Windows NT Version 5.0

Interim Developer's Release 2

The following sections of this document contain vital information pertaining to this release.  Consult these notes before installing this release. 

When attempting to setup this Interim Developer's Release of Windows NT 5.0 using the boot floppies, the user will receive an error and setup will not continue.   The creation and use of the three boot floppies, regardless of how they are created (WINNT, WINNT32 or from them Bootdisk directory), does not work in this release of Windows NT 5.0 Workstation or Server.

To setup Windows NT 5.0, launch setup using WINNT.EXE or WINNT32.EXE from an existing OS and do not choose to create the boot floppies.

Dell Precision 410 Wks SCSI

This SCSI device contains the Ultra II chip and is not yet supported on this interim release.  This will be supported in a future release.

Compaq Computers with Symbios 810 SCSI Controllers

If your Compaq computer (such as the Compaq Proliant 2500) uses the cpq32fs2.sys driver which supports the built-in Symbios 810 SCSI controller on Windows NT 4.0, you will need to disable it before performing an upgrade to this interim release.  For example:

• remove cpq32fs2.sys from the drive, or
• copy null.sys over cpq32fs2.sys

The Symbios 810 will be correctly detected by Windows NT Setup (symc810.sys) and the SCSI device will function correctly.

Slave CD-ROM drive not detected on Compaq Proliant 1600 machines

1. Jumper the CD-ROM drive as master.
2. Replace the ATAPI.SYS on the disk with an updated version on http://ntbeta.microsoft.com/support/idr2.asp.   If setup says it cannot find the CD-ROM drive, then copy the ATAPI.SYS available on http://ntbeta.microsoft.com/support/idr2.asp to the \$WIN_NT$.~BT\ and \$WIN_NT$.~LS\I386 directories, and restart setup.

Bug Check (Inaccessible_boot_device) on EISA systems

We do not recommend installing this Interim Developers Release on EISA systems. If your system boots from an EISA SCSI card and bugchecks (Inaccessible _boot_ device), you can get an updated version of the kernel and SCSIPORT.SYS from http://ntbeta.microsoft.com/support/idr2.asp to resolve the problem.  These updated files may also resolve issues with EISA netcards not starting properly.  Follow the directions below to update these files.

1. Download the new kernel and SCSIPORT.SYS from http://ntbeta.microsoft.com/support/idr2.asp.
2. Place the new kernel in the %systemroot%\SYSTEM32 directory.
3. Place the new SCSIPORT.SYS in the %systemroot%\SYSTEM32\DRIVERS directory.
4. Reboot the system.

Gateway Services for NetWare

1. Right click on the folder from Explorer, or My Computer.
2. Choose Sharing
3. Click the radio button next to "shared as" to share.
4. Click OK.

Disable Diskperf Before Upgrading

You must first disable Diskperf before upgrading to this Interim Developer's Release.   Failure to do so will result in a bluescreen and Setup will fail.  Diskperf is not supported on this interim release, but will be fixed in a future release.

Conversion of NTFS to NTFS v5

Conversion of NTFS to NTFS v5 will take place on any new installation or upgrade of NT 5.0. This will upgrade any mounted NTFS volume to NTFS v5. In dual boot situations where NT 4.0 pre SP3 is installed, user must upgrade to NT 4.0 Sp3 or SP4 before attempting the NT 5.0 installation or the NTFS volume will no longer be accessible to the NT 4.0 installation. In the case of NT 4.0 SP3, NT 5.0 setup will copy over NTFS40.sys to the NT 4.0 SP3’s %systemroot%\system32\drivers subdirectory as NTFS.sys. This will allow the NT 4.0 installation to access NTFS v5 formatted volumes. If the NT 4.0 system is running NT 4.0 Sp4, the NTFS.sys installed is capable of mounting NT 5.0 formatted NTFS volumes. In the case of NT 3.51, there will not be any backwards compatibility provided.

Conversion of FAT to NTFS v5

Note:  The conversion of FAT to NTFS v5 is not implemented in this Interim Developer's Release.  The following information will be implemented in Beta 2.

When performing an upgrade from a previous version of Windows NT 5.0 to this Interim Developer's Release, under certain conditions Neomagic or Chips and Technology video drivers may no longer work properly.  The workaround is as follows:

1. From Device Manager, double click on Devices.
2. Double click on Display Adapters.
3. If the display key does not exist, click on "Continue".
4. Select the Neomagic or C&T driver.
5. Right click and select "Uninstall".
6. Repeat these steps if multiple Neomagic or C&T drivers are listed in the Display Adapters field.

After the appropriate drivers have been removed:

1.     Select the Hardware Wizard in the Control Panel.
2.     Click "Next".
3.     Select "Add New Hardware" and click "Next".
4.     Select "Display Adapters" and click "Next".
5.     Select the driver you want to install.  Choose "Have Disk..." if you want to obtain a driver from another location.
6.     Complete the installation and reboot the computer.

This Interim Developer's Release does not support display adapters utilizing the Riva 128 chipsets.  If you are using a display adapter with this chipset on Windows NT 4.0, you will need to perform the following before performing an upgrade to this release.  This workaround is not necessary if you are performing a fresh installation.

1.     Open the Display Applet by right clicking on the desktop.
2.     Select Properties.
3.     Click on the "Settings" tab.
4.     Select "Display Type".
5.     Click "Change".
6.     In the "Change Display" dialog, select "(Standard display types)" under "Manufacturer".
7.     In "Display", select "VGA compatible display adapter".
8.     Click "OK".
9.     Complete the installation of the standard VGA driver from the Windows NT 4.0 compact disc. 

You can now perform an upgrade installation from Windows NT 4.0 to this release in VGA mode.

