Issue with AD users restricted to certain machines.

Hi all,
So, we seem to have a bit of an issue with user accounts that are restricted to logging in to certain machines only. While the user is permitted to log in to the machine (Windows lets them), our ISE server denies the login and the trace looks like this:
24430 Authenticating user against Active Directory
24441 Account not permitted to log on using the current workstation
22057 The advanced option that is configured for a failed authentication request is used
22061 The 'Reject' advanced option is configured in case of a failed authentication request
11823 EAP-MSCHAP authentication attempt failed
12305 Prepared EAP-Request with another PEAP challenge
11006 Returned RADIUS Access-Challenge
5411 No response received during 120 seconds on last EAP message sent to the client
Has anyone seen this?
Version 1.1.1.268.
Thanks!
-Ryan

Well, as soon as I posted this, the idea hit me.
We added the two ISE servers' machine accounts in AD to the machines that this user is permitted to log in to, and it works like a charm now. Apparently when a user logs in, ISE passes through a generic machine name (of itself) to AD, and it wasn't matching the list of allowed machines.

Similar Messages

Issue with "unknown user type 6" on Coherence 3.5.2

Having an issue with a cluster which is running using an internally developed cluster starter tool. This tool, and the associated cluster, all use POF, and upon attempting to connect a non-storing member to the cluster from java, the following exception is raised...
2011-07-11 15:54:58.338/2.469 Oracle Coherence GE 3.5.2/463p2 <Error> (thread=Cluster, member=n/a): This cluster node is
configured to use serializer com.tangosol.io.pof.ConfigurablePofContext {location=application-pof-config.xml}, which ap
pears to be different from the serializer used by Member(Id=1, Timestamp=2011-07-11 15:34:30.779, Address=10.74.82.193:8
088, MachineId=11188, Location=site:INTRANET.BARCAPINT.COM,machine:ldnpsm020006423,process:80976,member:ldnpsm020006423:
cacheserver:1).
java.io.StreamCorruptedException: unknown user type: 6
at com.tangosol.io.pof.PofBufferReader.readAsObject(PofBufferReader.java:3289)
at com.tangosol.io.pof.PofBufferReader.readObject(PofBufferReader.java:2600)
at com.tangosol.io.pof.ConfigurablePofContext.deserialize(ConfigurablePofContext.java:348)
at com.tangosol.coherence.component.util.daemon.queueProcessor.Service.readObject(Service.CDB:4)
at com.tangosol.coherence.component.util.daemon.queueProcessor.service.Grid$ServiceConfigMap.readObject(Grid.CDB
:1)
at com.tangosol.coherence.component.util.daemon.queueProcessor.service.Grid$MemberConfigResponse.read(Grid.CDB:1
3)
at com.tangosol.coherence.component.util.daemon.queueProcessor.service.Grid.onNotify(Grid.CDB:123)
at com.tangosol.coherence.component.util.daemon.queueProcessor.service.grid.ClusterService.onNotify(ClusterServi
ce.CDB:3)
at com.tangosol.coherence.component.util.Daemon.run(Daemon.CDB:42)
at java.lang.Thread.run(Thread.java:619)
There is no serialiser configured in the cache config, instead we just set tangosol.pof.enabled=true, and set the pof config file to what is seen above. The thing which is very confusing about this error is that unlike other clients which we connect, and in fact the servers they connect to, this client never attempts to load the cache configuration file. The point at which this should happen, prior to pof loading, shows:
2011-07-11 15:54:57.260/1.391 Oracle Coherence GE 3.5.2/463p2 <Info> (thread=Main Thread, member=n/a): Loaded cache conf
iguration from "jar:file:/C:/Program%20Files/Oracle/coherence/3.5.2b463P2/lib/coherence.jar!/reports/report-group.xml"
I have tried every combination of classpath entries I can think of, and no matter what, it never shows an attempt to load the application-cache-config.xml supplied in the startup. Does anyone have any experience with something like this?

