System Admin

24-Jul-08 3:48

We have a few "roaming PC's" that are not always connected to ther network, and are used by different people.

We have most data on a share usually mounted as drive W:\, but that's painful for these PC's. I would like to either:

(a) mount the share permanently on these computers (i.e. they should be available after logon with a local account), but credentials for the share should be asked when accessing it after logon.

OR

(b) create a shortcut that mounts the share and asks for credentials with the "normal" dialog.

What I can do now is:
- create a shortcut for the share, credentials asked when clicking it (sux for various reasons)
- make them members of the domain (doesn't work well for various reasons)
- mount the share permanently under specific credentials (not what I need)

Any suggestions?

We are a big screwed up dysfunctional psychotic happy family - some more screwed up, others more happy, but everybody's psychotic joint venture definition of CP
blog: TDD - the Aha! | Linkify!| FoldWithUs! | sighist

Jörgen Andersson24-Jul-08 4:38

24-Jul-08 4:38

Until you tell us why your different alternatives doesn't work or sux, it's a bit hard to guess what you want/need.
But anyway, here's a fourth alternative.

At an old customer of mine we used an autostarting Guest-cd with a simple script that mounted a drive and a printer with guest privileges.
Just make sure you get the CD back.
Here is a shortened simplified version of the script without exception handling:

@ECHO off
cls
:start
ECHO.
ECHO 1. Add Printers and drive v:
ECHO 2. Remove printers and drive v:
ECHO 3. Exit
set choice=
set /p choice=Enter the number of your choice.
if not '%choice%'=='' set choice=%choice:~0,1%
if '%choice%'=='1' goto add
if '%choice%'=='2' goto remove
if '%choice%'=='3' goto end
ECHO "%choice%" is not valid please try again
ECHO.
goto start

:add
echo INSTALLING PRINTER AND DRIVES.. PLEASE WAIT....
net use \\domain\ipc$ /USER:domain\visitorname visitorpass
net use v: /delete
net use v: \\dcalswgb01\visitor

rundll32 printui.dll,PrintUIEntry /in /n\\domain\printer1
rundll32 printui.dll,PrintUIEntry /in /n\\domain\printer2

goto end

:remove

net use v: /delete
rundll32 printui.dll,PrintUIEntry /dn /n\\domain\printer1
rundll32 printui.dll,PrintUIEntry /dn /n\\domain\printer2

goto end

:end

peterchen24-Jul-08 5:12

24-Jul-08 5:12

Some of these computers are mobile and don't have a permanent LAN connection.
On all of these computers, different users work under the same local account. However, to access the share, they need to authenticate against the domain controller, each user with his/her own credentials, of course.

Using the share (i.e. browsing to \\server\exchange) is clumsy for various reasons, e.g. everyone is used to find the stuff on w:\, and for some tools the share needs to be mounted as a drive.

I could include the computers in the domain (at least the desktop machines), but I don't see how this would help, as all users want and should share the same local acocunt. Also, some connect via WLAN which is a tad slower (Domain Controlller login isn't really fast for still unknown reasons, and I would rather spend the budget on some other tools than CAL's. That's the "sux" part. Big Grin | :-D

One solution would be a version of "net use" that asks for credentials (rather than taking them from the command line). I could put that into startup, or as link on the desktop.

I considered a small skript/an app that asks for username and pwd, but I don't want to "teach" people to enter their credentials into some uncommon dialogs, and deal with plaintext passwords in a cmd/wsh script.

Jörgen Andersson24-Jul-08 10:07

24-Jul-08 10:07

Do you have more users than computers?
Otherwise it doesn't make sense to me.

peterchen24-Jul-08 10:41

24-Jul-08 10:41

No.
Could you explain what you would do?

Jörgen Andersson28-Jul-08 2:30

28-Jul-08 2:30

Sorry for not answering, it's been really nice weather (still is) and I'm on vacation Big Grin | :-D

Something you could try to do is to create mandatory user profiles for the computers where people should have the same profile. The users would still log on with their personal account and therefore retain their personal rights on the fileserver, but they would get the same profile at logon. All changes to the profile would of course be lost at logoff.

My (very unclear) question was referring to your CALs. What I should have asked is if you have user based or device based CALs. Normally the CAL is user based and you can connect as many computers as you feel like as long as you have one CAL per user. Device based CALs basically only make sense if you have more users than computers which might be the case where you're working in shift.

BTW, slow Domain Controllers are usually DNS related.

peterchen28-Jul-08 3:28

28-Jul-08 3:28

You are right, the reference to CAL's was pointless.
I found a neat trick (see below), so I don't have to mess around with the profiles. Anyway, thanks for helping!

Jörgen Andersson wrote:
BTW, slow Domain Controllers are usually DNS related.

Yeah, every little issue I google blames DNS. However, clients seem to be set up correctly, and error logs don't show anything. Do you knwo a good, complete article/checklist what to check and could be wrong?

