Get Active directory users in C# error

Hello,
I am tring to get all folders and users name from AD in C#, but got error.
this is my code:
   DirectoryEntry de = new DirectoryEntry(domainName, ConfigurationManager.AppSettings[AdminUserName],    ConfigurationManager.AppSettings[AdminUserPwd]);
            de.AuthenticationType = AuthenticationTypes.Secure;
            DirectorySearcher myDirectorySearcher = new DirectorySearcher(de);
            myDirectorySearcher.Filter = "sAMAccountName=" + AdminUserName;
            myDirectorySearcher.PropertiesToLoad.Add("MemberOf");
            SearchResult myresult = myDirectorySearcher.FindOne(); // Error is here
"The provider does not support searching and cannot search "
Thanks,
Deepak
Deepak

Hello,
This forum is for discussions and questions regarding profiles and Microsoft's recognition system on the MSDN and TechNet sites. It is not for products/technologies.
As it's off-topic here, I am moving the question to the
Where is the forum for... forum.
Karl
When you see answers and helpful posts, please click Vote As Helpful, Propose As Answer, and/or Mark As Answer.
My Blog: Unlock PowerShell
My Book: Windows PowerShell 2.0 Bible
My E-mail: -join ('6F6C646B61726C40686F746D61696C2E636F6D'-split'(?<=\G.{2})'|%{if($_){[char][int]"0x$_"}})

Similar Messages

  • Getting Active Directory Users in UCM User Admin - Users Tab

    Hello All
    We have integrated WLS with our Active Directory. And we are getting all the active directory users under Security Realms >myrealm >Users and Groups tab in WLS Console.
    We are also able to login to webcenter spaces and Content server using those userid and credentials. But our problem is in UCM under Admin Applets - User Admin - Users tab all the active directory users are not listed. So we are not able to assign particular roles to the users.
    When a particular Active Directory user logins in UCM (First Time) after that the admisistrator (weblogic) is able to get that user under Admin Applets - User Admin - Users tab. And also it comes as an External user so we are not able to assign role.
    So basically UCM requires a login to get all the users listed in users tab.
    Our requirement is we want all the Active Directory users to get listed in UCM without the condition that the users has to login in content server once.
    Thanks

    Hi Navin ,
    First and foremost the requirement that you have posted is not possible and the reason for that is :
    Users are created on AD which is outside the realm of UCM hence there is no way that the users created on AD will be shown up under Users tab without they login atleast once . UCM does not know which all users are part of the realm until and unless the AD users login in atleast once .
    Secondly external users cannot be assigned roles from UCM because when the Auth type is set to External UCM sees it as external entity hence not giving it any way to relate roles / groups from UCM . As a workaround you can change the AuthType for the External users to Global from User Admin applet after the users login for the first time . This will enable you to assign roles / groups for the AD users .
    Hope this helps .
    Thanks
    Srinath

  • Building a Basic Runbook to disable a Active Directory User who has not logged in for 90 days.

    I am new to Orchestrator.  I am using Orchestrator 2012 R2 on a Hyper-V running Server 2008.  I have been trying to set up a Runbook to sweep AD for user accounts that have not logged in for 90 days and have those accounts automatically disabled
    and moved to another OU.  However, I would be happy just to have the account just be disabled.  If you need any more info or I have posted in the wrong forum, please let me know.  
    Thanks

    Hi,
    there is no SCO Activity to do this.
    Problem with this is, the LastLogedOn Times are not synced between DomainControllers.
    Best will be you take a look at this PowerShell Script
    http://gallery.technet.microsoft.com/scriptcenter/Get-Active-Directory-User-bbcdd771
    and change it to your needs
    Seidl Michael | http://www.techguy.at |
    twitter.com/techguyat | facebook.com/techguyat

  • Can not open Active Directory Users and Computers

    Problem Reported:
    Out of the blue this has started happening:
    When I go to "Active Directory Users and Computers" I get this message.
    "MMC cannot open the file C:\WINDOWS\system32\dsa.msc.
    This may be because the file does not exist, is not an MMC console, or was created by a later version of MMC. This may also be because you do not have sufficient access rights to the file.
    Additional information:
    This is a server that has been in use for 2+ years with active directory users that can and do login everyday.
    As far as I know the system has no backup.
    dsa.msc IS located in the system32 folder
    I am using the administrator account.
    OS:
    Microsoft Windows Server 2003 R2
    Standard x64 Edition
    Service Pack 2
    Please help with detail. Thank you.

    Have you tried to uninstall ADUC administrative tool and re-install it again? If no, please give a try. 
    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
    Get Active Directory User Last Logon
    Create an Active Directory test domain similar to the production one
    Management of test accounts in an Active Directory production domain - Part I
    Management of test accounts in an Active Directory production domain - Part II
    Management of test accounts in an Active Directory production domain - Part III
    Reset Active Directory user password

  • Is it possible to get the active directory user name of the person

    Is it possible to get the active directory user name of the person who is logged onto a windows computer, when they are using your coldfusion site, the same way asp pages can do that?

    SECOND TRY TO POST THIS REPLY
    You have to turn on "Windows Integrated Security" and turn off anonymous login in the IIS web server, once that condition is met the cgi.AUTH_USER variable will be popluated with the domain/username of the user logged into the cient computer.
    If the user is using a windows browser on a windows client computer this will be done silently in the background.  Otherwise they will normally be presented with a login dialog box by the browser.

  • Cannot log into DTR with Active Directory User

    Greetings,
    I have set up and installed JDI correctly.  I can log into /devinf, the cbs, cms and sld systems with no problem using both Administrator and my JDI.Administrator that I assigned to an Active Directory user.  I can log into the DTR using a user from the database (i.e. Administrator), however, when trying to access the DTR with an Active Directory user, I get the following message:
    500   Internal Server Error
      SAP J2EE Engine/6.40 
      Application error occurred during the request procession.
      Details:   Error [javax.servlet.ServletException: Group found, but unique name "businessUnit.all.guests" is not unique!], with root cause [com.tssap.dtr.server.deltav.InternalServerException: Group found, but unique name "businessUnit.all.guests" is not unique!].  The ID of this error is
    Exception id: [0012798F81680042000000090000165C0003FE9AA3C0B86B].
    This group exists in multiple domainshowever, this has not caused us any issues to date with our portal and other pieces of SAP WASit's only this DTR error. 
    Any help is greatly appreciated.
    Thanks,
    Marty

    Hi Marty,
    In the document available at the link enclosed below, there is a part that explains how to configure DTR so that it always uses "Unique-IDs".
    http://help.sap.com/saphelp_nw04/helpdata/en/20/f4a94076b63713e10000000a155106/frameset.htm
    It is mentioned that this is valid for LDAP, but the information is applicable for Active Directory as well.
    Regards,
    Manohar

  • EFS Encrypted Files over home workgroup network via WebDAV avoiding Active Directory fixing Access Denied errors

