AD Administration Credentials

Post Author: ADoinel
CA Forum: Authentication
I need to switch from Enterprise to AD authentication. What permissions will the domain account that is entered under the "AD Administration Credentials" need?
Thanks for your assistance,
ADoinel

Post Author: TAZ
CA Forum: Authentication
Hi ADoinel,
The account will require read/query access to AD only. The term AD "Administration" credentials is a bit misleading.
Usually a regular domain user will have enough permission unless your AD has very strict domain policies enforced.
The account should also have a non-changing password or when the password expires AD auth will fail.
Regards,
Tim

Similar Messages

How to Add Publisher Administrator Credentials to Oracle BI Presentation Services Credential Store

I used to follow this document until 10g - Bookshelf v10.1.3.2: Adding Publisher Administrator Credentials to Oracle BI Presentation Services Credential Store
Does anyone know how to configure the same in OBIEE 11G
Thanks for your help
Srix

Tarun
In BI URL word analytics is kind of virtual directory, if you want to change this you might have to change at Web Server side.
Try to use em for your oc4j to change or redeploy the analytics with desired name.
Just in case you are using IIS then you need to check in IIS.
If helps mark
~ http://cool-bi.com

Administrative credentials when adding a WEP/WPA/WPA2 Enterprise wifi profile?

Hello,
Why do users need to provide administrative credentials when they install a configuration profile containing installation of a WEP Enterprise or WPA/WPA2 Enterprise Wifi-profile? This is not the case when installing a Wifi-profile usning standad WEP, WPA or WPA2.
Is this a bug? It confuses users with user profiles when they need to confirm the installation with administrative credentials.

I don't know the answer to your question. Maybe you can find something here:
http://training.apple.com/pdf/WP_8021X_Authentication.pdf

Standard account requires Administrator credentials

So, I bought a new MacBook the day after they came out. Everything is great so far except for one tiny thing. My girlfriend can't use our wireless connection if I am not around to log in with my credentials.
I don't want to leave the connection open or give her my password, for obvious reasons, but I also think there should be a way to flag my connection so that every acct (however rarely used) can connect to it without Administrator permission.
So far, I've tried adding a keychain to her account.
Is this possible? Do I have to setup a second connection or what?

This is what I have been able to accomplish so far:
<key>system.login.screensaver</key>
<dict>
<key>class</key>
<string>rule</string>
<key>comment</key>
<string>the owner as well as any admin can unlock the screensaver;modify the group key to change this.</string>
<key>rule</key>
<string>authenticate-session-owner-or-admin</string>
</dict>
<key>com.apple.airport.allow.network.cha</key>
<dict>
<key>class</key>
<string>rule</string>
<key>comment</key>
<string>the owner as well as any admin can unlock the screensaver;modify the group key to change this.</string>
<key>rule</key>
<string>authenticate-session-owner-or-admin</string>
</dict>
I switched users and tried it, then rebooted and tried again, but it still doesn't work. She still requires an administrator login and password to connect to our network.

Administrator credentials are not accepted

When a normal user account is logged in and an application upgrade asks for the credentials of an administrator account the credentials provided are not accepted in spite of the fact that the credentials are correct.

Obviously forgot to mention that when i log the user out and log in with the credentials of the administrator account it logs in correctly. Logging out and log in with user account and than providing credentials for administrator account for update gives the error text: login name or password incorrect. Which i just proven to be correct.

What is the apex internal administration credentials

dear all
i have installed oracle xe 11g and i have loged in on storage and apex tabs and i have created workspace and users.
now i would like to access apex internal administration. i need to configure email server ip there
can anyone help me with this.
thanks in advance
Uday

Hi Uday,
that's no problem. You'll find a script named apxchpwd.sql in the apex directory of your XE installation path (e.g. +/u01/app/oracle/product/11.2.0/xe/apex+ on Linux).
Change to that directory, start sqlplus as sysdba and run the script to reset the password.
Note that you'll have to set the environment properly to be able to run sqlplus. You can do that by sourcing the oracle_env.sh
. /u01/app/oracle/product/11.2.0/xe/bin/oracle_env.sh
cd /u01/app/oracle/product/11.2.0/xe/apex
sqlplus sys@XE as sysdba
(enter login data)
@apxchpwd.sql
(enter new password)
exitAfterwards you should be able to login using the new password.
-Udo

