Hot answers tagged account
8
I'm not sure what your level of familiarity is with Wireshark, so my apologies if this is too verbose or terse. ;-)
Essentially you'd want to install and start Wireshark on either end – it shouldn't matter which – and begin capturing on the appropriate interface:
In Wireshark, click the Capture menu, then Options…
Select the appropriate interface.
Since ...
7
Let's not beat around the bush on this.
If the user has "Administrator" rights then it's "game over" for any setting that you want to enforce on the computers themselves. There is NO mechanism that you can use to prevent an "Administrator" from doing anything they want to the computer. When you allow users to run as "Administrator" you give up all control ...
5
Type visudo, you will see something like this:
<your_user> ALL=(ALL) NOPASSWD:ALL
If you want sudo prompt for a password, just remove NOPASSWD
<your_user> ALL=(ALL) ALL
UPDATE
As @MikeyB mentioned, by default, sudo will prompt for a password of the invoking user. But if you turn on the targetpw flag:
Defaults targetpw
sudo will ...
4
Since you asked...
I'm a sysadmin at a large University. We have anywhere from 20,000 to 24,000 accounts depending on where we are in the academic quarter and whether or not the State has mandated that we accept more students. Account provisioning is a problem we've been having to solve since we first started giving Students computer accounts en-mass (back ...
3
If you don't have any other accounts that are members of the "Administrators" group then there is no "supported" method for gaining Administrator access again.
Having said that, you can boot the Windows setup DVD image, attach to the SAM registry hive on your locked-out installation, and re-enable the Administrator account (see ...
3
There are many tools for allowing users self-service password reset. We're using SSRPM which provides both a msgina.dll replacement, which we install on all client stations, as well as web-based access. The reset questions are customizable and you can build profiles for different OUs or Groups.
Delegation of user administration activity is highly ...
3
Here's Symantec's document re: Active Directory integration: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007092721431648 When you talk about "how SEP authenticates on the domain", I'm going to assume you're referring to SEP's access to the directory to perform its cruddy "synchronization" of OUs of AD into its own database. When add a ...
3
Removing a computer from the domain is simple, simply join it to a workgroup.
If you want to maintain their profile you'll want to copy their profile before you leave the domain.
Create a local account for the user, and login once so the users profile folder gets created.
Login as an account that has the local administrator privilege that is not the user ...
3
The Quick and Dirty Way
You'll need PsExec from Microsoft for this script to work. I'm assuming that you can connect to the non-domain member and domain member computers with the same username and password. If that's not possible, let me know and I'll change up the script a little bit.
Put a list of machine names into machines.txt and run:
@echo off
for ...
2
It's quite possible that your users' ISP is more draconian than yours. Often, ISPs will block all outbound SMTP traffic that is not aimed at their own SMTP farm. Have them look into their ISP's traffic policies; something may be posted on their website or at least mentioned in a forum thread on DSLReports.com. I'd tell you to have them call their ISP, ...
2
This depends widely on the structure of your company. If you have an IT department consisting of several groups, it's common to grant those types of roles to a Help Desk section, usually consisting of lower- to mid-level techs.
It's also possible to delegate these rights to individuals within the departments. Select one or two people in each department to ...
2
It's not the orphaned account you need to get rid of, it's the orphaned ACE's. You need to find out if the SID's that are listed are a user SID or one of the well known SID's. You can check it against this list:
http://support.microsoft.com/kb/243330
Also, you can download a utility called SidToName to see if it can be resolved to a user account or to one ...
2
You don't mention email, so maybe they don't need it, which will save some hassle. When we've had temporary contractors that needed to send email, we usually set up generic accounts for them (e.g. marketing-assistant) and hoped to re-use them if that department needed contractors in the future.
You probably want to keep track of which workstations ...
2
There is no standard way but there are several ways to accomplish this, each being a configuration option in ldap.conf (or pam-ldap.conf depending on your distribution and their pam_ldap build-time settings):
pam_filter: Use a custom filter together with an attribute in LDAP that denotes an inactive account.
pam_check_host_attr: pam_ldap will check if ...