I guess your non-storing JAVA code does not specify -Dtangosol.pof.enabled=true and the -Dtangosol.pof.config =<POF file location> on joining the cluster. Post the startup java command and the complete logs.
If application-cache-config is not loaded then coherence-cache-config.xml should be loaded by default and set -Dtangosol.coherence.cacheconfig=<application-cache-config>
Cheers,
NJ

Sharing a folder with other users on the same machine (SOLVED)

Hi,
Recently, I've been sharing my computer with my dad. I don't want him to use my account, since I have a lot of secret files and bookmarks on my profile. However, I would like to share all my music with him. What I did was to set the permission of my Music directory to 777 and using root create a symbolic link from my own account to his account. But then when I log into his account, it says the folder is corrupt.
Then I created a symbolic link from my music directory to /media/ and set the permission to 777. Again I tried to see if I can access it from my dad's account and got the same error.
What's the best way of creating common folders between users in a linux machine?
Note that, since I use Amarok, I don't want to move my Music to somewhere else, because it will mess up with the database info of songs.
EDIT: I solved the problem by using mount instead of symbolic links.
You have to issue the following command:
mount --bind /home/name/music /media/music/
Of course you have to execute this command whenever you boot the computer. Just place this command in rc.local and you're good.
Thanks
Last edited by mohtasham1983 (2009-11-05 22:06:03)

grey wrote:If I wanted to share it between different users, I wouldn't put it inside one particular users home directory. Just use a reasonable place that is not used by the system, like /usr/local/data, /var/shared or so, give it the desired permissions and that's it.
you are absolutely right and i recommend this as well.
grey wrote:The link will probably not work, because in order to read /home/yourname/music, you need to be able to read /home/yourname. That is even true if root created the link.
that is true for symbolic links, not bind mounts. a bind mounted dir doesn't care about the parent directories because your not traversing to it through a link, it's just 'there'. this is how i put folders under my ~ out on my http server.

Logitech Keyboard Issues with Fast User Switching

I'm running OSX 10.4 on an 800 MHz iMac, and using a Logitech Cordless Navigator keyboard. The keyboard's main feature (for me) is the ability to have the function keys (F1-F12) automatically open applications and folders and such. When I have multiple accounts running though, this feature seems to be tied to whichever one I first logged into. If I switch accounts and try to use one of the keyboard shortcuts nothing happens where I am, but when I switch back to the original account I find that the keyboard has opened the program there. The keyboard types fine in the new account, and I can even change the preferences so the function keys do different things in the different accounts, but the extra functionality seems to be only available for whichever account logs in first.
I realize this may just be a Logitech bug, but any ideas how to fix this? (Also even though I'm the only one using my computer this seems like a mild security issue, if theoretically another user could activate programs on my account without the password.)
800 MHz iMac G4 Mac OS X (10.4.3) 768 MB RAM

Logitech support is frustrating:
Dear tajmahall14,
Thank you for your recent inquiry about your Keyboards.
I understand you are having issues with the settings for the function keys becoming non-functional when fast switching from one user account to another.
Depending on the system configuration, the Fast User Switching may or may not work. Unfortunately this is not an issue I can address. You may need to contact Apple to see if they have a possible solution to your problem.

Firefox issues with multiple users on a single computer.

I have an issue with Firefox and multiple users on my computer. There are two users setup and I'm running Win7 Ultimate x64. When the other user logs in, my settings in Firefox get screwed up somehow. Even if that user does not open Firefox.
Examples of problems this causes:
Gmail - Cannot load the standard interface, however it will load the HTML only interface.
Facebook - Cannot post anything.
vBulletin Forums - Some forums will no longer normally load - a text-only version loads as if I was browsing from a mobile device.
There may be other issues, but these are the main ones. If I clear my cookies, cache and browsing and download history, then restart Firefox, everything works again.
This seems to happen most often when the other user logs in, and uses Firefox to log on to their Gmail account.
How can I fix this?