Connected to Domain but can't log in using Actived Directory Credentials

Hey everyone. I've been working on this issue for two weeks now, and I don't know what else to try. I'm connected to my domain but cannot get my Macbooks to log in using Active Directory credenitals both through our wireless network, and hard wired with an ethernet cable. The weird part about it is that it is not uniform all across our network. This only happens to certain Macbooks and as of right now there doesn't seem to be a pattern. I can say that it has happened to all new Macbook Pros that we have ordered lately though.
We use Jamf to manage our Macs on our network, and ever since upgrading to a new version (9.01 and now 9.1) we have had this issue. However I can't connect after manually adding the domain either, so for now it makes me think it is not a Jamf issue. Has anyone dealt with this issue before, that might know of a fix? Thanks!

Hi Burnettb1,
I have come across a similar issue as yours. I have included the instructions that I use to bind the Mac at my institution. In regards to wifi, I have not tried binding the Mac over wifi. Should you need to log in to a Mac with domain user credentials I would suggest to bind the Mac over ethernet. Once you get to the:
*Click on triangle to the left of Show Advanced Options to expand"
portion of the instructions click on the Mappings tab and select the checkbox for creating a mobile account at login. This will create a domain user profile on the machine that you can log into when not connected to the domain.
Hope this helps.
BIND iMac:
          Login into iMac using administrative credentials
          Open System Preferences
                    *Goto Users & Groups
                    *Click on lock in lower left-hand corner
                    *Use same password used to log into iMac
                    *Click on Login Options
*Click on ‘Join...’ button right of "Network Account Server: "
                    *Click on ‘Open Directory Utility…’ button
                    *Click on lock in lower left-hand corner
                    *use same password used to log into iMac and click on Modify Configuration
                    *Double-click on Active Directory
Active Directory Domain = domain
                              Computer ID = name of Mac
                    *Click on triangle to the left of Show Advanced Options to expand
                              *Click on Administrative tab
                              *Check Prefer this domain server
Type domainserver_ipaddr -or- servername.domain in this field
                              *Click on ‘Bind…’ button
                              *When prompted for network administrator login
                                        username = [domain admin user]
                                        pwd = [domain user password]
                              *Click OK (Note: search path will be updating. Until completed the ‘OK’
button will be greyed out
*Click OK
*Click lock to lock and close window
                    *Click lock to lock and close window
BIND CHECK:
          *Search AD for added mac host - it should be there.
          Open Terminal app by either:
                    1)
                              *Press command+spacebar
                              *Type Terminal and select app
                    2)
                              *Click on desktop
                              *Press shift+command+A
                              *Goto Utilities folder located within Application folder (which you should
be in) and open Terminal
          *Once Terminal is opened type in id [domain username] and press return key. The output should be
some some network account information
          *Close app by pressing command+Q and any other opened windows
          *Restart iMac
          *Log in

Workstation Credentials after Remote Desktop

Hello,
I am facing an issue with a SSO Captive Portal whenever I log into a server using RDP. While I can login normally using my login username, whenever I log into a server using Administrator credentials, it seems that IE uses the Administrator credentials instead
of the logged user.
Is there a way to identify the reason why IE gets the Admin credentials?
MCSE: Server Infrastructure

If you launched IE using the run as another user option then it is normal that the IE will launched under the administrator session / context. If this is not what you did then I would recommend that you reset IE settings and try again: https://support.microsoft.com/kb/923737?wa=wsignin1.0
More if you ask them in IE forum: https://social.technet.microsoft.com/Forums/ie/en-US/home?category=internetexplorer
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Migrate from Google Apps to Office 365 with admin credentials only

Hi team,
We are migrating from Google Apps to Office 365. I know the normal procedure of migrating, but I want to know how to migrate from gmail to office 365 with administrator credentials. Normally for migration, we use user's mail ID and password in CSV file.
But I don't want to use users credentials, instead I want to use only Administrator credentials.
Thanks in Advance...

