Disabled Account Still Able to Login (Server 4.0)

Hi there,
Just migrated OD from Snow Leopard Server using slapconfig -backupdb and -restoredb.
Everything is working so far, however, I couldn't figured out why a network account is still able to login when the account is clearly marked as disabled. (Allow to login is unchecked)
Anyone experienced this?
TIA!

Okay, I've finally resolved the issue, thanks to the Apple Enterprise tech support team. I'm thinking they wouldn't mind if I share this information, but I can't guarantee that this will work on your system or, worse yet, degrade your system further. However, that's fairly unlikely, just make sure you have plenty of backups before you begin any troubleshooting session.
So I was told to perform the following instructions, which I did, line for line. The part about closing Server.app seems a given, but I'm not sure why they want you to open Server.app at the the end (maybe taken out of context from some other instructions?). I did it anyway, but you should be able to begin testing, on a client workstation, right after rekerberizing is complete. I did, however, need to reboot my client, login as local admin, and then binding would proceed, and network users are able to login again. The engineer also let me know to expect an error, something like the following: "2015-03-11 21:58:38 +0000 Error synchronizing removal of attribute draft-krbPrincipalACL from record 72519e4c-7ac7-15e4-bd42-10adb1944cbc: 77013 result: 16 No such attribute" - this is apparently normal, and did in fact happen in my experience.
So here's the fix:
- Quit Server.app (don’t just close the window)
- On the Open Directory Server, execute these Terminal commands:
- sudo mkdir /var/db/openldap/migration/
- sudo touch /var/db/openldap/migration/.rekerberize
- sudo slapconfig -firstboot
- Open Server.app
And that's it. I did nothing else on my OD server, just logged out. Immediately tried binding on my MacBook client, it failed, I rebooted, tried again, it worked quickly, and I'm able to login with network user accounts again.

Similar Messages

Recently cerated Open Directory user accounts not able to login.

Hello Everyone,
I recently updated our companies Maverick server to version 3.2.1 and now some of my users are unable to login to our Open Directory server. Our server is currently running OS X 10.9.5 Build 13F34. The server log out put is the following when a user attempts to login to Open Directory.
12/8/14 11:35:46.995 AM kdc[3049]: AS-REQ [email protected] from 192.168.15.95:59274 for krbtgt/[email protected]
12/8/14 11:35:47.003 AM kdc[3049]: AS-REQ [email protected] from 192.168.15.95:59274 for krbtgt/[email protected]
12/8/14 11:35:47.004 AM kdc[3049]: Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ
12/8/14 11:35:47.011 AM kdc[3049]: AS-REQ [email protected] from 192.168.15.95:50783 for krbtgt/[email protected]
12/8/14 11:35:47.016 AM kdc[3049]: AS-REQ [email protected] from 192.168.15.95:50783 for krbtgt/[email protected]
12/8/14 11:35:47.017 AM kdc[3049]: Client sent patypes: ENC-TS
12/8/14 11:35:47.017 AM kdc[3049]: ENC-TS pre-authentication succeeded -- [email protected]
12/8/14 11:35:47.019 AM kdc[3049]: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, arcfour-hmac-md5, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
12/8/14 11:35:47.019 AM kdc[3049]: Requested flags: forwardable
12/8/14 11:35:47.282 AM kdc[3049]: TGS-REQ [email protected] from 192.168.15.95:50911 for host/[email protected] [canonicalize, forwardable]
12/8/14 11:35:47.283 AM kdc[3049]: Searching referral for mbpe-0c4de9abba49.local
12/8/14 11:35:47.284 AM kdc[3049]: Server not found in database: krbtgt/[email protected]: no such entry found in hdb
12/8/14 11:35:47.285 AM kdc[3049]: Failed building TGS-REP to 192.168.15.95:50911
12/8/14 11:35:47.289 AM kdc[3049]: TGS-REQ [email protected] from 192.168.15.95:64376 for krbtgt/[email protected] [forwardable]
12/8/14 11:35:47.290 AM kdc[3049]: Server not found in database: krbtgt/[email protected]: no such entry found in hdb
12/8/14 11:35:47.290 AM kdc[3049]: Failed building TGS-REP to 192.168.15.95:64376
Note: I have rebuild Open Directory and still see the message above when users attempt to login. Also, I have not changed the name of the server, all server certificates are valid and for some reason time machine restores is not working. I have tried to restore the server back to June and it made the issue worse.
Any help would be appreciated.

