Upgrading to the Identity Manager Module for Mainframe

Boyd Wilson

bowilson@novell.com

Robert Taylor

RoTaylor@novell.com

Upgrading NAM to Identity Manager

Why Upgrade

NAM has been discontinued. Nsure® Identity Manager is the migration path

Newer code base

More functionality

More reliable

A completely IDM2 driver based solution

One application to administer your identity solution (iManager)

Universal Password enabled

Password self-service

Enforce strong password policies

Expand identity management to many other systems such as LDAP directories, databases, e-mail systems, and enterprise applications

Chance to review company policies and practices for identity management.

The PRICE is RIGHT!!!

** Visit www.novell.com/nsureidentitymanager for more details

Upgrade Details

1. Customers with current maintenance/upgrade protection are entitled to upgrade to a corresponding Novell Nsure Identity Manager package at no cost.

2. Customers who do not have current maintenance/upgrade protection, may purchase a corresponding Nsure Identity Manager package at the standard upgrade price.

Part 1 Agenda

Why upgrade?

Mainframe Upgrades

A decision to make before upgrading?

NAM 2.1 to Identity Manager

NAM 3.0 to Identity Manager

Unix and Linux Upgrades

A decision to make before upgrading?

NAM 2.1 to Identity Manager

NAM 3.0 to Identity Manager

Why Upgrade?

Benefits of Upgrading

Easier Installations

Newer code base

More functionality

More reliable

A completely IDM2 driver based solution

iManager Administration

Universal Password enabled

Chance to review company policies and practices for identity management.

Better Auditing using Nsure® Audit

A Point to Remember

Because of the nature of identity management solutions each upgrade must be throughly investigated before any work is done.

The information given here will work in the majority of environments with only minor modifications

Mainframes

NAM 3.0 for Mainframes

An authentication redirection solution which provides bidirectional password support through z/OS system Exits

Provisioning provided through event driven Rexx Scripts that provides logic delegation to the z/OS system programmer.

What product is currently installed?

A decision to make?

Nsure Identity Manager Integration Module 2.1 for Mainframe contains two drivers that operate in very different ways to solve different sets of problems.

Bi-Directional

Fan-Out

Bi-Directional Driver

Allows two way flow of information

It uses polices and style sheets to transfer the data between the environments All the decisions are made in eDirectory.

Each LPAR on the mainframe must have it's own driver.

eDirectory™

IDM2 Bi-Directional Driver

Policies

Linux/Unix

Driver Options
Bidirectional and Fan-Out

Feature	Bidirectional	Fan-Out

Data Publishing from z/OS to Identity Manager

Data Subscribing from Identity Manager to
z/OS

Provisioning to Hundreds of Platforms with a
Single Driver

Bidirectional Password Synchronization

Administrative Password Resets from z/OS

Administrative Password Resets to z/OS

End User Password Replication to and from
z/OS

Authentication Redirection

Enforcement of Universal Password Rules on
z/OS Login

Login Expiration Synchronization from eDir to z/OS

Driver Options
Bidirectional and Fan-Out

Feature	Bidirectional	Fan-Out

Universal Password Replication Support

Event Triggered Rexx Scripts for Provisioning
(Logic on z/OS, working sample scripts provided)

Native TSO Command Execution

Role-Based Entitlements

Nsure Audit Enabled

Password Self Service Support

iManager Plug-In

Password Failure Email Notification Support

API's to Simplify Programmatic Directory Access

IDM Policy Support (Logic in IDM on eDirectory,
working sample policies provided)

Fan-Out Driver

Allows a one way flow of information

Allows data migration to a large number of LPARs using a single driver.

Uses REXX scripts on the local system to transfer the information into the local database.

Fully supports the NAM 3.0 REXX Scripts

Leverages password redirection with optional password replication.

eDirectory

IDM2 Fan-Out Driver

Linux/Unix

Scripts

Upgrading from Novell Account Management 3.0 for Mainframes

Novell Account Management 3.0

NAM 3.0 has two main services, each service has multiple components.

Core Services:

Manager – Processes events in eDirectory and queues them up for the Platform Receivers.

Agent – Processes requests for eDirectory information from the Platform Services Process

Event Listener – DirXML® driver that listens for changes to users and groups in eDirectory and passes that information onto the Manager for processing.

