Active Directory & Keychain Password Sync

We've been introducing some Macs into our Active Directory environment and I'm a little confused about how best to handle the local Keychain password. We're joining systems to the domain so that users can use their network password to login to their Macs (accounts are setup as Admin, Managed, Mobile) and so far that is working great.
It's my understanding that the password on the default login keychain is set automatically when the user account is created, so it would match the password the user first used to login to the Mac. However, we have a password expiration policy here, so users are changing their passwords at least every 3 months. As I understand it, by default the login keychain password is static, so I'm concerned that users are going to either forget the keychain password, or assume it is the same as their network password, and be unable to unlock the keychain should they even be prompted.
I've tried enabling the "synchronize login keychain password with account" setting in Keychain Access, but this causes another issue. When the user changes their network password, the next time they login to the Mac they receive a Keychain prompt asking them to enter their old keychain password in order to keep the keychain pass in sync.
Is there any way to keep the keychain password synchronized to a user's AD account password without prompting them at all? Or is their an accepted "best practice" regarding the keychain in active directory?
Thanks

I've also written a blog post about this Topic:
http://sccmfaq.wordpress.com/2014/01/23/azure-directory-sync-initial-configuration/
www.sccmfaq.ch

Similar Messages

Use of active directory userid/password authentication instead of SAP R/3 User/Password for digital signature?

Dear all,
I am looking to setup the use of active directory userid/password authentication instead of SAP R/3 User/Password for digital signature. We SSO to the backened ABAP AS via an SAP NW Portal to which SPNEgo kerberos authentication is setup. Today we specify R3 user id/password to digitally approvae a lot release. The idea is to have users maintain one AD password and don't have to remember the R/3 password anymore and also our Security team to avoid password maintenance.
I know there are 3 options for digital signature and
System signature with authorization by user ID and password (We use this currently)
Digital User signature with verification - (We would like to use this with AD userid/password, so the system still ask the users their AD userid/password for the authentication when they try to "sign" a document.)
User signature without verification
Do you think there is a way to configure the system in order to ask and check the active directory userid/password instead of SAP R/3 password? Where can I found documentation about it ?
I have several different versions of AS ABAP starting from NW 7.02 to NW 7.31.
My active directory is based on Windows 2008.
Thanks in advance!!
Dhee

Actually enabling Kerberos for SSO purposes and enabling Kerberos for digital signatures are two different topics although the latter is because of the former. I'm interested in the topic as well and I'm currently looking at different options. SAP provides a BAdI for the digital signature API which can be used for external authentication but they do not provide the solution to invoke Kerberos authentication based on username and password. SAP provides a semi solution with NWSSO 2.0 SP2 which works only on Windows with classic dynpros meaning SAP GUI for Windows is assumed. The solution is based on an ActiveX component which does the actual Kerberos authentication using the Secure Login Client which is part of the NWSSO suite. Extending that implementation to non-Windows and non-GUI applications would require some sort of web enabled service that could be used to authenticate the user with username and password. In case authentication is successful, a Kerberos token would be returned to SAP which would then be validated. All the required pieces are there since SAP has Kerberos support now in both stacks of the NetWeaver Application Server, some bits are still missing though which leaves customers looking at 3rd party or custom solutions.

Active Directory user passwords on mobile account with File Vault

Hi all,
I enabled file vault when I moved to my MacBook Pro. I joined the computer to the domain (after enabling file vault), and logged in with my domain account, creating a managed, mobile account so that I could use the computer when not connected to the domain.
Active Directory has forced a change in my password for the domain account but I cannot get the password on the Mac to change the password and sync with the domain.
My account (the one with the changed network password) on the Mac is a standard user account. When I open system preferences, go to Security & Preferences, General, click on the lock to unlock and allow change and then click Change Password ..., I receive the following error message after going through the steps to change the password:
The password for the account "user" was not changed. There was a problem with your password. It's possible your system administrator doesn't allow you to change your password. Contact your system administrator for help.
For Old Password, I used the old network password, the one that I use to log into the Mac. For New Password, I used my new, current password.
The same result happens when I attempt to change the password from the Users & Groups section of the System Preferences.
I have logged out and logged in with the user account that is identified as the admin and get a similar (same ?) error when attempting to change the password.
Any suggestions? How do I get the passwords to be one so that I can forget the old password?

Thanks for your insights.
The Tech Tool report happened after AppleJack, and never showed up before that. Restarting again just now, it showed up again.
I had not emptied the trash, but did now, and the 'get info' on my hard drive still shows that I have used nearly all of my 160 GB.
Re Disk Warrior: I do have it and just ran it. I emptied trash again and checked to see available disk space: I have 2.47 GB, so the problem still exists.
Here is the disk warrior report for the first part of its tests:
DiskWarrior has successfully built a new optimized directory for the disk named "Hildegarde." The new directory is
ready to replace the original directory.
There is not enough contiguous free space for a fail-safe replacement of the directory. It is highly recommended that
you create 204 MB of contiguous free space before replacing the original directory.
All file and folder data was easily located.
Comparison of the original and replacement directories indicates that there will be changes to the number, the
contents and/or the attributes of the files and folders. It is recommended that you preview the replacement
directory and examine the items listed below. All files and folders were compared and a total of 14,627,488
comparison tests were performed.
• Errors, if any, in the directory structure such as tree depth, header node, map nodes, node size, node counts, node
links, indexes and more have been repaired.
• 1 folder had a directory entry with an incorrect custom icon flag that was repaired.
Disk Information:
Files: 552,652
Folders: 131,014
Free Space: 2.47 GB
Format: Mac OS Extended
Block Size: 4 K
Disk Sectors: 321,410,736
Media: HDT722516DLAT80
Time: 11/28/08 6:54:19 PM
DiskWarrior Version: 4.1

