Solved

Defaulting authentication out of Workstation Lock

Posted on 2006-07-13
2
575 Views
Last Modified: 2008-02-26
OK this is a bit of an odd one. We are a shop that runs Netware/2000AD. Primarily we rely on Netware for things like password security policies and such; the AD is just there mainly to make workstation management easier and some basic Group Policy stuff.

One of the GP's we do have is an automatic screen saver lock after 15 minutes, which the users hate of course, but we are a medical school so HIPAA is scaring the crap out of everyone. One problem we are seeing, however, involves password expirations.

A scenario: A user logs in at 8am in the morning. Their password is set to expire today, but by chance the expiration date and time is not until 10am this morning, so when they log in they are not yet prompted to change their password. Throughout the day their screen locks a number of times, forcing them to re-authenticate with their NDS credentials when they want back in, each time decrementing their Grace Logins. If this happens enough times during the day, they eventually get locked out, and have to call the Help Desk. Of course techs don't always immediately recognize what the true problem here is, and given what we know about users it's not hard to imagine how this sometimes becomes a big mess.

Now, the Novell client by default prompts for the NDS credentials when you want to unlock the PC, but what we're wondering is if there is a way to get the client to automatically prompt for the Windows credentials instead. We have identity management which auto-pushes NDS password changes to the AD, so they are always the same. However, we don't actively enforce password ages on the AD side (relying on NDS to get them changed regularly), so if users were always unlocking their PC's using Windows credentials, in theory they wouldn't be continually burning their grace logins on the NDS password, and in cases where a password expires after a user has already logged in on a particular day, they just get prompted to change the next day when they login.

Obviously this isn't a situation that comes up very often, but it does happen. Of course users could simply select Windows authentication instead of Novell, but training them to do this, and expecting them to always remember to do so, doesn't seem feasible. A quick browse through the Novell client properties does not turn up anything that looks promising, and some initial Google's did not turn up anything either. Wondering if anyone has dealt with anything like this before?
0
Comment
Question by:mvogts
2 Comments
 
LVL 35

Accepted Solution

by:
ShineOn earned 500 total points
ID: 17104715
So the problem is that they're not notified that their password has expired if they use the password to unlock the screensaver, but it still logs as a grace login, but if they use their Windoze credentials (which are kept in sync with their eDirectory credentials I assume) they unlock and are still connected, so they don't take up any grace logins?

Just curious, as a medical school concerned with hipaa, why not use Novell's SecureLogin product instead of Windoze GPO?  I'd think it would be a more secure, hipaa-compliant way to do it... plus it could also be set to force an orderly, safe  logoff/shutdown process after being idle / locked for whatever additional time period you set, closing the programs for you and everything...  Way more compliant.

Anyway.

There is a registry tweak available with reasonably-current versions of the Novell Client called "simple unlock" that will force the unlock dialog to only allow one way or the other instead of giving the option box.  If you create the following key/value:

[HKEY_LOCAL_MACHINE\SOFTWARE\Novell\Login]
"Simple Unlock"=dword:00000000

it will behave as it does normally (zero is same as default.)  To force eDirectory or Bindery only, set the dword value to 00000001, if you want Windoze auth only, set it to 00000002.

Here's a TID that explains it better: http://support.novell.com/cgi-bin/search/searchtid.cgi?10059068.htm
0
 

Author Comment

by:mvogts
ID: 17107719
Yes, you essentially nailed it. I don't have time right at the moment to test out your suggestion there but it looks promising, going to go ahead and award the points. Thanks a bunch.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Can a GroupWise Archive be converted to a PST file WITHOUT a GW system? 4 529
How to log on a machine in XP mode in win7 8 563
IPX/SPX on Windows 7 (64-bit) 6 12,217
iPrint Error 0x406 12 1,279
Cloud-based technologies and services will continue to grow in popularity in 2017 thanks to the simple, scalable and cost-effective solutions they deliver. Here are three areas where cloud adoption is poised to really take off.
In 2017, ransomware will become so virulent and widespread that if you aren’t a victim yourself, you will know someone who is.
This Micro Tutorial will teach you how to censor certain areas of your screen. The example in this video will show a little boy's face being blurred. This will be demonstrated using Adobe Premiere Pro CS6.
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now