Advanced Server 7.3B & VISTA

[Music]

I am currently trying to get a Vista machine (Enterprise edition) to connect to Advanced Server 7.3B. When I try to connect with the usual domain\username & password, I get a "Logon unsuccessful... windows is unable to log you on" message. I have tested with the security policy on the Vista machine set to "LAN Manager authentication level = Send LM & NTLM - user NTLMv2 if negotiated", but it doesn't work. Nothing shows up in the Advanced Server event log to indicate what the problem is (show events), even though I have failed logon event logging enabled. Multiple attempts disables the account (5 bad password attempts are allowed), so the server is being reached and the username is passed correctly, but apparently not the password... ?

Any ideas?

[Hoff]

If you have a support contract in place for Advanced Server, you might want to call the HP customer support center.

In general, Advanced Server is in maintenance and the Samba SMB CIFS package (free, available for download) is the path forward for Windows file services for OpenVMS.

(I'd tend to be somewhat surprised if there were plans to add Windows Vista compatibility to Advanced Server, given the migration to CIFS underway. And as for compatibility, the release notes for CIFS 1.0 indicate it doesn't support Windows Vista. The newer T1.1 CIFS release notes indicate improved compatibility with Windows Vista.)

[Karl Rohwedder]

I just tried it (to be prepared when the 1st users will try) and connected a network drive from Vista Business edition to my AdvancedServer. No problems.
I did 2 tests:
- one VMS system is in its own domain
- one VMS system is member of domain

No problems on both so far.

regards kalle

[Music]

Hoff: Thanks for the reply. HP states that 7.3B is compatible with Vista... but apparently I have a mismatched setting somewhere?

Kalle: Your test gives me hope! I'm hoping it's something as simple as a security policy setting on Vista. I don't see anything that can be tweaked on the VMS side related to how Advanced Server negotiates password security?

Bobby

[Doug Phillips]

If the above logical and the two settings discussed in c.o.v. didn't work you might have an SID problem, so try:

1. in Vista, remove the PC from the domain.

2. in AS ADMIN remove the Vista computer (if it's there).

3. in AS ADMIN, add the Vista computer back in.

4. in Vista, rejoin the domain.

If you use CCLEANER on your PCs (highly recommended), run it to clean files and the registry on Vista after leaving the domain and before rejoining.

Since you can connect with XP, you should be able to connect with Vista. I've connected (Vista Ultimate) to both VAX PW6.? and Alpha AS 7.3A with very little problems (other than firewall tweaks and such).

[Paul Nunez]

Hi,

Watch out for this policy as well

Microsoft network client: Digitally sign communications (always)

The Advanced Server has server-side SMB signing disabled by default:

$ regutl show param server enable*/known
Section Name: server
Keyword Name: EnableSecuritySignature
Source: Default
Type: Integer
Default Data: 0

Set it to 1 to enabled smb signing:

$ regutl set param server enablesecuritysignature 1 /create

It's not a dynamic parameter so you'll have to restart Advanced Server for it to take affect.

The other option is to disable the policy on the client.


Paul

[Music]

Well, I finally made progress, just in time to forget about it over the upcoming holiday weekend. It turns out that if the password is typed on the Vista side in "all caps", then connection to AdvancedServer is successful. Entering the password in "small caps" fails with a "logon_not_valid" SMB message.

I thought that Advanced Server was case-insensitive? My logon from XP is in all lower case (user & password), and the username for the (successful) Vista login is in lower-case, but not the password. It is my understanding that LMNT authentication converts the password to UpperCase during the encryption process, but that apparently isn't happening on my test machine. Now I'm wondering if there's a setting somewhere on either the VMS or Vista side for this, or if it is a bug?

[Paul Nunez · Accepted solution]

If you do $ ADMIN LOGON does it only work when you use the uppercase password?

Advanced Server is just like NT (in fact, it was ported from the NT v4 code) so passwords are case-sensitive (usernames are not).

Depending on how the account was created and the password set, you may have inadvertently set an uppercase password by not quoting it (if included on the command line; if it prompts you it retains case) as in:

$ admin mod user music/pass=password

instead do:

$ admin mod user music /pass="password"

HTH,

Paul

[Music]

Thanks for the additional info Paul. You're analysis is dead on. I had simply entered the passwords with the /pass=text option (no quotes). The odd thing is that the XP machines have been working with the small-case passwords even though AS was storing as uppper-case... but I won't try to figure that one out.

I re-tested with pass="text" and connected with small-case passwords from Vista without any issues, which is quite a relief. I really do appreciate the help.

Bobby