Platform Services:

Platform Receiver – Processes events it receives from the Manager using the Scripts written in the local systems scripting language (Shell, REXX, Visual Basic, etc).

Platform Services Process – Processes system request for eDirectory information such as authentication requests, group membership lists, and checks on rights to objects.

Diagram of NAM 3.0

eDir Server

eDir Server

eDir Server

z/OS using RACF, ACF/2, Top Secret

Manager

Event Listener

Agent A

Agent B

Receiver

Scripts

Security System

Authentication &

PW Change Exits

Platform Services

Process

eDirectory

NAM 3.0 to Bi-Directional Driver

The official upgrade path for NAM 3.0 is the Fan-Out Driver. However if the customer finds that the Bi-Directional Driver is a better fit for their environment they can migrate to that driver.

Because of the different way in which NAM 3.0 and the RACF Bi-Directional Driver operate there isn't an “upgrade” path, it's a new install and a cut over to the driver. Just make sure you have migrated to Universal password before you make the switch.

NAM 3.0 to Fan-Out: Step 1

Install the Fan-Out driver on your existing NAM 3.0 Manager server.

This server must have all the replicas that contain objects you will be provisioning so the Fan-Out Driver can capture the events in eDirectory.

Configuration information will be updated during the install process.

Attributes will be migrated from the ASAMPlatformUser to the ASAMEnterpriseUser object during the initial trawl and during event processing.

After the Fan-Out driver is install all trawls will remove a settable number of ASAMPlatformUser and UIDGID Objects from eDirectory.

The Fan-Out driver will automatically be configured as a Primary driver.

Diagram of Step 1

eDir Server

eDir Server

eDir Server

z/OS using RACF, ACF/2, Top Secret

Manager

Event Listener

Agent A

Agent B

Receiver

Scripts

Security System

Authentication &

PW Change Exits

Platform Services

Process

eDirectory

Primary

Fan-Out

Driver

NAM 3.0 to Fan-Out: Step 2

Upgrade NAM 3.0 Agents to Fan-Out drivers.

The Fan-Out driver is backwards compatible with the NAM 3.0 Agent you do not need to perform this step immediately.

The installation for the Fan-Out driver will detect that an Agent is running on the system (by looking at the asamcore.conf file) and upgrade it to a Fan-Out driver.

The Fan-Out driver will be automatically configured as a Secondary driver.

Diagram of Step 2

eDir Server

eDir Server

eDir Server

z/OS using RACF, ACF/2, Top Secret

Manager

Event Listener

Agent A

Agent B

Receiver

Scripts

Security System

Authentication &

PW Change Exits

Platform Services

Process

eDirectory

Primary

Fan-Out

Driver

Secondary

Fan-Out

Driver

Secondary

Fan-Out

Driver

NAM 3.0 to Fan-Out: Step 3

Upgrade NAM 3.0 Platform Services.

The Fan-Out driver is backwards compatible with the NAM 3.0 Platform Services you do not need to perform this step immediately.

The installation method for each client is unique for each type of system.

Diagram of IDM2 Fan-Out Driver

eDir Server

eDir Server

eDir Server

z/OS using RACF, ACF/2, Top Secret

Receiver

Scripts

Security System

Authentication &

PW Change Exits

Platform Services

Process

eDirectory

Secondary

Fan-Out

Driver

Secondary

Fan-Out

Driver

Primary

Fan-Out

Driver

NAM 3.0 to Fan-Out: Cleanup

Cleaning up old NAM components.

Remove from the Fan-Out driver configuration any old Agents, Platforms, and Platform sets that are no longer being used.

Remove from systems any Agents, Event Listeners, and Platforms that are no longer being used.

During each trawl a set number of ASAM-PlatformUser and ASAM-UIDGID objects are removed. This number can be changed to suit each environment, the default is 2000 objects for each trawl.

Linux & Unix

What product is currently installed?

Novell Account Management 2.1

Uses a NSSwitch to redirect accounts and passwords to eDirectory running locally.

Novell Account Management 3.0 for Unix

An authentication redirection solution which provides bidirectional password support through z/OS system Exits

Provisioning provided through event driven Rexx Scripts that provides logic delegation to the unix admin.

A decision to make?

Nsure Identity Manager Integration Module 2.1 for Linux and Unix contains two drivers that operate in very different ways to solve two different problems.

