User can't access afp shares

About once every other day one of my users losses the ability to log onto afp shares on the server.
In the Server App under Users his "Allow user to log in" tick box has become unticked. If I tick that and save, everything is fine for a day or so then it becomes unticked on its own again. As usual with computers in generally becomes unticked at a crucial point when everyone is busy !!
Any help would be appreciated. I can see nothing unusual in the logs and I have tried reseting his password.

I just went from 10.8.5 to 10.9.2 and have this same problem. I first noticed in DNS 127.0.0.1 was removed during install and not put back. From there I got everyhting working except afp.
Error message is:
Kerberos fail: gss_acquire_cred major status_value <458752> minor status_value <0>
major error <1>: No credentials were supplied, or the credentials were unavailable or inaccessible.
minor error <1>: unknown mech-code 0 for mech unknown
Trying:
sudo sso_util configure -r REALM_NAME -a diradmin afp
/Local/Default
/LDAPv3/127.0.0.1
Creating the service list
Creating the service principals
OSStatus CreateKerberosPrincipals(CFStringRef, CFStringRef, const char *, CFMutableDictionaryRef, Boolean): unable to find admin record: -1
Creating the keytab file
Configuring services
Any solutions out there? This is pretty critical for TM backups around the office.

Similar Messages

Open Directory users can't access shares

Greetings all.
I apologize if this has been covered, but I couldn't find a search term that would locate the issue.
I have a 10.5.8 Server running on a MDD dual 1Ghz G4. I have it set up as an OD Master and providing time services, DNS, file sharing, portable home directories and calendaring for a small workgroup of 7 computers. At least that's the idea when it's functional.
It is behind a NAT and only serves the local network.
Until I have the user's data all transferred from local directories to portable home directories, I need to make it so that the users can access the shares.
In testing, when I try to access a share, I get an error message that the login failed because the username or password was invalid.
However, when I go look at the Password Service log, the user was authenticated and in good standing.
Any ideas?
Thank you,
John

maybe some additional information or rephrasing might help.
I have users and groups set up with ACLs on the shares that are set up with automount over NFS. The shares should also be available via appleshare, but not automount.
The users are configured now with Portable Home Directories.
The client computers are bound to the Open Directory Master on which the shares reside.
The server runs network time services and the client computers use that for their time service.
The server also runs DNS, and the client computers use that DNS.
Users can log into their Portable Home Directories ok.
Users can not log into shares via "connect to server" as it says that the username/password is invalid, even though the password service log says that the user was authenticated and in good standing.
Users can see the NFS automount shares at /Network/Servers/Library (where it is supposed to be), but they cannot write, even though the ACL gives the user account permission to do so.
For the permissions on the automount, I can't tell if the user is not being detected as the authenticated user, and is therefore being given "everyone" permissions, or if the ACL is not working on the mount and so the user is being given ""everyone" permissions.
Anyone have any idea how I can find out?
As to why a user can't log in via "connect to server" I'm clueless.
Thank you,
John

User Passwords Rejected on AFP share mounts?

User Passwords Rejected on AFP share mounts?
(OK, my last post got buried, and perhaps too long), try again. Very brief
Issue:
After so many days, a User's AFP share password is rejected? What gives.
If you reset it, several days later, same thing, rejected.
Is Netinfo Database corrupted, what can / should be done?
- Stand Alone server (with AFP and FTP services running, all other services off, not running.
Summary Info for user having issue:
Location: 192.168.0.50/NetInfo/DefualtLocalNode
Home: No Home Directory
Primary Group: Users (20)
Password: Shadow Password
I have deleted that troublesome user name and created a new name (for that user), just in case, in the re-creation of the same user name (after deletion) some corruption gets inherited.
thanks,
macguitarman
Power Mac G5 Dual 2.0 Mac OS X (10.4.7)

