So I successively joined some Mac computers (OSX 10.8) to our AD domain, but I cant figure out how to force users to log in through the domain credentials. Suppose the local user before joining to the Domain was 'joedoe', and that there is a user by the same name in the domain. Currently, if the password for the local 'joedoe' is different than the domain 'joedoe', it is impossible to log in with the domain credentials. Is there a way to force the Mac to login through the domain, regardless of the local account?
This may not answer exactly your question, but that's how we're planning to transition our 100+ (local) users on Mac (10.7 and soon 10.8).
First you join the Mac to the domain, making sure the uid and gid are correctly mapped (you have to enter those in AD and use Directory Utility or command line to do the mapping). For us is:
Mac <-> AD
uid <-> uidNumber
gid <-> gidNumber
ggid <-> gidNumber
Then, delete the local user from command line, preserving the home folder (and its permission):
sudo dscl . -delete /Users/
Then AD users can just login and they will be owner of the home folder (if the uid/gid is correctly mapped). We're looking at a way to script the whole thing and deploy it via puppet.