Windows users - "Access Account" gets disabled by server every night?!?

I have an OS X Server 10.4.7 on a new Mac Pro in our office. All of my windows users connect to a basic Windows fileshare using the server's IP, then I map the network drives, so they should auto connect. I connect the users, verify the connection, log out, log back in, the drives re-connect like normal. However, TWICE now, I verify that thye all work, then the next morning (or over the weekend), it's like the OS X Server disabled everyone's accounts, except mine (i'm an adminstrator account). Nobody can get to their shares, and all the "Access Account" checkboxes on all my users are unchecked.
I have Open Directory set as an OD Master, with default policies.
Under Windows I have it set as a PDC (I'll migrate my old domain accounts once I have the server working, unless this is my whole problem)
I disabled the file share of "users", but I can't see why that would be my problem. It works until overnight, seemingly.
Ideas?

System.log has thousands of these:
Sep 18 07:47:32 Genesis1 kernel [0]: (11997: ps) ftp: failed on 0:
asl.log has a bunch of these:
[Time 2006.09.18 17.29.48 UTC] [Facility daemon] [Sender DirectoryService] [PID 63] [Message Failed Authentication return is being delayed due to over five recent auth failures for username: anish.] [Level 1] [ UID -2] [GID -2] [Host Genesis1]
The only thing I've set up on any machine is network drive connections, and I manually entered names and passwords. Not sure if XP is doing anything else on its own.
- Bill

Similar Messages

SYSTEM user's accounts get locks automatically

Oracle SYSTEM user's account gets lock automatically after every 4-5 days. I user to run following query which unlocks the account:
SQL:\>ALTER USER system ACCOUNT UNLOCK;
How I can stop this happening? I am not able to alter profile for unlimited attempts also.
Is there any workout, please help me....

In my opinion, you should immediately find out who constantly tries to guess the password of system instead of making it possible for him to try that indefinitely without locking the account. That is like switching off the annoying alert sirene if someone constantly tries to break in.
You should
SQL> connect sys/oracle@prima as sysdba
Connected.
SQL> alter system set audit_trail=true scope=spfile;
System altered.
SQL> startup force
ORACLE instance started.
Total System Global Area 313860096 bytes
Fixed Size                  1299624 bytes
Variable Size             285215576 bytes
Database Buffers           20971520 bytes
Redo Buffers                6373376 bytes
Database mounted.
Database opened.
SQL> audit session whenever not successful;
Audit succeeded.
SQL> select count(*) from dba_audit_trail;
COUNT(*)
         0
SQL> connect system/wrongpw@prima
ERROR:
ORA-01017: invalid username/password; logon denied
Warning: You are no longer connected to ORACLE.
SQL> connect sys/oracle@prima as sysdba
Connected.
SQL> select count(*) from dba_audit_trail;
COUNT(*)
         1

Authenticate windows users accessing os x client using open directory?

I need to setup an OS X client machine (10.4.6) so that windows users (XP) can access folders based on their open directory credentials. (Using OS X server, open directory, windows PDC). If I turn on windows sharing in system preferences on the mac, it will only share local home folders to users with local accounts - not what I need. Any ideas? thanks.

Thanks! So now I see Open Directory, but it seems like it should be listed under the Server app with all the other services...
Anyhow, I seem to remember a way to administer the users and groups. This app shows me the status of the services, logs, settings. The Server app, if I click on Add Users button, then click "connect to it" to supposedly connect to the directory server, it won't take my credentials. I always get "Cannot authenticate to server. Please authenticate by entering the name and password of a user account in this server's directory."
Connect anonymously doesn't seem to do anything, it doesn't even dismiss the dialog.
So what am I missing?

Pwpolicy -- how to determine if a user's account is disabled?

Hi all...
For my user accounts, I have the accounts set to disable after 180-days of non-use.
I'd like to be able to determine which accounts *have been disabled* because of this. Graphically, I can only see this in WorkGroup Manager when a user actually tries to log in to their account and it fails because of this -- then the user gets an "X" next to their name in WGM.
But this "X" doesn't appear unless the user tries to access his/her account.
For example, here's the policy on my account:
For example, here's my account
pwpolicy -getpolicy -u maser
Getting policy for maser
newPasswordRequired=0 maxMinutesOfNonUse=259200 maxChars=0 usingHistory=0 isSessionKeyAgent=0 isComputerAccount=0 maxMinutesUntilDisabled=0 requiresAlpha=0 hardExpireDateGMT=01/01/70 minutesUntilFailedLoginReset=0 requiresMixedCase=0 passwordCannotBeName=0 requiresSymbol=0 expirationDateGMT=01/01/70 notGuessablePattern=0 canModifyPasswordforSelf=1 maxFailedLoginAttempts=0 minChars=9 usingExpirationDate=0 requiresNumeric=0 maxMinutesUntilChangePassword=0 usingHardExpirationDate=0
This shows me that 259200 minutes (the default) will be when my account is disabled from maxMinutesOfNonUse -- but nothing about how long it's been since I've used my account.
Is there a terminal command which will show me which accounts have been disabled?
And/or a command that will show my how many "MinutesOfUse" an account has (meaning how long it's been since a user connected to my server)?
Thanks!