Using Tiger Server, I have found that enabling ACLs, or Access Control Lists on the volume, and then specifying users and/or groups into the specific ACLs for the share point has been very helpful. Also note that 10.4.10 server seems to work better than 10.4.11, so if you haven't upgraded, don't go beyond 10.4.10. .11 seems to have some permissions issues and other problems.
I assume you are connecting to the server via AFS (i.e. Go > Connect to Server > ip address) and not SMB? SMB sometimes is more problematic about ownership. But either way, Mac or PC clients, it seems ACLs are the way to go.
Crazy as it seems, on my server, even if the owner is, say, admin, and the group with r/w permissions is, say, Prepress, it helps to specifically add the Prepress group to the ACL for that share. Then be sure to propagate the permissions down (unless you don't want to, for some reason). To do this, click the little gear icon and propagate all the permissions -- owner, group, acl, etc. down. This will take a bit of time depending on how much stuff you have. I also find that a server reboot can be helpful.
[[ All this said, 10.5.1 seems to do some crazy things, and I hope 10.5.2 addresses them. I have one machine (not user ID) that always creates a folder on a share with no permissions for anyone. Only from that Mac; the same login on another works just fine. Go figure]]

I can't access folder share in WIndows Server 2012 R2 from windows 8.1

i have a strange case:
I have a Windows Server 2012 R2 machine with a shared folder. Accessing this folder using a Win7, Win8,
Win 2008 R2 machine using \\servername works fine but form windows 8.1 or windows
2012 r2 i can't so any one can help me.

Hi,
Would you please let me know the complete error message that you can find, when can’t access to the share folder
that host in the Windows Server 2012 R2?
If you logon the Windows 8.1 (or server 2012 r2) with administrator account, will encounter the same issue?
Meanwhile, please access the share folder via \\server’s IP address\share folder. Then please check if this issue still persists.
In addition, there is a similar thread. Please refer to and check if can help you.
Can't
access UNC share on Windows Server 2012 R2
Hope this helps.
Best regards,
Justin Gu

Other user can't access to OBIEE 11G installed on a server

Hello,
We have installed OBIEE 11G on a server ( windows sever 2008 r2) with admin account, and it works fine, But others users can't access to obiee 11g ( administration icons are white in their sessions) even they have admin rights.
Can anyone tell me what should we do??
Thank you.

Hi,
This is the exact format how my tnsnames.ora file looks. sorry, I can ping it in command prompt now. In my connection pool i tried first DSN = ab.bc.xy.zx, did not work. Then I saw oracle's default repository and changed my DSN to your suggested format starting from "DESCRPTION" to rest. Still no luck Do you think, i should put the same TNS in my local machine??
ab.bc.xy.zx =
(DESCRIPTION =
    #(ADDRESS = (PROTOCOL = TCP)(HOST = 10.20.30.110)(PORT = 1521))
    #(ADDRESS = (PROTOCOL = TCP)(HOST = 10.20.30.120)(PORT = 1521))
    (ADDRESS = (PROTOCOL = TCP)(HOST = 10.20.30.130)(PORT = 1521))
    (LOAD_BALANCE = yes)
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SID = cap2)
thanks,
BK.

Saving so that windows user can have access?

I have my project all ready and those with quick time...loads up perfectly. However those who have windows have a long wait or pile will not come up. Do you know how i can save my final cut express project so that window users can have access to it?

thank you. one last question....the quick time movie file can not be seen when opening on a windows. do you know if i need a quick time pro so that i can convert it? or is there a way that i don't know about?

Can't access any shares on the network

Hi,
As the topic says, I can't access any shares on the network. I've tried connecting to a Iomega NAS, Windows 7 laptop, and a macMini. In the "Shared" list in finder im able to see all the shares, I'm able to click them and see the folders they share, but when I try to open one of the folders I get an error, no matter which share it is:
+"The operation can’t be completed because the original item for “<folder name>” can’t be found."+
The shares can all access each other, and they can access my folders. I just can't access any folder on the network.
I got a mac pro with osx 10.6.2 and have all the latest updates.
How can I solve this problem?
Thanks.

Well, try this (I was able to fix my with these steps):
Go Utilities > Disk Utility
Select your Startup Disk, e.g. Macintosh HD
Then, under the First Aid Tab, click Verify Disk Permissions.
If there are errors, then click repair Disk Permissions.
After it is done, restart the computer and see if your problem is resolved.
I hope this help.
Zeke
www.ZekeYuen.com/blog/

Why the apple store is so expensive and why the apple users can't access for free after spending huge amount in apple phone ?

