Unregistering display specifiers
Note: You must have Enterprise Administrator rights to unregister display specifiers.
To unregister display specifiers in Active Directory
- Log in as a user with Enterprise Administrator rights.
- Open a command prompt and navigate to the Safeguard Authentication Services installation directory.
- Run the DsReg.vbs script with the /remove option:
DsReg.vbs /remove
Note: To unregister display specifiers with One Identity Active Role, run the following command:
DsReg.vbs /remove /provider:EDMS
To see all the DsReg.vbs options, run the following command:
DsReg.vbs /help
A SUCCESS message appears indicating that the display specifiers were removed successfully.
Display specifier registration tables
Display specifiers are stored in the Active Directory configuration partition under the DisplaySpecifiers container. The DisplaySpecifiers container has child containers named for a corresponding locale ID. US English display specifiers are in cn=409,cn=DisplaySpecifers,cn=Configuration,dc=domain. The following modifications are made for each locale by the display specifier registration script, DsReg.vbs.
Table 24: Object: User-Display
| adminPropertyPages |
modify, insert |
10,{E399C9A2-E7ED-4DDF- 9C5A-BA4EACC34316} |
Registers the Unix Account property page extension with User objects. |
| adminPropertyPages |
modify, insert |
11,{53108A01-9B68-4DFB- A16D-4945D26A38A9} |
Registers the Unix Personality property page extension with User objects. |
| attributeDisplayNames |
modify, insert |
uidNumber, UID Number |
Provides a more user-friendly name for the Unix user ID number attribute. Allows this attribute to display in the Unix Object find dialog results. |
| attributeDisplayNames |
modify, insert |
uid, Login Name |
Provides a more user-friendly name for the Unix login name attribute. Allows this attribute to display in the Unix Object find dialog results. |
| attributeDisplayNames |
modify, insert |
gidNumber, GID Number |
Provides a more user-friendly name for the Unix group ID number attribute. Allows this attribute to display in the Unix Object find dialog results. |
| attributeDisplayNames |
modify, insert |
canonicalName, Path |
Provides a more user-friendly name for the Unix canonical name attribute. Allows this attribute to display in the Unix Object find dialog results. |
Table 25: Object: Group-Display
| adminPropertyPages |
modify, insert |
10,{E399C9A2-E7ED-4DDF- 9C5A-BA4EACC34316} |
Registers the Unix Account property page extension with User objects. |
| attributeDisplayNames |
modify, insert |
gidNumber, GID Number |
Provides a more user-friendly name for the Unix group ID number attribute. Allows this attribute to display in the Unix Object find dialog results. |
| attributeDisplayNames |
modify, insert |
canonicalName, Path |
Provides a more user-friendly name for the Unix canonical name attribute. Allows this attribute to display in the Unix Object find dialog results. |
Table 26: Object: vintela-UnixUserPersonality-Display
| cn |
create object |
vintela-UnixUserPersonality- Display |
The display specifier object is created. |
| adminPropertyPages |
modify, insert |
10,{E399C9A2-E7ED-4DDF- 9C5A-BA4EACC34316} |
This registers the Unix User Personality property page extension with user personality objects. |
| classDisplayName |
modify, set |
Unix User Personality |
Sets the friendly name of the object class. This is the text displayed in the New Object menu and elsewhere in ADUC. |
| creationWizard |
modify, set |
{57AC8F6B-5EA8-4DC9- AB9A-C0ED6420C7F9} |
This registers the "New Unix User Personality" object creation wizard. This creation wizard registration mechanism works in ADUC, but is not yet supported in ARS. To create personality objects in ARS, use the Advanced Create Wizard and select the Unix User Personality object class. |
| iconPath |
modify, insert |
0,vas_dua_user.ico |
This is the default personality icon. This icon is installed by Safeguard Authentication Services in the %SYSTEMROOT%\system32 folder so that it is available to all applications that might need it. |
| iconPath |
modify, insert |
1,vas_dua_user_disabled.ico |
This icon is not currently used. |
| iconPath |
modify, insert |
2,vas_dua_user_orphaned.ico |
This icon is not currently used. |
| attributeDisplayNames |
modify, insert |
uidNumber, UID Number |
Provides a more user-friendly name for the Unix user ID number attribute. Allows this attribute to display in the Unix Object find dialog results. |
