> Date: Tue, 04 Nov 2008 08:13:08 -0700 > From: Rich Megginson<rmeggins at redhat.com> > John Dickinson wrote: >> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins at redhat.com> wrote: >> create user in AD userAccountControl: 512 (Normal) >> create user in Fedora DS (console) userAccountControl: 546 (Normal + >> PASSWD_NOTREQ + ACCOUNTDISABLE) >> >> Would there be anything wrong with Fedora DS just forcing >> userAccountControl = 512? Or are more options needed in the user >> creation dialog? > I'm not sure. 1.1.3 included a "fix" for userAccountControl. The way > it works now is this: > add new AD entry over LDAP - no userAccountControl attribute is present, > so it must use some sort of AD default value > read the new AD entry - get the userAccountControl value > set AD entry userAccountControl |= 0x200 # 512 == normal account) > > So you might try a simple test - add a new AD entry over LDAP outside of > windows sync - see what the default userAccountControl value is - I'm > guessing that adding a new AD entry without specifying > userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE Yes, users created via LDAP are disabled unless you explicitly provide the userAccountControl attribute (with proper flags) in the LDAP Add operation. I tripped over this myself the first time I loaded up a test database in AD. (It also gave me a Fine Opportunity to time how long it took to LDAP Modify all of the users in my test database. ugh...) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/
