Logon Errors with Advance Server (Pathworks) v7.3-140A and Windows 2008 domain

[Rcash_1]

We have just updated our windows PDC emulator to Windows 2008 and I am trying to manage shares on advanced server and getting the error:

%PWRK-E-ERRGETSRV, error getting server information for "PDC ServerName"
-LM-E-ERROR_LOGON_NOT, logon not granted

When trying to login (login administrator/domain=domain), grant domain accounts share access and running other commands like "show computers".

I have set the policy "Allow cryptography algorithms compatible with Windows NT 4.0" in the default domain controller policy.

Any help would be greatly appreciated.

[Shilpa K]

Hi,

As you are still running Advanced Server V7.3A ECO4 on your system, you may want to upgrade to Advanced Server V7.3B (AS V7.3B) and then install PS015 patch set. AS V7.3B and PS015 patch set contain some additional fixes for admin commands to work with Windows 2008. You can find AS V7.3B kit and PS015 patch set on hprc.

Regards,
Shilpa

[Rcash_1]

Thanks for the reply. I have v7.3b ps015 running on a test server and I still get the same errors with the admin commands. I also have issues when viewing the file security from a windows computer. It will only show the SIDs for the groups/users with access and will not display the actual names.

[Shilpa K]

Hi,

Are you able to connect to Advanced Server shares on the test system using Windows 2008 domain account credentials?

Can you execute the following commands on your test system and post the response:

$ @sys$startup:pwrk$define_commands
$ lmstat -s
$ regutl show param * MemberInAD/kn

Also, do you have any Windows 2003 Domain Controllers in the Windows Domain apart from Windows 2008 Servers?

On your test system, do you get the same error "-LM-E-ERROR_LOGON_NOT, logon not granted" or do you see a different error?

On your Windows 2008, can you check if the following policies are enabled or disabled:

1. Microsoft network server: Digitally sign communications (always)"

2. "Microsoft network server: Digitally sign communications (if client agrees)"

Regards,
Shilpa

[Rcash_1]

We are still able to connect and access the shares on the test system.

lmstat -s results:


Shared memory initialization time: Mon Jun 22 07:46:18 2009
Lmx.ctrl's current time: Mon Jun 22 08:13:30 2009
Server statistics last cleared: Mon Jun 22 07:46:18 2009
Shared memory size: 42748 bytes

Max number of client sessions: 32

Clientsession [ 0 ]:
Last authentication try: Mon Jun 22 07:46:41 2009
State: Authenticated
Connection status:
Flags: None
Negotiated flags: Netlogon supports account lockout, multiple SIDs, refuse change password
Auth alert count: 0
Reference count: 1
Discovery flags: None
Domain id: S-1-5-21-149954171-217925691-231145771
Authentication seed: 0xFD2E828AA679602A
Session key: 0x5D948E6981AD9BEA0000000000000000
Secure channel type: Workstation secure channel
Account name: POINT-ALIAS$
Unc server name: \\PDCComputerName
Unc Alias name: \\PDCComputerName
Domain name: DomainName

Total number of client sessions: 1

Max number of server sessions: 200

Total number of server sessions: 0


regutl show param * MemberInAD/kn results:
Section Name: vmsserver
Keyword Name: MemberInAD
Source: Default
Type: Integer
Default Data: 0

On the 2008 DC the both policies are 'Not Defined'

Thanks

[Rcash_1]

Forgot to answer one of your questions:

When running admin commands such as 'show computers', or 'mod share sharename /perm=("domain admins"=full)' we get the following error:

%PWRK-E-ERRGETSRV, error getting server information for "PDCComputerName"
-LM-E-ERROR_INVALID_F, invalid function

[Shilpa K · Accepted solution]

Hi,

If you have configured Advanced Server as member server to a Windows domain, it is recommend that you set the registry parameter "MemberInAD" to 1. Can you please execute the following command on your test system and restart Advanced Server?

$ @sys$startup:pwrk$define_commands
$ regutl set param * MemberInAD 1/create
$ pwrestart

After Advanced Server is fully up, can you try admin login again and see how it goes?

Also, do you still retain any Windows 2000 or Windows 2003 Servers in your domain?

Thanks,
Shilpa

[Rcash_1]

After setting the registry paramater MemberinAD to 1 the admin commands are now working with no errors. I can also now see the proper user and group names when viewing the security.

Yes we currently still have a couple of windows 2003 DC servers in our domain.

I did not want to migrate them all to 2008 until these issues were resolved.

Thanks

[Shilpa K]

Hi,

Glad to know that admin commands are working now. One question that I forgot to ask is related to lmstat -s output:

Unc server name: \\PDCComputerName
Unc Alias name: \\PDCComputerName

The system "PDCComputerName", is it a Windows 2008 Server or Windows 2003 Server? Though I assume its Windows 2008, thought of getting it confirmed.

Thanks,
Shilpa

[Rcash_1]

It is a windows 2008 server.