Re: can't verify disk

E Z Peaces <cash@xxxxxxxxxxxxxxx> wrote:

Jolly Roger wrote:
In article <pZECk.35881$kh2.32357@xxxxxxxxxxxxxxxxxxxxxx>,
E Z Peaces <cash@xxxxxxxxxxxxxxx> wrote:

My aunt has a G5 iMac with Tiger. My cousin used it extensively during
a visit of several days. During the visit, my aunt phoned to say she
was no longer able to contact her SMTP server using mail.app. It worked
after she restarted her computer.

Tonight she called to say she couldn't contact the SMTP server with
mail.app or webmail. I could contact that server from my house.
Restarting her computer didn't help.

She went to DU, and when she pressed "verify disk", it asked her user
name and password. I've never known DU to do that. It rejected the
user name and password she gave it.

Disk Utility has required an administrator name and password for certain
operations for some time now (I believe since Mac OS X 10.3 - possibly
earlier). This is perfectly normal.

Why would it be needed just to verify a disk? I was running through the
same steps at my house. As always, DU verified my disk without asking
my password.

If you have startup up the computer from the hard drive, then verifying
your startup disk requires temporarily suspending write access to it by
all other processes, so that it isn't changing state during the verify
(read access might also be suspended for performance reasons).

This is clearly a task which requires admin privileges, because Disk
Utility has to temporarily stop everything else from getting disk
access, including applications run by other users, or other parts of the
system.

If you boot from CD and verify the hard drive from there, no special
permissions are required because the hard drive is able to be unmounted
and verified without other software trying to access it.

The same applies if you have booted from hard drive and verify a
non-startup volume (e.g. a second hard drive or second partition on the
same drive). If no files are open on that volume, Disk Utlity can
unmount it and verify it without asking for admin privileges.

A non-admin user might require authentication using an admin username
and password even if the drive can be unmounted.

The other thing that puzzled me was that she had to type in her user
name. If Tiger ever asks my user name, it's multiple choice.

The only "mulitple choice" for name selection are the login screen, list
of accounts in System Preferences, and fast user switching.

If you are asked for an administrator password to approve a specific
task, a dialog appears with fields to type in the username and password.

If you are logged in as an admin user, your name is pre-entered in the
username field, and you have to type in the password.

If you are logged in as a non-admin user, the username field in the
authentication dialog is blank. You have to type in the username and
password of an admin user.

If your aunt is being asked to authenticate and it isn't filling in the
username automatically, then it sounds like her computer has somehow
ended up in a state where the only account on it is a normal user, and
there is no user with admin privileges. (I've occasionally seen this,
usually due to mistakes made with advanced tools like NetInfo Manager.)

You can check this in System Preferences > Accounts. Each user has an
option "Allow user to administer this computer". You can't change your
own setting, but it is displayed (greyed out). I expect you will find
that her admin option is unchecked.

Since you also can't change her password, I suspect something is
seriously mucked up with her user account settings in the NetInfo
database (10.4 or earlier), or Directory Services database (10.5).

This may be difficult to fix, depending on the scope of the problem.

The first thing to do is to confirm my theory that she is no longer an
admin user (and there are no other admin accounts on the computer).

If my theory is right, then you will need some way to create a new admin
user account. This isn't particularly easy but there is a method of
doing it via single user mode and typing in a series of commands. This
procedure is complex enough that I wouldn't recommend trying to talk
your aunt through it.

The goal is to force Mac OS X repeat the initial setup procedure for the
computer. As part of that, you will create a new administrator account,
which has a different account name from your aunt's normal account.
(Your aunt's account will remain on the computer in its current state.)

The new admin account can then be used to diagnose and fix the problem
with your aunt's account. After this is done, and your aunt's account
has admin privileges, you could delete the newly created admin account,
or keep it in case of emergencies.

I could give you the detailed instructions, but they are available on
the web in various places. The key detail is that you need to delete the
following file:

/var/db/.AppleSetupDone

The absence of this file will trigger the initial setup (and admin user
creation) when you next restart.

Do a Google search for "AppleSetupDone" to find several articles which
describe this.

Since your aunt doesn't have a valid admin password, you won't be able
to delete this file while logged in normally. That's where single user
mode comes in.

If someone did not change her password, it could be that there is a
problem preventing the authentication system from working properly.
Usually if that's happening it means bad news. If this is the case, you
may be able to recover from it by booting on the system install CDs that
came with the computer and resetting the password as described in the
following Apple support article.

Read the section titled "Resetting the original administrator account
password":

<http://support.apple.com/kb/HT1274>

Thanks. It says you can reset the password even if you don't know the
password. I hadn't realized that was possible.

Note that this procedure will only work if her account is an
adminstrator. If she somehow lost admin status (which seems likely given
the evidence), this method won't work.

Resetting the password has the disadvantage that you lose access to the
keychain. Any passwords stored in the keychain (such as web sites or
e-mail) will also be lost, unless you can guess what the old password
was.

It seems as if I could use three accounts: visitor, personal, and
administrator. In past experimenting, one drawback I found was that
more accounts meant more possibilities of forgetting a password.

Easily solved: write down the passwords and store them somewhere secure,
even if only for the infrequently used accounts.

Another was that switching between accounts was a bit of a hassle.

In 10.3 and later, there is a feature called "fast user switching" which
can be enabled in System Preferences > Accounts > Login options. It adds
a menu in the top right corner of the screen, though which you can
select another user and log in as that user (requiring their password).

When you do this, you have two users logged in at the same time. The
screen "rotates" to show the new user's desktop.

Switching back to the first user is done through the same menu (and
requires their password). This can be done repeatedly to hop back and
forth without having to quit applications or lose current state.

If one user logs out, the login screen shows that the other user is
still logged in.

It isn't a good idea to shut down or restart the computer while multiple
users are logged in, because the inactive ones will effectively have all
their applications force quitted, which may result in loss of unsaved
data. If you want to shut down or restart, it is best to log out of each
user except one, then restart or shut down from that user account.

It is also a good idea to not have multiple users logged in while doing
things like installing software updates. Log out of all other users
first.

--
David Empson
dempson@xxxxxxxxxxxxx
.

Relevant Pages

  • Re: cant verify disk
    ... DU verified my disk without asking ... If you have startup up the computer from the hard drive, ... I verified my startup disk from my admin account with several apps open. ...
    (comp.sys.mac.system)
  • Re: Incoming E-Mail - cant create contact in OU
    ... central admin pool different than the web app. ... that account a little (if the web app is compromised or something, ... So I started with giving the app pool account domain admins permissions then ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Security Breach in AD! Help!
    ... > about 5 minutes the user was removed from the built in admin group. ... > changed the default domain policy, the default domain controller policy, ... >> auditing of account logon for success and failure and account management ... >> success and failure in Domain Controller Security Policy. ...
    (microsoft.public.win2000.security)
  • Re: cant verify disk
    ... DU verified my disk without asking ... I verified my startup disk from my admin account with several apps open. ... a dialog appears with fields to type in the username and password. ...
    (comp.sys.mac.system)
  • Re: Wscript within VBA
    ... One box is running VBA code,. ... One box is a domain controller, or has an account trusted to manipulate AD ... >> It posts a form to an ASP page, ... >> Since what you want to do sounds like it will require admin privileges, ...
    (microsoft.public.vb.database)