Local Users (belongs to domain) on ISE cannot derive Password from Windows Database

Dear Support Team
We are in the progress of Migrating ACS4.2 to ISE3355 running 1.1.4. We have SSL VPN Users & Wireless Users to be migrated.
ISE 1.1.4 is already integrated with AD Windows 2008 and can see all the groups defined on AD.
1: in ACS 4.x & even 5.x, we have option to add a user locally (users belonging to domain) , and we can configure user’s password to be derived from Windows Database. It helps to control AAA Policies.
It also helps to avoid configuring "users" in specific groups on AD and as a result no dependency on System Team to configure users in specific groups, which can be used in policy making on ISE.
However while doing the same, I could not find an option in ISE 1.1.4. Password cannot be derived from windows database. Password has to be set manually, that clearly means that i have to arrange the users in specific group on AD.
Is it a platform specific issue or am I missing something ?
Thanks in advance for your valuable time to look into this issue.
Ahad....

It seems that i have to open a TAC case to get cisco official explanation on this feature, it was a nice feature, which has been unnecessarily deprecated.
Any Inputs from anyone, who has similiar requirement, Please share it here.
Regards
Ahad

Similar Messages

Cannot Remove Password From Accdb Database

Access 2007
Windows 7 Ultimate x64
I created an accdb database and encrypted it with a password. Now I want to remove the password.
I opened the database exclusively and entered the password. The help instructions say:
2.On the Database Tools tab, in the Database Tools group, click Decrypt Database.
The Unset Database Password dialog box appears.
Unfortunate, the Database Tools group is displaying "Encrypt with Password" and clicking on that brings up the Set Database Password dialog box not the Unset Database Password dialog box.
Is this a known bug?
There is also an Encode/Decode Database in the Database Tools group but there does not appear to be anything in the help information about it.
Decode Database results in a not found response and Encode Database retunrs a link to Encrypt a database by using a database password which refers to the "Encrypt with Password" section of the documentation which refers to "Encrypt with Password" in the Databse
Tools group.
The only way it appears you can remove a password is to create a new unprotected database and import everything from the old one it. Unfortunately, that leaves behind things like the layout of the Relationships window, all property settings, etc.

Hi There,
Sorry for the late response.
I think I have a solution to your issue. I poretty much had the same condition when trying to remove a password. I logged on in EXCLUSIVE mode multiple time and each time I would see the ENCRYPT with Password instead of the "DECRYPT...."
I believe my password contained a few special characters that may have caused the problem with corruption because I also noticed that whenever I tried to COMPACT & REPAIR it would not accept my password that I logged on with. That's why I
figured there is either a bug or corruption.
In either case follow these steps and you should be able to resolve without re-building and importing/exporting objects:
=================================================
If you try changing the database password by
1. Open exclusive mode
2. Click info
3. If the Decruypt button appears then click and change the password.
If not try below
It is possible to remove the password as follows:
Again open Access database in EXCLUSIVE mode
Press Ctrl+G to activate the Immediate window in the Visual Basic Editor. (With MS Access )
Type or copy/paste the following line:
Code:
a) CurrentDb.NewPassword
"enter old password", ""
With the insertion point anywhere in the line, press <Enter.>
Examples
1. Remove the password assume the current password is : SnowFlake123
CurrentDb.NewPassword "SnowFlake123", ""
2. Change the password to SpringWater123” assume the current password is : SnowFlake123
CurrentDb.NewPassword "SnowFlake123", "SpringWater123"
================================================
This worked for me. I used option 1 and removed the password. Then compact and repaired.
Restarted without the password and then ENCRYPTED with PASSWORD. I used a password with upper, lower case and numbers. No special characters.
I tried to follow the steps to remove the passowrd and now my "DECRYPT...." shows up under file, info.

XID-- Change Local User SAPServiceXID to Domain\SAPServicesXID

Hi All.
We have to change local SAPServiceXID User to Domain\SAPServiceXID User
boths users are administrators into the Administrator Group.
If we start the three central instances(Database,Abap,JAVA) with local User there is no problem.
when we replace the local user to Domain\user and tries access to http://Host:50000/rep -->The page cannot be displayed, but in SAP Manage Console, the service green and from TCODE SMICM Java stack is green too.
any idea??
Thanks & Regards
RP.
Message was edited by:
Rodrigo Pertierra