Thank you for you reply Linc. Unfortunately I tried this already and it did not fix my issue. I checked the Open directory startup log and found a possible issue with the domain name in the startup file and the signing certificate. The domain name has a $ and it can find the signing certifiate with a public key. Please take a look below and let me know what you think?
12/8/14 11:02:42.961 PM kdc[13708]: AS-REQ [email protected] from 127.0.0.1:63580 for krbtgt/[email protected]
12/8/14 11:02:42.975 PM kdc[13708]: UNKNOWN -- [email protected]: no such entry found in hdb
12/8/14 11:02:43.082 PM kdc[13708]: AS-REQ [email protected] from 127.0.0.1:52257 for krbtgt/[email protected]
12/8/14 11:02:43.093 PM kdc[13708]: UNKNOWN -- [email protected]: no such entry found in hdb
12/8/14 11:02:43.621 PM kdc[13708]: AS-REQ [email protected] from 127.0.0.1:64357 for krbtgt/[email protected]
12/8/14 11:02:43.633 PM kdc[13708]: UNKNOWN -- [email protected]: no such entry found in hdb
12/8/14 11:02:43.893 PM kdc[13708]: AS-REQ [email protected] from 127.0.0.1:64619 for krbtgt/[email protected]
12/8/14 11:02:43.904 PM kdc[13708]: UNKNOWN -- [email protected]: no such entry found in hdb
12/8/14 11:02:44.191 PM kdc[13708]: AS-REQ [email protected] from 127.0.0.1:61095 for krbtgt/[email protected]
12/8/14 11:02:44.210 PM kdc[13708]: UNKNOWN -- [email protected]: no such entry found in hdb
12/8/14 11:02:44.560 PM kdc[13708]: AS-REQ [email protected] from 127.0.0.1:52115 for krbtgt/[email protected]
12/8/14 11:02:44.576 PM kdc[13708]: UNKNOWN -- [email protected]: no such entry found in hdb
12/8/14 11:02:45.016 PM UserEventAgent[18]: Registered Workstation service - wdpmosx [68:5b:35:ca:f7:4b]._workstation._tcp.
12/8/14 11:02:45.193 PM kdc[13708]: AS-REQ [email protected] from 127.0.0.1:54745 for krbtgt/[email protected]
12/8/14 11:02:45.208 PM kdc[13708]: UNKNOWN -- [email protected]: no such entry found in hdb
12/8/14 11:02:45.554 PM kdc[13723]: label: WDPMOSX.XYZ.ORG
12/8/14 11:02:45.554 PM kdc[13723]: dbname: od:/LDAPv3/ldapi://%2Fvar%2Frun%2Fldapi
12/8/14 11:02:45.554 PM kdc[13723]: mkey_file: /var/db/krb5kdc/m_key.WDPMOSX.XYZ.ORG
12/8/14 11:02:45.555 PM kdc[13723]: acl_file: /var/db/krb5kdc/acl_file.WDPMOSX.XYZ.ORG
12/8/14 11:02:45.568 PM kdc[13723]: PKINIT: failed to find a signing certifiate with a public key
12/8/14 11:02:45.618 PM kdc[13723]: KDC started
Thanks again.

