List Disabled Accounts Due To Excess Password Attempts on Redhat Directory Server and Correlate With IP Address - sql

I'm trying to get a log of disabled user accounts due to excess password attempts and then correlate the attempts and specific accounts with the IP adress they originated from.
I can get a list of disabled user accounts per instructions at SQL Query for Disabled Active Directory Accounts but am not sure how to correlate those accounts with IP logs.
This is on Redhat Directory Server.
Thanks,
Greg

If your Directory is Active-Directory you can corelate it with the Domain Servers event log. I give an example in an other answer, it exist to events : login Event "4624" and logout Event "4634" you can make a relation betwen the events by the data named TargetLogonId. The IP adress is in data named IpAdress. "4740" means that an account was locked.
The problem here is that you need to get all the Domain servers logs.
Description of security events in Windows Vista and in Windows Server 2008 can help you

Related

cPanel accounts unable to receive emails "host lookup for alpha.yodns.africa did not complete (DNS timeout?)"

I'm having an issue with incoming emails for my cPanel email accounts. Below is the error I get on all incoming emails when I check incoming emails on Mail Delivery Reports in WHM:
What I think caused the issue is that I was trying to transfer the cPanel accounts from one of my servers(alpha.yodns.top) to another server(alpha.yodns.africa). Now, I had some issues on the server that I was transferring to, so I decided to just keep the accounts running on the first server instead.
What I picked up while I was trying to fix this yesterday is that the nameservers had changed(to the NS of the server I was transferring to) on the DNS Zones of my accounts. So, I had to change those back to their original state. I thought that would resolve the issue but it didn't.
The accounts are able to send out but unable to receive any emails.
The issue has been resolved. I had to remove all the domains from /etc/manualmx using:
whmapi1 unset_manual_mx_redirects domain='example.com'
A manual_mx was somehow set to redirect to the new host server for all the domains.

Can't Login to Web Management Except Admin

I'm trying to set up an admin user for a different virtual host and give this account management permissions to manage everything in this virtual host.
So I created a new user account with the virtual host specified with a tag "Management." However, when I try to log in to the web management console I can't seem to log in unless I tag this account with "administrator."
What am I missing?
Of course, right after I posted the question I found out the tags are case-sensitive. As soon as I changed "Management" to "management" I could log in.

How do I fix the error:1069 - The service did not start due to logon failure?

I have written my own windows service which interacts with a SQL database and updates it. The service was running fine and seems to be functioning correctly, however of late it seems to go down at random times and cannot restart due to the error designated in the question. I have tried various searches to fix this, but unfortunately I have come up with nothing. The aim is to eventually having this service running on my companies server, but I can't adjust any server settings, I am but a user on the server, so I have restrictions to some settings.
Any quick fixes, would be helpful!
Open the Services Manager. ( Win + R, then type services.msc )
Then right click on the SQL Server process and click Properties
Then go to Log On, and select This account:
Then click Browse, and add your username in the box. (Notice it should contain the domain, in my case is AD\myusername), then Check Names and accept.
Finally type your password in the other two fields, and that's it, you should have permission to start your process now.
Cheers!!
One issue for us was the format of the account user name, we initially used
domain\username
and got the 1069-logon error, then ultimately I tried validating the user name in the properties | logon tab of the Service (in Control Panel / Service Manager), using the "Browse" and "Search" for the user name and it turned it suggested and validated ok with the reverse format
username#domain
This also worked and resolved the 1069 error, and let us script the startup using sc.exe.
Error 1069 is vague and can have different causes. I am sharing my experience here.
I encountered this error when trying to get a service to run under my account (I am trying to get my services to see the same LocalDB as interactive processes running on my account for development purposes). I use an MSA (Microsoft Account) with Windows’s PIN login normally, so I rarely enter my Windows password. To resolve the issue, I locked my screen, selected Password input instead of PIN input, and then entered my password. I assume this somehow reminded Windows what my password was and made my local account more legit.
Before doing this, you need to configure the user account in question to have the Logon as Service privilege. To do this, open the Group Policy Editor. Expand Computer / Windows Configuration / Security Configuration / Local Policies / User Permissions Assignment and then open Login as Service. From there, you can add your user in question.
also check for "Deny Logon service" policy.
user should not be added over there
We had this issue as well because the account was set so that the password expired. After we updated the account to not expire and set the password this error stopped.
The account could also be locked out. To unlock it, you only need to change that user's password (new and old password can be the same).
What also worked for me was re-entering the password in the services->LogOn window. Even when you think the account and password is correct, re-entering it will re-grant the account permission to log on as a service.