i've found this error
com.sap.engine.services.rfcengine##com.sap.engine.services.rfcengine.RFCJCOServer.handleRequestInternal()####XID#SAPSYS                          #434CC9A85B334CA891E2E7F351D27B1A#Thread[JCO.ServerThread-2,10,SAPEngine_System_Thread[impl:5]_Group]##0#0#Error##Plain###com.sap.mw.jco.JCO$AbapException: (126) SLD_CLIENT_EXCEPTION: AbapSLDRequestHandler.ping(): server connection *** failed *** on Tue Jan 16 11:37:42 GMT-03:00 2007
     at com.sap.lcrabapapi.util.AbapSLDRequestHandler.raiseAbapException(AbapSLDRequestHandler.java:4203)
     at com.sap.lcrabapapi.util.AbapSLDRequestHandler.raiseAbapException(AbapSLDRequestHandler.java:4212)
     at com.sap.lcrabapapi.util.AbapSLDRequestHandler.execPing(AbapSLDRequestHandler.java:2960)
     at com.sap.lcrabapapi.util.AbapSLDRequestHandler.execute(AbapSLDRequestHandler.java:953)
     at com.sap.lcrabapapi.util.AbapSLDRequestHandler.processRequest(AbapSLDRequestHandler.java:264)
     at com.sap.lcrabapapi.ejb.AbapSLDRequestBean.processFunction(AbapSLDRequestBean.java:48)
     at com.sap.lcrabapapi.ejb.AbapSLDRequestObjectImpl0.processFunction(AbapSLDRequestObjectImpl0.java:259)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:324)
     at com.sap.engine.services.ejb.session.stateless_sp5.ObjectStubProxyImpl.invoke(ObjectStubProxyImpl.java:187)
     at $Proxy193.processFunction(Unknown Source)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:324)
     at com.sap.engine.services.rfcengine.RFCDefaultRequestHandler.handleRequest(RFCDefaultRequestHandler.java:100)
     at com.sap.engine.services.rfcengine.RFCJCOServer.handleRequestInternal(RFCJCOServer.java:113)
     at com.sap.engine.services.rfcengine.RFCJCOServer$ApplicationRunnable.run(RFCJCOServer.java:171)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(Native Method)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:100)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:170)
any idea what its means?

