Volatile User / Sids / Permissions

Zen 3.2 / XP workstation / Policy Package with DLU enabled, manage
existing, use edirectory credentials and volatile user, roaming profiles:
Problem:
When viewing security/permissions on any files or folders created by the
user or by an application being used by the user on the local drive, they
end up with an unknown account (S-1-5-21-4226715 etc)after subsequent
logins. I assume this is due to the volatile user setting because each
time the user logs in, workstation manager actually creates a new account
and therefore new sid. I could live with this, although it's unsightly and
sloppy. But the real problem is that the user loses rights to files upon
subsequent logins. We are using the default ntfs xp security group
permissions on the drives.
We have lots of older type apps that generate temp files, etc so losing
permissions is a problem. I don't want to just set everything to run as
unsecure user unless I absolutely have to.
Anybody else have this problem? I suppose I could just remove the volatile
user setting but then I fear I'll have another set of problems to deal
with because users will end up logging in locally and have none of their
zen stuff!

Tried uphclean ?, see TID 10096547
Cheers Dave
Dave Parkes [NSCS]
Occasionally resident at http://support-forums.novell.com/

Similar Messages

BRTOOLS errno 13 when logged in as user sid adm

Hi,
Just upgraded to 7.2 (14) BRTOOLS, Netweaver on Oracle/UNIX platform.
My brtools open when I'm logged in as ora<sid> user, however they fail with permissions on the Oracle directories when I try and run brtools as user <sid>adm.
I've verified the file permissions against a known working instance on the br files and they are matching.
The error I get is below, I know it must be file permissions somewhere, can someone advise, thanks.
hneccscd01s:s02adm 4% brtools
BR0651I BRTOOLS 7.20 (14)
BR0252W Function stat() failed for '/oracle/S02/saptrace/diag/rdbms/s02/S02/trace/alert_S02.log' at location BrFileStatGet-1
BR0253W errno 13: Permission denied
BR0273W Determination of file status for /oracle/S02/saptrace/diag/rdbms/s02/S02/trace/alert_S02.log failed
BR0252W Function stat() failed for '/oracle/admin/S02/adump' at location BrFileStatGet-1
BR0253W errno 13: Permission denied
BR0273W Determination of file status for /oracle/admin/S02/adump failed
BR0252E Function fopen() failed for '/oracle/S02/112_64/dbs/initS02.ora' at location BrInitOraRead-1
BR0253E errno 13: Permission denied
BR0158E Error reading Oracle profile /oracle/S02/112_64/dbs/initS02.ora
BR0280I BRTOOLS time stamp: 2011-08-26 15.01.42
BR0654I BRTOOLS terminated with errors
Cheers
Richie
SAP Basis

Hi Richie,
Are the environment variables properly set for <sid>adm and ora<sid>?
Try to see if the dot (.) profiles in the home directories of <sid>adm and ora<sid> are consistent.
Also, as ora<sid> recursively change the permissions for /oracle/S02/saptrace to 755 [chmod -R 755 /oracle/S02/saptrace]
Also check the permissions of brtools executables in the /sapmnt/<SID>/exe on the database server.
Normally, they should be something like shown below.
-rwxr-xr-x 1 <sid>adm sapsys 1578637 Feb 20 2011 brrestore
-rwsrwxr-x 1 ora<sid> sapsys 2303924 Feb 22 2011 brtools
-rwsrwxr-x 1 ora<sid> sapsys 4178065 Feb 24 2011 brarchive
-rwsrwxr-x 1 ora<sid> sapsys 4284895 Feb 24 2011 brbackup
-rwsrwxr-x 1 ora<sid> sapsys 5527676 Feb 24 2011 brconnect
-rwxr-xr-x 1 <sid>adm sapsys 4587371 Feb 24 2011 brrecover
-rwxr-xr-x 1 <sid>adm sapsys 5679668 Feb 24 2011 brspace
Br,
Venky.

