OD users cannot log on without server home directory

I am new to OD and am trying to configure a working setup for a few Macs on the network. The server is set up as an OD master, and while we are running Active Directory, the Mac server is not integrated into the AD network. DHCP and DNS are handled by the server that provides AD.
I have set up a few test users and bound a Mac to the OD server for testing. I've found that if I don't specify a home directory for a particular user in workgroup manager (i.e. I just leave it at (none)), the user cannot log on to the bound Mac. The log in window begins to slide as if it is accepting the password, then stops and shakes and brings me back to the login window without any error message. If I specify a home directory on the server, it will then accept the username and password, show that I am logging in as said user, then display the message, "You are unable to log in to the user account [user] at this time. Logging into the account failed because an error occurred."
I'm guessing the error message relates to a permissions issue with the way the home directories are set up. But honestly, I'd rather the users just have their home directories stored locally rather than on the server. How do I configure it so that the users are able to log on and their home directories are stored locally?
Thanks in advance for any assistance that can be provided!

After playing around with the system some more, I found that I had to explicitly specify the local home directory. I set it to /Users/ and everything seems to be working now.

Similar Messages

Network users cannot log in to server

I have set up a new server from scratch on a new Macmini. In the main, it works absolutely fine. Users can log into the sever from client device as registered user and can share the screen with no problem.
The users are set up as local network users and are in a local group and a network group. I set them up using Workgroup manager after setting up Open directory. All users cn be seen from OD and WM. However, they cannot log in to the server directly - only the server adminstrator can do that. Home drives etc are all set up fine.
Any help will be greatly appreciated.
F

Administrators always have access, you may have blocked Network Users from having access using Workgroup Manager 10.8.
Open Workgroup Manager 10.8
Authenticate to the local directory as an administrator.
Go to the machines section and select the server where users cannot log in.
Click the preferences icon to see the preferences for that computer set through WM 10.8
From the overview choose Login.
Choose the Access tab and set Manage: to Never.
Message was edited by: Mark23

HELP NEEDED - 530 user cannot log in

I'm using CS5.5 and would desperately like some advice over a very odd problem.
For some reason I have a duplicate website showing in DW. It is not on the desktop and doesn't appear in any search.
The original - Cumbria Dog Training, ha sbeen joined by Cumbria Dog Training 2.
I have no idea how this has happened.
I have been validating two items today, one a simple js item and the other is renaming an.htaccess file without the .txt
At the moment, when I try to upload anything from the original, I have the message
FTP error occurred - cannot make connection to host etc.
530 user cannot log in
What does all this mean and what can I do about it.
Many thanks for any advice.
Paul
btw - I also upgraded my server plan today.

Thanks SnakEyez
You're right and I've sorted it out, to the point that I can now upload stuff.
It may sound a dumb question but how - safely - do I remove the duplicate copy, which is showing under "manage sites".
Many thanks
Paul

User cannot log in using Opendirectory password but can log in using Crypt

Hi,
We have an Xsan environment with Opendirectory authentication. Most of the users are created in Workgroup manager and home folders are stored on an Xsan volume.
We have noticed (this has happened to two users recently) that sometimes user cannot log in using his password stored in Opendirectory Password server. This is permanent to some specific User/Workstation combination. Other users can log in to the same workstation and this user can log in to other workstations.
Also, if I change password type to Crypt in Workgroup manager, user can log in to this workstation. In past this happened to another user/workstation combination.
I tried to create a new Opendirectory password (password ID has changed in WM), with no success.
Any ideas?
Thanks,
Darius

You say you can log in the web browser right? You can find your username in the following url: https://play.spotify.com/user

User cannot log into ZCM Agent 11.3.1

We just went through a domain migration. All PCs were unregistered from the old ZCM 11.2 server in the old domain before they were migrated. When we went to re-register them to the 11.3.1 ZCM server, we ran into 2 issues. Some of the systems successfully upgraded to 11.3.1 BUT users cannot log onto the ZCM 11.3.1 Agent. It's giving an error of "unable to log into the network because the login credentials or the server certificate is incorrect". The PCs that didn't not upgraded to ZCM 11.3.1 and are running 11.2.0 do not have this problem. They get authenticated appropriately. The User configuration is set to eDirectory (just like on the ZCM 11.2 server in the old domain).
I ran "zac ci" and noticed there are old certificates from ZENworks servers that are no longer around. How do you get rid of these old references? It's picking up the new server's certificates. I ran this on my PC ZCM Agent 11.2 (won't upgrade and can authenticate into the ZCM 11.2 agent just fine) and I do not see the old certificates. I'm only seeing certificates for the new ZCM 11.3.1 server in the new domain and the eDirectory master server that the ZCM server is referencing.