How to Move Local Users to Network Domain Users

Before you follow these instructions...... I'm a rank amateur so I'd check to see if the smart kids have corrected my errors or improved on the method in the replies below
The reason for the post is I have good and established local user accounts on all the computers and moving them to domain controlled accounts is the one topic I could not find a script to follow that worked for my low level of knowledge of OS X.
Let me first explain my setup and needs. I'm replacing a Windows Home Server (WHS) with the Mac Mini Server. My goal was to have the Mac Mini as the server holding all our photos, data, etc. and running a user account to run the family iTunes account to feed the Apple TV and be the backup / sync point for a family sized set of iPod Touches, iPads and iPhones. I want to be able to log into each mac and have the same information setting, links, etc........ basically walk around the house, find any mac shaped device not used by someone else, log in and carry on where I was before - with the MacBook Air having a portable account so it can come travelling with us.
The key hardware is...
Mac Mini Server running Snow Leopard 10.6.8
Apple TV
2 x iMac Running Lion 10.7.1 [upgraded from 10.6.8]
MacBook Air running Lion 10.7.1 [upgraded from 10.6.8]
Normal stuff like wifi, hubs and a router doing the DHCP (and for me reserving IP addresses based on the 'MAC Address' to save me having to manually configure all the IP addresses)
Key Resources I used as I learnt how to do this; to level set you all, I'm a relative newcomer to OS X having had a Windows life with Linux for fun, so i'm not a mac or IT specialist but like to play around.
Apple's podcast series 'Apple Quick Tour of Leopard Server' - this is great, it informed me and kept me motivated through all the bah moments, all 33 episodes and it's in the iTunes store as a podcast.
The book 'Mac OS X Snow Leopard Server For Dummies' - I bought this about half way through the whole process and wish i'd bought it earlier, my reccomendation would be get the Kindle version so you can search it for advice.
The excellent information on DNS from Hoffman Labs http://labs.hoffmanlabs.com/node/1436
The video 'Setting up a primary DNS zone.....' from Lynda.com on youtube http://www.youtube.com/watch?v=OOEgQY9oFK4
The Series of PDF document on Snow Leopard Server from Apple http://support.apple.com/manuals#mac%20os%20x%20server%20v10.6
And finally this excellent post from Joe Ferrante which was the core of what I used http://joeferrante.net/how-to-migrate-local-user-account-to-network-user-account -with-networked-home-folder-on-snow-leopard-server/
Right off we go....
Setting up the Server [this took me 6 goes to get it right as I learnt a little each time].
So i'm not going to go through this step by step because it in the 'dummies' book and the videos from Apple above and those will be better than anything I write but here's my details/advice.
I split the primary disc into 2 partitions using disk utility so I could reformat the operating system without moving my data.
100GB for the OS X system
400GB for user data
Install OS X from the DVD, press the buttons based on your desires but stop at the bit about naming you computer titled Network Names
READ UP ON DNS - this one of the reason I had so many goes as it was the 1st time i've set up a server like this using DNS and guessing didn't get me there.
If you don't have one buy a domain name for your network it make it much easier in the long run & is $10 well spent
The name needs to be [the computer name].[your domain name].[com or net or org, etc]
So if you want you computer to be called fred and you bought or have the domain location.com enter fred.location.com in the primary DNS name box
This shoud automatically put fred in the computer name box.
Follow along with the set up guide to finish
After you have finished the set up test the DNS with NSLOOKUP in a terminal window
nslookup fred.location.com in my example and you should get the IP
Add your servers IP address to the list of DNS servers in network preferences on the client mac.
Bind [link] the client computers to the server in Accounts on the client computer - I used the 'dummies' book for this but there's lots of data on the web.
Clean up the user profile on the client to reduce the size of the Home folder as much as possible or the data transfer is loooooooonnnnng - i also connect the iMac on a cable rather than wifi to speed it up.
Read Joe's post http://joeferrante.net/how-to-migrate-local-user-account-to-network-user-account -with-networked-home-folder-on-snow-leopard-server/ and follow along.useful info I learnt somewhere - to get the paths to the folders correct in the terminal window go to the folder in Finder and then drag it to the terminal window and let go - this will put the correct link in the instruction.
You now need to be on a terminal window on your server, with a finder window open and logged into the client as the user you are moving
THE CLIENT COMPUTER NEEDS TO BE LOGGED OUT or logged in as a different user than the one you're trying to move.
so when you're at the right point - type sudo cp -R then hit the space bar, drag the existing user folder onto the finder window, add the /* and hit space then find the users folder on the server and drag that onto the terminal window to complete the instruction.
Hit enter and wait a while assuming it starts ok - i used network traffic on the Activity Monitor utility to check if it was working.
If you got this far and it all worked - login to the profle you moved on any computer linked to the server or the server but not the original client computer to see if it worked and all your setting and data are intact and then delete the profile off the original client if it was ok [archiving the home directory took ages for me].
As you can probably guess most of this was good learning for me and it worked successfully for me in the end, moving all my history, saved password, etc, etc without any problems.
Hope this helps other in the same situation & feel free to expand or correct this if I've missed anything.
Ed

Hi,
I was unable to access the Joe Ferrante information (it appears to now requrie a password and was not able to determine how a username and password were assigned) Would you happen to have a copy of the post that you refer to above?
I am still at the early stages of this process but am hoping that the steps you refer to are going to get me where I want to be. Your stated end goal is where I hope to get to.
Thanks,
Sean

Windows 8.1 cannot change password in Windows 2003 domain level domain

On several installations of windows 8.1 enterprise, users cannot change passwords by using <ctrl> + <al> + <del> keys and choosing change password.
The error is: "The security database on the server does not have a computer account for this workstation trust relationship"
Fresh Windows 8.1 enterprise installs with no patches to fully patched windows 8.1 enterprise workstations have the problem. Backed out patches one by one and tested password change without success. Tried various dell laptops, tablets, and workstations
but same issue. Tried VMware guest workstation with windows 8.1 enterprise. The domain functional level is 2003 with a mixture of Windows 2008 R2 DC's and Windows 2003 DC's.
The add/remove from domain did not help. What troubleshooting steps should I take from this point? Is this related to secure channel failures? Note: did not find event log entries for the failures in the DC's nor on the workstation.
Perhaps I did not search for the proper entry on the DC's.

Hi,
Please find below several possible cause of error “The security database on the server does
not have a computer account for this workstation trust relationship”
Secure channel is broken (Can fix by rejoin problematic client to domain)
AD replication issue. The computer account exists on one domain controller but not others.
Duplicated SPN (seems not possible)
So, to narrow down the issue, you need to make sure the AD replication is working fine. Please run command
repadmin /showrepl * on a DC, then post the result here.
After that, please run
set l on a problematic client, then post the result here.
Moreover, please check on system event log and check if there have any related error of the issue.
Thanks.

