group permissions no longer working?

I have a shared workarea that has been working perfect for several months. suddenly none of them have privs to get latest or edit. We are win2k with ts552.

I've checked the nt group and all the users are in the group. I've also created a new workarea, created a new group and added all the previous users to that test group and it still did not work.

Thoughts?

Thanks,
Nico

Find more posts tagged with

Comments

Migrateduser

Wow, any clues on what might have changed on the system? can any user see files in the workarea? Are there permission problems with non TeamSite assets too, indicating perhaps a problem with NT permissions? Is LDAP involved?

lissa

Migrateduser

Are you using LDAP? I have seen issues like this with LDAP configurations, I don't think there ever was a solution.

Is the PDC down?

There are two settings you can add to the [iwserver] section of iw.cfg that will add logging to one of the Interwoven logs to show what users TeamSite thinks are in what groups. I am not sure if you change them and do iwreset or if you have to reboot.

show_user_list=yes
show_user_list_verbose=yes

Edited by john on 06/03/03 10:43 AM (server time).

nico

Not using LDAP just NT Basic Authentication

nico

Users can still see/view files, they just cant edit anything. Not sure about the non teamsite assets, how would i look into that? Not using ldap just nt basic authentication.

Migrateduser

Still not working? Were you able to try this in [iwserver] of iw.cfg and reboot?

show_user_list=yes
show_user_list_verbose=yes

One of the logs indicates which PDC TeamSite is using - is that a valid/functional PDC?

nico

whoa i did that and now no one can log in to ts. gonna remove those setting from the cfg file

Migrateduser

I don't have an explanation for that. Is your PDC very far from your TeamSite server (like in a different province)?

nico

pdc?

Migrateduser

Primary domain controller, the machine/service Windows uses to determine what users exist and what groups they are in.

Unless you are using all local users and groups?

In iwtrace.log look for something like:

Domain "YOUR_DOMAIN" is added to the domain list, pdc="\\YOUR_PDC".

Find out what you can about the machine YOUR_PDC.

Edited by john on 06/05/03 10:47 AM (server time).

nico

Domain "FHLBSF" is added to the domain list, pdc="\\PDC".
Domain "FHLBSF" is removed from the domain list. NetGetDCName result=2453
[Mon Jun 02 10:19:24 2003] Creating workarea Mktg
[Mon Jun 02 10:49:46 2003] Cleaning up workarea id=122872
[Mon Jun 02 10:49:46 2003] Cleanup workarea id=122872 completed with status 0
[Mon Jun 02 12:40:37 2003] Creating workarea test
[Mon Jun 02 12:43:54 2003] Creating workarea Mark Guinness
[Mon Jun 02 12:44:12 2003] Cleaning up workarea id=123152
[Mon Jun 02 12:44:12 2003] Cleanup workarea id=123152 completed with status 0
[Mon Jun 02 13:57:33 2003] Creating workarea MaryDesmond
[Mon Jun 02 14:10:28 2003] Creating workarea test
[Mon Jun 02 14:53:09 2003] Cleaning up workarea id=124724
[Mon Jun 02 14:53:09 2003] Cleanup workarea id=124724 completed with status 0
[Mon Jun 02 14:54:54 2003] Creating workarea Tf
[Tue Jun 03 11:39:55 2003] Creating workarea Cl
[Tue Jun 03 11:40:43 2003] Creating workarea Rg
[Tue Jun 03 12:21:17 2003] Creating workarea Tf
compare_sids - invalid sid
Revision: 204
SubAuthorityCount: 107
IdentifierAuthority.Value[0]: 0x80
IdentifierAuthority.Value[1]: 0x0
IdentifierAuthority.Value[2]: 0x0
IdentifierAuthority.Value[3]: 0xf
IdentifierAuthority.Value[4]: 0xa1
SubAuthority[0]: 0x0
SubAuthority[1]: 0x0
SubAuthority[2]: 0x782e9dd8
SubAuthority[3]: 0x80591a
SubAuthority[4]: 0x80591a
SubAuthority[5]: 0x96bfc84
SubAuthority[6]: 0x806bdc
SubAuthority[7]: 0x96bfc54
SubAuthority[8]: 0x77d3e141
SubAuthority[9]: 0x96bfc84
SubAuthority[10]: 0x8a11398
SubAuthority[11]: 0x80591a
SubAuthority[12]: 0x7ce35c8
SubAuthority[13]: 0x7ce3624
SubAuthority[14]: 0x0
compare_sids - invalid sid
Revision: 204
SubAuthorityCount: 107
IdentifierAuthority.Value[0]: 0x80
IdentifierAuthority.Value[1]: 0x0
IdentifierAuthority.Value[2]: 0x8
IdentifierAuthority.Value[3]: 0xb0
IdentifierAuthority.Value[4]: 0x97
SubAuthority[0]: 0x0
SubAuthority[1]: 0x0
SubAuthority[2]: 0x782e9e10
SubAuthority[3]: 0x80591a
SubAuthority[4]: 0x80591a
SubAuthority[5]: 0x384fc84
SubAuthority[6]: 0x806bdc
SubAuthority[7]: 0x384fc54
SubAuthority[8]: 0x77d3e141
SubAuthority[9]: 0x384fc84
SubAuthority[10]: 0x897b4a0
SubAuthority[11]: 0x80591a
SubAuthority[12]: 0x7ce35c8
SubAuthority[13]: 0x7ce3624
SubAuthority[14]: 0x0
[Thu Jun 05 09:21:30 2003] Creating workarea TracyFine