Users and permissions for a small home server

Hello community,
I have been using Linux on the desktop for many years now, but unfortunately my knowledge about servers is very limited, almost non-existent. Therefore my question is most probably equally well fitting here and into the newbie corner.
I'm trying to set up a little home server which should be in charge of following tasks:
- CUPS print server in the local network
- access to shared files through NFS in the local network
- backup (again over NFS)
- an Owncloud server
- maybe a mail server in the long run (NSA, paranoia, etc. )
For now I have set up the print server, the NFS server and was working on the Owncloud installation, when Owncloud gave me some errors with users and permissions. So I was led to the idea of rethinking the users and permissions on server. So far there is only the root user who may do everything. This seems like a quite unsafe configuration. I'd like to make it safer. First, the printer, the backup and the locally shared files should be accessible from the local network only. SSH access should also be accessible locally only. The Owncloud file folder should be accessible from the internet, but of course only for the Owncloud users registered to the Owncloud server.
What is the best way to set up users and permissions for such a set up?
Thanks for any hints,
PhotonX

Hi, i think it depends who are you serving for, if you are just serving for a small office or home server or a big organization. The following quick thinking just came to me:
I think cups set automatically a system user of its own, and runs as it, so no trouble there. Cups also has the option to set users and it uses the system users as default, i think it depends in in how many printers/users your have in your server.Users that can manage cups are in the lp group.
For nfs every user should have their home, samba is also a good option if you have windows computer in your network and it integrates better with graphical file managers like nautilus in the clients side, but it is a hassle to configure.
You should run the web server (owncloud ) as it own user, maybe you can manage to set something up for owncloud in the filesystem, but owncloud uses a database, and the users for owncloud are stored in there, and they are not system users.
You can configure ssh for local use only enabling the corresponding subnets in your /etc/sshd.conf and optionally but recommended you can set a firewall and permissions. You can use iptables but i prefer ufw for simple setup.
I think you should read the wiki:
https://wiki.archlinux.org/index.php/users_and_groups
and the other respective topics in the wiki.
Also as an advice i know that arch linux is a great distribution, but you have to do more work to mantain a stable server. I would recommend debian or another more conservative distro, but of course it is your choice.
Last edited by hydrosIII (2014-11-06 06:26:45)

Volatile user

Hello, We have has a long term issue where local accounts are not removed after users logout. I have changed to Volatile user which is set for a two day time period, I have checked the local logins on some of our machines and user accounts and their respective files are not removed from the local machine.
When a user logs in again to a machine the local profile is used, which is sometimes broken (as it looks as if it has been successfully cleared) which the corrupts the profile on the netware home drive causing a domino effect. The only solution we have at the moment is to net user /delete the local user and clear the profile on the home drive.
Can anybody assist in correcting this issue.
Server: sles11.1 zenworks 11.2
Pcs: Win 7 32 bit, agent 11.2 Client 2sp2 ir2, DLU & Roaming Profiles
User home drives: mixture of nw65sp8, sles11.1 oes11
(I have posted before and commented upon other threads, now a new sp and client ir have been released I thought I would obtain the views of the forum again.)
Thanks
Breezer

Originally Posted by breezer
Hi Leroy,
We have tried everything.
What we do know is that profiles are corrupting when the are copied back from the windows 7 machine to the network. This is now happening for the majority of staff and students using windows 7, we are continually resetting profiles on the local machines and the network.
symptons
black screen, instead of normal background (machines are licensed)
groupwise not working due to registry permission issues.
login script not running so no access to directories
no delivered zen icons or bundles
user desktop icons not delivered
zoomtext not working
jaws losing its licence
not able to remote control/view machine with zenworks tools
Part of the user profile is left behind
c:\users\USERNAME\AppData\Local\Temp - .tmp files
c:\users\USERNAME\AppData\Roaming\ - various files
fix.
1. Remove user in System properties - Advanced - there are sometime 4 or 5 'unknown' users listed here, these are deleted as well.
2. net user delete /USERNAME
3. manually delete c:\user\USERNAME
4. copy fresh windows nt 6.1 ..... to their home directory.
Does anyone have any solutions as this is seriously effecting our users.
Breezer
Hi Breezer,
what is "fresh windows nt 6.1" do you generate a default Profile with the Sysprep/copyprofile method?
Ive never used Roaming Profiles but as far as i know the usual way the roaming Profile would be created based on the default profile an a machine the first time the user logs on. never heard about preloading one into the user homedir.
I was told that "login script not working" will be fixed in IR3 foer Novell Client. Login Script will not run if the Profile is guest or mandatory.
When the "black screen" profile appears is it a TEMP Profile?
ist there a remaining key under
HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\SID?
Profile State of 128 = Guest
List of Profile states:
VBScript - Meaning of values under HKLM\SOFT....\ProfileList Key
I never used Romaing Profiles in the past (except testing for for small groups)
I think there are 2 seperate cases:
1. Workplace = 1 user, 1 computer, simply use local profile
2. public PCs (student labs) =
* many users per computer
* definition: any logon is a new users logon
* use mandatory/default profiles (roaming profiles to hard to manage)
regards
MArkus
p.s. google delprof.exe and delprof2.exe