Bi-Directional

Fan-Out

Driver Options
Bidirectional and Fan-Out

Feature	Bidirectional	Fan-Out

Data Publishing from Linux& Unix to Identity Manager

Data Subscribing from Identity Manager to
Unix and Linux

Provisioning to Hundreds of Platforms with a
Single Driver

Bidirectional Password Synchronization

Administrative Password Resets from Linux &Unix

Administrative Password Resets to Linux & Unix

End User Password Replication to and from

Linux and Unix

Authentication Redirection

Enforcement of Universal Password Rules on
PAM Login

Login Expiration Synchronization from eDir to Linux
& Unix

Driver Options
Bidirectional and Fan-Out

Feature	Bidirectional	Fan-Out

Universal Password Replication Support

Event Triggered Shell Scripts for Provisioning
(Logic on platform, working sample scripts provided)

Native Command Execution

Role-Based Entitlements

Nsure Audit Enabled

Password Self Service Support

iManager Plug-In

Password Failure Email Notification Support

API's to Simplify Programmatic Directory Access

IDM Policy Support (Logic in IDM on eDirectory,
working sample policies provided)

Bi-Directional Driver

Allows two way flow of information

It uses polices and style sheets to transfer the data between the environments All the decisions are made in eDirectory.

Each Linux or UNIX system must have it's own driver or be running NIS or NIS+

eDirectory

IDM2 Bi-Directional Driver

Policies

Linux/Unix

Fan-Out Driver

Allows a one way flow of information

Allows data migration to a large number (500+) of Linux or Unix systems using a single driver.

It uses Shell scripts on the local system to transfer the information into the local security system.

By default it uses PAM/LAM authentication redirection and can be configured to do replication as well.

eDirectory

IDM2 Fan-Out Driver

Linux/Unix

Scripts

From Account Management 2.1

Novell Account Management 2.1

NAM 2.1 works by redirecting all accounts and passwords to eDirectory using a nsswitch.conf module.

Currently the fan-out and bidirectional drivers do not support this functionality, it is being looked into for a future release. To currently upgrade you will need to uninstall NAM 2.1 and replace it with IDM Integration module for Linux and Unix 2.1.

From Novell Account Management 3.0

Novell Account Management 3.0

NAM 3.0 has two main services, each service has multiple components.

Core Services:

Manager – Processes events in eDirectory and queues them up for the Platform Receivers.

Agent – Processes requests for eDirectory information from the Platform Services Process

Event Listener – DirXML driver that listens for changes to users and groups in eDirectory and passes that information onto the Manager for processing.

Platform Services:

Platform Receiver – Processes events it receives from the Manager using the Scripts written in the local systems scripting language (Shell, REXX, Visual Basic, etc).

Platform Services Process – Processes system request for eDirectory information such as authentication requests, group membership lists, and checks on rights to objects.

Diagram of NAM 3.0

eDir Server

eDir Server

eDir Server

z/OS using RACF, ACF/2, Top Secret

Manager

Event Listener

Agent A

Agent B

Receiver

Scripts

Security System

Authentication &

PW Change Exits

Platform Services

Process

eDirectory

NAM 3.0 to Fan-Out: Step 1

Install the Fan-Out driver onto your existing NAM 3.0 Manager server.

The server must be running Identity Manager 2.1

This server must have all the replicas that contain objects you will be provisioning so the Fan-Out Driver can capture the events in eDirectory.

Configuration information will be updated during the install process.

Attributes will be migrated from the ASAMPlatformUser to the ASAMEnterpriseUser object during the initial trawl and during event processing.

After the Fan-Out driver is install all trawls will remove a settable number of ASAMPlatformUser and UIDGID Objects from eDirectory.

The Fan-Out driver will automatically be configured as a Primary driver.

Diagram of Step 1

eDir Server

eDir Server

eDir Server

Linux, HPUX, AIX, BSD, Solaris...

Manager

Event Listener

Agent A

Agent B

Receiver

Scripts

Security System

Authentication &

PW Change Exits

Platform Services

Process

eDirectory

Primary

Fan-Out

Driver

NAM 3.0 to Fan-Out: Step 2

Upgrade NAM 3.0 Agents to Fan-Out drivers.

The Fan-Out driver is backwards compatible with the NAM 3.0 Agent you do not need to perform this step immediately

The installation for the Fan-Out driver will detect that an Agent is running on the system (by looking at the asamcore.conf file) and upgrade it to a Fan-Out driver.