The old Trusts can be cleared using IE to managed the Trusted Root
Stores. There are some other ways too.
However, Having old ones should not be an issue unless the old and new
Servers have the same name. Not 100% sure matching will cause an issue,
but I think I have seen that before.
It may be possible to automate the removal of the old trusts, but I
would not worry about that until you verify it is an issue by manually
fixing a couple and see if resolves your issue.
Your issue may be something else.
Reinstalling CASA is something else to try.
On 10/9/2014 5:16 AM, hfr63 wrote:
>
> We just went through a domain migration. All PCs were unregistered from
> the old ZCM 11.2 server in the old domain before they were migrated.
> When we went to re-register them to the 11.3.1 ZCM server, we ran into 2
> issues. Some of the systems successfully upgraded to 11.3.1 BUT users
> cannot log onto the ZCM 11.3.1 Agent. It's giving an error of "unable
> to log into the network because the login credentials or the server
> certificate is incorrect". The PCs that didn't not upgraded to ZCM
> 11.3.1 and are running 11.2.0 do not have this problem. They get
> authenticated appropriately. The User configuration is set to
> eDirectory (just like on the ZCM 11.2 server in the old domain).
>
> I ran "zac ci" and noticed there are old certificates from ZENworks
> servers that are no longer around. How do you get rid of these old
> references? It's picking up the new server's certificates. I ran this
> on my PC ZCM Agent 11.2 (won't upgrade and can authenticate into the ZCM
> 11.2 agent just fine) and I do not see the old certificates. I'm only
> seeing certificates for the new ZCM 11.3.1 server in the new domain and
> the eDirectory master server that the ZCM server is referencing.
>
>
Going to Brainshare 2014?
http://www.brainshare.com
Use Registration Code "nvlcwilson" for $300 off!
Craig Wilson - MCNE, MCSE, CCNA
Novell Technical Support Engineer
Novell does not officially monitor these forums.
Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.

Is there an application to monitor users who log into Windows Server 2012 R2?

I'm looking at Family Safety Feature in Windows 8 and like what they can do. I have a request to monitor, track users who log into Windows Server 2012 R2 to see how many users login, how long each login is for each user so a monthly report can be generated.
1. I just wonder if Windows Essential 2012 can be used for this purpose or not. If it can, is Windows Essential 2012 a feature can be added or installed on Windows Server 2012 R2?
2. If Window Essential 2012 cannot be used for this purpose, is there any feature in Windows Server 2012 R2 that can be used for this purpose?
3. Is there any other suggestions?
Thank you for your help.
Thanks and Regards,
Hien Phan

Hi Hien,
Anything updates?
It seems that there is no feature can do that. I agree with Tim that you can check the event logs. In general, the event 4624 would be created when a user was logged on, and the event 4634 would be created when a user account was logged
off.
More information:
Tracking User Logon Activity Using Logon Events
Best regards,
Susie
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

SAPJSF user cannot log-on to the User Management Engine.

We have a newly installed PI 7.0 system.
SLDCHECK is succussful but if we go to the http://hostname:50100/sld - we are redirected to http://hostname:50100/logon/logonServlet?redirectURL=%2Fwebdynpro%2Fdispatcher%2Fsap.com%2Ftc%7Esld%7Ewd%7Emain%2FMain
When we check the default.trc file, we see the error: User "SAPJSF" is the communication user for the connection between User Management Engine and the ABAP backend system SIDCLNTxyz. This user cannot log-on to the User Management Engine.
The SAPJSF user is not locked in SU01. This user is used by the JCO providers to connect to the gateway service.
We opened Visual Administrator and navigated to Server0 -> Services -> UM Provider
We changed the password property at ume.r3.connection.master.passwd
We then restarted the ABAP and J2EE engine. But we still see this error.
Any help to solve this issue is appreciate.
Jay Malla

Hi,
Please, refer the link below. It says you cannot logon with SAPJSF user to J2EE engine for security reasons.
http://help.sap.com/saphelp_nw2004s/helpdata/en/4e/225b42eeb66255e10000000a155106/frameset.htm
Thanks
R.Murali

End Users cannot log in to the ccmuser web page.

Greetings,
I have a Call Manager Business Edition that was synched with a customer's AD directory. However, the end users cannot log in to the ccmuser web page with either their AD password or the Call Manager end user PIN.
Any suggestions?
Thanks
George

Thanks for your reply, Aaron.
All users are in the end user group.. I even created a new role/user group that gives users complete read/write access to all end user features. Still no go. I think it is an LDAP issue, but I'm confused because everything else works.

