Comments on: Unix Attributes Tab and nisprop.dll

By: slowe

slowe — Wed, 05 Oct 2011 21:29:30 +0000

Omniwig, thanks for the information!

By: omniwig

omniwig — Wed, 05 Oct 2011 15:56:20 +0000

To delegate permissions to change the Unix attributes tab, a user will need read+write access on the following properties:
msSFU30Name
unixUserPassword
uid
gidNumber
loginShell
msSFU30NisDomain
uidNumber
unixHomeDirectory

By: Anandha

Anandha — Wed, 15 Jun 2011 14:52:36 +0000

Hi,

Is there a way to change the default homedirectory, shell and gidNumber being assigned to new users so the help desk persons have minimal change to do in the Unix Attributes tab?

Thanks for your help.

By: slowe

slowe — Sat, 21 May 2011 15:23:55 +0000

Jean-Paul, I thought I had written a blog post about using dsquery to locate accounts that don’t have a UID/GID assigned, but I can’t seem to find it at the moment (and I don’t have access to an AD environment with the UNIX extensions installed). You can certainly use dsquery to do this; refer to the help pages for the exact dsquery syntax. (I do have a few other dsquery-related posts here on the site that might help.)

As for automatically populating, I thought that AD automatically assigned sequential numbers as you enabled UNIX properties. I could be wrong, though—it has been quite some time since I worked with this (nearly five years now!).

By: Jean-Paul Sergent

Jean-Paul Sergent — Fri, 20 May 2011 18:48:58 +0000

i’m trying to figure out a way to have it so that when new users are created on the domain, UID/GID values get automatically populated. Does anybody have any ideas on this? or have a solution your using now?

Also, does anybody have a script that would populate user accounts that do not currently have values associated with their account? Thanks for the help.

By: rrue

rrue — Wed, 10 Nov 2010 18:40:21 +0000

I’m trying to get the Unix Attributes tab visible in ADUC on a 2K3R2 DC that I’ve already installed NIS on (but not password sync).

I’ve confirmed that I have Schema Admin privileges, although that account is not commonly used as it also has Forest Admin rights. Assuming I get this to work, can I just register nisprop.ddl once as the Schema Admin and then see the Unix tab as only a Domain Admin.

But I’m getting ahead of myself. Even as a Schema Admin. I get the same error every time I try to register nisprop.dll, “DllRegisterServer in nisprop.dll failed. Return code was: 0xc0000005.” Oh, and nisprop.dll has been copied to C:\Windows\system32.

By: Povl H. Pedersen

Povl H. Pedersen — Fri, 03 Oct 2008 10:57:09 +0000

You can install IDMU.EXE from the SUPPORT folder of Windows 2003R2, and you will get the tabs to edit the unix attributes. Works fine on XP as well.

But, I can not modify any attributes, because there is no NIS domain. So it requires registering the NIS domain in AD in some way.

My first attempt at locating the information failed, I will give it another shot using wireshark to look at LDAP queries.

By: Josh Cook

Josh Cook — Wed, 30 Apr 2008 20:47:48 +0000

ok, I’ve got the attributes tabs in my schema, everything LOOKS fine.

But.. no changes save. If I go in to a group and set its unix attributes, and hit apply and ok, and go back in.. *poof* all gone, same for users and computers.. doesn’t matter.. no changes are saved.

Any ideas?

By: Philip

Philip — Wed, 23 Apr 2008 15:28:25 +0000

I have been able to get AD authentication working for my Linux boxes thanks to your blog. I can administer the UNIX Attributes from the DC; however, that’s the problem. I can only administer these attributes from the DC.

I have installed the Admin Pack on my Windows XP workstation and IDMU. I can view and update attributes on the various tabs. The UNIX Attributes tab appears in the snap-in; however, when I click on the tab, there is a split second delay before it displays an error message titled “Primary Group Missing.” I click OK on the dialog box and it displays the tab with bogus information populated in the UID, Login Shell, and Home Directory. Primary Group is blank. When I view the same user on the DC, everything is populated correctly.

Any ideas why my XP workstation cannot retrieve these attributess?

Any help would be appreciated.
Phil

By: slowe

slowe — Mon, 26 Nov 2007 06:49:51 +0000

Jon,

I would guess it uses ADSI or equivalent Win32 API calls to access Active Directory, but as I’m not a programmer I wouldn’t know for certain.