Create a new profile as a test to check if your current profile is causing the problems.<br />
See [[Basic Troubleshooting#Make_a_new_profile|Basic Troubleshooting: Make a new profile]]
There may be extensions and plugins installed by default in a new profile, so check that in "Tools > Add-ons > Extensions & Plugins"
If that new profile works then you can transfer some files from the old profile to that new profile (be careful not to copy corrupted files)
See http://kb.mozillazine.org/Transferring_data_to_a_new_profile_-_Firefox

Sharing iMove Projects Libraries with different users on the same machine

I was wonder how two different users on the same machine can
share project libraries. Some Context:
My daughter has some finished projects in her project library and
I either want to import those project into my library or share them
so both user accounts can access the projects (similar to how the
event library is accessible)
Note: I've already moving the project library to a shared disk (the one
the event library is on) with no luck
Using iMove 09
tia...

You need to move each project to the external drive from within iMovie. Be sure to use command-drag so you move, not copy.

Is Lightroom supported in a Active Directory domain environment with multiple users logging into a machine?

We are a school district using an Active Directory environment. We currently use other Adobe products with multiple users on different machines and it works fine. If Lightroom does work in a domain environment what are the required local user permissions needed for it tor work properly? Thanks!

Lightroom is not a multiuser program. It is required that the catalog is located on a hard drive that is local to the machine accessing it. There are no workarounds.

Email issues with PC users

I am a web project manager and email daily with both PC & Apple users. I use Apple Mail as my default program. I have had countless issues with the formatting of my email appearing differently to PC users on Outlook when sending or forwarding Rich Text emails. I try to stick with plain text but sometimes Rich Text is required.
My current issue is orphan "B" characters are appearing through out the body of my email text when sending or forwarding Rich Text emails to PC users. This is NOT visible at all in my Apple mail program. This does not occur in plain text. I recently switched to sending in UTF-8 format - could this be the issue and if so what is the best solution.
I am interested in feedback on the best way to efficiently communicate with PC users using mail and what the appropriate configurations to do so would be. I really don't want to have to switch from Apple mail to use another program but when dealing with co-workers and clients who are not tolerant of these errors I must find a solution.
Thanks in advance to anyone that can help!
Powerbook G4 (1.67 GHz PowerPC) Mac OS X (10.4.8)

current issue is orphan "B" characters are appearing
through out the body of my email text when sending
or forwarding Rich Text emails to PC users. This is
NOT visible at all in my Apple mail program. This
does not occur in plain text. I recently switched to
sending in UTF-8 format - could this be the issue
and if so what is the best solution.
See this note and see if Fix C helps:
http://homepage.mac.com/thgewecke/woutlook.html

Issue with create user and issue with Java Development tab

I have two issues with EP,
1. When i login with Super Admin user, i am unable to Create any user from User Admin tab. Do i have to change the settings of the Super Admin? or is there any criteria for creating the user?
2. How to assign any user the Java Development tab. Though i login with a super admin user i am unable to see the Java Development role and when tried to assign the role, there were no searches for that Java....

Hi Adi,
by default the super administrater has got all permissions. Thus you should be able to create portal users when using a user assigned to the portal group Administrators.
In order to help you with your first question we need more information. Please describe the malfunction in detail. Have a look into the log files and post related error messages.
Regarding your second question: You will find the java development role in PCD
pcd:portal_content/com.sap.pct/platform_add_ons/com.sap.pct.pdk/Roles/com.sap.pct.pdk.JavaDeveloper.
If not, then you haven't installed the PDK business package in your portal.
Go to service.sap.com, choose downloads and search the package (PDK should do it). Download the package, and deploy on your portal using SDM.
Best regards,
Martin

SSAS issue with Domain user account

Hi
I have SSAS 2008 R2 set up running on Windows Server 2012 Standard.
The server is registered as a part of domain.
I have had an issue of domain user accounts accessing to a cube and it's starting to get worse. There has been no problem with a local user account (I set up a few for testing purpose).
I ran the role report from BIDS Helper and it finds all the domain user accounts invalid.
It looks like SSAS is not talking well with the domain server (Windows 2003 server standard) to verify user credentials. But the thing is that everyone is ok with the domain server except for SSAS. IT does not have a clue what's going on here and everything
is just pointing at me right now.
I'd like to know if there is anyway to monitor that communication between SSAS and domain server for user credential verification and any guideline on how to resolve it. Most of time, it just works again.. like 10 minitues later.. it resolves by itself.
But this time, not!!!
All I know is that 1. Registering the server as a part of domain 2. use domain user account to set the security.
MY IT department has set up network monitoring tool and says that they are 100% percent working (No connection loss. It's monitoring Active directory as well). The application installed is 'ManageEngine Applications Manager'
I don't know what to do here.
P.S Will it be related something like 'Error
while Add user to SSAS Server - The trust relationship between the primary domain and the trusted domain failed' but it's all the domain accounts including mine are not working.
Cheers!!!

