Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I observed that MacOS X 10.6, if machine is added to an Active Directory and set to authenticate over LDAP to the Active Directory server requests a Kerberos TGT as expected at each user login.

However, this TGT has a lifetime on the Active Directory and should be refreshed before the time expires. Windows machines does this automatically about 1 hour before expiration, but the MACs in our network does not do this. So, when a MacOS reaches the end of the TGT lifetime, nothing happens and access to services is limited accordingly by the Active Directory server.

I am looking for a way to configure the MACs to do a TGT refresh without user intervention. Preferably the solution should be a setting somewhere or a cron job to be run, and if that's impossible what software should I install to automatically refresh the TGT?


UPDATE: I found out that kinit -R or kinit -B should refresh the TGT. When I run it, it seems to run OK, klist shows updated times ... but I see this error in the logs: ([9299]): Exited with exit code: 1 and of course nothing happens on the Active Directory server.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.