Howard Chu wrote: >> Date: Tue, 04 Nov 2008 08:13:08 -0700 >> From: Rich Megginson<rmeggins at redhat.com> > >> John Dickinson wrote: >>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins at redhat.com> wrote: > >>> create user in AD userAccountControl: 512 (Normal) >>> create user in Fedora DS (console) userAccountControl: 546 (Normal + >>> PASSWD_NOTREQ + ACCOUNTDISABLE) >>> >>> Would there be anything wrong with Fedora DS just forcing >>> userAccountControl = 512? Or are more options needed in the user >>> creation dialog? >> I'm not sure. 1.1.3 included a "fix" for userAccountControl. The way >> it works now is this: >> add new AD entry over LDAP - no userAccountControl attribute is present, >> so it must use some sort of AD default value >> read the new AD entry - get the userAccountControl value >> set AD entry userAccountControl |= 0x200 # 512 == normal account) >> >> So you might try a simple test - add a new AD entry over LDAP outside of >> windows sync - see what the default userAccountControl value is - I'm >> guessing that adding a new AD entry without specifying >> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE > > Yes, users created via LDAP are disabled unless you explicitly provide > the userAccountControl attribute (with proper flags) in the LDAP Add > operation. I tripped over this myself the first time I loaded up a > test database in AD. (It also gave me a Fine Opportunity to time how > long it took to LDAP Modify all of the users in my test database. ugh...) > Then this is a bug in the winsync code. In the ADD case, it should just force userAccountControl to the Normal value. In the MOD case, it should |= the value. John, can you open a bug about this issue? Thanks.
