Issues with moving LanMan 2.2 (PW v5) to AD?

[Dave Gudewicz]

Anyone here have experience / issues with moving a Pathworks v5 server to an Active Directory (aka newer domain) environment?

On paper, I don't see a problem, but having never actually done a move such as this, there could be some unforseen gotchas.

I have a VAX that's been happily living in an NT domain for years. That domain is going bye-bye soon, thus the move to the newer environment.

[Antoniov.]

Dave,
no direct experience, but I never migrated pathwork server without problem :-(

AFAIK AD need crypted message blocks (LanMan 3.0, kerberos) so you need advanced server V7.3 to work within AD.

Antonio Vigliotti

[Dave Gudewicz]

Found an Understanding Active Directory Services book from our friends at Microsoft and it mentions on several occasions that Windows 2000 AD is backward compatible with older LanMan technology. No mention of exact versions or other details given.

I'll dig around Technet and google for more info. and post what I learn here.

[Dave Gudewicz]

Can anyone confirm this?

Saw a brief reference while googling for Lan Manager 2.2 info that W2K does not support this version of LanMan.

I then went to Microsoft.com and tried to verify this. Couldn't find anything there, but could easily have missed or not known where to find this information. Broad searches in the W2K sections came up empty with regards to LanMan version compatibility.

I'll keep looking.....

[Martin P.J. Zinser]

Hello Dave,

what "role" does your VAX play in the NT domain? While I mostly watch Pathworks from the sidelines as a user I am fairly certain that you can not have a PW server as a domain controller with W2k (any version of PW/AS).

Greetings, Martin

[Dave Gudewicz]

Martin,

The VAX will be a member server in the new domain. It currently is a standalone server. Enabling the NETLOGON service and adding the new domain name in LANMAN.INI should be all that is needed to make this switch. Should be.

Dave...

[Antoniov.]

Dave,
your vax could be work if:
- It will became a member of domain;
- AD works as native mode;
- Your vax has Kerberos installed.

Antonio Vigliotti

[Brad McCusker · Accepted solution]

Dave -

If your V5 server is standalone now, why not leave it that way? If it is standalone now, why do you say it has "been happily living in an NT domain"?

OK, I'll bet it really isn't stand alone. Or, are you saying clinets in an NT 4 domain can access your V5 server?

Bottom line, to the best of my knowledge, PW-V5 can not participate at the domain level with Win2K. Just can't do it, Microsoft will not let the LanMan 2 servers play.

Win2K clients can indeed access PW-V5 resources - although it is unsupported. There are some patches that you will need to get from CSC to make it work correctly. If Microsoft changes something next week, there is no promise from HP to keep things working.

My suggestion is to make the V5 server standalone, and let the Win2K PCs access it.

Brad

[Brad McCusker]

Martin wrote:

>I am fairly certain that you can not
>have a PW server as a domain controller
>with W2k (any version of PW/AS).

Correct. Advanced Server and PW V6.1 can be Member Servers in the Win2K domains. they can not be Domain Controllers.

[Dave Gudewicz]

Brad wrote:

>If your V5 server is standalone now, why >not leave it that way? If it is standalone >now, why do you say it has "been happily >living in an NT domain"?

From its LANMAN.INI

[workstation]
Domain=(name not important)

Its my understanding that standalone servers and W2K domains don't mix well. Therefore the change from standalone to the member server role. Perhaps I didn't explain this as well as I should have.

>OK, I'll bet it really isn't stand alone. >Or, are you saying clinets in an NT 4 >domain can access your V5 server?

I'd bet it is standalone. Has its own LanMan security database, clients need to logon with credentials located on this server Vs their domain credentials.

All this is moot now.

Show stopper is what you say Brad, v2.2 LanMan servers are a no-no in a W2K domain. So be it.

[Paul Nunez]

Dave wrote:

>Brad wrote:
>
>>If your V5 server is standalone now, why >>not leave it that way? If it is >standalone >now, why do you say it >has "been happily >living in an NT domain"?
>
>From its LANMAN.INI
>
>[workstation]
>Domain=(name not important)
>
>Its my understanding that standalone >servers and W2K domains don't mix well. >Therefore the change from standalone to >the member server role. Perhaps I didn't >explain this as well as I should have.

