Troubleshooting issues with macOS Asset Binding

Solutions:

• Re-check for all the settings in the policy. Ensure that you provide the full Organizational Unit designation, and the account credentials used for AD binding should be intact. Try binding the Mac with the same settings as you have used in the policy.
• Ascertain that the macOS device and the domain controller are in the same network.
• Verify if the device can reach the Active Directory server while on the corporate network.
• Ensure that the time on the device matches with the server.

Solutions:

Add the same IP address specified as Active Directory Domain on the policy as the DNS server name on the device. To perform that, navigate to System Preferences > Network > Advanced > DNS Servers to enter the DNS server to the Mac.

Or

Failed to apply the action to the device. The ‘Directory Binding Account’ payload could not be installed. The server either couldn’t be found or was not responding.

Cause:

These errors occur when the server name or credentials specified in the policy are incorrect, or the server cannot respond.

Solution:

Verify if the server name and OU(Organizational Unit) path are intact. Then, try applying the policy after some time.

To obtain the OU path of the Active Directory,

enter the following command in the terminal server: dsquery user -name *

If the issue persists, modify the host file on the device to point the FQDN to the IP address of the Domain Controller.

To edit the host file on Mac,

1. Open Finder.
2. Navigate to Applications > Utilities > Terminal.
3. Enter the following command:

   sudo nano /private/etc/hosts

4. Enter the password when prompted.
5. Next, add a new entry. Specify it in the following format:

   IP address server.domain.com

   Enter the IP address followed by the server name (or domain name) you want to associate with it.

   For example,

   34.192.79.104 your_domain.com

Reason:

When Login Windows Preferences are associated with the device, it would be difficult to create a network user via AD Asset Binding.

Solution:

Perform the following steps:

1. Remove the login window preferences associated with the device.
2. Log in to the device using an AD user account credentials.
3. Try enabling the login window preferences once again.
4. The mobile user account will be created and listed on the login window.

Cause:

This error can occur if the domain account credentials provided in the policy are invalid.

Resolution:

1. Verify the domain account credentials that you provided in the policy and check if any typo exists.
2. Confirm whether the domain account password has expired.
3. If a user account is locked out, they will not be able to log into the AD domain. So, an administrator can check if the given account is in a locked state from an AD bound Mac.
   • Launch Directory Utility.
   • Navigate to Directory Editor.
   • Choose the node to the domain.
   • Click on the lock icon to authenticate with an account that has the required permissions.
   • Search for the user account and check with the attribute lockoutTime attribute. If it holds a value other than 0, it means it is locked.
   • Edit the attribute to ‘0’.