    This is for information to help others
    KEYWORDS:
      - Sharing EFS encrypted files over a personal lan wlan wifi ap network
      - Access denied on create new file / new fold on encrypted EFS network file share remote mapped folder
      - transfer encryption keys / certificates
      - set trusted delegation for user + computer for EFS encrypted files via
    Kerberos
      - Windows Active Directory vs network file share
      - Setting up WinDAV server on Windows 7 Pro / Ultimate
    It has been a long painful road to discover this information.
    I hope sharing it helps you.
    Using EFS on Windows 7 pro / ultimate is easy and works great. See
    here and
    here
    So too is opening + editing encrypted files over a peer-to-peer Windows 7 network.
    HOWEVER, creating a new file / new folder over a peer-to-peer Windows 7 network
    won't work (unless you follow below steps).
    Typically, it is only discovered as an issue when a home user wants to use synchronisation software between their home computers which happens to have a few folders encrypted using windows EFS. I had this issue trying to use GoodSync.
    Typically an "Access Denied" error messages is thrown when a \\clientpc tries to create new folder / new file in an encrypted folder on a remote file share \\fileserver.
    Why such a EFS drama when a network is involved?
    Assume a home peer-to-peer network with 2pc:  \\fileserver  and  \\clientpc
    When a \\clientpc tries to create a new file or new folder on a \\fileserver (remote computer) it fails. In a terribly simplified explanation it is because the process on \\fileserver that is answering the network requests is a process working for a user on
    another machine (\\clientpc) and that \\fileserver process doesn't have access to an encryption certificate (as it isn't a user). Active Directory gets around this by using kerberos so the process can impersonate a \\fileserver user and then use their certificate
    (on behalf of the clienpc's data request).
    This behaviour is confusing, as a \\clientpc can open or edit an existing efs encrypted file or folder, just can't create a new file or folder. The reason editing + opening an encrypted file over a network file share is possible is because the encrypted
    file / folder already has an encryption certificate, so it is clear which certificate is required to open/edit the file. Creating a new file/folder requires a certificate to be assigned and a process doesn't have a profile or certificates assigned.
    Solutions
    There are two main approaches to solve this:
         1) SOLVE by setting up an Active Directory (efs files accessed through file shares)
              EFS operations occur on the computer storing the files.
              EFS files are decrypted then transmitted in plaintext to the client's computer
              This makes use of kerberos to impersonate a local user (and use their certificate for encrypt + decrypt)
         2) SOLVE by setting up WebDAV (efs files accessed through web folders)
               EFS operations occur on the client's local computer
               EFS files remain encrypted during transmission to the client's local computer where it is decrypted
               This avoids active directory domains, roaming or remote user profiles and having to be trusted for delegation.
               BUT it is a pain to set up, and most online WebDAV server setup sources are not for home peer-to-peer networks or contain details on how to setup WebDAV for EFS file provision
             READ BELOW as this does
    Create new encrypted file / folder on a network file share - via Active Directory
    It is easily possible to sort this out on a domain based (corporate) active directory network. It is well documented. See
    here. However, the problem is on a normal Windows 7 install (ie home peer-to-peer) to set up the server as part of an active directory domain is complicated, it is time consuming it is bulky, adds burden to operation of \\fileserver computer
    and adds network complexity, and is generally a pain for a home user. Don't. Use a WebDAV.
    Although this info is NOT for setting up EFS on an active directory domain [server],
    for those interested here is the gist:
    Use the Active Directory Users and Computers snap-in to configure delegation options for both users and computers. To trust a computer for delegation, open the computer’s Properties sheet and select Trusted for delegation. To allow a user
    account to be delegated, open the user’s Properties sheet. On the Account tab, under Account Options, clear the The account is sensitive and cannot be delegated check box. Do not select The account is trusted for delegation. This property is not used with
    EFS.
    NB: decrypted data is transmitted over the network in plaintext so reduce risk by enabling IP Security to use Encapsulating Security Payload (ESP)—which will encrypt transmitted data,
    Create new encrypted file / folder on a network file share - via WebDAV
    For home users it is possible to make it all work.
    Even better, the functionality is built into windows (pro + ultimate) so you don't need any external software and it doesn't cost anything. However, there are a few hotfixes you have to apply to make it work (see below).
    Setting up a wifi AP (for those less technical):
       a) START ... CMD
       b) type (no quotes): "netsh  wlan set hostednetwork mode=allow ssid=MyPersonalWifi key=12345 keyUsage=persistent"
       c) type (no quotes): "netsh  wlan start hostednetwork"
    Set up a WebDAV server on Windows 7 Pro / Ultimate
    -----ON THE FILESERVER------
       1  click START and type "Turn Windows Features On or Off" and open the link
           a) scroll down to "Internet Information Services" and expand it.
           b) put a tick in: "Web Management Tools" \ "IIS Management Console"
           c) put a tick in: "World Wide Web Services" \ "Common HTTP Features" \ "WebDAV Publishing"
           d) put a tick in: "World Wide Web Services" \ "Security" \ "Basic Authentication"
           e) put a tick in: "World Wide Web Services" \ "Security" \ "Windows Authentication"
           f) click ok
           g) run HOTFIX - ONLY if NOT running Windows 7 / windows 8
    KB892211 here ONLY for XP + Server 2003 (made in 2005)
    KB907306 here ONLY for Vista, XP, Server 2008, Server 2003 (made in 2007)
      2 Click START and type "Internet Information Services (IIS) Manager"
      3 in IIS, on the left under "connections" click your computer, then click "WebDAV Authoring Rules", then click "Open Feature"
           a) on the right side, under Actions, click "Enable WebDAV"
      4 in IIS, on the left under "connections" click your computer, then click "Authentication", then click "Open Feature"
           a) on the "Anonymous Authentication" and click "Disable"
           b) on the "Windows Authentication" and click "Enable"
          NB: Some Win 7 will not connect to a webDAV user using Basic Authentication.
            It can be by changing registry key:
               [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WebClient\Parameters]
               BasicAuthLevel=2
           c) on the "Windows Authentication" click "Advanced Settings"
               set Extended Protection to "Required"
           NB: Extended protection enhances the windows authentication with 2 security mechanisms to reduce "man in the middle" attacks
      5 in IIS, on the left under "connections" click your computer, then click "Authorization Rules", then click "Open Feature"
           a) on the right side, under Actions, click "Add Allow Rule"
           b) set this to "all users". This will control who can view the "Default Site" through a web browser
           NB: It is possible to specify a group (eg Administrators is popular) or a user account. However, if not set to "all users" this will require the specified group/user account to be used for logged in with on the
    clientpc.
           NB: Any user account specified here has to exist on the server. It has a bug in that it usernames specified here are not validated on input.
      6 in IIS, on the left under "connections" click your computer, then click "Directory Browsing", then click "Open Feature"
           a) on the right side, under Actions, click "Enable"
    HOTFIX - double escaping
      7 in IIS, on the left under "connections" click your computer, then click "Request Filtering", then click "Open Feature"
           a) on the right side, under Actions, click "Edit Feature Settings"
           b) tick the box "Allow double escaping"
         *THIS IS VERY IMPORTANT* if your filenames or foldernames contain characters like "+" or "&"
         These folders will appears blank with no subdirectories, or these files will not be readable unless this is ticked
         This is safe btw. Unchecked (default) it filters out requests that might possibly be misinterpreted by buggy code (eg double decode or build url's via string-concat without proper encoding). But any bug would need to be in IIS basic
    file serving and this has been rigorously tested by microsoft, so very unlikely. Its safe to "Allow double escaping".
      8 in IIS, on the left under "connections" right click "Default Web Site", then click "Add Virtual Directory"
           a) set the Alias to something sensible eg "D_Drive", set the physical path
           b) it is essential you click "connect as" and set
    this to a local user (on fileserver),
           if left as "pass through authentication" a client won't be able to create a new file or folder in an encrypted efs folder (on fileserver)
                 NB: the user account selected here must have the required EFS certificates installed.
                            See
    here and
    here
            NB: Sharing the root of a drive as an active directory (eg D:\ as "D_Drive") often can't be opened on clientpcs.
          This is due to windows setting all drive roots as hidden "administrative shares". Grrr.
           The work around is on the \\fileserver create an NTFS symbollic link
              e.g. to share the entire contents of "D:\",
                    on fileserver browse to site path (iis default this to c:\inetpub\wwwroot)
                    in cmd in this folder create an NTFS symbolic link to "D:\"
                    so in cmd type "cd c:\inetpub\wwwroot"
                    then in cmd type "mklink /D D_Drive D:\"
            NB: WebDAV will open this using a \\fileserver local user account, so double check local NTFS permissions for the local account (clients will login using)
             NB: If clientpc can see files but gets error on opening them, on clientpc click START, type "Manage Network Passwords", delete any "windows credentials" for the fileserver being used, restart
    clientpc
      9 in IIS, on the left under "connections" click on "WebDAV Authoring Rules", then click "Open Feature"
