Yosemite Server: After upgrade, OD is read-only

HardySch

I am not having kerbros fails, but I also cannot edit certain items in my Users and Groups pane.

All the options on all Network Users are grayed out to change password.

I also cannot change items such as global password policies nor disable login, etc.

I can Add a new user, but as soon as the user is added, the options are grayed out to change password, etc.

Any assistance greatly appreciated!

Thought I had the same issue until I noticed that Server.app v4 now has a lock icon at the bottom left of the Accounts > Users pane. Click the lock icon and enter you Directory Admin username and password when prompted.

Hope this helps!

Thanks for the quick response Simon.

Umm, I must be blind-- I am seeing no lock in Server.app under Accounts>Users

you only see the lock if you select at the top the network users or network group

Looks like the automated moderator got me...

Thank you toop68. You are correct, and I can now edit/update network users but you do need to limit the view to network user/group and auth with diradmin.

Thanks!

John

I've just update My test server and I can't add or change network user.

When I login with my diradmin account to unlock, the window refuse my login (but it work I can connect to the server.app with this account).

Someone else have this issue ?

I follow this proc 2 times : http://apple.stackexchange.com/a/88395 and it works

I had to reset the diradmin password using this

OS X Server: How to reset the Open Directory administrator password in Mavericks

Then I was able to unlock the lock using the diradmin login. After that all was good.

Definitely easier than doing it the stack exchange method which is based on pre-OSX 10.7 authentication.

Thanks, that was the easy solution

My Exact rendition of this process (summarized from this forum):

Still logged in as Macintosh Administrator

Clicked on Server app and clicked on "manage" on the top bar

"Connect to server"

Choose the server then continue

The Credentials box pops up and I trade the Macintosh Administrator username for the Directory Administrator username

I use the Directory Administrator password and remember in keychain

Server App Starts up/reconnects

I click on "Users" under Accounts on the left column

At the top right I click the dropdown arrows to select "Local Network Users"

The Lock Icon now shows up at the bottom

I unlock, supply the Directory Administrator Credentials, and now I can make changes to user accounts

Previous to this, after the server v.4.0 update, I had read-only privilege in Open Directory and could only create a local user account.

The option to create a local network account wasn't even there and attempts to add a user to a network group was met with the

"The operation couldn't be completed..(com.apple.Server.Accounts error 2.)" message.

All set now so thank you for everyone's input. I just summarized what you all said for some of my co-workers and figured I'd share..

Thanks Simon, we had the same issue but hadn't seen the padlock due to having 'All Users' selected. Changed to Network accounts, unlocked with Directory Admin credentials and all is well again.