SetupUserGroups: reading configuration parameters

domain_local_groups = no
include_nested_groups = yes

User "user" is removed, UserNameToID err=925
User "forondaa" is removed, UserNameToID err=925
Domain browser: scan is started
NetGetDCName("FHLBSF") failed, err=2453
NetGetDCName("WORKGROUP") failed, err=2453
NetGetDCName("FHLBSF-DEV") failed, err=2453
NetGetDCName("IAS-PA") failed, err=2453
Domain browser: scan is complete.

SetupUserGroups: reading configuration parameters

domain_local_groups = no
include_nested_groups = yes

User "user" is removed, UserNameToID err=925
User "forondaa" is removed, UserNameToID err=925
Domain browser: scan is started
NetGetDCName("FHLBSF") failed, err=2453
NetGetDCName("WORKGROUP") failed, err=2453
NetGetDCName("FHLBSF-DEV") failed, err=2453
NetGetDCName("IAS-PA") failed, err=2453
Domain browser: scan is complete.

SetupUserGroups: reading configuration parameters

domain_local_groups = no
include_nested_groups = yes

User "user" is removed, UserNameToID err=925
User "forondaa" is removed, UserNameToID err=925
[Thu Jun 05 10:10:24 2003] [Thu Jun 05 10:10:24 2003] TEnvironment::Flush flushed 0, unlinked 0
TEnvironment::Flush flushed 0, unlinked 0
[Thu Jun 05 10:10:24 2003] infinite wait completed
[Thu Jun 05 10:10:24 2003] TEnvironment::Freeze freeze until Fri Jun 04 10:10:24 2004
[Thu Jun 05 10:10:28 2003] TEnvironment::Freeze freeze until Fri Jun 04 10:10:24 2004
[Thu Jun 05 10:10:28 2003] TeamSite Server Stopped.[Thu Jun 05 10:10:28 2003] TEnvironment::Freeze extend freeze to Fri Jun 04 10:10:28 2004
[Thu Jun 05 10:10:28 2003] TEnvironment::Freeze extend freeze to Fri Jun 04 10:10:28 2004
[Thu Jun 05 10:10:38 2003]: ERROR: DrvUnMountDevice - Lock volume failed Access is denied.

