topic Re: Remove unknown accounts from AdvSrv group in Operating System - OpenVMS

Remove unknown accounts from AdvSrv group

Aaron Sakovich — Wed, 16 Nov 2005 14:22:27 GMT

I've got a global group in Advanced Server that includes users in other domains as members. Some of those users have had their accounts deleted, which leaves me with dangling pointers in the group. For example:

Members: [UR] Account Unknown, [UR] Account Unknown, [UR] Account Unknown,
[US] INTERNAL\Aaron.Sakovich, ...

How do I remove these unassociated SIDs from the command line? There's no "/confirm" qualifier, nor is there a representation shown as to what the SID in question is (not that I'd really want to type in a SID...)

Any ideas?
Aaron

Re: Remove unknown accounts from AdvSrv group

Arch_Muthiah — Wed, 16 Nov 2005 17:05:20 GMT

Aaron,

I think you have disabled user accounts in your system. Disablbed users is though not permitted to login, it continues to exist in the user accounts list.

Once you REMOVE those accounts, then those accounts should be permanently deleted.

So to remove, first set those accounts to Disabled, using...
MODIFY /flags=disuser

Then delete those account, using...
REMOVE USER

Note:
Each user account is represented by a unique identifier which is independent of the user name. Once the user account is deleted, even creating an identically named user account in the future will not restore access to resources which currently name this user account in the access control list.

Archunan

Re: Remove unknown accounts from AdvSrv group

Aaron Sakovich — Wed, 16 Nov 2005 22:26:43 GMT

No, the accounts aren't disabled -- they are accounts in another domain that have been deleted.

I know that with a Windows GUI i/f to the user manager, I can see the SID displayed (where the username normally would be) and can remove them from the group that way. However, I don't have the tools available to me now, and need to remove them using the CLI.

Aaron

Re: Remove unknown accounts from AdvSrv group

Brad McCusker — Thu, 17 Nov 2005 01:22:12 GMT

Aaron - I'm 95% certain the solution to this is to use the Windows tools (user manager) to remove those "unknown" members. I vaguely recall looking into burying a way to do this from the CLI into the ADMIN utility, but, it never happened.

Wish I had a better answer - maybe someone else does?

Re: Remove unknown accounts from AdvSrv group

Aaron Sakovich — Thu, 17 Nov 2005 10:12:28 GMT

That's my thinking, too. It would have been nice if you could do a MODIFY GROUP grpnam /REMOVE=*/CONFIRM, but it's kind of a moot point now with AdvSrv's product status.

I've got a PC BDC where I can manage the user accounts from via UltraVNC. I think this is the first instance of something that can actually be done better in the PeeCee GooEee than from the command line on VMS!

Aaron