Active directory member;range=0-999 issue

Has anyone else run into a problem with active directory and
it returning the member attribute with the range attached? I am
running into this problem as discussed in a microsoft article (see
below). The data comes back fine and I get all the records I need.
BUT... the problem is the column name is returned as
"member;range=0-999" instead of just member as in a normal active
directory query. The problem is it has that semicolon in the column
name so trying to loop through the query or get to that data keeps
breaking it. So it is there, I just can't get to it. I have tried
escaping the semicolon or aliasing the column name, but I just keep
running into problems. I am hoping someone else has run up against
this or knows ways to get around invalid column names in a query.
If I have a resultset for a query that has a bad column name, how
can I get to that data?
When an Active Directory server returns the values of the
member attribute as the result of a directory search query, its
behavior varies depending on whether the total number of attribute
values for that object exceed the maximum limit on values
retrieved. For example, if a distribution list on a Windows 2000
Server contains 1000 or fewer member values, a search query will
return all of the values in a single call. However, if the list
contains 2497 member values, the first call to the search query
function will return the member attribute with no values, and an
additional member;range=0-999 attribute that contains the first
1000 member values. To retrieve the next group of member values,
the search query should be repeated using a range specifier that
begins at the attribute number one past the number of the previous
group returned. In this example, the search query function would
request the member;range=1000-* values, which would return the
member;range=1000-* attribute with no values and a
member;range=1000-1999 attribute with the next 1000 values. This
process is repeated until the last group of values is retrieved.
The end range on the last group retrieved from the server would be
indicated by an asterisk (*) in the returned attribute name.

I found I was able so solve this using the method found at
the following address:
http://www.bennadel.com/index.cfm?dax=blog:357.view

Similar Messages

Ix4-300d Cannot Log In Active Directory member

I have an ix4-300d that is an Active Directory member that will not let me log in with my username and password. I have tried restarting the device and still will not let me. I can see all of the shares when I type the "\\devicename\sharename" just fine. Any ideas on what I can do to log in?
Thanks,
Eric

Moderator comment: A post which did not conform to the Community Rules has been removed. Incivility will not be tolerated.
English Community Deutsche Community Comunidad en Español Русскоязычное Сообщество
Community Resources: Participation Rules • Images in posts • Search (Advanced) • Private Messaging
PM requests for individual support are not answered. If a post solves your issue, please mark it so.
X1C3 Helix X220 X301 X200T T61p T60p Y3P • T520 T420 T510 T400 R400 T61 Y2P Y13
I am not a Lenovo employee.

Active Directory problems/client log in issues

We have a Windows 2003 Active Directory Server running DNS, DHCP, and Active Directory.
We have a xserve g5 file server that serves the files for our school.
Our xserve will not join the kerberos domain on the 2003 Server. We have unbound, rebound, rebooted, repaired permisions, run the kron scrips, did a file system check, all that stuff. We have even done a check disk on the 2003 server. Any ideas as to what could be causing this?
On top of that our Mac users are unable to log in using active directory. Our pc users are able to log in but there profile mount does not mount. We have no ideas left as to what do do. Please help

Hi Leif
I guess it would have been impossible to bind the
server without having done that first?
That is true, but I have had experience where the reverse pointer was not created due to a problem with DHCP reserved pools on the AD Server.
Having said that, it seems the DNS reverse (PTR
records) might not always be setup by AD setup
wizards depending on what is chosen at setup time
("small" or "big" AD?).
Exactly right. Forward lookup no problem, bound no problem, imported test users from AD user base, mcx etc, clients bind OK but can’t log in, tell-tale jiggle on the log in window everytime with the added ‘AFP or SMB is on another server etc’ message. Issuing host command reveals no reverse pointer for the ODM, you can never be too certain when it comes to DNS, its a good tip to test and test again and is saves a lot of problems later on.

Active Directory Logon / Site Link Bridge Issue

Dear NC,
i have an issue with users in different Locations, to explain easyest here is a little network diagram:
So, as one can see, i have 4 Locations, one is the Headquarter.
The Target Goal is: Users in Location C must Logon with Domaincredentials from Sub.domain.tld from Location A.
Location HQ, A and B are fully routed, Location C has only a route to Location B.
Every Location has at least one writable DC with GC ans DNS Server installed.
I have the following site links:
HQ<>A
HQ<>B
A<>B
B<>C
and also a Site Link Bridge with "A<>B" and "B<>C".
Unfortunatly Users cannot logon in Location C with sub.domain.tld Domaincredentials from Location A.
Need a bit help, thx :-)
-Bernd

