Pillar Axiom 300 Storage System
 
Pillar Axiom 600 Storage System
 
Pillar Axiom 500 Storage System
 

PLA-Support>Sun Systems>DISK>Axiom>SN-DK: Ax600
 

A change in Axiom Release 4.3, 04.03.xx, may prevent CIFS Clients that use NTLM authentication from accessing shares in an Active Directory Domain where the AD Domain Name is not the same as the NETBIOS Domain Name

This issue affects all 4.3 and 4.5 releases.

In this Document

Symptoms

Cause

Solution

References

Created from <SR 3-5449535101>

Applies to:

Symptoms

After an upgrade of an Axiom to Release 4.3 or 4.5, any client using NTLM authentication may fail to map CIFS shares, indicating that there are no NETLOGON Servers available.  

Cause

A change was made in Axiom Release 4.3 to cache NETBIOS Names during Join Domain when the NETBIOS Name differs from the first field of the Fully Qualified Active Directory Domain Name.

As the Axiom File Server joins the Active Directory Domain, it queries the Domain Controller for the NETBIOS Name, and opens a connection to the privileged Name Pipe PIPE\NETLOGON for handling mount requests from clients that use NTLM authentication. 

If either the Preferred Server list or an account other than "anonymous" is configured for the "File Server Access to Domain Controllers", the File Server fails to make this query during the Join Domain, and will attempt to open the NETLOGON pipe to the Active Directory domain name, which will fail. 

As a result, clients using NTLM type authentication will be unable to map shares.    This includes most Samba Clients, as well as any client that attempts to map a share using the IP address of the file server rather than the Fully Qualified Server Name.    e.g. \\169.254.1.2  

Solution

Workaround

This issue can be avoided by leaving the list of Preferred Servers unpopulated and selecting the "Access Anonymous" option for joining the domain on the CIFS "File Server Access to Domain Controllers" option.
Then, the affected file server must re-join the domain to obtain the NETBIOS Name

The Join Domain is performed using the pull down Action Menu with a credential authorized to join member servers, not "anonymous"   

Resolution:  Apply the release or patch containing the fix for Bug 13862827 when available. 

References

This solution has no attachment