Export (0) Print
Expand All
1 out of 1 rated this helpful - Rate this topic

Logon, Browsing, and Resource Sharing: The Basics

Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.

This chapter describes how to configure and use the Windows 95 logon process, network browsing, and peer resource sharing capabilities.

This section summarizes key Windows 95 features that you can use to make network logon, resource browsing, and peer resource sharing easier and more secure for computers running Windows 95 on your network.

On This Page

Unified System Logon Basics
Network Browsing Basics
Peer Resource Sharing Basics
Logon, Browsing, and Resource Sharing: The Issues
Overview of Logging on to Windows 95
Configuring Network Logon
Using Login Scripts
Technical Notes for the Logon Process
Browsing Overview
Browsing on Microsoft Networks
Browsing on NetWare Networks
Overview of Peer Resource Sharing
Using File and Printer Sharing for Microsoft Networks
Using File and Printer Sharing for NetWare Networks
Troubleshooting for Logon, Browsing, and Peer Resource Sharing

Unified System Logon Basics

Windows 95 offers a consistent user interface for logging on to and validating access to network resources. The first time the user logs on to Windows 95, logon dialog boxes appear for each network client on that computer and for Windows 95. If the user's password for Windows 95 or for another network is made the same as the password for the primary logon client, Windows 95 automatically logs the user on to Windows 95 and all networks using that password every time the user logs on. This means that, for users, network logon is simplified in that a single logon dialog box is presented each time the operating system starts. For network administrators, it means they can use existing user accounts to validate access to the network for users running Windows 95.

Note: The Passwords option in Control Panel provides a way to synchronize logon passwords for different networks so they can be made the same if one is changed. For more information, see Chapter 14, "Security."

When a user logs on to other networks with different passwords and chooses to save them, the passwords are stored in a password cache. The Windows 95 password unlocks this password cache. Thereafter, Windows 95 uses the passwords stored in the password cache to log a user on to other networks so no additional passwords need to be typed.

For NetWare networks, Windows 95 provides graphical logon to Novell NetWare versions 3.x, or 4.x if the network is configured for bindery emulation, plus a NetWare-compatible login script processor. This means that if you are using Microsoft Client for NetWare Networks, Windows 95 can process NetWare login scripts. If drive mappings and search drives are specified in a login script, then under Windows 95 the same user configuration is used for network connections as was specified under the previous operating system, with no administrative changes necessary.

For Microsoft networks, Windows 95 supports network logon using domain user accounts and login script processing (as supported by LAN Manager version 2.x and Windows NT).

Network Browsing Basics

Network Neighborhood is the central point for browsing in Windows 95. It offers the following benefits:

  • Users can browse the network as easily as browsing the local hard disk.

  • Users can create shortcuts to network resources on the desktop.

  • Users can easily connect to network resources by clicking the Map Network Drive button that appears on most toolbars.

  • Users can open files and complete other actions by using new common dialog boxes in applications. This new standard provides a consistent way to open or save files on both network and local drives.

  • The network administrator can customize Network Neighborhood by using system policies, as described in Chapter 15, "User Profiles and System Policies." A custom Network Neighborhood can include shortcuts to commonly used resources, including Dial-Up Networking resources.

In any situation in which you can type a path name for connecting to a server — such as in the Map Network Drive dialog box or at the command prompt — you can specify the server name with two backslashes (\\) if your network uses UNC path names. For example, to connect to the server CORP, volume DOCS, directory WORD, and subdirectory Q1, type the UNC name \\corp\docs\word\q1.

On NetWare networks, you can use the UNC name or standard NetWare syntax. For the previous example, you would type corp/docs:word\q1. (Notice that, in the NetWare environment, "/" and "\" are interchangeable.) However, Windows 95 does not support the NetWare 4.0 naming convention of \\\nwserver_sys\directory_path\filename.ext where \\\nwserver_sys is the name of the NetWare Directory Services (NDS) server volume object.

Peer Resource Sharing Basics

The two peer resource sharing services in Windows 95 — Microsoft File and Printer Sharing for NetWare Networks and File and Printer Sharing for Microsoft Networks — are 32-bit, protected-mode networking components that allow users to share directories, printers, and CD-ROM drives on computers running Windows 95. File and Printer Sharing services work with existing servers to add complementary peer resource sharing services.

For example, a NetWare network and its users will realize the following benefits by using File and Printer Sharing for NetWare Networks:

  • Users can share files, printers, and CD-ROM drives without running two network clients. This saves memory, improves performance, and reduces the number of protocols running on your network. (Under Windows for Workgroups, Novell users had to also run a Microsoft network client to take advantage of peer resource sharing.)

  • Security is user-based, not share-based. You can administer user accounts, passwords, and group lists in one place (on the NetWare server) because File and Printer Sharing for NetWare Networks uses the NetWare server's authentication database.

  • Users running VLM or NETX clients can access shared resources on computers running Windows 95. The computer running Windows 95 looks as if it is just another NetWare server if it uses SAP Advertising, as "Using File and Printer Sharing for NetWare Networks" later in this chapter. The computer providing File and Printer Sharing services can handle up to 250 concurrent connections.

  • You can add secure storage space and printing to the network inexpensively, while using familiar NetWare tools to manage these resources. You can reduce the load and improve the performance of NetWare servers by moving selected shared resources to one or more computers running File and Printer Sharing services. This allows you to manage load balancing for users without adding a new NetWare server.

  • You get a scalable, high-performance 32-bit peer server that uses multiple 32-bit threads, the new Windows 95 VFAT 32-bit file system, 32-bit NDIS drivers, 32-bit IPX/SPX-compatible protocol, and the burst-mode protocol.

Similar benefits are available when you use File and Printer Sharing for Microsoft Networks. You can also use either share-level security or, on a Windows NT network, user-level security to protect access to peer resources.

Logon, Browsing, and Resource Sharing: The Issues

This section summarizes the issues you need to consider when planning to use logon, browsing, and resource sharing features in Windows 95.

The network logon issues include the following:

  • To use unified logon, a logon server (such as a Windows NT domain controller or a NetWare preferred server) must be available on the network and contain user account information for the user (unless, of course, the user is logging on as a guest).

  • The Windows 95 logon processor can parse most statements in the NetWare login scripts. However, any statements loading TSRs must be removed from the scripts and loaded from AUTOEXEC.BAT. Because the Windows 95 logon processor operates in protected mode, it is not possible to load TSRs for global use from the login script. These TSRs should be loaded from AUTOEXEC.BAT before protected-mode operation begins, or using other methods described in "Using Login Scripts" later in this chapter.

    In some cases, login scripts load backup agents as TSRs. In such cases, protected-mode equivalents built into Windows 95 can be used, making it unnecessary to load these TSRs.

The network browsing issues include the following:

  • You can plan ahead to configure workgroups for effective browsing by using WRKGRP.INI to control the workgroups that people can choose. For information about configuring WRKGRP.INI, see Chapter 5, "Custom, Automated, and Push Installations."

  • If your enterprise network based on Microsoft networking is connected by a slow-link WAN and includes satellite offices with only Windows 95, then workstations in the satellites cannot browse the central corporate network. Consequently, they can connect to computers outside of their workgroups only by typing the computer name in a Map Network Drive dialog box. To provide full browsing capabilities, the satellite office must have a Windows NT server.

  • You can use system policies, such as Hide Drives In My Computer or Hide Network Neighborhood, to limit or prevent browsing by users. For information, see Chapter 15, "User Profiles and System Policies."

The resource sharing issues include the following:

  • If you want to configure a computer to share its files or printers, the choice of which File and Printer Sharing service you install depends on whether users who will be browsing for shared resources are running Microsoft or NetWare network clients.

  • If you want to use File and Printer Sharing for NetWare Networks, there must be a NetWare server available on the network. This peer resource sharing service uses only user-level security, not share-level security, so a NetWare server must be available to validate user accounts. Also, the NetWare server must include a Windows_Passthru account (with no password) in its user accounts database.

  • If you plan to use File and Printer Sharing for Microsoft Networks with user-level security, then a Windows NT server or domain must be available to validate user accounts.

  • If you plan to use Net Watcher to remotely monitor connections on a computer running File and Printer Sharing services, that computer must have the Microsoft Remote Registry service installed. This is also true if you want to use Registry Editor or System Policy Editor to change settings on a remote computer. For information, see Chapter 16, "Remote Administration."

  • If you are configuring a user's workstation to act as a peer server, you might also want to specify that this computer cannot run MS-DOS – based applications (which take exclusive control of the operating system, shutting down File and Printer Sharing services). To do this, you can set the system policy named Disable Single-Mode MS-DOS Applications.

Overview of Logging on to Windows 95

There can be two levels of system logon on Microsoft or NetWare networks:

  • Log on to Windows 95 by using a user name and a password that is cached locally

  • Log on to a NetWare network or a Windows NT domain for validation, "Overview of Logging on to Windows 95" earlier in this chapter

When other network vendors make 32-bit, protected-mode networking clients available, network logon will be automatically available for those networks because of the Windows 95 network provider interface, as described in Chapter 32, "Windows 95 Network Architecture."

Windows 95 provides a single unified logon prompt. This prompt allows the user to log on to all networks and Windows 95 at the same time. The first time a user starts Windows 95, there are separate logon prompts for each network, plus one for Windows 95. If these passwords are made identical, the logon prompt for Windows 95 is not displayed again.

Logging on to Windows 95 unlocks the password cache file (.PWL) that caches encrypted passwords. This is the only logon prompt that appears if no other network clients are configured on that computer.