Network users cannot log in to account on server

Here's the situation.
1) X-Server running 10.6
2) Workstation running 10.5 or 10.4
3) Created user accounts using WGM (from a machine other than the server)
4) Bound workstation to server ('green-light' and message Network Accounts Available - shows up on workstation.
5) When test account user name and password are entered, password shakes - we get the message 'Cannot log in due to an error'.
What gives???!!!???

If the error you're getting is 'You are unable to log in to the user account "suchandso" at this time. Logging in to the account failed because an error occurred', that usually indicates that there was a problem mounting the user's home folder. My standard approach to narrowing down where errors like this are coming from is to test the critical parts of a network login (user info lookup, authentication, and home directory mount) by hand and watch for informative errors:
Log in as a local user on a client computer, and open the Terminal utility.
Run the command "id suchandso" (where "suchandso" is the short name of a network user). It should reply with something like "uid=1025(suchandso), gid=20(staff)," etc. If it instead replies with "id: suchandso: no such user", you either have the wrong username or the client is having trouble looking up user info on the server over LDAP. (Note: if this isn't working, you generally don't get as far as the error message, just a shake of the login window.)
Get a network authentication ticket with the command "kinit suchandso" (enter the user's password when prompted). If this works, it'll just come back with another shell prompt. If something goes wrong, you'll generally get an informative error message about what the problem is (e.g. if it says "Kerberos Login Failed: Clock skew too big", that means the client's clock is too far out of sync with the server's and one or both of them needs to be corrected).
Now, use the Finder's Connect to Server (Command-K) feature to try to connect to the server; enter the server's full domain name in the Server Address field. You should not be prompted for a name and password (Kerberos authentication should be automatic after the "kinit" command; if not, something's wrong with the file service's Kerberos setup). You should get a "Select the volumes to mount" dialog including the Users folder (or whatever folder your user homes are under). Note that the user's actual home folder will also be listed, but that's not what you want; select the Users volume instead. If the Users folder isn't listed, or you get an error trying to mount it, troubleshoot that.
If none of that shows any problem, you've got something more obscure going wrong. A couple of random things to try:
Enable guest access to the Users folder (shouldn't be necessary, but I've seen reports that it sometimes avoids trouble).
Make sure the user's home folder settings are configured correctly: use WGM to switch the user's home folder to "(None)", save, then set it back and save again.

Having problem with svchost.exe/ntdll.dll errors causing GPSVC (Group Policy Client) to crash preventing users from logging into the server.

Recently (within the past 2 weeks) I have noticed a few of our servers will have problems with the svchost.exe application causing the GPSVC (Group Policy Client) to crash. The only fix at that point is to reboot the server since the GPSVC service is tied
to svchost.exe and therefore is protected from being manually restarted.
I noticed the following errors when this occurs:
Log Name: Application
Source: Application Error
Date: 7/23/2013 4:35:26 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Server1.xxx.xxx.net
Description:
Faulting application name: svchost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000024
Fault offset: 0x00000000000cd7d8
Faulting process id: 0x46c
Faulting application start time: 0x01ce877f9476ac07
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: d252d26d-f372-11e2-8ad4-005056ac00e8
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-07-23T08:35:26.000000000Z" />
<EventRecordID>158950</EventRecordID>
<Channel>Application</Channel>
<Computer>AAW19XM2.agency.nwie.net</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bc3c1</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.17725</Data>
<Data>4ec4aa8e</Data>
<Data>c0000024</Data>
<Data>00000000000cd7d8</Data>
<Data>46c</Data>
<Data>01ce877f9476ac07</Data>
<Data>C:\Windows\system32\svchost.exe</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>d252d26d-f372-11e2-8ad4-005056ac00e8</Data>
</EventData>
</Event>
All of our servers are running Server 2008 R2 Enterprise where we use Citrix to deliver desktop sessions to our users, but some are virtual and some are physical. This seemingly impacts our virtual machines more, and our VMs are hosted through VMWare, however,
about 5 months ago a similar error fired on a non-virtual machine:
Log Name: Application
Source: Application Error
Date: 2/27/2013 6:57:58 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: AAW29033
Description:
Faulting application name: svchost.exe_gpsvc, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000024
Fault offset: 0x00000000000cd7d8
Faulting process id: 0x6c0
Faulting application start time: 0x01ce14e1af313fd9
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: ed3d01c4-80d4-11e2-9128-b499baa9e5e8
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-02-27T11:57:58.000000000Z" />
<EventRecordID>286291</EventRecordID>
<Channel>Application</Channel>
<Computer>AAW29033</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe_gpsvc</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bc3c1</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.17725</Data>
<Data>4ec4aa8e</Data>
<Data>c0000024</Data>
<Data>00000000000cd7d8</Data>
<Data>6c0</Data>
<Data>01ce14e1af313fd9</Data>
<Data>C:\Windows\system32\svchost.exe</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>ed3d01c4-80d4-11e2-9128-b499baa9e5e8</Data>
</EventData>
</Event>
I've searched and cannot seem to find any information as to what may be causing this, or even really where to start. Would someone be able to help me identify what might be causing this event, specific with the Exception code: 0xc0000024, which causes
the Group Policy Client service to stop?