Exchange 2010 user cannot change password from OWA

My users are not able to change their own email password from owa. But we can change the passwords from ECP or from the server without any issue. What could be the issue ?
Biju Rajan

Check the regional date and time is set for user OWA...Follow the below steps
On the Client Access Server (CAS), click Start > Run and type
regedit.exe and click OK.
Navigate to HKLM\SYSTEM\CurrentControlSet\Services\MSExchange OWA.
Right click the MSExchange OWA key and click New >
DWord (32-bit).
The DWORD value name is ChangeExpiredPasswordEnabled and set the value to
1.
Note: The values accepted are 1 (or any non-zero value) for "Enabled" or 0 or blank / not present for "Disabled"
After you configure this DWORD value, you must reset IIS. The recommended method to reset IIS is to use
IISReset /noforce from a command prompt.
Ref:http://blogs.technet.com/b/exchange/archive/2010/10/06/3411240.aspx
Exchange Queries

P6 Analytics - cannot load data from STAR database in BI EE

Hi.
We have successfully deployed OBI EE 11g and STAR database (RDB 3.1), ETL processes have also run succesfully. But we cannot access data from the Analytics in a very strange way: we can get information on EPS and WBS, but cannot get projects or activitites data. It doesn't show any errors, it just returns empty replies (including replies on SQL-queries in Administration->SQL). I have cleaned the cache (call SAPurgeAllCache()) and reloaded metadata. I've checked the STAR db - all the data is ok.

Check in P6 application that you have given access to P6 Analytics module to the application user. If not give that and rerun Global Schedule services followed by ETL process.
This appears to be related to security but I might be wrong.

Light weight AP cannot Get IP from windows DHCP server

Hi all :
We user WISM ver.5.0.148.2 , All AP is 1230 Series and Use Windows 2003 DHCP server.All AP cannot get IP after upgraded Lightweight from Autonomous IOS.
But I found the DHCP is work if i use my notebook connect the same switch port and my notebook can get IP from DHCP server.
Anyone can tell me why MY Lightweight AP cannot get IP from DHCP server ???
thx any idea .
I confirm the AP DHCP setting enabled and the config as below :
AP000d.bc41.4392#show ip inter bri
Interface IP-Address OK? Method Status Protocol
FastEthernet0 unassigned YES DHCP up up

hi fella5:
yes , it's done , the WLC already have the SSC Code and i verify the SCC code is correctly.
the Switchport configured that vlan 99 access port and the Global Vlan ID set the IP helper to the DHCP already.I can ping to the DHCP , DNS and WLC.

Cannot change password from OS X

I just tried to change my Skype password from my Mac running OS X 10.6.8. I tried in both Safari and Chrome, but once I put my old password in, I could not tab into the next field not select it with my mouse. I finally got my password changed by logging in from my iPad. That's funny, as it's usually the other way around. Some sites that work fine in a desktop OS don't work right in Mobile Safari.

Try booting from your 10.1 DVD and going to Utilities/Reset Password.
User Password Reset (3)

Cannot add pictures from windows to ipad

In the past I have been able to add pictures from windows onto my Ipad. I cannot do that now. When I tried, picture albums that I had on are no longer there. I have tried everything I can think of to add these photos. I need help.
Thanks!

Babyboogie wrote:
When I tried, picture albums that I had on are no longer there. I have tried everything I can think of to add these photos. I need help.
If you are saying that the pictures that were on the iPad have disappeared when you synced again, you have to include all photos albums to sync every time that you sync. You can sync multiple albums to the iPad but the albums all have to be in the same main photos folder from which you sync.
This should be helpful.
iOS and iPod: Syncing photos using iTunes - Support - Apple

Cannot synchronize passwords from DS with ISW

I have this warning S Plugin (SUBC100): cannot capture password change of 'uid=rrrr,ou=people,o=tdc', because new password is already hashed" TNK

[25/Jun/2009:12:32:31.800 +0200] WARNING 2301 CNN100 tiwspreldap1 "DS Plugin (SUBC100): cannot capture password change of 'uid=aapontec,ou=empleados,ou=personas,o=tdc', because new password is already hashed"
i make the next syncronization for the first time : from DS to AD
./idsync resync -c -o Sun -l SUL2 -w - -q -
thank you!
yenny.
Edited by: yenny on Jun 25, 2009 3:36 AM

Cannot access attachments from Windows users

Recently I've had a few emails from friends using Windows with attachments (usually daft videos or the like).
The message shows up in mail.app at being around 3Mb, for example, and in the mail list shows as having 2 attachments.
When I open the message it only shows 1 attachment (usually their little 10Kb signature graphic or some such), but not the main, large, attachment.
Anyone else experienced this, or found a solution?
Steve

I assume that both machines are on the same home network, and that there are no external gateways/routers/firewalls etc. in the way? No wireless networks?
Is the Windows machine XP, or something else? What are the firewall settings on the Windows machine? Can you access any other FTP site from the PC?