Hi all...
For my user accounts, I have the accounts set to disable after 180-days of non-use.
I'd like to be able to determine which accounts *have been disabled* because of this. Graphically, I can only see this in WorkGroup Manager when a user actually tries to log in to their account and it fails because of this -- then the user gets an "X" next to their name in WGM.
But this "X" doesn't appear unless the user tries to access his/her account.
For example, here's the policy on my account:
For example, here's my account
pwpolicy -getpolicy -u maser
Getting policy for maser
newPasswordRequired=0 maxMinutesOfNonUse=259200 maxChars=0 usingHistory=0 isSessionKeyAgent=0 isComputerAccount=0 maxMinutesUntilDisabled=0 requiresAlpha=0 hardExpireDateGMT=01/01/70 minutesUntilFailedLoginReset=0 requiresMixedCase=0 passwordCannotBeName=0 requiresSymbol=0 expirationDateGMT=01/01/70 notGuessablePattern=0 canModifyPasswordforSelf=1 maxFailedLoginAttempts=0 minChars=9 usingExpirationDate=0 requiresNumeric=0 maxMinutesUntilChangePassword=0 usingHardExpirationDate=0
This shows me that 259200 minutes (the default) will be when my account is disabled from maxMinutesOfNonUse -- but nothing about how long it's been since I've used my account.
Is there a terminal command which will show me which accounts have been disabled?
And/or a command that will show my how many "MinutesOfUse" an account has (meaning how long it's been since a user connected to my server)?
Thanks!

AD ACCOUNT GETTING DISABLED ALL THE TIME

Hi all,
Helpdesk has reported that user account get's disabled all the time & they have to enable it.
What could be the cause of this & how to troubleshoot.

Hi all,
Helpdesk has reported that user account get's disabled all the time & they have to enable it.
What could be the cause of this & how to troubleshoot.
Remove the help-desk access to user objects and see if it gets disabled again or not. :)
If you have third party tools which manage user accounts, review their configuration. FIM for example is one of the tools that has authority to disable/enable the accounts. Also If I had no clue what is going one I would enable auditing on user objects and
filter my security event viewer for user changes to see who is disabling them.
AD DS Auditing Step-by-Step Guide
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Enabling end - user access in Sun One Web Server 6.1 SP2

Hi,
I am new to Sun One Web Server 6.1 SP2 and I can't figure how to enable the end user access so that the end users can change their password.
On iPlanet 6.0 SP2, in the Distributed Admin page, I could enable Distrubuted Administration as well as end user access on the webserver. The end users could then change their own password. I can't find a similar feature in Sun One Web server 6.1 SP2.
Could anyone out there tell me how to get this done?
Thanks in advance!

Hi,
I just found from release notes that End user administration feature (which was under Distributed Administration ) is no longer supported in Sun One Web Server 6.1. [Problem ID 4865295 in release notes]
Could anyone provide a workaround to get over this and allow the end users to change their passwords?
Many thanks in advance,
auporna.

Windows Users Accessing Public Folder

I would like to know the way to allow Windows users to access only the Public folder on my mac.
When I try to access folders from Windows I go to My Network Places and click on the icon representing my Mac then I'm prompted for a password; as I have only my account on the Mac I have to put my user ID and password, thus allowing access to all my folders - not only Public.
I know that Mac users can access Public, but how to allow the Windows camp to do that?
17' PowerBook G4 Mac OS X (10.4.4)

SharePoints is a great tool to allow access to peripheral drives, volumes, and the like. But you shouldn't have to use it to access the Public folder via a PC as you can a Mac. That is a very big question on the boards that has yet to be answered.
Apple says it happens. If so, what's the secret to accessing the Public folder via a PC.
Any information will be greatly appreciated.

Accounts getting disabled after enabling password expiration on BOXI R2 SP2

Hi All,
We have a strange issue with our production environment.After enabling password expiration on the enterprise some accounts got disabled,on further investigation I found that these users were either trying to log on to Designer or 2 tier Deski.
I made them login through the Infoview to fix the issue.These users were Universe deginer or report writers.
Any Suggestions

Hi Tim,
These accounts are Enterprise accounts,according to the users they were not given a chance and they never got any prompt for the password change it was disabled directly at the first login.
These people were trying to logon using the Desginer or 2 Tier DESKI login and they are the members of the Administrtor Group also.
Is it important to logon to infoview or 3 tier DESKI to change your password?
I have no answer to give them why there accounts were disabled.
Please suggest
Thanks,
Arun

I keep getting a restart box every night to install the new Firefox. Why do I keep getting this box if it's already installed?

I've already installed the new Firefox, but every night, I keep getting a box that asks if I want to restart Firefox to install the new version. This happens all the time. Why am I getting this box if it's already installed?

Thanks for getting back to me; i was not able to get to the computer until now.
No, not thru web access; it is via the Outlook provided thru Microsoft Office.