Why the apple store is so expensive and why the apple users can't access for free after spending huge amount in apple phone ?

The Apple store is correct. The warranty is not international, and Apple will not accept or return iPhones shipped from a different country. You need to ship the phone to somebody in Hong Kong who can take it in to Apple for repair, or pay a third party repair shop in the Philippines to fix it.

Windows XP users can't access SMB/CIFS shares on MAC OSX10.4.4 Xserve bug?

The Xserves are new for us. This problem involves two of the 10.4 xerserves.
1 serves as an Open Directory System Master(10.4.3). 2 Serves as a file share & backup (10.4.4).
Both are production machines and cannot easily be restarted.
There is no Windows network, Active Directory or Windows domain in our network.
We created a SMB and AFP share on the file server which is a member of the Open Directory. (It is bound and kerberized to server 1).
The users all have accounts in the OD system and all passwords are Open Directory. Our users can ssh into the various xserves (including the file share server 2) and authenticate against OD.
We made the shares available via smb under Protocols --> Windows File Settings. We turned the Windows Service on in Server Admin. I'ts a standalone server and all the authentication types are checked under access.
The MAC (powerbook) users can access the share fine. The Windows users can't. The Windows laptops can see the file share server (through search - not visable is Network Neighborhood) but when they try and connect they are presented by an authentication box that just keeps cycling over and over regardless of what the user types as user name & passwd.
I tried to access the smb share with my powerbook(10.4.4) and have the same issue. I'm presented with an authentication box but authentication fails.
The Windows File Service Log shows:
auth.c:checkntlmpassword(312)
checkntlmpassword: Authentication for user [csmith] -> [csmith] FAILED with error NTSTATUS_WRONGPASSWORD
[2006/02/24 21:52:03, 1] authods.c:opendirectory_authuser(212)
User "csmith" failed to authenticate with "dsAuthMethodStandard:dsAuthSMBNTKey" (-14090)
[2006/02/24 21:52:03, 1] authods.c:opendirectory_smb_pwd_checkntlmv1(427)
opendirectorysmb_pwd_checkntlmv1: [-14090]opendirectoryauthuser
[2006/02/24 21:52:03, 2] /SourceCache/samba/samba-92.15/samba/source/auth/auth.c:checkntlmpassword(312)
checkntlmpassword: Authentication for user [csmith] -> [csmith] FAILED with error NTSTATUS_WRONGPASSWORD
[2006/02/24 21:52:03, 1] authods.c:opendirectory_authuser(212)
User "csmith" failed to authenticate with "dsAuthMethodStandard:dsAuthSMBNTKey" (-14090)
[2006/02/24 21:52:03, 1] authods.c:opendirectory_smb_pwd_checkntlmv1(427)
opendirectorysmb_pwd_checkntlmv1: [-14090]opendirectoryauthuser
[2006/02/24 21:52:03, 2] /SourceCache/samba/samba-92.15/samba/source/auth/auth.c:checkntlmpassword(312)
checkntlmpassword: Authentication for user [csmith] -> [csmith] FAILED with error NTSTATUS_WRONGPASSWORD
[2006/02/24 21:52:03, 2] /SourceCache/samba/samba-92.15/samba/source/smbd/server.c:exit_server(595)
Closing connections
I've googled this error and it seems that there a lot of engineers out there with the same problem but no answers. Could this be a bug with Apple's SMB process? Is there something I've missed? (I've looked at the smb.conf and have even turned off deny clear text passwords - I've even tried granting guest access) Anyone have any ideas?

On the server itself, run the following in the Terminal:
(from a few different sources):
run ps -auxw | grep Password
to see if Password service is running
Also check the logs in /Library/Logs/PasswordService
Try: id username
and see if you get some info returned.
Ex: id jimguy
You should get some info about uid, gid, groups.
sudo killall -USR1 DirectoryService
Then try to login from a client machine.
Be sure to re-issue
sudo killall -USR1 DirectoryService
in order to stop the (far more) verbose logging.
Then check the logs in /Library/Logs/DirectoryService
In Open Directory, you might want to revert to standalone (this will destory the existing OD setup) and then re-promote to OD Master. You'll lose all OD users however when doing so. If you don't have many, this may be best.
You'll want to verify the hostname, and forward & reverse DNS lookups before re-promoting, and watch for any errors when promoting to OD master
See, when you say "The real clue is that I'm unable to access the shares from my Powerbook G4 with my Open Directory account. I can log in to the file share as the local admin though and that's why I'm thinking there is a bug in the samba/OD relationship. " - that's the real clue indeed.
The local admin account, the first admin account you setup on the server, is indeed local, and resides in NetInfo, not Open Directory.
So something is afoul in your OD.