The ability to create an Emergency Repair Disk (ERD) has been moved to NT Backup under the Tools menu, "Create an Emergency Repair Disk." The ERD no longer contains a backup of the registry, nor can the registry be repaired using the ERD process. In order to backup the registry you can use NT Backup and with the Backup Wizard and select "Only backup the registry". The registry can also be backed up and restored with the Automatic System Recovery (ASR) process. An ASR Disaster Recovery set can be created with NT Backup also under the tools menu, "Disaster Recovery Preparation." In the unlikely event your system has a complete failure of the system drive or operating system, the Disaster Recovery set can recover the entire system. The recovery process is started during textmode setup with the "To recover a destroyed system, or system disk, press D" option, you will have to insert the Disaster Recovery set Disk created from NT Backup previously. This process will recover your system disk and boot environment only, any user data or applications stored on other volumes will have to be restored separately.

For this release, you can join a workgroup or domain and change your computer name through the Control Panel, System, Network ID tab.  Or you can right click on My Computer and select Properties or open the System applet in the Control Panel.  Additionally, you can choose "Network Identification" from the Connections menu of the Network Connections folder.  When you join a domain that contains your previously created machine account, you will be prompted to provide a username and password. 

DNS/DHCP

DNS configurations that host registrations under the DHCP assigned domain name will fail on this interim release.  To workaround this problem, override the DHCP assigned domain name with the DNS domain name:

• Select Start, Control Panel, Open Network Connections.
• Select the Local Area Connection, Properties.
• Open the Properties for Internet Protocol (TCP/IP), Advanced, DNS properties.
• In the DNS domain edit box, type in the DNS name of the domain the domain controller was promoted for.

This will be fixed in a future release.

DNS name resolution problems may exist when the system is configured to use non-Microsoft DNS servers. As a result of a problem in the DNS resolver code, response data may cause certain applications to fail to obtain an address for the name queried.   This is because the Name Server records in the response packet, reference to one or more DNS servers that may be on the same network or sub-network that the computer is on.   A feature to prioritize DNS records based on machine's local IP address or addresses and subnet mask(s) causes the failure.  The workaround is as follows:

Disable the DNS record prioritization to leave response data in the format it is received from the DNS server.  This can be done by creating/editing the Registry key value:

Key:  \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Value:   PrioritizeRecordData (REG_DWORD) 0x0

This Interim Developer's Release contains a system volume hosted on all Windows NT version 5.0 domain controllers to store well known scripts and part of the group policy objects for both the current domain as well as the enterprise.

During fresh installations, the system volume is automatically created on a local volume by dcpromo.exe. 

Because the system volume is accessed as \\domain-name\sysvol, it is required that all Windows NT 5.0 domain controllers host a system volume.

The system volume replicates on the same schedule as the Active Directory. As such, you may not notice files being replicated to or from your newly created system volume until two replication periods have elapsed (typically ten minutes). This is because the first replication period is used to update the configuration of other system volumes so that they are aware of the newly created system volume.

Sysvol requires NTFS version 5.0. You can verify the format version of any drive using chkntfs.exe, for example "chkntfs c:". 

Directory Service

You cannot install the Directory Service on a dynamic drive.  It can only be installed on basic drives.

Directory Service Migration

The Directory Service Migration tool (off-line migration from NetWare bindery and NDS resources) is an optional installation. This component was shipped in Windows NT 5.0 Beta.   If you installed this tool using the previous Beta release, complete the steps below to ensure the updated version is installed.  This process will overwrite your existing Directory Service Migration data files. 

Run From a Domain Controller

The Directory Service Migration tool performs optimally when run from a domain controller. This is due to less information hitting the network during the configuration (export) to Active Directory.  Running this tool from a workstation is not supported in this release.

Directory Service Migration Tool

This is an optional installation. Complete the steps below to install this component.

1. From Control Panel, select Add/Remove Programs- v2. Do not select the Add/Remove Programs applet that does not indicate "v2".
2. Select "Remove or Modify an existing program" and select Next.
3. Select "Windows NT Optional Components" and select Modify.
4. Select "Networking Options" and select Show Subcomponents.
5. Select "Directory Service Migration Tool" and select OK.
6. Select Next, and follow the prompts.

If you are prompted for Remote Access Service dial-up properties, provide the details and close.  This a known problem with the installer which will be fixed in a future release. There is no dial capability associated with the Directory Service Migration tool.

Running the Tool

After this component is installed, from Start, Program, Administrative tools, select "Directory Service Manager Tool."

Documentation

Complete documentation is provided in this release. You can review documentation from both the "Assistant" as well as from the Help menu directly.

Usage Tips

• Create a project.  This creates an off-line holder for the Directory information.
• From that project, create a view from NetWare to populate the off-line holder with directory information.
• From this view, modify the off-line data to match your migration needs (ie: rename users, move branches).
• Configure the view to Active Directory to populate Active Directory with the directory information in the off-line view.
• Once user objects exist in Active Directory, you can optionally perform a file migration.

Distributed File System

Creating New Dfs Roots

After creating or adding new child nodes for Fault Tolerant roots, some users may not see changes immediately. This is a result of the replication schedule on the Active Directory between domain controllers.   After all domain controllers have replicated the Dfs topology, all users in the enterprise will view the Fault Tolerant Dfs root consistently.

Perform the same steps listed above for a machine based Dfs without rebooting.

Run the Directory Management MMC tool:

Start, Programs, Administrative Tools, Directory Management

Expand the domain name

Select the Fault-tolerant Dfs name to be removed.

Select Action, Delete to remove the FtDfs from the Ds.

Reboot the machine(s) in the fault-tolerant Dfs.

Setting Up Multiple Site Replication

To configure replication between multiple sites, the administrator must perform the following tasks from the Active Directory Sites and Services Manager snap-in located from the Start menu, Programs, Administrative Tools menu "Sites Topology". 

Install two or more domain controllers into the domain as replicas, or parent and child.  By default they are installed into FirstSite unless subnet objects have been created for each subnet on which a domain controller will reside, and the subnet objects are associated to sites created in Step 3 below.

In the example of two domain controllers to create two sites:

1. In FirstSite\Servers[serverA]\NTDS Settings create a second connection from the NTDS Settings container of server B
2. In FirstSite\Servers\[serverB]\NTDS Settings create a second connection from the NTDS Settings container of server A
3. Right click on the Sites node to create the SecondSite (or determined name)
4. Right click on one of the servers in FirstSite, and select Move...
5. Click [Browse...]
6. Select Sites\SecondSite\Servers
7. OK.
8. OK.