>>OK, I'll bet it really isn't stand alone. >>Or, are you saying clinets in an NT 4 >>domain can access your V5 server?
>
>I'd bet it is standalone. Has its own >LanMan security database, clients need to >logon with credentials located on this >server Vs their domain credentials.
>
>All this is moot now.
>
>Show stopper is what you say Brad, v2.2 >LanMan servers are a no-no in a W2K >domain. So be it.

Just so everyone is clear:

A PATHWORKS v5 _standalone_ server is equivalent to a PATHWORKS v6, Advanced Server v7, or NT member server in that it neither replicates domain accounts nor provides domain logon validation.

A PATHWORKS v5 _member_ server is more akin to an BDC in that it DOES replicate the domain accounts, but does NOT provide domain logon validation.

A PATHWORKS v5 server is not supported in any fashion in any W2K/W2K3 domain. It might work as a standalone server, but it's definitely not supported.

A PATHWORKS v6.1 or Advanced Server v7.3A ECO3 _member_ server is equivalent to an NT member server. Both can join a Windows 2000 or Windows 2003 _native-mode_ domain as a Member server only. But they function quite well doing so.

A PATHWORKS v6.1 or Advanced Server v7.3A ECO3 server can participate as a BDC in a W2K or W2K3 mixed-mode domain.

The overriding principle to keep in mind when working with PATHWORKS v6.1 or Advanced Server v7.3A is that they are (suppose to be) equivalent to an NT v4 server. So when attempting to determine if something is possible in a W2K or W2K3 domain, ask "What's possible with NT v4?"

HTH,

Paul

[Brad McCusker]

OK, I need to comment on what Paul said.

He tried to clear things up, and, perhaps from the user's point of view he did. But, from my view it is not clearer. Maybe I'm too close to the product.

First, let me also be very clear that when it comes to PATHWORKS/Advanced Server knowledge, there is no one on the planet who knows those products better than Paul. I was the project leader for years, and, I frequently went to Paul with questions! Yes, I did.

So, what was written is:

>Just so everyone is clear:
>
>A PATHWORKS v5 _standalone_ server is
>equivalent to a PATHWORKS v6, Advanced
>Server v7, or NT member server in that it
>neither replicates domain accounts nor
>provides domain logon validation.
>

This is true. But, it is not important, in my mind. What is important is to know that the PATHWORKS v5 _standalone_ server does not have a secure channel to any domain. So, when resources are requested, validation of credentials is done by the PW-V5 server against the PW-V5 server's accounts database. The PW-V5 server's accounts database has no relationship with, or knowledge of any domain's database. And of course, LanMan 2.* has no concept of trusts, so there is no connection to any domain that way either.

So, the standalone server doesn't care at all about NT servers, Win2K servers, etc. All it cares about is the clients trying to access its resources. It only talks to clients. As long as the clients can talk its language (and, Win2K currently can, with the right PW-V5 patches - unsupported of course), the PW-V5 server will happily serve resources.

>A PATHWORKS v5 _member_ server is more akin
>to an BDC in that it DOES replicate the
>domain accounts, but does NOT provide
>domain logon validation.
>

Ssshhhsshh... this is supposed to be engineering's little secret. We aren't supposed to actually particpate in replication, but, we do because we couldn't make it work otherwise. I used to know why, but, I forget (and it was designed before my time). The fact that a V5 member server actually does replicate accounts is unique to the PATHWORKS for OpenVMS product, I believe.

>A PATHWORKS v5 server is not supported in
>any fashion in any W2K/W2K3 domain. It
>might work as a standalone server, but it's >definitely not supported.

The idea of a _standalone_ server "in" a domain is what I think is confusing. As I said earlier, standalone servers don't know or care about domains.

Hope this helps.

Brad

[Dave Gudewicz]

Thanks for clearing this up Brad.

And thanks for you and guys like Paul checking in here from time to time.

It really helps.

[Dave Gudewicz]

Brad and Paul have answered my questions.