Unable to Unlock User Accounts or Reset Passwords

[Guest]

I am experiencing odd behavior from Hyena while in the properties of a user account. I am not sure this ever worked.

Scenario: A user attempts to login incorrectly 5 times. The user account is then locked out for 30 minutes.

I can use hyena to see that the users account is locked but if I try to unlock the account with Hyena I get "Unable to save Active Directory data. Access is denied. --Extended Error --- LDAP Provider : 00002098: SecErr: DSID-03150A45, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0"

I am aware that the error message is a rights issue but there is no rights issue in AD.

Here are the facts:

- This issue only happens when I am in the properties for the account and try to “uncheck†the box that reads “Account Locked Out†or I try to change the password from the General tab of the properties page. If I right click the user from the “All Users†list and choose “Account Functions > Reset Password or Unlock Account it works fine.

- The user account that I run hyena from is a member of the Helpdesk Operators group. This group has been delegated the rights to read/write lockout time in AD.

- This user account CAN unlock a user account with ADUC (dsa.msc) from a Windows XP workstation as himself logged onto the domain (not using runas)

- The account in question is NOT a member of any administrative groups. It is just a domain user, set up for testing this problem.

- This has never worked in Hyena and I want to see if we can get it working.

Please advise.

John

P.S. Also just realized that Hyena is not refreshing AD data. 30 minutes has passed since the test account was locked out and is now unlocked in AD. Hyena still shows the account as locked. I closed Hyena multiple times in an effort get it to refresh and it did not work. What's up with this application?

[cmccullough]

Re: Unable to Unlock User Accounts or Reset Passwords

Making changes from Hyena's user properties also requires that you have the ability to write to useraccountcontrol. There's no way around that, so we added the right-click options for the more popular functions. As you've noted, these work for you due to the fact that you have been delegated these rights.

The solution is to either use the right-click options, or get them to give you the ability to write to useraccountcontrol as well.

As far as updating data, Hyena reads information real-time from AD. There is nothing to "refresh" on Hyena's side. Hyena reads data from a single domain controller, though. So, if all of your domain controllers haven't been updated yet, you may see different information in Hyena than from ADU&C, for example. Once your controllers sync, you'll see the same data in Hyena.

[kstanush]

Re: Unable to Unlock User Accounts or Reset Passwords

A couple of things to add to what Chuck wrote above:

- In addition to using the Account Functions to unlock an account, you can also access the Shell Properties, which will give you the same dialog as ADU&C, and its unlock should work as usual with delegated rights.

- The unlock checkbox that you see in Hyena's user account properties dialog comes from a reading of the 'useraccountcontrol' AD attribute, whose updating by AD may not reflect in realtime whether the account is actually locked out or not. It will eventually reflect the correct state, but may actually get updated when the user logs back in. Its unclear.

If you doubt this, you can use Hyena or any AD tool for viewing the raw value of this attribute then looking at the bit value for UF_LOCKOUT. See:
http://msdn2.microsoft.com/en-us/library/aa772300.aspx

[Guest]

Re: Unable to Unlock User Accounts or Reset Passwords

So how can I tell which server Hyena is pulling from. (I currently have 2 DCs) I checked both DCs in my domain and both show the account as unlocked, while Hyena still shows it locked. Not sure Hyena is pulling properly.

Chuck, do I just need to adjust the Lockout flag under useraccountcontrol or do I need to allow staff the ability to write to all flags?

[kstanush]

Re: Unable to Unlock User Accounts or Reset Passwords

UserAccountControl is one attribute; there are not separate flags in AD for the various checkboxes that you see on the properties dialog.

Contrary to what I wrote earlier, Hyena uses the lockouttime attribute to determine whether the account is locked or not, but in some cases, AD does not clear the value until some magical event happens, possibly until the user logs on. You can view the presence or value of this attribute by looking it it directly using ADSI edit or Hyena's Manage Directory Attributes function.

Unchecking the account lockout checkbox makes Hyena clear the lockouttime value in AD, but its documented to not actually get cleared until the user logs back on. For the KB article, see:
http://support.microsoft.com/kb/q250873/

The easiest way to see which DC (not that it really matters) Hyena is using to reading and writing to the directory is to view the properties of a user and look at the title bar of the properties dialog.

[This message has been edited by kstanush (edited 07-27-2007).]

[This message has been edited by kstanush (edited 07-27-2007).]