Users still able to sign into Lync 2010 even though their Lync accounts are disabled

I have 2 users who are still able to sign into Lync 2010 even though I disabled their Lync accounts. They no longer show up in the Lync console or when you use get-csuser. Their Lync account were associated somehow with their AD accounts in an old domain
that we just decommissioned. I wanted to delete Lync accounts and recreate to see if that fixed their issue. After deleting the Lync account, they are still able to login. So, I guess I need to edit the Lync database to get rid of them and start fresh?.
HDL

Hi Winterthur,
Agree with Tek-Nerd,
this user certificate is valid for a period of 180 days, and is automatically renewed one month prior to expiration regardless of whether the user is connected internally or externally.
Jeff Guillet’s article Disabling a User in AD Does Not Disable the User in Lync provides
a good background about revoking this certificate and properly disabling the user from accessing Lync services when their Active Directory user account is disabled.
For more details,
http://blogs.technet.com/b/nexthop/archive/2012/11/28/lync-2010-client-authentication.aspx
Best regards,
Eric

Can't Login With Network Account After Upgrade To Yosemite Server 4

I've been putting off this troubleshooting for a while now, and after trying everything I could find, decided to post.
- After upgrading my server to Yosemite with Server 4, and my MacBook to Yosemite, I can no longer login with any network accounts.
- I was on clean installs of Mavericks before the upgrade.
- I'm using SSL for the OD, with a GoDaddy cert, the same one that was working on Mavericks.
- I've tried removing the laptop's binding using the Users and Groups preferences dialog, which does not remove the laptop's entry from Open Directory, so I manually deleted the record on the server.
- I then choose to Join again, and it looks as though everything goes through, but I still cannot login with a network account. Also, when rejoining, it does not create a binding on the server.
- If I use the Directory Utility->Services->LDAPv3, and add it that way, entering the FQDN and checking Encrypt..., Use for auth and Use for contacts, it asks me for the directory admin username and password, and does in fact create the binding on the server, but I still cannot login. What's strange about that method, is that it forces the use of the IP address of the server, rather than the FQDN, like I entered it, which would of course have problems, because the certificate's common name is the server's FQDN. It does not allow me to change from using the IP address, graying out that field.
- I've also tried destroying the OD and restoring from archive to no avail.
It looks like many users have hit dead ends with this, with some having success by completely formatting and setting up a new iteration of the server, but I will not be doing that. However, I'll be happy to try any other suggestions.
Thanks for your time,
   -- Mike

     Okay, I've finally resolved the issue, thanks to the Apple Enterprise tech support team. I'm thinking they wouldn't mind if I share this information, but I can't guarantee that this will work on your system or, worse yet, degrade your system further. However, that's fairly unlikely, just make sure you have plenty of backups before you begin any troubleshooting session.
     So I was told to perform the following instructions, which I did, line for line. The part about closing Server.app seems a given, but I'm not sure why they want you to open Server.app at the the end (maybe taken out of context from some other instructions?). I did it anyway, but you should be able to begin testing, on a client workstation, right after rekerberizing is complete. I did, however, need to reboot my client, login as local admin, and then binding would proceed, and network users are able to login again. The engineer also let me know to expect an error, something like the following: "2015-03-11 21:58:38 +0000 Error synchronizing removal of attribute draft-krbPrincipalACL from record 72519e4c-7ac7-15e4-bd42-10adb1944cbc: 77013 result: 16 No such attribute" - this is apparently normal, and did in fact happen in my experience.
So here's the fix:
- Quit Server.app (don’t just close the window)
- On the Open Directory Server, execute these Terminal commands:
- sudo mkdir /var/db/openldap/migration/
- sudo touch /var/db/openldap/migration/.rekerberize
- sudo slapconfig -firstboot
- Open Server.app
And that's it. I did nothing else on my OD server, just logged out. Immediately tried binding on my MacBook client, it failed, I rebooted, tried again, it worked quickly, and I'm able to login with network user accounts again.

