🚀 go-pugleaf

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


From: http://www.ntfaq.com/


John Savill / January 9, 2000
Q. How can I force a client to validate its logon against a specific
domain controller?

A. Before answering this it is best to understand what happens when a
login occurs.

When a logon request is made to a domain, the workstation sends out a
request to find a domain controller for the domain. The domain name
is actually a NetBIOS name that is a 16-character name with the 16th
character used by Microsoft networking services to identify the
NetBIOS type.

The type used for a domain controller is <1C> and so the NetBIOS name
for domain controller of domain "SAVILLTECH" would be "SAVILLTECH
<1C>" The NetBIOS type has to be the 16th character, hence the name
of the domain has to be filled with blanks to make its length up to
15 characters.

If the client is WINS enabled then a query for the resolution of
"<domain name> <1C>" will be sent to the WINS server as defined in
the clients TCP/IP properties. The WINS server will return up to 25
IP addresses that correspond to domain controllers of the requested
domain, a \mailslot\net\ntlogon is broadcast to the local subnet and
if the workstation receives a response then it will attempt logon
with the local domain controller.

If WINS is not configured then it is possible to manually configure
the LMHOSTS file on the Workstations to specify the Domain
Controller. This file is located in the
%systemroot%\system32\drivers\etc directory.

An example entry in LMHOSTS would be as follows

200.200.200.50 titanic #PRE #DOM:savilltech #savilltech domain
controller

The above sets up IP address 200.200.200.50 to be host Titanic, which
is the domain controller for savilltech and instructs the machine
that this entry is to be preloaded into the cache.

To check the NetBIOS name cache you can use command nbtstat -c, which
will show all the entries including their type. If WINS is not
configured and there is no entry in LMHOSTS then the Workstation will
send out a series of 3 broadcasts. In the situation where no response
is received and WINS is configured to use DNS for WINS resolution a
request to the DNS server will be sent and finally the HOSTS file
checked. If all of this fails then an error "A domain controller for
your domain could not be contacted.

To force a client to use a specific domain controller we need only do
the following:

Start the registry editor
Move to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
- From the Edit menu select New - DWORD value
Enter a name of NodeType and press ENTER
Double click on the new value and set to 4 (this sets the network to
an M-mode/mixed which means it will perform a broadcast before
querying name servers for resolution). By default a system is 1 if no
WINS servers are configured (B-node/broadcase) or 8 if at least one
WINS server is configured (H-node/queries name resolution first then
broadcasts)
Double click on the EnableLMHOSTS value and set to 1. If it does not
exist select New - DWORD value from the Edit menu and enter a name of
EnableLMHOSTS
Close the registry editor
Reboot the machine
The machine is now configured to broadcase for a domain controller on
a local subnet and then query a name server. If no domain controllers
are found on the WINS server, or WINS is not used it will then search
the LMHOSTS file. The next stage is to edit this file.

Check for the LMHOSTS file
C:\>dir %systemroot%\system32\drivers\etc\lmhosts
If the file does not exist copy the sample host file
C:\>copy %systemroot%\system32\drivers\etc\lmhosts.sam
%systemroot%\system32\drivers\etc\lmhosts
1 file(s) copied.
Edit the file using edit.exe, don't use notepad.exe
C:\>edit %systemroot%\system32\drivers\etc\lmhosts
Goto the end of the comments and add a new line of the format
<ip address> <name of DC> #PRE #DOM:<domain name> #<comment>
e.g. 200.200.200.50 titanic #PRE #DOM:savilltech #savilltech domain
controller
Save the changes to the file and exit edit.exe
Force the machine to reload the LMHOSTS file (or just reboot)
C:\>NBTSTAT -R
Note: The -R must be in capitals, the command is case sensitive
Check the cache
C:\>NBTSTAT -c
At this point the configuration is complete and a reboot is
advisable.
Service Pack 4 includes a new utility, SETPRFDC.EXE, which will
direct a secure channel client to a preferred list of domain
controllers.

The syntax is:

C:\> SETPRFDC <Domain Name> <DC1, DC2, ....., DCn>

SETPRFDC will try each DC in the list in order, until a secure
channel is established. If DC1 does not respond, DC2 is tried, and so
on. Once you run SETPRFDC on a WinNT 4.0, SP4 computer, the list is
remembered until you change it. You can run SETPRFDC in batch, via
the scheduler, or even in a logon script (for future logons). Don't
forget to undo





- --
Svenn Derrick
RSA CSE, MCSE, CCA, Compaq ASE
~~~~~~~~~~~~~~~~~~~~~~~~~~
svenn@NOSPAMglobalnet.co.uk
http://www.users.globalnet.co.uk/~svenn/

Remove "NOSPAM" to reply via email
~~~~~~~~~~~~~~~~~~~~~~~~~~
Always listen to experts.
They'll tell you what can't be done, and why.
Then do it.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Simon" <simieh@bigpond.com> wrote in message
news:kSlt6.36559$v5.80205@newsfeeds.bigpond.com...
> Guys,
>
> I have a 2 domain controllers on the one subnet. At the moment, I
> am having problems with drive mappings, and I need the clients to
> be authenticated by the same domain controller all the time. Please
> if you know how to set up so that when users log on, they always
> get authenticated by the same domain controller.
> Thanx
>

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0

iQA/AwUBOractyO2tKXe6fMwEQI+8gCghRJezDROCxDj3APzlhVIffgnKXAAoOlX
UcR9ddwmXPdUe5mlsBkTX6kY
=LWXP
-----END PGP SIGNATURE-----