The Fan-Out driver will be automatically configured as a Secondary driver.

Diagram of Step 2

eDir Server

eDir Server

eDir Server

Manager

Event Listener

Agent A

Agent B

Receiver

Scripts

Security System

Authentication &

PW Change Exits

Platform Services

Process

eDirectory

Primary

Fan-Out

Driver

Secondary

Fan-Out

Driver

Secondary

Fan-Out

Driver

Linux, HPUX, AIX, BSD, Solaris...

NAM 3.0 to Fan-Out: Step 3

Upgrade NAM 3.0 Clients.

Because the Fan-Out driver is backwards compatible with the NAM 3.0 Clients you do not need to perform this step immediately.

The installation method for each client is unique for each type of system.

Diagram of IDM2 Fan-Out Driver

eDir Server

eDir Server

eDir Server

Receiver

Scripts

Security System

Authentication &

PW Change Exits

Platform Services

Process

eDirectory

Secondary

Fan-Out

Driver

Secondary

Fan-Out

Driver

Primary

Fan-Out

Driver

Linux, HPUX, AIX, BSD, Solaris...

NAM 3.0 to Fan-Out: Cleanup

Cleaning up old NAM components.

Remove from the Fan-Out driver configuration any old Agents, Platforms, and Platform sets that are no longer being used.

Remove from systems any Agents, Event Listeners, and Clients that are no longer being used.

During each trawl a set number of ASAM-PlatformUser and ASAM-UIDGID objects are removed. This number can be changed to suit each environment, the default is 2000 objects for each trawl.

Upgrading to the Identity Manager Module for Windows

Agenda Part II

Why upgrade?

A decision to make before upgrading?

Upgrading from NAM 2.1 (NDS4NT)

Upgrading from NAM 2.1 for Win2K

Upgrading from NAM 3.0

Why Upgrade?

Benefits of Upgrading

Newer code base

More functionality

More reliable

A completely IDM2 driver based solution

Use one application to administer your identity solution (iManager)

Universal Password enabled

Chance to review company policies and practices for identity management.

Point to Remember

Because of the nature of identity management solutions each upgrade must be throughly investigated before any work is done.

The information given here will work in the majority of environments with only minor modifications

Upgrading

What product is currently installed?

Novell Account Management 2.1 for NT (NDS4NT)

A bi-directional solution that replaces the Samsrv.dll and stores the domain information in eDirectory

Novell Account Management for Win2k

A bi-directional solution that uses a DirXML 1.0 and client based password syncronization. Style sheets are used to translate the data from eDirectory to the host system.

Novell Account Management 3.0

A one-way client-server based solution that uses LDAP and mutually authenticated SSL communication. Scripts written in Visual Basic are used to translate the date from eDirectory to the host system.

From Domain 2.1

NAM 2.1 (NDS4NT)

NAM 2.1 (NDS4NT)

A redirection solution that replaces the Microsoft's SAMSrv.dll and stores the domain information in eDirectory.

Bi-directional password synchronization.

Does not scale well in large environements.

Hard to troubleshoot and isolate problems. (never sure if the problems are Novell's or Microsofts).

Microsoft will not support an NT Domain that has been redirected using NDS4NT.

NAM 2.1 (NDS4NT) – Upgrade Process

Upgrade Process

The server hosting IDM must have eDirectory 8.7.1 or greater

Install and configure NMAS 2.3.x and Universal Password

Setup Password Policies

Upgrade Novell Clients to a version that supports Universal Password

Novell Client 4.83 or greater – Current Client is 4.91

Novell Client 3.4 for Windows 95/98 (Requires NICI2.6.1 and NMAS Client 2.2)

NOTE: For Universal Password Support Information see TID10083884

http://www.novell.com/documentation/nw65/index.html?page=/documentation/nw65/universal_password/data/alpc9nb.html

NAM

NAM 2.1 (NDS4NT) – Upgrade Process

Upgrade Process - cont

Perform NDS4NT Health check

TID#:10068115

TID#:2967088

Backup the registry key HKLM\Security\NWSAM

Copy \winnt\system32\netware\nds4nt.dat (This will be a hidden file)

Uninstall NAM2.1 (NDS4NT)

Please follow TID10068010 “Alternate Reverse Migration for Novell Account Management 2.1”

Install Novell Idententy Manager with the NT Driver

This server must have all the replicas that contain objects you will be provisioning so the NT Driver can capture the events in eDirectory.

