User Details View

I would like to know if there is any way to show "Pwd Not Expire" Column in User View.

I have enabled "Pwd Not Expire" Column in User Details on Display Mode. But I can not see it in any User views.

Please Help!

[cmccullough]

Re: User Details View

If this is for a Windows NT domain, you will right-click on Users and choose View All User Details.

For a Windows 2000 Domain, right-click on All Users and choose Tabular->Views->Users Detailed(General). In the right window look for a column titled Roles. For users that have this set you will see NO_PWDEXP in that column.

If you don't see the Roles column when you do this, post back and I'll give you instructions to add it.

Re: User Details View

Thank you very much cmccullough. I got it.

[je79ayps]

Re: User Details View

Is it possible to do the same in the left tree menu? I just upgraded to v5.7 from v4.3 and miss that feature.

[kstanush]

Re: User Details View

For Windows NT domains, the left tree window view for all objects is not user-configurable.

For Windows 2000, you can modify the view of the left tree window for Active Directory objects under File->Manage Object View->Queries. Select the object type, then modify the DEFAULT Tree Window display (or both window types).

Test by adding/removing one field until you understand the terms used in the GUI.

[je79ayps]

Re: User Details View

OK, under "All users" I have "Pre w2k name" and "Display name" as "users summery" and that's allright. I can only have 2 things right?

But how do I change the info that appears when I choose to expand the user (pushing the +")?

Currently I have the following:
- Groups
Display Name
First Name
Directory Name
Last Name

I would like to change this to other things - like "last log off" - still this should be in the tree menu.

[kstanush]

Re: User Details View

That's right, you can only have two elements visible in the tree (left) window. The query can contain more fields, but Hyena will only show the first two. In fact, if you reduce the query to just two fields it will optimize performance as fewer fields will be retrieved from AD.

Someone will get back to you on what builds the fields that you see when you click the plus sign under a user.

[cmccullough]

Re: User Details View

You should be able to accomplish what you are wanting to do by following these instructions:

Go to File->Manage Object View->Queries
Change the Query Type to Active Directory User
Click New and enter a Query Name of: User (Summary)
Display Format is Listing, and Default Window is Tree (left)
Click OK to save this
Click on this new query in the Current Queries window
In the lower right click on Directory Name and click Add, then Display Name and click Add
To add Member Of, change the Attribute Category to Group Attributes

Once you've added the fields you want click OK to save, then expand a user and let us know if that works.

[je79ayps]

Re: User Details View

Thanks - that worked like a charm!

One thing, is it possible to view if an account is locked out in the tree menu?

[cmccullough]

Re: User Details View

I don't see anyway that you could add that one as it is not an AD field.

[kstanush]

Re: User Details View

Find an account that is locked out and look at its lockouttime attribute. You can add that to your query but it might be hard to use it that way.

[je79ayps]

Re: User Details View

cmccullough >> what do you mean?

kstanush >> thanks - that'll do. I just think that in ver 4.3 we actually had a field saying "accound locked out" in the tree menu.

Re: User Details View

In looking at the ROLE column in the Detail view, most of the entries are self explanatory.


DISABLED = the user account is disabled
NO_PWDEXP = the password is set to never expire

But I see one that states LOCK. I have looked at the account it is NOT locked out. What does this mean? What are the possible entries?

[kstanush]

Re: User Details View

This is a bug/limitation in Windows, and we are unsure whether to show the lockout bit setting, or hide it. If we hide it, and if Microsoft fixes it in the future, it will again be misleading. The LOCKOUT bit is set in the useraccountcontrol for this user, probably because the account was locked out at one time. It might clear itself if a user logs on.

There is a KB article Q250873 that explains this in more detail. The problem/bug has been around for some time.

In general, you need to use the LockoutTime attribute to see if the account is locked out.

Re: User Details View

Thanks for the QUICK! reply. I was checking the lockout time column also for locked accounts, that was what was confusing me when they didn't agree with each other.

Are there other parameters other than those we have discussed that would be of benefit to check for?

Thanks again for the help!! I LOVE HYENA!!