To log on to Windows 95 when no other network logon is configured

  • When the Welcome to Windows dialog box appears after starting Windows 95 for the first time, specify the user name and password.

Cc751090.rk11_01a(en-us,TechNet.10).gif

Windows 95 uses this logon information to identify the user and to find any user profile information. User profiles define user preferences, such as the fonts and colors used on the desktop, and access information for the user. (For more information, see Chapter 15, "User Profiles and System Policies.")

To log on to Windows 95 on a Microsoft network

  1. When the Enter Network Password dialog box appears after starting Windows 95 for the first time, specify the user name and password.

    For network logon on a Microsoft network, type the name of the Windows NT domain, LAN Manager domain, or Windows NT computer that contains the related user account.

    This dialog box appears for logging on to Windows NT networks

    Cc751090.rk11_01g(en-us,TechNet.10).gif

    After the user name and password pair are validated by the network server, the user is allowed to use resources on the network. If the user is not validated, the user cannot gain access to network resources.

  2. The first time Windows 95 starts, the Welcome to Windows dialog box appears, prompting you to type the user name and password defined for Windows 95.

To log on to Windows 95 on a NetWare network

  1. To log on to a NetWare network, type the name of the NetWare server, which is the preferred server where the related user account is stored.

    This dialog box appears for logging on to NetWare networks

    Cc751090.rk11_02a(en-us,TechNet.10).gif

    After the user name and password pair are validated by the NetWare server, the user is allowed to use resources on the network. If the user is not validated, the user will be prompted to type a password when connecting to a NetWare server during this work session.

  2. The first time Windows 95 starts, the Welcome to Windows dialog box appears, prompting you to type the user name and password defined for Windows 95. Type this information and click OK.

The next time this computer is started, Windows 95 displays the name of the last user who logged on and the name of the domain or preferred server used for validation. If the same user is logging on again, only the password for the network server or domain needs to be entered. If another user is logging on, that user's unique user name and password must be entered. If the passwords are the same for the network and Windows 95, the second dialog box for logging on to Windows 95 does not appear again.

Configuring Network Logon

If you install either Client for Microsoft Networks or Client for NetWare Networks, you can configure a computer running Windows 95 to participate on a Windows NT or NetWare network.

Before you can use network logon on a computer running Windows 95, however, you must have a Windows NT domain controller or NetWare server on the network that contains user account information for the Windows 95 user. For more information about setting up permissions on a Windows NT or NetWare server, see the administrator's documentation for the server. For related information, see Chapter 8, "Windows 95 on Microsoft Networks" and Chapter 9, "Windows 95 on NetWare Networks."

The validation of a user's network password at system startup might not be required for accessing network resources later during that work session. However, system startup is the only time the login script can run, and it is the only time at which user profiles and system policies can be downloaded on the local computer. Therefore, proper network logon can be extremely important.

The following sections provide information about configuring network logon for computers on Windows NT and NetWare networks when using a 32-bit, protected-mode network client. You can also use system policies to control network logon options, as summarized at the end of this section. For information about enforcing logon password requirements, see Chapter 14, "Security."

Tip Logon validation will control only user access to network resources, not access to running Windows 95. To require validation by a network logon server before allowing access to Windows 95, you must use system policies. For information, see "Setting Network Logon Options with System Policies" later in this chapter.

Notice, however, that Windows 95 security cannot prevent a user from starting the computer by using Safe Mode or a floppy disk. If you require complete user validation before starting the computer in any way, use Windows NT as the sole operating system.

Configuring Logon for Client for Microsoft Networks

When the computer is configured to use Client for Microsoft Networks as the Primary Network Logon client, you can specify Microsoft Windows NT logon options in the Network option in Control Panel. This section describes how to configure these options.

Network logon automatically validates the user on the specified Windows NT domain during the process of logging on to Windows 95. If this option is not configured, the user cannot access most network resources. If this option is configured and the user does not provide a correct password, Windows 95 operation might seem normal, but the user will not have access to most network resources.

When you configure network logon options, you can specify whether you want to automatically establish a connection for each persistent connection to a network resource or verify whether to reestablish connections at system startup. You can also specify basic network logon options in custom setup scripts used to install Windows 95.

For complete procedures for configuring network logon and persistent connections for Client for Microsoft Networks, see Chapter 8, "Windows 95 on Microsoft Networks." For information about defining network logon options in custom setup scripts, see Chapter 5, "Custom, Automated, and Push Installations." For information about controlling network logon by using system policies, see Chapter 15, "User Profiles and System Policies."

Configuring Logon for NetWare Networks

Each Windows 95 user must have an account on the NetWare server before being able to use its files, applications, or print queues. The NetWare server account contains user credentials (user names and passwords).

With Client for NetWare Networks, there is no real-mode logon before Windows 95 starts, just the single, unified logon prompt for Windows 95 that allows users to log on to the system and to all networks at the same time. The first time a user starts Windows 95, there are two separate logon prompts: one for Windows 95 and one for the NetWare preferred server. As long as the two passwords are the same, the second logon prompt for Windows 95 is not displayed again.

If the computer uses a Novell-supplied real-mode network client, network logon occurs in real mode, and uses all the NetWare configuration settings that were in place before Windows 95 was installed. There are no required changes.

To configure Client for NetWare Networks for network logon, you need to specify whether Client for NetWare Networks is the Primary Network Logon client, which means the following:

  • System policies and user profiles are downloaded from NetWare servers, if you use these features.

  • Users are prompted first to log on to a NetWare server for validation when Windows 95 starts (before being prompted to log on to any other networks).

  • For this computer, the last logon script runs from a NetWare server.

Tip When you start Windows 95 with Client for NetWare Networks configured as the Primary Network Logon client, Windows 95 automatically prompts you to provide logon information such as your password on the NetWare server.

You should never run the Novell-supplied LOGIN.EXE utility from a batch file or at the command prompt when you are using Client for NetWare Networks.

When you designate Client for NetWare Networks as the Primary Network Logon client, you must also specify a preferred NetWare server. Windows 95 uses the preferred server to validate user logon credentials and to find user profiles and system policy files. You can change the preferred NetWare server at any time.

The following procedure describes how to configure Client for NetWare Networks to log on to a NetWare network. If you use a NETX or VLM client, you can configure the setting for the preferred server using NET.CFG or using the /ps option in STARTNET.BAT, AUTOEXEC.BAT, or wherever you start NETX or VLM. For more information, consult your Novell-supplied documentation.

To use a NetWare server for network logon

  1. In the Network option in Control Panel, select Client for NetWare Networks in the Primary Network Logon box.

  2. Double-click Client for NetWare Networks in the list of installed components.

  3. In the Client for NetWare Networks properties, set values for the configuration options, as described in the following table.

    Property

    Meaning

    Preferred Server

    Designates the name of the NetWare server that appears automatically in the network logon dialog box. Windows 95 obtains the NetWare login script from this server, unless you specify a different NetWare server in the Enter Network Password dialog box. This is also the server used to store user profiles and system policies, if these are used on your network. The Preferred Server setting is for the computer, not for individual users.

    First Network Drive

    Specifies the first drive letter that you want assigned to the first network connection.

    Enable Logon Script Processing

    Specifies that this computer will process NetWare logon scripts when a user logs on to the network.

Client for NetWare Networks attempts to connect to the preferred server rather than the first server that responds to the Get Nearest Server broadcast. Client for NetWare Networks also attempts a number of server connections in case the client computer can't establish a connection with the preferred server.

Tip for Passwords on Windows 95 and NetWare Servers

After you log on to the network and you are validated by a NetWare server, Windows 95 automatically supplies the same user name and password for logging on to Windows 95. You are asked to supply your user name and password to log on to Windows 95 only if the user name or password is different from your NetWare user account. Therefore, you might want to keep your user name and password the same for both the Windows 95 and the NetWare networks.

Maintaining the same user name and password for both networks also makes it easier for network administrators to coordinate user accounts. For more information about passwords, including brief information on changing passwords on a NetWare server, see Chapter 14, "Security."

With NETX and VLM clients, network logon occurs in real mode during system startup. Therefore, the logon prompt for Windows 95 always appears when these clients are used because the unified logon process is not available.

Setting Network Logon Options with System Policies

The network administrator can define system policies to enforce requirements for network logon. For example, you may want to ensure that users cannot access the local computer without network validation, or you may want to disable password caching.

For network logon in general, use these policies:

  • Logon Banner, to specify a caption and other text, such as a legal notice, to be displayed before the logon dialog box appears.

  • Require Validation By Network For Windows Access, to specify that each logon must be validated by a server before access to Windows is allowed.

For Microsoft Client for NetWare Networks, use this policy:

  • Disable Automatic NetWare Login, to specify that when Windows 95 attempts to connect to a NetWare server, it does not automatically try to use the user's network logon name and password and the Windows logon password to make the connection.

For Client for Microsoft Networks, use these policies:

  • Log On To Windows NT, to specify that this computer can participate in a Windows NT domain.

  • Display Domain Logon Validation, to display a message when the domain controller has validated user logon.

  • Disable Caching Of Domain Password, to specify that no caching is used for the network password. However, do not enable the Quick Logon feature when password caching has been disabled using system policies. The Quick Logon feature requires password caching to function properly.

For information about these policies and others that enforce password requirements, see Chapter 15, "User Profiles and System Policies." which also describes how to implement system policies.

If a computer has the Microsoft Remote Registry agent installed, you can use System Policy Editor to remotely set network logon options on individual computers without using system policies. This is useful in cases in which you have not previously enforced logon requirements using system policies but you want to ensure that network logon is configured properly on a specific computer.