           a) click "Add authoring rules". Control access to this folder by selecting "all users" or "specified groups" or "specified users", then control whether they can read/write/source
           b) if some exist review existing allow or deny.
               Take care to not only review the "allow access to" settings
               but also review "permissions" (read/write/source)
           NB: this can be set here for all added virtual directories, or can be set under each virtual directory
      10 Open your firewall software and/or your router. Make an exception for port 80 and 443
           a) In Windows Firewall with Advanced Security click Inbound Rules, click New Rule
                 choose Port, enter "80, 443" (no speech marks), follow through to completion. Repeat for outbound.
              NB: take care over your choice to untick "Public", this can cause issues if no gateway is specified on the network (ie computer-to-computer with no router). See "Other problems+fixes"
    below, specifically "Cant find server due to network location"
           b) Repeat firewall exceptions on each client computer you expect to access the webDAV web folders on
    HOTFIX - MAJOR ISSUE - fix KB959439
      11 To fully understand this read "WebDAV HOTFIX: RAW DATA TRANSFERS" below
          a) On Windows 7 you need only change one tiny registry value:
               - click START, type "regedit", open link
               -browse to [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MRxDAV\Parameters]
               -on the EDIT menu click NEW, then click DWORD Value
               -Type "DisableEFSOnWebDav" to name it (no speech marks)
               -on the EDIT menu, click MODIFY, type 1, then click OK 
               -You MUST now restart this computer for the registry change to take effect.
          b) On Windows Server 2008 / Vista / XP you'll FIRST need to
    download Windows6.0-KB959439 here. Then do the above step.
             NB microsoft will ask for your email. They don't care about licence key legality, it is more to keep you updated if they modify that hotfix
      12 To test on local machine (eg \\fileserver) and deliberately bypass the firewall.
            a) make sure WebClient Service is running
                (click START, type "services" and open, scroll down to WebClient and check its status)
            b) Open your internet software. Go to address "http://localhost:80" or "http://localhost:80"
                It should show the default "IIS7" image.
                If not, as firewall and port blocking are bypassed (using localhost) it must be a webDAV server setting. Check "Authorization Rules" are set to "Allow All Users"           
            c) for one of the "virtual directories" you added (8), add its "alias" onto "http://localhost/"
                    e.g. http://localhost/D_drive
                If nothing is listed, check "Directory Browsing" is enabled
      13 To test on local machine or a networked client and deliberately try and access through the firewall or port opening of your router.
            a) make sure WebClient Service is running
                (click START, type "services" and open, scroll down to WebClient and check its status)
            b) open your internet software. Go to address "http://<computer>:80" or "http://<computer>:80".
                  eg if your server's computer name is "fileserver" go to "http://fileserver:80"
                  It should show the default "IIS7" image. If not, check firewall and port blocking. 
                  Any issue ie if (12) works but (13) doesn't,  will indicate a possible firewall issue or router port blocking issue.
           c) for one of the "virtual directories" you added (8), add its "alias" onto "http://<computername>:80/"
                   eg if alias is "C_driver" and your server's computer name is "fileserver" go to "http://fileserver:80/C_drive"
                   A directory listing of files should appear.
    --- ON EACH CLIENT ----
    HOTFIX - improve upload + download speeds
      14 Click START and type "Internet Options" and open the link
            a) click the "Connections" tab at the top
            b) click the "LAN Settings" button at the bottom right
            c) untick "Automatically detect settings"
    HOTFIX - remove 50mb file limit
      15 On Windows 7 you need only change one tiny registry value:
          a) click START, type "regedit", open link
          b) browse to [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WebClient\Parameters]
           c) click on "FileSizeLimitInBytes"
           d) on the EDIT menu, click MODIFY, type "ffffffff", then click OK (no quotes)
    HOTFIX - remove prompt for user+pass on opening an office or pdf document via WebDAV
     16 On each clientpc click START, type "Internet Options" and open it
             a) click on "Security" (top) and then "Custom level" (bottom)
             b) scroll right to the bottom and under "User Authentication" select "Automatic logon with current username and password"
             SUCH an easy fix. SUCH an annoying problem on a clientpc
       NB: this is only an issue if the file is opened through windows explorer. If opened through the "open" dialogue of the software itself, it doesn't happen. This is as a WebDAV mapped drive is consdered a "web folder" by windows
    explorer.
    TEST SETUP
      17 On the client use the normal "map network drive"
                e.g. server= "http://fileserver:80/C_drive", tick reconnect at logon
                e.g. CMD: net use * "http://fileserver:80/C_drive"
             If it doens't work check "WebDAV Authoring Rules" and check NTFS permissions for these folders. Check that on the filserver the elected impersonation user that the client is logging in with (clientpc
    "manage network passwords") has NTFS permissions.
      18 Test that EFS is now working over the network
           a) On a clientpc, map network drive to http://fileserver/
           b) navigate to a folder you know on the \\flieserver is encrypted with EFS
           c) create a new folder, create a new file.
               IF it throws an error, check carefully you mapped to the WebDAV and not file share
                  i.e. mapped to "http://fileserver" not "\\fileserver"
               Check that on clientpc the required efs certificate is installed. Then check carefully on clientpc what user account you specified during the map drive process. Then check on the \\fileserver this
    account exists and has the required EFS certificate installed for use. If necessary, on clientpc click START, type "Manage Network Passwords" and delete the windows credentials currently in the vault.
           d) on clientpc (through a webDAV mapped folder) open an encrypted file, edit it, save it, close it. On the \\fileserver now check that file is readable and not gobble-de-goup
           e) on clientpc copy an encrypted efs file into a folder (a webDAV mapped folder) you know is not encrypted on \\fileserver. Now check on the \\fileserver computer that the file is readable and not gobble-de-goup (ie the
    clientpc decrypted it then copied it).
            If this fails, it is likely one in IIS setting on fileserver one of the shared virtual directories is set to: "pass through authentication" when it should be set to "connect as"
            If this is not readable check step (11) and that you restarted the \\fileserver computer.
      19 Test that clients don't get the VERY annoying prompt when opening an Office or PDF doc
          a) on clientpc in windows explorer browse to a mapped folder you know is encrypted and open an office file and then PDF.
                If a prompt for user+pass then check hotfix (16)
      20 Consider setting up a recycling bin for this mapped drive, so files are sent to recycling bin not permanently deleted
          a) see the last comment at the very bottom of
    this page: 
    Points to consider:
       - NB: WebDAV runs on \\fileserver under a local user account, so double check local NTFS permissions for that local account and adjust file permissions accordingly. If the local account doesn't have permission, the webDAV / web folder share won't
    either.
      - CONSIDER: IP Security (IPSec) or Secure Sockets Layer (SSL) to protect files during transport.
    MORE INFO: HOTFIX: RAW DATA TRANSFERS
    More info on step (11) above.
    Because files remain encrypted during the file transfer and are decrypted by EFS locally, both uploads to and downloads from Web folders are raw data transfers. This is an advantage as if data is intercepted it is useless. This is a massive disadvantage as
    it can cause unexpected results. IT MUST BE FIXED or you could be in deep deep water!
    Consider using \\clientpc to access a webfolder on \\fileserver and copying an encrypted EFS file (over the network) to a web folder on \\fileserver that is not encrypted.
    Doing this locally would automatically decrypt the file first then copy the decrypted file to the non-encrypted folder.
    Doing this over the network to a web folder will copy the raw data, ie skip the decryption stage and result in the encrypted EFS file being raw copied to the non-encrypted folder. When viewed locally this file will not be recognised as encrypted (no encryption
    file flag, not green in windows explorer) but it will be un-readable as its contents are still encrypted. It is now not possible to locally read this file. It can only be viewed on the \\clientpc
    There is a fix:
          It is implimented above, see (11) above
          Microsoft's support page on this is excellent and short. Read "problem description" of "this microsoft webpage"
    Other problems + fixes
      PROBLEM: Can't find server due to network location.
         This one took me a long time to track down to "network location".
         Win 7 uses network locations "Home" / "Work" / "Public".
         If no gateway is specified in the IP address, the network is set to '"unidentified" and so receives "Public" settings.
         This is a disaster for remote file share access as typically "network discovery" and "file sharing" are disabled under "Public"
         FIX = either set IP address manually and specify a gateway
         FIX = or  force "unidentified" network locations to assume "home" or "work" settings -
    read here or
    here
         FIX = or  change the "Public" "advanced network settings" to turn on "network discovery" and "file sharing" and "Password Protected Sharing". This is safe as it will require a windows
    login to gain file access.
      PROBLEM: Deleting files on network drive permanently deletes them, there is no recycling bin
           By changing the location of "My Contacts" or similar to the root directory of your mapped drive, it will be added to recycling bin locations
          Read
    here (i've posted a batch script to automatically make the required reg files)
    I really hope this helps people. I hope the keywords + long title give it the best chance of being picked up in web searches.