NAM 2.1 (NDS4NT) – Upgrade Process

Upgrade Process - cont

Migrate Users from eDirectory to NT -

This will associate existing users.

Remove the NT Domain object from eDirectory

(only do this if everything is up an running with IDM)

NAM

From AD Syncronization

AD Synchronization

AD Synchronization

A bi-directional solution that uses a DirXML 1.0 driver. Style sheets are used to translate the data from eDirectory to the host system.

Passwords sync is indepentant of the DirXML driver and relies on a Password Sync agent and the Novell Client™

Pre IDM Architecture (setting in eDirectory)

1

End user enters password in Novell Client

Novell Client

2

Client sets password in eDirectory

eDirectory

3

Client reads agent information from eDirectory

4

Client sends password information to P/S agent

Password Sync agent

5

Agent sends password info to filter

Password Filter on Domain

6

Filter sets password in Active Directory

Connected System

Password Sync agent

4

Filter sends password to agent

Connected Application

3

Domain controller sets password in AD, hands copy of password to filter

Pre IDM Architecture (Microsoft Client)

1

End user enters password via Microsoft Client

Microsoft Client

2

Client sends password to domain controller

Password Filter on Domain

Agent sets password in eDirectory

5

eDirectory

IDM Architecture (setting in eDirectory)

4

Driver calls API to set password in Active Directory

Connected Application

3

DirXML Engine sends modify-password request to driver

Password Sync Driver

2

Engine gets Universal Password

DirXML Engine

Universal Password

1

User enters password in Novell Client, LDAP, etc. This sets Universal Password

LDAP Client

eDirectory

IDM Architecture (Microsoft Client)

Password Sync driver

4

Filter sends password to driver

Connected Application

3

Domain controller sets password in AD, hands copy of password to filter

1

User enters password via Microsoft Client

Microsoft Client

2

Client sends password to domain controller

Password Filter on Domain

Driver sends modify-password request to engine

5

eDirectory

DirXML Engine

Universal Password

AD Synchronication – Upgrade Process

Upgrade Process

The server hosting IDM must have eDirectory 8.7.1 or greater

Install and configure NMAS 2.3.x and Universal Password

Setup Password Policies

Upgrade Novell Clients to a version that supports Universal Password

Novell Client 4.83 or greater – Current Client is 4.91

Novell Client 3.4 for Windows 95/98 (Requires NICI2.6.1 and NMAS Client 2.2)

NOTE: For Universal Password Support Information see TID10083884

http://www.novell.com/documentation/nw65/index.html?page=/documentation/nw65/universal_password/data/alpc9nb.html

AD Synchronization- Upgrade Process

Upgrade Process - Cont

Uninstall NAM2.1 for Win2K through “Add/Remove Programs” – Users are already sync to both eDirectory and Active Directory

Install Nsure Identity Manager 2.01 with the AD Driver

This server must have all the replicas that contain objects you will be provisioning so the Active Directory Driver can capture the events in eDirectory.

Migrate Users from eDirectory to AD

This will associate existing users

AD Synchronization- Upgrade Gotcha's

ADSync matched on “Internet Email Address”, while IDM matches “CN” to “UPN”

“Full Name” now maps to “Display Name” so “Full Name” is now required when creating users

When creating/migrating users where no “Universal Password” is available, “Surname” is set as the default application password.

LDIF Export from AD, copy SAMAccount to UPN and LDIF Import – This fixes Matching Rule

From Account Management 3.0

Novell Account Management 3.0

NAM 3.0 has two main services, each service has multiple components.

Core Services:

Manager – Processes events in eDirectory and queues them up for the Platform Receivers.

Agent – Processes requests for eDirectory information from the Platform Services Process

Event Listener – DirXML driver that listens for changes to users and groups in eDirectory and passes that information onto the Manager for processing.

Platform Services:

Platform Receiver – Processes events it receives from the Manager using the Scripts written in the local systems scripting language (Shell, REXX, Visual Basic, etc).

Platform Services Process – Processes system request for eDirectory information such as authentication requests, group membership lists, and checks on rights to objects.

