Re: iSeries domain logon support -- MIDRANGE-L

Tom,

If you are talking about how I have been doing it for years (not at 6.1
yet) then yes.

You are talking about loading PLC4.5 onto the clients.

On 7/10/2009 3:20 PM, Tom arranged the binary bits such that:

We have a new v6r1 box, model M15. In the infocenter documentation, there's
info how to setup and configure the iSeries to provide Domain Logon support
(http://publib.boulder.ibm.com/iseries/v5r2/ic2924/index.htm?info/rzahl/rzah
ldmnlogonspt.htm). As I understand it, this would essentially allow me to
remove the Win2K server (running on an IXS on an old 400) out of our
network. The Win2K server on the iXS is the primary domain controller, and
that's really all it's used for (no DHCP, no DNS, etc).

Apparently, in order for the user PCs (all XP at this time) to be able to
login to the domain I'll need to install/configure client software on each
PC; ok, no biggie, I can do that.

You are talking about loading PLC4.5 onto the clients aren't you? The
biggest trick is finding the place to download it, as it was designed
for OS/2 servers a loonnnggg time ago. If you are talking about
different client software I would like to know exactly what it is.

Brings up some questions:

- What if the user can't authenticate to the iSeries domain
controller? Will they be 'locked out' of the PC until they do network
authentication, or will they be logged in using a stored copy of their
Windows user profile, or will something else happen?

PLC4.5 doesn't cache credentials so they won't be able to login. You
have to jump through some difficult hoops if you want folder
redirection, server stored Group Policies, server stored profiles (not
just *USRPRF but settings and such)... If you want the users to have
administrator rights on the PC you will have to create a local profile
that exactly matches the i5/OS profile. They will still login to the
domain but will have the local rights. If they login to the local user
it will be a separate set of local files though.

No matter the documentation and registry entries the "home" folder will
always be the next highest drive letter. USB drives plugged in will
mount as the next highest drive letter (unless you use disk manager or
special software) and cause a real mess. You have to disconnect the
"home" drive to access the USB drive or use disk manager to reassign the
drive letter to the mounted USB.

Also, I haven't tried changing the i5/OS password level to try long
passwords yet. If you do let me know how it goes.

- What if we upgrade client systems from XP to Vista or Windows 7?

Haven't allowed Vista in the shops yet. I had one bank IT manager (i5/OS
for the banking plus some W2k3 servers) try it on his personal PC and
outright banned Vista from the bank.

Tom

Roger Vicker, CCP