Hi Bernd,
I am sorry that I am a little confused here, would you please clarify what do you mean by “Users in Location C must Logon with Domaincredentials from Sub.domain.tld from Location A”?
From what I understand, you have two domains:
domain.tld and sub.domain.tld, and you want that user accounts in
sub.domain.tld (location A) can logon from domain.tld (location C), am I right?
If that is your goal, please make sure the following conditions are true:
During the logon process, specify the right domain name which is like
@sub.domain.tld.
The GC in location C is available to identify the appropriate Domain Controller for authentication process.
There is no network connectivity issues between location A and C, because after GC located a DC in location A, the logon process will take place between location A and C.
In addition, every site should have good network connectivity with at least another site to keep AD replication healthy. If there are critical errors in your HQ site, we should try
to resolve them.
Here is a related article below for your reference:
What Is the Global Catalog?
http://technet.microsoft.com/en-us/library/cc728188(v=WS.10).aspx
Please feel free to let us know if there are any further requirements.
Amy Wang

DNS and Active Directory error 4000 server 2008

Hello all,
My network skills aren't very good and I'm facing a dilemma. First off we have two Windows servers on the network. The newest is 2008 Standard (named Vader) and the other is 2000 (dells3). Obviously I'd like to get rid of the 2000, but the people in charge
of my budget haven't given me the option to do so and it's the only back up we have.
Earlier in the week we had lots of problems. One of our nas boxes locked everyone out who was mapped to it and it would only let me log in through the web portal. Two of our Macs our marketing department uses suddenly locked up and wouldn't let them back
in (both were part of the Active Directory). A second nas box won't let certain people map to it and for awhile I had issues logging into Vader itself.
I believe all of these problems are connected to some issues on Vader and possibly in conduction with dells3. In Server Manager under DNS I get error 4000 "The DNS server was unable to open Active Directory.
This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it. Check that the Active Directory is functioning properly and reload the zone. The event data is the error code."
Then under Active Directory Domain Services I get error 2042 "It has been too long since this machine last replicated with the named source machine. The time between replications with this source has exceeded
the tombstone lifetime. Replication has been stopped with this source."
Followed by more text I can post if needed.
Under File Services error 1202 "The DFS Replication service failed to contact domain controller to access configuration information. Replication is stopped. The service will try again during the
next configuration polling cycle, which will occur in 60 minutes. This event can be caused by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues."
And finally if I try to open Active Directory Domains and Trusts "The configuration information describing this enterprise is not available. The server is not operational."
I'm not sure where to start or what to post that might help. Any and all help is appreciated.
Edit: Also I can only add dells3 as the DNS on Vader in the DNS Manager if I try to add Vader to itself I get an error.

It's the other way around. Overall, I'm advising ripping the 2008 server out of AD and adding it back . Let's look at this as a series of steps:
1.) You do a force demote of the 2008 server because it's tombstoned. This means the 2008 server is no longer a DC. You are doing a force because it doesn't have the ability to replicate. If it could replicate, we'd just do a graceful demotion
and be done with it.
2.) Once the 2008 server is demoted, we go to the 2000 server which holds the only good copy of AD. From that server we run a metadata cleanup using the ntdsutil utility. We use that utility to clean out references to the 2008 server which is
no longer a DC.
3.) Once you have a clean AD, you can then promote the 2008 server back into Active Directory. Make sure Vader is pointing to Dells3 as its primary DNS server before promoting or you'll run into issues.
Hopefully that clarifies things.

Active Directory Time Errors

Hi everyone. Putting this here as I could not find a better forum. My company's Macs are bound to a Mac OS X Server, but it's the Active Directory binding that is the issue.
We have a number of Macs, running 10.6.8, that starting sometime recently, began to have login issues. When connected to the network, users could not log in. These are mobile accounts authenticating against a Windows 2008 Active Directory server.
I started by checking whether binding was still valid. It was not. So I attempt to unbind, and there get an "Active Directory Time Error." It appears that usually, this means that the time on the client and the time reported by the AD server are out of sync. But they're not. I can force unbind, and on attempting to rebind, I get the time error again.
In nearly every case, these commands in Terminal resolve the issue:
$ sudo rm -rdfv /Library/Preferences/DirectoryService
$ sudo rm -rdfv /var/db/dslocal/nodes/default/config
$ sudo killall -USR1 DirectoryService
(then restart)
This didn't happen all at once, the issue has been popping up in one 10.6 machine after another. (We also have a number of 10.8 and 10.9 machines, which so far seem unaffected.)
Does anyone have any inkling what factors could be causing this to keep happening?

Not sure how you've confirmed that the times are not skewed; I'd (still) look for a problem with the ntp servers (one ntp server with a rogue time within a pool can play havoc with a network, for instance), and whether the local ntp clients are all reporting as being locked. See the ntpdc -c peers command, among other commands.