Two Windows users accessing the same Datebook (Palm Desktop)

I have a Vista machine that has Palm Desktop 6.2 installed. My wife sometimes needs to access the calendar to add dates, etc. I set up the Vista machine for remote desktop and gave her an account so that she doesn't kick me out of my session. When she launches Palm Desktop, she can only create a new user/profile, not access the one that's already there. How can I accomplish this? Thanks!
Post relates to: Zire 31

Palm desktop doesn't support the fast user switching thus the problems you are running into. I think the closest you are going to get to in order to share this data is a program called SyncUs.
They have a current version that is in beta that is compatible with Palm Desktop 6.2 if that is something you want to give a try.
http://www.syncus.co.uk/
Post relates to: Centro (Sprint)

Windows Users can no longer connect to Server

I have an Xserve configured to share via AFP and windows. It is running Open Directory as an Open Directory master. It is connected to a Windows Network that is worldwide, running in a specific subnet and domain. Recently, all the users I have configured on the machine have been migrated to a new Active directory server for their email accounts. I can connect and authenticate against the open directory using AFP, but can not connect using windows file sharing from a Windows computer, nor can I connect using SMB from a mac. Shouldn't the users be authenticating against the Xserve when trying to connect or is it passing off the authentication to another server? Do I need to move the Xserve to the new domain? (in other words, do I have to change its FQDN? )
thanks in advance,
Mike
XServe Dual 2GB G5 Mac OS X (10.3.4) Windows Domain member

I just had this same problem on my server. The only difference is it is an Xserve insted of a Mac Mini.
I restarted the whole operating systems and that appeard to have fixed the problem but I do not know what I cause was.
Did you figure anything out?

Windows Users Connecting to a OS X Server

We are running into a issue with our Window's users. We have a FileMaker database that we use as a PDF proofing system. All of the PDFs in FileMaker, are links to the actual PDFs that are stored on one of our shared drives. The Window's users have to have the share point mounted for FileMaker to allow them to export the PDFs from it. The problem is, we don't want the users to be able to open the server and view every single PDF since a lot of them are concept designs. Is there a way of locking down the server to only allow the access for FileMaker? This has become a big issue and I'm racking my brain trying to think of a solution. Thank you in advance for any help.

Find out the IP address of the server you want to connect to. You're looking for a numeric address: something like 123.56.67.89. You can find this out by running Server.app on the server and looking at the details of that server itself.
When you start up Server.app on another computer choose the option to administer another computer, not the one Server.app is running on.
When it asks for an address, type in the numeric address as shown above.

Windows Users Can't Get My Site.

I'm new to iWeb. But not new to the wonders of the Mac.
I recently used iWeb to create and publish a web page.
It all looked fine when I viewed it.
But friends I send the link to tell me they cannot get there.
This is what they send back to me:
THIS IS WHAT I GET WHEN I TRY TO ACCESS THE SITE:
but we can't find the iWeb page you've requested. It's possible that:
·The address was entered incorrectly. Check your spelling and try again.
·The .Mac member of this name has either created a page and removed it or has never published an iWeb site.
·There is no .Mac member of this name. If you'd like this member name for yourself, sign up for a .Mac account right now and have your own iWeb site in minutes.

Hello and thanks to all.
I am using the address as suggested by James. And I have since asked another friend, with a Mac, to check it out and it's coming through fine for her. The other factor might be that the first person is on a dial-up connection. So I'm guessing either dial-up, or a older windows computer is the problem.
This is what I have sent.
http://web.mac.com/geo23
It works fine for me.
But what my friend gets is what looks like the banner on the apple site with all the links to various places, such as the Apple Store, .Mac, Quicktime, Support, etc. But it is broken up, incomplete. Then below that is a short list of reasons why she is not getting to the site, such as:
We can't find the iWeb page you've requested. It's possible that:·
The address was entered incorrectly. Check your spelling and try again.
The .Mac member of this name has either created a page and removed it or has never published an iWeb site.
There is no .Mac member of this name.
Then more of the same but in several different languages.
noodlehead confoun..ddeD

When a win7 users accesses a file on the server the permissions on the file revert to read only.

Hi there,
Originally my enviroment was 100% Mac, but now we have merged with another company who are all PC users.
The issue I'm having is when a Windows 7 client accesses a file on the Snow Leopard server the file becomes Read Only, and I have to manually propergate the permissions to fix it. This isn't an issue with XP users.
So far this is only happening with Excel files.
Is anyone else experiencing this issue? Any help would be greatly appreciated.
Cheers,
J

I'm having a similar issue as well. Excel 2007 appears to be the culprit, but hard for me to say. Running 10.6.8 here as well.

Windows User Access

We have recently merged with a company that is on Windows. We are total Mac with OSX server. iCal seems to work OK for the Mac people but the Windows people are having nothing but problems. We set up browser based access for them off of the server where iCal is active and they get a spinning sprocket in the middle of a gray screen. We have tried Google, etc. Is there an easy way to bring in our new workers, misguided though they are:-)?

itz quite urgent ....can any1 gimme an idea as to how i should go about it...pls...itz a request

Windows users - "Access Account" gets disabled by server every night?!?

Similar Messages

Maybe you are looking for