News:

If you need help with OS/2 visit http://forum.os2world.com

Main Menu
Menu

Show posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Show posts Menu

Messages - nedcheese

#1
Sure, glad I could help.
#2
For once in my life, I will give back to the Googilites....

For years this has been an issue for our company, trying to get an OS/2 machine to access a share in a Windows 2003/2008 domain........don't ask why, it's complex, but needed.

I've looked through all the forums, tried all the reccomendations dating back to 2004.......me and my collegue finally figures it out........so here it is:

Summary:   The OS/2 machines cannot access Windows shares due to limitations in security authentication.  Due to this restriction, the machines are limited in the type of security authentication used to access Windows shares.  OS/2 only uses "LM" authentication, and with the release of Windows Server 2003 and 2008, two GPO settings need to be changed on the Default Domain Policy, the Default Domain Controller Policy, or both.  Also there is a small change made on the Datacard OS/2 machines.  Below will have the steps in more detail.

Windows Server GPO settings:
Either in the Default Domain Policy or the Default Domain Controller Policy edit the following:
1.   Computer Configuration/Windows Settings/Security Settings/Local Policies/Security Options
a.   Network Security: Do not store LAN Manager hash value on next password change
i.   Change to Disabled
b.   Network Security: LAN Manager authentication level
i.   Change to "Send LM & NTLM – use NTLMv2 session security if negotiated"
2.   Make sure to do "gpupdate /force" on the domain controller doing the authentication
3.   After the Policies refresh, go into Active Directory Users and Computers, and reset the User Account that the OS/2 machines are using to access Windows shares.
4.   Once that is done, the password will be reset and store the LAN Manager hash, which is what's needed because the OS/2 machines can only send the hash.
5.   When the shares are verified for access from the OS/2 machines, go back to the GPO settings in step 1-a, and change it back to "enabled" so all passwords are not stored as a LM hash value.
OS/2 settings:
1.   Open up the "IBMLAN.ini" file and put in the correct domain it will be trying to authenticate to: