Cannot connect Workgroup Manager using a domain administrator account

Hello,
I'm trying to determine if this is normal behavior or something is not working right:
When using Workgroup Manager (remotely or locally on the server) it will only let me connect with the local (Netinfo) administrator account that was created upon install of the server. It will NOT let me log in with the diradmin account that was created when promoting the server to an OD master (or any other accounts I created (under the LDAP directory) and checked User can "administer the server" and "administer this directory domain").
Once connected to WGM with the local admin account I then can (and still need to) authenticate to the directory database using the diradmin account (which works). Is this normal behavior?
From reading Apple's User Management documentation it seems to indicate that once a domain administrator account is set up you can use that account to log into WGM.
Thanks in advance.
- Brian
Mac OS X (10.4.6)

OK, it looks as though I've figured this out. Using the Directory Access utility on the server itself, I needed to add the "LDAPv3/127.0.0.1" directory domain to the list of domains to search for authentication.

Similar Messages

Cannot access Exchange Mgmt Shell - user "Domain\Administrator" isn't assigned to any management roles

This is a new domain-joined Server 2012 member server with no data. Domain Administrator account is in the Organization Management group. Domain functional level is Server 2012.
Setup /m:RecoverServer fails because "...server roles are already installed..."
Uninstall fails because the "mailbox database contains one or more mailboxes..." which I can't delete.

Hi,
I recommend you refer to the following article to troubleshoot the issue:
https://social.technet.microsoft.com/wiki/contents/articles/14874.error-the-user-domain-localusersadministrator-isnt-assigned-to-any-management-roles-on-exchange-2010-management-console.aspx
we may try to propagate the RBAC permissions for the user again! procedure is as below:
1.
Open Windows Powershell as “Run As Administrator”
2.
Load the setup Snapin with the command: Add-Pssnapin *Setup*
3.
Run the commands one after the other to propagate the RBAC to the user who is logged on to the Exchange Server.
a. Install-CannedRbacRoleAssignments –InvocationMode Install
b.
Install-CannedRbacRoles
c.
Install-CannedRbackRoleAssignmentsRAP
d.
Install-CannedAddressLists
Thanks.
Niko Cheng
TechNet Community Support

PI 7.11: Cannot connect to server using message server:...

Hello Guys,
we make the Application Management for a Customer PI System.
Scenario:
- the SAP Gui Connection to the ABAP Stack is routed via SAPRouter and Works fine.
SAP Gui -> our SAP Router -> VPN Box from Customer -> Firewall Customer -> ABAP Stack PI System
- WebAccess its working fine, the Customer use Webdispatcher on every PI Server...
Browser -> VPN Box from Customer -> Firewall Customer -> Java Stack (Port: 5xx00 btw. 81xx (Webdispatcher))
Problem:
Our Problem ist, we can not proceed the Integration Builder or the ESB, the Java Web Start works fine and open the Logon Screen Correctly -> but i fill the Logon Screen with my User name and Password and press Logon come the follwing Error:
"Cannot connect to server using message server: ms://<hostname>.<domain>:8134/P4"
In the Details from the Error Message:
"<hostname>.<domain>:53404 Reason: com.sap.engine.services.rmi_p4.P4IOException:
Cannot open connection to host: <IP-Adress of Central Instance> and Port: 53404"
The Customer says, the Firewall is open with the IP Adresses and P4 Port but i dont think so...
Can everybody help me, or have tips for me! I have checked a lot of OSS Messages (PI High Availabilty etc... its all correct on the System)
Sorry for my bad English
Best Regards,
Markus

Hi Markus,
did you check if the browser is using a proxy? (In this case your scenario unfortunately won't work).
P4-port should generally be routed via a proxy (described in the help.sap.com), but within the PI-Tools(JNLP) the proxy-usage is not implemented. There is even a SAP-note that describes how to check the JavaWebStart-Proxyconfiguration, but this won't help either.
If there is a proxy defined in the browser everything is working fine till you pass the logon-screen but even with the correct "javaws"-settings you won't be able to go on.
(This problem is pretty bad if you do have developers and the SAP-servers seperated because of security issues. I'm hoping that this malfunction will be solved with upcoming patches.)
Solution: Establish a connection without any proxy in between.
E.g.: a terminal server in the same network
It would be helpful to find more people with the same problem to force a fix from SAP for that.
If anyone else is having problems with this, please add a comment to this thread.
Best regards
Christian

Cannot connect to server using message server: ms://xiidhasoft:50004/P4

Hi SAP Guru's
When PISUPER or any any of the enduser is trying to login in the Integration Builder , they are getting error
Cannot connect to server using message server: ms://xiidhasoft:50004/P4
I have tryed to search in SDN and got below solution but no success
1. Exchange Profile of PI - http://host:port/exchangeProfile
2. Check with the rmi port number.
3. if rmi port number is empty or any number is present ( check with Tr code: SMICM - services - check for p4 port number - it will be ex: 5<nr>04)
4. fill the rmi port number as present in the P4.
OR
implement note 864268
I have Netweaver PI 7.1 .
Please suggest some alternative solution.
Thanks & Regards
Vinay Patel

You may check your local PC Java Network Setting.
Troubleshooting:
Probably Javau2122 WebStart does not detect the correct Proxy Settings. In this case please proceed as follows:
To change the Proxy Settings for Javau2122 Web Start:
1. Click Start --> Run and enter javaws. Press button OK.
2. Control Panel -> Programs ->Java -> Network Settings...
3. Select Direct Connection to switch off the proxy settings and press button OK.
If this still does not work, select Use proxy server to set manually the HTTP Proxy and Port.
Contact your network administrator for the correct settings.

Cannot connect Service Manager with Orchestrator Web Service URL

Dear TechNet User,
i cannot connect my service manager console with my Orchestrator Webservice. i try to connect to "http://AMSCO01:81/Orchestrator.svc" ... the user i´ve choose is local admin on the orchestrator Machine.
Thats the Logfile:
Date: 07.10.2013 15:23:16
Application: System Center Service Manager
Application Version: 7.5.2905.0
Severity: Error
Message: Could not connect to the Orchestrator web service.
System.Data.Services.Client.DataServiceQueryException: An error occurred while processing this request. ---> System.Data.Services.Client.DataServiceClientException: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>404 - File or directory not found.</title>
<style type="text/css">

</style>
</head>
<body>
<div id="header"><h1>Server Error</h1></div>
<div id="content">
<div class="content-container"><fieldset>
<h2>404 - File or directory not found.</h2>
<h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>
</fieldset></div>
</div>
</body>
</html>
   at System.Data.Services.Client.QueryResult.Execute()
   at System.Data.Services.Client.DataServiceRequest.Execute[TElement](DataServiceContext context, QueryComponents queryComponents)
   --- End of inner exception stack trace ---
   at System.Data.Services.Client.DataServiceRequest.Execute[TElement](DataServiceContext context, QueryComponents queryComponents)
   at System.Data.Services.Client.DataServiceQuery`1.Execute()
   at System.Data.Services.Client.DataServiceQuery`1.GetEnumerator()
   at Microsoft.EnterpriseManagement.ServiceManager.Sdk.Connectors.OrchestratorRunbookConnector.GetRunbookFolders(OrchestratorContext scoContext, Folder parentFolder)
   at Microsoft.EnterpriseManagement.ServiceManager.UI.Administration.Connectors.Orchestrator.OrchestratorConnectorHelper.ValidateServerConnection(Boolean found)
System.Data.Services.Client.DataServiceClientException: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>404 - File or directory not found.</title>
<style type="text/css">

</style>
</head>
<body>
<div id="header"><h1>Server Error</h1></div>
<div id="content">
<div class="content-container"><fieldset>
<h2>404 - File or directory not found.</h2>
<h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>
</fieldset></div>
</div>
</body>
</html>
   at System.Data.Services.Client.QueryResult.Execute()
   at System.Data.Services.Client.DataServiceRequest.Execute[TElement](DataServiceContext context, QueryComponents queryComponents)
any ideas? Thank you very much!

Hi,
I am unable to connect to
http://hostname:81/Orchestrator2012/Orchestrator.svc/ in IE and am getting the same error while creating the connector.
I can connect to orchestrator via http://hostname:81/ but it still gives me the same error when I create the connector (Cannot connect Service Manager with Orchestrator Web Service).
anyone seen it before?

I've used the Domains Administrator and added 45 domains. Where is that information recorded ?

I've used the Domains Administrator and added 45 domains. Where is that information recorded ?
Thanks,
Bob Larsen

The should be in defaultdomains.xml which will be in your system types directory (if you defined one), otherwise it is in a folder where you installed data modeler.

Since a I have intalled OS X Lion I cannot connect internet mobile using my ZTE mobile pen

Since a I have intalled OS X Lion I cannot connect internet mobile using my ZTE mobile pen.

It sounds like you need updated drivers. They are hard to find for that thing. This is what I found on a cursory search:
http://studiofourfour.zendesk.com/entries/20305042-mac-os-x-lion-3-zte-usb-broad band-drivers
You should consider contacting the manufacturer or cell provider that sold you the modem for support.

Built-in domain Administrator account not given full access to new Exchange 2013 server

I migrated from Exchange 2010 to 2013 over the weekend. I cannot log into the EAC with my domain administrator account I use to log into all my other servers. I also cannot run the clean-mailboxdatabase cmdlet logged in as this user. I
had no trouble moving mailboxes from the old server to the new server with this account though.
This account is a member of: Domain Admins, Enterprise Admins, Exchange Full Admin, Exchange Organization Admin, Organization Management, Schema Admins, Server Management.
I can log into the EAC with another admin account that has the same memberships as the Administrator account.
I tried giving the account the role of "Databases" as suggested by others to fix the clean-mailboxdatabase issue but that did not work for me either.
The Administrator mailbox has been moved to the new database on the Exchange 2013 server. The Exchange 2010 has been decommissioned and is turned off.

Hi,
Based on my research, to retrieves the mailbox statistics for the disconnected mailboxes for all mailbox databases in the organization, we can try the following command:
Get-MailboxDatabase | Get-MailboxStatistics -Filter 'DisconnectDate -ne $null'
http://technet.microsoft.com/en-us/library/bb124612(v=exchg.150).aspx
Additionally, The Identity parameter specifies the disconnected mailbox in the Exchange database and it can be display name instead of mailbox GUID.
http://technet.microsoft.com/en-us/library/jj863439(v=exchg.150).aspx
Hope it can help you.
Thanks,
Angela Shi
TechNet Community Support

Built-in Domain Administrator Account Repeated Locks

This account was disabled years ago and is not used. However, event 4740 are regularly generated, It shows the calling computer name as one of our servers. So, I logged into the that server and look in the local security event log and there
are no references to account lockouts at the time the 4740s are generated on the domain controllers.
I checked for services running on the server using administrator credentials and I checked for scheduled tasks using administrator credentials and I don't see anything on the server listed as caller computer.
I renamed the "User logon name" for this account to something different so that would not longer be a match if something is try to authenticate using the logon name of "administrator." However, this has not helped. The account
still generates the 4740.
I checked the domain "Administrator" account again today and it was no longer disabled. So, I disabled it again and will see if it still gets locked out again in the next 24 hours.
How can an account with the user id changed still get locked out? It seems very strange that the account can be locked out when the user name no longer matches anything that could have ever had that user id saved.
What can be done to fix this issue?

hi,
If possible please do the following steps.
Note: here I have taken user account name as User1
1.Using ADSIEDIT changed the value of UserAccountControl attribute of the User1 account to 66082(numerical) i.e. 0x10222(in hex) and disabled it which is the sum of the following attributes:
a. ACCOUNTDISABLE; PASSWD_NOTREQD; NORMAL_ACCOUNT; DONT_EXPIRE_PASSWORD
b.
It’s current value was 0x10202 aka 66050 in dec (I believe this implies ACCOUNTDISABLE | NORMAL_ACCOUNT | DONT_EXPIRE_PASSWD)
2.   Then for the account (in ADUC) do the following:
a. Unchecked the "user cannot change password" -> OK
b. Right-clicked on the
‘user1’ account and selected reset password and kept it blank and clicked OK
i.
This step is to set a NULL password for the User1 account and keep it disabled
c.
Right-clicked on the User1 account and checked the "user cannot change password" again
https://support.microsoft.com/en-us/kb/305144?wa=wsignin1.0

Domain Administrator account being locked up by PDC

Hi everyone,
My PDC is locking up my domain administrator (administrateur in french) account.
System event logs :
The SAM database was unable to lockout the account of Administrateur due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please
consider resetting the password of the account mentioned above.
Level : Error
Source : Directory-Services-SAM
Event ID : 12294
Computer : Contoso-PDC
User : System
There is absolutely no events in the security events log, not a single "Audit Failure" event for the "administrateur" account.
I tried to change the name of the domain administrator account from "administrateur" to "administrator".
Now there is "Audit failure" events poping up in the security event logs.
Once again the Source Workstation is the PDC. I guess those events are there because it receive credential validation for an account who doesn't exist anymore since it have been renamed in "Administrator".
Here is the detail log :
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: Administrateur
Account Domain: CONTOSO
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc0000064
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: CONTOSO-PDC
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
On the PDC i checked :
Services : None of them are started with the "administrateur" account
Network Share : There is no network share ...
Task Scheduler : None of the tasks are launch with the "administrateur" account.
And the logon type (3:network) seem to indicate that the login comes from an other computer but i have nothing to look for, not a single IP.
Any ideas?
ps : Sorry for the probable english mistakes :(

Hi,
Thanks for you answers.
San4wish :
Lockout tool confirm that the domain administrator account is locked on my PDC. I didn't run eventcomb but i though it only helped parsing security event logs which i did "manually". Anyway i'll try eventcomb after this week end.
About the conficker worm : I looked into it and this worm was exploiting a vulnerability in the server service. It have been patched by MS08-067 (KB958644) and this kb isn't available for Windows 2008 R2 and Windwos 2012 so i guess Windows 2008 R2 have
fixed this vulnerabilty.
So i doubt its a conficker type worm.
Also i gave the PDC role to another DC (let's call him DC2) and now DC2 is locking the administrator account so it seems that the computer locking the account is doing it through the network and it's not something executed on the DCs.

Not Able to Promote DC to server even i am using built in Administrator Account.

hi,
i am facing below mentioned issue from last 4 to 5 days and i am very frustrating about this error and nobody give me a proper solution. if any anybody facing this kind of issue please give me a solution this will very helpful for me.
"Windows Server 2012 domain controllers have a default for the security setting named "Allow cryptography algorithms compatible with Windows NT 4.0" that prevents weaker cryptography algorithms when establishing security channel sessions."
Thanks & Regards,
Sushant Chavan.

Hi Sushant,
>>Not Able to Promote DC to server even i am using built in Administrator Account.
I have seen your thread "Verification of prerequisites for Domain Controller promotion failed" and provided a reply.
Verification of prerequisites for Domain Controller promotion failed
http://social.technet.microsoft.com/Forums/en-US/23f33ffa-a847-47bc-81d4-569f8e195886/verification-of-prerequisites-for-domain-controller-promotion-failed?forum=winserver8gen
In the reply, it provides a step-to-step guidance for setting up a Windows Server 2012 Domain Controller. Have we followed it to promote the server?
Best regards,
Frank Shen

Installing software from a Domain Administrator account

I have a machine on a domain. I have logged into that machine using a Domain Admin account, and am trying to install some software. Theoretically, a Domain Admin should have full rights on that local machine, yes? However, when I try to do that install I
get an error message:
"The system administrator has set policies to prevent this installation."
Any ideas of why this is occurring? What settings might I need to adjust to give the domain admin installation access?