Can't login to local NON-admin accounts-Directory Access set to server

I have a strange problem on a set of laptops that I cannot resolve and am hoping someone can help me.
Here is the issue:
I have a set of building laptops (PowerPC, OSX.4.11) that seemingly will not "search locally" in the authentication process. The logins seem to work fine for NETWORK logins to our Open Directory Master xserve, but these machines will not login to any LOCAL non-admin accounts. The local root and local admin account logins do, however, work fine. ?? The remainder of the building computers (Intel iMacs OSX.4.11) appear to have the exact same settings and login fine both locally and via the network home directories.
I have tried the following:
Deleted DirectoryService preferences folder (MacintoshHD-->Library-->Preferences->DirectoryService)
Deleted the mcx cache in Directory Access
Tried adding a new non-admin user to test (still will not login)
Removed and re-created LDAP configuration (all set to custom)
Tried setting the LDAP to the automatic settings ("Add DHCP-supplied LDAP servers to automatic search policies")
Disabled all network connectivity (turned off Airport and disconnected the ethernet cable), still cannot login to local accounts
Tried to bind in LDAP configuration (when I did bind the machine, it would no longer authenticate to the network authentication server, so I did an "unbind" and restarted and it went back to performing the network logins, but still will not login to local non-admin accounts).
Reset passwords in System Prefs and also re-typed them in NetInfo Manager
Deleted login keychains
Deleted mcx.plist
Reinstalled the OS from disk and local logins worked TEMPORARILY--UNTIL I set the LDAP directory access to authenticate to our server (which I also need for the network logins to work),then, the issue started again.
*Same results with both ethernet and wireless connectivity enabled.
*Note: I also manage these local accounts via WGM (installed on the local machine) and even tried disabling that and still no luck.
Please help...I have spent hours and hours trying to find a solution and nothing seems to work! What am I missing??

Mostly just a bump...
How about that .local extension, or trailing / ?

Not able to login from microsoft account's generat...

I had created a skype id using my hotmail account. The skype name automatically generated as live:***
I am able to login to skype on any device when I signin using Microsoft account and enter details of my hotmail account.
Problem: Why am I not able to login using the automatically generated skype name (live:***), on any device or browser. Whenever I try logging in using this skype name I get an error that please check your skype name and enter password and login again.
Please help!

Hi,
I presume you have implemented the solution provided in the KBA 1204539
Two things you might try:
- Use the IP address as CMS name. If that works, then you have a problem with your resolution. You need to check your client DNS settings and suffix.
- Make sure that there is communication between CMS server and client. If you use requestport parameter, you need to verify with your network admin that the range indicated is opened between server and client.
- Use the requestport parameter for Input FRS as well
You can check more details in the section "Working with Firewalls" (page 450) http://help.sap.com/businessobject/product_guides/boexir31SP3/en/xi31_sp3_bip_admin_en.pdf
I presume that your LiveOffice is working because you are connecting to QaaWs and your connection to the Web Application server is fine. The problem are the other ports.
Regards,
Julian

I am not able to login to the Management Server from the Management Server dialog from FlexBuilder

hi,
I am trying to setup the flex builder project for the demo host sample and am running into issues with the login. I have my OEM setup in https://<ip-address>:7801/em and am able to login with the credentials. Now, when I try to launch the HostSample.html from the flex builder project and the details are provided to my Management Server dialog, the same credentials fail with some IO Error. Please help
Error during operation: Logging in to Management Server
[FaultEvent fault=[RPC Fault faultString="HTTP request error" faultCode="Server.Error.Request" faultDetail="Error: [IOErrorEvent type="ioError" bubbles=false cancelable=false eventPhase=2 text="Error #2032"]. URL: https://10.105.219.188:7801/em/websvcs/mpws/LoginService"] messageId=null type="fault" bubbles=true cancelable=true eventPhase=2]
The LoginService.login is failing.
Here is the Item details
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<SOAP-ENV:Header>
    <ns0:TraceRequest xmlns:ns0="http://em.oracle.com/tracing/xsd">
      <ns0:ecid>15D0C25A-51F9-B29F-EC74-DDD780ACCCEE</ns0:ecid>
    </ns0:TraceRequest>
    <ns1:RslVersion xmlns:ns1="http://em.oracle.com/auth/xsd">
      <ns1:rslVersion>12.1.0.3.0</ns1:rslVersion>
    </ns1:RslVersion>
    <ns1:InternalToken xmlns:ns1="http://em.oracle.com/auth/xsd">
      <ns1:intToken>secret-token</ns1:intToken>
    </ns1:InternalToken>
</SOAP-ENV:Header>
<SOAP-ENV:Body>
    <tns:loginRequest xmlns:tns="oracle.sysman.emx.LoginService">
      <loginInfo>
        <username>sysman</username>
        <password><my password text in plain text format></password>
        <role xsi:nil="true"/>
      </loginInfo>
    </tns:loginRequest>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>

