macOS “Hold for Authentication” — keychain mapping fix

Joe B.

Reviewed for technical accuracy

Specialities: macOS, Printers, Kerberos/Active Directory, CUPS, Print Servers

Fix “Hold for Authentication” on AD-bound Macs — Kerberos ticket, Keychain Access, CUPS, IPP/SMB

Technician

Hey! Let’s clear macOS “Hold for Authentication”. We’ll map the Mac’s Keychain to your Active Directory (Kerberos) credentials, refresh tickets, and fix the printer queue.
Quick details: Is the Mac AD-bound (Directory Utility) or using NoMAD/Enterprise Connect? Are you printing to a print server (SMB/IPP) or directly to the device? Did your AD password change recently?

Customer

It’s an AD-bound MacBook. We print to a Windows print server via SMB. After a password change, every job sits as Hold for Authentication.

Technician

That matches the classic pattern: the saved Keychain password for the server (smb://printserver or ipp://server) is out of sync with your new AD password, or the Kerberos ticket expired.
Plan: 1) remove/repair the Keychain item and map it to your AD login, 2) renew tickets (klist/kinit), 3) ensure the queue uses the server’s FQDN and trusted certificate, 4) re-add the printer using the correct protocol (IPP over HTTPS or SMB) and test.

Customer

Where do I fix the Keychain entry? I see multiple saved passwords for the print server and “AD” in the name.

Technician

Step 1 — Repair the Keychain mapping
1) Open Keychain Access → login. In the search box enter your server address (printserver or domain.tld).
2) Delete old entries named “smb://FQDN”, “cifs://”, “ipp://”, and any Application Password that references the print server.
3) If you recently changed your AD password and the Mac keeps prompting everywhere, select Keychain Access → Preferences → Reset My Default Keychain (or update the login keychain password to match your AD password). This fixes keychain password out of sync issues on AD-bound Macs.

Customer

Cleared them. Do I need to touch Kerberos tickets too?

Technician

Yes — let’s refresh them.
• Open Terminal and run klist. If you see Expired or no TGT, run kdestroy then kinit yourUPN@YOUR.DOMAIN and enter the new password.
• Reconnect to the network where the KDC is reachable (VPN/office). Ensure the Mac’s time is correct (Kerberos is time-sensitive).
This eliminates Kerberos ticket expired causes of Hold for Authentication.

Customer

Our queue uses smb://printserver. Would IPP be better for Macs?

Technician

Both work. For macOS reliability I prefer IPP over HTTPS to a print server or the device (eg. ipps://server.domain.tld/printers/Queue). Use the server’s FQDN so Kerberos and certificates match. If your environment requires SMB, use smb://FQDN/PrinterShare and check that the server allows Kerberos (not NTLM-only). Trust the server certificate if prompted.

Customer

After clearing the keychain, the job still pauses. Anything in CUPS I should check?

Technician

Step 2 — Clean the CUPS queue
• Delete the printer from System Settings → Printers & Scanners.
• Open http://localhost:631 (enable via cupsctl WebInterface=Yes if needed). Remove the queue and any stalled jobs.
• Re-add using IPP(S) or SMB with FQDN. Check Use Kerberos Authentication if your server supports it, otherwise you’ll be prompted to save credentials to Keychain again.
• Test with a simple PDF from Preview.

Customer

We manage Macs with JAMF. Can we push a fix so users stop seeing prompts?

Technician

Absolutely. Options for enterprise:
• Deploy printers via configuration profile (IPP/LPD/SMB) using the server FQDN and enforce Kerberos where supported.
• Use NoMAD / Enterprise Connect or a JAMF script to renew tickets at login and after password change.
• Post-password-change policy: clear stored server credentials in the user’s login keychain and re-create the printer.
• Ensure DNS and time are correct; mismatches break Kerberos and trigger Hold for Authentication.

Customer

It works after re-adding via IPPS and renewing tickets. Any final checks so it stays fixed?

Technician

Final checks:
• In Keychain Access, confirm a single saved password (or Kerberos) for the queue’s FQDN.
• Run klist to verify a valid TGT; set a reminder to renew after VPN reconnects.
• Keep macOS time synced (NTP), and ensure the print server’s certificate is trusted.
• Avoid renaming queues; broken URIs can re-prompt for auth.
Need help with profiles or JAMF scripts? Open the chat.

Customer

Perfect — no more “Hold for Authentication” prompts. Printing is back to normal.

Technician

Summary: Fix macOS “Hold for Authentication” by repairing Keychain credentials, renewing Kerberos tickets, using the server’s FQDN, and re-adding the printer via IPP(S) or SMB. Enterprise teams can push a profile and ticket-renewal policy to stop prompts long-term. Need a hand? Open the chat.

Quick answer: the accepted fix

Accepted fix for macOS “Hold for Authentication”: delete outdated server passwords from Keychain Access, reset/align the login keychain with your AD password, renew Kerberos (klist/kinit), then re-add the printer using IPPS or SMB with the server’s FQDN and trusted certificate.

FAQ

Step-by-step (macOS)

1. Open Keychain Access → remove old smb:///ipp:// credentials for the print server; align login keychain with your AD password.
2. In Terminal: kdestroy then kinit UPN@DOMAIN; verify with klist.
3. Delete the printer; re-add via IPPS or SMB using the server’s FQDN; trust the certificate.
4. Test printing; if prompts return, check time/DNS, VPN, and certificate chain. Consider a JAMF profile to deploy the queue and renew tickets.

Note for mixed environments (Windows print servers)

1. Use queues published with FQDN and Kerberos enabled; avoid NTLM-only shares if possible.
2. If using SMB, ensure the Mac connects as DOMAIN\\username and that the saved Keychain item matches.

Sources

• Apple — Keychain Access
• CUPS — Administration & troubleshooting
• Microsoft — Print server protocols (IPP/SMB)

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.