Page 1 of 1 1
Topic Options
#117181 - 2004-04-01 08:08 PM InGroup | Enumgroup with NT BDC in AD Mixed-Mode
morphus Offline
Fresh Scripter

Registered: 2004-03-25
Posts: 20
Hello,

Does anyone know why when a user running XP get authentified by a NT4 BDC in a AD Mixed Mode domain the InGroup() always fail?

If I use Enumgroup() to enumerate all group he is member of it's also empty.

However if the user get authentified by a AD Controller the group membership is filled properly...

Thank

ML

Top
#117182 - 2004-04-01 08:21 PM Re: InGroup | Enumgroup with NT BDC in AD Mixed-Mode
Co Offline
MM club member
***

Registered: 2000-11-20
Posts: 1342
Loc: NL
Is your BDC in sync with the PDC??
_________________________
Co


Top
#117183 - 2004-04-01 10:27 PM Re: InGroup | Enumgroup with NT BDC in AD Mixed-Mode
morphus Offline
Fresh Scripter

Registered: 2004-03-25
Posts: 20
Yes it is...

I even force a sync.

However it doubt it can really be a sync issue, since it doesn't list even 1 groups, and the users always been member of Domain Users.

Thank

ML

Top
#117184 - 2004-04-02 12:43 AM Re: InGroup | Enumgroup with NT BDC in AD Mixed-Mode
Co Offline
MM club member
***

Registered: 2000-11-20
Posts: 1342
Loc: NL
Is it just one XP pc or do you have this problem at all your XP pc's?
What other systems do you have in your domain and do they have the same problems?
Are there any other issues you have with the Windows NT BDC's?
_________________________
Co


Top
#117185 - 2004-04-02 03:03 PM Re: InGroup | Enumgroup with NT BDC in AD Mixed-Mode
morphus Offline
Fresh Scripter

Registered: 2004-03-25
Posts: 20
Many XP and 98 pc have the problem, and that's the only problem the BDC have.

BTW there I have 5 NT bdc and they all have the same problem. AD don't.

ML

Top
#117186 - 2004-04-03 11:12 AM Re: InGroup | Enumgroup with NT BDC in AD Mixed-Mode
Co Offline
MM club member
***

Registered: 2000-11-20
Posts: 1342
Loc: NL
When this problem occure does the user have the same permissions when he was validated by a Windows 2000 DC?

Are the master roles OK?
Is WINS (static mappings) OK?
_________________________
Co


Top
#117187 - 2004-04-03 12:49 PM Re: InGroup | Enumgroup with NT BDC in AD Mixed-Mode
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Please post the code you're using and which version of KiXtart you're using.

If you have to, run a BATCH file that has a PAUSE in it to hold the window open so you can confirm if the client even sees the logon process.

Top
#117188 - 2004-04-03 03:57 PM Re: InGroup | Enumgroup with NT BDC in AD Mixed-Mode
morphus Offline
Fresh Scripter

Registered: 2004-03-25
Posts: 20
Everything DC wise are properly configure.
The user have the same role, if I shutdown all NT4 BDC and force authentication to AD it work
ML

Top
#117189 - 2004-04-03 03:59 PM Re: InGroup | Enumgroup with NT BDC in AD Mixed-Mode
morphus Offline
Fresh Scripter

Registered: 2004-03-25
Posts: 20
The login script execute since all the other non group dependent function execute properly.

IF INGROUP("GROUPNAME")
? "User is in group..."
ENDIF

Kix V4.22

Thank

ML

Top
#117190 - 2004-04-03 04:30 PM Re: InGroup | Enumgroup with NT BDC in AD Mixed-Mode
Les Offline
KiX Master
*****

Registered: 2001-06-11
Posts: 12734
Loc: fortfrances.on.ca
I doubt this is a KiX problem but you could test with VBS to be sure.
Code:
Set objUser = GetObject _

("LDAP://cn=myerken,ou=management,dc=fabrikam,dc=com")

WScript.Echo "Distinguished Name: " & VbCrLf & _
objUser.Get("distinguishedName")

objMemberOf = objUser.GetEx("MemberOf")
WScript.Echo VbCrLf & "The user is a member of:"
For Each Group in objMemberOf
Wscript.echo Group
Next


{edit} Brain fart alert! The VBS code would most likely not query from the NT4 DC. You might want to test with KiX 3.63 to see what it returns.


Edited by Les (2004-04-03 04:35 PM)
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.

Top
#117191 - 2004-04-03 09:10 PM Re: InGroup | Enumgroup with NT BDC in AD Mixed-Mode
Co Offline
MM club member
***

Registered: 2000-11-20
Posts: 1342
Loc: NL
Quote:

The user have the same role




Is the user validation correct? Can they do the same like when they are validated by a W2K DC. You can test this by changing a test user's permissions/rights.


With role I meant i.a. the PDC Emulator:

Quote:

In a Windows 2000 domain, the PDC emulator role holder retains the following functions:
Password changes performed by other DCs in the domain are replicated preferentially to the PDC emulator.
Authentication failures that occur at a given DC in a domain because of an incorrect password are forwarded to the PDC emulator before a bad password failure message is reported to the user.
Account lockout is processed on the PDC emulator.
The PDC emulator performs all of the functionality that a Microsoft Windows NT 4.0 Server-based PDC or earlier PDC performs for Windows NT 4.0-based or earlier clients.


Source: http://support.microsoft.com/default.aspx?scid=kb;en-us;197132&Product=win2000
_________________________
Co


Top
#117192 - 2004-04-04 12:19 AM Re: InGroup | Enumgroup with NT BDC in AD Mixed-Mode
morphus Offline
Fresh Scripter

Registered: 2004-03-25
Posts: 20
Yes user permission work either when authenticate by NT or AD.

The 5 masters roles are fine...

ML

Top
Page 1 of 1 1


Moderator:  Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 2220 anonymous users online.
Newest Members
Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users

Generated in 0.087 seconds in which 0.046 seconds were spent on a total of 12 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org