    What probably happens is that processes are using those mounts. And that those processes are not killed before the mounts are unmounted. Is there anything that uses those mounts?

  • What do I need to do to enable Active Directory users to authenticate to AFP shares in 10.8 server?

    We recently upgraded from 10.6 server to 10.8 server and are having trouble with AFP shares and Active Directory.  We have shares on each of our OS X servers that should be mountable by any Active Directory user at the site the server resides.  In 10.6, this worked beautifully.  Simply adding the appropriate AD groups with appropriate permissions to the ACL of the folder(s) being shared worked without a hitch.  In 10.8 server, this is not working.  Permissions are defined correctly (as far as I can tell), the server is bound to AD, but yet no AD user who should have access can mount the share.  When attempting to mount the share on a 10.6 client, the user gets the short and simple "You entered an invalid username or password.  Please try again."  On a 10.7 client, the window shakes. 
    What confuses me even more is that no local users can mount the share as well.  I try as our admin account, I receive the following error message on our 10.6 clients:
    Actually, as I was forumulating this post, logging in as the server administrator account is now working...???!!!
    This was the error message we were receiving on 10.7 clients before it magically started working:
    In any case, authenticating as an AD user is still no go.  Any ideas?

    I had something similar to this. In the name field put in DOMAIN\username rather than just the name.

  • Windows 2008 Server - Cannot run Active Directory Users and Computers

    Hi,
    I am running Windows 2008 Server with latest windows updates installed. Directory Services Role also.
    I attempt to open Active Directory Users and Computers tool and I get a;
    Microsoft Visual C++ Runtime Library error;
    "The Application has requested the runtime to terminate it in a unusual way. Please contact the application's support team for more information"
    I click ok, then get the following debug info;
    Problem signature:
    Problem Event Name: APPCRASH
    Application Name: mmc.exe
    Application Version: 6.0.6001.18000
    Application Timestamp: 47919524
    Fault Module Name: msvcrt.dll
    Fault Module Version: 7.0.6001.18000
    Fault Module Timestamp: 4791ad6b
    Exception Code: 40000015
    Exception Offset: 0000000000029b06
    OS Version: 6.0.6001.2.1.0.272.7
    Locale ID: 3081
    Additional Information 1: 43aa
    Additional Information 2: cf3a46656318492c1997480001b6b0e0
    Additional Information 3: 3837
    Additional Information 4: 92f72e0d0589ff77cef51e0a413aeff6
    Read our privacy statement:
    http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409
    If someone could please assist, it would be very much appreciated.
    Regards
    B

     
    Hi,
    To solidly troubleshoot this kind of issue, we need to debug dump file. A suggestion would be to contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.
    To obtain the phone numbers for specific technology request please take a look at the web site listed below:
    http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
    However, I am also glad to share my research.
    Some third party applications may lead to this error. Please check if you install other third party applications on Windows server 2008?
    Also, please follow the article below to perform necessary steps to see how it's going?
    FIX: You receive an "invalid page fault in module MSVCRT.DLL" error message after you install the run-time libraries from Visual C++ 6.0
    http://support.microsoft.com/kb/190536/en-us
    Hope this helps.
    Best wishes
    Morgan Che

  • Not able to open active directory user and computer in windows server 2008r2

    Hi All techies,
    i would like to know one issue which i am facing mostly, i have created 5 virtual machine all with window server2008r2 and one windows 7 on vm-ware now when ever i start my virtual machines everything going rite but when i try to open active directory user/
    computer or domain and trust i get a following error "data from active directory user and computers is not available from dc(null) bcoz unspecified error" even when i chk in events log its give me no help, and after 15-30 min everything works good
    Please let me know the cause of it and really appreciate it .
    Thanks
    Atul

    You need to ensure that
    1. group policy that says "wait for network before logon" is applied to all computers including servers and workstations is applied
    2. DNS record exists for all DCs in DNS
    3. If there are multiple Domain Controllers in Forests, then they point them as secondary DNS server. This way they will be able to resolve IPs if local DNS server service takes time to start.
    As Chris mentioned, you need to start all DCs first, give a time of 5 minutes and then start member servers and workstations for successful logon.
    - Sarvesh Goel - Enterprise Messaging Administrator

