blog.rimann.org

While rolling out ActiveDirectory and a new Windows 2003 based file server at work, we recently found an issue regarding Mac users that could not connect to the fileserver (authentication failed).

We could track this down to the lacking encryption features in Mac OS X 10.4. In Mac OS X 10.5 (Leopard) it worked out of the box.

Drew McLellan found the reason and describes a solution on his blog post Accessing a Windows 2003 Share from OS X.

Short summary

Mac OS X Panther does not understand encrypted connections to the fileserver/domain controller during authentication. But in Windows 2003 Server, encryption is enforced for all connections by default (no matter whether the client supports encryption!).

Short solution

• Open Group Policy editor and edit the Default Domain Controller Policy
• Go To Local Policies, then to Security Options
• Scroll down and find the entry Microsoft network server: Digitally sign communications (always)
• Set this option to Disabled
• Execute gpupdate on the DC and the file server to apply the new GPO ruleset
• Test it with a Mac OS X 10.4 (Panther) based device

This did the trick for us.