Centrify

Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-7417: How to troubleshoot when a user show up in Show Effective Users but adquery for the user shows the status as zoneEnabled:false?

Authentication Service ,  

30 August,16 at 06:13 PM

Applies to: All versions of Centrify DirectControl

Question:

How to troubleshoot when a user show up in Show Effective Users but adquery for the user shows the status as zoneEnabled:false 

In the Centrify DirectManage Access Manager/DirectControl console, the user does show up in "Show Effective Users" for Centrify servers.  
But in the UNIX machine, running adquery shows as zoneEnabled:false, for example:

# adquery user -A jsmith

unixname:jsmithi
uid:732430
gid:732430
gecos:John Smith
home:/home/jsmith
shell:/sbin/nologin
dn:CN=John Smith,OU=Local Consultants,OU=Information Technology,OU=US,DC=acme,DC=com
samAccountName:JSmith
displayName:John Smith
sid:S-1-5-21-2071661896-1205500103-1105138716-65934
userPrincipalName:JSmith@acme.om
canonicalName:acme.com/US/Information Technology/Local Consultants/John Smith
passwordHash:x
accountExpires:Never
passwordExpires:Thu Apr 18 20:22:54 2013
passwordWillExpire:9
nextPasswordChange:Sun Jan 20 19:22:54 2013
lastPasswordChange:Fri Jan 18 19:22:54 2013
accountLocked:false
accountDisabled:false
zoneEnabled:false
unixGroups:jsmith
memberOf:acme.com/Groups/Domain Local/Information Technology,acme.com/Groups/Global/Active Email Users,acme.com/Groups/Global/QA,acme.int/Groups/Global/Domain

Answer:

Since the user show up in "Show Effective users", it indicates that the user have a valid UNIX profile in the Zone.

So please check if the user is included in the file 

  /etc/centrifydc/user.ignore

If so, please do the following:

a) edit the file and remove the user.  
b) run the command adreload
c) make sure the user is not included in the files /etc/centrifydc/user.ignore and /etc/centrifydc/uid.ignore

Then run adquery user -A <username> to verify zoneEnabled:true for the user.
 
For further reading on building a complete Zone Profile and login issue, please see:

KB-3038: How to add an AD user into a Centrify Zone.

KB-3020: How to troubleshoot if a user is not shown in "Show Effective Users"

KB-3029: Running adquery shows the user's shell as '/sbin/nologin' and user can't login

Related Articles

 articleKB-2260: How to troubleshoot if a user is not shown in "Show Effective Users" articleKB-6041: How to show current license type in use by adclient articleKB-3029: Running adquery shows the user's shell as '/sbin/nologin' and user can't login articleKB-6040: How to change the license type in use after adclient successful joined to the AD? articleKB-20210: Common Questions Regarding Centrify DirectControl and CoreOS articleKB-6073: How to join the Linux/Unix Centrify Server to Active Directory with specific Computer Role? articleKB-6056: How to report the group policy settings that are in effect for the local computer? articleKB-6038: How to specify the license type to use when joining the server to AD using adjoin? articleKB-3038: How to add an AD user into a Centrify Zone.