From: TommieGannert Date: Tue, 27 Jul 2004 10:08:00 +0000 (+0000) Subject: none X-Git-Url: https://git.openafs.org/?p=openafs-wiki.git;a=commitdiff_plain;h=cec8acb77ed916d8896d5f373b436ef2c000ac83 none --- diff --git a/AFSLore/NewWindowsDocumentation.mdwn b/AFSLore/NewWindowsDocumentation.mdwn index 9d9d0f4..39ce1cb 100644 --- a/AFSLore/NewWindowsDocumentation.mdwn +++ b/AFSLore/NewWindowsDocumentation.mdwn @@ -14,3 +14,17 @@ - The [afs-install-notes.txt](http://web.mit.edu/~jaltman/Public/OpenAFS/afs-install-notes.txt) file. - The [registry.txt](http://web.mit.edu/~jaltman/Public/OpenAFS/registry.txt) file. - The [[WindowsLoopBackAdapter]] page. + +### Things That Are Not Implemented Yet + +Registry: + +- [[LogoffTokenTransfer]] +- [[LogoffTokenTransferTimeout]] +- [[NoWarnings]] +- Class +- [[DependOnGroup]] +- [[DependOnService]] +- Name +- [[ProviderPath]] +- [[LogonOptions]] (it is available in UI and HS mode should not be used) diff --git a/AFSLore/WindowsConfigurationReferenceGuide.mdwn b/AFSLore/WindowsConfigurationReferenceGuide.mdwn index 1740c18..af12a8a 100644 --- a/AFSLore/WindowsConfigurationReferenceGuide.mdwn +++ b/AFSLore/WindowsConfigurationReferenceGuide.mdwn @@ -38,6 +38,17 @@
  • Tweaking RPC Traffic
  • Enabling Debug Trace Events
  • Restricting the Number of Utilized CPUs
    • +
  • Moving the CellServDB File
    • +
  • Moving the Integrated Logon Support File
    • +
  • Allowing More Time For the Service To Start
    • +
  • Running a Logon Script
    • +
  • Integrated Logon Usage
    • +
  • Integrated Logon Silence
    • + + +
  • Per Domain Options
  • Windows Registry Keys of OpenAFS
    • @@ -243,6 +254,71 @@ Normally, the `TraceOption` (type DWORD) in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentCo For most part, the [[OpenAFS]] client can use as many processors as available. It has, however, showed that Hyperthreaded Pentium 4 systems can cause the [[OpenAFS]] service to crash. If you have such a system, you should set `MaxCPUs` (type DWORD) (in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters`) to 1. The default is undefined, and means all processors may be used. +### Moving the [[CellServDB]] File + +The registry setting `CellServDBDir` (type string) in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider` specifies the base directory of the [[CellServDB]] file. Note that the filename `CellServDB` is appended to this path. The default is `C:\Program Files\OpenAFS\Client`. + +### Moving the Integrated Logon Support File + +[[OpenAFS]] installs very few files outside its directory in `Program Files`. The Integrated Logon DLL, `afslogon.dll`, is an exception. It is installed in `%WINDIR%\SYSTEM32` by default. + +To change this location you must update the registry value `AuthentProviderPath` (type string) in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider` to point to the new location. + +### Allowing More Time For the Service To Start + +When the AFS Client Service starts, it has to read files, the registry, DNS and connect to servers. All of this may take quite some time. On slow computers, the default retry policy can be too short. + +In this case, the `LoginRetryInterval` (type DWORD) and `LoginSleepInterval` (type DWORD) values in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider` can be increased. If the [[OpenAFS]] client service has not started yet, the network provider will wait for a maximum of `LoginRetryInterval` seconds while retrying every `LoginSleepInterval` seconds to check if the service is up. This setting is domain-specific, see below. + +### Running a Logon Script + +You may set `LogonScript` (type string or expandable string) of `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider` to any runnable script or program. Default is to not run any program. This setting is also domain-specific, see below. + +### Integrated Logon Usage + +Utilization of the Integrated Logon feature can be set on a per-domain basis. The value is called `LogonOption` (type DWORD) and can be found in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider`. Setting this to zero disables Integrated Logon, a one enables it. Default is enabled. If you set this to 2, you enable the [[OpenAFS]] High Security mode, and setting it to 3 enables both High Security Mode and Integrated Logon. + +High Security mode is a deprecated techinque to let several users logon to the same computer at once. Since [[OpenAFS]] now supports authenticated SMB connections, there