Networks

Ask something
Discussion Locked

filtered supervisor rights

0 helpful
19 replies

by efrahm

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have two objects in our tree to which no one has rights. Even supervisor rights have been filtered by a previous admin. I have the ability to see them, but not to delete or change. Is there a utility or TID covering this?

19 replies

by sixfourtykilo

Two words: BACK DOOR!

This is a situation where you need to be the ADMINISTRATOR of the Network Directory Services... Log on as the ROOT ADMINISTRATOR and you will be able to modify these objects.

Good Luck!
640k

by efrahm

I AM the admin. I have supervisor rights to the [ROOT], but those rights are filtered on these two objects.

by sixfourtykilo

No - YOU as an adminitrative USER will not have the correct rights for this. You need to log in as the ROOT user that is first set up when installing NT. There is an ADMINISTRATOR on every network that is GOD above GOD. It is only used in emergencies like this one and there IS an account for this whether you think there is or not. You need to find out what the ROOT password is to log on as ADMINISTRATOR.

by sixfourtykilo

ADDITIONAL INFORMATION: With NT 4 all you have to do is log into a domain server (any server attached to the domain) as the domain administrator account. That account would be the first administrator account setup on the Primary Domain Controller in an NT 4 domain. As for Windows 2000 you would have to log into any Windows 2000 server setup in the domain as any domain administrator account that has been given full control access to Windows 2000 Active Directory. To access from any server inthe domain you would have to have Active Directory Services installed on the particular server. W2K is different from NT 4 in that NT 4 uses WINS to recognize servers in the domain. W2K uses DNS so you have to ensure that your servers are all listed in the DNS table for the particular zone you want access to.

by sixfourtykilo

Novell also has a [ROOT] administrator that can be logged in as. Novell has several back doors that are generally set up in the beginning that just aren't necessarily dispatched to all of the techs. You may need to research this a little.
640k

by stillatit

Things to try:

As Supervisor, move up the tree and give yourself rights to the parent directory(s). If you have full rights in the parent you should at least be able to delete the object, and you can probably manipulate its rights.

The owner of the object should be able to change rights regardless of other rights.

The Supervisor should be able to change the owner regardless of other rights.

Good luck.

by rogerndgreen

If you want to spend money, try MAKESU from Dreamlan (www.dreamlan.com). It's about $100 or so.

There is a free demo version which would suit you IF you could crack the password (it's randomly generated and you aren't told what it is).

Roger

by duster52

Couple of questions.....are the objects leaf objects or container objects? If container, can you manage the objects under the container? If leaf objects, do you need to keep them, or can you delete and then recreate them? Did the previous admin use an IRF or explicitly assign the rights? How many admin or admin-equivalent objects do you have in your tree?

There are a number of shareware/freeware utilities that may help you, but the guaranteed way of fixing your problem is to break out your credit card and calling Novell support.

by wcraigmiles

Use DSBrowse. It is an NLM and runs on the server. Look at TID 10020238 for details. It will allow you to delete individual objects. This will also allow you to look for hidden objects that the old admin may have placed so they could login without you knowing.

by kevin anderson

1: Go to www.dreamlan.com, and get a copy of their tools. This will be cheaper than having Novell dial-in and fix it for you, but they can do that as well... Either option will more or less be a one time thing (for obvious security reasons).

2:Your previous admin is an idiot.

Alternately...

3:
If you know it was an admin who did it, and don't expect him to be hacking into your system, you could just ignore the whole thing, and not worry about it. That branch of the tree will be orphaned, but so what? If it ever becomes an issue, you can prune it then. For now, it's not doing damage, nor will it in the future, so just leave it alone...

This discussion is closed to new replies.