Mac OS X Server 10.3: Windows client authentication stalls when used as a PDC

When many Windows clients are logging in and Mac OS X Server 10.3 is used as a primary domain controller (PDC), authentication may stall.
This mainly occurs when a large number of Windows users try to log in simultaneously, such as in a classroom environment.

Lookupd's default of 64 threads may not be high enough for large numbers of simultaneous Windows logins. To verify this is the issue, execute this command in Terminal when the logins are slow:

# top -l0 | grep lookupd

Tip: The three characters following "top" are minus, ell, and zero. Be sure to include all spaces as above. You can copy and paste into Terminal. The number sign (#) and first space represent the prompt in Terminal, so don't copy them.

While running, the above command will display data about the lookupd process that is updated every second. The number in the fifth column is the number of threads. If this is near 64, the number of threads needs to be increased. Press Control-C to stop the process.

To increase the number of threads, execute these commands in Terminal:

# sudo nicl . create /locations/lookupd MaxThreads 128
# sudo nicl . create /locations/lookupd MaxIdleThreads 4
# sudo killall -1 lookupd

Threads are created only when needed and killed when no longer needed. This change uses no additional system resources when the system isn't loaded.
Published Date: Oct 7, 2016