is really no need for this mode. If you still want to use this mode, you should disable SMB Authentication. See "Tweaking the SMB Connections" on this matter. + +### Integrated Logon Silence + +In the Client Configuration, you may choose whether the Intergrated Logon should warn when you cannot logon, or if it should not. Since this setting is domain-specific, here is the background. The `FailLoginsSilently` (type DWORD) in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider` can be set to 1 to ignore any failures. Default is to warn (i.e. a value of zero). + +## Per Domain Options + +[[OpenAFS]] for Windows is now able to support domain-specific settings. Four of the settings in the previous section can be adjusted on a domain basis: + +- Allowing More Time For the Service To Start +- Running a Logon Script +- Integrated Logon Usage +- Integrated Logon Silence + +This is a new feature of [[OpenAFS]] 1.3.6, and is not yet supported by the configuration user interface. While being a usable feature, we choose to document, so that you can still use it. A new configuration interface is hopefully on its way. + +All values that can be domain-specific are located under `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider`. Domains which want to have specific settings can create the subkey Domain\\_domain_\\ and store the values there. The domain name is the logon domain, as specified in the Windows Login screen. A special domain, called `LOCALHOST`, is a placeholder for the local computer. Any other Active Directory or Kerberos realm should use it's realm name for the key. + +### Resolution of Domain Specific Values + +As a consequence of this scheme, there must also be set rules for resolving which value to use. Let us use the following example in the discussion: + + ...\NetworkProvider\ LogonOption = 1 + Domain\ LogonOption = 0 + OPENAFS.ORG\ LogonOption = 1 + MIT.EDU\ + LOCALHOST\ LogonOption = 0 + +If the specific domain key does not exist, then the `Domain` key will be ignored. All the configuration information in this case will come from the standard `NetworkProvider` key. + +If the specific domain key exists, then the value will be looked up in the specific domain key, domains key and the NP key successively until the value is found. The first instance of the value found this way will be the effective for the login session. If no such instance can be found, the default will be used. To re-iterate, a value in a more specific key supercedes a value in a less specific key. + +Back to our example. Logging in to domain `OPENAFS.ORG` clearly enables the Integrated Logon. Logging on the local computer disables it. Logging in to `MIT.EDU` will also disable Integrated Logon, because the domain key exists, but misses a value. This resolves to using the value of `Domain\LogonOption`. However, logging in to `KTH.SE` would enable Integrated Logon. It is not listed as a domain, and thus the `NetworkProvider\LogonOption` is used. In order to retain backward-compatibility, there are two exceptions to this resolution order. + +### Exceptions To the Resolution Rule + +Historically, the 'FailLoginsSilently' value was in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters` key and not in the `NetworkProvider` key. Therefore, for backwards compatibility, the value in the `Parameters` key will supercede all instances of this value in other keys. In the absence of this value in the `Parameters` key, normal scope rules apply. + +The second exception is for the `LogonScript` value. If a `LogonScript` is not specified in the specific domain key nor in the `Domain` key, the value in the `NetworkProvider` key will only be checked if the effective `LogonOptions` specify a high security integrated login. If a logon script is specified in the specific domain key or the domains key, it will be used regardless of the high security setting. Please be aware of this when setting this value. + ## Windows Registry Keys of [[OpenAFS]] During the preparation of this release of [[OpenAFS]], a lot of changes have been made to the way configuration is stored. The work is still not finished, why the list of registry keys currently used can be found [here](http://web.mit.edu/~jaltman/Public/OpenAFS/registry.txt). diff --git a/AFSLore/WindowsTroubleshootingGuide.mdwn b/AFSLore/WindowsTroubleshootingGuide.mdwn index d6b967b..76645d7 100644 --- a/AFSLore/WindowsTroubleshootingGuide.mdwn +++ b/AFSLore/WindowsTroubleshootingGuide.mdwn @@ -4,17 +4,30 @@