What do I need to do to enable Active Directory users to authenticate to AFP shares in 10.8 server?

We recently upgraded from 10.6 server to 10.8 server and are having trouble with AFP shares and Active Directory. We have shares on each of our OS X servers that should be mountable by any Active Directory user at the site the server resides. In 10.6, this worked beautifully. Simply adding the appropriate AD groups with appropriate permissions to the ACL of the folder(s) being shared worked without a hitch. In 10.8 server, this is not working. Permissions are defined correctly (as far as I can tell), the server is bound to AD, but yet no AD user who should have access can mount the share. When attempting to mount the share on a 10.6 client, the user gets the short and simple "You entered an invalid username or password. Please try again." On a 10.7 client, the window shakes.
What confuses me even more is that no local users can mount the share as well. I try as our admin account, I receive the following error message on our 10.6 clients:
Actually, as I was forumulating this post, logging in as the server administrator account is now working...???!!!
This was the error message we were receiving on 10.7 clients before it magically started working:
In any case, authenticating as an AD user is still no go. Any ideas?

I had something similar to this. In the name field put in DOMAIN\username rather than just the name.

Domain machine Can't access administrative shares c$ admin$ on windows 7 x64 network path was not found

Hello,
I'm unable to access admin shares on a windows 7 pro x64 domain machine, i've tried the following:
. Disable IPV6
. LocalAccountTokenPolicy (32 and 64 bits set to 1 or zero with restart)
. Disable UAC
. Disable firewall
. LmCompatibilityLevel set to 1
I can ping the machine, remote desktop and everything BUT access any shares on it, i've created additional shares for testing and still can't access it, by name or ip, even using the 127.0.0.1. Please help as this issue is driving me nuts.
PS: Windows 7 Enterprise doesn't have this problem

Believe it or not, it's UAC causing the blockage of accessing any hidden $ drive share in Windows 7. At least, for me.
For a new PC built here I tried everything I could find. Disable antivirus, firewall, defender... changing network share settings.. nothing worked.
Thing is, its been working on multiple old PCs so I tracked down network profile and other differences between new and old, only one I found was that I'd disabled UAC on the old PCs (all win7 pro). Disabled UAC on the new PC, rebooted as required to completely
turn it off, bam! can now access root drive shares via the hidden $ as always.
More advanced admins could probably track down the specific registry settings changed by UAC and isolate the one blocking LAN connecting to hidden drive $ shares. I'm not delving any deeper.
Oh, btw, turned firewall, antivirus etc back on and it still allows access over a LAN.
(UAC - User Account Control for those not familiar with the acronym)

Multiple Users Can't Access Time Capsule Data

My wife and I have two separate Apple MacBooks that share a Time Capsule. We have different account names on these respective computers. I initially set up my Time Capsule and created folders that I can access from Finder.app when I connect over our wireless network. In Airport Utility.app, under the "Disks" tab, I set up the shared disks "with device password", so that she and I can mutually access all the data on the Time Capsule. However, when I try to access it from her computer, I click on the Time Capsule in Finder.app and get this dumb Sharepoint icon--a total dead end. I created another account on her computer with the same name as the account on my own computer, and from that account, I'm able to access all of the data on the Time Capsule. This therefore seems to be a permissions issue, but I've checked all of the files and folders on the Time Capsule and ensured that they all have "everyone read & write" access, so there should be no restrictions on access to this data.
Why are the volumes on my Time Capsule sensitive to the user accessing them? How do I set up data repositories on the Time Capsule that can be accessible to all users on my network? I'm out of ideas.

