Solved

Defaulting authentication out of Workstation Lock

Posted on 2006-07-13
2
577 Views
Last Modified: 2008-02-26
OK this is a bit of an odd one. We are a shop that runs Netware/2000AD. Primarily we rely on Netware for things like password security policies and such; the AD is just there mainly to make workstation management easier and some basic Group Policy stuff.

One of the GP's we do have is an automatic screen saver lock after 15 minutes, which the users hate of course, but we are a medical school so HIPAA is scaring the crap out of everyone. One problem we are seeing, however, involves password expirations.

A scenario: A user logs in at 8am in the morning. Their password is set to expire today, but by chance the expiration date and time is not until 10am this morning, so when they log in they are not yet prompted to change their password. Throughout the day their screen locks a number of times, forcing them to re-authenticate with their NDS credentials when they want back in, each time decrementing their Grace Logins. If this happens enough times during the day, they eventually get locked out, and have to call the Help Desk. Of course techs don't always immediately recognize what the true problem here is, and given what we know about users it's not hard to imagine how this sometimes becomes a big mess.

Now, the Novell client by default prompts for the NDS credentials when you want to unlock the PC, but what we're wondering is if there is a way to get the client to automatically prompt for the Windows credentials instead. We have identity management which auto-pushes NDS password changes to the AD, so they are always the same. However, we don't actively enforce password ages on the AD side (relying on NDS to get them changed regularly), so if users were always unlocking their PC's using Windows credentials, in theory they wouldn't be continually burning their grace logins on the NDS password, and in cases where a password expires after a user has already logged in on a particular day, they just get prompted to change the next day when they login.

Obviously this isn't a situation that comes up very often, but it does happen. Of course users could simply select Windows authentication instead of Novell, but training them to do this, and expecting them to always remember to do so, doesn't seem feasible. A quick browse through the Novell client properties does not turn up anything that looks promising, and some initial Google's did not turn up anything either. Wondering if anyone has dealt with anything like this before?
0
Comment
Question by:mvogts
2 Comments
 
LVL 35

Accepted Solution

by:
ShineOn earned 500 total points
ID: 17104715
So the problem is that they're not notified that their password has expired if they use the password to unlock the screensaver, but it still logs as a grace login, but if they use their Windoze credentials (which are kept in sync with their eDirectory credentials I assume) they unlock and are still connected, so they don't take up any grace logins?

Just curious, as a medical school concerned with hipaa, why not use Novell's SecureLogin product instead of Windoze GPO?  I'd think it would be a more secure, hipaa-compliant way to do it... plus it could also be set to force an orderly, safe  logoff/shutdown process after being idle / locked for whatever additional time period you set, closing the programs for you and everything...  Way more compliant.

Anyway.

There is a registry tweak available with reasonably-current versions of the Novell Client called "simple unlock" that will force the unlock dialog to only allow one way or the other instead of giving the option box.  If you create the following key/value:

[HKEY_LOCAL_MACHINE\SOFTWARE\Novell\Login]
"Simple Unlock"=dword:00000000

it will behave as it does normally (zero is same as default.)  To force eDirectory or Bindery only, set the dword value to 00000001, if you want Windoze auth only, set it to 00000002.

Here's a TID that explains it better: http://support.novell.com/cgi-bin/search/searchtid.cgi?10059068.htm
0
 

Author Comment

by:mvogts
ID: 17107719
Yes, you essentially nailed it. I don't have time right at the moment to test out your suggestion there but it looks promising, going to go ahead and award the points. Thanks a bunch.
0

Featured Post

Salesforce Made Easy to Use

On-screen guidance at the moment of need enables you & your employees to focus on the core, you can now boost your adoption rates swiftly and simply with one easy tool.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

With User Account Control (UAC) enabled in Windows 7, one needs to open an elevated Command Prompt in order to run scripts under administrative privileges. Although the elevated Command Prompt accomplishes the task, the question How to run as script…
When it comes to protecting Oracle Database servers and systems, there are a ton of myths out there. Here are the most common.
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
I've attached the XLSM Excel spreadsheet I used in the video and also text files containing the macros used below. https://filedb.experts-exchange.com/incoming/2017/03_w12/1151775/Permutations.txt https://filedb.experts-exchange.com/incoming/201…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question