I am using a batch script to find old users and machines and delete them...
How does the command ShowOldUsers work? What is an "old" user?
Users that are still connected to active computers are deleted via this approach.
In this scenario, you can see the problem:
User Alice is assigned to the computer Neptune.
Alice is always online and does seldomly reboot ( a few months or more). When I am now executing the ShowOldUsers operation and then delete the user I have a problem, SINCE Alice is still active on her computer Neptune...
Is there an option to check (via script), whether a user is still assigned to a computer which is regularly synched (and not rebooted and therefore there is no user that logs on)?
Another approach of this question:
What could be the reason for that: I am checking the audit log of a machine and I can see, that there are successfull syncs every 8 hours with the server, but NO reboots or user-login audits since MONTHS? I do not believe that a computer is running more than 3 or 4 months without a reboot...?
And if YES : HOW can i find out then, that the user is still active (via a script) and is so it shoudl not be deleted...
Solved! Go to Solution.
Post client pc "SbClientLog.txt" and user and machine audit logs, so we can have a meaningful discussion here.
If you tie user accounts to AD (there is connector app for that), then you can automatically delete EEPC user account once it is deleted from AD.on 8/19/10 1:10:50 PM EDT
I managed to receive the logs from the user...
the user is using mostly the hibernate mode... but was definitely also rebooting his client from time to time.. but these events are not logged in the audits... whats wrong? what can i do?Nachricht geändert durch harrerch on 23.08.10 08:37:38 GMT-06:00
nothing - there's nothing in any log to indicate there's a problem, and also nothing to indicate user savignac has logged on since 18th January. My guess is they are using a different user ID.
I'm guessing (since this is an older version) that there's a problem with the audit system which is so subtle as to not be reported as an error - eBoot the machine to clean everything up, that should reset everything to user audit gets captured again.Message was edited by: SafeBoot on 8/23/10 10:45:22 AM EDT
EEPC 5.2.3 is not that old! and should work properly.
I would try to reconcile user and machine ID's using pre-boot Option/Recovery features. Before one applies heavier procedure of Emergency Boot.
what if a simple machine recovery does not help? the machine recovery was followed by user-deletion and a recreation of the user on the server, synchronising the changes onto the client. also creating a new user, called temp and syncing this one also onto the client.
this did not help, both users (temp and regular one) could not login, since a message saying, that parameters are incorrect appeared.
how can i fix such problems? may it be, that the local DB is broken or corrupt?
i did a emergency boot on a computer with the same problem last week and the computer got stuck within the safetech cd during the emergency boot process.
so what can i do instead? mount the sbfs and execute chkdsk? or is there another option like deleting ALL users from the affected client on the server, synch this onto the client, and then recreate the user?
eBoot is the only thing which will rebuild SBFS, other than disable/enable. There's not much else you can do - you could mount SBFS and chkdisk it I guess, it's not guaranteed to fix everything though, only things which Chkdsk can find.
okay, thank you!
and what would you recommend to do in case the emboot procedure will be stuck again?
last time when this happened, i got a 92h error after the next reboot.
so i want to be 100% sure, that it will fix my problem.
there's no guarantees I'm afraid - it depends on the health of the drive, stability of the BIOS, 3rd party drivers etc. You can almost always decrypt the drive with Safe/WinTech though if the worst case comes up. 92H means something bad moved SBFS, or updates to the MBR were blocked - just eBoot it again and make sure any AV type software is not blocking things.
The other thought is you may have a root kit virus getting involved.
I would recover any useful data from encrypted drive, reimage disk with standard OS image and redeploy EEPC.
Then monitor situation to see if it improved or not.