Active Directory users not made member of Local Network group

Hi all,
I've just done a clean install from 10.6 Server to 10.8.4.
The issue I seem to be having is a mismatch between what Groups in Server.app is reporting as members (who happen to be users or groups from our Active Directory domains) of a Local Network group and what dseditgroup reports as members of the same network.
The Setup:
In Groups in Server.app under Local Network Group I have created a group call "AccessServer"
Members in that group are:
     - AD-Domain User Group (so should be all users in the domain)
     - MacOS X "netaccounts" group (again, should capture all users that connect through the network I've used this in the past/10.6 very handy)
     - AD User 1
     - AD User 2
     - AD User 3
The Server is bound to the AD Domain, All-Domains is not selected and a Search Path is added for each Domain needed and set at the top of the search order.
The Behaviour:
AD User 1 can access AFP and other services as expected.
AD User 2 and 3 cannot.
Another user within AD-Domain User Group or netaccounts can access AFP and other services as expected
Yet other users within AD-Domain User Group or netaccounts cannot
Furthermore:
If I REMOVE AD User 1 (a working user) *and* the AD Domain Group and netaccounts Group. I can still login with that account!
Diagnosis:
I tried checking group membership with dseditgroup, the results match the behaviour, not the setup.
>dseditgroup -o checkmember -m ADUser1 accessserver
yes ADUser1 is a member of accessserver
>dseditgroup -o checkmember -m ADUser2 accessserver
no ADUser2 is NOT member of accessserver
>dseditgroup -o checkmember -m ADDomainUser/netacc accessserver
yes ADDomainUser/netacc is a member of accessserver
>dseditgroup -o checkmember -m n accessserver
no ADUser2 is NOT member of accessserver
When non-member users try to connect I get a message in the logs of (IP/DNS values anonymized):
2013-06-25 3:04:36.794 PM sshd[5217]: error: PAM: authentication error for illegal user ----- from ----.mala.bc.ca via x.x.
I get the same results even after removing the user from the Groups screen!
Failed Solutions
- As we are a large AD I've tried specifying specific Active Direcotry servers that might better be able to find the users in question and authenticate.
- I've let the system just sit, in hopes delayed replication would solve the problem overnight.
- I've deleted and recreated the groups.

Upon further investigation we have discovered:
a) the main behaviour that is causing the problem is best described as AD users that are added to a Local or Network OS X group... either individually or through a Domain group.... are not actually recognized as members of that OS X group even though the GUI or CLI tool have added them and acknowledge them as being in the list.
b) This is NOT limited only to MacOS X Server 10.8. The same behaviour is occuring on a long-running 10.6 server as well.
c) The problem remains whether we nest AD groups to capture a large bunch of users, or add users individually. If the user is part of the mysteriously denied set, how they are added to the OD or local group is irrelevant, including if added from the command line.
d) Which users are allowed and which are not is unclear and appears generally random. We have found 3 'classes' of users:
          1 - those that are successfully becoming members every time.
          2 - those that are intermittent members. Members on one server or another, or in one case even go from being reported as a member (by dseditgroup), to not being a member, to being a member again within the span of only a minute or two.
          3 - those that are never successfully admitted as a member.
So the problem is both Apple's and Windows in that:
Apple: Is allowing a group and/or user to be added and implying then membership in the group even though that membership is not being honoured in some way and there is no feedback or communication of that fact aside from generic 'denied' or 'illegal user' errors.
Windows: Is passing along membership through its groups and users, but not completely, for reasons that are, at this point, a mystery.
Really hoping people have some ideas on this. This system of nested groups or individual user access is something we have of course being using for many years. So this is a major setback.

Replication Active Directory, ports issues in firewall

Hi,
i am facing some issue in active directory replication between my Active Directory User Database located in two different locations.
I am not doing any Port based ACL in the firewall, and there is no static / dynamic NAT-ng used between the server ip ranges (nat 0).
1) what could be the possible issue in this?2) do i need to issue any command in the FWSM Module to make use / open the dynamic ports ?3) How can i make sure that these ports are not opend or not blocked on the firewall.
below are some of the ports used for this, based on the information from Microsoft Team.
tcp 5389
tcp 5722
tcp 5729
tcp3268
tcp 3269
tcp 445
udp 445
udp 88
udp 2535
udp 389
tcp 1025 - 5000
tcp 44152 - 65535
Appreciate your valuable support.
regards
Sunny

Hi Bro
If you’re not doing any port based ACL in your FWSM, I can only assume you’re permitting the rules between both the AD by IP e.g. access-list inside permit ip host 1.1.1.1 host 2.2.2.2, am I right? I hope you can PING between both the AD, otherwise this could be a routing issue.
Listed below are some commands that you could type to investigate this issue further;
a) show np block (hardware buffer counters) - if they are non-zero and increasing it's bad. You're most likely running into hardware limitation of the FWSM.
b) show np all stats | i RTL and show np all stats | i RL will show you if the packets are dropped because of software rate limiting mechanisms built into network processors.
Perhaps, what you need is to enable the “xlate-bypass” command. By default, the FWSM creates NAT sessions for all connections even if you do not use NAT. You can disable NAT sessions for untranslated network traffic, which is called xlate bypass, in order to avoid the maximum NAT session limit. The xlate-bypass command can be configured as shown:
hostname(config)#xlate-bypass
If the xlate-bypass doesn’t resolve your issue, please do ensure you’ve a static NAT or dedicated nat/global in place.
The last resort is to enable sysoption np completion-unit, this magic option is invoking special processing created to address scenarios in which FWSM was known to introduce out of order packets for TCP streams.