Diagram of NAM 3.0

eDir Server

eDir Server

eDir Server

z/OS using RACF, ACF/2, Top Secret

Manager

Event Listener

Agent A

Agent B

Receiver

Scripts

Security System

Authentication &

PW Change Exits

Platform Services

Process

eDirectory

NAM 3.0 to ActiveDirectory Driver

Upgrade Process

The server hosting IDM must have eDirectory 8.7.1 or greater

Install and configure NMAS 2.3.x and Universal Password

Setup Password Policies

Upgrade Novell Clients to a version that supports Universal Password

Novell Client 4.83 or greater – Current Client is 4.91

Novell Client 3.4 for Windows 95/98 (Requires NICI2.6.1 and NMAS Client 2.2)

NOTE: For Universal Password Support Information see TID10083884

http://www.novell.com/documentation/nw65/index.html?page=/documentation/nw65/universal_password/data/alpc9nb.html

NAM 3.0 to ActiveDirectory Driver

Upgrade Process – Cont

Stop the “Platform Receiver Service” and the “Platform PSP Service”

Uninstall the Platform Services

\novell\asam\platformservices\platformreceiver\asamplat -u

Remove the \novell\asam directory

Install Nsure Identity Manager 2.01 with the AD Driver

This server must have all the replicas that contain objects you will be provisioning so the ActiveDirectory Driver can capture the events in eDirectory.

Migrate Users from eDirectory to AD -

This will associate existing users

If Core Services is not being used for other Platforms it can be removed along with the ASAM container in eDirectory.

Troubleshooting Universal Password

Troubleshooting Password Syncronization

Password Synchronization can be handled in two way in a windows environment

Password Sync 1.0 – Client based

Password Sync 2.0 – DirXML Driver Based

Troubleshooting Password Sync in Nsure Identity Manager 2.0 - TID10092687

IDENTITY MANAGER and PasswordSync 1.0

Password Sync 1.0

Separate install that originally shipped with DirXML 1.1x. It utilizes the Novell Client, Password sync agent, filter.

Password Filter must be installed on all AD domain controllers and on the NT PDC.

Password are not sync'd using the DirXML driver

Does not use Universal Password

PasswordSync1.xml overlay needed to make IDM2.01 add NAD attributes to Users

Installing Password Synchronization 1.0 to work with IDM 2 - TID10092900

Identity Manager - Passwordsync

Password Sync 2.0

Installs as part of the Active Directory/NT DirXML driver

Utilizes Universal Password

Password sync via the DirXML Driver

Filter must be installed on all AD Domain Controllers or on the NT PDC.

AD Synchronization- Upgrade issues

AD Synchronization- Upgrade issues

AD Synchronization- Upgrade issues

Passwords expiring using IDM

NMAS 2.3.4 greater now sets passwords as an Admin which expires the users password.

FIX

Install NMAS 2.3.5.2 or greater

install IDM201IR3.exe

New DHUTIlj and DHUTILj2

When “Use Distribution Password for password synchronization” is checked the driver makes a different call and will not expire the password

Syncing Passwords Attributes
with NDS Driver

Universal Password MUST NOT sync like a traditional eDirectory Attribute.

DirXML filter for NSPMDistributionPassword must be set to:

IGNORE on the Publisher channel

Notify on the Subscriber channel

Universal Password is encrypted by the tree key and stored in attributes on the user object. If this attribute is sync'd to another eDirectory tree then the user/administrator will not be able to reset the users password in the destination tree because the tree key is different.

The engine upon seeing a password change makes an NMAS call to set the password in eDirecoty and strips the password element from the document.

Syncing Password Expiration with
NDS Driver

To sync Password expiration between trees add the policy found in IDM201IR3.exe.

This policy stips the password change from the XML Document and writes it directly to the other tree causing NMAS to set and expire the password immediately.

The “Password Expiration” attribute is then updated from the XML document.

Password Sync with Win3K

Windows 2003 by default enables strong password policies causing passwords being sync'd from eDirectory to fail.

“NOT DEFINED” means “Enabled”.

Either make the eDirectory password policy more restictive or the Active Directory password policy less restrictive.

When changing the ActiveDirectory Password policies, Windows must update the policy before it will take effect.

Reboot the server

gpupdate /force

Password Sync with Win3K

MISC NMAS ISSUE...

When using NMAS version 2.3.4 or ealier, applications that set their own passwords were subject to password policies.

Printers

ZenObjects

Fix: NMAS 2.3.5 and greater

Saverio Guido

2005-01-18T10:32:04