First check your DNS servers setting on the server you have SSAS installed. You should only use the IP addresses of the DNS servers (e.g. Domain Controllers) of your domain. Active Directory relies on proper DNS server settings. Adding public DNS servers,
even if they are on the bottom of the list, will mess up name resolving Active Directory names. This should have been done when IT had provisioned the server. Same goes for own workstation if you run your development/management software not on the server.
Second make sure SSAS is running under a service account that has access to Active Directory. This can be either a domain account, the local system account, or the network service account. Running SSAS under a local account or the local service account will
not work because local accounts do not have access to Active Directory. Running SSAS under either a Managed Service Account or a Virtual Account will not work because those features require the domain at least the Windows Server 2008 R2 functional
level.
Third make sure the account you use to log on to SSAS is a domain account and has appropriate permissions in SQL Server and SSAS. Local accounts and SQL Server account do not have access to Active Directory

Finder Wants Permission Every time File is moved on Server (issue with multiple users)

The Situation: I have a team of seven coworkers that uses a file structure on a server to move job folders from the 'active jobs' folder to "coworker x's" folder and then to a "waiting" folder once the job has been completed. Pretty much just moving folders into different folders. Seems pretty simple.
The Problem: At times, some folders will not move from one folder to another, and a message pops up asking "Finder wants to make changes. Type your password to allow this" and then it shows my computer's name and asks for a password. Now if typing in the password meant that the file would be moved, I would be fine with it, but when I type in my password in and accepts it, it does nothing! Like I said, there are seven of us that are using this system, and everyone has the same issue with the same folders, it is not like one person can move it and another cannot. To make it even harder to define where the issue is coming from: if you go back after a few minutes / hours, the folder will randomly be able to move with no issue. If you take the files out of the folder, you can move them, and when you move the now empty folder, it will gladly move into any folder, but when the files remain in the folder it asks for the password. And in some cases, folders that were just made and are empty have the same issue, which leads me to believe that this issue is not a result of the contents of the folder, but something else.
It is seemingly impossible to nail down the cause of our dilemma so I have come here in hopes of a great break through. The worst part is is that we are not doing anything that difficult, we are simply moving folders around. This is a windows based server, that might be important. Also, some of us are running Mavericks and others are still on Snow Leopard. Thank you for any information you might have! ( I have already tried the boot in recovery, resetpassword trick with no luck >_< )

If we're going to fix this, we will have to concentrate on one person to start with. Can that be you?
Some more information is required, only from you, your Mac and your windows user account on the server:
On the Windows server, are the 3 folders in question within the one shared folder?
What is the name of the Volume (share) that appears in Finder?
Are any of the folders being copied or moved to the local drive of the Mac?
On the windows server, what are the permissions that you have to:
The top-level shared folder
The 3 folders underneath the top-level shared folder
Do a Get Info of the Volume (share) in Finder and do a screen shot of both the area above Preview and the area below Preview (Preview itself is not required. Make sure all right-pointing arrows are expanded to down-pointing arrows so all info in each section can be seen.
(Did this discussion get re-assigned to the OS X Server Community? I've never been there, and I thought I found it in the OS X Mavericks community.) Are you actually running OS X Server on the Macs?
Message was edited by: SilverSkyRat: Additional Question