Using Login Scripts

This section summarizes some information about using login scripts on Windows NT and NetWare networks. For details about using login scripts for push installation of Windows 95, see Chapter 5, "Custom, Automated, and Push Installations."

Using Login Scripts with Microsoft Networking

This section summarizes how to use login scripts for Windows 95 on Windows NT networks.

Login scripts are batch files or executable files that run automatically when a user logs on to a computer running either Windows NT, Windows 95, or MS-DOS. Login scripts are often used to configure users' working environments by making network connections and starting applications.

There are several reasons that you might want to use login scripts:

  • You want to manage part of the user environment (such as network connections) without managing or dictating the entire environment.

  • You want to create common network connections for multiple users.

  • You already have LAN Manager 2.x running on your network, and you want to continue to use login scripts you have created for that system.

To assign a user a login script, designate the path name of the login script file in the user's account on the server. Then, whenever that user logs on, the login script is downloaded and run. You can assign a different login script to each user or create login scripts for use by multiple users.

To create a batch-file login script, create an MS-DOS batch file. (For more information on creating batch files, see the Windows NT Server System Guide or your MS-DOS documentation.) There are several special parameters you can use when creating login scripts, as shown in the following table.

Parameter

Description

%OS%

The operating system of the user's workstation

%PROCESSOR%

The processor type (such as 80386) of the user's workstation

%USERDOMAIN%

The domain containing the user's account

%USERNAME%

The user name

A login script is always downloaded from the server that validates a user's logon request. For users with accounts on Windows NT server domains that have one or more backup domain controllers and a primary domain controller, any one of the domain controllers can authorize a user's logon attempt. To ensure that login scripts always work for users, you should be sure that login scripts for all user accounts in a domain exist on every primary and backup domain controller in the domain. You can do this by using the Windows NT Replicator service, as described in the Windows NT Server System Guide.

Home directories on Windows NT networks are used to store user profiles and can also serve as private storage spaces for users. Typically, users also control access to their home directories and can restrict or grant access to other users.

To ensure access to user profiles, you should assign each user a home directory on a server. You can also assign users home directories on their own workstations (although this means that users won't have access to their user profiles from other computers); you might want to do this if you don't want the user to be able to access files and directories on the rest of the workstation.

Using Login Scripts on NetWare Networks

On NetWare networks (version 3.x or using the bindery), the system login script named NET$LOG.DAT is stored in the PUBLIC directory on the server. Individual user scripts are stored in their MAIL subdirectories. The network administrator can use SYSCON (or NWADMIN for VLM) to edit login scripts for any NetWare-compatible client running under Windows 95.

Login scripts are stored differently on NetWare 3.x servers (using bindery services) versus NetWare 4.x servers (using NDS). On a bindery server, the System login script is stored in the NET$LOG.DAT file in the PUBLIC directory, and User login scripts are stored in the LOGIN file in MAIL subdirectories that correspond to the users' internal IDs. On an NDS server, the Container, Profile, and User login scripts are stored in the NDS database as properties of those objects.

The issues related to running login scripts depend on whether the computer is configured with Client for NetWare Networks or uses a Novell-supplied network client.

Running Login Scripts with Client for NetWare Networks

If the computer is running Client for NetWare Networks, the special Windows 95 login script processor runs the login script after the user completes entries in the network logon dialog box during system startup. Microsoft Client for NetWare Networks makes only bindery connections. When it connects to a NetWare 4.x server, the server must be running bindery emulation, so that the login scripts can be accessed in the same way as on a bindery server. If bindery-type login script files aren't available, you must use SYSCON from a NetWare 3.x server to connect to the NetWare 4.x server and create bindery-type System and User login scripts.

The Windows 95 login script processor runs NetWare 3.x system and user login scripts, using commands in these scripts, such as MAP and CAPTURE, to make global changes to the system environment. For example, a script might include SET statements or PATH statements to specify search drives.

The login script appears in a window if the user's login script contains the WRITE, DISPLAY, FDISPLAY, PAUSE, or WAIT commands.

The Login Script Processor window

Cc751090.rk11_31(en-us,TechNet.10).gif

Any NetWare or MS-DOS command (in conjunction with NetWare login script commands) can be used in a login script except those that load TSRs. The Windows 95 login script processor operates in protected-mode, so loading real-mode TSRs from a login script is not possible because login scripts are run after all real-mode actions are completed at system startup. Any TSR that is run from a login script is loaded in a single VM, which is subsequently shut down when login script processing is completed. In these cases, the login script processor displays an error message.

For loading components such as backup agents, protected-mode equivalents in Windows 95 can be used instead of running TSRs. If you need to run a TSR to support an application, use one of the options described in the following table.

What the TSR must support

Where to load the TSR

With NDIS 3.1 drivers:

 

All applications created for MS-DOS or Windows, without IPX/SPX support

AUTOEXEC.BAT

All Windows-based applications that require IPX/SPX support1

WINSTART.BAT in the Windows directory

Any MS-DOS – based application that requires IPX/SPX support2

Load the TSR at the command prompt before running the application

With ODI drivers:

 

All applications created for MS-DOS or Windows with IPX/SPX support

After the entry that loads IPXODI in AUTOEXEC.BAT

1 The IPX/SPX-compatible protocol (NWLINK) is loaded after real mode is complete but before login scripts are processed, so this protocol is available for TSRs loaded from WINSTART.BAT.

2 The TSR must be loaded in each separate VM for each application that requires that TSR before the application is loaded. This can be done in a batch file used to run the application.

The network administrator might want to warn users that, in the following circumstances, the login script processor can display special windows and messages, and that this is not an error condition:

  • When the login script runs, a message announces that the operating system is processing login scripts. The user can click a button to see details. However, if any statement in the script writes to the screen or if there is a PAUSE statement, the Logon Script Processor window appears and displays all subsequent statements as they run.

  • If any #DOS_command statement is included in the script, a special VM is used to process the command. An MS-DOS Prompt window appears while the command is running and then closes automatically when the command is complete.

The following list presents some tips for testing and running login scripts with Client for NetWare Networks:

  • In your testing laboratory, run the login script on a NETX computer and check the drive mappings and printer capture statements. Then run the script under Client for NetWare Networks and make sure the results are the same.

  • Insert PAUSE statements frequently in the scripts you are testing so that you can study each screenful of information as it appears in the Logon Script Processor window.

  • While testing scripts, check carefully for script errors that appear in the Logon Script Processor window.

  • Insert PAUSE statements following any text that you want the user to read during system logon.

Note: The Windows 95 login script processor can handle any documented NetWare login script commands. Any undocumented variations on NetWare commands might not be processed as legal statements.

You can make persistent connections (using the same drive letter each time) to NetWare volumes and directories by using the Windows 95 user interface. Using persistent connections eliminates the need for some NetWare MAP commands in login scripts. However, if persistent connections are made to a server, you should avoid using the ATTACH command in login scripts. For information about making persistent connections, see "Connecting to Drive and Printer Resources" later in this chapter.

Client for NetWare Networks also differs from NETX and VLM in that it does not map the first network drive to the logon directory of the preferred server. All subsequent connections to NetWare servers must be made by using Windows 95 tools.

Running Logon Scripts with Novell-Supplied Clients

If a computer is running the Novell-supplied NETX or VLM networking client, login scripts are processed as they were before Windows 95 was installed.

With NETX or VLM, login scripts are run during system startup after real mode at the command prompt before Windows 95 switches to protected mode. Therefore, all statements and TSRs will run as expected and be available globally for all applications created for Windows or MS-DOS.

Important: Users running a Novell-supplied client should always log on to the NetWare server before running Windows 95. Otherwise, many operational problems will occur. For example, if a user instead logs on at command prompt while already running Windows 95, then all the drive mappings created by the login scripts will be local only to that VM.

Technical Notes for the Logon Process

The notes in this section provide a brief overview of the logon process in Windows 95.

If user profiles are enabled (using the Passwords option in Control Panel or by setting the related system policy), then a logon dialog box will always appear at system startup (even if the user's password is blank) because the user must be identified so the operating system can load the correct profile.

If user profiles are not enabled, then what happens in the logon process depends on the setting specified in the Primary Network Logon box in the Network option in Control Panel. If the Primary Network Logon setting is for a network provider such as Client for NetWare Networks or Client for Microsoft Networks, then an Enter Network Password dialog box will always appear at system startup if the network is active. These network providers cannot allow automatic logon without the user entering a password because the provider does not know which network password the user wants to use.

On a portable computer that has a network adapter that can be changed (for example, using the adapter on a docking station versus using a PCMCIA card), the logon dialog box appears when there is an active network. Only the Windows 95 system logon dialog box appears when the network is not active.

If the user selects Windows Logon as the value in the Primary Network Logon box in the Network option in Control Panel, then the Windows logon dialog box will appear first, followed by logon dialog boxes for any other network providers. In this case, if the Windows password and the passwords for any other network providers are all blank, then Windows 95 can attempt an automatic or "silent" logon (opening the user's password file with a blank password).

You might choose this configuration, for example, for peer servers that are physically secure from user access when you want such servers to be able to automatically recover from power outages or other failures without user intervention.

Note: The administrator can use system policies to restrict users' access to the Passwords option in Control Panel or to require a minimum password length to prevent automatic logon using blank passwords.

Browsing Overview

Browsing in Windows 95 is the same for all network providers, whether the network is based on Windows NT Server, Novell NetWare, another network, or Windows 95 itself.