When running with HTTPS, FlexBuilder enforces security restrictions on same domain policy and verifies security certificate. To workaround this you either have to disable security on your OMS and use HTTP for your development (using emctl secure unlock), or you have to install the security certificate from your OMS in the IE browser you are launching from FlexBuilder.
To install the certificate in Firefox: go to the EM website using Firefox, and you will see "The Connection is Untrusted", expand "I Understand the Risks" and click "Add Exception". On the dialog that appears leave all the defaults and click "Confirm Security Exception". At that point if you close/reopen the browser you can go back to the EM website and you should see no security exception.
To install the certificate in IE: go to the EM website using IE and you should see "There is a problem with this website's security certificate", click "Continue to this Website (not recommended)", the address bar will then change to show "Certificate error" on the right side of the URL. Click that icon and the "View certificates" on the "Untrusted Certificate" popup. On the dialog that appears, click the "Certification Path" tab, then click the root node (root certificate) in the path and click "View Certificate". In the new dialog that appears, click "Install Certificate...". Then click "Next>", click "Place all certificates in the following store", click "Browse..."., select "Trusted Root Certification Authorities" and click "OK". Then click "Next>" and click "Finish". On the "Security Warning" dialog, click "Yes" to install the certificate and then "OK on the confirmation dialog. Click "OK" on the "Certificate" dialog (there should be two) that was launched to install the root certificate. Now on the original "Certificate" dialog click "View Certificate". Then click "Next>", click "Place all certificates in the following store", click "Browse..."., select "Trusted Root Certification Authorities" and click "OK". Then click "Next>" and click "Finish" and then "OK on the confirmation dialog. Click "OK" and "OK". At that point if you close/reopen the browser you can go back to the EM website and you should see no security exception.

I am not able to login to Gmail past 2 weeks, before that I am, But still i can able to login gmail from chrome but not from Firefox

I am not able to login to Gmail past 2 weeks, before that I am, But still i can able to login gmail from chrome but not from Firefox
getting following error
"Oops! Your browser seems to have cookies disabled. Make sure cookies are enabled or try opening a new browser window. [?] "
Please help me

The support article http://mzl.la/1BAQKUb might help you.

Two listners are running in our SRM server, we are not able to login.

Dear all,
In our SRM server two listeners are running as we are not able to login to the server, suddnely we got two listners ,please suggest , what could be the reason.
Regards
Ratnakar G.

Hi,
If you have only ONE listener, you can either STOP all running listener or KILL using their PID's.
After that you can start correct listener again.
You can also start the correct listner using below command, so if there is other listener it will not run in startup.
# su - ora<SID>
# lsnrctl start <LISTENER_NAME>
If this is Windows system, you can see if there are 2 listener services... If you found 2 services, disable incorrect one...
Regards.
Rajesh Narkhede

Is Windows 2003 member servers still able to authenticate against Windows Server 2012 R2 AD after mirgation?

Hi,
We are planning to migrate Windows Server 2008 R2 AD to Windows Server 2012 R2 AD. But we have some Windows 2003 member servers (Running RADIUS for VPN user to authenticate their AD accounts). Does anyone know that existing Windows 2003 member
servers still able to authenticate on Windows Server 2012 R2 AD after migration and function properly? Just wanted to make sure Windows Server 2012 AD support Windows 2003 member server.
Thanks.
M

Hi,
Thanks for your post.
Is there any Windows server 2003 domain controller in your domian?
If yes, i think you could refer to this article:
http://blogs.technet.com/b/askds/archive/2014/07/23/it-turns-out-that-weird-things-can-happen-when-you-mix-windows-server-2003-and-windows-server-2012-r2-domain-controllers.aspx
Regards.
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

HT204268; I have purchases on an aol login pre 2008 and all recent stuff under an apple id. I currently see and use everything when i login with the apple id. After March 31st will my apple id account still show and contain all?

