Advanced Server - Chaning from Domain to Active Directory

[Matthew Smith_18]

Okay, it's been several years since I last did any VMS work but I have just been landed with a 3 node Alpha cluster that no one else want to support. My first major hurdle is that it's running Advanced Server 7.3A and is currently a member server in an NT4 domain.

The NT4 domain is being switched off in the coming months and the Alphas need to move over to be part of our Active Directory domain, again just as a member server.

The user manuals don't give too much away about changing domains let alone if it will work with AD.

Anyone got an idea how I do it, is it related to the @SYS$UPDATE:PWRK$CONFIG command.

Thanks

[Karl Rohwedder · Accepted solution]

I think it is just PWRK$CONFIG -> change role and domain (memberserver as you wrote).

But beware, that changing domain will create a new sharedatabase.

If you have a procedure to recreate shares/protections, thats fine, else I've attached a text from engeeering on how to save the sharedb across domain switsches.

regards Kalle

[Matthew Smith_18]

Thanks for the quick response.

I've looked through the note you attached and I'm a bit confused (only a bit not completly).

Step 4 says to delete the file {domain-name}.; but I don't have one named after the domain it's currently residing in. I do have one named after the cluster alias, is this because it is a member server and not a PDC/BDC ?

I understand the rest of it, it's basically just preserving the files that contain the shares and the acls and renaming them back once you have changed domain.

[Antoniov.]

Matthew,
if your alphaserver is PDC or BDC, you must have a {domain}. file in
PWRK$LMROOT:[LANMAN.DOMAINS]
If your alpha is neither PDC neither BDC, I'm not sure about that file, but I suppose it have to exists. What does file exist in your directory?

Antonio Vigliotti

[Karl Rohwedder]

I checked with our installations: if the server is just a member server, then there is a file
with either the server's name (standalone) or the cluster-alias.

regards Kalle

[Matthew Smith_18]

I have a file named after the cluster alias in that directory.

It sounds pretty straight forward to me so I just need to arrange some downtime to try the procedure out.

Thanks for the help

[Matthew Smith_18]

Well, I tried it but I didn't have the success I was hoping for.

I managed to join the domain okay and preserved the shares and acl information. On first appearance everything seemed okay, I could map the shares that were there before. But when I asked my users to do the same they could not map anything.

I then tried a few commands on the Alphas, like Net users and it eventually told me that it couldn't find the domain controller.

Having read other stuff in the forums I think it is possible to get 7.3a working with 2003 but only if you lower the general level of security/encryption etc in your policy.

I've also read that 7.4 (or 7.3b or 7.3b+) is the version needed for full kerberos intergration with 2003.

Does anyone know how I get 7.4, is it free or is it going to cost ?

Cheers

Matt

[Ian Miller.]

V7.3A ECO4 is the current version. See
http://www1.aclabs.com/masterindex/final_spl_vmsaxp_q105/SPLVAQ105_A93AA_7_3A_ECO4.shtml
for some information

There are a couple of issues with Windows 2003 listed as fixed in the ECO4 release notes.

[Matthew Smith_18]

How do I tell which ECO number I am running ?

[Brad McCusker]

>>How do I tell which ECO number I am running ?

$@sys$manager:pwrk$define_commands.com
$pwver

Post the output and I'll tell you.

Brad

[Brad McCusker]

>Does anyone know how I get 7.4, is it free >or is it going to cost ?

Sorry, I missed this question -

The roadmaps are changing - there won't be a 7.4, there won't be Kerberos integration. Engineering is working on porting Samba V3.* to OpenVMS Integrity (and back to Alpha), and eventually port future Samba releases as well. That is where you will need to go to get things like Kerberos integration.

Regards

Brad

[Matthew Smith_18]

I think I need a final clarification to tell my boss....

Is it possible to get 7.3A to talk to a Windows 2003 Active Directory without compromising the security policy set on that AD. We have a centrally controlled AD and I have a feeling that anything NT4(ish) is not allowed to join it.

Thanks again !!!

[Antoniov.]

From HP documentation:
The Advanced Server can act as a BDC in Windows 2000 and Windows 2003 mixed-mode domains, or as a member server in Windows 2000 and Windows 2003 native-mode and mixed-mode domains, in accord withthe limitations imposed by Microsoft on Windows NT V4-compatible servers.
I guess, limitation are crypted password. On Win 2K3 you have to enable uncrypted password inside local domain.
AFAIK there is no security degradation in domain.