| attributeDisplayNames |
modify, insert |
gidNumber, GID Number |
Provides a more user-friendly name for the Unix group ID number attribute. Allows this attribute to display in the Unix Object find dialog results. |
| attributeDisplayNames |
modify, insert |
uid, Unix Login Name |
Provides a more user-friendly name for the Unix login name attribute. Allows this attribute to display in the Unix Object find dialog results. |
| attributeDisplayNames |
modify, insert |
description, Description |
Provides a more user-friendly name for the description attribute. Allows this attribute to display in the Unix Object find dialog results. |
| attributeDisplayNames |
modify, insert |
canonicalName, Path |
Provides a more user-friendly name for the Unix canonical name attribute. Allows this attribute to display in the Unix Object find dialog results. |
| attributeDisplayNames |
modify, insert |
managedBy, Linked To |
Provides a more descriptive name for the managed by attribute to indicate how this attribute is used on personality objects. Allows this attribute to display in the Unix Object find dialog results. |
Table 27: Object: vintela-UnixGroupPersonality-Display
| cn |
create object |
vintela-UnixGroupPersonality- Display |
The display specifier object is created. |
| adminPropertyPages |
modify, insert |
10,{E399C9A2-E7ED-4DDF- 9C5A-BA4EACC34316} |
This registers the Unix User Personality property page extension with user personality objects. |
| classDisplayName |
modify, set |
Unix Group Personality |
Sets the friendly name of the object class. This is the text displayed in the New Object menu and elsewhere in ADUC. |
| creationWizard |
modify, set |
{A7C4A545-C7C8-49C8- 8C96-8C665E166D0C} |
This registers the "New Unix User Personality" object creation wizard. This creation wizard registration mechanism works in ADUC, but is not yet supported in ARS. To create personality objects in ARS, use the Advanced Create Wizard and select the Unix User Personality object class. |
| iconPath |
modify, insert |
0,vas_unix_group.ico |
This is the default personality icon. This icon is installed by Safeguard Authentication Services in the %SYSTEMROOT%\system32 folder so that it is available to all applications that might need it. |
| attributeDisplayNames |
modify, insert |
gidNumber, GID Number |
Provides a more user-friendly name for the Unix group ID number attribute. Allows this attribute to display in the Unix Object find dialog results. |
| attributeDisplayNames |
modify, insert |
cn, Name |
Provides a more user-friendly name for the Unix login name attribute. Allows this attribute to display in the Unix Object find dialog results. |
| attributeDisplayNames |
modify, insert |
description, Description |
Provides a more user-friendly name for the description attribute. Allows this attribute to display in the Unix Object find dialog results. |
| attributeDisplayNames |
modify, insert |
canonicalName, Path |
Provides a more user-friendly name for the Unix canonical name attribute. Allows this attribute to display in the Unix Object find dialog results. |
| attributeDisplayNames |
modify, insert |
managedBy, Linked To |
Provides a more descriptive name for the managed by attribute to indicate how this attribute is used on personality objects. |
Troubleshooting
To help you troubleshoot, One Identity recommends the following resolutions to some of the common problems you might encounter as you deploy and use Safeguard Authentication Services.
Getting help from technical support
If you are unable to determine the solution to a problem, contact Technical Support for help.
Before you contact Support, please collect the following information:
- Take a system information snapshot. To do this, run the following command as root:
/opt/quest/libexec/vas/scripts/vas_snapshot.sh
This produces an output file in /tmp.
- Make note of the Unix attributes for the user that cannot log in (if applicable). To do this, capture the output from the following commands:
vastool -u host/ attrs <username>
id <username>
Note: Depending on your platform, you may need to run id -a instead of id.
- Copy the text from any error messages that you see.
- Save the results of running a "double su." To do this, log in as root and run su <username> note any error messages. Then run su <username> again and note any error messages.
Once you have collected the information listed above, contact Support at https://support.oneidentity.com/authentication-services/.