Cannot Print InDesign from Windows 7 OS

Hi all,
I am hoping someone might be able to suggest something that can fix this issue. I just got a new machine with Windows 7 as the OS. This is a brand new machine. I've installed PageMaker, InDesign CS4, and Acrobat 9 Pro - complete installations of each. When I attempt to print to any printer (my local, the network, or PDF) only garbage prints on the page... It appears as symbols and characters across the top of each page and seems to feed pages indefinitely until forcing met to shut off the selected printer.
I've checked for updates and all are up to date.
I tried to outsmart it by printing as a PDF and also tried exporting to PDF. It works on three of five files. The two that will not create a PDF gives an error stating that Distiller cannot be started.
Any suggestions are most appreciated.
Thank you!

Well, I can report that removing the HP 2800 InkJet driver did not fix the problem.
The only drivers currently installed (now) are applicable to either my local printer or the network printers that I use. All test pages print without issue.
The only print issues I am experiencing from any program is from Adobe PageMaker and InDesign.
Open for more suggestions and very grateful for your help!

Unable to change domain logon password from Windows 8.1 system

We are facing a new problem in our domain. Users working on windows 8.1 platform are not able to change the password and getting an error "the security database on the server does not have a computer for this workstation". I tried deleting the
computer from domain and rejoined to the domain but did not help.
We are running Windows 2008 standard 64 bit Domain Controller and Active Directory functional level is Windows Server 2003. Please help with a solution.

Thanks Marius, but we do not have R2.. It is just Win 2008 Std with SP2
The same applies to Windows Server 2003 and Windows Server 2008 as well so far I know, you have to call Microsoft and ask for back-port hotfix. Can you check if the password has been updated for the krbtgt account?
You can use repadmin lik this, just replace the DCNAME and the DN to much your own environment:
repadmin /showobjmeta eur-fle-dc02 "CN=krbtgt,CN=users,DC=e
r,DC=corp,DC=chrisse,DC=com"
35 entries.
Loc.USN Originating DSA Org.USN Org.Time/Date
Ver Attribute
======= =============== ========= =============
=== =========
7202 dc95de70-859e-4f39-a489-73380dd1896f 12299 2005-03-19 16:40:16
2 unicodePwd
Note "2" for unicodePwd it means that the password for the account has been updated 2 times.
If the above doesn't apply to you, have you changed any ACLs recently? and dose it work on Windows 7 for example?
Enfo Zipper
Christoffer Andersson – Principal Advisor
http://blogs.chrisse.se - Directory Services Blog

Cannot print wirelessly from Windows 7 (64 bit) laptop to Officejet 6000 Wireless (E609n)

The printer is a HP Officejet 6000 Wireless (E609n) and is connected via usb to a Windows 7 (64 bit) desktop and the laptop has Windows 7 (64 bit) loaded.
No changes were made that I'm aware of other than the usual Windows updates.
Server is offline is displayed next to the printer icon on the laptop when printing is attempted.
The wireless network test report shows no problems.
I have rebooted the desktop and printer with no success.
The laptop used to print wirelessly without a problem.

I am not sure the Officejet 6000 can have both the wireless and USB ports active at the same time. You could try disconnecting for the USB cable and then power cycling the printer and trying to connect wirelessly. If you have the desktop connected to a router that also provices wireless capability you could connect the desktop with the network connection.
One other thing you might consider is sharing the printer on your network from the desktop computer. Next on the laptop computer do the following: go to the Devices and Printers folder, Add a Printer, Local Printer, Create a Port, Local Port, \\Computername\Printername (use the actual share name for the computer and printer), OK, then select HP (not Hewlett-Packard) for the manufacturer and select the appropriate HP Officejet 6000 series model.
Bob Headrick, HP Expert
I am not an employee of HP, I am a volunteer posting here on my own time.
If your problem is solved please click the "Accept as Solution" button ------------V
If my answer was helpful please click the "Thumbs Up" to say "Thank You"--V

Local Users (belongs to domain) on ISE cannot derive Password from Windows Database

Similar Messages

Maybe you are looking for