Advanced Server 7.3A on OpenVMS 7.3 with DCs upgraded to Window server 2008

[Dean Lahodny]

Our windows domain controllers were upgraded to windows server 2008.

Since then if you try to logon to windows domain on VMS the following is displayed:

HARRISRANCH\\WSVMS> logon
Username: administrator
Password:
%PWRK-E-LOGONERR, error logging user "administrator" onto domain "HARRISRANCH"
-LM-E-ERROR_NOT_SUPPO, this request is not supported by the network.

The error - An attempt was made to logon, but the network logon service was not started - is received from windows when trying to access the pathworks shares


Prior to the domain controller upgrade last night Pathworks has worked almost flawlessly for more years than I care to remember.

Can anyone point me in the right direction to solve this?

Let me know if I can supply any further information or have left anything out.

[Karl Rohwedder · Accepted solution]

The latest version I know of is V7.3B with Patchset 0021.

The releasenotes from the patchset 21 state:
Problem: ASV does not work as member server to Windows 2008 domain

Solution: There is a policy which exists on Windows 2008 domain controllers that
will allow the domain controller to allow NT4 clients. The policy is
under "Computer Configuration->Administrative Templates->System->Netlogon->
Allow cryptography algorithms compatible with Windows NT 4.0".

You need to enable this policy in order for ASV to correctly function as
member server in Windows 2008 domain.

regards Kalle

[Ian Miller.]

Note Advanced Server 7.3B ECO1 is also available.

[Dean Lahodny]

Do I need to upgrade to the 7b version before this change will work? In the process of the PDC being upgraded the name was also changed. When I went into the pwrk$config to change the PDC I get an error creating the SAM database. During the procedure it appeared that the username and password were accepted but in exiting the configuration there was an error creating the SAM database.

I was hoping to get this up for the users and do the upgrade at a less busy time.

[Hans Hosang]

Dean,

You can install the 7.3B-eco1 directly over the V7.3A. No need to go to V7.3-B in between.
Also make sure that you have enabled the folowing named pipes to be accessed anonymously:
netlogon, samr, lsarpc.
Do this in the snapin "local Security Policy"
under local policies, security options.

[Hans Hosang]

Dean,
Forgot to mention that with this setup / combination of software, you can map drives but the command $ admin logon will still fail.
There is no solution yet for $ admin logon.
Management will have to be done from Windows.

[Paul Nunez]

Hi,

Dean, you're not going to be able to do anything until the W2K8 (R2) DCs have that policy enabled. Once enabled, v7.3A should work (the NETLOGON service should start, confirm with $ ADMIN SHOW SERVICES).

v7.3B ECO1 is recommended for better integration with Windows 2003/2008 DCs.

The Advanced Server ADMIN utility can still be used to manage Advanced Server as long as you login to a local admin account rather than a domain account.

HTH,

Paul

[Dean Lahodny]

Thanks for all the help. We are able to able to get to the shares.

I can't upgrade to the latest Pathworks yet or OVMS for that matter because apparently the Software update service for OVMS we have been paying for for years doesn't allow for software updates.

[John Royer]

Same scenario...the PDC Emulator was upgraded to Windows 2008. Share mapping worked fine after setting the policy above, however external authentication fails. Assigned the PDC role to the one remaining Windows 2003 DC and we're back in business. What are we missing? Thanks, John.

[ArgonPro]

Is there any update on this topic?

We are facing the same problem as described here.

Upgraded DCs from 2003 to 2008R2, after some group policy tweaks we get to work file shares, but admin logon still says

-LM-E-ERROR_NOT_SUPPO

I can't see something special in the logs on 2008 DCs, it says auth is OK.

If we switch Pathworks back to 2003 DCs, admin logon starts to work again.