forappie
Level 1
(25 points)
Q: After upgrading to Yosemite all accounts disabled
After I upgrade to Yosemite I can login once or twice before I get the message "Your account has been disabled. Contact your system administrator for more information". This applies to ALL 3 account (2x administrator and one standard account which I use most of the time). I have tried to reset the passwords, repaired permissions, repaired user ACL (by restarting in re3covery mode) but nothing seems to work.
After restoring from a Time Machine backup several weeks old and ensuring everything worked (10.9.5) I undertook a second attempt and even managed to upgrade to 10.10.1. However, after repairing disk permissions I had the same problem and all my accounts are disabled.
What can I do?
Mac Pro, OS X Yosemite (10.10.1)
forappie
Level 1
(25 points)
I finally cracked the problem after many tests and 2nd line Apple server support group in Ireland. The problems were caused by one or more 'rogue' password policies distributed by my Mac home server. These password policies were no issue on the Mavericks client but created havoc when I upgraded to Yosemite.
I had to take the following steps:
- Remove Yosemite client from ProfileManager running on (home) server. When your client is enrolled, ProfileManager can still remove the client even if you can't login yourself
- On the Yosemite client, enable root and create a new admin account (alternatively I could also re-run the Yosemite installer over the existing client installation as this unlocked all accounts for 1 or 2 restarts)
- Login with new admin account and disable root
- in terminal on the client with the new admin account execute 'sudo /usr/bin/pwpolicy clearaccountpolicies'. This responds with 'Clearing global account policies'. This is described in technical article HT203114 under slightly different circumstances but it worked for me.
Note: it may be useful to run the following command before and after clearing the policies to see whether it worked: sudo /usr/bin/pwpolicy getaccountpolicies . This command shows the global account policies in force. - before re-enrolling to the server delete the old password policy on the server (and replace by new policy). The new policy no longer shows the maxfailedAttempts rule which caused all the problems.
- re-enroll client to profile manager as required
These steps solved it for me. I have been using my Yosemite client now for 2 weeks without the issue returning.
For your information I also tried a number of other solutions which didn't work for me:
- Running the Yosemite installer over the existing Yosemite client with problems only allows 1 or 2 logins before the accounts get disabled
- backup/delete/restore Open Directory on the server ... after 1 or 2 restarts all accounts were disabled again
- even after starting with a clean Open Directory (I deleted the existing one and created one from scratch) the accounts still got disabled. This gave indication server must put some policies permanently on the client
- starting without network didn't make any difference (ie the password policy is present on the client to prevent accounts to login). Again this makes you think there are permanent policy rules on the client
Also note the 'pwpolicy clearaccountpolicies' option only exists in Yosemite, not Mavericks. see 'man pwpolicy' for details.
Pfffffttttttt