CS2 Problems with multiple user accounts on 1 machine

I have been having this problem since I first installed CS2 in my Mac lab. I have 8 G5's and I have loaded the exact same software (all licensed of course) on all 8 machines, in the same order. The problem occurs when trying to use CS2 in a second user account on the machines.
All software works fine for the original admin account. Then when I try to open and use in a second account I get crashes and errors, nothing consistent. AND some computers work just fine. HUH? I have called Apple and they suggested repairing permissions, that doesn't work.
I have tried uninstall and reinstall. I have tried making the second user an admin user. I have tried 2nd and 3rd users. I have tried a total system reinstall. I have tried changing the order in which I install. I have tried installing both before and after creation of the second account.
It doesn't seem to matter. On some machines it works, on others it doesn't. The only account the software will work in is the original user account.
The reason this matters is it is a student lab. I have implemented a server and students can't use the software through their server accounts either. Currently the server is a 40lb paperweight until this problem is fixed.
Any clue?
Thanks for any help you can give me.
Amy O.

This has to do with permissions in the non admin accounts. A solution was posted a while back you could do a search or somebody will pop in with the solution soon.

Issue with superadmin user (sap*) in portal

Hi,
I have issue with my superadmin user (SAP*) in portal system.
When I activated superadmin user (sap) from configtool and tried to login to the system with sap it is not letting me to enter into portal instead it is asking whether I am new user and also giving me link for "register user".
Please suggest.
Regards,
Chandra.

Hi Chandra,
I hope you performed all steps as discussed in the below link. Please cross check.
http://help.sap.com/saphelp_nw70/helpdata/en/3a/4a0640d7b28f5ce10000000a155106/content.htm
Thanks,
Siva Kumar

Business Contact Manager issue with New Users

I have an issue with a client when setting up Business Contact Manager for Outlook 2013. The client recently got a new employee and the employee was setup on an existing workstation that has BCM installed. When I launched Outlook 2013, and configured Oultook for
the new user, BCM started and needed to be configured. I went through the procedure for connecting to a 'Remote Database' on the server, typed in the server name as requested, and clicked Continue. BCM searched for the database but could not find it. The existing
user account on the workstation works just fine with BCM, and sees the remote database.
My next step was to remove BCM and re-install. This is the latest version/release of BCM for Outlook 2013. The existing user account was able to configure BCM with no issues, and found the remote database without an issue. The new user account had the same
issue as before and would not find the remote database.
I logged onto the same workstation as the administrator account we use to perform Admin tasks. I launched Outlook, configured Outlook 2013, and was able to successfully configure BCM and connect to the remote database with no issues.
I then created another New User on the server called Testaccount (TAccount), and logged onto the same workstation again, as this new user, and went through the same Outlook 2013 configuration and BCM setup. BCM has the same issue with this new user, and
cannot locate the remote database. From what I can determine, this looks to be something related to New Users that are created on the server and BCM not locating the remote database. Existing users do not have this issue when configuring BCM and connecting
to the remote database.
Has anyone had this issue or seen this issue and knows of a fix to correct this so my client can use BCM with the new user account, and any future new users they hire?
Thank you in advance for any assistance on this matter.

If you want to sync subfolders then you will need third party software. (Like Pocket Mirror)
Post relates to: None

Issues with Remote Users, VPN Connections, etc.