After each site has been seeded, a subnet object for the location can be created and associated to the site.  Newly promoted domain controllers will be recognized in the site to which their subnet object is associated.  For site policies to operate properly, you must create subnets and associate them to the sites.

This can be performed from one computer if the order is carefully preserved.  If Step 4 is completed before Steps 1 and 2, then Steps 1 and 2 must be performed at the location of each replicating domain controller.

Domain Controllers

Creating Domain Controllers

When creating replica or child domain controllers, the timezone settings for each must be identical.  The system clock between both computers must also be within five minutes of each other.  Failure to do so will cause credential failures and will not successfully create a domain controller.

Demoting Child Domain Controllers may fail

The demotion of a child domain in an arbitrarily deep domain tree structure will fail.

This Interim Developer's Release has support for demotion of domain controllers back to standalone servers. Users are now able to demote a root DC, a child DC, or a replica DC to a member server. In any domain, however, the last domain controller may only be demoted if that domain has no children of its own. The demotion will succeed in simple trees that are no deeper than one level without any problems. However, in trees that contain grandchildren, great-grandchildren, or deeper domains underneath the root domain controller, any attempt to demote a DC deeper than the first child domain of the root domain will fail with endless prompting for credentials.

To work around the problem, the following steps are required:

1. Before beginning demotion of the grandchild domain controller, add the Administrator account from the root domain of the domain tree to the administrators group on the immediate parent domain controller of the child domain which is to be demoted.
2. When the popup dialog prompting for credentials appears during DCPromo demotion on the child domain controller, supply the credentials for the Administrator account from the root domain of the domain tree. This account should be the same one you added in the previous step to the parent's Administrators group.
3. Do not supply the DNS name of the domain in the domain edit field on the credentials popup page, even though this is the default choice. Use the NETBIOS domain name instead. Unless otherwise changed, the NETBIOS domain name is the same as the leftmost portion of the DNS domain name. For example, the DNS domain name "mydomain.myNT5dom.com" would have a NETBIOS name of "mydomain" if it had not been changed during the original DCPromo operation.

After following the steps above, the demotions should proceed through to completion successfully.

Configuring Domain Controllers for Inter-Site Replication

The certificate request wizard should succeed, and you should receive a certificate.

PWDUMP Utility

Protection against the PWDUMP utility is not supported in this release.  This will be fixed in a future release.

Network Monitor

Windows NT Workstation includes the Network Monitor protocol.  Windows NT Server includes this protocol and Network Monitor Tools.

If you perform an upgrade to this release from Windows NT 4.0 or Windows NT 5.0 Beta, first remove all Network Monitor components.  Failure to remove Network Monitor before upgrading will result in an unknown state.

After the Windows NT upgrade has successfully completed, you can then install the Network Monitor Tools and Network Monitor Agent v2 driver.  After it is installed, Network Monitor will be accessible from the Start, Programs, Network Analysis, Network Monitor menu.

Note

If you perform an upgrade to this release before removing these components, you will need to remove the Network Monitor components and Network Monitor Agent v2 driver and reinstall them.

Adding Network Monitor Components

Removing Network Monitor Components

Adding the Network Monitor Agent V2 Driver

Removing the Network Monitor Agent V2 Driver

Right click on the Connection icon\Properties\Networking tab\select Network Monitor Agent v2 Driver \click <Remove>\click <OK>\click <OK>.

SNMP Agent

In this release, the SNMP Agent will fail unexpectedly when attempting to browse the 1.3.6.1.2.1. portion of the Management Information Base (MIB).  The service will stop processing requests until it is restarted.  To workaround this problem:

Run Regedt32

HKEY_LOCAL_MACHINE\Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters\TrapPollTimeMilliSecs

Set the registry variable to FFFFFFFF

Known Issue

The SNMP Agent will hang when attempting to set the following Object Identifier (OID):

            1.3.6.1.2.1.4.24.2.1.2.127.0.0.0.2.0.127.0.0.1

Active Directory

Active Directory Installation

Upgrading a Windows NT 4.0 Backup Domain Controller to a Windows NT 5.0 Replica

When the Active Directory Installation Wizard in Windows NT Setup prompts you to select either "Leave as a member server" or "Make a domain controller", select "Leave as a member server".  After the installation wizard completes the process, leave the Domain and join a Workgroup through the Network ID tab of the System applet.  Reboot the system.  Select Start, Run and type Dcpromo.exe to install a replica domain controller. 

If you select to install "Make a domain controller", the following error message will occur:

Active Directory Installation Failed

The security account manager (SAM) or local security authority (LSA) server was in the wrong state to perform the security operation.

Cancel the Domain Controller wizard (Dcpromo.exe) and restart it.  Select Start, Run and type Dcpromo.exe and follow the above instructions.

If the Domain Controller wizard continues to appear after each reboot of the system, edit the following entry in the Registry.  Select Start, Run, Regedt32.exe.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Winlogon\Userinit

remove "dcpromo /upgrade"

Active Directory Manager

Active Directory Manager is the Microsoft Management Console snap-in for administering the Active Directory. 

New Features of Active Directory

Mode of Operation

Active Directory Manager supports two modes of operation selected from the snap-in View menu.  In Normal mode, only standard objects are displayed as containers, Organizational Units, Groups, Contacts, Users, and Computers.  These items display a reduced set of properties.

In Advanced mode, additional containers such as Lost and Found, and System can be viewed.  In this mode, additional properties are available such as security and certificate mappings.

Viewing Computers, Users and Groups as Containers

Objects such as Users, Groups and Computers are viewed as leaf nodes in the directory.   These objects may also be viewed as containers.  For example, printers are published in a Computer container.  To view objects such as Printers and IPSec Settings, you can view Computers, Users and Groups as containers.

Filters

A filter can be applied to display certain types of leaf objects.  This allows administrators to selectively view only the object classes that are included in the filter.  In this release, there is no visual indication the filter has been applied.

