We have been troubleshooting several reports from offices with bound OS X servers where Mac and PC clients are unable to connect to shares using AFP or SMB. Additionally these offices have reported that Macs will randomly drop their AFP connections to the OS X server.
When the connection problem occurs often times the server shares will display generic ACL GUIDs: a series of numbers and letters instead of the group name. In cases such as these restarting Directory Services generally resolves the problem- at least temporarily:
sudo /usr/bin/killall DirectoryService
Other times the GUIDs display normally but the connection problems still persist. In these cases two things are suggested:
- Nest AD users into local groups and then use the local groups to populate the ACLs
- Flush the group membership cache by running this command:
sudo dsmemberutil flushcache
Generally these problems occur most often on Leopard servers- Snow Leopard servers have improved group membership caching.
