Mac OS X Server v10.5 and later: Mobile users may not be able to log in when using a password policy

Resolution

1. On the server, use Workgroup Manager to re-enable account access for the disabled user.
2. Save the user record.
3. On the affected client computer, log in as a local admin user.
4. Open Terminal.app (located in /Applications/Utilities/Terminal).
5. Execute this command: sudo -s
6. Enter the admin password when prompted.
7. Navigate to the local user database directory with this command:
   

   cd /var/db/dslocal/nodes/Default/users/

8. Make a backup copy of the disabled users plist file with this command (replacing username with the affected account's user name):

   cp username.plist username.plist.bak

9. Using your preferred text editor, open the affected user's .plist file. The nano editor is used in this sample command:
   

   nano username.plist    
   

10. Locate the "authentication_authority" key within the .plist file; it looks similar to this:

    <key>authentication_authority</key>
        <array>
           <string>;ShadowHash;</string>
           <string>;DisabledUser;;Kerberosv5;;abcd@LKDC:SHA1.9965008CC9FE7938B5CC06EE8DE79B6159989$
        </array>     
    

11. Delete the text ";DisabledUser;" that appears in the key. Be careful to only delete ";DisabledUser;".
12. Save the file with the text editor.
13. Type exit, then press Return.
14. Quit Terminal.
15. Log out.

The disabled user should now be able to log back in to the client computer.