Multiple Select

You can now select multiple objects in the Results pane.  The operations applicable for this selection are Enable/Disable User Accounts, Send Mail (assumes a mail client is installed and the users' email address attribute is present), Delete and Move.

Groups

Group Type is new terminology that defines whether a group may be used as a security principal (can be given permissions to access resources) and as a mail distribution list, or whether the group is strictly a mail distribution list.

Group Scope defines whether the group is Enterprise (Universal group), Domain (Domain Global, similar to Windows NT Global Groups) or Resource (Domain Local, similar to Windows NT Local Groups) wide. Universal Groups and nesting of any group type is only permissible when the domain is running in Native Mode.  In Native Mode, the domain can not contain downlevel Windows NT 3.51 or 4.0 domain controllers.

Security

The Active Directory provides a rich security model.  To simplify the delegation of authority on objects in the Active Directory to specific users and groups, the "Delegation Wizard" will step administrators through a series of tasks that easily enable them to grant management permissions to users.

User Principal Name

The User Principal Name (UPN) is the User Logon Name when accessing the network from Windows NT 5.0 Workstations.  An example of a UPN is fredn@antipodes.com.  In this release, the only available UPN suffix (for example, antipodes.com) is the domain tree name.

Known Active Directory Issues

Logon Locally Right assigned to IUSR_<ComputerName), IWAM_<ComputerName>
Batch Logon Right assigned to MTS_Admin, IUSR_<ComputerName>, IWAM_<ComputerName>

2. Or choose not install IIS/MTS servers during NT 5.0 server install, then after dcpromo runs to promote a DC, install IIS/MTS from add/remove programs in control for optional components.

The "Delegate Control…" wizard in the Active Directory Service Manager tool does not correctly grant permissions on DS objects. In order to properly grant permissions on DS objects, use the Security property page of the DS object. This property page is accessible when "Advanced Features" is turned on in Active Directory Service Manager.

The Results Pane is not automatically updated after performing Move operations, deleting containers or Organization Units.  Select "Refresh" or F5.

"Sheets up.  Cannot delete it!" error message.  This may occur when two people are administering the same domain simultaneously or if the user has displayed the properties of an object and then attempt to delete it from the snap-in without first closing the properly sheet.

Close any open property pages.  Retry the operation.  If there are no open pages, restart the Active Directory Manager.

Failure to modify properties for contact objects with LDAP_CONSTRAINT-VIOLATION.   The information contained in the "Address" page for contact objects cannot be modified.  Saving information on other pages for contacts will fail in the same way if the "Address" page was previously selected.  Reopen the property pages for the contact, and make the modifications directly to the page on which you change the information (excluding "Address").

Logon hours set incorrectly for user accounts.  Use User Manager to set the logon hours.

User account expiration date is set incorrectly.  Use User Manager to set expiration date.

User's "Member Of" page fails to modify membership if attempting to add the user to a group in another domain to which the administrator does not have write permissions.  Ensure the administrator has sufficient privileges in this domain.

Internet Protocol Security - IPSec

Not all systems are IPSec enabled

If your NT5.0 IPSec-enabled system needs to talk also to non-IPSec systems, you can allow a "fail-to-clear" negotiation behavior on a per rule basis. Since the negotiation behavior is per rule, it means that only traffic that matches that filter associated with the rule will be negotiated according to the negotiation policy, not necessarily all traffic. The predefined security policy called "Secure Initiator" has this behavior configured because it uses the "Secure Initiator" negotiation policy. Examine the "Secure Initiator" policy, then the "Secure Initiator" negotiation policy to see that the check box labeled "Allow unsecured communication with non-IPSec aware hosts" is checked. When an NT5.0 negotiation request receives no reply for approximately 4 seconds, a "soft association" will be established to allow traffic to be sent and received in clear-text with destinations matching the corresponding filter. This soft security association will last for 8 hours as long as traffic is being exchanged within 8 minutes. If no traffic is exchanged for 8 minutes, the soft association will expire – meaning another packet will drive a new negotiation attempt. At the 8 hour interval soft associations will be forced to renew – meaning another negotiation with the destination is attempted. Use the IPSec monitor to view active associations. If the Negotiation Policy column shows the word "None", then you have a soft association between those source and destination addresses.

1. Use IPSec to communicate securely to your DNS server. This means you would run one of your DNS servers on a Windows NT5.0 IPSec-enabled host and have corresponding IPSec policy to permit clients to successfully negotiate an IPSec security association with it when doing DNS lookups.
2. Exempt DNS traffic from IPSec on the client by creating a new rule to filter just DNS traffic in the client’s IPSec policy. This new rule has a filter list with a single mirrored filter specification of the destination IP address of the DNS server. The negotiation policy for this rule has the radio button enabled that says "Don’t allow secure communication". When DNS queries are generated going to the DNS server destination IP address, this negotiation policy will prevent IPSec from processing those packets.
3. You could specify a filter only for the end machine to which you are trying to communicate. Edit the policy, edit the filter list, and make sure that the source is "My IP Address" and the destination is the particular machine you are trying to communicate to. Make sure this filter is mirrored to properly handle reply packets from that destination

Using a DNS name as source or destination in filter specification

When you type in a DNS name in the box for DNS name as a source or destination address, the UI attempts to resolve that DNS name to an IP address for you when you click on OK.

When the policy is retrieved by the computer, all DNS names in the filters are resolved to their current IP addresses. The new address is the one used. If the DNS lookup fails, then the IP address that is used is the one that was "cached" in the filter specification at the time that the filter was created. If not IP address could be cached, then the filter is discarded.

