Return
-
Title
Error in System log file: "Error retrieving userAccountControl: No such attribute attribute. Veri -
Description
QAS is unable to determine if a user is enabled or disabled, so NSS (Name Service Switch) always returns a valid shell, even if the user is disabled. System log files show the following messages:
"Error retrieving userAccountControl: No such attribute
Verify that the userAccountControl attribute can be read by authenticated users" -
Cause
AD permissions. In order for VAS to determine if a user has been disabled, the Active Directory security policy must allow host principals to read the userAccountControl attribute on user objects.
-
Resolution
The following is one example of how you could enable read access on the uSNChanged attribute for host principals. There are many ways to perform this operation that may be more appropriate to your Active Directory deployment.
1. Open the ADSI Edit MMC snap-in. ADSI Edit is installed as part of the Windows Support Tools package.
2. Right-click the ADSI Edit root node in the left panel and select Connect to.
3. In the Connection Settings dialog select the Domain well known naming context from the drop down in the Connection Point group box. Click OK.
4. Navigate to the OU where your Unix-enabled users and groups are stored. Right-click the OU and select Properties. Select the Security tab.
5. Click the Advanced button. The Advanced Security Settings dialog is displayed.
6. Create a new permissions entry by clicking the Add button and specifying Authenticated Users as the object name to select. Then click OK. The permission entry dialog is displayed.
7. From the Apply onto drop down box, select This object and all child objects.
8. Click on the Properties tab.
9. Click the Allow check box for the Read userAccountControl permission.
10. Repeat this procedure for any other OU's where Unix users objects are stored.