Admin password unknown 1

[BrianCharlton]

CE10 setup uses predominantly NT based ID's from 2 domains conatined in 2 groups. One of the domain groups membership was changed and so to refresh the user list in CE the authentication update was completed. This has failed to read the local group - crystal nt users and during the update has removed all NT based ID's leaving 4 Enterprise ID's. These are:
User 1 - not an admin password unknown
User 2 - admin, password unknown and acc now disabled due to failed password attempts
Guest - disabled and no rights
Enterprise admininstrator - password unknown

Can anyone help?

At this moment in time the only option I see open is to restore the MSDE database from prior to the authentication refresh to repopulate the security DB or a rebuild......

 

[groggle]

The following is a procedure I have heard works in BOE XI. You will need to relate it to the CE 10 System database. (I don't have one handy to check)

I strongly advise you to back up the system database before attempting this procedure.

I have heard the following procedure can be used. At the database level, delete the record with OBJECTID 13 from the CMS_INFOOBJECTS5 table. (It's usually the first record in this table and presumably is the administrator account record)

Restart the CMS and the ID will be recreated with a blank password. I can't stress enough that this should be as a last resort only, and should only be done after a thorough backup.

 

[BrianCharlton]

Thanks for the response - most appreciated.

Since my original post I have recovered the CE10 database within MSDE from the backup taken on the day before the loss of the user ID's. This was populated with the NT based user ID's (actually recorded with SID's in the table you mentioned) and as these ID's are still active I have now been able to login.

I have now reset the local Crystal Admin password and written it down (just in case)

Steps for my recovery - must have a known good CE10 backup:
Stop Crystal Enterprise related services
Back up CE10 database (Just in case)
Restore previous CE10 database prior to change
Restart Crystal Enterprise related services
Login with NT based id

The weird thing is if I goto groups and look at teh membership of Crystal NT Users - the membership can not be read for the local groups. So I think i am still in the same situation where if I refresh authentication to create ID's based on the membership of thsi group all the NT users will drop out. The error message i am getting is:

"There was an error while retrieving data from the server: NT Authentication failed to get the members of the group with ID "SID\\Server Name". If the problem persists, please delete this group and re-map it into Crystal, then try again."

Any suggestions?

You mention objectID13 in the reply but within my database the actual admin acc is objectID12 and objectID13 is crystalenterprise.user. A variation of your recommendation may well have worked and I really appreciate the time you have spent to reply. thanks again.

 

[groggle]

Is the NT Authentication still setup correctly?

Can you Map a test NT group to CE 10 successfully, and have the member account get created successfully?(create a test NT Group in the local domain and add a new account to it - providing you have authorization to do so)

If so, you should be able to remove and remap the Crystal NT User Group back and the users that are a member of that group should reappear.

However, it may cost you the time to reapply security for this group throughout the system.

 

[BrianCharlton]

Thanks Groggle

The authentication does still seem to be set-up correctly.

A new group can be added without issue however any update based on the revised groups fails with a message relating to the original Crystal NT Users group which is still added in. This doesn't then appear to actually create all the users necessary from the added group or the original. This stops me from adding a test group with the original groups membership prior to removing the one that is failing.

I am busy documneting the Crystal group set-up with membership to allow me to remove this problem group and add it back in (with or without recreating this group depending on which provides the most success) - obviously if this results in all the NT based CE ID's being removed from the system I will then be in a position to relatively quickly set up the access again.

One last question if you can help - the majority of recurring reports (95%) were published using one NT based ID. I have added an Enterprise alias, set a password etc for this ID. Am I right in believing that if the NT authentication update removes all NT based ID's when the group is removed, that the reports will remain intact as the ID will still exist from an Enterprise perspective?