A third party tool such as MigrationWiz can accomplish this task. More information on how to set up administrative access can be found here:
https://community.bittitan.com/kb/Pages/GoogleApps%20to%20Office365%20Migration%20Guide.aspx

Error entering SSO administrator creds

I am trying to configure SA 5.5.1.1 but when it asks me to put in the SSO administrator credentials I get the following error:
Something failed. Try again.
General failure.
java.net.UnknownHostException:
XXXXXXXXXXXXX.xxx.xxxxxxxx.gov: Name or service not known
XXXXXXXXXXXXX.xxx.xxxxxxxx.gov: Name or service not known
(I removed the server/domain names for security sake)
I've already verified that my server is up and running and all services are on/online and operational. I am able to log into my system using the SSO administrator account without issue, so I know the password for that is right.
I am unable to locate any documentation on SA other than the less than useful information provided by VMWare. Has anyone run into this before and if so how did you fix/overcome it?

I think it can happen if the host names of the SSO records that are found in the LS can't be resolved. (the error message isn't the most informative, unfortunately)
This could be either because 1) SA is using the wrong DNS server, or 2) the hostnames in the records are incorrect (not resolvable even if using the right DNS server).
Most probably it is 1). You can fix this by quitting the wizard (press Cancel), go to the "VA settings" tab and edit the network settings. Then you can continue with the installation (go back to Overview, press Configure and so on)
Hope that helps

UAC allowing standard domain user to elevate without providing credentials

I don't understand how this is occurring. We created a test user on our domain. Its only group membership is Domain Users. UAC is behaving quite different depending on which computer we test the account on.
When I login to my computer with the test user, UAC prompts me to provide an administrator username/password whenever I try to run something that requires elevated rights (for example: IE "Run as Administrator", compmgmt.msc via right-clicking
Computer and choosing "Manage", accessing another user's folder in c:\users)
When I login using the same test user to my colleague's computer (which was imaged and deployed at the same time), any of the above examples will elevate with a simple click of "Yes" or "Continue" to the UAC prompt. UAC does not prompt
for administrator credentials in this case and this standard Domain User account suddenly has local admin rights! How can this happen?

Hi,
Regarding the UAC issue mentioned, here are some suggestions:
. Change the UAC settings to a higher mode;
. Run gpupdate /force, then log off, then log on and check;
. Check to see if any
local UAC policies configured;
. Log on the Problematic computer with this test user and check the group membership;
. Create a new domain user and recheck this issue.
Best regards
Michael Shao
TechNet Community Support

Can't install add-in for non-administrator

Hello all,
I'm having trouble getting the Adobe Connect add-in installed under a non-administrator user's account. I found a successful method of installing it in this thread, but that method is no longer working for me. As the forum in question is currently down, I'll paste the post below:
I know this is an old thread, but we recently had this issue. Our users do not have the ability to install software, and using admin credentials at the UAC prompt installed it in the admin's profile, instead of the user's.
Here's how we solved it and made it per computer on Vista SP2. All without turning UAC off.
1) Log in as an admin and install the Connect Add-In.
2) Browse to the plug-in directory; directory should contain 1 .exe and 1 .s. **Note, there is a space in ...\Flash Player\...**
C:\users\%your_admin_account%\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\connectaddin6x5\
3) Run the connectaddin6x5.exe file, which will create 2 .dll files. It will also launch a window, which is okay to close after the 2 .dll files have been created.
4) Copy "\www.macromedia.com\bin\connectaddin6x5\*.*" to a central location for easier access.
5) Copy "\www.macromedia.com\bin\connectaddin6x5\*.*" to c:\users\default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\connectaddin6x5\*.*
**When any new user to the system logs in and their profile is generated, this will include the Connect Add-In plugin
6) For users who already have a profile, we created a simple .bat script to xcopy the directory structure and files created in Step 4 to "C:\Users\%UserProfile%\AppData\Roaming\Macromedia\Flash Player\"
7) Have the user run the script once and the plug in will be installed for the user.
8) Log in to/Refresh the meeting.
I hope this helps. If there's a better way to do this without disabling UAC, I'm interested. Or maybe an MSI to push with GPO. Or even a Setup.exe that can be run with User privileges. But with 10-15 users per computer and 100+ computers, this was our best solution.
Evan Franklin
Field Service Engineer, SAIC
The computer that I used this method on had the add-in working fine until a few days ago, when the add-in stopped being recognized. Repeating the process yielded no results. When installed as an administrator it works fine, and launching the browser under administrator credentials allows the add-in to run, but this is not an acceptable solution for the long-term.
Any help would be much appreciated.