  • SMB access for Active Directory users

    Hi there,
    My server is an OD Master bound to AD for authentication and my institution's Kerberos realm.
    When I try to share files from the server via SMB and connect as an Active Directory user I get the following error in the logs:
    [2009/06/11 12:02:27, 1, pid=5308] /SourceCache/samba/samba-187.8/samba/source/libads/kerberosverify.c:ads_verifyticket(428)
    adsverifyticket: smbkrb5_parse_name(myserver$) failed (Configuration file does not specify default realm)
    [2009/06/11 12:02:27, 1, pid=5308] /SourceCache/samba/samba-187.8/samba/source/smbd/sesssetup.c:replyspnegokerberos(340)
    Failed to verify incoming ticket with error NTSTATUS_LOGONFAILURE!
    I've read something vague about having to Kerberize the SMB service seperately so I'm not sure if that's the problem.
    My smb.conf file is as follows:
    ; Configuration file for the Samba software suite.
    ; ============================================================================
    ; For the format of this file and comprehensive descriptions of all the
    ; configuration option, please refer to the man page for smb.conf(5).
    ; The following configuration should suit most systems for basic usage and
    ; initial testing. It gives all clients access to their home directories and
    ; allows access to all printers specified in /etc/printcap.
    ; BEGIN required configuration
    ; Parameters inside the required configuration block should not be altered.
    ; They may be changed at any time by upgrades or other automated processes.
    ; Site-specific customizations will only be preserved if they are done
    ; outside this block. If you choose to make customizations, it is your
    ; own responsibility to verify that they work correctly with the supported
    ; configuration tools.
    [global]
    debug pid = yes
    log level = 1
    server string = Mac OS X
    printcap name = cups
    printing = cups
    encrypt passwords = yes
    use spnego = yes
    passdb backend = odsam
    idmap domains = default
    idmap config default: default = yes
    idmap config default: backend = odsam
    idmap alloc backend = odsam
    idmap negative cache time = 5
    map to guest = Bad User
    guest account = nobody
    unix charset = UTF-8-MAC
    display charset = UTF-8-MAC
    dos charset = 437
    vfs objects = darwinacl,darwin_streams
    ; Don't become a master browser unless absolutely necessary.
    os level = 2
    domain master = no
    ; For performance reasons, set the transmit buffer size
    ; to the maximum and enable sendfile support.
    max xmit = 131072
    use sendfile = yes
    ; The darwin_streams module gives us named streams support.
    stream support = yes
    ea support = yes
    ; Enable locking coherency with AFP.
    darwin_streams:brlm = yes
    ; Core files are invariably disabled system-wide, but attempting to
    ; dump core will trigger a crash report, so we still want to try.
    enable core files = yes
    ; Configure usershares for use by the synchronize-shares tool.
    usershare max shares = 1000
    usershare path = /var/samba/shares
    usershare owner only = no
    usershare allow guests = yes
    usershare allow full config = yes
    ; Filter inaccessible shares from the browse list.
    com.apple:filter shares by access = yes
    ; Check in with PAM to enforce SACL access policy.
    obey pam restrictions = yes
    ; Don't be trying to enforce ACLs in userspace.
    acl check permissions = no
    ; Make sure that we resolve unqualified names as NetBIOS before DNS.
    name resolve order = lmhosts wins bcast host
    ; Pull in system-wide preference settings. These are managed by
    ; synchronize-preferences tool.
    include = /var/db/smb.conf
    [printers]
    comment = All Printers
    path = /tmp
    printable = yes
    guest ok = no
    create mode = 0700
    writeable = no
    browseable = no
    ; Site-specific parameters can be added below this comment.
    ; END required configuration.
    Any help would be much appreciated!!
    Thanks.

    I am now having the same problem - a Windows server trying to access a file share on the Mac Server is presented with the same error message in the log files:
    [2009/06/29 21:34:56, 2, pid=485] /SourceCache/samba/samba-187.8/samba/source/smbd/sesssetup.c:setupnew_vcsession(1260)
    setupnew_vcsession: New VC == 0, if NT4.x compatible we would close all old resources.
    [2009/06/29 21:34:56, 1, pid=485] /SourceCache/samba/samba-187.8/samba/source/libads/kerberosverify.c:ads_verifyticket(428)
    adsverifyticket: smbkrb5_parsename(vifile$) failed (Configuration file does not specify default realm)
    [2009/06/29 21:34:56, 1, pid=485] /SourceCache/samba/samba-187.8/samba/source/smbd/sesssetup.c:replyspnegokerberos(340)
    Failed to verify incoming ticket with error NTSTATUS_LOGONFAILURE!
    Workgroup manager can read from Active Directory - seems to be jiving correctly - my server (SMB) is in Domain Member mode...
    When I try to access system from \\UNC command, I am presented with username/password prompt and nothing works.
    Not feeling the Mac OS X love tonight.
    Bill
    System is bound to active directory - green light in Directory Utility

  • Exchange 2010 - #554 5.2.0 The Active Directory user wasn't found

    We have migrated form Exchange 2003 to Exchange 2010 a year ago with no issues. All Exchange legacy servers uninstalled with no issues. We had an issue today were emails sent to mail-enabled public folder was returning NDRs. This happened on two or three
    and then trickled down thorugh several public folders. This client has several public folders and uses them for business processes. There have been 100s of incidents now. 
    Symtoms:
    E-mail messages that been sent to mail-enabled public folder in Exchange Server 2010 environment rejected with the following NDR:
    #554 5.2.0 STOREDRV.Deliver.Exception:ObjectNotFoundException; Failed to process message due to a permanent exception with message The Active Directory user wasn't found. ObjectNotFoundException: The Active Directory user wasn't found. ##
    We are getting the following Event log messages on Hub transport servers.
    Log Name:      Application
    Source:        MSExchange Store Driver
    Date:          5/29/2014 2:45:53 PM
    Event ID:      1020
    Task Category: MSExchangeStoreDriver
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      xxxxxx
    Description:
    The store driver couldn't deliver the public folder replication message "Backfill Request (xxxxxxx)" because the following error occurred: The Active Directory user wasn't found..
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="MSExchange Store Driver" />
        <EventID Qualifiers="49156">1020</EventID>
        <Level>2</Level>
        <Task>1</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-05-29T18:45:53.000000000Z" />
        <EventRecordID>168407</EventRecordID>
        <Channel>Application</Channel>
        <Computer>xxxxxx</Computer>
        <Security />
      </System>
      <EventData>
        <Data>"Backfill Request (xxxxxxx)"</Data>
        <Data>The Active Directory user wasn't found.</Data>
      </EventData>
    </Event>
    Actions:
    We have executed the following steps.
    1. Start the ADSI Edit MMC Snap-in. Click Start, then Run, and type adsiedit.msc, and then click OK.
    2.       Connect & Expand the Configuration Container [YourServer.DNSDomainName.com], and then expand CN=Configuration,DC=DNSDomainName,DC=com.
    3.       Expand CN=Services, and then CN=Microsoft Exchange, and then expand CN=YourOrganizationName.
    4.       You will see an empty Administrative Group. Expand the  CN=YourAdministrativeGroupName.
    5.       Expand CN=Servers.
    6.       Verify there are no server objects listed under the  CN=Servers container.
    7.       Right click on the empty CN=Servers container and choose Delete.
    8.       Verify the modification, and try to send again the E-mail to the mail-enabled public folder.
    To no avail the issue still exists.
    We have not rebooted the servers and plan to in the early morning.
    We have dismounted/mounted public folder DBs
     Does anyone have any other suggestions?
    Danny Kennedy, MCSE, MCITP

    I have already uninstalled legacy servers a year ago.
    This was the solution:
    I moved the public folder hierarchy to exchange 2010 using ADSIEdit.
                                      If you don't know adsiedit tool that much check this
    http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay?javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken&javax.portlet.prp_ba847bafb2a2d782fcbb0710b053ce01=wsrp-navigationalState%3DdocId%253Demr_na-c03067450-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.tpst=ba847bafb2a2d782fcbb0710b053ce01&sp4ts.oid=1840527&ac.admitted=1401455429281.876444892.492883150
    Danny Kennedy, MCSE, MCITP

  • How to display active directory users through weblogic portal Application?