Active directory to oid sync

hi all,
recently i've been given the assignment of sync one Active Directory to one OID.
Said so seams easy .....
...... so I installed a fresh copy of Win2000 adv server with Active Directory PLUS another Win2000 adv server with Oracle AS infra.
Then a got a copy of this document:
http://www.oracle.com/technology/obe/obe_as_10g/im/ads_import/import.htm?_template=/ocom/technology/content/print
unfortunately the "dipassistant" command at the end of the document comes out with an error:
dipassistant ERROR: DIP_GEN_UNKNOWN_FAILURE
I also looked on metalink for some help, and I found the note n. 267153.1
At the begining of the document it is explained how to verify if it possible to read the "container": cn=users,dc=domain,dc=com
Running an ldapsearch on the Active Directory is usefull for verifying any access issues.....
The command does not come out with errors, but it also does not come out with any output (I put few users on the Active Dir).
Thank you in advance for the time

Thanks Andres,
I tried to query the Active directory in the way you said ....but nothing !
ldapsearch
-p 389
-h adhost
-D "cn=Administrator,cn=users,dc=domain,dc=com" \
-w "mypassword"
-b "cn=users.oracle.com"
-s base "objectclass=*"
and in these formats too:
(-b "dc=users.paan.com"
-b "cn=users,dc=paan,dc=com)
I'm really lost, what else could be wrong ?
I'm wondering if there is anything missing from the document i'm following for the Sync.
http://www.oracle.com/technology/obe/obe_as_10g/im/ads_import/import.htm?_template=/ocom/technology/content/print
Conceptually the syncronization seams to be a straighforward process, but in reality I find it quite complicated...........maybe i'm missing some key information.....
Any ideas to suggest ?
thank

Mac OS X 10.5 Clients - Active Directory Login - Password Policy

Hi,
I wonder if anyone can help me or give me some pointers.
I have a client who has a number of Mac OS X 10.5 Leopard clients who sign-in and authenticate with a Window's Active Directory server which has a password policy to prompt users to change their login password every 30 days.
Today is the day they are required to change their login password and they do get message that says something like "0 days to change your password" but are not getting the subsequent dialogue box that allows them to change their password.
Any ideas?

OOPs, missed which one we were talking about, sorry.
Does it boot to Single User Mode, CMD+s keys at bootup, if so try...
/sbin/fsck -fy
Repeat until it shows no errors fixed.
(Space between fsck AND -fy important).
Resolve startup issues and perform disk maintenance with Disk Utility and fsck...
http://docs.info.apple.com/article.html?artnum=106214

Keychain Password sync

There is an issue with my keychain password. I can not remember having set up a keychain password at all.
All the time i'd like to show the password of e.g. a wireless connection keychain asks me to enter the keychain password which i can not remember. Entering my system password will fail with an error message.
Is there any default passowrd for keychain?? How is it???