It works with a local admin account. Doesn't work with domain account. I installed my first domain server 2 days ago and have no idea what I'm doing, which may be contributing to the problem, but from everything I can tell it seems like the "Domain Admins"
group has full permissions on all computers in the domain. I'm very confused why this is happening when, as you said, the domain admin should become a local admin by default (and I never messed with any default settings).
If it works with a local account, but is denied with a domain account, then it is either permissions (unlikely based on what you've described), a domain policy setting denying installations to domain accounts, or possibly some other software/security blocking
the installation.
examine the eventlogs on the pc, for events relating to the attempted installation.
these articles may help you to check for settings that can cause this, you would then need to work out where those settings are coming from, so you can consider changing them.
http://social.technet.microsoft.com/Forums/windows/en-US/6c62e6cc-7893-421d-8b90-8e14eaa1eb48/the-system-administrator-has-set-policies-to-prevent-this-installation?forum=itprovistasecurity
http://www.itninja.com/question/the-system-administrator-has-set-policies-to-prevent-this-installation-1?from=appdeploy.com
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Server restrict from domain administrator account

I have a server 192.168.1.XXX which is added in AD domain but I would like to restrict this server from domain administrator account.
192.168.1.XXX server will be access by local account only.
Please help..

I have a server 192.168.1.XXX which is added in AD domain but I would like to restrict this server from domain administrator account.
192.168.1.XXX server will be access by local account only.
Please help..
You received some great suggestions and info. Curious, why would you want to remove the domain admin account from accessing the server?
Maybe a stand alone server may be a better solution? You can still access domain resources from a stand alone using specific domain accounts, but the machine won't be joined to the domain preventing the domain admin account from accessing it.
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.

Cannot connect essbase sever using Essbase administration service console

Hi:
I installed Essbase 11.1.2.2 in my PC,
but I cannot connect essbase server with the administration servise console. but I try to connect with ESSCMD.exe, everything is OK.
could you pls help to advise how can I connect it ?

Did you add the essbase server in EAS?
If yes what is the message that you are getting while connecting to Essbase?
Regards
Celvin
http://www.orahyplabs.com
Please mark the answers as helpful/correct if applicable

Cannot connect to database using the Upgrade Simulation Tool

I have installed the Upgrade Simulation Tool on my system and when I try to run the tool my system works in the for awhile in the background and creates the _Simulation mdf and ldf files and a .bck file. After 3 or 4 minutes it gives me an error "Cannot connect to the database".
It looks to me like it is connecting to the database because it is creating the files in the SQL Data folder. I have tried to run it on several databases and get the same results.
Thank you, Jeff

Hi,
You may not have the ability to upgrade it directly.
He does have the ability.
When downloading Pl 42, it is cleary marked as "Upgrader", which means it can be used for upgrade (in this case simulation) from a lower version than 2007A
Patchlevel which are marked as "patch" are suitable only for updating the PL within the very same version of SAP Business One.
This tool should run under 2007 system I believe.
The Upgrade Simulation tool was designed in orderto test an upgrade, therefore it can run at a machine where 2005 version is installed. Technically speaking it creates a second SBO-common, which can be used only with the special designed (read only) client of the tool.
Jeff, you should check access rights of your SQL Data folder.Maybe grant user "Everyone" modifying rights to that folder. In addition you could try to detach a DB and move the related *.mdf and *.ldf to another folder where no access denied rights were applied.
If using MSSQL 2005 create via ODBC a Native Client connection to the Server, although you might just working locally only.
Regards
Mario

Cannot connect Workgroup Manager using a domain administrator account

Similar Messages

Maybe you are looking for