Jörgen Andersson28-Jul-08 4:56

28-Jul-08 4:56

Point one and two on my checklist is netdiag and dcdiag thats included with the support tools on the server cd

Matthew Faithfull25-Jul-08 4:30

Matthew Faithfull

25-Jul-08 4:30

Mount the share permanently under all the Domain credentials, making everyone a domain member. When the laptop's on the network everything will now be fine. Also give everyone who uses the laptop detached a local user account on the laptop that does not have the share at all. Make the credentials for the local accounts the same as the domain ones. Users will still attempt to log onto the domain when disconected and most times it will work due to cached credentials but at least when they have problems you can tell them they should use their local machine account when not on the network.
This probably isn't ideal for you but it's the only way we've managed to get a workable solution in exactly the same situation.

"The secret of happiness is freedom, and the secret of freedom, courage."
Thucydides (B.C. 460-400)

peterchen28-Jul-08 3:35

28-Jul-08 3:35

I found a trick, see my post below.

solved

peterchen28-Jul-08 3:24

28-Jul-08 3:24

I found something that does what I want, so no messing around with the domain necessary Smile | :)

create a batch file
net use W: \\server\share

but store it on \\server\share (or a sub folder)

Create a shortcut to the batch file, using \\server\share (NOT W:\..)
When starting the shortcut, windows will ask for credentials to access the share. When it reache sthe net use, you are already authenticated. Big Grin | :-D

With some extras:
(allow to run multiple times, error checking, open explorer)

<br />
@echo off<br />
<br />
IF EXIST W:\NUL goto OK<br />
net use w: \\wolfgang\exchange<br />
IF EXIST W:\NUL goto OK<br />
<br />
echo could not mount server share. Error=%ERRORLEVEL%<br />
pause<br />
goto END<br />
<br />
:OK<br />
start explorer /e,/select,W:\User<br />
goto END<br />
<br />
:END<br />

Re: solved

Jörgen Andersson28-Jul-08 4:59

Domain in hosts file not seen!

28-Jul-08 4:59

neat

Waleed Eissa23-Jul-08 18:19

Waleed Eissa

23-Jul-08 18:19

I have added two domain names to the hosts file (in Windows XP SP2) and mapped both of them to 127.0.0.1 (for the sake of developing the sites on the local machine), one of them correctly returns 127.0.0.1 when using the ping command, the other one insists on returning its IP on the internet! (the ISP parking server), I used ipconfig /flushdns multiple times and checked the hosts file a zillion times but still no use! the problem has been present for several days now so I don't think it's a caching problem .. what's really weird is that only one of them is working, if both were not working it would have been ok but why only one?!!

Waleed Eissa
Software Developer Sydney

Windows Server 2003 acting as router

wilcoswa23-Jul-08 6:59

wilcoswa

23-Jul-08 6:59

I am trying to setup a Windows Server 2003 server to act as a software router.

It has 2 NIC's:
NIC1 is the Private Network, with static IP, and null Gateway.
NIC2 is the Public Network, with static IP, DNS, Gateway etc.
I also runs DNS and DHCP services, along with AD (and aware of all the security issues...)

I have run the RRAS wizard, and selected both private and public interface for NAT, as in http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html[^]
The porblem is that only the server is succsfully connecting with outside world, while clients cannot access outside addresses.
A ping of external site, by a clients, results in the address being shown of the site, and no reply.
It is as if all incomming connings are blocked, or not correctly routed.

What am I missing here ?

Re: Windows Server 2003 acting as router

requesttimedout23-Jul-08 13:03

Re: Windows Server 2003 acting as router

23-Jul-08 13:03

The clients default gateway is the IP or the interal NIC on the server right?

a ping isn't really that good a test either, especially pinging external IPs.

Haven't done this with Windows, but having setup PIXs and ASAs I'm not sure you want to enable NAT on the private interface. You want to NAT traffic from your internal LAN out through the public interface, but I'm not sure if this would be accomplished by enabling NAT on the private interface in Windows or not.

Just out of curiosity if you type: "route print" at the command line, does it show 0.0.0.0 0.0.0.0 to have the gateway for external traffic?

Any reason your not just using a Linksys or similar box to perform this?

wilcoswa23-Jul-08 23:06

wilcoswa

23-Jul-08 23:06

Hi,
I changed the internal nic to static 192.168.10.3, with DHPC range 192.168.10.x.
Public NIC is still the same, only now the DNS shows to the new internal address 192.168.10.3.

Firewall is off on private interface.
Clients can ping outside interface successfully.
No static routes are defined(yet ?)
No RIP enabled (yet)
All Firewalling is of.
No filters are defined.

DHCP Router(Option3) set to 192.168.10.3
DHCP DNS Server(Option6) set to 192.168.10.3

DNS Interfaces set to 'ALL'
DNS Forwarders set to ISP DNS1 and DNS2

Clients are unable to ping ISP DNS1 and DNS2, although server can.

Should we have a look at RIP2 then and what do the settings need to be.

Re: Windows Server 2003 acting as router

requesttimedout24-Jul-08 12:18

DNS Server service stopped without any reason

24-Jul-08 12:18

http://www.windowsnetworking.com/articles_tutorials/Configuring-Windows-Server-2003-act-NAT-router.html[^]

Maybe this is the article you should be following.