Closing Incident

Error in installing the Password Sync connector

Hello friends,
I am installing the Active Directory Connector Password Sync on the domain controller, these are the results of the installation log. Any suggestions to solve the problem. thanks
(Oct 14, 2011 9:08:39 AM), Install, com.installshield.wizard.platform.win32.Win32PPKRegistryServiceImpl, dbg.registry, reading VPD from C:\WINDOWS\vpd.properties
(Oct 14, 2011 10:11:33 AM), Install, com.oracle.installshield.adpwd.getAttributeVal, dbg, defaultNamingContext
(Oct 14, 2011 10:11:33 AM), Install, com.oracle.installshield.adpwd.getAttributeVal, err, [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece ]
(Oct 14, 2011 10:11:33 AM), Install, com.oracle.installshield.adpwd.getDomainName, dbg, dnsHostName
(Oct 14, 2011 10:11:33 AM), Install, com.oracle.installshield.adpwd.getDomainName, err, [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece ]
(Oct 14, 2011 10:27:06 AM), Install, com.oracle.installshield.adpwd.pathValidator, err, could not create directory D:\$P(absoluteInstallLocation)
(Oct 14, 2011 10:28:16 AM), Install, com.oracle.installshield.adpwd.pathValidator, err, could not create directory D:\$P(absoluteInstallLocation)
(Oct 14, 2011 10:28:34 AM), Install, com.oracle.installshield.adpwd.pathValidator, err, could not create directory D:\$P(absoluteInstallLocation)
(Oct 14, 2011 10:28:46 AM), Install, com.oracle.installshield.adpwd.pathValidator, err, could not create directory D:\$P(absoluteInstallLocation)
(Oct 14, 2011 10:29:09 AM), Install, com.oracle.installshield.adpwd.pathValidator, dbg, C:\Progra~1\oracle\OIMADPasswordSync\Logs Directory already exists
(Oct 14, 2011 10:30:07 AM), Install, com.oracle.installshield.adpwd.pathValidator, dbg, C:\Progra~1\oracle\OIMADPasswordSync\Logs Directory already exists
(Oct 14, 2011 10:41:49 AM), Install, com.installshield.wizard.platform.win32.Win32JVMServiceImpl, dbg.jvm, calculating size from directory C:\DOCUME~1\user\LOCALS~1\Temp\LRE1.tmp
(Oct 14, 2011 10:41:49 AM), Install, com.installshield.wizard.platform.win32.Win32JVMServiceImpl, dbg.jvm, calculating size from directory C:\DOCUME~1\user\LOCALS~1\Temp\LRE1.tmp
(Oct 14, 2011 10:41:58 AM), Install, com.installshield.product.actions.UninstallerJVMResolution, dbg.jvm, attempting to use the current JVM
(Oct 14, 2011 10:41:58 AM), Install, com.installshield.product.actions.UninstallerJVMResolution, dbg.jvm, copying the current JVM
(Oct 14, 2011 10:41:58 AM), Install, com.installshield.wizard.platform.win32.Win32JVMServiceImpl, dbg.jvm, copying directory C:\DOCUME~1\user\LOCALS~1\Temp\LRE1.tmp to C:\Program Files\oracle\OIMADPasswordSync\_jvm
(Oct 14, 2011 10:42:03 AM), Install, com.installshield.wizard.platform.win32.Win32JVMServiceImpl, dbg.jvm, JVM_HOME = C:\Program Files\oracle\OIMADPasswordSync\_jvm
(Oct 14, 2011 10:42:03 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory before installing Files (files): free=16516032 total=20971520
(Oct 14, 2011 10:42:03 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, msg1, installing Files (files)
(Oct 14, 2011 10:42:03 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory after installing Files (files): free=16258032 total=20971520
(Oct 14, 2011 10:42:03 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory before installing Files (dlls): free=16241712 total=20971520
(Oct 14, 2011 10:42:03 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, msg1, installing Files (dlls)
(Oct 14, 2011 10:42:03 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory after installing Files (dlls): free=17534280 total=20971520
(Oct 14, 2011 10:42:03 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory before installing Win32 Registry Update (registryUpdate): free=17517840 total=20971520
(Oct 14, 2011 10:42:03 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, msg1, installing Win32 Registry Update (registryUpdate)
(Oct 14, 2011 10:42:03 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory after installing Win32 Registry Update (registryUpdate): free=16909032 total=20971520
(Oct 14, 2011 10:42:03 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory before installing Create Directory (createLogDir): free=16892816 total=20971520
(Oct 14, 2011 10:42:03 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, msg1, installing Create Directory (createLogDir)
(Oct 14, 2011 10:42:03 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory after installing Create Directory (createLogDir): free=16838120 total=20971520
(Oct 14, 2011 10:42:03 AM), Install, com.installshield.wizard.platform.win32.Win32PPKRegistryServiceImpl, dbg.registry, writing VPD to C:\WINDOWS\vpd.properties
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, Reading in ASCII file C:\Program Files\oracle\OIMADPasswordSync\prepAD.ldif.
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: orclpwfbasedn ON LINE: 7/
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, ou: oimpwdsyncdomain.inet
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: orclpwfbasedn ON LINE: 5/
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, name: oimpwdsyncdomain.inet
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: orclpwfbasedn ON LINE: 3/
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, OU=oimpwdsyncdomain.inet,persistentstore,domaindn
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: orclpwfbasedn ON LINE: 0/
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, dn: OU=oimpwdsyncdomain.inet,persistentstore,domaindn
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: domaindn ON LINE: 3/
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, OU=oimpwdsyncdomain.inet,persistentstore,DC=domain,DC=inet
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: domaindn ON LINE: 0/
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, dn: OU=oimpwdsyncdomain.inet,persistentstore,DC=domain,DC=inet
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: persistentstore ON LINE: 3/
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, OU=oimpwdsyncdomain.inet,ou=IDM-quota,DC=domain,DC=inet
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: persistentstore ON LINE: 0/
(Oct 14, 2011 10:42:06 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, dn: OU=oimpwdsyncdomain.inet,ou=IDM-quota,DC=domain,DC=inet
(Oct 14, 2011 10:42:06 AM), Install, com.oracle.installshield.adpwd.ldapModify, err, in Create the initial directory context