[Thu Jun 05 10:10:38 2003] Watch Event Thread stopping
[Thu Jun 05 10:10:41 2003] TEnvironment::dtor found 0 dirty.
[Thu Jun 05 10:10:41 2003] TEnvironment::dtor found 0 dirty.

Migrateduser

It looks to me like it is having trouble determining or connecting to the PDC. From the TeamSite server can you ping the PDC?

I'm sorry I can't really help with this. I would file a support case with Interwoven if you haven't already. I don't know what the issue is with the invalid SID messages but someone in support once told me they were bad.

You might want to also add domain_list=FHLBSF,hostname (where hostname is the machine name) in both [iwserver] and [cgi] sections if iw.cfg, if it isn't already set correctly. I think that was supposed to improve performance.

nico

Thanks for all your help, now how do you get your forum image to change with every refresh?

Nico

MattP

Did you get this resolved?

As I was reading the post, I thought the issue may have been with a change to submit.cfg. (currupt, not valid, edited in some way...)

Matt

Matthew Petitjean
BOC Group
Murray Hill, NJ 07974 USA

ProfessorX

I have a smiliar problem here.

WIN2k TS 5.5.2 basic NT auth.

When I restart the server certain WF jobs do not show up in the users to do list. But when they select View ALL they do.

Also they cannot EDIT any files in the import workarea. Permissions are fine. I am sure of that. But when I go to reboot the server again Walaa! everthing is working normally. Strange

The Professor-

mjm

I'm having a similiar problem with only one user. Everyone else in the group can view/edit/modify. This one particular user is set up exactly the same as the others as far as I can tell. However they can only view, they get a permissions error when trying to edit, get latest etc..

Any suggestions would be greatly appreciated.

thanks

TJRees

OK, I have a very similar problem which occurred when we tested for Disaster Recovery. We are currently using \\Server1 as our PDC server and we switched over to \\Server2 (as our failover PDC). However, we didn't realize this until after the fact so only a MASTER had complete Teamsite access. For future reference, is there a config file in TS that sets this? I noticed this setting (\\Server1) is in the registry...is this the only setting we need to modify? Thanks. We are on WIN2K, TS 5.5.2. Thanks!

pjacintorees@leggmason.com

Edited by webteam on 12/03/03 03:37 PM (server time).

Migrateduser

Back in the 4.5.1 days, one one project we had a PDC in another state and a local BDC. It would always go to the PDC and we thought this might have been associated with performance problems (especially because there were many users in a big domain). I remember trying lots of things including registry tweaks but nothing seemed to make it go to the BDC by default. Maybe this has been fixed in 5.x but I haven't heard of it.

yshalizi_va

Hello,
We are experiencing a similar issue here regarding access of content through the Standard/Professional interface. Through the both interfaces, users are only able to view workareas they have ownership of. Users are not able to view workareas they have write access to which is incorrect.

Permission setup: Domain Local Groups were assigned to the workarea and populated with Domain Global User Accounts.

If we assign local groups to workareas (local to the TeamSite server, not AD Domain Local Accounts) the application seems to funcition well - all users who have write access to the workareas can view the workareas from the both interfaces.

Permission setup: Local Groups were assigned to the workareas and populated with Domain Global User Accounts.

Preliminary analysis of the Interwoven logs suggest a possible concern with the Domain Controllers and to test this, we have a question to ask Interwoven:

How can we force TeamSite to refer to a specific Domain Controller instead of allowing AD to select the Domain Controller? What would the level of effort to apply this change?