Generally filters should apply for both directions

For IPSec to work between any two systems, you will need an inbound and outbound filter. For example, to use IPSEC from A to B , host A needs to have filter A -> B and another filter B->A. Host B also needs equivalent filters, source B -> destination A, and source A to destination B. The reverse filter can easily be done using the checkbox on the filter specification dialog "Mirrored. With this checkbox checked, a "Yes" will appear in the mirrored column in the filter specification list. The easiest filter specification to use is from "Me" to "Any IP address" with the checkbox marked

Ping <ip address> does a DNS lookup

When you have enabled a pre-canned IPSec policy on two machines, such as Secure Initiator or Lockdown, and you are trying to ping between them, the ping <ip-address> command may fail because it performs a reverse DNS lookup to find out the name associated with the IP address from your DNS server. This will cause the machine which is trying the ping, to do an ISAKMP negotiation with your DNS server. In the case that you have not activated a compatible IPSec policy on your DNS server, this negotiation attempt will fail, causing ping to always fail. A Netmon sniff of the traffic should indicate the ISAKMP packets being sent to the DNS server address. If you have activated the "Allow communication with non-IPSec hosts" option on the rule’s negotiation policy, then you will fall back to clear after the soft association has been established. The system will need a soft SA to the DNS server and potentially to the destination address specified on the ping command line (when the destination does is not-IPSec enabled). If you repeat the ping command after 8 seconds, you should see it succeed when the destination is not IPSec enabled. Since DNS query replies are cached locally on a system for a short time, you may not see the DNS query packet (or the resulting ISAKMP negotiation packet) actually sent on the wire to the DNS server when you issue a ping.

You will need the Windows NT5.0 domestic North American Version in order to negotiate with IOS 11.3 routers that support IP Security transport and tunneling. This is required for interoperability of the cryptographic transforms DES-CBC with 56bit key and Triple-DES.

Getting Started Quickly with IPSec

Activating IP security as a property of a local area network connection:

Note: this changes the IP security for all connections, not just the LAN connection.

Activating IP security using the Microsoft Management Console IPSec snapin tool:

Creating and applying IPSec policy in the NT 5.0 Directory Service

1. Start up a blank MMC console or bring up the IP Security Management tool from the Programs -> Administrative Tools menu (server only)
2. Choose Console -> Add/Remove Snapin
3. Click the Add button
4. Select the IP Security Management snapin, click OK.
5. When prompted for the location you want to manage, choose the "Policy information in your domain controller’s directory service" location.
6. If you are a domain administrator, then you will have access to the IPSec policy area in the Active Directory and can create policy there.
7. A separate process is required to assign the IPSec policy to the domain or organizational unit using the Group Policy Editor to edit the appropriate group policy object.

Using Certificate Trust

If you have mis-entered this string as a CA name in the rule, the IKE negotiation process will not be able to find a certificate issued by the misspelled CA name. In the Event Security Log, a general processing failure is recorded.

Default Policies

The default policies use the Kerberos authentication method. This means that two systems must be in the same or trusted domains to be able to negotiate a security association.

Known Problems with IPSec

Directory polling for policy is disabled

The polling interval for IPSec policy agent to refresh active policy has been set to a large value to effectively disable polling. So if you make changes to any part of an active IPSec policy, you will need to stop the policy agent service on the workstation and restart it. In the event log, you will see informational messages that indicate the polling interval is set to a large number of minutes for this reason.

When a client is moved from an OU/Domain which contains IPSec policy assignment, to an OU/Domain which does not have any IPSec policy, the policy that was cached on the local machine may in some cases not be deleted. Check the event log to verify the source of the policy.

RAS IPSec tunneling

Client IPSec tunneling does not assign an internal IP address. The same IP address on clients must be used for both the source address of the tunnel and source address for the end-to-end communication.

For testing IPSec tunnel servers, should specify filters from "Any" or a subnet going to each client’s IP address.

Router-router tunnel

A ---- GW1 ====== GW2 ----- B

The policy on GW2 should have a rule with a filter specification that says from subnet B going to subnet A, use tunnel end point of GW1, NOT mirrored. And going from subnet A to subnet A use GW2 as the tunnel end point.

Two or more default routes with the same metric

On multi-homed machines, make sure you don't have two default routes with the same metric. This can cause ISAKMP negotiation to fail. Symptoms: your negotiation fails going from host A to host B, but succeeds when B initiates to A.

ISAKMP policy settings

If you make changes to the phase 2 key lifetimes, make sure the number of bytes transferred per re-key is very large, such as 20Mb or greater. The actual minimum recommended value depends on how much data is being transferred at what rate. A smaller value results in rekey negotiations which are too fast such that they never complete the first renegotiation before starting the second.

Export Limitations

Export version of the NT5.0 builds will allow you to configure IPSec policies, such as 56bit DES or 3DES, that the underlying mechanisms do not support.

How to Report a Problem with IPSec

If the problem can not be resolved using the checklist of steps above, gather the following information, and send it to the Windows NT5.0 Beta Support networking team using typical bug reporting tools. If the problem is reproducible, then output from the commands listed below before and after is most helpful.

Internet Authentication Service

Internet Authentication Service (IAS) uses the Remote Authentication Dial-in User Service (RADIUS) protocol to perform remote authentication, authorization, and accounting of users who connect through a network access server (NAS).

Authentication:

Authorization:

Accounting:

Network Access Servers:

Remote Access Policies is used to authorize users for access to network services. The IAS service evaluates the list of remote access policies in the specified sequence. Each remote access policy is divided into conditions and a corresponding profile. The profile is used when all the conditions in the policy are matched. If none of the conditions in a policy match, then IAS evaluates the next policy in sequence. If none of the policies match, then the user is rejected.