(Oct 14, 2011 10:42:06 AM), Install, com.oracle.installshield.adpwd.ldapModify, err, Request: 1 cancelled
(Oct 14, 2011 10:42:06 AM), Install, com.oracle.installshield.adpwd.ldapModify, dbg, C:\Program Files\oracle\OIMADPasswordSync\prepAD.ldif
(Oct 14, 2011 10:42:06 AM), Install, com.oracle.installshield.adpwd.ldapModify, err, gen exp
(Oct 14, 2011 10:42:06 AM), Install, com.oracle.installshield.adpwd.ldapModify, err, null
(Oct 14, 2011 10:55:13 AM), Install, com.installshield.wizard.platform.win32.Win32PPKRegistryServiceImpl, dbg.registry, reading VPD from C:\WINDOWS\vpd.properties
(Oct 14, 2011 10:55:23 AM), Install, com.oracle.installshield.adpwd.getAttributeVal, dbg, defaultNamingContext
(Oct 14, 2011 10:55:24 AM), Install, com.oracle.installshield.adpwd.getAttributeVal, err, [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece ]
(Oct 14, 2011 10:55:24 AM), Install, com.oracle.installshield.adpwd.getDomainName, dbg, dnsHostName
(Oct 14, 2011 10:55:24 AM), Install, com.oracle.installshield.adpwd.getDomainName, err, [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece ]
(Oct 14, 2011 10:57:21 AM), Install, com.oracle.installshield.adpwd.pathValidator, err, could not create directory D:\$P(absoluteInstallLocation)
(Oct 14, 2011 10:57:38 AM), Install, com.oracle.installshield.adpwd.pathValidator, dbg, C:\Progra~1\oracle\OIMADPasswordSync\Logs Directory already exists
(Oct 14, 2011 11:00:18 AM), Install, com.installshield.wizard.platform.win32.Win32JVMServiceImpl, dbg.jvm, calculating size from directory C:\DOCUME~1\user\LOCALS~1\Temp\LRE3.tmp
(Oct 14, 2011 11:00:19 AM), Install, com.installshield.wizard.platform.win32.Win32JVMServiceImpl, dbg.jvm, calculating size from directory C:\DOCUME~1\user\LOCALS~1\Temp\LRE3.tmp
(Oct 14, 2011 11:00:21 AM), Install, com.installshield.product.actions.UninstallerJVMResolution, dbg.jvm, attempting to use the current JVM
(Oct 14, 2011 11:00:31 AM), Install, com.installshield.product.actions.UninstallerJVMResolution, dbg.jvm, copying the current JVM
(Oct 14, 2011 11:00:31 AM), Install, com.installshield.wizard.platform.win32.Win32JVMServiceImpl, dbg.jvm, copying directory C:\DOCUME~1\user\LOCALS~1\Temp\LRE3.tmp to C:\Program Files\oracle\OIMADPasswordSync\_jvm
(Oct 14, 2011 11:00:35 AM), Install, com.installshield.wizard.platform.win32.Win32JVMServiceImpl, dbg.jvm, JVM_HOME = C:\Program Files\oracle\OIMADPasswordSync\_jvm
(Oct 14, 2011 11:00:35 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory before installing Files (files): free=17418496 total=20971520
(Oct 14, 2011 11:00:35 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, msg1, installing Files (files)
(Oct 14, 2011 11:00:35 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory after installing Files (files): free=17160072 total=20971520
(Oct 14, 2011 11:00:35 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory before installing Files (dlls): free=17125832 total=20971520
(Oct 14, 2011 11:00:35 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, msg1, installing Files (dlls)
(Oct 14, 2011 11:00:36 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory after installing Files (dlls): free=17012768 total=20971520
(Oct 14, 2011 11:00:36 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory before installing Win32 Registry Update (registryUpdate): free=16996328 total=20971520
(Oct 14, 2011 11:00:36 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, msg1, installing Win32 Registry Update (registryUpdate)
(Oct 14, 2011 11:00:36 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory after installing Win32 Registry Update (registryUpdate): free=16365640 total=20971520
(Oct 14, 2011 11:00:36 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory before installing Create Directory (createLogDir): free=16349424 total=20971520
(Oct 14, 2011 11:00:36 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, msg1, installing Create Directory (createLogDir)
(Oct 14, 2011 11:00:36 AM), Install, com.installshield.wizard.platform.win32.Win32ProductServiceImpl, dbg.install, JVM memory after installing Create Directory (createLogDir): free=16294688 total=20971520
(Oct 14, 2011 11:00:36 AM), Install, com.installshield.wizard.platform.win32.Win32PPKRegistryServiceImpl, dbg.registry, writing VPD to C:\WINDOWS\vpd.properties
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, Reading in ASCII file C:\Program Files\oracle\OIMADPasswordSync\prepAD.ldif.
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: orclpwfbasedn ON LINE: 7/
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, ou: oimpwdsyncdomain.inet
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: orclpwfbasedn ON LINE: 5/
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, name: oimpwdsyncdomain.inet
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: orclpwfbasedn ON LINE: 3/
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, OU=oimpwdsyncdomain.inet,persistentstore,domaindn
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: orclpwfbasedn ON LINE: 0/
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, dn: OU=oimpwdsyncdomain.inet,persistentstore,domaindn
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: domaindn ON LINE: 3/
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, OU=oimpwdsyncdomain.inet,persistentstore,DC=domain,DC=inet
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: domaindn ON LINE: 0/
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, dn: OU=oimpwdsyncdomain.inet,persistentstore,DC=domain,DC=inet
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: persistentstore ON LINE: 3/
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, OU=oimpwdsyncdomain.inet,ou=storepersistent,DC=domain,DC=inet
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, /REPLACE TEXT: persistentstore ON LINE: 0/
(Oct 14, 2011 11:00:39 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, dn: OU=oimpwdsyncdomain.inet,ou=storepersistent,DC=domain,DC=inet
(Oct 14, 2011 11:00:41 AM), Install, com.oracle.installshield.adpwd.ldapModify, err, in Create the initial directory context
(Oct 14, 2011 11:00:41 AM), Install, com.oracle.installshield.adpwd.ldapModify, err, Request: 1 cancelled
(Oct 14, 2011 11:00:41 AM), Install, com.oracle.installshield.adpwd.ldapModify, dbg, C:\Program Files\oracle\OIMADPasswordSync\prepAD.ldif
(Oct 14, 2011 11:00:41 AM), Install, com.oracle.installshield.adpwd.ldapModify, err, gen exp
(Oct 14, 2011 11:00:41 AM), Install, com.oracle.installshield.adpwd.ldapModify, err, null

