal command that can output the same data displayed when the I search for the domain user Under Users in the OD node (/Active Directory/MYCOMP/...) the data is a dictionary with fields like AltSecurityIdentities, dsAttrTypeNative:.. , and more. I'm looking for macOS(10.12+) native, command line tool, that can extract an input user AD details that contains fields like AuthenticationAuthority and AltSecurityIdentities quite similar to Diretory Utility Gui based application (/System/Library/CoreServices/Applications/Directory Utility.app). Is it possible to script user lookups?

For a few days now I cannot login to AD Accounts anymore. I receive the message "Your are unable to log in to the user account "XYZ" at this time. Logging into the account failed because an error occurred" I've logged in with a local administrator to check the AD Connection and this seems to work. After this I've checked the directory services. If I go to the directory editor and search for the user in the nodename. I can find it with all attributes. Unfortunately we are running macOS High Sierra 10.13. Time/Date is also checked. All neccessary certificates are installed.

Scenario: company-provided MacBook Pro, Big Sur 11.2.3, and I used it in office for a few months on the wired LAN and Wireless networks. COVID therefore WFH, but now my login password while home does not get updated when I update my domain password. I always change my password from one of the servers in the company datacenter, not from the MacBook. Next time log into Mac, only the old password still works. When I come into the office and connect MacBook to the wired LAN, I can log in initially with the domain credential. But as soon as I disconnect from the network and restart/relog, only my year-old domain credential works. The current password no longer works. How does one update the credential stored in MacOS with the current domain values? Also is there a setting that will allow it to keep updated even though remote via VPN?

In Windows you can use the "net" command to do this quite easily:

net group /domain groupName

Which checks if **groupName** exists in your current domain. Is there something equivalent in Mac?

I have a macbook pro running macOS Big Sur 11.1 that was given to me by my former employer. They allowed me to keep the laptop after I left the company. When I try changing my password, I get this error: I understand that my company's network administration setup still has its tentacles in my machine. This is the output from klist:

Credentials cache: API:9F3BD780-2620-4574-A37D-C745AC9FBCA5
        Principal: my.username@company.domain.name

  Issued    Expires    Principal

How do I change my password?

Our OS X Server machine has had no issue at all with being in the Windows AD domain right up until we updated it to OS X 10.10. Now it behaves bizarrely, refuses to connect to our Exchange mail server, and even rejects the DNS lookup for all of the other servers on the network. I tried removing and readding the Server to the domain, but I get "Unable to add server. Authentication server could not be contacted (5200)" Is there any way of finding out what the solution may be?

I've installed BigSur on physical machine and bind it to remote LDAP server which reside behind vpn server. The bind itself went just fine, but when I try to login or fetch any of the AD users, it fails and although the LDAP seems bounded, the AD nodes cannot be connected (all are offline)

Name                                          State   Refs Type         External Locked Hidden 
--------------------------------------------- ------- ---- ------------ -------- ------ ------ 
/Active Directory                                     2                          X      X      
/Active Directory/MYSERVERDEV                         11                                       
/Active Directory/MYSERVERDEV/All Domains     Offline 2    Virtual node                        
/Active Directory/MYSERVERDEV/Global Catalog          2    Virtual node                 X      
/Active Directory/MYSERVERDEV/myserverdev.com Offline 16   Virtual node                 X      
/Configure                                            1                          X      X      
/Contacts                                     Online  3                                        
/LDAPv3                                               1                          X      X      
/Local                                        Online  2                          X      X      
/Local/Default                                Online  6                          X             
/Search                                       Online  5

from the logs I could see that the opendirectoryd keep trying to connect the nodes but they remain offline. I wonder if there's any timeout for the connection or anything else that can effect the connection, since the bind itself did work successfully. any ideas ?

[com.apple.opendirectoryd:session] /Active Directory/MYSERVERDEV/All Domains nodestate: 
starting check

[com.apple.opendirectoryd:session] /Active Directory/MYSERVERDEV/All Domains nodestate: 
failed to create connection

[com.apple.opendirectoryd:session] /Active Directory/MYSERVERDEV/All Domains nodestate: 
failed to create connection

opendirectoryd: [com.apple.opendirectoryd:session] /Active Directory/MYSERVERDEV/All Domains 
nodestate: next check in 30 seconds

[com.apple.opendirectoryd:session] /Active Directory/MYSERVERDEV/All Domains 
nodestate: is still offline

[com.apple.opendirectoryd:session] /Active Directory/MYSERVERDEV/myserverdev.com 
nodestate: starting check

[com.apple.opendirectoryd:session] /Active Directory/MYSERVERDEV/myserverdev.com 
service discovery: timed out after 5 seconds

[com.apple.opendirectoryd:session] /Active Directory/MYSERVERDEV/myserverdev.com 
nodestate: next check in 15 seconds

[com.apple.opendirectoryd:session] /Active Directory/MYSERVERDEV/myserverdev.com 
nodestate: is still offline