1. Remote Access Policies cannot be stored in Active Directory. It is always stored locally on the machine running IAS.
2. Callback number and Callback options do not work.
3. Event log does not contain any messages.
4. MSCHAP Change Password version 1 is not supported. MSCHAP Change Password version 2 is supported.
5. List of EAP Types is predefined and cannot be changed.
6. If you use EAP Authentication, then do not use policies that are dependent on Universal Groups.
7. Interoperability tests failed with a latest update to Ascend MAX, version 5.0AP42. The interoperability tests passed with an earlier version of Ascend MAX.
8. IAS must be installed either in a native Windows NT 5.0 domain or in a native Windows NT 4.0 domain. IAS does not yet support a mixed domain with Windows NT 4.0 domain controllers and Windows NT 5.0 directory services.
9. Behavior for users in Windows NT 4.0 domains: The dial-in permission assigned to Windows NT 4.0 users overrides the dial-in bit in the Profile.
10. Behavior for users in Windows NT 5.0 Active Directory and Windows NT 5.0 SAM: Dial-in permission is determined by membership of users in Windows NT groups (see Remote Access Policies).
11. Migration from Windows NT 4.0 domains to Windows NT 5.0 Active Directory: The dial-in bit, callback number, callback options, and CHAP password assigned to users in Windows NT 4.0 domains are not upgraded to Windows NT 5.0 Active Directory.
12. To enable CHAP in Windows NT 4.0 domains, download the CHAP update from www.microsoft.com and follow the instructions in the associated documentation.
13. To enable clear text password in Active Directory domains follow these steps: in Active Directory snap-in, right click on domain, and select -> Tasks -> Manage Group Policy. If a Group Policy Object does not exist, then create it. Edit the Group Policy Object, and navigate to Computer Settings --> Security Settings --> Account Policies --> Password Policy. Here you will see the option to enable/disable Clear Text Passwords.
14. Upgrading from the version of IAS in the Windows NT 4.0 Option Pack is not supported.
15. Changes in configuration do not take effect until the service is restarted. After changing any parameters, stop and restart the service.
16. RAS and IAS share Remote Access Policies. If you change the Remote Access Policies on a computer, then the change applies to both RAS and IAS on that computer.
17. Policy-evaluation sequence bug: Policy is not evaluated in the sequence specified by the administrator.

• Cisco AS 5200 version 11.2
• Windows NT 4.0 Routing and Remote Access Service RADIUS client
• Windows NT 5.0 Remote Access Service
• Ascend MAX (see note in "Read this before using IAS" list, above).

1. Verify that you have installed IAS. IAS is an optional component that can be installed using Windows NT Optional Components Manager.
2. If the user accounts are in Active Directory, then

3. The Remote Access Policies that are installed by default disable access for all users in Active Directory, and enable access to users in NT4 domain which have the dial-in permission enabled.
4. Define the Clients (NAS equipment and RADIUS proxies) with the appropriate shared secret.
5. Verify that the NAS equipment uses the same RADIUS ports. By default, IAS uses these ports: 1812 for authentication, 1813 for accounting. These ports are recommended by the RADIUS RFC 2138, RFC 2139.
6. Configure the NAS or RADIUS proxy to forward authentication and accounting packets to the IAS server.
7. Start the service.

Services for Macintosh

In previous versions of Windows NT Server, Services for Macintosh was installed from Network in Control Panel to enable management of Macintosh file and print services. With this release of Windows NT Server, Services for Macintosh is split into File Services for Macintosh, Print Services for Macintosh, and the AppleTalk protocol. In this release, Macintosh clients can use the TCP/IP protocol to access shares on a Windows NT Server that is running File Services for Macintosh (AFP over IP).

File Services for Macintosh Installation

Notes

• You must have an NTFS partition installed before you install File Services for Macintosh.
• When File Services for Macintosh and TCP/IP are installed, the Apple Filing Protocol (AFP) over TCP/IP is enabled automatically.
• File Services for Macintosh no longer requires the AppleTalk protocol when TCP/IP is installed on the Windows NT Server computer.

To install File Services for Macintosh

1. In Control Panel on a Windows NT Server computer, click Add/Remove Programs v2.
2. In the Programs Wizard dialog box, click Remove or modify an existing program, and then click Next.
3. In the Application Name box, select Windows NT Optional Components, and then click Modify.
4. In the Components box, select the Networking Options check box, and then click Show Subcomponents.
5. In the Subcomponents of Networking Options box, select the File Services for Macintosh check box, click OK, and then click Next.

Print Services for Macintosh Installation

Note that if you install Print Services for Macintosh and have not already installed the AppleTalk protocol, the protocol is installed automatically.

To install Print Services for Macintosh

1. In Control Panel on a Windows NT Server computer, click Add/Remove Programs v2.
2. In the Programs Wizard dialog box, click Remove or modify an existing program, and then click Next.
3. In the Application Name box, select Windows NT Optional Components, and then click Modify.
4. In the Components box, select the Networking Options check box, and then click Show Subcomponents.
5. In the Subcomponents of Networking Options box, select the Print Services for Macintosh check box, click OK, and then click Next.

AppleTalk Protocol Installation

You can install the AppleTalk protocol separately from File Services for Macintosh or Print Services for Macintosh. For example, you can install the AppleTalk protocol for routing purposes only. In this situation, you need AppleTalk, but not File or Print Services for Macintosh.

Note

• Installing the AppleTalk protocol on a LAN connection will install and enable it for all LAN connections on your computer. To disable the AppleTalk protocol on a LAN connection, you must configure the connection and uncheck the AppleTalk protocol box.

To install the AppleTalk network protocol on a connection

1. Click Start, point to Settings, click Control Panel, and then click Network Connections.
2. Right-click a Local Area Connection and click Properties.
3. On the Networking tab, click Add.
4. Select Protocol and click Add.
5. In the Network Protocol box, select AppleTalk Protocol, and then click OK.

Note

• By installing Print Services for Macintosh, you automatically install the AppleTalk network protocol.

AppleTalk Protocol Configuration

AppleTalk protocol properties—such as a default adapter type and a default zone—are now configured per-connection in the Network Connections folder.

To set default adapter and zone properties

1. Click Start, point to Settings, click Control Panel, and then click Network Connections.
2. Right-click a Local Area Connection, and click Properties.
3. On the Networking tab, select AppleTalk Protocol, and click Properties.
4. If you want to use this connection as the default adapter, select the Accept inbound connections on this adapter box.
5. Select a zone for the system, and then click OK.

Note

• Once you have selected an adapter as the default adapter, you cannot deselect that adapter. If you want to use a different LAN connection as your default adapter, you must perform this procedure on it.

AppleTalk Routing Configuration

AppleTalk routing properties—such as a network range and whether to enable routing, and the zone list—are now configured by using the Routing and Remote Access Management console.