This is the contents of prepAD.ldif
dn: OU=oimpwdsyncdomain.inet,ou=IDM,DC=domain,DC=inet
changetype: add
distinguishedName:
OU=oimpwdsyncdomain.inet,ou=IDM,DC=domain,DC=inet
instanceType: 4
name: oimpwdsyncdomain.inet
objectClass: organizationalUnit
ou: oimpwdsyncdomain.inet
Result of manual execution of this file
C:\Program Files\oracle\OIMADPasswordSync>ldifde -i -f prepAD.ldif
Connecting to "SERVER.DOMAIN.INET"
Logging in as current user using SSPI
Importing directory from file "prepAD.ldif"
Loading entries.
Add error on line 1: No Such Object
The server side error is "Directory object not found."
0 entries modified successfully.
An error has occurred in the program
No log files were written. In order to generate a log file, please
specify the log file path via the -j option.
Friends, any suggestions for the solution of this case
Thanks.

Active Directory Not Syncing Correctly in ES2

Hello,
We had our Active Directory 2003 synced up using Adobe Livecycle ES. There would be around 30,000 users that would be synced and this would take around 3 - 4 1/2 minutes to run. This worked perfectly for us for the past half of a year or so.
Last week we upgraded to ES2 and moved all of our processes over. We removed ES and did a fresh install of ES2. Everything seems to be working fine now except the Active Directory isn't syncing properly. When we run the sync, different numbers of users will be fetched. Sometimes it's around three thousand, sometimes seven thousand, sometimes ten thousand, but it never seems to get through them all. In the server log it does say that the directory synchronization completed successfully though even though the number fetched is changing. We made sure the settings are exactly the same as they were before, and we even tried a few different settings, but it still doesn't get all the users. For testing purposes, we tried changing the search filter to pick specific people that aren't showing up during the normal sync and it will show up fine, so I'm wondering if there is something stopping it from going all the way through?
We also have another enterprise domain connected which has around 2,000 users on it and have not had this problem with it.
Here are some of the sync statistics from the past few syncs: (The active directory name has been stripped for security purposes). If you need any more information please feel free to ask. We would like to have this resolved as soon as possible.
2010-05-30 21:02:51,366 INFO [com.adobe.idp.um.businesslogic.synch.DomainSynchronizer]
========== Synch Statistics for ============
Total User Fetched - 5633
Total Group Fetched - 0
Total Members Fetched - 0
Total time taken is 110 sec
[100.00%] [100.00%]Domain Synchronizer(2 runs) : Total 110,375 ms, Max 110359 ms, Min 16 ms, Avg 55187 ms
--[99.99%] [99.99%]User and group phase(1 runs) : Total 110,359 ms, Max 110359 ms, Min 110359 ms, Avg 110359 ms
----[95.78%] [95.80%]Users synch from (6 runs) : Total 105,719 ms, Max 19141 ms, Min 14281 ms, Avg 17619 ms
------[1.18%] [1.23%]Provider (31 runs) : Total 1,298 ms, Max 109 ms, Min 31 ms, Avg 41 ms
--[0.01%] [0.01%]Memberhsip phase(1 runs) : Total 16 ms, Max 16 ms, Min 16 ms, Avg 16 ms
-------Persistence Statistics-------
Users ->
added = 8
removed = 2568
updated = 5625
unchanged = 0
renamed = 0
failed = 0
UniqueId changed = 0
Groups ->
added = 0
removed = 0
updated = 0
unchanged = 0
failed = 0
UniqueId changed = 0
Emails ->
added = 8515
removed = 106
unchanged (In changed Principals) = 16784
Group Members ->
added = 0
removed = 0
unchanged = 0
unknown = 0
failed = 0
-------Batch Statistics-------
Successful User Batches = 113
Failed User Batches = 0
Successful Group Batches = 0
Failed Group Batches = 0
Successful Member Batches = 0
Failed Member Batches = 0
======================================
2010-06-02 21:03:43,692 INFO [com.adobe.idp.um.businesslogic.synch.DomainSynchronizer]
========== Synch Statistics for ============
Total User Fetched - 7140
Total Group Fetched - 0
Total Members Fetched - 0
Total time taken is 165 sec
[100.00%] [100.00%]Domain Synchronizer(2 runs) : Total 164,781 ms, Max 164750 ms, Min 31 ms, Avg 82390 ms
--[99.98%] [99.98%]User and group phase(1 runs) : Total 164,750 ms, Max 164750 ms, Min 164750 ms, Avg 164750 ms
----[96.78%] [96.79%]Users synch from (8 runs) : Total 159,469 ms, Max 26719 ms, Min 3500 ms, Avg 19933 ms
------[1.01%] [1.05%]Provider (42 runs) : Total 1,667 ms, Max 109 ms, Min 15 ms, Avg 39 ms
--[0.02%] [0.02%]Memberhsip phase(1 runs) : Total 31 ms, Max 31 ms, Min 31 ms, Avg 31 ms
-------Persistence Statistics-------
Users ->
added = 8
removed = 5
updated = 7132
unchanged = 0
renamed = 1
failed = 0
UniqueId changed = 0
Groups ->
added = 0
removed = 0
updated = 0
unchanged = 0
failed = 0
UniqueId changed = 0
Emails ->
added = 3340
removed = 105
unchanged (In changed Principals) = 33761
Group Members ->
added = 0
removed = 0
unchanged = 0
unknown = 0
failed = 0
-------Batch Statistics-------
Successful User Batches = 142
Failed User Batches = 1
Successful Group Batches = 0
Failed Group Batches = 0
Successful Member Batches = 0
Failed Member Batches = 0
======================================
2010-06-03 08:56:43,286 INFO [com.adobe.idp.um.businesslogic.synch.DomainSynchronizer]
========== Synch Statistics for ============
Total User Fetched - 2960
Total Group Fetched - 0
Total Members Fetched - 0
Total time taken is 68 sec
[100.00%] [100.00%]Domain Synchronizer(2 runs) : Total 67,984 ms, Max 67921 ms, Min 63 ms, Avg 33992 ms
--[99.91%] [99.91%]User and group phase(1 runs) : Total 67,921 ms, Max 67921 ms, Min 67921 ms, Avg 67921 ms
----[96.37%] [96.46%]Users synch from (3 runs) : Total 65,516 ms, Max 23016 ms, Min 19766 ms, Avg 21838 ms
------[4.00%] [4.15%]Provider (17 runs) : Total 2,719 ms, Max 844 ms, Min 31 ms, Avg 159 ms
--[0.09%] [0.09%]Memberhsip phase(1 runs) : Total 63 ms, Max 63 ms, Min 63 ms, Avg 63 ms
-------Persistence Statistics-------
Users ->
added = 2
removed = 6632
updated = 2958
unchanged = 0
renamed = 0
failed = 0
UniqueId changed = 0
Groups ->
added = 0
removed = 0
updated = 0
unchanged = 0
failed = 0
UniqueId changed = 0
Emails ->
added = 3
removed = 1
unchanged (In changed Principals) = 10035
Group Members ->
added = 0
removed = 0
unchanged = 0
unknown = 0
failed = 0
-------Batch Statistics-------
Successful User Batches = 60
Failed User Batches = 0
Successful Group Batches = 0
Failed Group Batches = 0
Successful Member Batches = 0
Failed Member Batches = 0
======================================

We do have quite a few that are missing an attribute, specifically:
2010-06-06 21:05:47,579 WARN [com.adobe.idp.um.businesslogic.synch.LdapHelper] Record [xxxx] is missing required attribute [objectSID] for canonicalName i.e uniqueIdentifier field
This is something that was on our old system as well:
2010-05-25 03:02:35,559 INFO [com.adobe.idp.um.provider.directoryservices.LDAPDirectoryPrincipalProviderImpl] UserM:: [Thread Hashcode: 3010887] This record is missing a required attribute and cannot be used. Specifically CanonicalName is null. Common Name: xxxx
We have many users in our active directory with just email accounts so that users are able to search for a name and find the email address in outlook. I have checked through these and they look fine (though there are fewer entries in ES2 since there are fewer users being fetched).
As for the locked users, here is what we received:
2010-06-06 21:05:47,579 INFO [com.adobe.idp.um.businesslogic.synch.LdapPrincipalProvider] Found [1257] locked users while synching. These users were ignored
This sounds about right for the amount of users that were fetched.
If you have any more questions or ideas, please let us know. We would like to have this resolved as soon as possible. Thanks.