Directory Security Strange Permissions Issues (Windows Server 2003 running Active Directory)

I have a user that all of a sudden was not able to open 70% of her files located on a file server, Windows Server 2003 running Active Directory, from her laptop. The same user can access all the same files from a different machine, logging on with the same
credentials. Just looking for a point in the right direction and a possible theory as what could cause this problem, an why all of a sudden. I did go back through the logs but nothing sticks out. For the most part the logs on the server and the laptop are
pretty clean.
Both machines are Latitude E5420s running Windows 7 Enterprise Service Pack 1. Both machines are 64bit and connect to the network via hard-wire, not wireless.
Thanks in advanced.
Grajek

I would recommend proceeding that way:
Check that your DCs are in a healthy state and AD replication is fine: It might be that the user is member of security groups and the membership is not getting replicated properly which can cause this random behavior. You can use
dcdiag and repadmin for checks and you can refer to my recommendations here: http://social.technet.microsoft.com/wiki/contents/articles/18513.active-directory-replication-issues-basic-troubleshooting-steps-single-ad-domain-in-a-single-ad-forest.aspx
Make sure that the file server is reachable from the user client computer. Start with
ping and nslookup. Also, you need to make sure that the traffic between the client and the server is not blocked or filtered. You might want to temporary disable security software for testing
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Download issue when Windows 7 Pro joins a Windows Server 2008 Active Directory

Hi,
I purchased 2 new Dell OptiPlex 3010 desktop computers that came with Windows 7 Professional operating system with SP1.
There were no Microsoft updates installed yet. After I added one of these Dell computers to the Windows Server 2008 Active Directory, I was not able to download several items.
Below are several examples:
1) I downloaded the Norton anti-virus installation file. This file is not the full installation of Norton; it is more of a file where you execute it and it will download the full installation from the Internet like from their Norton web
site. So when I executed this installation file, it does not download the full installation files.
It just hung at the screen saying “Downloading” and it will finally stop with an error (don’t remember the error message).
Note: If I have the full Norton installation file then I am able to install it on this computer with no problems.
2) I downloaded the Adobe Reader installation file. This file is not the full installation of Adobe Reader; it is more of a file where you execute it and it will download the full installation from the Internet like from their Adobe web
site. So when I executed this installation file, it hung at the downloading part and then it will error out with a “Actionlist Not Found” message.
Note: If I have the full Adobe Reader installation file then I am able to install it on this computer with no problems.
3) I installed Microsoft Office 2010 Standard version on this computer.
I configured Microsoft Outlook to retrieve emails from my email provider (pop and smtp settings).
After configuring Microsoft Outlook, I was able to send emails through Microsoft Outlook successfully (and very quickly), but he was unable to retrieve my emails. The progress bar for the Receiving in the "Outlook Send/Receive Progress" box
shows no progress. The Progress bar is not moving. There is a message at the bottom of Microsoft Outlook stating "Receiving message 1 of 6 (x.xx KB of x.xx MB)" and it is very slow. My new emails were not being retrieved at all.
I tried various pop and smtp servers that was available for my email provider, but all had the same effect.
4) I can access certain web sites (e.g.
www.yahoo.com, www.cnn.com) while I cannot access other web sites like
www.usatoday.com, my web hosting email site.
Note: I had a Dell computer with Windows XP Professional operating system and this computer does not have any of the above issues.
The above are only a few examples that I have experienced.
If I removed this Dell OptiPlex 3010 computer from the Windows Server 2008 Active Directory then I still experience the same issue.
So as another test, I setup the other new Dell OptiPlex 3010 with the same Windows 7 Professional OS with SP1.
This time, I did not join the Windows Server 2008 Active Directory and I was able to successfully download the full Norton installation files, download the full Adobe Reader installation files, download my emails from Microsoft Outlook 2010, etc.
But once I joined this computer to the Windows Server 2008 Active Directory then I am not able to download these files and emails at all.
It seems like there might be some group policy or a security setting that is preventing these downloads so I disabled the group policy on the Windows Server 2008 AD and Windows 7 Profession OS, but it didn’t resolve the issue.
I disabled all of the firewall programs on this Windows 7 Professional OS, but it still did not resolve the issue.
Since the Windows Server 2008 AD did not have DHCP installed, I installed DHCP and setup a scope.
Then configured the Windows 7 Professional OS to obtain an IP address, but it didn’t resolve the issue.
If I move this Windows 7 Professional computer to another network where it did not have any Active Directory; it just had a wireless router serving DHCP then everything works on the Windows 7 Pro computer.
Any ideas what is the root cause when a Windows 7 Professional computer join a Windows Server 2008 AD?
Thanks,
wl_tech

