Advanced Server 7.3A on OpenVMS 7.3 with DCs upgraded to Window server 2008

[Dean Lahodny]

Our windows domain controllers were upgraded to windows server 2008.

Since then if you try to logon to windows domain on VMS the following is displayed:

HARRISRANCH\\WSVMS> logon
Username: administrator
Password:
%PWRK-E-LOGONERR, error logging user "administrator" onto domain "HARRISRANCH"
-LM-E-ERROR_NOT_SUPPO, this request is not supported by the network.

The error - An attempt was made to logon, but the network logon service was not started - is received from windows when trying to access the pathworks shares


Prior to the domain controller upgrade last night Pathworks has worked almost flawlessly for more years than I care to remember.

Can anyone point me in the right direction to solve this?

Let me know if I can supply any further information or have left anything out.

[Karl Rohwedder · Accepted solution]

The latest version I know of is V7.3B with Patchset 0021.

The releasenotes from the patchset 21 state:
Problem: ASV does not work as member server to Windows 2008 domain

Solution: There is a policy which exists on Windows 2008 domain controllers that
will allow the domain controller to allow NT4 clients. The policy is
under "Computer Configuration->Administrative Templates->System->Netlogon->
Allow cryptography algorithms compatible with Windows NT 4.0".

You need to enable this policy in order for ASV to correctly function as
member server in Windows 2008 domain.

regards Kalle

[Ian Miller.]

Note Advanced Server 7.3B ECO1 is also available.

[Dean Lahodny]

Do I need to upgrade to the 7b version before this change will work? In the process of the PDC being upgraded the name was also changed. When I went into the pwrk$config to change the PDC I get an error creating the SAM database. During the procedure it appeared that the username and password were accepted but in exiting the configuration there was an error creating the SAM database.

I was hoping to get this up for the users and do the upgrade at a less busy time.

[Hans Hosang]

Dean,

You can install the 7.3B-eco1 directly over the V7.3A. No need to go to V7.3-B in between.
Also make sure that you have enabled the folowing named pipes to be accessed anonymously:
netlogon, samr, lsarpc.
Do this in the snapin "local Security Policy"
under local policies, security options.

[Hans Hosang]

Dean,
Forgot to mention that with this setup / combination of software, you can map drives but the command $ admin logon will still fail.
There is no solution yet for $ admin logon.
Management will have to be done from Windows.

[Paul Nunez]

Hi,

Dean, you're not going to be able to do anything until the W2K8 (R2) DCs have that policy enabled. Once enabled, v7.3A should work (the NETLOGON service should start, confirm with $ ADMIN SHOW SERVICES).

v7.3B ECO1 is recommended for better integration with Windows 2003/2008 DCs.

The Advanced Server ADMIN utility can still be used to manage Advanced Server as long as you login to a local admin account rather than a domain account.

HTH,

Paul

[Dean Lahodny]

Thanks for all the help. We are able to able to get to the shares.

I can't upgrade to the latest Pathworks yet or OVMS for that matter because apparently the Software update service for OVMS we have been paying for for years doesn't allow for software updates.

[John Royer]

Same scenario...the PDC Emulator was upgraded to Windows 2008. Share mapping worked fine after setting the policy above, however external authentication fails. Assigned the PDC role to the one remaining Windows 2003 DC and we're back in business. What are we missing? Thanks, John.

[ArgonPro]

Is there any update on this topic?

We are facing the same problem as described here.

Upgraded DCs from 2003 to 2008R2, after some group policy tweaks we get to work file shares, but admin logon still says

-LM-E-ERROR_NOT_SUPPO

I can't see something special in the logs on 2008 DCs, it says auth is OK.

If we switch Pathworks back to 2003 DCs, admin logon starts to work again.

[Paul Nunez]

HI,

The inability to use the ADMIN utility to logon a domain with W2K8 R2 domain controllers

remains and will not be "fixed".   ADMIN can still be used to manage the local Advanced

Server system by logging onto the Advanced Server rather than the domain, using the

syntax:

$ admin logon /domain=\\<Advanced-Server-name>

The inclusion of the double-backslashes preceding the name of the server is required

when logging onto a Member server.

But that assumes the system is running the most recent version of Advanced Server - v7.3B ECO1.

7.3A versions are likely to have other issues.   7.3B ECO1 is available from the OpenVMS patch

management/download site on the HP Support Center portal.

HTH,

Paul

[Hoff]

Microsoft has largely retired the old and insecure domain controller authentication system, as part of its migration to Microsoft Active Directory (AD) and its related authentication implementation.

And HP has largely retired Advanced Server; the path forward for OpenVMS users here is the CIFS/Samba package.

Some vendors have implemented a "magic triangle" configuration with Open Directory servers and Microsoft Active Directory providing services for their respective platforms and coordinating access across the servers and clients, but AFAIK HP has not implemented that with OpenVMS. 

Some versions of Samba can also authenticate with AD (see the Samba wiki for details), though I haven't checked any Samba/CIFS version against this.  (We use Open Directory and don't run a Windows AD here, so we don't have an AD configuration to test CIFS/Samba with.)  As for the version involved, the CIFS/Samba V1.2 ECO1 kit is reportedly based on Samba  3.0.28a.

The closest you can get with OpenVMS and distributed authentication here is likely the LDAP login extensions and whatever AD pieces are in CIFS/Samba.  (These are obviously fairly limited and somewhat complex to establish, and the VMS distributed authentication provide only passwords and password-related authentcation features.  VMS didn't migrate the other login-related attributes and settings out into the LDAP directory.  But that's not specific to nor does it provide authentication for PATHWORKS nor Advanced Server.)

And to make the future and plans for this whole configuration somewhat more complex, the Samba folks adopted GPLv3 at their version 3.2.  I don't know if HP has made any statements around their plans for newer versions of CIFS on OpenVMS.  HP may decide to remain on an earlier (3.0.x) version, for that matter.

[Caudette]

Hey all,

Sorry for dragging up this old thread however its the only one I could find on this issue.

We are attempting to demote our last remaining 2003 DC's to bring the domain to 2008. We have Pathworks 7.3B installed.

I have ensured all 2008 DC's have the following policy enabled: "Computer Configuration->Administrative Templates->System->Netlogon-> Allow cryptography algorithms compatible with Windows NT 4.0".

After logging into the Pathworks and running the "sh user" command I receive the following error:

%PWRK-E-ERRGETSRV, error getting server information for "SVOTTDC002"

-LM-E-ERROR_NOT_SUPPO, this request is not supported by the network.

What else should I be looking at?