Can you authenticate user/password from SAP to Active Directory

I don't want to implement SSO for ABAP because my company doesn't have the license for "SAP NW Single Sign-On"; but we would like to authenticate our users and their passwords to active directory. Our goal is to make sure the user/password in SAP is the same as their Active Directory user/password. Is this possible?
Thanks!

This has been discussed many times, for example see SSO with LAN UserID/Password. The short answer is no, you can't synchronize passwords. You can however achieve the requirement assuming you are using Identity Management to provision users and passwords to all systems (AD, SAP, etc). In that case you will have to deal with users changing their password. Recommendation is to enable SSO. If you don't want to get licenses for NWSSO, try to look at other options (X.509 certificates, SPNEGO in AS JAVA and then issue a Logon Ticket, 3rd party solution, etc).

Active directory, SSGD and password change

Hi everybody, we have some problems with SSGD, active directory and password change
Scenario:
We have 2 different perfectly working Active directory called "Gruppo" and "Eracle";
We have 2 different tarantella installations called "Sgd" and "Tlv";
Sgd servers are working servers and users authenticate against Eracle, used by our customer.
We made 2 basic different test with Tlv:
1. we configure Tlv to authenticate users against Gruppo (that is our real need)---> we can't change pasword using kpasswd or ttakpasswd
2. we configure Tlv to authenticate users against Eracle ---> everything was ok
There are NO DIFFERENCE beetween Sgd and Tlv, they have same configuration, same krb5.conf etc..
There is ONE DIFFERENCE beetween Eracle and Gruppo:
Eracle Active Directory's properties:
Domain functional level: Windows 2000 mixed
Forest functional level: Windows 2000
Gruppo Active Directory's properties:
Domain functional level: Windows 2000 native
Forest functional level: Windows 2000
SSGD documentation doesn't speak about different Active Directory properties. The SSGD documentation says that you can authenticate users against Active directory, so, IT HAS TO WORK even if the domain functional level of active directory is different.
Can someone help us^Hi Simon
I'll try again to explain you our problem, because it seems that I wasn't so clear.
Scenario:
We have 2 different perfectly working Active directory called "Gruppo" and "Eracle";
We have 2 different tarantella installations called "Sgd" and "Tlv";
Sgd servers are working servers and users authenticate against Eracle, used by our customer.
We made 2 basic different test with Tlv:
1. we configure Tlv to authenticate users against Gruppo (that is our real need)---> we can't change pasword using kpasswd or ttakpasswd
2. we configure Tlv to authenticate users against Eracle ---> everything was ok
There are NO DIFFERENCE beetween Sgd and Tlv, they have same configuration, same krb5.conf etc..
There is ONE DIFFERENCE beetween Eracle and Gruppo:
Eracle Active Directory's properties:
Domain functional level: Windows 2000 mixed
Forest functional level: Windows 2000
Gruppo Active Directory's properties:
Domain functional level: Windows 2000 native
Forest functional level: Windows 2000
SSGD documentation doesn't speak about different Active Directory properties. The SSGD documentation says that you can authenticate users against Active directory, so, IT HAS TO WORK even if the domain functional level of active directory is different.
Can someone help us?
Many thank
Patrizia

Added question.
Do you guys know if changing the password will change the password on their Active directory access.
Thanks,
helmut

Configuring Active Directory user to Authenticate against OSB proxy service

Hi,
I applied the oracle Predefined auth.xml WS-policy to the osb proxy service and that will query a web service that is running on separate weblogic server, and I configured ActiveDirectory as an Authentication Provider in the weblogic server under myrealm. when I pass the weblogic/weblogic which is an admin account in the OSB test console or soap ui to test the authentication works and I get the response back but when I pass in one of the Active directory username/password I'm getting the following Failed to assert identity with UsernameToken SOAP fault.
Do I have to change or add any configuration In the weblogic server to make this work? such as Identity Assertion provider in the weblogic server.
fault: <con:fault xmlns:con="http://www.bea.com/wli/sb/context">
<con:errorCode>BEA-386201</con:errorCode>
<con:reason>
A web service security fault occurred[{http://www.w3.org/2003/05/soap-envelope}Sender][Failed to assert identity with UsernameToken.]
</con:reason>
<con:details>
<err:WebServiceSecurityFault xmlns:err="http://www.bea.com/wli/sb/errors">
<err:faultcode xmlns:soap="http://www.w3.org/2003/05/soap-envelope">soap:Sender</err:faultcode>
<err:faultstring>
Failed to assert identity with UsernameToken.
</err:faultstring>
</err:WebServiceSecurityFault>
</con:details>
<con:location>
<con:path>request-pipeline</con:path>
</con:location>
</con:fault>
Regards
Vick

Hi Manoj
I have configured the weblogic server to use the Active Directory Authentication provider which is supported in weblogic server and I can see the AD users under weblogic console under users and groups tab, but if I pass in the username/password of the users in AD I'm getting the above error.
thanks
Vick

Snow Leopard and Windows 2003 Active Directory Binding Issues

Ok I have a new imac 27" with snow leopard (completely patched).
I am attempting to join it to an active directory domain.
First the prequel:
* I have opened full traffic to and from the machine and our domain controllers
* I have enabled full logging on the firewall and there are no blocked packets
* I have used wireshark to watch the traffic on the mac and there appear to be no anomalies (packets being sent out but not getting a response, dns requests that aren't answered, etc)
* I have enabled full KDC logging on the domain controller in question and there are no errors in any of the event logs on either domain controller.
* The domain admin account in question has Enterprise, Schema and Domain Admin rights
* I have tried it both with and without an existing computer account and with every conceivable combination of caps and no caps on domain name, user and computer names.
I am getting the following error at the very end of the process:
"Unable to add server. Credential operation failed because an invalid parameter was provided (5102)"
I enabled debugging on Directory Services and will post a log in a reply.
Anyone have any ideas? I have been banging my head on this for a week with no luck.

