[sims] All users unable to log in "invalid username/password" error

[Easy_506]

Morning all,

 

Got an interesting one today, our sims is no longer allowing any users to log on. It attempts to process the request and then presents the prompt "invalid username or password".

 

I'm unable to log in to sims server side also.

 

I have already tried bouncing the server, checked the event logs, and checked the size of the database and transaction logs.

 

Whilst I wait for support from the LA, has anyone else got any ideas?

 

 

Thanks in advance!

[MrMat]

You ran any upgrades recently? Like SQL, SIMS etc?

[crt404]

Have you checked the time on the SIMS server? Years ago I had issues when the clock skewed more than five minutes and kerberos couldn't do it's thing!

[matt40k]

Checking SQL server is running on the server would be the first thing to check.

[Easy_506]

Hi guys,

 

No changes whatsoever to Sims server since the Spring 2014 update was applied in April. Literally just stopped allowing users to log in.

 

Server time has been an issue in the past but is not now. All systems showing correct time.

[RPilkington]

I would check AV/Firewall to see if anything is blocking incoming connections to the server Edited July 2, 2014 by RPilkington
spelling mistake

[andydis]

What does SQL manager say against the databases ? Checking they are not "recovering". Also check the default databases

[Ephelyon]

Does SQL Server Management Studio reveal anything - authentication logs etc? Also, are all databases attached as they should be?

[dalehopper]

have you checked connect.ini is pointing at correct place

[Easy_506]

Hi guys,

 

Quick update - I did check the firewall, database attachment, sql studio, connect.ini etc etc.

 

Just spent the last 45mins or so in a remote session with Capita and they couldn't explain how or why it's happened but basically about 90% of our users have had their accounts reset to 'inactive'. During that process Sims has also re-amended users' usernames to LastnameFirstname instead of our normal naming convention which is FirstinitialLastname.

 

The 'fix' is for me to log in as sysman and manually change each affected user's account back to 'active' and to amend their username back to our naming convention, then supply the new randomly generated password.

 

I don't know if any edugeekers have ever had this before, I've certainly never encountered the issue, neither has the support teams from my LA or Capita. Very strange indeed.

 

Thanks for all the replies above.

[Ephelyon]

Ah... that sounds like the database has been detached and subsequently re-attached (or updated/migrated) manually without using Capita's DBAttach tool. We had something similar with that before.

[cullingsh]

That's not a fix

How much data is likely to have changed today (given most people can't login) - I would be looking to restore the database from last nights backup as a quick fix. Or if I could get away wit it the relevant table but bit risky and would take ages of digging to find it.

[Easy_506]

That's not a fix

How much data is likely to have changed today (given most people can't login) - I would be looking to restore the database from last nights backup as a quick fix. Or if I could get away wit it the relevant table but bit risky and would take ages of digging to find it.

 

I'm painfully aware that's not a fix - after all i'm the one who has to sit here manually changing everyone's details for however long that's going to take(!).

 

I can certainly vouch that no database changes/upgrades were done on the sims server since the Spring 14 update was released in April.

 

Re: last night's backup - the problem first occurred at 3.40pm yesterday afternoon and the backup took place at 6.07pm. I was toying with the idea of going back to the 30th June backup, but unfortunately it's reports season and so much data has been written in that 24hour period that i'd probably be lynched by the staff if I said they'd lost it all.

[Easy_506]

That's not a fix

How much data is likely to have changed today (given most people can't login).

 

Oh yeah...should add, two support staff members were able to log in, so of course they shared their login details with EVERYONE :-/

 

So yeah there's probably too much data from today as well now.

[Jasbo]

That's your day sorted then....

 

Has anyone else got admin access at a level allowing them to do any actions that would result in the issue?

 

Perhaps the data entry would be less arduous after you have flogged someone?

 

Have a quick scan round the office for any lack of eye contact and flushed faces

[matt40k]

I wonder if the running the sims transfer login would have kicked it into work, or doing a backup, restoring the backup from a few nights ago then restoring the backup you just did would have resolve it. Still that would take rather a long while and only might fix it.

 

Does re-enforce what I said about using Windows Auth over SIMS SQL Auth!!

[matt40k]

Ohh... and if you had staff email addresses in SIMS, you could email them the temp password (insert security disclaimer) - if only there was a tool to bulk import staff email addreses into SIMS .net - https://simsbulkimport.codeplex.com/

[Easy_506]

That's your day sorted then....