Hi,
Could you please tell some information for the AD environment and how it connect to the internet?
Regarding 3rd party installlers didn't work as expected, please also seek help in their offical website.
For outlook not receiving emails, could you please take a look in
Event Viewer and see if there are any special errors logged there?
And when trying to access the website like
www.usatoday.com, any special errors IE showed out?
Best regards
Michael Shao
TechNet Community Support

Issue with Active Directory User Target Recon

Hi ,
I am facing an issue with Active Directory User Target Recon
My environment is OIM 11g R2 with BP03 patch applied
AD Connector is activedirectory-11.1.1.5 with bundle patch 14190610 applied
In my Target there are around 28000 users out of which 14000 have AD account (includes Provisioned,Revoked,Disabled accounts)
When i am running Active Directory User Target Recon i am not putting any filter cleared the batch start and batch size parameters and ran the recon job .Job ran successfully but it stopped after processing around 3000 users only.
Retried the job two three times but every time it is stopping after processing some users but not processing all the users.
Checked the log file oimdiagnostic logs and Connector server logs cannot see any errors in it.
Checked the user profile of users processed can see AD account provisioned for users
My query is why this job is not processing allthe users.Please point if i am missing some thing .
thanks in advance

Check the connector server load when you are running the recon. Last time I checked the connector, the way it was written is that it loads all the users from AD into the connector server memory and then sends them to OIM. So if the number was huge, then the connector server errored out and did not send data to OIM. We then did recon based on OUs to load/link all the users into OIM. Check the connector server system logs and check for memory usage etc.
-Bikash

Certificate issues Active Directory Certificate Services could not process request 3699 due to an error: The revocation function was unable to check revocation because the revocation server was offline. 0x80092013

Hi,
We have some problems with our Root CA. I can se a lot of failed requests. with the event id 22: in the logs. The description is: Active Directory Certificate Services could not process request 3686 due to an error: The revocation function was unable to
check revocation because the revocation server was offline. 0x80092013 (-2146885613). The request was for CN=xxxxx.ourdomain.com. Additional information: Error Verifying Request Signature or Signing Certificate
A couple of months ago we decomissioned one of our old 2003 DCs and it looks like this server might have had something to do with the CA structure but I am not sure whether this was in use or not since I could find the role but I wasn't able to see any existing
configuration.
Let's say that this server was previously responsible for the certificates and was the server that should have revoked the old certs, what can I do know to try and correct the problem?
Thank you for your help
//Cris

hello,
let me recap first:
you see these errors on a ROOT CA. so it seems like the ROOT CA is also operating as an ISSUING CA. Some clients try to issue a new certificate from the ROOT CA and this fails with your error mentioned.
do you say that you had a PREVIOUS CA which you decomissioned, and you now have a brand NEW CA, that was built as a clean install? When you decommissioned the PREVIOUS CA, that was your design decision to don't bother with the current certificates that it
issued and which are still valid, right?
The error says, that the REQUEST signature cannot be validated. REQUESTs are signed either by itself (self-signed) or if they are renewal requests, they would be signed with the previous certificate which the client tries to renew. The self-signed REQUESTs
do not contain CRL paths at all.
So this implies to me as these requests that are failing are renewal requests. Renewal requests would contain CRL paths of the previous certificates that are nearing their expiration.
As there are many such REQUEST and failures, it probably means that the clients use AUTOENROLLMENT, which tries to renew their current, but shortly expiring, certificates during (by default) their last 6 weeks of lifetime.
As you decommissioned your PREVIOUS CA, it does not issue CRL anymore and the current certificates cannot be checked for validity.
Thus, if the renewal tries to renew them by using the NEW CA, your NEW CA cannot validate CRL of the PREVIOUS CA and will not issue new certificates.
But it would not issue new certificates anyway even if it was able to verify the PREVIOUS CA's CRL, as it seems your NEW CA is completely brand new, without being restored from the PREVIOUS CA's database. Right?
So simply don't bother :-) As long as it was your design to decommission the PREVIOUS CA without bothering with its already issued certificates.
The current certificates which autoenrollment tries to renew cannot be checked for validity. They will also slowly expire over the next 6 weeks or so. After that, autoenrollment will ask your NEW CA to issue a brand new certificate without trying to renew.
Just a clean self-signed REQUEST.
That will succeed.
You can also verify this by trying to issue a certificate on an affected machine manually from Certificates MMC.
ondrej.