Users can browse network resources to connect to them. For example, users on NetWare networks can see NetWare servers and printers, plus computers running File and Printer Sharing for NetWare Networks. Users on Microsoft networks can find network resources by scrolling through a list of available workgroups, a list of available computers in a given workgroup, and a list of available resources on a given computer.

For technical details about network computing with Windows 95 on Microsoft and NetWare networks, see "Browsing on Microsoft Networks" and "Browsing on NetWare Networks" later in this chapter.

Using Network Neighborhood

When you use Network Neighborhood, you can access shared resources on a server without having to map a network drive. Browsing and connecting to the resource consists of a single step: clicking an icon.

For information about what happens internally when Network Neighborhood is used to browse multiple networks, see the description of the Multiple Provider Router in Chapter 32, "Windows 95 Network Architecture."

Using Workgroups in Windows 95

On Microsoft networks, computers are logically grouped in workgroups for convenient browsing of network resources. If share-level security is used, each computer in the workgroup maintains its own security system for validating local user logon and access to local resources.

NetWare networks do not use the workgroup concept, so computers running Windows 95 with VLM or NETX clients cannot be members of workgroups. However, computers running File and Printer Sharing for NetWare Networks with Workgroup Advertising enabled can appear in workgroups.

To set the workgroup for a computer, click the Identification tab in the Network option in Control Panel and type a name.

For more information about using Network Neighborhood, see online Help.

To browse a server quickly without mapping a drive

  1. From the Start menu, click Run, and then type the server name. For example:

    \\nwsrv1
    
  2. To browse any shared directory in the window that appears, double-click its icon.

  3. To browse this server's workgroup, press BACKSPACE. This is the equivalent of clicking the Up One Level button on the toolbar.

To create a shortcut on the desktop to a network resource

  1. In Network Neighborhood, find the network resource for which you want to create a shortcut.

  2. Using the right mouse button, drag the icon for that resource onto the desktop.

  3. In the context menu, click Create Shortcut Here.

  4. Double-click the shortcut icon to view the contents of the network directory in a new window. This shortcut is available every time you start Windows 95.

As the network administrator, you can use system policies to create a custom Network Neighborhood for individuals or multiple users. You can create shortcuts using UNC names for any network connections, including Dial-Up Networking connections, as part of the custom Network Neighborhood provided when using system policies. However, do not place directories in the custom Network Neighborhood. Windows 95 does not support this feature, and unpredictable results can occur. In System Policy Editor, enable the policy named Custom Network Neighborhood:

  • Use Registry mode to enable this option on a local or a remote computer

  • Use Policy mode to create or modify a policy file for one or more users

You can also set the following system policies to control users' access to built-in Windows 95 browsing features:

  • Hide Network Neighborhood, to prevent access to Network Neighborhood

  • No Entire Network In Network Neighborhood, to prevent access to the Entire Network icon in Network Neighborhood

  • No Workgroup Contents In Network Neighborhood, to prevent workgroup contents from being displayed in Network Neighborhood

For more information about specific policies and about using System Policy Editor, see Chapter 15, "User Profiles and System Policies."

Browsing in Common Dialog Boxes

The new common dialog boxes (such as File Open and File Save) are standard in programs that use the Windows 95 user interface. They provide a consistent way to open or save files on network resources and local drives. Also, you can browse Network Neighborhood and you can perform most basic file management tasks by using a common dialog box.

Note: Windows-based applications created for earlier versions of Windows do not use the new common dialog boxes.

In Windows 95, you can create new directories (also called folders) when you are saving a document (unlike Windows 3.1 in which you had to start File Manager or exit to the MS-DOS command prompt). This means that you can also create a new directory on a shared network resource when saving documents, as shown in the following procedure. This procedure can be used in any application that uses the Window 95 common dialog boxes.

To create a new directory on the network while saving a file

  1. In the File menu, click Save As.

  2. In the Save In list, select a network location. If you need to, you can click Network Neigborhood in this list to browse for the computer on which you want to save the file.

    Cc751090.rk11_29(en-us,TechNet.10).gif

  3. Click the Create New Folder icon, and type text for the new directory label.

  4. In the File Name box, type a name for the file, and then click Save.

Connecting to Drive and Printer Resources

rk11_05a

The toolbar is available in every window and includes the Map Network Drive button. If you click this button, the Map Network Drive dialog box appears. In this dialog box, you can type the name of a network server and shared directory using the UNC name. For example, the UNC name for the server CORP and the shared directory DOCS is \\CORP\DOCS. On NetWare networks, you can also type any remote computer name understood by the network (for example, TRIKE/SYS:public).

You can make a persistent connection to any drive (that is, you can store its name and automatically reconnect to it at startup) by clicking the Reconnect At Logon check box in the Map Network Drive dialog box. Persistent connections are restored to the same drive letters each time Windows 95 is started.

You can display this dialog box by right-clicking the Network Neighborhood icon.

Cc751090.rk11_06(en-us,TechNet.10).gif

When installing a new printer, you can specify a shared printer resource by using the UNC name or the Point and Print method. For example, for the shared printer named HP_III on the server CORP, the name UNC is \\CORP\HP_III. For more information about Point and Print, see Chapter 23, "Printing and Fonts."

Browsing with the Net View Command

Browsing network resources at the command prompt is handled by the real-mode networking components. You can use the net view command to perform most of the same browsing actions as Network Neighborhood or Windows Explorer, except that it cannot provide a list of workgroups.

For specific notes about using the net commands on NetWare networks, see "Browsing on NetWare Networks" later in this chapter.

To display a list of computers with shared resources in a workgroup

  • At the command prompt, type the following and then press ENTER.

    net view [\\computername]

    – Or –

    net view [/workgroup:workgroupname]

Where computername is the name of the computer with shared resources you want to view; /workgroup specifies that you want to view the names of the computers that share resources in another workgroup; and workgroupname is the name of the workgroup that has computer names you want to view.

Browsing on Microsoft Networks

The Windows 95 browsing scheme for Microsoft networks is based on the scheme currently used for Windows NT and Windows for Workgroups. The Windows 95 browse service attempts to minimize the network traffic related to browsing activity, while also providing an implementation that scales well to support both small and large networks.

This section describes how the browse service designates browse servers and maintains the browse list.

Designating a Browse Master for Microsoft Networks

The Windows 95 browse service uses the concept of a master browse server and a backup browse server to maintain the browse list. There is only one master browse server for a given Windows 95 workgroup for each protocol used in the workgroup; however, there can be one or more backup browse servers for each protocol for a given workgroup.

The master browse server is responsible for maintaining the master list of workgroups, domains, and computers in a given workgroup. To minimize the network traffic that the master browse server can be subjected to when handling browsing services, backup browse servers can be designated in a workgroup to help off-load some query requests. Usually, there is one browse server for every 15 computers assigned to a given workgroup.

When Windows 95 is started on a computer, the computer first checks to see if a master browse server is already present for the given workgroup. If a master browse server does not exist, an election creates a master browse server for the workgroup.

If a master browse server already exists, Windows 95 checks the number of computers in the workgroup, and the number of browse servers present. If the number of computers in the workgroup exceeds the defined ratio of browse servers to computers in a workgroup, an additional computer in the workgroup might become a backup browse server.

The Browse Master parameter in the Advanced properties for File and Printer Sharing for Microsoft Networks provides a mechanism for controlling which computers can become browse servers in a workgroup. If this parameter is set to Automatic, the master browse server can designate that computer as a backup browse server when needed, or that computer can be elected as master browse server. For information about configuring this parameter, see "Using File and Printer Sharing for Microsoft Networks" later in this chapter.

Tip for Using the Net View Command to Check the Browse Server

The net view command is a valuable troubleshooting tool if you suspect the browse list maintained by a browse server is incomplete or inaccurate. You can use net view /WORKGROUP: workgroupname at the command prompt to get the list of known computers directly from the master browse server. The request is not handled by a backup browse server.

If the list of computers returned by a master browse server is inaccurate, you could reset this computer by quitting Windows 95. Another computer will then be promoted to master browse server for the workgroup.

Building the Browse List for Microsoft Networks

In Windows 95, the browse service maintains an up-to-date list of domains, workgroups, and computers, and provides this list to applications when requested. The user sees the list in the following types of circumstances:

  • If a user requests a list of computers in a workgroup, the browse service on the local computer randomly chooses one of the browse servers it is aware of and sends the request.

  • If a user selects a workgroup to which the computer does not belong, Windows 95 requests a list of computers defined in the selected workgroup from a browse server in the selected workgroup.

The selected browse server also sends a list of the other workgroups it knows about that are defined on the network, along with a list of computers in the workgroup to which the user belongs.

The browse list is displayed in the Map Network Drive and Connect Network Printer dialog boxes, or anywhere that Windows 95 presents lists of resources that can be browsed. The browse list can also be displayed by using the net view command. The list can contain the names of domains, workgroups, and computers running the File and Printer Sharing service, including the following:

  • Computers running Windows 95, Windows for Workgroups, and Windows NT Workstation

  • Windows NT Server domains and servers

  • Workgroups defined in Windows 95, Windows for Workgroups, and Windows NT

  • Workgroup Add-On for MS-DOS peer servers

  • LAN Manager 2.x domains and servers

Adding New Computers to the Browse List

When a computer running Windows 95 is started on the network, it announces itself to the master browse server for its workgroup, and the master browse server adds that computer to the list of available computers in the workgroup. The master browse server then notifies backup browse servers that a change to the browse list is available. The backup browse servers then request the new information to update their local browse lists. It might take as long as 15 minutes before a backup browse server receives an updated browse list, and new computers on the network do not show up in a user's request for a browse list until then.

