Graham Perrin's List: [sussex.ac.uk #84311]

• 10.6.5 on Snow Leopard server
• reset the permissions of all users to Deny access to the login menu
• disconnected an ipod and an external HD
• user accounts were gone
• rebooted several days later
• all non-system users on my machine were deleted. Only "Other" showed
• 10.6.5 update made backups of the Directory Services and shadow passwords in /private/var/db as the xar archives 'dslocal-backup.xar' and 'shadow-backup.xar'
• Restore the settings for each deleted user, as well as all shadow passwords
• cd /private/var/db
  
• xar -xf dslocal-backup.xar dslocal/nodes/Default/users/username.plist
• xar -xf shadow-backup.xar
• problem was caused by USB drives
• easy to replicate
• remove the drive
• login screen is then refreshed and you will immediately notice that any user account not currently logged in has been removed
• or (b) shutdown the system before removing a USB drive
• either (a) leave ALL user accounts logged in
• three computers
• 10.6.4
• Thank you, Ilude.
  
• ejecting and unplugging my external USB hard disk, which I use for Time Machine backups
• very specific case
• USB connected drives with a "Fat32" partition
• pull the drive. All accounts will disappear except for "other"
• Users (but not home directories) missing after a USB device is ejected

  • http://diigo.com/0ei0v for highlights from this post. 
  Add Sticky Note
• casting some nets
• 1. Had there been any use of a USB drive with spinning hard disk (non-flash)?
   
   2. If so:
   
   — did that drive rely on one USB port alone for power?
   
   — was any partition on that drive used by Time Machine?
   
   — was any partition on that drive formatted NTFS, NTFS-3G or FAT?
• 3. Were there any FileVault home directories?
  
• 4. Was Sophos Anti-Virus installed?
  

27 more annotations...

• Users (but not home directories) missing after a USB device is ejected
•  

  Return to Thread
• 05-Jan-2011
• not over-focused on delta or combo updates to 10.6.5
• three times — with one USB drive (used at two computers)
• GPT (GUID Partition Table)
• Journaled HFS+
• Time Machine
• NTFS-3G
• FileVault
• first two incidents (first a MacBook Air, then an iMac)
• c. user disconnected a USB drive
   
   d. users disappeared from the login dialogue.
• third incident may have been slightly different
• restarted the OS
• sleeping
• mains power adapter was not connected
• power key
• i. users disappeared from the login dialogue.

16 more annotations...

• referred from http://discussions.info.apple.com/thread.jspa?threadID=2644133 - Graham Perrin on 2011-01-05

• referred from http://discussions.info.apple.com/thread.jspa?threadID=2644133 - Graham Perrin on 2011-01-05

• referred from http://discussions.info.apple.com/thread.jspa?threadID=2644133 - Graham Perrin on 2011-01-05

• referred from http://discussions.info.apple.com/thread.jspa?threadID=2644133 - Graham Perrin on 2011-01-05

• referred from http://discussions.info.apple.com/thread.jspa?threadID=2644133 - Graham Perrin on 2011-01-05

• referred from http://discussions.info.apple.com/thread.jspa?threadID=2644133 - Graham Perrin on 2011-01-05

• referred from http://discussions.info.apple.com/thread.jspa?threadID=2644133 - Graham Perrin on 2011-01-05

• Part 2
• Missing Persons in DSLocal
• a disk with Leopard installed is being treated as an ‘external accounts’ disk
• when it’s removed
• system is deleting the users
• disable external accounts on the Open Directory Master
• March 4, 2009

5 more annotations...

• referred from http://discussions.info.apple.com/thread.jspa?threadID=2644133 and from http://derflounder.wordpress.com/2009/10/11/the-night-loginwindow-put-out-a-hit-on-my-user-accounts/ - Graham Perrin on 2011-01-05

• referred from http://discussions.info.apple.com/thread.jspa?threadID=2644133 - Graham Perrin on 2011-01-05