Sun Storage 7000 Unified Storage System: Configuring the ZFSSA for Active Directory with NTLMv2 / Windows Server 2008

Asset ID:	1-71-1402208.1
Update Date:	2013-07-24
Keywords:

Solution Type Technical Instruction Sure

Solution 1402208.1 : Sun Storage 7000 Unified Storage System: Configuring the ZFSSA for Active Directory with NTLMv2 / Windows Server 2008

Applies to:

Sun Storage 7410 Unified Storage System - Version Not Applicable to Not Applicable [Release N/A]
Sun ZFS Storage 7120 - Version Not Applicable to Not Applicable [Release N/A]
Sun ZFS Storage 7320 - Version Not Applicable to Not Applicable [Release N/A]
Sun Storage 7310 Unified Storage System - Version Not Applicable to Not Applicable [Release N/A]
Sun Storage 7110 Unified Storage System - Version Not Applicable to Not Applicable [Release N/A]
7000 Appliance OS (Fishworks)

Goal

Windows Server 2008 introduced a new security check that works in conjunction with NTLMv2. This document explains how to configure the ZFSSA for compatibility with this setting. In addition, the LAN manager compatibility setting is explained in detail.

To discuss this information further with Oracle experts and industry peers, we encourage you to review, join or start a discussion in the My Oracle Support Community - Disk Storage ZFS Storage Appliance Community

Solution

On the SMB service configuration page, found in the BUI under Configuration / Services /SMB, you will find the setting Lan Manager Compatibility Level. This setting details the versions of the LAN Manager (lanman) protocol accepted and refused, and corresponds to similar settings on Windows/SMB clients and servers. The following describes the behavior at each level:

2 (default) - In Windows workgroup mode, the Solaris CIFS server accepts LM, NTLM, LMv2, and NTLMv2 requests. In domain mode, the SMB redirector on the Solaris CIFS server sends NTLM requests.

3 - In Windows workgroup mode, the Solaris CIFS server accepts LM, NTLM, LMv2, and NTLMv2 requests. In domain mode, the SMB redirector on the Solaris CIFS server sends LMv2 and NTLMv2 requests.

4 - In Windows workgroup mode, the Solaris CIFS server accepts NTLM, LMv2, and NTLMv2 requests. In domain mode, the SMB redirector on the Solaris CIFS server sends LMv2 and NTLMv2 requests.

5 - In Windows workgroup mode, the Solaris CIFS server accepts LMv2 and NTLMv2 requests. In domain mode, the SMB redirector on the Solaris CIFS server sends LMv2 and NTLMv2 requests.

When connecting to a 2008 server, and a Lan Manager setting higher than the default of "2" is required, you must upgrade to ZFSSA system software version 2011.1.2.0 or later.

If you are running an earlier version, you will encounter a compatibility issue that requires a registry change (and a hotfix if the 2008 server is below the R1/Service Pack 2 patch level). Upgrade your software if this is the case, or contact support if this is not possible.

Try to encourage the customer to update the software to fix this if at all possible. The following information is provided for those customers who can not or will not upgrade.

The required registry setting and information on the hotfix can be found in MSKB article #957441. Once the registry setting is set as detailed in this article, the Lan Manager Compatibility Level can be set to "5" and will function as expected.

To clarify, this only affects Windows Server 2008 and is only applicable when the LM Compatibility setting is increased from the default on the DC. This can be worked around by setting a 2003 Server or a single 2008 server with the registry change as the Preferred Domain Controller in Configuration / Services / SMB.

This setting lowers security for the AD Domain and we often find that the customer will not agree to make this registry change.

Back to <Document 1402353.1> Sun Storage 7000 Unified Storage System: How to Troubleshoot Active Directory Issues.

References

<NOTE:1402353.1> - Sun Storage 7000 Unified Storage System: How to Troubleshoot Active Directory Issues
MSKB 957441: HTTP://SUPPORT.MICROSOFT.COM/KB/957441/
<BUG:7023098> - PL TRANSLATION DEFECTS ON THE CLE_F206_MPCS FROM

Attachments

This solution has no attachment