Removing Computers from the Browse List

When a user shuts down a computer properly, the operating system informs the master browse server that it is shutting down. The master browse server then notifies backup browse servers that a change to the browse list is available. The backup browse servers then request the changes to the browse list.

If a user turns off the computer without shutting down, the computer does not get a chance to send the message to the master browse server. In this case, the computer name might continue to appear in the browse list until the name entry times out, which can take up to 45 minutes.

Technical Notes on Browsing on Microsoft Networks

This section presents some brief notes related to browsing on Microsoft networks.

  • The Windows 95 browser has been updated to support browsing across TCP/IP subnetworks. To take advantage of this, the network must use a WINS server or you must use #DOM entries in LMHOSTS files. For information about creating LMHOSTS files, see Appendix G, "HOSTS and LMHOSTS Files for Windows 95."

  • Microsoft LAN Manager-compatible networks such as IBM® LAN Server and Microsoft LAN Manager for UNIX® support browsing of servers and shared directories using the Windows 95 user interface or net view.

  • DEC™ PATHWORKS™ is an example of a Microsoft LAN Manager-compatible network that does not support browsing. AT&T® StarLAN is an example of a Microsoft Network-compatible network that is not based on Microsoft LAN Manager and that does not support remote browsing of servers and shared directories. These servers do not appear in Network Neighborhood; with Windows 95, however, users can still access the servers and shared directories through a network connection dialog box.

  • When a known slow network connection is used (for example, the remote access driver), Windows 95 is automatically configured not to designate that computer to be a browse server for the network connection. The SlowLanas parameter in the Registry identifies the network LANA numbers for which the local computer will not serve as a master browse server. However, the user can still request a list of available workgroups and computers on the network across the slow network connection.

Browsing on NetWare Networks

The Windows 95 user interface includes support for browsing and connecting to network resources on Novell NetWare and other networks. Except for workgroups, this support is the same whether you use Client for NetWare Networks or the Novell-supplied NETX or VLM client. After you connect to a NetWare volume or a computer running File and Printer Sharing for NetWare Networks, you can drag and drop directories and files to move and copy them between your computer and the NetWare server.

For information about printer connections, see Chapter 23, "Printing and Fonts."

Using Network Neighborhood on NetWare Networks

Network Neighborhood is the primary way you can browse the network. When you open Network Neighborhood on a computer running a NetWare-compatible networking client, all the NetWare bindery-based servers your computer is connected to are displayed. All computers running File and Printer Sharing for NetWare Networks that use Workgroup Advertising also appear in Network Neighborhood.

Clicking the Entire Network icon displays a list of all NetWare servers on the network. This list also contains a list of workgroups that include computers running File and Printer Sharing for NetWare Networks. You can view the contents of any server without having to map a network drive.

If your computer has both Client for Microsoft Networks and Client for NetWare Networks installed, then you will also see a list of computers running Windows for Workgroups, Windows 95, and Windows NT. The list of NetWare servers is at the beginning of the list of workgroups or domains in the Entire Network window.

In both the Network Neighborhood and Entire Network views, you can open a server to access its contents without having to map a network drive. You will be asked for security information, if necessary, and you can choose to save your password in the password cache so that you will not have to type it again.

If the computer is running Client for NetWare Networks, drive mappings are limited to the available drive letters. However, Windows 95 supports unlimited UNC connections. (If the computer is running NETX or VLM, it is limited to only eight server connections.)

To connect to a NetWare server in Network Neighborhood

  1. In Network Neighborhood, right-click a NetWare server.

  2. In the context menu, click Attach As. Then type a user name and password, and click OK.

    Cc751090.rk11_12(en-us,TechNet.10).gif

  3. If you want to map a directory on this server, double-click the server icon. Right-click the directory you want to map, and click Map Network Drive in the context menu. Fill in the Map Network Drive dialog box, and click OK.

Tip You can also create a shortcut to frequently used resources. For information, see "Using Network Neighborhood." When you double-click a shortcut, you have to supply only a password to connect to it.

The toolbar on every window includes the Map Network Drive button, which you can use to specify the name of a NetWare server and volume (or directory) that you want to map to a drive letter.

To connect to a directory as the root of the drive

  1. In Network Neighborhood, right-click a directory on a NetWare server. In the context menu, click Map Network Drive.

  2. In the Map Network Drive dialog box, make sure Connect As Root Of The Drive is checked, and then click OK.

With this option enabled, if you switch to this mapped directory in a VM windows, you will see the prompt as drive:\> not drive:\directory>). You cannot go further up the directory tree from the command prompt.

The context menu for a NetWare server shows everything you can do with the related server, volume, or directory. To view the context menu, in Network Neighborhood, right-click a NetWare server.

The following table describes the commands available on the context menu.

Command

Description

Open

Connects to that server.

Explore

Shows the resources available on that server without making a connection.

Who Am I

Specifies whether the user is logged on or attached to the server; if a user is logged on and the computer is attached, specifies that user's name.

Log Out

Logs the user off the server.

Attach As

Presents a dialog box for typing a password to log on to the server. This dialog box allows the user to connect to the server by using a different user name from the one used to log on to the network.

Map Network Drive

Presents a dialog box for mapping a network drive to a drive letter.

Create Shortcut

Creates a shortcut on the desktop for the selected server.

Properties

Shows the properties for the server. Notice that listing the properties of a NetWare server creates an attachment without logging on, thereby using up one of the allowable connections.

If a computer running File and Printer Sharing for NetWare Networks has been configured to allow remote administration, and if you have the authority to administer that server, you can use the administration options in the computer's properties. To do this, in Network Neighborhood, right-click the computer's icon. In the context menu, click Properties, and then click the Tools tab. Use the buttons to run Net Watcher or System Monitor, or to administer the file system.

Cc751090.rk11_30(en-us,TechNet.10).gif

For more information about preparing computers for remote administration under Windows 95, and about using Net Watcher and other tools, see Chapter 16, "Remote Administration."

Managing Connections with Client for NetWare Networks

Client for NetWare Networks is different from NETX and VLM in that it does not map the first network drive to the logon directory of the preferred server. All subsequent connections to NetWare servers must be made in the Windows 95 user interface.

With Client for NetWare Networks, you can manage connections to the NetWare network by using Network Neighborhood and common network-connection dialog boxes such as the Open and Save dialog boxes. (These are the same techniques used for Microsoft networks.)

With Client for NetWare Networks, you can define persistent connections (which use the same drive letter each time the computer starts) to NetWare volumes and directories. Using persistent connections eliminates the need for NetWare MAP commands in login scripts; however, you can still use MAP, ATTACH, and other commands at the command prompt or in login scripts, as described in the following section.

Using Commands to Connect to NetWare Servers

If you are running Client for NetWare Networks, all NetWare commands run in the same way as they do for a Novell-supplied networking client. The ATTACH and SLIST commands provided with Windows 95 use the same syntax and work in exactly the same way as the counterparts provided by Novell.

The following should be noted about certain Novell-supplied commands:

  • For the ATTACH command, configure the networking client to use SAP Browsing.

  • It is recommended that you do not use the LOGIN utility to create an attachment to a computer running File and Printer Sharing for NetWare Networks. Use the ATTACH command instead.

  • For the MAP command, drive mappings in Windows 95 are global to all sessions.

You can also use the Microsoft networking net commands at the command prompt or in login scripts to manage connections on NetWare networks. For example, the net use command can be used to do the following:

  • Perform the same functions as the NetWare ATTACH and MAP commands.

  • Supply similar functionality to the CAPTURE utility for printing when programs require printing to a specific port.

You can use the Windows 95 net view command to perform the same function as the NETX SLIST or VLM NLIST SERVER commands.

The following brief procedures show built-in Windows 95 commands that can be used at the command prompt or in scripts to manage resource connections.

To view NetWare servers

  • At the command prompt or in a login script, type net view

    For example:

    D:\WIN\COMMAND>net view
     NetWare Servers
     ----------------------------
     \\386
     \\TRIKE
     \\WRK
    

To view volumes on a server

  • At the command prompt or in a login script, type net view \\servername

    For example:

    D:\WIN\COMMAND>net view \\trike
     Shared resources at \\trike
     Sharename    Type         Comment
     ----------------------------------
     SYS          Disk
     PUBLIC       Disk
    

The net view command creates an attachment without logging on. Viewing a NetWare server or a computer running File and Printer Sharing for NetWare Networks does not show print queues. However, viewing a computer running File and Printer Sharing for Microsoft Networks shows both shared directories and shared printers.

Use the /network parameter to specify the volumes on the particular network you want to view. For example:

net view \\nwserver_name /network:nw

To create a drive connection

  • At the command prompt or in a login script, type net usedrive: \\servername\volume

    For example:

    D:\WIN\COMMAND>net use l: \\trike\sys
     The password is invalid for \\TRIKE\SYS.
     Enter user name for server TRIKE:joed
     Enter the password for user JoeD on server TRIKE:
    

The net use command is equivalent to MAP drive:=servername\volume: and it maps only to the root of the volume.

Tip To use the next available drive letter when connecting to the volume, replace the drive letter with an asterisk (*).

By typing the net use command without parameters, you can list the current network connections. For example:

Status

Local

Remote

Network

E:

\\NW4\SYS

NetWare

OK

F:

\\WINDOWS\DROOT

Microsoft

H:

\\NETWARE40\THOR\APPS

NetWare

To delete a drive connection

  • At the command prompt or in a login script, type net usedrive: /d

    For example:

    D:\WIN\COMMAND>net use l: /d
    

The /d switch and the NetWare command MAP DEL drive are equivalent.