TeamSite 6 with Active Directory

Snippet of iwtrace.log:

user: VHAMASTER\VHAISWSHETTP

Ask local system:
NetUserGetLocalGroups( "NULL", "VHAMASTER\VHAISWSHETTP") ["TeamSitePilot" "TeamSiteTest" "OCA_Local" "Administrators" "Users" ]
Ask domain <VHAMASTER>:
NetUserGetGroups( "\\VHAISH3DC1", "VHAISWSHETTP") failed, error=5
NetUserGetLocalGroups( "\\VHAISH3DC1", "VHAISWSHETTP") failed, error=5
Ask domain <DVA>:
NetUserGetGroups( "\\VACO2DC1", "VHAMASTER\VHAISWSHETTP") failed, error=5
NetUserGetLocalGroups( "\\VACO2DC1", "VHAMASTER\VHAISWSHETTP") failed, error=5

groups = [VHAISWWBDT\TeamSitePilot VHAISWWBDT\TeamSiteTest VHAISWWBDT\OCA_Local VHAISWWBDT\Administrators VHAISWWBDT\Users ]

user: VHAMASTER\VHAISWSHALIY

Ask local system:
NetUserGetLocalGroups( "NULL", "VHAMASTER\VHAISWSHALIY") ["OCA_Local" "Administrators" "Users" ]
Ask domain <VHAMASTER>:
NetUserGetGroups( "\\VHAISH3DC1", "VHAISWSHALIY") failed, error=5
NetUserGetLocalGroups( "\\VHAISH3DC1", "VHAISWSHALIY") failed, error=5
Ask domain <DVA>:
NetUserGetGroups( "\\VACO2DC1", "VHAMASTER\VHAISWSHALIY") failed, error=5
NetUserGetLocalGroups( "\\VACO2DC1", "VHAMASTER\VHAISWSHALIY") failed, error=5

groups = [VHAISWWBDT\OCA_Local VHAISWWBDT\Administrators VHAISWWBDT\Users ]

user: VHAMASTER\VHAISWMILLIG

Ask local system:
NetUserGetLocalGroups( "NULL", "VHAMASTER\VHAISWMILLIG") ["Users" "Administrators" ]
Ask domain <VHAMASTER>:
NetUserGetGroups( "\\VHAISH3DC1", "VHAISWMILLIG") failed, error=5
NetUserGetLocalGroups( "\\VHAISH3DC1", "VHAISWMILLIG") failed, error=5
Ask domain <DVA>:
NetUserGetGroups( "\\VACO2DC1", "VHAMASTER\VHAISWMILLIG") failed, error=5
NetUserGetLocalGroups( "\\VACO2DC1", "VHAMASTER\VHAISWMILLIG") failed, error=5

groups = [VHAISWWBDT\Users VHAISWWBDT\Administrators ]

user: VHAMASTER\VHAISWMUSSED

Ask local system:
NetUserGetLocalGroups( "NULL", "VHAMASTER\VHAISWMUSSED") ["Users" ]
Ask domain <VHAMASTER>:
NetUserGetGroups( "\\VHAISH3DC1", "VHAISWMUSSED") failed, error=5
NetUserGetLocalGroups( "\\VHAISH3DC1", "VHAISWMUSSED") failed, error=5
Ask domain <DVA>:
NetUserGetGroups( "\\VACO2DC1", "VHAMASTER\VHAISWMUSSED") failed, error=5
NetUserGetLocalGroups( "\\VACO2DC1", "VHAMASTER\VHAISWMUSSED") failed, error=5

groups = [VHAISWWBDT\Users ]

user: VHAMASTER\VHAISWWAHLD

Ask local system:
NetUserGetLocalGroups( "NULL", "VHAMASTER\VHAISWWAHLD") ["TeamSitePilot" "OCA_Local" "Users" ]
Ask domain <VHAMASTER>:
NetUserGetGroups( "\\VHAISH3DC1", "VHAISWWAHLD") failed, error=5
NetUserGetLocalGroups( "\\VHAISH3DC1", "VHAISWWAHLD") failed, error=5
Ask domain <DVA>:
NetUserGetGroups( "\\VACO2DC1", "VHAMASTER\VHAISWWAHLD") failed, error=5
NetUserGetLocalGroups( "\\VACO2DC1", "VHAMASTER\VHAISWWAHLD") failed, error=5

groups = [VHAISWWBDT\TeamSitePilot VHAISWWBDT\OCA_Local VHAISWWBDT\Users ]

