#122019 - 2004-06-30 07:42 PM
Script not processing cross domain
|
bslocum1
Fresh Scripter
Registered: 2004-06-30
Posts: 6
|
Active Directory forest, numerous domains, AD domains and some NT4 two-way trusted domains. A workstation is member of AD domain "A". A user from domain "A" logs into WS and kix scripts process correctly. A user from NT4 domain logs into same WS and kix scripts do not process, if this same user logs into a WS which is a member of the NT4 domain, the kix script processes.
|
|
Top
|
|
|
|
|
#122021 - 2004-07-01 03:44 PM
Re: Script not processing cross domain
|
bslocum1
Fresh Scripter
Registered: 2004-06-30
Posts: 6
|
This script only processes domain common drive mappings.
I debug'd and discovered that it's not recognizing all of the group memberships, of the four groups that I was a member of (and each should've mapped a separate drive), kix only processed one. This always works fine when the workstation is a member of the NT4 domain, and also found out that some of the workstations that are part of AD domain does process the kix properly from the NT4 domain. Works on some but not most.
|
|
Top
|
|
|
|
|
#122022 - 2004-07-08 11:13 PM
Re: Script not processing cross domain
|
bslocum1
Fresh Scripter
Registered: 2004-06-30
Posts: 6
|
Anybody know any reason why the Group Membership is not enumurating properly across domains?
|
|
Top
|
|
|
|
|
#122024 - 2004-07-09 12:05 AM
Re: Script not processing cross domain
|
bslocum1
Fresh Scripter
Registered: 2004-06-30
Posts: 6
|
I just deleted the whole key, which recreated when rerunning kix. Interesting find though, in the cache, if there's identical groups in the domain that the workstation belongs versus the userid of the domain the user is logging into, kix registers the workstations domain for those groups first.
For example:
Domain "A" is a W2000 Active Directory domain. Workstation "123" is a member of "A"
Groups "Apples" "Oranges" and "Bananas" are in "A"
Domain "B" is an NT4 domain.
User "XYZ" is a member of domain "B"
Groups "Apples" "Peaches" "Pumpkin" and "Bananas" are in "B"
and user "XYZ" is a member of all of these groups.
User "XYZ" logs onto workstation "123" into domain "B". I verify that kix is being run from a DC in domain "B". In the Kix token cache it lists the following domain\group enumeration:
A\Apples
B\Peaches
B\Pumpkin
A\Bananas
As long as the cache enumerates the group to domain "B" those scripts process correctly. If kix enumerates the groups incorrectly back to domain "A", it doesn't process the scripts.
The caches should be:
B\Apples
B\Peaches
B\Pumpkin
B\Bananas
So kix somehow cross checks the workstations domain for identical groups of the users login domain, and if there's a match, it incorrectly caches it as a group from the workstation's domain.
Make sense? Is this a known issue with a solution?
Thanks.
|
|
Top
|
|
|
|
|
#122026 - 2004-07-09 03:29 PM
Re: Script not processing cross domain
|
bslocum1
Fresh Scripter
Registered: 2004-06-30
Posts: 6
|
Quote:
Are these migrated groups with SIDHistory?
Yes, as matter of fact, I thought about that last night. What does that mean, or how to fix?
Thanks again.
|
|
Top
|
|
|
|
|
#122028 - 2004-07-10 12:27 AM
Re: Script not processing cross domain
|
bslocum1
Fresh Scripter
Registered: 2004-06-30
Posts: 6
|
We will be upgrading the NT4 domain to W2000 or W2003 Active Directory shortly - do you think that will correct the issue?
If not, how do I purge SIDHistory? or Is it documented how to setup the INI file.
I did check running the scripts with version 3.63 and it does work, however, we lose some functionality because we want to bounce out of running kix scripts whenever we login to servers, since there's no @Producttype in 3.63 makes me 
Thanks again for your assistance.
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
1 registered
(Henriques)
and 2516 anonymous users online.
|
|
|