HT204268; I have purchases on an aol login pre 2008 and all recent stuff under an apple id. I currently see and use everything when i login with the apple id. After March 31st will my apple id account still show and contain all?
I understand the instructions to create a new account id (apple id) from the old aol account. However, does this mean my purchases will be split into 2 accounts; or does the fact that I currently see everything under my apple id (regardless of the purchased by username) mean this will all still appear in my current account as it does now?

You see them where when you login your non-AOL account ?
If you currently have two accounts (the AOL username account and an email address account) then you will continue to have two accounts, and nothing should change when you update the AOL account to be an email address (apart from how you access that account).
You will just be renaming the account to have an email address for accessing it, not creating a new account.

I recently updated my primary email address associated with my Apple ID account. When I go to App store on my iPad it still tries to login to the App store using the old email address I had associated with the account, and naturally my password doesn

I recently updated my primary email address associated with my Apple ID account.
Now when I go to App store on my iPad it still tries to login to the App store using the old email address I had associated with the account, and naturally my password doesn't work. I can't figure out how to tell my iPad to login using the updated email address.
So in effect I'm locked out of the app store and I currently have 26 updates waiting.
I've tried disconnecting and reconnecting my IPad to iCloud with no luck.. However I cloud happens to show the correct/updated email address.
Does anyone know how to resolve this?
Thanks

Did you change the email for the Apple ID or did you create a new Apple ID? A new Apple ID cannot be used with content that was bought using a different Apple ID.
Changing the email address you use for your Apple ID -
http://support.apple.com/kb/HT5621

HT204053 The one alias I've had for over 5 years has not fully migrated over to iCloud. My account now shows 3of3 aliases available but I'm still able to receive messages addressed to my old alias. I can no longer send emails using this alias. Help!

For years I have been using [email protected] for business.
It is on my business cards, stationary and most of my closest correspondences are maintained off of that email.
The documentation I've read indicates aliases should be transferred over as part of this iCloud migration but this does not seem to be the case. My account now shows 3of3 aliases available but I'm still able to receive messages addressed to the alias. I can no longer send emails from this alias.
How do I get this corrected?
Ali,
[email protected]
A.K.A
[email protected]

Workable solution found here:
https://discussions.apple.com/thread/1589996?start=15&tstart=0

I am unable to access my iCloud e mail account and am still able to access AOL account though. It says something about an IMAP pathway and a port number how do I find this?

I am unable to access my iCloud e mail account and am still able to access AOL account though. It says something about an IMAP pathway and a port number how do I find this?

If the old ID is yours, and if your current ID was created by editing the details of this old ID (rather than being an entirely new ID), go to https://appleid.apple.com, click Manage my Apple ID and sign in with your current iCloud ID. Click edit next to the primary email account, change it back to your old email address and save the change. Then edit the name of the account to change it back to your old email address. You can now use your current password to turn off Find My iDevice, even though it prompts you for the password for your old account ID. Then save any photo stream photos that you wish to keep to your camera roll. When finished go to Settings>iCloud, tap Delete Account and choose Delete from My iDevice when prompted (your iCloud data will still be in iCloud). Next, go back to https://appleid.apple.com and change your primary email address and iCloud ID name back to the way it was. Now you can go to Settings>iCloud and sign in with your current iCloud ID and password.

My login option turned to disabled ,according to the tips ,i've changed my passwords many times, but i still can't login my itunes store ,who can help me to solve the problem?

My login option turned to disabled ，according to the tips ,i've changed my passwords many times, but i still can't login my itunes store ,who can help me to solve the problem?

Try here > Can't connect to the iTunes Store
Try disabling anti virus software and turning off the Firewall.

Disabled Account Still Able to Login (Server 4.0)

Similar Messages

Maybe you are looking for