    Hi,
    Does anyone has faced this situation?
    I configured the activedirectory and able to see the users and group in the weblogic console at Security->Realms->Myrealm->users. when I run my portal application,I am able to see only the users that are configured in embedded weblogic LDAP ie, I can see only the users weblogic,portaladmin and yahooadmin that are of defaultauthenticator provider.I need to display the active directory users also in our portal.
    I have two doubts on this?
    1)Is it I need to write custom code to view the active directory users in our portal?
    2)Does I need to use any jars that supports active directory authenticator?
    I would appreciate if any one can reply on this with helpfull docs/information.
    We are using BEA 8.1 SP4.
    Windows 2000.
    Surendra

    Hi,
    I too have a similar kind of requirement, i use a jsp to do this activity, but i get an exception, i have shown the entire jsp code below,
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
    <%@ page import="java.util.Set" %>
    <%@ page import="javax.naming.Context" %>
    <%@ page import="weblogic.jndi.Environment" %>
    <%@ page import="weblogic.management.MBeanHome" %>
    <%@ page import="weblogic.management.configuration.DomainMBean" %>
    <%@ page import="weblogic.management.configuration.SecurityConfigurationMBean" %>
    <%@ page import="weblogic.management.security.RealmMBean" %>
    <%@ page import="weblogic.management.security.authentication.AuthenticationProviderMBean" %>
    <%@ page import="weblogic.management.security.authentication.UserPasswordEditorMBean" %>
    <%@ page import="weblogic.security.providers.authentication.LDAPAuthenticatorMBean" %>
    <%@ page import="weblogic.management.configuration.EmbeddedLDAPMBean" %>
    <%@ page import="weblogic.management.security.authentication.UserEditorMBean" %>
    <%@ page import="weblogic.management.security.authentication.UserReaderMBean" %>
    <%@ page import="weblogic.management.security.authentication.GroupReaderMBean" %>
    <%@ page import="weblogic.management.utils.ListerMBean" %>
    <%@ page import="javax.management.MBeanException" %>
    <%@ page import="javax.management.modelmbean.RequiredModelMBean" %>
    <%@ page import="examples.security.providers.authentication.manageable.*" %>
    <%@ page import="weblogic.security.providers.authentication.ActiveDirectoryAuthenticatorMBean" %>
    <%@ page import="weblogic.management.utils.InvalidParameterException" %>
    <%@ page import="weblogic.management.utils.NotFoundException" %>
    <%@ page import="weblogic.security.SimpleCallbackHandler" %>
    <%@ page import="weblogic.servlet.security.ServletAuthentication"%>
    <%!
    private String makeErrorURL(HttpServletResponse response,
    String message)
    return response.encodeRedirectURL("welcome.jsp?errormsg=" + message);
    %>
    <html>
    <head>
    <title>Password Changed</title>
    </head>
    <body>
    <h1>Password Changed</h1>
    <%
    // Note that even though we are running as a privileged user,
    // response.getRemoteUser() still returns the user who authenticated.
    // weblogic.security.Security.getCurrentUser() will return the
    // run-as user.
    System.out.println("------------------------------------------------------------------");
    String username = request.getRemoteUser();
    System.out.println("User name -->"+username);
    // Get the arguments
    String currentpassword = request.getParameter("currentpassword");
    System.out.println("Current password -->"+currentpassword);
    String newpassword = request.getParameter("newpassword");
    System.out.println("New password -->"+newpassword);
    String confirmpassword = request.getParameter("confirmpassword");
    System.out.println("Confirm password -->"+confirmpassword);
    // Validate the arguments
    if (currentpassword == null || currentpassword.length() == 0 ||
    newpassword == null || newpassword.length() == 0 ||
    confirmpassword == null || confirmpassword.length() == 0) { 
    response.sendRedirect(makeErrorURL(response, "Password must not be null."));
    return;
    if (!newpassword.equals(confirmpassword)) {
    response.sendRedirect(makeErrorURL(response, "New passwords did not match."));
    return;
    if (username == null || username.length() == 0) {
    response.sendRedirect(makeErrorURL(response, "Username must not be null."));
    return;
    // First get the MBeanHome
    String url = request.getScheme() + "://" +
    request.getServerName() + ":" +
    request.getServerPort();
    System.out.println("URL -->"+url);
    Environment env = new Environment();
    env.setProviderUrl(url);
    Context ctx = env.getInitialContext();
    MBeanHome mbeanHome = (MBeanHome) ctx.lookup(MBeanHome.LOCAL_JNDI_NAME);
    System.out.println("MBean home obtained....");
    DomainMBean domain = mbeanHome.getActiveDomain();
    SecurityConfigurationMBean secConf = domain.getSecurityConfiguration();
    // Sar
    EmbeddedLDAPMBean eldapBean = domain.getEmbeddedLDAP();
    System.out.println("Embedded LDAP Bean obtained...."+eldapBean );
    RealmMBean realm = secConf.findDefaultRealm();
    System.out.println("RealmMBean obtained....");
    AuthenticationProviderMBean authenticators[] = realm.getAuthenticationProviders();
    System.out.println("AuthProvMBean obtained....");
    // Now get the UserPasswordEditorMBean
    // This code will work with any configuration that has a
    // UserPasswordEditorMBean.
    // The default authenticator implements these interfaces
    // but other providers could work as well.
    // We try each one looking for the provider that knows about
    // this user.
    boolean changed=false;
    UserPasswordEditorMBean passwordEditorMBean = null;
    System.out.println("UserPwdEdtMBean obtained....");
    //System.out.println("Creating MSAI....");
    //ManageableSampleAuthenticatorImpl msai =
    // new ManageableSampleAuthenticatorImpl(new RequiredModelMBean());
    //System.out.println("Done....");
    for (int i=0; i<authenticators.length; i++) {
    System.out.println("### Authenticator --->"+authenticators);
    if (authenticators[i] instanceof ActiveDirectoryAuthenticatorMBean)
    ActiveDirectoryAuthenticatorMBean adamb =
    (ActiveDirectoryAuthenticatorMBean)authenticators[i];
    System.out.println("### ActiveDirectoryAuthenticatorMBean .....");
    String listers = adamb.listUsers("*",0);
    while(adamb.haveCurrent(listers))
    System.out.println("### ActiveDirectoryAuthenticatorMBean user advancement.....");
    adamb.advance(listers);
    if (authenticators[i] instanceof UserPasswordEditorMBean) {
    passwordEditorMBean = (UserPasswordEditorMBean) authenticators[i];
    System.out.println("Auth match ...."+passwordEditorMBean);
    try {
    // Now we change the password
    // Sar comment
    System.out.println("Password changed....");
    //passwordEditorMBean.changeUserPassword(username,
    // currentpassword, newpassword);
    changed=true;
    // Sar Comment
    catch (InvalidParameterException e) {
    response.sendRedirect(makeErrorURL(response, "Caught exception " + e));
    return;
    catch (NotFoundException e) {
    catch (Exception e) {
    response.sendRedirect(makeErrorURL(response, "Caught exception " + e));
    return;
    // Sar code
    LDAPAuthenticatorMBean ldapBean = null;
    UserReaderMBean urMBean = null;
    UserEditorMBean ueMBean = null;
    GroupReaderMBean gMBean = null;
    //ListerMBean lBean = null;
    try
    if (authenticators[i] instanceof LDAPAuthenticatorMBean)
    ldapBean = (LDAPAuthenticatorMBean) authenticators[i];
    String userFilter = ldapBean.getAllUsersFilter();
    System.out.println("userFilter ="+userFilter);
    if (authenticators[i] instanceof UserEditorMBean)
    try
    System.out.println("UserEditorMBean...");
    ueMBean = (UserEditorMBean) authenticators[i];
    System.out.println("List users..."+ueMBean);
    boolean b = ueMBean.userExists("webuser");
    System.out.println("User Exists->>>"+b);
    String cursor = ueMBean.listUsers("webuser", 2);
    System.out.println("List User ----->"+cursor);
    catch(InvalidParameterException e)
    response.sendRedirect(makeErrorURL(response, "ERROR InvalidParameterException:" + e));
    catch(java.lang.reflect.UndeclaredThrowableException e)
    response.sendRedirect(makeErrorURL(response, "ERROR UndeclaredThrowableException :" + e));
    e.printStackTrace();
    catch(Exception e)
    response.sendRedirect(makeErrorURL(response, "ERROR LBean:" + e));
    catch(Exception ex)
    ex.printStackTrace();
    response.sendRedirect(makeErrorURL(response, "ERROR:" + ex));
    return;
    if (passwordEditorMBean == null) {
    response.sendRedirect(makeErrorURL(response, "Internal error: Can't get UserPasswordEditorMBean."));
    return;
    System.out.println("pwd changed ->"+changed);
    if (!changed) {
    // This happens when the current user is not known to any providers
    // that implement UserPasswordEditorMBean
    response.sendRedirect(makeErrorURL(response,
    "No password editors know about user " + username + "."));
    return;
    %>
    User <%= username %>'s password has been changed!
    <br>
    <br>
    </body>
    </html>
    Here is the console log
    User name -->webuser
    Current password -->i
    New password -->u
    Confirm password -->u
    URL -->http://localhost:7011
    MBean home obtained....
    Embedded LDAP Bean obtained....[Caching Stub]Proxy for mydomain:Name=mydomain,Type=EmbeddedLDAP
    RealmMBean obtained....
    AuthProvMBean obtained....
    UserPwdEdtMBean obtained....
    ### Authenticator --->Security:Name=myrealmDefaultAuthenticator
    Auth match ....Security:Name=myrealmDefaultAuthenticator
    Password changed....
    UserEditorMBean...
    List users...Security:Name=myrealmDefaultAuthenticator
    User Exists->>>true
    java.lang.reflect.UndeclaredThrowableException
    at $Proxy1.listUsers(Unknown Source)
    at jsp_servlet.__updatepassword._jspService(__updatepassword.java:411)
    at weblogic.servlet.jsp.JspBase.service(JspBase.java:33)
    at weblogic.servlet.internal.ServletStubImpl$ServletInvocationAction.run(ServletStubImpl.jav
    a:1006)
    at weblogic.servlet.internal.ServletStubImpl.invokeServlet(ServletStubImpl.java:419)
    at weblogic.servlet.internal.ServletStubImpl.invokeServlet(ServletStubImpl.java:463)
    at weblogic.servlet.internal.ServletStubImpl.invokeServlet(ServletStubImpl.java:315)
    at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletC
    ontext.java:6718)
    at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
    at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:121)
    at weblogic.servlet.internal.WebAppServletContext.invokeServlet(WebAppServletContext.java:37
    64)
    at weblogic.servlet.internal.ServletRequestImpl.execute(ServletRequestImpl.java:2644)
    at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:219)
    at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:178)
    Caused by: javax.management.MBeanException
    at weblogic.management.commo.CommoModelMBean.invoke(CommoModelMBean.java:551)
    at com.sun.management.jmx.MBeanServerImpl.invoke(MBeanServerImpl.java:1560)
    at com.sun.management.jmx.MBeanServerImpl.invoke(MBeanServerImpl.java:1528)
    at weblogic.management.internal.RemoteMBeanServerImpl.private_invoke(RemoteMBeanServerImpl.j
    ava:988)
    at weblogic.management.internal.RemoteMBeanServerImpl.invoke(RemoteMBeanServerImpl.java:946)
    at weblogic.management.commo.CommoProxy.invoke(CommoProxy.java:365)
    ... 14 more
    ### Authenticator --->Security:Name=myrealmDefaultIdentityAsserter
    pwd changed ->true
    Can u pls let me know how to get all the entries from LDAP.
    Thanx
    Sar