You still out there looking at things? If so I have an update. The issue hasn't stopped, even though it did seemingly die down for awhile, however, it is now back with a vengeance.
I am able to force it to happen by killing the svchost process that is hosting GPSVC. If I run gpupdate /force, then logout/login it does get GPSVC running again. Furthermore, if I simply start svchost again via the Task Manager GPSVC starts running again.
When I access the server remotely with KVM it acts just like it does as if I'm logging into it via Citrix/RDP which for Admin IDs gives an error saying "Failed to connect to a windows service. Windows could not connect to the Group Policy Client service...",
however, normal user accounts just get a message when logging into the server "The Group Policy Client Service Failed the Logon. Access is denied."
I haven't opened a case with Microsoft yet, but we about ready to because of the increase in these errors.
If you have any further suggestions that would be great, otherwise I'll provide an update once I get word back from Microsoft.
**EDIT -- apparently I mistook the the server's SCM's actions as my own. I was able to successfully crash the GPSVC service by killing the hosting svchost process, however, after I crashed it and let it sit crashed for awhile when I attempted
to restart either by starting a svchost task, or running gpupdate /force it failed. Either that, or there is a timing issue where if we don't restart the svchost process, or run gpupdate /force quickly enough it won't be able to recover without a reboot.

10.5.6 update - user cannot stay connected to server anymore!

Ugh. Here we go again, Apple! One user updated to .6 before leaving last night. Today, he can log in (local account) and now when he's connected to our XSERVE, he CANNOT save or copy files to it. he is getting constant "connection interrupted" messages. I am also looking at the Server Admin utility on the server and he's showing up multiple times as either "Disabled/Asleep" or (weird) his machine name is showing up as server-16027567 instead of the machine's actual name.
Someone, PLEASE tell me there is a simple way to roll back this update!!

Hi DevCom ,
Just wanted you to know that I've solved my "saved-over-the-network" problem by upgrading my AFP server to 10.4.11, after reading this note from Apple :
Improves Apple File Service performance, especially when using a home directory hosted on an AFP server. Important: If you are using Mac OS X 10.5.6 (client) to connect to a Mac OS X Server 10.4-based server, it is strongly recommended that you update the server to Mac OS X Server version 10.4.11.

Users cannot log into Remote Desktop after 3/11/2015 update!

I have a simple network where users can log into a Windows SBS 2008 server with Remote Desktop to access various applications. This worked quite smoothly until this morning, after the updates of last evening. (3/11/2015)
When users tried to log into the Remote Desktop this morning their credentials were rejected, as if their username and/or password were incorrect. Even I (as the administrator) could not log in remotely. Finally I connected a monitor and keyboard
directly to the server and was able to log in without an issue. After logging in directly I was able to connect through remote desktop.
This method worked for my other users as well - after I logged them in directly they were able to use remote desktop no problem.
The trouble is that I have a couple dozen users, and this is an issue that should not be occurring. What happened in the last update to cause remote desktop to reject users credentials? Why does it only work after the user logs in directly?
And most importantly, how do I fix this?
A few notes:
Simply browsing for files on the server also asks for the user's name and password, and this works as well. This is only a remote desktop issue.
I have already checked to make sure the domain was correct. It was.
I have already checked to make sure the usernames and passwords were correct. They were.
I have already checked to make sure this was not a unique issue for a single (or limited number) of users. This issue effected
all users all the network.
Thank you very much for your help,
Dustin

