[22224] in Kerberos
Re: Problem changing expired Windows 2000 passwords
daemon@ATHENA.MIT.EDU (Jeffrey Altman)
Wed Aug 18 13:32:03 2004
From: Jeffrey Altman <jaltman2@nyc.rr.com>
Message-ID: <uQLUc.34$Ot3.24@twister.nyc.rr.com>
Date: Wed, 18 Aug 2004 16:53:46 GMT
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
This behavior is a Windows 2000 bug which will not be fixed.
You must log in as
user@DOMAIN
to avoid the bug.
Jeffrey Altman
rodolfo@ime.unicamp.br wrote:
> Hi!
>
> I don't used AddKpasswd when I ran ksetup.exe. I tried to do it now, but
> it still not working.
>
> But... running tcpdump, I saw that the client asks my DNS server for
> something. Putting bind to log queries, I saw:
>
> query: _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.ROOT.
> IME.UNICAMP.BR IN SRV
> query: _ldap._tcp.dc._msdcs.ROOT.IME.UNICAMP.BR IN SRV
> query: _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.ROOT.
> IME.UNICAMP.BR IN SRV
> query: _ldap._tcp.dc._msdcs.ROOT.IME.UNICAMP.BR IN SRV
>
> ROOT.IME.UNICAMP.BR is our main kerberos realm (since our workstations
> was at .ime.unicamp.br domain, and Windows 2000 use the domain as its
> kerberos realm, we done it this way to preserve our original domain name
> for all workstations and be able to use cross-realm auth. with our MIT
> realm).
>
> As it uses to do, windows is looking for my MIT KDC asking to a domain
> with the realm's name.
>
> Btw: I tried to build the ROOT.IME.UNICAMP.BR zone at DNS and put SRV
> records for my (MIT) KDC, but it did not work. I tried putting SRV
> records for the ADS too (as ldap), but it still not working...
>
> .... some idea??
>
> Tnks in advice!!
>
> []s!
> Rodolfo
>
>
>>When you ran ksetup on a client did you use the /AddKpasswd option?
>>
>>It could be that SP1 is using the "older administrative protocol" which
>>was used by the v5passwdd. You might try running v5passwdd.
>>
>>I say this as I know the older krb5.exe on windows had a password change
>>option, and the krb5.exe could talk to AD to change a password in AD. So
>>Microsoft may have implemented the other direction as well,
>>and allow a Windows machine to change a password in an MIT realm,
>>but you may have to use the /AddKpasswd option to tell it where it is.
>
>
>
>
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
--
-----------------
This e-mail account is not read on a regular basis.
Please send private responses to jaltman at mit dot edu
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