2
FWIW (perhaps not much - just throwing stuff out there for you), when we had a similar problem with an AD Domain, we finally ended up using this toolset is to track down the perpetrator.
In one case, it turned out to be a training room workstation in another building that they had logged on to, but not out of, weeks ago - and that hadn't been used since.
2
Yes, you can use the GRANT statement, i.e.
GRANT UPDATE on myTable to
myUserorRole
..or if the writing will be done via a stored procedure, grant execute to the proc.
Granting to roles rather than a specific account would be a good idea, then add the role to the account.
Check Books OnLine (BOL) for details.
2
The Intruder Lockout events will be logged to the sys:\etc\console.log file (assuming you have CONLOG.NLM running) if running on Netware. If this is an OES2 Linux server then I think it will be in /var/log/messages.
This is a per server thing, since each possible replica server will be responsible for the lockout events.
If you had Identity Manager in ...
2
You can disable account lockout policy by changing the "Account Lockout Threshhold" option to 0. However, if it's not working... it's not working, so that won't help you.
First, check your Group Policy Refresh Interval for both computers and users. They are in Computer Configuration\Administrative Templates\System\Group Policy and User ...
2
You're being painfully vague, but they're saying that they'll create a service account for your service to log in as and run under.
However, there is no actual concept of "service accounts" in Active Directory or locally*, so in every way this is just a standard user with whatever rights are required etc. They may choose to restrict it as much as is ...
2
From comment:
This is not possible as you describe, because: the information is described only in shadow, and shadow can only be read by root. Any program needing password hashes or account expiration must be SUID (if you're using local accounts stored in shadow, as you say.)
Added information:
I initially used chage(1) as source.
Note
The chage ...
1
The answer lies in the sudoers(5) file, which you edit using visudo(8).
As the exmaples there show you, your current sudoers setup will look like this:
%wheel ALL = (ALL) NOPASSWD: ALL
You can change this to:
%wheel ALL = (ALL) ALL
1
You should be using imapsync or similar other software to move the mail between non-identical mail systems.
If the mail systems are identical, then moving the data (ideally, rsync over ssh or similar transport) will work. You've goofed somewhere, probably by using FTP.
1
First of all stop mysql & backup /var/lib/mysql or wherever the data files are on your system.
Then from a clean mysql install elsewhere tar up /var/lib/mysql/mysql and put it on the broken system.
Then re-add your users & permissions.
Of course if you have backed up the mysql database you can do this more quickly.
1
In both cases the password must be changed but the difference is that when a password has expired it can no longer be used for authentication, whereas one that requires changing is still valid. As you say, it's subtle.
For testing I would suggest creating a new policy to apply to just a test account and setting the expiry period to something short enough to ...
1
I'm not sure if there's an easy way to check. I doubt as a regular user you'd have r access to the passwd file (Not the shadow one), so you couldn't really easily sed/awk/grep for the ! field.
What you could do is design a very specific script, make it non rwx to non-root and then create a sudo entry specifically for that command. You could even make it ...
1
You should have the service run as a domain user account, grant proper permissions on network resources to that account, and make it a local administrator (or just give it proper NTFS permissions) on the server it's running on.
Alternatively, you can have your service running as LocalSystem, but then it will have full control on the server, and to grant it ...
1
It's not really a SharePoint specific thing, it's good practice for any services installed to use service accounts with the least privileges required to perform the tasks they are intended to perform.
This document covers the topic pretty well.
If implemented properly, it's a more secure setup, so I'm not sure there is anything to reconcile in ...
1
I agree that the best way is to configure your account details in your own mail client.
However, if this is a local unix account you're talking about you can use chfn(1) to change the real name of a user with something like:
chfn -f "Editor Surname" editor
or by editing directly the /etc/passwd file (both require superuser access).
1
Heh.
Unix/Linux and a standardized way to do something. Funny lad you are. I know, I know, in many cases there are standard ways of doing things, but LDAP certainly is not one of them. LDAP rhymes with the Perl motto, "There's more than one way to do it".
The same convention than in the /etc/passwd (or, in /etc/shadow to be precise) will work. Undernearth ...
Only top voted, non community-wiki answers of a minimum length are eligible