 

Has anyone else got admin access at a level allowing them to do any actions that would result in the issue?

 

Perhaps the data entry would be less arduous after you have flogged someone?

 

Have a quick scan round the office for any lack of eye contact and flushed faces

 

 

 

Aaaaaaand i'm done

 

Thank goodness we're about half the size of a regular secondary!

 

Must say...big shout out to Capita on this one. Spot-on support wise, and whilst it wasn't a quick 'fix', I can't complain about the difficulty of the task.

[Easy_506]

Ohh... and if you had staff email addresses in SIMS, you could email them the temp password (insert security disclaimer) - if only there was a tool to bulk import staff email addreses into SIMS .net - https://simsbulkimport.codeplex.com/

 

Aah yes this issue came up earlier. But we are on Office365 in the cloud for email, and I've discovered that SMTP connections cannot be made from behind a proxy (encountered this issue when attempting to set up monitoring systems on virtual servers, plus Spiceworks and PaperCut).

 

I like our email system but I think i'm going to build an exchange server soon to gain some more direct control over things.

[vikpaw]

If backup isn't an option, I would still be tempted to try proper detach reattach, or restore as suggest by Matt to see if it kicks the accounts into place. But, making them inactive is a weird one. If you move data to a new server and just badly attach it, i don't think that adjusts user status.

 

However, even without a quick fix, it's not that bad. An inactive account should have no username (...?), so in System Manager settings, go and change your default username to your preferred format. Then when you click active, it will put the correct username in so long as you don't have dupes, in which case you'll need to do some manual checking.

 

Now search for active = No. The problem is going to be a lot of the users there are probably leavers, so you'll have to be careful.

But, click on Active and it will create username, so keyboard: Ctrl+S to save. Then Ctrl+. It's supposed to be a > but full stop works on my keyboard.

This takes you to next user and highlight is on active, and on my system it even ticks active for you, but if not, space bar, then loop back to ctrl+s.

You could even write a script, but it'll be just as quick to get some RSI and do it by hand.

 

To distribute passwords, you can then loop through your actives and click email if it's configured, or there is a report i think that prints out default passwords. Can't remember where, the print screen doesn't show them but someone asked a while ago and i think you can print them out.

 

EDIT: Dang too late! sorry at least it's there for posterity.

Edited July 2, 2014 by vikpaw
too late!

[matt40k]

But we are on Office365 in the cloud for email

 

I thought it used your local email client - I use Windows 8 Mail client which uses the ActiveSync ie HTTPS at home and that works ok. Also, I think you can set up a SMTP relay with Windows Server, lot less of a headache then exchange - thought that was the idea of o365, to take away the hassle! Also if your on LA broadband they normally have a SMTP relay you can use.

[Jasbo]

Don't you hate it when something comes along and takes out your day...!

 

Def talk to your lea if yo have one, we have 365 with no onsite exc wtc and use their SMTP relay for all kinds of in house monitoring stuff, backup alerts etc.

[Easy_506]

I've had lots of dealings with our LA recently and not a single mention of an SMTP relay. In fact I had to go to some trouble in order to supply LA details of ports to open for particular apps/software. Got the ports opened up and the monitoring software still doesn't work. I'd like to think I've covered all my bases but unfortunately I wasn't the person who built or configured this network, so when you've got 2 x 3rd parties who both say 'oh everything looks ok, it *should* work'...THE END... you can find months slipping away without actually getting much up and running.

 

However, I'm no IT genius so chances are there's a way to get everything sorted, I just need to find the right people to collaborate with.

[WayTooTricky]

We had a similar issue following an upgrade. Turns out there's a flag that was left switched on by the staff dialed in to do the upgrade. Only administrators had permission to log in if it is set. Not sure where the flag is but it took them a day to work it out and sort it.

[vikpaw]

We had a similar issue following an upgrade. Turns out there's a flag that was left switched on by the staff dialed in to do the upgrade. Only administrators had permission to log in if it is set. Not sure where the flag is but it took them a day to work it out and sort it.

There is a setting that puts the system into single user mode - this is commonly used, however, it only works if everyone is out of the system. Otherwise, the first person to access becomes the single user, and you have to kick them out . Maybe it's not the same thing, but sounds similar, if they left SIMS open on the server it would have stopped anyone else getting access.