To create a print connection

  • At the command prompt or in a login script, type net useport: \\servername\queuename

    For example:

    D:\WIN\COMMAND>net use lpt3: \\trike\pscript1
    

This is equivalent to CAPTURE l=port S=servername Q=queuename.

To delete a print connection

  • At the command prompt or in a login script, type net useport: /d

    For example:

    D:\WIN\COMMAND>net use lpt3: /d
    

This is equivalent to ENDCAP L=port#.

The net command in Windows 95 does not support the following:

  • The functionality of the NetWare MAP ROOT command or search drive mappings.

  • Any of the command-line options of the CAPTURE command, except the equivalents for specifying port, server name, and queue name. To use specific CAPTURE options, use the Novell CAPTURE command.

  • The functionality of the Novell NetWare print job designations (the J=jobname parameter for the CAPTURE command).

Note: You can still use the NetWare commands SLIST instead of net view, MAP instead of net use, or CAPTURE instead of net use to connect to a printer.

Using Windows NT to Connect to NetWare Servers

If your site includes both a Novell NetWare network and a Windows NT Server network, computers using Microsoft networking will need to communicate and share resources with the NetWare network. This section summarizes several options using Windows NT.

Windows NT Gateway Service for NetWare.

For Microsoft networking clients that cannot use multiple protocols, you can configure a computer running Windows NT Server 3.5 as a file or print gateway using Windows NT Gateway Service for NetWare to connect to and share NetWare resources. Notice that a Microsoft Windows NT Client Access License is required if the computer will be connecting to servers running Windows NT Server. For information, contact your Microsoft reseller.

As shown in the following illustration, Windows NT Gateway Service for NetWare acts as a translator between the SMB protocol used by Microsoft networks and the NCP protocol used on NetWare networks.

Cc751090.rk11_28(en-us,TechNet.10).gif

The file gateway uses a NetWare account on the Windows NT Server computer to create a validated connection to the NetWare server, which then appears on the Windows NT Server computer as a redirected drive. When the administrator shares the redirected drive, it looks similar to any other shared resource on the Windows NT Server computer. A print gateway functions in much the same way as the file gateway: the NetWare printer appears on the Windows NT network as if it were any other shared printer.

Because access over the gateway is slower than direct access from the client for computers running Windows 95 that require frequent access to NetWare resources, Client for NetWare Networks is a better solution. For information about setting up a Windows NT Server computer with Gateway Service for NetWare, see Windows NT Server Services for NetWare Networks in the Windows NT Server 3.5 documentation set.

Microsoft File and Print Services for NetWare.

This utility for Windows NT Server provides users running a NetWare-compatible client with access to basic NetWare file and print services and to powerful server applications on the same Windows NT Server-based computer. You can use Microsoft File and Print Services for NetWare to add a multipurpose file, print, and application server to your NetWare network without changing users' network client software.

Microsoft Directory Service Manager for NetWare.

This utility for Windows NT Server allows you to maintain a single directory for managing mixed Windows NT Server and NetWare 2.x and 3.x server network.

For more information about these features or how to obtain Microsoft File and Print Services for NetWare, or the Microsoft Directory Service Manager for NetWare, contact your Microsoft sales representative.

Overview of Peer Resource Sharing

When a computer is running File and Printer Sharing services, other users running a compatible network client can connect to shared printers, volumes, CD-ROM drives, and directories on that computer by using the standard techniques for connecting the network resources, as described in "Browsing on NetWare Networks" and "Browsing on Microsoft Networks" earlier in this chapter.

Using computers running Windows 95 as peer servers allows you to add secure storage space and printing to the network at a low cost. The peer service is based on a 32-bit, protected-mode architecture, which means all the Windows 95 benefits for robust, high performance are available. In addition, administrators can take advantage of features provided with Windows 95, such as Net Watcher and system policies, to centrally administer peer servers. In addition, user-level security is available as an additional enhancement beyond the peer server capabilities built into Windows for Workgroups.

Tip Using Net Watcher, a network administrator can remotely monitor and manage files on any computer running File and Printer Sharing services if remote administration has been enabled for that computer. Net Watcher allows an administrator to disconnect users, change access rights, and administer the file system on remote computers. For more information, see Chapter 16, "Remote Administration."

Installing Peer Resource Sharing

If you use custom setup scripts or choose the Custom option as the Setup Type in Windows 95 Setup, you can specify that File and Printer Sharing services be installed with Windows 95. Otherwise, you can add the service later by using the Network option in Control Panel.

Tip For a computer that will share resources with other users on the networks, choose which File and Printer Sharing service to install based on what other users require:

• If most users who need to share these resources are running NETX, VLM, or Client for NetWare Networks, then install File and Printer Sharing for NetWare Networks.

• If most users who need to share these resources are running Client for Microsoft Networks, Windows NT, Windows for Workgroups, or Workgroup Add-on for MS-DOS, then install File and Printer Sharing for Microsoft Networks.

To install File and Printer Sharing after Setup

  1. In the Network option in Control Panel, click Add.

  2. In the Select Network Component Type dialog box, double-click Service.

  3. In the Select Network Service dialog box, click Microsoft in the Manufacturers list. Then, in the Network Service list, click the File and Printer Sharing service you want to install.

For information about enabling File and Printer Sharing in custom setup scripts, see Chapter 5, "Custom, Automated, and Push Installations." For information about controlling peer resource sharing capabilities using system policies, see Chapter 15, "User Profiles and System Policies."

Overview of Security for Peer Resource Sharing

For File and Printer Sharing for Microsoft Networks (but not NetWare), Windows 95 supports share-level security similar to the security provided with Windows for Workgroups. This level of security associates a password with a shared disk directory or printer. Share-level security for peer resource sharing can be implemented in a Windows 95-only peer-to-peer network or on a network supported by Windows NT or other Microsoft Windows network-compatible servers.

For File and Printer Sharing services on both Windows NT and NetWare networks, Windows 95 supports user-level security by linking a peer server directly to another server for user account validation. For network administrators, the user account list is centrally controlled at the Windows NT domain controller or NetWare server; on a Windows NT network, the user account list on a single server can also be used for validation. The resources on the Windows 95 peer server can be accessed only by users with accounts in the central database. Users can also be assigned specified access rights in Windows 95 for particular resources. For information about using and managing security, see Chapter 14, "Security."

Cc751090.rk11_02(en-us,TechNet.10).gif

The 32-bit, protected mode network client and the File and Printer Sharing service are separate network processes, but they share connection information and pass requests to each other when validating a user-level security request.

For user-level security on a computer running either version of File and Printer Sharing service, you specify the server that contains the database of user accounts that are allowed to connect to this peer resource sharing server. You can do the following to customize access to a shared resource:

  • You can use the Windows 95 user interface to specify which users can access the shared resources, and which rights they have. For details, see "Controlling Access to Peer Server Resources on NetWare Networks" later in this chapter.

  • For File and Printer Sharing on NetWare Networks, you can set up user rights remotely on the computer running Windows 95 by using NetWare utilities such as FILER.

  • For File and Printer Sharing on Microsoft Networks, you can set up user rights remotely by using User Manager for Windows NT.

  • You can use Net Watcher to monitor, add, and remove shared resources, as described in Chapter 16, "Remote Administration."

When a user requests access to a shared resource under user-level security, Windows 95 checks for the user's logon name against the list of user accounts maintained on the server. If this is a valid user logon name, Windows 95 then checks whether this user has access privileges for this resource. If the user has access privileges, then the requested operation is allowed.

For an example of how pass-through validation works with peer resource sharing, see Chapter 14, "Security."

Using File and Printer Sharing for Microsoft Networks

File and Printer Sharing for Microsoft Networks is the 32-bit, protected-mode Windows 95 SMB server (VSERVER.VXD), that supports all Microsoft networking products that use the SMB file-sharing protocol, including Windows for Workgroups, Windows NT, LAN Manager, LAN Manager for UNIX, AT&T StarLAN, IBM LAN Server, 3Com® 3+Open® and 3+Share®, and DEC PATHWORKS. Windows 95 enhances the features of Windows for Workgroups peer services by providing administrative control over whether peer sharing services are enabled, by adding user-based security capabilities, and by supporting long filenames.

The following summarizes some requirements for File and Printer Sharing for Microsoft Networks:

  • The computer must use Client for Microsoft Networks.

  • File and Printer Sharing for Microsoft Networks cannot run at the same time as NCP-based File and Printer Sharing for NetWare Networks.

  • If user-level security is used, a Windows NT domain controller must be used for authentication.

The default settings for File and Printer Sharing are correct for most installations. You should need to change these settings in the following circumstances only:

  • If you need to set Browse Master properties, as described in "Browsing on Microsoft Networks" earlier in this chapter.

  • If you want LAN Manager 2.x clients on your network to use resources on a computer running File and Printer Sharing for Microsoft Networks.

Use the Network option in Control Panel to configure the Browse Master and LM Announce parameters for the File and Printer Sharing service. For information about configuring security in Access Control properties, see Chapter 14, "Security."

To specify Browse Master settings

  1. In the Network option in Control Panel, double-click File and Printer Sharing for Microsoft Networks in the list of installed components.

  2. In Advanced properties for File and Printer Sharing for Microsoft Networks, select Browse Master in the Property list.

  3. Select an option in the Value list, as described in the following table.

    Option

    Description

    Automatic

    Specifies that this computer will maintain the browse list if Windows 95 determines that it is necessary. This is the default.

    Yes

    Specifies that this computer is to be used to maintain the browse list for computers in this workgroup.