Volatile users and Groupwise settings

OES2, Groupwise 7.1. Win XP on the workstations.
We're starting to use a volatile user policy on a few of our computers and have run into a snag. I need to turn off Integrations under the Documents Setup in Options.
Since the policy is creating new profiles all the time, Groupwise doesn't retain this setting. I've looked at the Client settings under C1 and don't see anything that can help.
Anyone know of a network side setting for Groupwise changes?
Thanks,
Sam

SS ISAdmin wrote:
> Ok, I placed an SR on this and found that the reg key is located in
> HKCU\Software\Novell\Groupwise\Client\Library.
> There are a host of other options in the Client folder but since it is
> the Current_User segment, it'll be different for each user.
> Since this a 24 hour volatile user, and the user profiles are created
> every day, I had to find a way to make the Reg changes happen for all
> users regardless of whether they'd logged in before.
> Ended up exporting the relevant keys and making a batch file to run on
> startup for all users.
> Works so far...
>
>
I don't do volatile profiles, but can't you assign it to Default User
and have stuff be merged in?

How to find out the oracle level user(sid) who is updating the table?

Hi everyone,
I am creating a update trigger which is to look for the user (sid) who is updating the rows in this table. Is there any lower level dynamic view or table I can use to find out the user?
Thanks for any help.
Jun

Hi, please repost this question in the Database section under the SQL & PL/SQL discussion forum
PL/SQL
thanks - OTN

SharePoint 2013 - Site Settings - Users and permissions - "Access Request and invitations" link missing

I am site collection administrator and have configured the outgoing email in Central administration but "Access Request and invitations" link is missing, pl advice any additional configurations for this link to show up
I was though able to configure access requests by going to Site Settings->Users and permission and on the ribbon selected "Access Request Settings"
What is the difference in either of the approaches?
Thanks
Abhishek

Hi there,
I noticed this post, and didnt really find an appropriate solution to your issue. I noticed the same issue when dealing with Access Requests. First of all to make sure that the Request feature is enabled, you need to access
Site Settings -> Site Permissions -> Access Request Settings -> Make sure the
'Allow access requests' option is enabled.
The Allow access screen just allows you to enable the feature and also to specify a email address that notifications are sent to. Whereas the 'Access Requests and Invitations' section provides a screen to manage Access Requests and request history.
I noticed then that the Access Requests and Invitations link under 'User and Permissions' didnt actually appear until someone actually requests to join the site. It seems that this is needed to display the screen. Once actioned once, the option stays there.
Hope it helps

JSPM phase error : admin/user/SID does not exist

Hi ,
There is an error message while opening the JSPM
Phase error report:
"cannot read secure store properties .could not set up secure store.property admin/user/SID does not exist.msg.util.dyn.0003.com.sap.security.core.server.secstore.secstoreFS get string value
com.sap.security.core.server.secstore.secstoreFS.Not found exception could not find a record key "admin/user/SID" in the store com.sap.security.core.server.secstore.secstorefs"
checked the config tool secure store and found no entry maintained for /admin/user/SID.
How to add the new entry in config tool and what is post entry procedure
Thanks a ton

Hello Daniel,
You can maintain the Administrator user in secure storage using the config tool.
By default, the value for this config tool property is user Administrator. However, when using the ABAP Engine for persistency, this user is J2EE_ADMIN.
Following are the steps:
       1.      Start the Config Tool.
       2.      Select secure store.
                The configuration for the secure storage in the file system appears.
       3.      Select the key admin/user/<SID>.
       4.      Enter J2EE_ADMIN in the Value: field and choose Add.
       5.      Select the key admin/password/<SID>.
       6.      Enter the password for J2EE_ADMIN in the Value: field and choose Add.
       7.      Save the configuration.
The corresponding link is mentioned below:
http://help.sap.com/saphelp_nw04/helpdata/en/ae/b7ceff3e40fd42be3a6503236f9746/content.htm

Word 2007 and volatile user

Guys,
I did not know where to ask. We use volatile user and I have a problem with word 2007. I can't get word to hold the settings, toolbars etc. I was able to change normal.dotx, and that's fine in regards to the page formating, but I can't make word 2007 to remember its layout. I even copied the profile to the default profile, which worked with word 2003. Please advise. Thank you.

Jakub,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Do a search of our knowledgebase at http://support.novell.com/search/kb_index.jsp
- Check all of the other support tools and options available at
http://support.novell.com.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://support.novell.com/forums)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://support.novell.com/forums/faq_general.html
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

I have a Win7Pro SP1 PC locked down with a Group Policy as it is a public facing PC. PDF fillable forms cannot be completed when logged on as the restricted user. The forms work as a normal user. What are the user requirements/permissions needed to fill f

I have a Win7Pro SP1 PC locked down with a Group Policy as it is a public facing PC. PDF fillable forms cannot be completed when logged on as the restricted user. The forms work as a normal user. What are the user requirements/permissions needed to fill forms?