  • Unable to login @ login window with Active Directory User

    I successfully bound my test machine to Active Directory and can search using dscl and id. I can also su to my active directory user account an authenticate perfectly. All search bases are correct and everything else looks fine.
    When I attempt to login from the login window as an AD user, the window shakes. Clicking under Mac OS X shows that "Network Accounts Available". Looks like the CLI tool "dirt" is now gone as well, although insecure it would possibly show something here.
    Anyone else having issues after binding to AD? I bound using the Directory Utility gui... I have not tried using my leopard bind script yet.
    Thanks,
    Ken

    I have pretty well the same problem. The machine was already bound to AD prior to upgrade. After could not login on with my account (jball). Can log on with other accounts from the same domain (we only have one AD domain). Can also su to jball in a terminal session. Can't access network resources with jball when I try to connect to a windows server through the finder, instantly comes up with bad username or password, doesn't even think about it.
    I have removed any copies of the home folder under either /Users or /Domain as I have had problems with that before. Have repaired permissions and unbind and bind the machine to AD. Have been at this all day now and no closer. Get these error messages in console:
    31/08/09 4:49:27 PM SecurityAgent[666] Could not get the user record for 'jball@domainname' from Directory Services
    31/08/09 4:49:27 PM SecurityAgent[666] User info context values set for jball@domainname
    31/08/09 4:49:27 PM SecurityAgent[666] unknown-user (jball@domainname) login attempt PASSED for auditing

