Problems troubleshooting AD/OD

I will do my best to quickly describe our environment but there are so many variables that I would rather save all the details for future communications with whoever feels brave enough to take this issue on!

We have an Xserve running AFP as well as serving as an OD master that is authenticating via Kerberos to an Active Directory server.  We set this up using the guide provided by AFP548.com.  Upon the initial rollout of this new file server w/ AD Auth. we were generally successful.  We were able to bind the Mac clients to both AD and OD, authenticate them and get access to the shares coming from the Mac server.  However we have been plagued by this perplexing issue where for some reason not know to us the Mac (seemingly random) loses it's ability to connect to the Xserve (even though there is still a valid TGT) and the attached error message is presented.

My quick fix has been to completely wipe the directory configuration by deleting preferences contained in the /Library/Preferences/DirectoryService/*, removing the computer account from both AD and OD, rebooting the client and re-binding it to both AD and OD.  This sucks to do BTW and it happens more than I'd like.

It's important to understand that meanwhile the client is still bound and authenticated to AD.  I can restart the computer in this state and login to AD without a hitch but the second I try to access a service from the Mac server whether it's AFP, SMB, FTP whatever, the OD server does not recognize the users credentials.

I would love to talk to somebody at length about this issue, it has been quite problematic.  So much so that we are considering managing two separate directory systems, one for the Mac users and one for the PC's.  Not ideal but the time we are wasting at the helpdesk level is too costly.

Any help or assistance you can provide on this issue is greatly appreciated.

-->

Chris Palmer

IT Manager

Cambridge BioMarketing Group

245 First Street, 12th Floor

Cambridge, MA 02142

Ph:  617-871-2272

Fax:  617-225-0988

<--