Are both computers actually running Mavericks??
This is very typical Yosemite problem.
For some reason which I don't yet understand Yosemite is horrible at handling network drives.
dumb Sharepoint icon
Sharepoint is a dlink app?? If you have ever had some app loaded that uses a different product to apple then it can mess your access.
WD share stuff seems to be the worst and causes no end of problems.
What you are seeing btw is the TC is not a NAS.. you are trying to use it as one.. but it isn't.

Can connect via VPN, but can't access AFP server on same Xserve

Hi:
I've set up our XServe with MacOS X Server 10.5.2 to do AFP and VPN (L2TP only; PPTP is disabled). The XServe is a standalone server, not connected to any other direstory server.
I can connect to the XServe's AFP server from my Mac over our wired and wireless network. The AFP server shows up in the sidebar of Finder windows. So far, so good.
I am able to successfully connect to our network via the VPN with Mac OS X 10.5.2 client (on two different machines) using L2TP through our network's firewall (on a Netopia T1 router; UDF ports 500 and 4500 and IP Protocol 50 and 51 are open) using a shared secret.
But I cannot connect to the XServe itself to use Server Admin or AFP (using afp://server.company.com or afp://xxx.xxx.xxx.xxx via the Go > Connect to Server command).
The error I get while connecting to the 10.5.2 AFP server is Some data in apf://server.mycompany.com could not be read or written (Error Code -36 ). I saw this error associated with a SMB problem in 10.4.x, but SMB is not running.
Other iChat users in my office also do not automatically show up in the Bonjour list when I connect to the network. Other computers on our network do not appear in the sidebar of a Finder window. (I'm told these are to be expected, as Bonjour isn't supported (in the "local area Bonjour" over a WAN link - it's purely a multicast feature on the network in the office, and won't be routed across the VPN link. True?)
Now, here's the odd part. There is a second server (v10.4.11) on our network running AFP. I can connect to it (using afp://server.company.com via the Go > Connect to Server command) and mount its various sharepoints via the VPN.
The only thing I see in the VPN log that seems amiss is this (but I have no idea what it means):
Tue Mar 11 23:09:27 2008 : Unsupported protocol 0x8057 received
--Both the 10.5.2 and the 10.4.11 servers have DNS properly configured (though our ISP; we're not running our own DNS).
--Both servers and the client have public IP addresses and have the same subnet mask. Network Utility confirms this while connected to the VPN.
--NAT is not running. The ISP is responding with public IPs for the servers.
--The firewall for the 10.5.2 server is not running (but will be once I get this all working).
--The IP address range for the VPN server doesn't overlap our DHCP pool (which also currently uses public IP addresses).
--Any user can access any service.
--No network routing definitions have been set up.
--In essence, I've followed the steps on Pages 141-142 of the Network Services Admin Guide.
One other note: After I connect, the Network Preferences > VPN > Advanced > TCP/IP window shows the IP address for the client just fine (assigned from the VPN pool), but lists the router as having the IP address of the XServe (rather than the router on the network). Is that normal?
I'm hoping I don't need to have the XServe run DNS as an internal LAN DNS server.... And I'm not sure why I would have to if I can already successfully connect to the 10.4.11 AFP server .
What simple step am I missing?
TIA,
mm