Mekong River22-Jul-08 16:02

Mekong River

22-Jul-08 16:02

Hi, I have a problem with my windows server 2003 Sp1 DNS service. The problem is the DNS service on windows usually stop whether I changed its setting to Automatic Start for DNS Server service. As network administrator, I didn't change any setting relating to DNS service after I have configure it correctly.

From here, I would like to know whether some of you experience with any virus that could stop DNS from running? When its stop, my whole organization could not access to an internet for a while. So I have to enable it every time to solve the problem. My concern is sometime I need to travel away from my office and this problem occure, so there would be nobody could solve this problem.

Thank in advance

Luc Pattyn22-Jul-08 16:18

Luc Pattyn

22-Jul-08 16:18

You did read this one[^]
in the daily CP newsletter, did you?

I hope your problem is something else tho.

Smile | :)

Luc Pattyn [Forum Guidelines] [My Articles]

Voting for dummies? No thanks. Dead | X|

Mekong River23-Jul-08 16:09

Mekong River

23-Jul-08 16:09

Thank you very much for your reply

requesttimedout22-Jul-08 17:19

22-Jul-08 17:19

I would update to Service Pack 2 first of all, there is always the chance that will solve the problem, plus probably better of at SP 2 anyway if at all possible.

Are there any errors in the event logs related to the DNS service? Is all DNS name resolution on the network failing or just Internet related queries?

I probably wouldn't point to a virus for this problem, although its tough to say from your description. Up to date virus signatures and a full scan are never a bad idea though.

You may want to try reinstalling DNS if updating to SP 2 doesn't help. (If you only have one DNS server and you're using Active Directory you might want to look for a MS document on how they say to do this, if there is one.)

Mekong River23-Jul-08 16:38

Mekong River

23-Jul-08 16:38

requesttimedout wrote:
I would update to Service Pack 2 first of all, there is always the chance that will solve the problem, plus probably better of at SP 2 anyway if at all possible.

Thank you very much for your comment. I have run windows update on the server and found that its recommend to update to windows 2003 sp2. Currently this server is acting as domain controller and file server which share a document to all user in the organization. As I have discussed with my team, I not sure whether if I apply sp2, whether the the server could running properly or not (may be it could cause some problem with any device driver, or strict any security seeting) which could cause a trouble for user to access the resource on the server. If you have any experience with sp2 on windows 2003, please let me know whether it have any problem or not after you apply it.

requesttimedout wrote:
Are there any errors in the event logs related to the DNS service? Is all DNS name resolution on the network failing or just Internet related queries?

When I found that the DNS server service is stopped, around 70% of my client couldn't access to an internet. But each client I also configure with an alternative ISP DNS. I also have some problem with my router too which could make me difficult to find the problem. After I turn off the router for 10 mintue and restart the DNS services, every body could access the internet again. I have check an event viewer to find the cause of the problem but I didn't found any entry that could cause DNS server service to stop. But I found the below entry that is related to the DNS server service:

Event Type:	Error<br />
Event Source:	DNS<br />
Event Category:	None<br />
Event ID:	4007<br />
Date:		18-Jul-08<br />
Time:		8:10:52 AM<br />
User:		N/A<br />
Computer:	SERVER<br />
Description:<br />
The DNS server was unable to open zone _msdcs.pr.org.kh in the Active Directory from the application directory partition ForestDnsZones.pr.org.kh. This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it. Check that the Active Directory is functioning properly and reload the zone. The event data is the error code.<br />
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.<br />
Data:<br />
0000: 0d 00 00 00               ....

and

Event Type:	Error<br />
Event Source:	DNS<br />
Event Category:	None<br />
Event ID:	4007<br />
Date:		18-Jul-08<br />
Time:		4:40:01 PM<br />
User:		N/A<br />
Computer:	SERVER<br />
Description:<br />
The DNS server was unable to open zone pr.org.kh in the Active Directory from the application directory partition DomainDnsZones.pr.org.kh. This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it. Check that the Active Directory is functioning properly and reload the zone. The event data is the error code.<br />
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.<br />
Data:<br />
0000: 0d 00 00 00               ....

requesttimedout wrote:
If you only have one DNS server and you're using Active Directory you might want to look for a MS document on how they say to do this, if there is one.)

The DNS Server and Domain Controller is set in the same machine. Please let me know if you have any idea. Thank in advance.

requesttimedout23-Jul-08 17:49

23-Jul-08 17:49

Personally I have not run into any problems with SP2. I manage quite a few Windows 2003 Servers and I have not run into a problem. If you're worried about driver compatibility you can research that with the vendor that the server came from, or if a custom built you can look into individual components.

I personally would never configure a domain controller to have DNS point to anything but itself or another internal DNS server. I would not point a DC to an external DNS server. Pointing clients to another DNS server is probably alright, although if you configure DNS to use forwarders for external queries it isn't really necessary.

You might not be doing this, you said only clients, so that might not be relevant.

Can you access the internet when the DNS Server Service is stopped? IE ... telnet to port 25 or 80 of some external server that you reference by IP address, thus bypassing DNS resolution all together?

Jörgen Andersson23-Jul-08 0:11