MSLogon fallback to VNC Standard password

localj · Post by **localj** » 2005-04-18 06:34

Howdy,

Quick question on RC19.4 running on Windows XP Pro SP2. I have setup both MS Logon and VNC Standard authentication. I can get either to work but not both. I would like MS Logon authentication to fallback to Standard when the domain is unavailable.

Is this possible? Am I missing something obvious?

Reason: Dialin in users who need help can't contact the domain for MS Logon authenication to work. So we cant remote them to help them.

Cheers

Guest · Post by **Guest** » 2005-04-18 07:37

Not possible.

vnc passwd use a single 8 char passwd
ntlogon use user/32 char passwd

When you should fallback to vnc passwd there is no reason
to activate mslogon, the security is a 8 char passwd.

Marscha · Post by **Marscha** » 2005-04-19 05:36

You could add a local user to the MSLogon groups.
In case the domain is not available, this account could be used for authentication.

Guest · Post by **Guest** » 2005-04-21 00:29

Yes a local user would work but I can't see how to add say, the local administrator for every PC in the organisation in an automated way eg. add a registry entry in a login script.

If I add it for PC PAUD0001 then the user shows up as PAUD0001\Administrator

If I add it for PC PAUD0002 then the user shows up as PAUD0002\Administrator

I will have bit more of a think about it.

Marscha · Post by **Marscha** » 2005-04-21 06:10

With MSLogon II, you can use MSLogonACL:
http://doc.uvnc.com/features/authentica ... mslogonacl
I added two abbreviations for special cases:
A dot (.) is replaced with the computername, two dots (..) with the computer's domainname.
So you should have a file acl.txt:

Code: Select all

allow 0x3 .\Administrator

and do

Code: Select all

mslogonacl /i /o acl.txt

On PC PAUD0001 this will add PAUD0001\Administrator, on PAUD0002 this will add PAUD0002\Administrator.

Be aware that some groups like Administrators (or Users) are not Computername\Administrators.
Their fully qualified name is BUILTIN\Administrators.
In addition if you have a localized OS (french, german, japanese ...) this prefix is also localized!
That's Microsoft

So configure one machine via the GUI dialog and export the ACL.
Then you see what the correct names are.

sbostedor · Post by **sbostedor** » 2005-05-12 14:26

Guest,

Does your network use a central authentication scheme such as Active Directory or NT4 domain?