Operations error : while querying ldap_search_ext_s in Objective-C

I am using ldap for user authentication as mentioned in this link.
http://www-archive.mozilla.org/directory/csdk-docs/writing.htm
Here I am getting "Operations error" while ldap_search_ext_s call. Can anyone tell me what changes I need to do in order to get the user information from Active Directory.
Note : I don't want to enter the dc name and password while binding. Since machines will be running under normal users account (domain users) which do not have admin credentials in domain.Please let me know how to do binding in this case also.
My machine details :
Mac Lion, 64 Bit.
I am trying to connect to Windows Active Directory.
Thanks,
Tausif.
You need to bind with a valid username and password when connecting to a Windows Active Directory server in most cases.
When you're performing your ldap_simple_bind_s(), the two NULL parameters need to be replaced - the first with the DN of the user that is performing the bind, the second with the password for that DN.
There's more link detail in this answer

SQL Server 2008 Error 18452 The login is from an untrusted domain and cannot be used with Windows authentication

I am trying to figure out what is going on. Here is our setup:
We have four SQL servers that are in replication with each other.
We add a new user to Windows Active Directory and add them to a group that is in SQL Server that we have been using for ages.
The new user, when trying to authenticate using Windows authenication returns that error in the subject line. But, any users that were previously in Active directory work fine.
At one point I had gotten SQL Server "caught up" becauuse we had a group of users that could not log in because of this error. I did some changes to the SPNs and ended up making it so no one could log in. Then I realized how the SPNs were supposed to look and fixed it. Then I guess some magic happened and those users were able to authenticate. I thought it was fixed, but it is obviously not as we had to add one new user and they cannot authenticate.
What is interesting is that the user can authenticate with three out of the four SQL Servers. It is only this one server that is working incorrectly. I set up two SPNs for the SQl Service on this sql server.
They look like -
MSSQLSvc/[servername].[domain].local:1433
MSSQLSvc/[servername]:1433
These are actually registered to the Service account that we use for the SQL Servers. What is interesting is that I can't find the SPNs for the servers that are working anywhere.
Any help would be appreciated!
Edit: Also, another point to note is that if I try to add the user directly as a login into SQL server. I right click Logins and click Add Login then click search. I then type in [Domain]\[Username] and click check names. It validates the name as being correct. Then I click OK. And then OK again, and it gives the Error Windows NT user or group '[Domain]\[Username]' not found. Check the name Again.
I thought it was fixed, but it is obviously not as we had to add one
new user and they cannot authenticate.
The user has to relogin in order to pick up the new group. Otherwise, it's kerberos ticket is still using the old group membership information in its PAC
These are actually registered to the Service account that we use for
the SQL Servers. What is interesting is that I can't find the SPNs for
the servers that are working anywhere.
I think what happen is that you have one SQL Server with SPN setup properly while the other three SQL Servers with no SPN setup at all. So, you are going to use Kerberos on this particular server while NTLM on the other three.
As mentioned before, when you are using Kerberos, you have to either purge the ticket using some tools or you have to relogin in order to pick up the new group membership. You can also try to lock the screen and then unlock it. If I remember correctly, this should also refresh the ticket.
Unlike Kerberos, NTLM doesn't carry the group memberhsip data. After SQL Server authenticated the user using NTLM, it will find the authenticated user's group membership, including the new group you just added.