  • Exporting Active directory users to excel with conditions

    I'm trying to export AD users with selected fields out to a spreadsheet, with the condition that the employeeid field is greater than 99999.    I found a VBScript elsewhere on this site that does everything i need, even filtering on the employeeid
    field except that when it export to the spreadsheet the employeeid field comes back as if it's blank.  But i know it's not as it will do the filtering correctly.  Below is the script i've been using.   As i said it will correctly list all users
    with employeeid greated than 5 digits but it just won't export the actual employeeid field
    Dim ObjWb 
    Dim ObjExcel 
    Dim x, zz 
    Set objRoot = GetObject("LDAP://RootDSE") 
    strDNC = objRoot.Get("DefaultNamingContext") 
    Set objDomain = GetObject("LDAP://" & strDNC) ' Bind to the top of the Domain using LDAP using ROotDSE 
    Call ExcelSetup("Sheet1") ' Sub to make Excel Document 
    x = 1 
    Call enummembers(objDomain) 
    Sub enumMembers(objDomain) 
    On Error Resume Next 
    Dim Secondary(20) ' Variable to store the Array of 2ndary email alias's 
    For Each objMember In objDomain ' go through the collection 
    if ObjMember.EmployeeID > 199999 Then  'if employee id greater than 199999 then add to spreadsheet (meaning physician)
    x = x +1 ' counter used to increment the cells in Excel 
    ' I set AD properties to variables so if needed you could do Null checks or add if/then's to this code 
    ' this was done so the script could be modified easier. 
    SamAccountName = ObjMember.samAccountName 
    FirstName = objMember.GivenName 
    LastName = objMember.sn 
    EmployeeID = ojbMember.employeeID
    EmailAddr = objMember.mail 
    Addr1 = objMember.streetAddress 
    Title = ObjMember.Title 
    Department = objMember.Department
    ' Write the values to Excel, using the X counter to increment the rows. 
    objwb.Cells(x, 1).Value = EmployeeID
    objwb.Cells(x, 2).Value = SamAccountName 
    objwb.Cells(x, 3).Value = FirstName 
    objwb.Cells(x, 4).Value = LastName 
    objwb.Cells(x, 5).Value = EmailAddr
    objwb.Cells(x, 6).Value = Addr1 
    objwb.Cells(x, 7).Value = Title 
    objwb.Cells(x, 8).Value = Department 
    ' Write out the Array for the 2ndary email addresses. 
    For ll = 1 To 20 
    objwb.Cells(x,26+ll).Value = Secondary(ll) 
    Next 
    ' Blank out Variables in case the next object doesn't have a value for the property 
    EmployeeID = "-"
    SamAccountName = "-" 
    FirstName = "-" 
    LastName = "-" 
    EmailAddr = "-" 
    Addr1 = "-" 
    Title = "-" 
    Department = "-" 
    For ll = 1 To 20 
    Secondary(ll) = "" 
    Next 
    End If 
    ' If the AD enumeration runs into an OU object, call the Sub again to itinerate 
    If objMember.Class = "organizationalUnit" or OBjMember.Class = "container" Then 
    enumMembers (objMember) 
    End If 
    Next 
    End Sub 
    Sub ExcelSetup(shtName) ' This sub creates an Excel worksheet and adds Column heads to the 1st row 
    Set objExcel = CreateObject("Excel.Application") 
    Set objwb = objExcel.Workbooks.Add 
    Set objwb = objExcel.ActiveWorkbook.Worksheets(shtName) 
    Objwb.Name = "Active Directory Users" ' name the sheet 
    objwb.Activate 
    objExcel.Visible = True 
    objwb.Cells(1, 1).Value = "EmployeeID"
    objwb.Cells(1, 2).Value = "SAMAccountName"
    objwb.Cells(1, 3).Value = "FirstName" 
    objwb.Cells(1, 4).Value = "LastName"  
    objwb.Cells(1, 5).Value = "Email" 
    objwb.Cells(1, 6).Value = "Addr1" 
    objwb.Cells(1, 7).Value = "Title" 
    objwb.Cells(1, 8).Value = "Department" 
    End Sub 
    MsgBox "User dump has completed.", 64, "AD Dump" ' show that script is complete

    Here is a test version
    Set xl = CreateObject("Excel.Application")
    xl.Visible = True
    Set wb = xl.Workbooks.Add()
    Set sheet = wb.Worksheets("sheet1")
    sheet.Name = "Active Directory Users"
    i = 1
    With sheet
    .Cells(i, 1).Value = "EmployeeID"
    .Cells(i, 2).Value = "SAMAccountName"
    .Cells(i, 3).Value = "FirstName"
    .Cells(i, 4).Value = "LastName"
    .Cells(i, 5).Value = "Email"
    .Cells(i, 6).Value = "Addr1"
    .Cells(i, 7).Value = "Title"
    .Cells(i, 8).Value = "Department"
    End With
    Set users = GetADUsers()
    While Not users.EOF
    i = i + 1
    With sheet
    .Cells(i, 1).Value = users("employeeID")
    .Cells(i, 2).Value = users("samAccountName")
    .Cells(i, 3).Value = users("GivenName")
    .Cells(i, 4).Value = users("sn")
    .Cells(i, 5).Value = users("mail")
    .Cells(i, 6).Value = users("streetAddress")
    .Cells(i, 7).Value = users("Title")
    .Cells(i, 8).Value = users("Department")
    End With
    users.MoveNext
    Wend
    Function GetADUsers()
    Set rootDSE = GetObject("LDAP://RootDSE")
    base = "<LDAP://" & rootDSE.Get("defaultNamingContext") & ">"
    filt = "(&(objectClass=user)(objectCategory=Person))"
    attr = "employeeid,SAMAccountName,mail,GivenName,sn,streetAddress,Title,Department"
    scope = "subtree"
    Set conn = CreateObject("ADODB.Connection")
    conn.Provider = "ADsDSOObject"
    conn.Open "Active Directory Provider"
    Set cmd = CreateObject("ADODB.Command")
    Set cmd.ActiveConnection = conn
    cmd.CommandText = base & ";" & filt & ";" & attr & ";" & scope
    Set GetADUsers = cmd.Execute()
    End Function
    ¯\_(ツ)_/¯

Maybe you are looking for

  • IPhone 5s IOS 8.1.1 battery drain using mail

    Problem: battery drain is unacceptably high with -1% per five minutes Description: after upgrading from IOS 7 to 8 the battery drain on my iPhone 5s (32GB) has hugely increased. Several tips on the internet have been tried from turning off several se

  • SmartView 11.1.2 Can't Connect to Shared Services

    I have posted this thread on the essbase forum, also... I have installed 11.1.2 on Windows 2008 (64bit) in stand-alone mode. I also have Excel 2007 installed on the same machine. I took all of the default ports when setting up the server instance. I

  • Need to ID G4 part:socket came off logic board (blue & white power cable

    In the course of disassembling a G4 iBook the socket for the blue & white power cable wiring harness broke off the logic board. I am trying to learn the correct desciption of this part so I can find a replacement. The wires on the bottom which were s

  • Define PORTAL_HOME Variable in NWDS

    Hello,     i me trying to create a new Portal Project using the NWDS, with this Project i want to create a new Extension Room for Collaboration. I have done the following to define a new Global PORTAL_HOME Path in NWDS as Classpath Variable: *PORTAL_

  • Writing to files within EJBs

    I know the EJB spec says I'm not allowed to access any files from within an EJB. I recently discovered a developer on our team is using a FileWriter to do some custom outputting. I'm fairly sure that he's not allowed to do what he's doing, but to be