Here is the log with the Active Directory: entries grepped... the full log is far too large to reply to here, if you think you need it let me know and I can email it to you it is 548kb
obviously machine names, usernames and ip addresses have been munged.
2011-02-09 12:13:32 EST - T\[0x0000000100404000\] - Active Directory: copyNodeInfo called for /Active Directory
2011-02-09 12:13:36 EST - T\[0x0000000100404000\] - Active Directory: copyNodeInfo called for /Active Directory
2011-02-09 12:13:41 EST - T\[0x0000000100404000\] - Active Directory: copyNodeInfo called for /Active Directory
2011-02-09 12:13:46 EST - T\[0x0000000100404000\] - Active Directory: copyNodeInfo called for /Active Directory
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Bind Step 1 - Searching for Forest/Domain information
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: subdomain.domain.tld - Start checking servers for site "any"
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Total Servers "any" LDAP - 2, Kerberos - 2, kPasswd - 2
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Adding Server - "dc3.subdomain.domain.tld"
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Adding Server - "dc1.subdomain.domain.tld"
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: subdomain.domain.tld - Finished checking servers for domain
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: DomainConfiguration reachabilityNotification - Node: subdomain.domain.tld - resolves - enabled
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Bind Step 2 - Finding nearest Domain controllers
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Bind Step 3 - Verifying credentials
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: subdomain.domain.tld - Start checking servers for site "any"
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Total Servers "any" LDAP - 2, Kerberos - 2, kPasswd - 2
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Adding Server - "dc3.subdomain.domain.tld"
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Adding Server - "dc1.subdomain.domain.tld"
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: subdomain.domain.tld - Finished checking servers for domain
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: DomainConfiguration reachabilityNotification - Node: subdomain.domain.tld - resolves - enabled
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: EstablishConnectionUsingReplica - Node subdomain.domain.tld - New connection requested
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: FindSuitableReplica - Node subdomain.domain.tld - Attempting Replica connect to dc3.subdomain.domain.tld.
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: watchReachability watching socket = 21, xxx.xxx.164.71 -> xxx.xxx.174.77
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: VerifiedServerConnection - Verified server connectivity - dc3.subdomain.domain.tld.
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: CheckWithSelect - good socket to host dc3.subdomain.domain.tld. from poll and verified LDAP
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: FindSuitableReplica - Node subdomain.domain.tld - Established connection to dc3.subdomain.domain.tld.
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: kadmEntry port is nil, will use default 464
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: populateKerberosToDomain - Bailing no domain cache for
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Password verify for [email protected] succeeded - cache MEMORY:vyvyIt4
2011-02-09 12:13:47 EST - T\[0x0000000102481000\] - Active Directory: Switching active cache to MEMORY:vyvyIt4
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Secure BIND Session Success with server dc3.subdomain.domain.tld.:389 using cache MEMORY:vyvyIt4 user [email protected]
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Processing Site Search with found IP
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: No site name available
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: subdomain.domain.tld - Start checking servers for site "any"
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Total Servers "any" LDAP - 2, Kerberos - 2, kPasswd - 2
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Adding Server - "dc3.subdomain.domain.tld"
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Adding Server - "dc1.subdomain.domain.tld"
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: subdomain.domain.tld - Finished checking servers for domain
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Updating Mappings from inSchema.........
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Updated schema for node name subdomain.domain.tld
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Configuration naming context = cn=Partitions,CN=Configuration,DC=subdomain,DC=domain,DC=tld
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Top domain set as <cn=subdomain,cn=partitions,cn=configuration,dc=subdomain,dc=domain,dc=tld>
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Updating domain hierarchy cache
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Updating policies from domain subdomain.domain.tld
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Updated policies for node name subdomain.domain.tld
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: Bind Step 4 - Searching for existing computer
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: EstablishConnectionUsingReplica - Node subdomain.domain.tld - New connection requested
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: watchReachability watching socket = 18, xxx.xxx.164.71 -> xxx.xxx.174.77
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: VerifiedServerConnection - Verified server connectivity - dc3.subdomain.domain.tld.
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: establishConnectionUsingReplica - Node subdomain.domain.tld - Previous replica = dc3.subdomain.domain.tld. responded
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: kadmEntry port is nil, will use default 464
2011-02-09 12:13:48 EST - T\[0x0000000102481000\] - Active Directory: populateKerberosToDomain - Bailing no domain cache for
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Password verify for [email protected] succeeded - cache MEMORY:zXpbfEi
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Switching active cache to MEMORY:zXpbfEi
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Secure BIND Session Success with server dc3.subdomain.domain.tld.:389 using cache MEMORY:zXpbfEi user [email protected]
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Doing Computer search for Ethernet address - 10:9a:dd:56:1b:1d
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Bind Step 4 - no mapping for Ethernet MAC address
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Doing DN search for account - machinename
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: stopWatching socket = 21, xxx.xxx.164.71 -> xxx.xxx.174.77
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: LDAP connection closed - dc3.subdomain.domain.tld.:389 - cache MEMORY:vyvyIt4 user [email protected]
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Destroying cache name MEMORY:vyvyIt4 user [email protected]
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Closing All Connections
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: stopWatching socket = 18, xxx.xxx.164.71 -> xxx.xxx.174.77
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: LDAP connection closed - dc3.subdomain.domain.tld.:389 - cache MEMORY:zXpbfEi user [email protected]
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Destroying cache name MEMORY:zXpbfEi user [email protected]
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Bind Step 5 - Bind/Join computer to domain
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: EstablishConnectionUsingReplica - Node subdomain.domain.tld - New connection requested
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: watchReachability watching socket = 18, xxx.xxx.164.71 -> xxx.xxx.174.77
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: VerifiedServerConnection - Verified server connectivity - dc3.subdomain.domain.tld.
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: establishConnectionUsingReplica - Node subdomain.domain.tld - Previous replica = dc3.subdomain.domain.tld. responded
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: kadmEntry port is nil, will use default 464
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: populateKerberosToDomain - Bailing no domain cache for
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Password verify for [email protected] succeeded - cache MEMORY:10xG6op
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Switching active cache to MEMORY:10xG6op
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Secure BIND Session Success with server dc3.subdomain.domain.tld.:389 using cache MEMORY:10xG6op user [email protected]
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Looking for existing Record of machinename
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Doing DN search for account - machinename
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: EstablishConnectionUsingReplica - Node subdomain.domain.tld - New connection requested
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: watchReachability watching socket = 21, xxx.xxx.164.71 -> xxx.xxx.174.77
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: VerifiedServerConnection - Verified server connectivity - dc3.subdomain.domain.tld.
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: establishConnectionUsingReplica - Node subdomain.domain.tld - Previous replica = dc3.subdomain.domain.tld. responded
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: kadmEntry port is nil, will use default 464
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: populateKerberosToDomain - Bailing no domain cache for
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Switching active cache to MEMORY:10xG6op
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Secure BIND Session Success with server dc3.subdomain.domain.tld.:389 using cache MEMORY:10xG6op user [email protected]
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: KerberosID Found for account CN=MACHINENAME,CN=Computers,DC=subdomain,DC=domain,DC=tld - MACHINENAME$
2011-02-09 12:13:49 EST - T\[0x0000000102481000\] - Active Directory: Existing record found @ CN=MACHINENAME,CN=Computers,DC=subdomain,DC=domain,DC=tld with [email protected].
2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: Setting Computer Password FAILED for existing record......
2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: Computer password change date is 2011-02-04 18:21:01 -0500
2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: Schtldled computer password change every 1209600 seconds - starting 2011-02-09 12:13:50 -0500
2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: Closing All Connections
2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: stopWatching socket = 21, xxx.xxx.164.71 -> xxx.xxx.174.77
2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: LDAP connection closed - dc3.subdomain.domain.tld.:389 - cache MEMORY:10xG6op user [email protected]
2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: stopWatching socket = 18, xxx.xxx.164.71 -> xxx.xxx.174.77
2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: LDAP connection closed - dc3.subdomain.domain.tld.:389 - cache MEMORY:10xG6op user [email protected]
2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: Destroying cache name MEMORY:10xG6op user [email protected]
2011-02-09 12:13:50 EST - T\[0x00000001026AA000\] - Active Directory: Failed to changed computer password in Active Directory domain
2011-02-09 12:13:50 EST - T\[0x0000000102481000\] - Active Directory: copyNodeInfo called for /Active Directory
2011-02-09 12:13:51 EST - T\[0x0000000102481000\] - Active Directory: copyNodeInfo called for /Active Directory
Message was edited by: aelana