"I am able to successfully connect to our network via the VPN with Mac OS X 10.5.2 client (on two different machines) using L2TP through our network's firewall (on a Netopia T1 router; UDF ports 500 and 4500 and IP Protocol 50 and 51 are open) using a shared secret."
I suspect you mean UDP ports and you might need UDP port 1701 open too.
You only need IP protocol 50 (ESP), protocol 51 (AH) isn't used. And ESP is only used when client and server isn't behind NAT (when NAT is used only the UDP ports are used).
"Unsupported protocol 0x8057 received"
This is usually seen when you can't get GRE through but since you don't use PPTP I can't be sure why this is registered in the logs. Sometimes when connecting using PPTP you have to disconnect and then reconnect for everything to work - you might try this for L2TP too.
But if you already can reach services on any LAN nodes through the VPN I wouldn't bother with it.
As you have a firewall in front of the server you need a second alias IP on the server that you can use to get at the services running on the server through the VPN. The firewall blocks all ports protocols not opened - that's why you can't use the server main IP even if the VPN is up.
The netmask is used by all nodes to determine how big your subnet is: what part of the IP number is the network number and what range the node number is in => really: should traffic be directed to a node on the same LAN or sent directly to the gw/router for forwarding.
What you can't do is connect from a NATed network to another NATed network that both are using the same network number. (That's why people should stay away from using the "default" 192.168.0.0/24 and 192.168.1.0/24 networks for VPN server LANs).
Try your settings at http://www.jodies.de/ipcalc to see what I mean.
"...lists the router as having the IP address of the XServe (rather than the router on the network). Is that normal?"
Yes. The VPN server is the VPN gw/router.
"The firewall for the 10.5.2 server is not running (but will be once I get this all working)."
If you already have a firewall in front of your servers that is a bit redundant.
"--No network routing definitions have been set up."
"I'm hoping I don't need to have the XServe run DNS as an internal LAN DNS server"
You need routing definitions if you want to setup a split tunnel VPN or all traffic is routed through the VPN when connected. The VPN becomes the default gw.
Without ipforwarding ON in the server you can only reach nodes on the server LAN - not Internet.
DNS is needed for your servers forward and reverse names/IPs for advanced services but doesn't need to run in any of your own servers.
If you decide to do a split tunnel VPN config (adding public and private routing definitions) a reachable DNS IP for VPN clients (in VPN config on server) is needed for VPN clients or they can't use names to find anything. To reach this DNS IP if public/not on your server LAN, you need your server to forward IP DNS lookups and have a routing definition for it.
A split tunnel VPN only send traffic for your server LAN through the VPN and all other traffic directly to the local gw/router (Internet).

SQL server can't access network share

Hello,
I am facing an issue where the SQL server can't access the network share. The network share is mounted by a domain user who is also configured as Administrator on the server.
Through SQL Server management studio as well as PoweShell script when i try to access the share in order to attach the database contained within the share, i get the error "Unable to find the file specified". I can't mention the network drive to
the SQL management GUI file browser too if i try to attach the database through GUI.
For all SQL services, I changed the service log on account to be the same account which mounts the network share.
As work around -
I launched a command prompt under NT Authority \ SYSTEM (LocalSystem) account and mounted the drive to the same location which lead to adding one more connection but under local system account. With this change, the SQL server was able to access the network
share!
I couldn't understand whey SQL expects the network share to be mounted under local system account even if all the SQL services are running under domain account ? I want SQL to be able to access the network share without opting for above work around.

Hello,
I couldn't understand whey SQL expects the network share to be mounted under local system account even if all the SQL services are running under domain account ? I want SQL to be able to access the network share without opting for above work around.
It doesn't have to be. The workaround is only a temporary fix and is certainly not a good idea. I would not use mounted folders with SQL Server, at all, period.
The reason you're having difficulty is that when the folder is mounted, it's mounted for YOUR session not ALL sessions. SQL Server has already started its services and is running under its' own session and is not privy to the things you do to change the
environment. For example, if you changed a system or user variable (for example, a SET variable) SQL Server would have no idea about this because when it started, that variable either didn't exist or was something else. This is not SQL Server's fault but how
Windows works (this information is stored in the Process Environment Block [PEB]) for any windows process.
As other's have said, don't use mounted drives - use a UNC path. UNC paths are 100% supported on 2012+ as well as running databases on a SMB 3.x share (UNC pathed of course).
If you absolutely must use a mounted drive, enabled xp_cmdshell access (through sp_configure) and run the net use command through xp_cmdshell. I, once again, would highly advise not doing this and using an UNC path.
-Sean
The views, opinions, and posts do not reflect those of my company and are solely my own. No warranty, service, or results are expressed or implied.

Problems with AD users to connecting to AFP share...

Hi,
I have Mountain Lion Server binded with Windows Active Directory. I have an active FileSharing too. The AD users can log to the comupter from client macs or directly on server, but can't connect AFP Sharing.
I have create a group where I put the AD users, and give the group full RW permissions to that shared folder over AFP.
Can anybody help me to eliminate my problem?

Make sure your AD users have the AFP SACL enabled. Go into Server.app/Accounts/Users for your AD user. Select menuItem 'Edit Access to Services...' and check the service checkboxes of the services you want your AD users to access.

User can't access afp shares

Similar Messages

Maybe you are looking for