• Welcome to OS2World OLD-STATIC-BACKUP Forum.
 

News:

This is an old OS2World backup forum for reference only. IT IS READ ONLY!!!

If you need help with OS/2 - eComStation visit http://www.os2world.com/forum

Main Menu

OS/2 can't access a share in a Windows 2003 or 2008 domain

Started by nedcheese, 2011.05.02, 16:08:25

Previous topic - Next topic

nedcheese

For once in my life, I will give back to the Googilites....

For years this has been an issue for our company, trying to get an OS/2 machine to access a share in a Windows 2003/2008 domain........don't ask why, it's complex, but needed.

I've looked through all the forums, tried all the reccomendations dating back to 2004.......me and my collegue finally figures it out........so here it is:

Summary:   The OS/2 machines cannot access Windows shares due to limitations in security authentication.  Due to this restriction, the machines are limited in the type of security authentication used to access Windows shares.  OS/2 only uses "LM" authentication, and with the release of Windows Server 2003 and 2008, two GPO settings need to be changed on the Default Domain Policy, the Default Domain Controller Policy, or both.  Also there is a small change made on the Datacard OS/2 machines.  Below will have the steps in more detail.

Windows Server GPO settings:
Either in the Default Domain Policy or the Default Domain Controller Policy edit the following:
1.   Computer Configuration/Windows Settings/Security Settings/Local Policies/Security Options
a.   Network Security: Do not store LAN Manager hash value on next password change
i.   Change to Disabled
b.   Network Security: LAN Manager authentication level
i.   Change to "Send LM & NTLM – use NTLMv2 session security if negotiated"
2.   Make sure to do "gpupdate /force" on the domain controller doing the authentication
3.   After the Policies refresh, go into Active Directory Users and Computers, and reset the User Account that the OS/2 machines are using to access Windows shares.
4.   Once that is done, the password will be reset and store the LAN Manager hash, which is what's needed because the OS/2 machines can only send the hash.
5.   When the shares are verified for access from the OS/2 machines, go back to the GPO settings in step 1-a, and change it back to "enabled" so all passwords are not stored as a LM hash value.
OS/2 settings:
1.   Open up the "IBMLAN.ini" file and put in the correct domain it will be trying to authenticate to:

RobertM

Hi Ned!

Thanks for the tip! Now, if you wouldn't mind, please let us know if in a week or so, the excessive network traffic the Windows boxes sends makes the OS/2 machines stop responding.

Best,
Rob


|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|


rwklein

Quote from: RobertM on 2011.05.02, 20:35:00
Hi Ned!

Thanks for the tip! Now, if you wouldn't mind, please let us know if in a week or so, the excessive network traffic the Windows boxes sends makes the OS/2 machines stop responding.

Best,
Rob

I think this only applies to servers/workstations that offer shares. If the requester is running to log onto a fileserver it might not get into trouble...

It seems its a messy adventure to get this to work. Congrats Nedcheese on getting this to work. We did try it a couple of times here at Mensys in our lab. But its certainly made a bit complicated from my point of view...

Do you mind if we put this information in the eComStation FAQ and our eComStation manual ?

For some companies it might not be an option to setup this up. In eCS we include a Samba client.
You can get a copy here:
http://svn.netlabs.org/samba
You need a license of Netdrive to make it work.

Roderick

Roderick