Active Directory User and Password Sync

Hi,
We have virtualised development labs that are direct clones of our production environment, including names, IP addresses and Active Directory. These labs are ring fenced using virtual network appliances with firewall rules that allow access to specific ports.
The issue we have is that when passwords expire either in the labs or in production AD, it causes issues for our developers. Also, when new users are created in production, the process has to be repeated in multiple labs which is a bit of a time sink, even
with scripts.
Currently we sporadically do system state restores to AD controllers in the labs to get them in sync with prod but this also requires us re-adding all the servers back onto the domain and again is tedious process. Is there any way to sync from production
AD to the labs AD?
Thanks in advanced.
Mark

If it is an isolated environment, you won't be able to synchronize the data.
Export/Import, Backup/restore, P2V, D2VHD etc are the only option.
Santhosh Sivarajan | Houston, TX | www.sivarajan.com
ITIL,MCITP,MCTS,MCSE (W2K3/W2K/NT4),MCSA(W2K3/W2K/MSG),Network+,CCNA
Windows Server 2012 Book - Migrating from 2008 to Windows Server 2012
Blogs: Blogs
Twitter: Twitter
LinkedIn: LinkedIn
Facebook: Facebook
Microsoft Virtual Academy:
Microsoft Virtual Academy
This posting is provided AS IS with no warranties, and confers no rights.

Connector for Active Directory Password Sync

Friends,
We have some questions about the Connector for Active Directory Password Sync:
1. There is a need to extend the AD schema when using this connector.
2. If I have 10 domain controllers and are not synchronized, the documentation tells us to install the dll in each domain controller. Is there any way to do this if necessary, to install this dll in a single domain controller?
Thanks for your help.
regards

Definitely:
For your Point-1 Look for the Preinstallation section in the AD Password Sync Connector Guide which talks nothing about extending AD schema which supports the validity of the statement.
For your Point-2 Look for Metalink Article-432727.1 which confirms that the connector has to be installed on all the DC's
Thanks
SRS

Password Sync from Active Directory Locking Accounts

Hello,
We recently set up Active Directory as a resource and are synching passwords. We are using IDM 7.1.1.11. We are noticing that when actions in IDM push the password out to AD, and they sync comes back to IDM, the sync workflow is locking up the account, before the original IDM action completes. For example, when an admin resets a users password, they see several error messages stating that the account is locked by the account that authenticates through the password sync utility. They also see succesful password reset messages, but I would like it if they didn't see errors saying the account is locked. We are using a direct connection between the Password Sync util and IDM. Has anyone ran into this? Any advice on overcoming it?
Thanks.
Jim

I opened a support case with Sun about this issue, and they recommended logging a trace file for com.waveset.adapter.ActiveDirectoryActiveSyncAdapter. While the tracefile does not seem to contain any useful information, the simple fact that there is tracing going on for it now seems to be easing the situation. In my test environment I saw occurrences of this locking problem drop by 90-95% simply by turning the tracing on. I started tracing in production in the hopes that it will at least lessen the occurances of this.
Sounds like we are taking the same approach Raj, the problem I've been having with it is getting it to happen will I'm debugging our reset password workflow. I want to make sure I add the locking check in the right place, so I was attempting to determine which area to check for it.
I'll be sure to keep the thread updated if anything changes on our end.
Jim

Active Directory & Keychain Password Sync

Similar Messages

Maybe you are looking for