Active Directory Issues 10.7.4 & 10.7.5

Hi
I'm having problems with all my 10.7.4 & 10.7.5 mac's. They're losing their connection to AD. When I got to unbind I get the follwing error:
Unable to access domain controller
This computer is unable to access the domain controller for an unknown reason. Warning: If you click force unbind you will leave an unused computer account in the directory.
I then get an option to ok or force unbind. If I force unbind if I force unbind I get the following error:
An unknown error occurred
An unknown error occurred
Helpful, I'm sure you'll agree! If I go in to Console I can see the following to errors:
02/10/2012 16:01:25.682 Directory Utility: An instance 0x7f8f02b30f30 of class ODCUnbindFromADAction was deallocated while key value observers were still registered with it. Observation info was leaked, and may even become mistakenly attached to some other object. Set a breakpoint on NSKVODeallocateBreak to stop here in the debugger. Here's the current observation info:
<NSKeyValueObservationInfo 0x7f8f02b56970> (
<NSKeyValueObservance 0x7f8f02b568c0: Observer: 0x7f8f01cea980, Key path: progressStatus, Options: <New: NO, Old: NO, Prior: NO> Context: 0x0, Property: 0x7f8f02b569a0>
and...
02/10/2012 16:03:32.463 Directory Utility: -[SFAuthorization obtainWithRights:::::] failed with error Error Domain=NSOSStatusErrorDomain Code=-60007 "The operation couldn’t be completed. (OSStatus error -60007.)" (The authorization was denied since no user interaction was possible. )
When users are curently logged in they lose access to SSH sessions, and network drives etc... they have had issues with saving work and subsiqently losing it!
When I go in to opendirectyd.log I see the following:
2012-10-02 15:37:42.208 BST - opendirectoryd (build 172.17) launched...
2012-10-02 15:37:42.265 BST - Logging level limit changed to 'error'
2012-10-02 15:37:42.902 BST - Initialize trigger support
2012-10-02 15:37:42.904 BST - Registered node with name '/Active Directory' as hidden
2012-10-02 15:37:42.904 BST - Registered node with name '/Configure' as hidden
2012-10-02 15:37:42.905 BST - Discovered configuration for node name '/Contacts' at path '/Library/Preferences/OpenDirectory/Configurations//Contacts.plist'
2012-10-02 15:37:42.905 BST - Registered node with name '/Contacts'
2012-10-02 15:37:42.906 BST - Registered node with name '/LDAPv3' as hidden
2012-10-02 15:37:42.939 BST - Registered node with name '/Local' as hidden
2012-10-02 15:37:42.964 BST - Registered node with name '/NIS' as hidden
2012-10-02 15:37:42.965 BST - Discovered configuration for node name '/Search' at path '/Library/Preferences/OpenDirectory/Configurations//Search.plist'
2012-10-02 15:37:42.965 BST - Registered node with name '/Search'
2012-10-02 15:37:43.024 BST - Discovered configuration for node name '/Active Directory/NUCA-AD' at path '/Library/Preferences/OpenDirectory/Configurations/Active Directory/NUCA-AD.plist'
2012-10-02 15:37:43.024 BST - Registered subnode with name '/Active Directory/NUCA-AD'
2012-10-02 15:37:43.024 BST - Registered placeholder subnode with name '/Active Directory/NUCA-AD/All Domains'
2012-10-02 15:37:43.040 BST - Discovered configuration for node name '/LDAPv3/nuca-mon1.nuca.ac.uk' at path '/Library/Preferences/OpenDirectory/Configurations/LDAPv3/nuca-mon1.nuca.ac.uk. plist'
2012-10-02 15:37:43.040 BST - Registered subnode with name '/LDAPv3/nuca-mon1.nuca.ac.uk'
2012-10-02 15:37:43.108 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/legacy.bundle'
2012-10-02 15:37:43.307 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/search.bundle'
2012-10-02 15:37:44.311 BST - '/Search' has registered, loading additional services
2012-10-02 15:37:44.311 BST - Initialize augmentation support
2012-10-02 15:37:44.352 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/SystemCache.bundle'
2012-10-02 15:37:44.423 BST - Successfully registered for Kernel identity service requests
2012-10-02 15:37:44.482 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/PlistFile.bundle'
2012-10-02 15:37:44.566 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/FDESupport.bundle'
2012-10-02 15:37:45.461 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ConfigurationProfiles.bundle'
2012-10-02 15:37:45.463 BST - Registered subnode with name '/Local/Default'
2012-10-02 15:37:45.556 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ldap.bundle'
2012-10-02 15:37:45.600 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/AppleODClient.bundle'
2012-10-02 15:37:45.645 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ActiveDirectory.bundle'
2012-10-02 15:37:45.654 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/Kerberosv5.bundle'
2012-10-02 15:37:45.858 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/NetLogon.bundle'
2012-10-02 15:37:45.858 BST - Registered subnode with name '/Active Directory/NUCA-AD/nuca.ac.uk' as hidden
2012-10-02 15:37:45.859 BST - Unregistered placeholder node with name '/Active Directory/NUCA-AD/All Domains'
2012-10-02 15:37:45.860 BST - Registered subnode with name '/Active Directory/NUCA-AD/All Domains'
2012-10-02 15:37:45.861 BST - Registered subnode with name '/Active Directory/NUCA-AD/Global Catalog' as hidden
2012-10-02 15:37:57.468 BST - failed to retrieve password for credential
2012-10-02 15:37:59.051 BST - failed to retrieve password for credential
2012-10-02 15:38:04.052 BST - failed to retrieve password for credential
2012-10-02 15:38:14.054 BST - failed to retrieve password for credential
2012-10-02 15:38:29.056 BST - failed to retrieve password for credential
2012-10-02 15:38:49.076 BST - failed to retrieve password for credential
2012-10-02 15:39:11.505 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/configure.bundle'
2012-10-02 15:39:11.900 BST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/keychain.bundle'
Interestingly enough, the problem doesn't seem to effect users runing 10.6.8 or my iMac which is running 10.8.2. I've spoken to network manager and he can't see anything strange going on, on the network.
I've also spoekn to our AD guy and nothing has changed.
This is now the second time it's happend, I've managed to get everyone working (before it happened again) by deleting the AD plist in /Library/Preferences/OpenDirectory/Configurations/Active\ Directory/ then rebinding via a scipt pushed out via ARD
If anyone can offer any assitance I'd be most gratful as I'm about to be shot by our users! as it's the start of our new academic year!
Thanks!
Paul

