samba - Jan 2004 - User Management / Samba 3.0.1 LDAP / USERMGR.EXE problems

Hello,
 
  I'm using Samba 3.0.1 with LDAP backend running as a PDC here.  When I
start up usrmgr.exe from Windows NT, it will read all the users (or
computers, for srvmgr.exe) in the domain and report them back correctly.
However, whomever I am logged in as ( including gid 512 users) it will not
let me see details or change anything.  In the logs after trying to view a
users details I will get (hand typed from across the room, so forgive the
lack of log lines):
 
rpc_server/src_samr_nt.c:access_check_samr_object(93) _samr_open_user:
ACCESS DENIED (requested: 0x00601bf)
 
Before that it does access  checks se_access_check  of different SID
variations, ending in also S-1-5-21-.......-512.
Does anyone have any idea why it is not enabling me to use the usrmgr.exe to
manage users?  The scripts work great as far as I am concerned, but with the
school I work for enrolling new students soon, I need a "counselor
level"
tool that they can do simple tasks with. :)  If not, does anyone have any
recommendations for other gui / cheesy user management that will run on
windows?
 
Thanks in advance!
 
Toby Schaefer

Toby,

You must log onto the Samba domain as the user 'root', as Domain
Administrator you need to have permission to add users. In UNIX that
requires 'root' privilege.

If you still have a problem, contact me direct.

Cheers,
John T.


On Tue, 6 Jan 2004, Toby Schaefer wrote:
> Hello,
>
>   I'm using Samba 3.0.1 with LDAP backend running as a PDC here.  When
I
> start up usrmgr.exe from Windows NT, it will read all the users (or
> computers, for srvmgr.exe) in the domain and report them back correctly.
> However, whomever I am logged in as ( including gid 512 users) it will not
> let me see details or change anything.  In the logs after trying to view a
> users details I will get (hand typed from across the room, so forgive the
> lack of log lines):
>
> rpc_server/src_samr_nt.c:access_check_samr_object(93) _samr_open_user:
> ACCESS DENIED (requested: 0x00601bf)
>
> Before that it does access  checks se_access_check  of different SID
> variations, ending in also S-1-5-21-.......-512.
> Does anyone have any idea why it is not enabling me to use the usrmgr.exe
to
> manage users?  The scripts work great as far as I am concerned, but with
the
> school I work for enrolling new students soon, I need a "counselor
level"
> tool that they can do simple tasks with. :)  If not, does anyone have any
> recommendations for other gui / cheesy user management that will run on
> windows?
>
> Thanks in advance!
>
> Toby Schaefer
>
>
>
>
>
>
-- 
John H Terpstra
Email: jht@samba.org