Having the same problem has anyone come up with a fix yet?
Since the connect 9 update to our hosted account we can no longer use in the connect add-in for meetings. we lose all the screen sharing option that we once had working fine.

Scheduled Tasks - Administrator Best Practices

Hi all,
I've gotten assistance this week with a couple scripts and scheduling them as tasks. I actually have well over a dozen running on our Exchange server using a special user with a complex password. This user is not used for logging into any machine, but it
is a member of 'Administrators' group and can be used for tasks requiring elevated privileges.
What I am interested in learning is what the best practice is for running scheduled tasks. We have several, such as querying AD for members of select OUs or users who meet certain criteria. We also have automated emails regarding certain mailbox metrics,
etc. You get the idea.
Despite the complex credentials, this account is still discoverable and could be used in nefarious ways. Is it possible be running tasks on Server 2008 R2 (2012 possibly) without administrator credentials? Are there certain restrictions for the tasks (like
is a scheduled reboot allowed by a standard account, but not querying Active Directory?).
I also have noticed a checkbox with 'Run with highest privileges' and do not fully understand what this means.
When I try to run the task as a regular user (no remote permissions) and it says 'Logon failure: the user has not been granted the requested logon type as this computer.'
In short, can I safely remove our special user account from 'Administrators' and place into regular users without breaking all of our tasks?

Hi KSI-IT,
Firstly, based on my research, if you want to run the task scheduler with a user account, the user account must have the corresponding permission, in other words, you can also manually run the script with the user account.
1. For the error you posted 'Logon failure: the user has not been granted the requested logon type as this computer', please make sure the task account has "logon as a batch job" privilege.
To add the privilege of the account, please go to
[Local Security policy\Local Policies\User Rights Assignment]
-Log on as a batch job.
Add the domain\username account and any others you may need and retry.
2. For the setting 'Run with highest privileges', this means that it runs with the highest privileges available to that user. This is different from the context menu's 'Run As Admin'.
It generates the highest privilege token for the specific user, however, it cannot run as a different user, for a standard user with no elevated permissions, 'Run with highest privileges' does not do anything.
Reference from:
What
effect does "run with highest priviledges" in task scheduler have on powershell scripts?
I hope this helps.

Administrative password to unlock screen 10.10.2

How do I login to a locked screen (sleep/screensaver) on OS 10.10.2 with administrator credentials?
Background: I work on a k-8 school campus in Denver and often times need to troubleshoot users' machines when they are not present. If their sleep/screensaver requires a user password, I can't access the machine. Yosemite displays the user name and only that user's password will unlock the screen. Previous OS versions had both user and password fields and would accept admin credentials. OS 10.7-10.9 allowed for a config file change that would display user and password fields.
For most machines, it's no problem to just disable the screensaver but many administrators have confidential information and require security measures. It's also important to note that due to network configuration, I am unable to enable fast user switching.
Thanks in advance for any help solving this issue.
Various Macs - desktop & laptop
OS 10.6-10.10.2

While I'm very curious how to unlock a user's screen through user switching it appears as though I've worked it out -
option+return will give you user and password fields as long as the account is not an admin account.
I tested this on an admin account and that's why it didn't work. Thanks for all the help.

The domain users without administrative permission cannot install printers shared on printer server

Dears
We have a printer server that OS is Windows server 2003 .And all clinets are installed windows 7.Now,the domain users cannot installed printers shared on the printer server.When i logon the clinent computer with a domain user and access printer server by
URL \\192.168.37.1 ,i can see all printers shared on the printer server.Then i double click on printer to install it on client computer.It will ask me to input user name and password of local administrator .
How to install the printers with domain user directly. Thanks

refer step #8:
http://blogs.msdn.com/b/7/archive/2011/07/11/allowing-standard-users-to-install-network-printers-on-windows-7-without-prompting-for-administrative-credentials.aspx
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

AD Administration Credentials

Similar Messages

Maybe you are looking for