User enrollment authorization problems

If you get an error (NTA0282) that indicates insufficient authorization to create and update integrated server users, take action as appropriate.

• If you are trying to enroll users and groups to a domain for the first time, ensure that you set up a QAS400NT user ID to provide the necessary authorization. The topic, The QAS400NT user, tells you how. Also ensure that the user is configured as a traditional user, which means that the user must specify an iSeries™ password and have local password management enabled. See Types of user configurations.
• If you have been successfully enrolling users and groups for awhile, check to see if the i5/OS password for the QAS400NT user has expired. When the QAS400NT user password expires, the account on the integrated server also expires. To correct this situation, do the following.
  1. Enable the integrated server account.

     On a domain controller:

     1. Open Start —> Programs —> Administrative Tools.
     2. Select Active Directory Users and Computers.
     3. Right-click Users, then double-click QAS400NT.
     4. Click on the Account tab at the top of the User Properties window.
     5. Change the Account expires date to a date in the future and click Never.

     On a local integrated Windows server:

     1. Open Start, Programs, Administrative Tools.
     2. Select Computer Management.
     3. Expand System Tools; then expand Local Users and Groups.
     4. Right-click QAS400NT from the list.
     5. Click on the Account tab at the top of the User Properties window.
     6. Change the Account expires date to a date in the future and click Never.
  2. On i5/OS, use the Change user profile (CHGUSRPRF) or Change password (CHGPWD) command to change the QAS400NT user password.
  3. Restart the iSeries User Administration Service.
     1. Click on Start, then Programs, then Administrative Tools, then Component Services.
     2. Click on Services.
     3. Click on iSeries User Administration, then right-click Stop to stop the service.
     4. Click on iSeries User Administration, then right-click Start to restart the service.

  Restarting the service automatically retries the enrollment of the users and groups.

  To avoid this problem, be sure to change the QAS400NT password periodically on your i5/OS system to prevent the password from expiring.

  If you have more than one iSeries with multiple integrated servers that participate in a Windows domain, you can minimize password expiration problems by implementing the steps described here: The QAS400NT user.

• If the problem still persists, check the technical information databases at the IBM® iSeries Support Web page . If you cannot find the solution there, contact your technical support provider.