Slow Login on Snow Leopard Clients Bound to AD

We have received several reports that Snow Leopard clients that are bound to AD are experiencing very slow logins- up to five minutes before the desktop would appear.

One fix is to remove Active Directory/All Domains from the Authentication tab in Directory Services.  Once this is done the login is very fast.

The drawback is that no other user will be able to log into the computer using their AD credentials.

AD password changes done via the login screen or System Preferences/Users/Change Password continue to work.

Full details can be found on Tech Smog.

OS X Server: users can not connect to SMB or AFP shares

We have been troubleshooting several reports from offices with bound OS X servers where Mac and PC clients are unable to connect to shares using AFP or SMB.  Additionally these offices have reported that Macs will randomly drop their AFP connections to the OS X server.

When the connection problem occurs often times the server shares will display generic ACL GUIDs: a series of numbers and letters instead of the group name.   In cases such as these restarting Directory Services generally resolves the problem- at least temporarily:

sudo /usr/bin/killall DirectoryService

Other times the GUIDs display normally but the connection problems still persist.  In these cases two things are suggested:

1. Nest AD users into local groups and then use the local groups to populate the ACLs
2. Flush the group membership cache by running this command:  

sudo dsmemberutil flushcache

Generally these problems occur most often on Leopard servers- Snow Leopard servers have improved group membership caching.

Restarting Directory Servcices from the Command Line: OS X

killall -HUP DirectoryService