It's been a few weeks now, and (touch wood) it's not happended again on mass. We have had a few individual ones, but nothing major.
We still don't quite know exactly what happened, but trouble shooting found the following:
Our time server wasn't working corrctly centrifys ADCheck tool showed it as having a firewall (even though it didn't) our AD guy fixed that problem (sorry not sure exactly what he did)
We checked the AD kerberos ticket from a machine that lost it's connection to AD, on another mac that worked and found that it couldn't connect as the password was wrong. It seems that by default Active Directory ticket wants to change it's password every 14, and when trying to it's failing so I set it to 0
We had tried to set the server the AD plugin see's to a specific DC but this wasnt happening due to subnets not being configured in AD sites and Services
Some of the Mac's did not like being set to GMT in the time zone and the time was an hour out, people where able to login though! So I've now set them to Eurpoe\London and they're now picking up the correct time and even picked up the daylight savings over the weekend.
Our DNS is still not great but we are in the process of sorting out our subnets and when we do the consolodation we'll also asign reservations for all the mac's in the hope that apeases DDNS
Thanks Paul

Active Directory : Replication Issue - "Disconnected" sub-domain from the Forest

Hello everyone,
I'm managing a multi-domain forest (with 7 sub-domain). All are working fine except for one. Throught repadmin (Repadmin /replsum /bysrc /bydest /sort:delta), I noticed I got both domain controllers of a subdomain (there are only 2 DCs in that
subdomain), who hadn't replicated with the rest of the forest for more than 60 days.
According to my research, it's usually recommended to Depromote and repromote the problematic DC to avoid the issue of lingering objects. In this case, it's both DC of a sub-domain. Of course, on the others DCs in the forest, I got the event
ID 2012 "it has been too long since this machine last replicated with the named source machine....".
HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Allow Replication With Divergent and Corrupt Partner
to a value of 1.
As I understand it, this may cause lingering objects to appear (they can be removed with repadmin /removelingeringobjects command with the DSA GUID, naming context, etc..). So far, I haven't used that registry key yet because of the associated risks.
I didn't noticed any other issue so far. Users in the problematic sub-domain are fine, and the problematic sub-domain seems to be able to pull replication data from the others DCs in the forests. (at least, I'm not getting any error in the A.D. Sites
and Services)
I added two new DCs for the affected sub-domains, so the number of DCs for that domain went from 2 to 4 DCs. The two old DCs that hadn't replicated for 60 days are windows Server 2003 and the two new DCs are Server 2008 R2.
Unfortunately (and I was half expecting this, but did it anyway since I must eventually replace the old DCs), that didn't solve my issue, since the rest of the forest "doesn't see" the two new DCs of the sub-domain. By that, I mean that I
cannot add an Active Directory Domain Services Connection in Sites & Services console (from a DC in another domain of the forest or even the root domain). I see all the DCs, including the two old DCs that are server 2003, but not the new ones.
I believe it's because the others DCs doesn't pull/replicate the information from the old DCs anymore, so they aren't "aware" of the two new DCs for that problematic sub-domain.
I was wondering what is the best course of action. Is it worthwhilte to use the registry key force replication with the old DCs ? (and hopefully, the new DCs will get their AD Services connection/replication vector created, so I can depromote
the old DCs.
Since the Old DCs from the problematic sub-domain seems to be able to pull the replication from the rest of the forest, does the risk of Lingering object isn't that great ?
Or is it too risky and I must create a new sub-domain and migrate one way or another the users ? (which would be time-consuming)
Thanks in advance,
Adam