I'm curious here... If the server is rebooted, does it put the RDS users back into a "credentials failed" situation? If so, could you please have them log in with credentials:
domain.local\username (I suspect they may be currently using domain\username)
and see if that fixes the RDS problem without having to first log into the server directly.
The ".local" may be ".lan" or ".somethingelse" depending on how you initially configured your domain, but the default for SBS 2008 is ".local"
Merv Porter
=========================
That's a good question - the server will auto-reboot this evening and I'll test again in the morning.
You are correct that we've been using domain\username. I tried domain.local\username (which is the way we've set up), and that did not work either.
I'll let you know how things turn out tomorrow morning. I don't want to mess with my users anymore today. :P
Dustin

Cannot log into OpenDirectory server

I am running OSX Server 2.2 on a Mac Mini with 10.8.5. I have successfully enabled Open Directory and created several users that are set up as Services Only, as they do not need home directories, only file sharing and (hopefully in the future) contacts and single sign-on.
I am able to bind my computer to the OD server using the fully qualified domain name (internal.xxxx.org) and get the green "enabled" dot in the Users page on the Mac.
I turned on "Allow Network Users to Log In" and tried to log in as my network user, and it "shakes" when I enter the username and password, and won't log in. What am I doing wrong? I'm unclear how to log in as a network user from my Mac's sign-in screen. I also tried using the administrator's account, which is an actual user account on the server and that did not log in either. It doesn't seem like the Mac is even attempting to check the server for user information.
Thank you.

Many Open Directory problems can be resolved by taking the following steps. Test after each one, and back up all data before making any changes.
1. The OD master must have a static IP address on the local network, not a dynamic address.
2. You must have a working DNS service, and the server's hostname must match its fully-qualified domain name. To confirm, select the server by name in the sidebar of the Server application window, then select the Overview tab. Click the Edit button on the Host Name line. On the Accessing your Server sheet, Domain Name should be selected. Change the Host Name, if necessary. The server must have at least a three-level name (e.g. "server.yourdomain.com"), and the name must not be in the ".local" top-level domain, which is reserved for Bonjour.
3. The primary DNS server used by the server must be 127.0.0.1 (that is, itself) unless you're using another server for internal DNS. The only DNS server set on the clients should be the internal one, which they should get from DHCP if applicable.
4. Follow these instructions to rebuild the Kerberos configuration on the master.
5. If you use authenticated binding, check the validity of the master's certificate. The common name must match the hostname and domain name. Deselecting and then reselecting the certificate in Server.app has been reported to have an effect in some cases. Otherwise delete all certificates and create new ones.
6. Unbind and then rebind the clients in the Users & Groups preference pane. Use the fully-qualified domain name of the master.
7. Reboot the master and the clients.
8. Don't log in to the server with a network user's account.
9. Disable any internal firewalls in use, including third-party "security" software.
10. If you've created any replica servers, delete them.
11. As a last resort, export all OD users. In the Open Directory pane of Server, delete the OD server. Then recreate it and import the users. Ensure that the UID's are in the 1001+ range.

After software update, users cannot log into Xserve

We have an Xserve running 10.6.7. We just did an software update and rebooted the server. Something broke and at this point, only local users can log in, such as the administrator account. None of the users in the LDAP db can log in. I cannot access their accounts from Workgroup Manager, either, because it posts an LDAP error.
We do have a full backup of that drive from 24 hours ago, but don't want to just blindly overwrite the whole drive. Are there specific files I could restore?
Or, is there a way to correct what's wrong with LDAP?

Sadly we are currently having problems with ldap and directoryservices after the 10.6.7 update. It is not the same thing you are seeing but none the less.
My advice would be to get that backup up and running. You could copy the backup to an external drive and try and boot off of it and see how that works if its ok I would revert back and hold off on updates.

Sharing only users cannot connect to Lion Server

Dear all,
I stumbled across a funny problem, that I tried to resolve all day. I just wanted to add a sharing only user for my girlfriends new MacBook that she could use to connect to a shared Time Machine Volume.
If I add a new standard user, this user can connect to my server via finder (connect as...) and see the shared drives. If the same user tries to connect to the Time Machine Backup Volume via the settings dialog, it receives an error message (OSStatus-error 5).
If I add a sharing only user, this user cannot connect via finder or Time Machine (same error). The clients console states the following error message:
/System/Library/CoreServices/NetAuthAgent.app/Contents/MacOS/NetAuthAgent[2471] AFP error -5018 mapped to EIO
Does anybody have an Idea?

That is my point. Yes, Apple still lets you add users via users and groups in system preferences but that is not how you should be adding users. I've seen nothing but trouble when that option is used to add users and I believe that the Lion server docs say to not use that. If you are using lion server why not use it the way it was meant to be. Just create a account in OD and only give her access to the Time Machine Service and none of the others.

OD users cannot log on without server home directory

Similar Messages

Maybe you are looking for