Hi there,
A few weeks ago I was asked to enable EWS and Outlook Anywhere which had not been previously enabled. I did so, but this seemed to cause issues (they may not have been implemented correctly) for users in remote offices; they would be prompted
for credentials to log into Outlook 2010, but no issues with OWA. I disabled Outlook Anywhere as it turned out we didn't need it, and this has caused VPN users to now not be able to open Outlook.
At this point I'm not sure what the issue is. I've tried implementing a few fixes from Googling around but haven't been able to determine the root cause and actually caused more issues this morning, where many local users were being prompted for credentials,
which was alleviated by creating new mail profiles for them.
We're using Exchange 2010 and Outlook 2010, with OWA being served by Forefront TMG.
I've seen in some other cases where results of the following queries were asked for, so here they are:
Get-OutlookProvider | fl
RunspaceId : a71467aa-c7ca-4a71-a349-41c860cb6db9
CertPrincipalName :
Server :
TTL : 1
OutlookProviderFlags : None
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
Name : EXCH
DistinguishedName : CN=EXCH,CN=Outlook,CN=AutoDiscover,CN=Client Access,CN=Business Name,CN=Microsoft Exchan
ge,CN=Services,CN=Configuration,DC=domain,DC=com
Identity : EXCH
Guid : 0e397d7f-fecc-451f-8774-3b4225cce8c9
ObjectCategory : sunrype.com/Configuration/Schema/ms-Exch-Auto-Discover-Config
ObjectClass : {top, msExchAutoDiscoverConfig}
WhenChanged : 10/10/2013 2:56:34 PM
WhenCreated : 9/28/2011 2:42:58 PM
WhenChangedUTC : 10/10/2013 9:56:34 PM
WhenCreatedUTC : 9/28/2011 9:42:58 PM
OrganizationId :
OriginatingServer : server.domain.com
IsValid : True
RunspaceId : a71467aa-c7ca-4a71-a349-41c860cb6db9
CertPrincipalName : msstd:*.domain.com
Server :
TTL : 1
OutlookProviderFlags : None
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
Name : EXPR
DistinguishedName : CN=EXPR,CN=Outlook,CN=AutoDiscover,CN=Client Access,CN=Business Name,CN=Microsoft Exchan
ge,CN=Services,CN=Configuration,DC=domain,DC=com
Identity : EXPR
Guid : 3bed6181-e70e-4c93-ac2d-bc57605cbeae
ObjectCategory : domain.com/Configuration/Schema/ms-Exch-Auto-Discover-Config
ObjectClass : {top, msExchAutoDiscoverConfig}
WhenChanged : 8/20/2014 9:32:10 PM
WhenCreated : 8/20/2014 3:21:11 PM
WhenChangedUTC : 8/21/2014 4:32:10 AM
WhenCreatedUTC : 8/20/2014 10:21:11 PM
OrganizationId :
OriginatingServer : server.domain.com
IsValid : True
RunspaceId : a71467aa-c7ca-4a71-a349-41c860cb6db9
CertPrincipalName :
Server :
TTL : 1
OutlookProviderFlags : None
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
Name : WEB
DistinguishedName : CN=WEB,CN=Outlook,CN=AutoDiscover,CN=Client Access,CN=Business Name,CN=Microsoft Exchang
e,CN=Services,CN=Configuration,DC=domain,DC=com
Identity : WEB
Guid : 659f40b8-815e-43ac-95ed-49bed9766ebc
ObjectCategory : domain.com/Configuration/Schema/ms-Exch-Auto-Discover-Config
ObjectClass : {top, msExchAutoDiscoverConfig}
WhenChanged : 10/10/2013 2:56:34 PM
WhenCreated : 9/28/2011 2:42:58 PM
WhenChangedUTC : 10/10/2013 9:56:34 PM
WhenCreatedUTC : 9/28/2011 9:42:58 PM
OrganizationId :
OriginatingServer : server.domain.com
IsValid : True
Get-OutlookAnywhere | fl
No output.
I've also run the Microsoft Connectivity Analyzer locally, which appears to fixate on Outlook Anywhere connectivity and fails because OA isn't enabled. Specifically it reports that "The EXPR Provider section is missing in the Autodiscover response.
RPC over HTTP may not be enabled."

Hi Steve,
According to the description, my understanding as below:
1. To make users use Outlook externally, you want to enable Outlook Anywhere. However cannot connect to Exchange server via Outlook, it prompts password again and again.
2. Because Outlook Anywhere doesn't work, so you disable it and enable VPN. But it doesn't work neither.
Please correct me if there is any misunderstanding.
Based on the result of running Microsoft Connectivity Analyzer, it means that the Outlook Anywhere is disabled. However it isn't an error.
I suggest enable Outlook Anywhere on Exchange server 2010 and configure Outlook Anywhere on Outlook.
Find an article related Configuration on Outlook for your reference:
Configure Outlook Anywhere in Outlook 2013
http://technet.microsoft.com/en-us/library/cc179036(v=office.15).aspx
Thanks
Mavis
Mavis Huang
TechNet Community Support

Issue with AD users restricted to certain machines.

Similar Messages

Maybe you are looking for