    No

    Specifies that this computer is never used to maintain the browse list. Use this setting if the computer has little free memory or is connected by a slow link (such as a dial-up connection), or if other conditions create special performance problems.

    At least one computer in the workgroup must have the value of Automatic or Yes for this parameter to ensure the browse list is available to network computers. This parameter is equivalent to the MaintainServerList= entry in the [network] section of SYSTEM.INI in Windows for Workgroups 3.11.

The LM Announce property controls whether a computer running File and Printer Sharing for Microsoft Networks can be seen by LAN Manager 2.x clients.

To specify LM Announce settings

  1. In Advanced properties for File and Printer Sharing for Microsoft Networks, select LM Announce in the Properties list.

  2. Select an option in the Value list, as described in the following table.

    Option

    Meaning

    Yes

    Specifies that you want this computer to announce its presence to other Microsoft networking computers in the workgroup, because there is a LAN Manager 2.x domain on the network. This value must be set to Yes if other computers in your workgroup need to see this computer when browsing the network.

    No

    Specifies that you do not want this computer to broadcast its presence to other computers. Setting this value to No minimizes the level of network traffic. Other users can still connect to this computer by specifying its UNC name in a Map Network Drive dialog box, but the computer will not appear in browse lists.

This parameter is the equivalent of the LMAnnounce= entry in the [Network] section of SYSTEM.INI in Windows for Workgroups 3.11. This value should be No unless there is a LAN Manager 2.x domain on your network.

A LAN Manager 2.x domain is known by browse servers in a workgroup only if at least one computer running Windows 95 (or Windows NT in the domain) is a member of that LAN Manager 2.x domain.

To make a computer running Windows 95 a member of a LAN Manager 2.x domain

  • Set the workgroup name for the computer to be the same as the LAN Manager 2.x domain name.

You can share a directory (or other resource) by selecting it in Windows Explorer or in My Computer and then configuring the related options. The following procedure describes how to share a directory on a computer where user-level security has been specified in the Network option in Control Panel. The steps for sharing resources with share-level security are similar to those for user-level security except that you do not select specific users. Rather, specify the type of access and define a password for the shared resource.

To share a directory (folder) with user-level security

  1. In Windows Explorer, right-click the icon for the directory you want to share. In the context menu that appears, click Sharing.

  2. Click the Sharing tab, and then type a share name for the directory.

    Tip If you add a dollar sign ($) to the end of the share name, the resource will not appear in Network Neighborhood or elsewhere when people browse network resources.

  3. Click the Add button, and use the Add Users dialog box to specify which users can access the directory.

For more information about sharing folders on a Microsoft network, see online Help.

Using File and Printer Sharing for NetWare Networks

If you want to use File and Printer Sharing for NetWare Networks:

  • The computer must use Client for NetWare Networks, rather than Novell-supplied client software.

  • Only user-level security (not share-level security) is available.

  • The service cannot run on the same computer as SMB-based File and Printer Sharing for Microsoft Networks.

  • For pass-through validation when user-level security is enabled, there must be a Windows_Passthru account (with no password) on the NetWare server that is used as the security provider.

A computer configured with File and Printer Sharing for NetWare Networks uses the NCP file-sharing protocol to share resources with MS-DOS – based Novell NetWare computers, computers running Windows NT, and computers that have Client for NetWare Networks installed.

File and Printer Sharing for NetWare Networks supports long filenames and is Plug and Play-aware. This new implementation differs from peer resource sharing in Windows for Workgroups in two fundamental ways:

  • File and Printer Sharing for NetWare Networks uses the NCP protocol instead of the SMB protocol. This means that any NetWare-compatible client (Client for NetWare Networks, NETX, or VLM) can connect to a computer running File and Printer Sharing for NetWare Networks.

  • File and Printer Sharing for NetWare Networks uses user-level security. Access to a shared resource is based on the user's identity instead of on a password associated with that resource. The user database for verifying user identity is the bindery on a specified NetWare server.

This feature means that hundreds of NetWare users can, for example, access a shared CD-ROM using a single NetWare server connection. Also, trustee or other access rights can be defined per-directory for a shared CD-ROM.

When File and Printer Sharing for NetWare Networks is running on a computer, how that peer server appears to users browsing on the network depends on how the peer server advertises itself:

  • For another computer running Microsoft Client for NetWare Networks, the resources on the peer server appear exactly as any shared resources on the network. If the peer server is using Workgroup Advertising, it appears in a workgroup. A peer server using Service Advertising Protocol (SAP, the NetWare broadcasting protocol) Advertising will not appear in a workgroup, but it will appear in the Entire Network list.

  • For a computer running NETX or VLM, any shared directories on a peer server that uses SAP advertising appear the same as volumes on any server. Any shared printers will appear as print queues. Most NetWare administrative commands work as expected, including RIGHTS, FILER, SYSCON, MAP, SLIST, VOLINFO, PCONSOLE, and CAPTURE. If the peer server is not using SAP Advertising, then users running NETX or VLM cannot see or connect to the peer server when browsing the network.

Sharing Resources on a NetWare Network: An Example

During the beta test phase for Windows 95, one NetWare system administrator found the peer resource sharing service to be an administrative lifesaver. A vice president at the company had CD-ROM hardware problems just when he needed immediate access to a tax program that was available only on compact disc.

The quick-thinking administrator installed File and Printer Sharing for NetWare Networks on a computer that had a CD-ROM drive. After making sure the vice president was assigned access rights, the administrator mapped a drive on the vice president's computer to access the shared CD-ROM.

The Windows 95 peer resource sharing service allowed the administrator to provide an immediate software solution to a hardware problem that would have taken much longer to solve.

Sharing Resources on a NetWare Network

To allow NETX and VLM clients on the network to access resources on the peer server, you must enable SAP Browsing in the properties for File and Print Sharing for NetWare Networks. The computer then appears as a server in SLIST listings, and users can map drives to connect to this computer. To see a list of volumes, users can use the VOLINFO command.

Note: Administrative control over File and Printer Sharing for NetWare Networks is coupled with the printer sharing control — the option controlling the user's ability to share a local printer. If these sharing options are not selected in the Network option in Control Panel, then the File and Printer Sharing service is not loaded. However, if the administrator disables printer sharing or file sharing by setting the related option in a system policy file, then the File and Printer Sharing service still runs on the computer, but the related sharing options are not available.

Configuring Browsing for Resource Sharing on NetWare Networks

After you install File and Printer Sharing for NetWare Networks, you need to choose the method that computers browsing on the network will use to find this computer. You can browse by using two options:

  • Workgroup Advertising, which uses the same broadcast method as used by workgroups on Microsoft networks.

  • SAP Advertising, which is used by Novell NetWare 2.15 and above, 3.x, and 4.x servers to advertise their presence on the network. You must enable this option if you want the shared resources to be available to computers running NETX or VLM.

Note: SAP browsing has a theoretical limit of 7000 systems for browsing, and a practical limit of about 1500 systems. For a large peer network, use Workgroup Advertising.

For a general discussion of browsing when using NetWare-compatible clients, see "Browsing on NetWare Networks" earlier in this chapter.

To specify the browsing preference

  1. In the Network option in Control Panel, double-click File and Printer Sharing for NetWare Networks in the list of installed components.

  2. In Advanced properties, select Workgroup Advertising to define how you want computers running Client for NetWare Networks to see and connect to this peer server.

    – Or –

    Select SAP Advertising if you want NETX and VLM clients to be able to connect to this peer server.

    If you select Workgroup Advertising, you can set the following values.

    Value

    Description

    Disabled

    This computer will not be added to the browse list, and it cannot be seen by other members of the workgroup by using any method for browsing network resources.

    Enabled: May Be Master

    This computer is added to the browse list and can be promoted to master browse server if the preferred master is not available.

    Enabled: Preferred Master

    This computer is the master browse server for the workgroup.

    Enabled: Will Not Be Master

    This computer is added to the browse list by the master browse server, but it cannot be promoted to master browse server.

    For more information about master browse server options, see "Building the Browse List for Microsoft Networks" earlier in this chapter.

    Note: If Workgroup Advertising is used, each workgroup must have a master browse server at all times to track names and addresses for computers in the workgroup.

    If you select SAP Advertising, you can set the following values.

    Value

    Description

    Disabled

    This computer will not advertise its presence, and NETX or VLM clients cannot see it by using SLIST or other browsing options, and cannot connect to it. Users running Client for NetWare Networks can see it if Workgroup Advertising is enabled on the peer server.

    Enabled

    This computer will advertise its presence. It will appear in the Entire Network list. Users running VLM, NETX, and Client for NetWare Networks can see it by using any browsing methods, and they can connect to it as they do for any server.

By default, computers running File and Printer Sharing for NetWare Networks are placed in and browsed by workgroups. You can use the Identification properties in the Network option in Control Panel to specify the workgroup and computer name for the computer.

Although computers that use SAP advertising appear in the list of NetWare servers, you cannot use them in all the same ways that you use NetWare servers.

  • When using NETX, you cannot log on to a computer running Windows 95 at the command line, although you can attach to one and map drives to its directories.

  • When using VLM, you cannot log on to a computer running Windows 95 at the command line, but you can run a login /ns command and use the Login button in the NWUSER utility.

  • If you run SYSCON on a NetWare server, you can change the server to one of the computers running Windows 95. However, the computer running Windows 95 does not have a bindery, so when you display all the users (or groups) in SYSCON, you will see the user list (or group list) from the NetWare server that was selected as the user-level security provider.