Well, try this (I was able to fix my with these steps):
Go Utilities > Disk Utility
Select your Startup Disk, e.g. Macintosh HD
Then, under the First Aid Tab, click Verify Disk Permissions.
If there are errors, then click repair Disk Permissions.
After it is done, restart the computer and see if your problem is resolved.
I hope this help.
Zeke
www.ZekeYuen.com/blog/

End Users Side Procedure

Hi All,
I am new to this Forum. We are experiencing lot of problems everyday. I am an End User. Dont know i am at right place or not.
We are using Unity Software by J.D.Edward.
Can you please explain me the Daily Sales Order Report process for end user side?

Hi,
Did you automatically create BPs using DSWP.
To be able to identify the key user in all systems that are connected to the SAP Solution Manager, you need to supply the following ID numbers (in the role, tab) in Transaction BP.
CRM001 <System ID> <Installation Number> <Client> <User Name> (separated by a space, for example, XYZ 1234567890 800 DEMOUSER).
Hope this will solve your problem.
Feel free to revert back.
--Ragu

Active Directory: how to return users account permissions RWDA?

In SCS 7.x
I`v been looking throught idoc functions and couldn`t find one to return the users account permissions when they log in with active directory..
How is this done..
I`v noticed they added the code in 10g..
<$userHasAccessToAccount("profile_account", "R")$>
Thanks.
Update:: I ended up just writing my own function that called a service returned AD info split the string and matched it against the account to return 1 = R, 2 = W, 4 = D, 8 = A
R = 1
RW = 3
RWD = 7
RWDA = 15

In SCS 7.x
I`v been looking throught idoc functions and couldn`t find one to return the users account permissions when they log in with active directory..
How is this done..
I`v noticed they added the code in 10g..
<$userHasAccessToAccount("profile_account", "R")$>
Thanks.
Update:: I ended up just writing my own function that called a service returned AD info split the string and matched it against the account to return 1 = R, 2 = W, 4 = D, 8 = A
R = 1
RW = 3
RWD = 7
RWDA = 15

Volatile User's not being removed

We have a DLU policy that has volatile user implimented. I have been
noticing that sometimes, the user doesn't get deleted and they have a
folder in C:\documents and settings\ and their username still exists in
the windows user management console, which causes problem with the user
not being able to logon later on. It says "Account created by Novell
Zenworks" in the description box besides the user name also.
What causes this and is there anyway we can fix it so that volatile user
works everytime?
We are running Netware 6.5 servers and Zenworks 6.5.

Tried uphclean ?, see TID 10096547
Cheers Dave
Dave Parkes [NSCS]
Occasionally resident at http://support-forums.novell.com/

Recent files and volatile user

Hello:
We use a volatile user with Zenworks 6.5 so the list of recent files gets wiped off once a user logs out. Is there anyway to change that? We would like to still use a volatile user accoutns, but we would also be able to keep the list of recently opened files so the user can use it after they log off. Thank You.

Jakub Gorecki,
> We use a volatile user with Zenworks 6.5 so the list of recent files gets wiped off once a user logs out. Is there anyway to change that? We would like to still use a volatile user accoutns, but we would also be able to keep the list of recently opened files so the user can use it after they log off. Thank You.
You can move the location of "recent" through the registry. Move it to the user's home directory.
http://support.microsoft.com/kb/242557
- Anders Gustafsson, Engineer, CNE6, ASE
NSC Volunteer Sysop
Pedago, The Aaland Islands (N60 E20)
Novell does not monitor these forums officially.
Enhancement requests for all Novell products may be made at
http://support.novell.com/enhancement
Using VA 5.51 build 315 on Windows 2000 build 2195

Which type of requests can send by the user side insupport project

hi all,pls send some issues from user side in suport project with complete solutions for all.it will be very helpfull for me.
thank you.

Hi,
you can get diffrent issue,
1. data loading issues.
2. change request ofr new reports. suppose you client is haing 10 uniot of measure, and all reports are based on kg now due to business requiremnt they want o use all units in one reports so they may raise a new change rewquest for implementing the same.
3.you may incidents like date convertion issue.
e.g
if a routine has been written without considering leap year then you may get a change request for correcing the routines.
hope this helps
br
santosh

Volatile User / Sids / Permissions

Similar Messages

Maybe you are looking for