user: VHAMASTER\VHAISWEDWARJ

Ask local system:
NetUserGetLocalGroups( "NULL", "VHAMASTER\VHAISWEDWARJ") ["TeamSitePilot" "Users" ]
Ask domain <VHAMASTER>:
NetUserGetGroups( "\\VHAISH3DC1", "VHAISWEDWARJ") failed, error=5
NetUserGetLocalGroups( "\\VHAISH3DC1", "VHAISWEDWARJ") failed, error=5
Ask domain <DVA>:
NetUserGetGroups( "\\VACO2DC1", "VHAMASTER\VHAISWEDWARJ") failed, error=5
NetUserGetLocalGroups( "\\VACO2DC1", "VHAMASTER\VHAISWEDWARJ") failed, error=5

groups = [VHAISWWBDT\TeamSitePilot VHAISWWBDT\Users ]

user: DVA\VACOALEXAW

Ask local system:
NetUserGetLocalGroups( "NULL", "DVA\VACOALEXAW") failed, error=5
Ask domain <VHAMASTER>:
NetUserGetGroups( "\\VHAISH3DC1", "DVA\VACOALEXAW") failed, error=5
NetUserGetLocalGroups( "\\VHAISH3DC1", "DVA\VACOALEXAW") failed, error=5
Ask domain <DVA>:
NetUserGetGroups( "\\VACO2DC1", "VACOALEXAW") failed, error=5
NetUserGetLocalGroups( "\\VACO2DC1", "VACOALEXAW") failed, error=5

groups = []

user: DVA\VACOPHILLM

Ask local system:
NetUserGetLocalGroups( "NULL", "DVA\VACOPHILLM") failed, error=5
Ask domain <VHAMASTER>:
NetUserGetGroups( "\\VHAISH3DC1", "DVA\VACOPHILLM") failed, error=5
NetUserGetLocalGroups( "\\VHAISH3DC1", "DVA\VACOPHILLM") failed, error=5
Ask domain <DVA>:
NetUserGetGroups( "\\VACO2DC1", "VACOPHILLM") failed, error=5
NetUserGetLocalGroups( "\\VACO2DC1", "VACOPHILLM") failed, error=5

groups = []

User "TEAMSITE_ADMIN" is removed, UserNameToID err=925

user: VHAMASTER\VHAISWURBANJ

Ask local system:
NetUserGetLocalGroups( "NULL", "VHAMASTER\VHAISWURBANJ") ["TeamSitePilot" "OCA_Local" "Users" ]
Ask domain <VHAMASTER>:
NetUserGetGroups( "\\VHAISH3DC1", "VHAISWURBANJ") failed, error=5
NetUserGetLocalGroups( "\\VHAISH3DC1", "VHAISWURBANJ") failed, error=5
Ask domain <DVA>:
NetUserGetGroups( "\\VACO2DC1", "VHAMASTER\VHAISWURBANJ") failed, error=5
NetUserGetLocalGroups( "\\VACO2DC1", "VHAMASTER\VHAISWURBANJ") failed, error=5

groups = [VHAISWWBDT\TeamSitePilot VHAISWWBDT\OCA_Local VHAISWWBDT\Users ]

user: VHAMASTER\VHAISWLET

Ask local system:
NetUserGetLocalGroups( "NULL", "VHAMASTER\VHAISWLET") ["Users" ]
Ask domain <VHAMASTER>:
NetUserGetGroups( "\\VHAISH3DC1", "VHAISWLET") failed, error=5
NetUserGetLocalGroups( "\\VHAISH3DC1", "VHAISWLET") failed, error=5
Ask domain <DVA>:
NetUserGetGroups( "\\VACO2DC1", "VHAMASTER\VHAISWLET") failed, error=5
NetUserGetLocalGroups( "\\VACO2DC1", "VHAMASTER\VHAISWLET") failed, error=5

groups = [VHAISWWBDT\Users ]