  • If you run VOLINFO on a NetWare server, you can select one of the computers running Windows 95 and display its volume information (if you are attached to it). This shows all the available shared disk resources for the computer running Windows 95.

In Windows 95, you can do the same things to resources on computers running File and Printer Sharing for NetWare Networks as you can to any other network resource. If you have appropriate rights to connect to the shared resources, you can also create a link to the computer or map a drive to its shared directories, and so on.

Note: Each computer configured with File and Printer Sharing for NetWare Networks logs on to the NetWare server that provides security, to get access to the bindery, using the Windows_Passthru account. This logon process takes place in the background, without user intervention. One connection to that NetWare server is used as needed for each computer running File and Printer Sharing for NetWare Networks, and it is disconnected if it is not needed for 30 seconds.

If a connection already exists, Windows 95 uses that connection and makes a new connection only when required.

Controlling Access to Peer Server Resources on NetWare Networks

You can add to the list of users who can access the resources on the peer server. To do this, add the users to the NetWare pass-through server that provides security. These users can then be given access to the peer server by adding them to the Sharing properties associated with the shared resource.

Passwords for users' resources on the peer server are the same as those for the NetWare pass-through server. Passwords must be changed at that server, as described in "Unified System Logon Basics" earlier in this chapter.

To ensure all users have the required server access

  • Make sure that one NetWare server on the network has the accounts for all users or all servers, and then set that server as the security provider for every computer configured with File and Printer Sharing for NetWare Networks.

    If server access is not set properly, each time the computer running Windows 95 is started a message warns that the pass-through server has not been specified.

To share a directory and specify users on a NetWare network

  1. In Windows Explorer, right-click the directory you want to share. In the context menu, click Sharing.

  2. In the Sharing dialog box, type a share name for the directory.

  3. Click the Add button. In the Add Users dialog box, select the user name in the list on the left, and then click the related button to specify the kind of access that user is allowed.

    For information about using the Add Users dialog box, see online Help. For more information about specifying directory access rights, see Chapter 14, "Security."

Cc751090.rk11_08c(en-us,TechNet.10).gif

Notice in the illustration that the list of users shown in the Add Users dialog box is from the TRIKE server's bindery. This means two things:

  • All user management is done in the name space of the existing NetWare server. The NetWare server is administered by using all the same tools that are currently in place; Windows 95 has not added another namespace to administer.

  • Only valid user accounts and groups on TRIKE can be specified for shared resources on the peer server.

When the computer running Windows 95 receives a request from a user attempting to access a shared device, Windows 95 uses the NetWare server to validate the user name or group membership. If the name or group membership is validated, then Windows 95 checks to see if this validated name or group has been granted access rights to the shared resource, and then it grants or denies the connection request.

Share Names vs. NetWare Volume Names

When you share resources on a local hard disk drive using File and Printer Sharing for NetWare Networks, the share name associated with the shared directory structure becomes a volume name in the Novell designation server/volume: or the UNC designation \\server\volume.

You can use the UNC designation with net commands to connect to and disconnect from either Microsoft networking \\server\sharename shares or NetWare server/volume shares.

Windows 95 does not make this distinction between shares and volumes because all shares and volumes appear as directories (also called folders). This distinction becomes important when you use NETX or VLM and NetWare utilities. NetWare does not use or understand the concept of share names. NetWare uses volumes for drive resources and print queue names for print resources.

Therefore, for a shared drive or printer resource to be available to all the different types of clients, when a computer configured with File and Printer Sharing for NetWare Networks shares a drive resource, the share name becomes equivalent to a NetWare volume. When this same computer shares a printer resource, the share name becomes equivalent to the NetWare print queue.

DIRECTORY SHARE NAME ---->   VOLUME
PRINTER SHARE NAME ------>   PRINT QUEUE

Using Bindery Emulation for Pass-Through Security

File and Printer Sharing for NetWare Networks grants access to printers and directories on a per-user basis, which requires the name of the server to retrieve the names of users on a network. For NetWare versions 2.15 and 3.x servers, all the information for users, groups, passwords, and rights is stored in a database on the server called the bindery. NetWare version 4.x servers can appear to have a bindery using bindery emulation, which is enabled by default. Windows 95 can use the bindery of one NetWare server.

Usually, companies have multiple NetWare servers for different departments, and individual users log on to a different server by department. Problems can occur when the list of accounts differs between NetWare servers. For example, assume that AnnieP and YusufM log on to the SALES server, and KrisI is on the R&D server. AnnieP can select only one server for pass-through validation, so she must select the SALES server, because that's where this account is located for logon. She can grant access to YusufM, but not to KrisI.

Troubleshooting for Logon, Browsing, and Peer Resource Sharing

This section provides some general methods for troubleshooting.

Setup doesn't run the login script.

If the network logon server or domain controller is not validating the user account, the login script will not run. Check the following:

  • The network connection

  • The user name

  • The user password

  • The basic network functionality

  • The domain or server logon validation

If the network logon server or domain controller is validating the user account, do the following:

  • Check the network connection.

  • Verify that the login script is present in the home directory (on a Windows NT network) or in the user's mail directory (on a NetWare network).

  • Check for enough memory on the client computer.

  • Check for and remove unnecessary drivers and TSRs, and then try to log on again.

You cannot browse to find SMB-based servers in the workgroup while using Client for Microsoft Networks.

There might be no SMB-based servers in the workgroup (computers running Windows NT, LAN Manager, or File and Printer Sharing for Microsoft Networks). Windows 95 does not support browsing in a workgroup that does not contain an SMB-based server if the computer is running Client for Microsoft Networks. The following presents a solution.

To ensure there is an SMB-based server in the workgroup

  • On a computer running File and Printer Sharing for Microsoft Networks, make sure the service is configured as the master browser server.

    – Or –

    Make sure that a Windows NT server computer is a member of the workgroup (or domain).

Access to an NCP-based server changes if SAP Advertising is defined.

Where you access an NCP-based peer resource server in Network Neighborhood can change, depending on whether the server is configured for Workgroup Advertising or SAP Advertising.

  • If the computer running File and Printer Sharing for NetWare Networks is configured for Workgroup Advertising, that peer server appears as a computer in its workgroup.

  • If the File and Printer Sharing server is configured for SAP Advertising, it appears with the other Novell NetWare servers at the beginning of the list of workgroups in the Entire Network window of Network Neighborhood.

To set SAP Advertising or Workgroup Advertising, follow the procedures in "Configuring Browsing for Resource Sharing on NetWare Networks" earlier in this chapter.

User cannot connect to any network resource.

  • Check the workgroup assignment.

  • Check the domain or preferred server assignment for the protected-mode network client.

  • Check the rights for the user as defined on the domain or preferred server.

  • Check the basic network operations.

  • Use net view \\computer name to view shared resources.

  • Check for the termination of the local network cable.

Others cannot connect to my shared resources.

  • In the Network option in Control Panel, verify that the File and Print Sharing service appears in the list of installed components.

  • Make sure other users are running a common protocol.

Network Neighborhood doesn't show servers.

  • Verify that at least one active server is on the local network.

  • Verify that the proper network clients are installed and, if necessary, reinstall them.

  • Verify that the user is logged on to the particular network.

  • Check the network protocol settings.

  • Check that the IPX Frame Type is set to Auto or to the same type as the server.

  • Check the network cable termination.

You can't connect to a specific server.

  • Check error message details, if available.

  • Verify that you can connect to any server.

  • Verify that you can connect to a specific server from other computers. If you cannot connect to the specific server from other systems, it probably indicates a problem with that server or the cabling or routing to it. Also verify termination of the local network cable.

The network redirector or server is not responding.

If the computer running Windows 95 is not responding properly as a client or server, use System Monitor to view statistics about the activity of the installed network servers and redirectors. If there is no activity, remove the client or server on the Network option in Control Panel, and then reinstall and try again.

You cannot see computers running Windows 95 on the other side of a router on a NetWare network.

This might be related to the IPX network number. An IPX client (such as a computer running Client for NetWare Networks) determines its network number by sending Routing Information Protocol (RIP) requests to the nearest IPX router. If the router is configured incorrectly, all IPX clients on that network can be adversely affected. Network numbers are assigned in the server's AUTOEXEC.NCF file when the network adapter drivers are loaded and IPX is bound to the logical adapter.

Access is denied for Windows for Workgroups users trying to connect to shared resources on a computer running File and Printer Sharing for Microsoft Networks.

If the user with the Windows for Workgroups client computer is logging on to a different domain from the computer running File and Printer Sharing services (the peer server), then Windows 95 cannot confirm logon validation for access to shared resources. To solve this problem, do one of the following:

  • Upgrade the Windows for Workgroups clients to Windows 95 (recommended).

  • Set the LM Announce option to Yes in the Advanced properties for File and Printer Sharing for Microsoft Networks on the peer server.

  • Switch to share-level security on the peer server.

  • Change the logon domain for the Windows for Workgroups clients.

This problem will not occur in these cases: if the client computers are running Windows 95 or Windows NT; if the peer server uses share-level security; or if the same domains are used for the client computer's logon domain and the domain specified for pass-through validation in the peer server's Access Control properties.

A user is incorrectly denied access to resources on a peer server on a Windows NT network.

If a user is denied access to resources on a computer running File and Printer Sharing for Microsoft Networks with user-level security, you should first determine which security provider is specified for the peer server. Then, see if the client can be validated by that security provider directly without going through the peer server.

If this is successful, verify that the user is on the access control list for the shared resource on the peer server. Remove that user from the list of users and then add the name back. If this is unsuccessful, reconfigure the peer server to use another security provider that you know can validate the user.

Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft. All rights reserved.