Antonio Vigliotti

[Doug Phillips]

Mathew,

I have AS 7.3A running as a Member Server in a 2003 domain and I didn't need to change anything in 2003 to get it to work. (at least I don't remember having to change anything -- it was a while ago.)

HOWEVER: To Active Directory, it looks like a Win NT4 server so it can't be a DC in native mode.

Since Microsoft does not (afaik) intend to let anyone else use Active Directory, then only Microsoft servers will actually support it. Not Samba; not Pathworks. Blame M$.

You might have some secuity settings causing this, though. Look in the 2003's Local Security Settings -> Local Policies -> Security Options and see if something looks too restrictive.

[Patrick Grealy]

Hi,
In Jan 2005 we changed IP addresses, upgraded to MS-Windows server 2003 from 2000 and moved everyone to new domains. I handled the VMS(7.3-1) cluster/Advanced Sever(7.3A)/TCPIP(5.3) stuff for our cluster of two nodes, txmsba and txmsbb. IT dept handled all the other stuff (Windows, Active Directory, DNS , etc.). I kept a document describing all the things we did to finally get things working. We mainly use the Alpha/OpenVMS system to map shared drives to Windows PCs.

A lot of what I'm including below may not pertain but the most important elements as I recall are:
- the Windows primary domain controller(pdc) must allow "pre-Windows 2000" member servers, like our VMS cluster.
- since the Windows config had several servers in primary/backup roles we had to insure the pdc was desiganted as the "x1b" by making an entry in lmhosts.

As I said, the rest of this may not pertain but I'm taking the shotgun approach here and giving everything we tried.

===============================

Steps Required to Synchronize OpenVMS Advanced Server with
New Primary Domain Controller in Windows 2003 Active Directory

All of the following except PWCONFIG and PWRK$directory changes are required on both txmsbA and txmsbB. Procedures are in cp$disk:[cluster_common].

- Chris Smith removes old DNS entries and adds new ones for txmsba.msb.txdallas.edu(999.131.6.3) and txmsbb.msb.txdallas.edu(999.131.6.4)

- Chris removes txmsbX(alias) from msbAD and adds it to msbDC3, the new primary domain controller(pdc); specify pre-Windows 2000 server option

- Logon OpenVMS/txmsbA, username SYSTEM.

- ADMIN/CONFIG ; Advanced ; [x]Advanced Server only

- ADMIN/CONFIG ; Transport ; [x]DNS [x]LM Hosts

- In pwrk$lanman, edit LMOSTS., adding two lines for PDC:

999.131.3.24 â msb \0X1Bâ #PRE #DOM:msb
999.131.3.24 msbDC3 #PRE #DOM:msb

(string â msb \0X1Bâ must be 22 characters exactly, including quotes)

- Remove old hosts and add new hosts and domain in TCP/IP(@tcpip_set_new_hosts)

- Remove old bind names and add new bind info in TCP/IP(@tcpip_set_new_bind)

- Shutdown and restart TCP/IP(@sys$startup:tcpip$shutdown)

- Shutdown Pathworks (PWSTOP).

- Rename the SAM files before reconfiguring Pathworks:

- in pwrk$lmdomains, rename txmsbx. to txmsbx.old

- in pwrk$lmdatafiles, rename acl. to acl.old, builtin. to builtin.old, lsa. to lsa.old and sharedb. to sharedb.old

- Run Pathworks configuration(PWCONFIG)

- set domain to msb

- set server type to MEMBER

- select YES user/password credentials

- PDC: msbDC3; User: cp-svc; Password: xxxxxxxxxx

- Administrator password: pw$999999

- Rename the SAM files before restarting Pathworks:
(this preserves our old share definitions and permissions)

- in pwrk$lmdatafiles, rename acl.old back to acl. and sharedb.old back to sharedb.

- Restart Pathworks(PWSTART) on txmsbA and txmsbB

- NBSHOW KNBSTATUS msbdc3: identifies â x1bâ PDC

- ADMIN ADD HOSTMAP txdallas\username username (for each programmer; this enables access to OpenVMS personal shares)

[Patrick Grealy]

Hi,
Sorry, my double-quote characters created garbled text in a few critical lines above. Replace the dollar-sign characters below with double-quote in the following lines:


- In pwrk$lanman, edit LMOSTS., adding two lines for PDC:

999.131.3.24 $msb \0X1B$ #PRE #DOM:msb
999.131.3.24 msbDC3 #PRE #DOM:msb

(string $msb \0X1B$ must be 22 characters exactly, including quotes)


- NBSHOW KNBSTATUS msbdc3: identifies $x1b$ PDC

Pat G.