Thanks for the reply. One of the link had another link to a good article about the use of repadmin :
So, I ran the command "repadmin /removinglingerobjects " on one of the problematic DCs ().
For clarity purpose, let's say I used the domain :
domain = main domain
subdomain = the domain whose DC are problematic (all of them).
AnotherSubDomain = Just another subdomain I used as a "reference" DC to cleanup the appropriate partition.
Command (the DSA guid is from a DC "clean" in another domain)
repadmin /removelingeringobjects adrec01.mysubdomain.domain.ca C4081E00-921A-480D-9FDE-C4C34F96E7AC dc=ANOTHERsubdomain,dc=domain,dc=ca /advisory_mode
I got the following message in the event viewer :
Active Directory Domain Services has completed the verification of lingering objects on the local domain controller in advisory mode. All objects on this domain controller have had their existence verified on the following source domain controller.
Source domain controller:
c4081e00-921a-480d-9fde-c4c34f96e7ac._msdcs.mydomain.ca
Number of objects examined and verified:
0
Objects that have been deleted and garbage collected on the source domain controller yet still exist on this domain controller have been listed in past event log entries. To permanently delete the lingering objects, restart this procedure without using the
advisory mode option.
How should I interpret the message "number of objects examined and verified 0". Does it mean it just didn't find any object to compare ? (which would be odd IMHO) Or there is another problem ?
Thanks in advance,
Adam

DNS, Certificates, and Active Directory - School Setup Issues

Our school has been piloting a small iPad depolyment. I have been struggling with getting Profile Manager to work correctly since August of last year. Here's the setup:
1. Active Directory DNS/DHCP server (set as "school.local"--yes, I know .local is bad form, but it was set before I got here). I have changed the "Digest" to "Basic" setting
2. Mac Mini server that has its own external IP and hostname ("mac.school.org") and is also bound to the AD server for user authentication for services (Profile Manager, WebDAV, wiki, etc.). I have a self-signed SSL certificate installed under the name "mac.school.org"
3. About 90 iPads, and a handfull of Mac desktops
In a perfect world, users would be able to login (with their AD credentials) to the Profile Manager self-service portal using the external hostname of the mac server ("mac.school.org/mydevices"), install the Trust Profile, and enroll the device (iPad, Mac, etc).
However, this is not the case. The setup seems to work for awhile; quite perfectly in fact. But then for reasons unknown to me, everything just "breaks" and Profile Manager ceases to work like it should. Here are some of issues I am seeing:
a.) DNS service on the Mac server turns itself ON randomly. DNS should NOT be running this server, correct? All DNS lookups internally are done by the AD server. I've used changeip and everything matches (both say "mac.school.org")
b.) Whenever we use VPN, and at other seemingly random times, the server's hostname changes from "mac.school.org" to "mac.school.local" I would make the server external only, but it needs to have an internal IP to talk to the AD server.
c.) AD binding breaks randomly and I have to rebind the server to AD
d.) When enrolling devices, Profile Manager starts rejecting certificates (not a trusted source, etc.) and I have to destroy OD and PM and start all over again.
I know this is a lot and I'm not necessarily expecting anyone to answer all of these questions. I guess I'm wondering if anyone could point me in the right direction? I've looked for help with these issues all over the place, but none of the environments I read about are quite like the one I'm in.

Yes, I am not giving the real domain name here.
No prob. just checking, sometimes people have weird domain names never know if they are real or they expect them to be real or they put domain names owned by someone else on their internal network eek.
Not really needed to use mac.school.org internally, that is in local LAN. The thing to understand about DNS is the scope for which a DNS zone is relevant WRT a client machine — inside LAN or on Internet, and which DNS server is authoritative for a domain. Authoritative in the sense of 'the final word'.
Go to Network Utility on your mac, type in your real domain name (whatever you are changing to school.org to hide it) what comes back. On my server I see the below (I have replaced my real, Internet legal domain, to 'example.com')
In my setup I have, on the LAN, setup the Mac server to be authoritative for domain 'example.com'. On the Internet however it is another external DNS server.
So you have set DNS forwarders on the Mac machine?
I really don't believe that the machine's hostname is changing, it is statically configured. What I believe is happening is that DNS name resolution is telling you different things at different times because you are using different DNS servers.
On mac machine terminal type $less /etc/resolv.conf and copy paste what it says. In server app Services | DNS right side does it say you have forwarders?
Still it is not good to have two DNS domains in your internal LAN, there is no need to have school.org on the mac DNS unless it is going to be fully setup to be authoritative in the internal LAN for the domain school.org. You can have school.org on the Internet (Internet scope of users point 1) and school.local on internal machine (LAN scope of users).
Lookup has started…
Trying "example.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53292
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; QUESTION SECTION:
;example.com.                   IN        ANY
;; ANSWER SECTION:
example.com.     10800          IN        SOA          example.com. admin.example.com. 2013010907 3600 900 1209600 86400
example.com.     10800          IN         NS          server.example.com.
example.com.     10800          IN         MX          10 server.example.com.
;; ADDITIONAL SECTION:
server.example.com. 10800       IN          A          192.168.1.20
Received 145 bytes from 127.0.0.1#53 in 2 ms

Active directory member;range=0-999 issue

Similar Messages

Maybe you are looking for