To configure AppleTalk routing properties

1. Click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access Administrator.
2. Under Console Root, select AppleTalk.
3. Right-click an adapter in the Adapters list, and then click Properties.
4. Configure seed routing and the zone list as appropriate for the computer, and then click OK.

AppleTalk Remote Access Configuration

1. Click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access Administrator.
2. Under Console Root, right-click Routing and Remote Access, and then click Properties.
3. On the ARAP tab, configure remote access options as appropriate for the computer, and then click OK.

Note

• You must restart your computer before any changes take effect.

Macintosh File Administration

In previous versions of Windows NT Server, the Macfile program handled Macintosh file administration, including the creation of Macintosh volumes, passwords, security options, user limits, and permissions. Access to the Macfile menu was from Control Panel, File Manager, and Server Manager. Macintosh volumes and files are now centrally administered through the File Service Management snap-in of the Microsoft Management Console. Both Macintosh and non-Macintosh files are administered by using File Service Management. This improves the integration of Macintosh file management with non-Macintosh files.

To administer Macintosh volumes

1. Click Start, point to Programs, point to Administrative Tools, and then click File Service Management.
2. In the console tree, click Shares.
3. Right-click a Macintosh shared folder, and then click Properties.

To configure File Server for Macintosh

1. Click Start, point to Programs, point to Administrative Tools, and then click File Service Management.
2. In the console tree, right-click File Service Management, and then click Configure File Server for Macintosh.

AppleTalk Remote Access Protocol (ARAP)

Macintosh users may dial in to Windows NT Server 5.0 by using the AppleTalk Remote Access Protocol (ARAP). ARAP installs automatically if the Remote Access Service and AppleTalk protocol are installed. The AppleTalk protocol installs automatically with Print Services for Macintosh. The AppleTalk protocol may also be installed separately. Windows NT Server version 5.0 for ARAP includes the following features:

• Addresses are dynamically allocated. Note: do not statically configure the addresses.

• Clients are not forced to change their passwords.

Note

• If the client is using the Macintosh ARAP client version 3.0, then the Macintosh client must use the ARAP Only protocol.

ARAP client callback functionality is identical to other Dial-In client types. Callback ensures that only users from specific locations can access the Dial-Up server. This saves toll charges for the user. In addition, the ARAP client may specify their number to be called back at the time they dial in, if their account is enabled for callback. To do this, the user specifies their username as Username@Phonenumber. For example, a user called "JohnSmith," whose account is configured for callback, wants to be called back at "5551234." He can enter JohnSmith@5551234 as his user name, and he will get called back at that number.

Guest account authentication and access authorization are identical under ARAP as any other dial-in method.

ARAP requires that user passwords be saved in reversibly encrypted clear-text format on the Dial-Up server. By default, passwords are not stored on the Dial-Up server in clear-text format. Because of the clear-text format requirement, existing users who want to use the ARAP protocol must have their passwords converted to clear-text format in one of two ways. Their administrator must first enable the Dial-Up server to store passwords in clear-text format. For existing accounts, the administrator can then either delete and recreate the accounts, or change the password for the account. Either way, the password is then stored in clear-text format, and the user can dial in using the ARAP protocol.

All account passwords created after enabling clear-text password storage will be saved in clear-text format.

In this release, you cannot store passwords on a domain-wide basis. Instead, you can do it on a per-user basis. So for ARAP clients and to allow Apple Encrypted passwords to work, for each user the admin must:

To store passwords on a per-user basis

1. On a Windows NT Server Domain Controller, click Start, point to Programs, point to Administrative Tools, and then click Directory Management.
2. Double-click domain, and then double click Users.
3. In the user list, right-click on a user and then click Properties.
4. On the Account tab, select the Save password as encrypted clear text check box, and then click OK.

Note

• You must complete this procedure on each user for which you want to enable AppleTalk remote access or enable log in using Apple Encrypted User Authentication Method (UAM).

To configure AppleTalk Remote Access

1. Click Start, point to Programs, point to Administrative Tools, and then click Routing and Remote Access Administrator.
2. Under Console Root, right-click Routing and Remote Access, and then click Properties.
3. On the ARAP tab, configure remote access options as appropriate for the computer, and then click OK.

Note

• You must restart your computer before any changes take effect.

ARAP Callback Problems

Macintosh clients may experience problems using the AppleTalk Remote Access Server Callback feature. Specifically, a client may connect initially when they call the server, but when the server calls the client back, modem negotiation fails and the client cannot reconnect.

This is a known issue and requires updating the client modem script file. To resolve the problem, obtain the most current client modem script file from the modem manufacturer, reinstall the script file, and connect again.

Note

• If you have Open Transport installed as well as Apple Remote Access Client version 2.x or greater, you must obtain the appropriate Open Transport-specific modem script from your modem manufacturer. To verify that Open Transport is installed, look at the Control Panels folder. If you have an AppleTalk Control Panel, then Open Transport is installed. If you have a Network Control Panel, then you do not.

Send Message

Messages to Macintosh users are sent from the File Service Management snap-in. Messages can only be sent to all Macintosh users of the server. Messages cannot be sent to individual users or to those users accessing a particular volume.

To send a message

1. Click Start, point to Programs, point to Administrative Tools, and then click File Service Management.
2. In the console tree, right-click File Service Management, and then click Configure File Server for Macintosh.
3. On the Sessions tab, type your message text.
4. Click Send, and then click OK.

Macintosh Volume Names

Macintosh volume names created by using Windows NT Server version 5.0 cannot exceed 12 characters in length. To create volumes with longer names, you must use the command-line tool Macfile.exe.

For example, to add a volume called Landscape Design on the Error! Bookmark not defined. server using the TREES folder on drive E:, type

macfile volume /add /server:\\magnolia /name:"Landscape Design" /path:e:\trees

Password Expiration

When Macintosh user accounts or passwords expire, the Macintosh client receives an inaccurate error message from Windows NT Server. The error message indicates that either the account name or the password is incorrect.

To correct the situation, the Macintosh user’s password must be changed by the administrator at the Windows NT Server version 5.0 computer.