user: VHAMASTER\VHAISWBASNYK

Ask local system:
NetUserGetLocalGroups( "NULL", "VHAMASTER\VHAISWBASNYK") ["TeamSitePilot" "Users" ]
Ask domain <VHAMASTER>:
NetUserGetGroups( "\\VHAISH3DC1", "VHAISWBASNYK") failed, error=5
NetUserGetLocalGroups( "\\VHAISH3DC1", "VHAISWBASNYK") failed, error=5
Ask domain <DVA>:
NetUserGetGroups( "\\VACO2DC1", "VHAMASTER\VHAISWBASNYK") failed, error=5
NetUserGetLocalGroups( "\\VACO2DC1", "VHAMASTER\VHAISWBASNYK") failed, error=5

groups = [VHAISWWBDT\TeamSitePilot VHAISWWBDT\Users ]

user: VHAMASTER\VHAISWLAMAN

Ask local system:
NetUserGetLocalGroups( "NULL", "VHAMASTER\VHAISWLAMAN") ["TeamSitePilot" "Users" ]
Ask domain <VHAMASTER>:
NetUserGetGroups( "\\VHAISH3DC1", "VHAISWLAMAN") failed, error=5
NetUserGetLocalGroups( "\\VHAISH3DC1", "VHAISWLAMAN") failed, error=5
Ask domain <DVA>:
NetUserGetGroups( "\\VACO2DC1", "VHAMASTER\VHAISWLAMAN") failed, error=5
NetUserGetLocalGroups( "\\VACO2DC1", "VHAMASTER\VHAISWLAMAN") failed, error=5

groups = [VHAISWWBDT\TeamSitePilot VHAISWWBDT\Users ]

User "Administrator" is removed, UserNameToID err=925
User "user" is removed, UserNameToID err=925
0x508 0x1ff8 - 17:06:05.7370 B default Batch Jobs
0x508 0x1ff8 - 17:06:05.7370 0.0000 E default Batch Jobs
ERROR: no valid submit config file found in the current configuration (D:\iw\iw-home\local\config\submit.cfg,

\iw\iw-home\config\submit.cfg,

\iw\iw-home\local\config\submit.cfg) (2)
ERROR: no valid autoprivate file found in the current configuration (D:\iw\iw-home\local\config\autoprivate.cfg,

\iw\iw-home\config\autoprivate.cfg,

\iw\iw-home\local\config\autoprivate.cfg) (2)

Thanks in advance!

Regards,
Yama

rajnag

Hi Yama,

I am also experiencing similar proble but in TeamSite 5.5.2. I can post the solution how to resolve this would be great.

Thanks

nag.

aga1296

Background:
We are on Teamsite 6.1 Windows 2003 environment.
Everything was functioning until this morning when we were flooded with calls of users not able to create DCR's, import files or any related write operation.
We also found that the administrators could not create branches and folders either, except when they logged in as "master"
We checked all the permission on all the folders and nothing seemed changed - everybody had the right permissions as before.
Our iw.cfg had the entry "domain_list=SERVERNAME"
We also noticed that the domain dropdown during login had changes and suspected an PDC issue. Now we could not login to the domain anymore either from Teamsite

Resolution Path:
We tried to change the entry in iw.cfg to "domain_list=DOMAINNAME Smiley Frustrated

ECONDARY_DOMAIN_CONTROLLER_SERVER" - Now we could log in, but the permissions did not change. Figured out that entry was good for login only. Once logged in, the app starts looking at the PDC
A good idea would be to add the below entries into the "iwserver" section of the iw.cfg file to get more debug info in the trace.log about the sever trying to locate the PDC.
show_user_list=yes
show_user_list_verbose=yes

Resolution:
We found that the server guys has some WINS server downtime this morning. On further investigation, found that we just had one server specified in the WINS (of the Teamsite server (the PDC) - we included an second WINS entry (SDC) an voila - everything was restored. Make sure you run the "nbtstat -RR" command from the command line after this entry.

Harish