Certificate Services

New Features in this Release

Administration of Certificate Services - The administration model for Certificate Services has changed with this release. Users of the v1.0 Certificate Server will recall that administration was performed using web pages. Starting with this release, all administration will be done using MMC snap-ins.

Enterprise Policy - A new policy module called "Enterprise Policy" has been included in this release. This is in addition to the default policy shipped with Certificate Server v1.0 and shipped here as well. Enterprise policy is intended to address the need for a policy module that works "out of the box" and is administratable using a provided GUI. Enterprise Policy also publishes CA information, CRLs and user certificates to the Active Directory. Enterprise Policy requires the Active Directory.

Certificate Hierarchies - Certificate Hierarchies are now supported.

Certificate Manager - Certificate Services supports processing of requests for certificates from the Certificate Manager. The Certificate Manager is a new MMC snap-in that manages certificates and certificate stores for a user or machine. It is documented elsewhere.

Known Problems and Limitations

• Upgrade Support

Name changes are in process.

This release renames what was formerly known as "Certificate Server" to "Certificate Services". At this time the work needed to complete this is only partially done. In particular, the documentation will often refer to "Certificate Services", whereas the forms will always say "Certificate Server". These terms mean the same thing.

Additionally, most of the documentation describing how to perform tasks using Certificate Services has not yet been incorporated into the standard documentation facility supplied with NT 5. As such, see the section titled Certificate Services Documentation

Certificate Services Documentation

This section will provide elements of documentation about Certificate Services that has not yet been incorporated into the standard documentation supplied with NT 5. Specifically, what follows is focused on how to perform various administrative tasks. This information will be incorporated in the standard documentation for NT 5 in a future release.

Notes:  The result of this action is that the certificate will be marked as revoked. As such it is no longer displayed in the result panel when the Issued Certificates folder is open. To see the certificate, double click on the Revoked Certificates folder. To publish the fact that this certificate has been revoked, you will need to create and publish a CRL. This is described elsewhere in this document.

Internet Information Server and Peer Web Services

After doing a DCPROMO, some user account privileges will have been removed. Web and Transaction services might not function properly.  The following two workarounds will resolve the issue.

1. If IIS/MTS servers are installed with NT server install, the workaround is to assign the following rights to the accounts after dcpromo has rebooted the machine:

Logon Locally Right assigned to IUSR_<ComputerName), IWAM_<ComputerName>
Batch Logon Right assigned to MTS_Admin, IUSR_<ComputerName>, IWAM_<ComputerName>

2. Or choose not install IIS/MTS servers during NT server install, then after dcpromo runs to promote a DC, install IIS/MTS from add/remove programs in control for optional components.

This release of Internet Information Server does not support:

• Installation on domain controllers
• Secure Sockets Layer (SSL)
• Client certificate mapping
• Custom error messages

• Using the Performance Monitor MMC snap-in to display IIS performance counters in not supported in this release.  If you wish to view IIS performance counters, you must use the Windows NT Performance Monitor application (Perfmon.exe).
• Using the MMC snap-in to view or set IIS computer (or master) level properties is not supported in this release.

The Key Manager application will be installed by default, but is no longer used to manage certificates.

Remote Boot Machine Replacement

The client side caching feature should be disabled on all Domain Controllers and unattended servers, to prevent the possibility of accidentally taking the SMB client offline and using cached data. In order to do this, the following key in the registry should be set:

HKLM/System/CurrentControlSet/Services/MRxSmb/Parameters/CscEnabled REG_DWORD 0

A reboot is required for this to take effect.

Group Policy

On Replicated DCs it is possible that Group Policy information has not been replicated to its replication partners when an attempt is made to modify Group Policy information on a replicated DC. To lessen this possibility:

• Limit edit access for Group Policy to the needed Administrators. Having multiple Administrators increases the chance that changes will be made and not replicated. If you get an error wait 15 minutes and try again.
• If you close the Group Policy Manager or the Group Policy Editor and quickly log onto another machine that binds to another DC that has not replicated yet, you may get an error. Wait 15 minutes and try again.

Distinguished names are not valid in the NT 5 shell’s open file dialogs in the IDS. Therefore they are not valid in the Samples node when specifying a server in the My Documents sample. Use only the NETBIOS file:///\\server/share naming convention.

The Software Policies node of the GPE is only partially complete in this release. It will be for Beta2. Any policy that is more than enabled/disabled will not be able to be changed. Also in this release some policies do not cause the correct action. This will be fixed for Beta2.

Application Management

Known Issues:

1. With this Interim Developer's Release, build the ability for an administrator to use the Application Deployment Editor to assign an application to a user or a machine in a site, or to publish to a user in a site has not been tested yet. You may try this feature, but be aware that it may leave a workstation in an unknown state. This functionality will be available in Windows NT 5.0 beta two.
2. When using the GPE (group policy editor) with a replicated DC for any changes you made you need to wait until the replication takes places. Occasionally you might get an error "Class Store not found" just after you created the GPO and you try to edit it. Please wait for the replication to take place and try again. This will be fixed for beta2.
3. When opening a document having and embedded object of a published/assigned app inside the automatic installation of the app will be triggered right away the moment you open the doc and not when you click on the embedded object. This will be fixed for beta2.
4. The ADE has the UI for the transforms (modifications) to be applied to the managed apps but this functionality is not available for this release. It will be available for beta2.

Other Known Interim Developer's Release Issues

In the Interim Developer's Release, there are two Add/Remove Programs applets (Add/Remove Programs and Add/Remove Programs -v2).   Add/Remove Programs is now web based and used for adding, removing, or modifying existing applications installed on Windows NT 5.0.  Add/Remove Programs - v2 is used for the installation, removal and maintenance of applications deployed through Application Management.

The new Add/Remove Programs applet is now fully functional. The old Add/Remove Programs v2 has not been removed yet – it can be used as a backup if you have any problems with the new one. The new Add/Remove Programs might take some time until it displays the initial page. The performance will be improved for beta2. Also the information displayed for the apps might not be accurate at this time. (size, support URL, etc.)