Re: Very odd routing issue: accesses share outside of domain

"Kelsen Depp" <> wrote in message
news:...
>
> We have 13 pc workstations in a domain with one server running server
> 2008. All PCs run XP. A personal iMac is also connected to the network
> but not really apart of the domain, though it accesses the internet and
> printers on the domain. When trying to connect one particular
> workstation to the shared printer on another particular workstation, the
> printers connected to the iMac come up instead. This did not used to
> happen.
>
> A little more info: Right before this started happening I replaced our
> 2003 server box with a new server 2008 box. The workstation that is
> having the trouble is apart four identical workstations in our reception
> area. Each runs XP with the latest updates. The same user account is
> used to log into all three. Reception1 has a local printer connected to
> it that all four share. One of them stopped being able to access the
> printer with an "Access Denied" error displayed in Printers under the
> Control Panel. I navigated to Network Places > Entire Network >
> Reception1 It asked for credentials, which was odd because the same
> credentials are used for each of these 4 computers, so I entered them
> again. Then it opened like I would expect, but displayed the local
> printers connected to the iMac instead of the local printer on
> Reception1. The only seems to happen from the Reception3 computer and
> not the others.
>
> This same thing happened last week. I temporarily solved it by turning
> the iMac off then accessing Reception1's shared printer from Reception3
> again. That time it went correctly through without asking for
> credentials and displayed the correct shared printer.
>
> The server handles DHCP, DNS, DC, AD, etc.
>
> Any ideas on where the problem may lie? Is there any more information
> or diagnostic tests I could run that would be helpful?
>
>
> --
> Kelsen Depp


I don't know much about the iMac, but there must be a way to disable it from
participating with the Windows Browser service, which appears to be what's
going on. It must be winning the election, which doesn't seem possible
considering the OS version. By rights, a workstation shouldn't be
participating wtih the Browser service anyway.

A note on the same user accounts being used - The fact that you are using
the same account on multiple machines doesn't have anything to do with it,
however, I question the logic behind that. Each user should have their own
credentials, at least in my book, and based on best practices and security
practices.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.

Ace Fekay, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE & MCSA
2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer

For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.

"Kelsen Depp" <> wrote in message
news:...
>
> In our environment using separate credentials for all of the employees
> would be too cumbersome for little gain. The five employees who work
> the reception area all need fast access to any of the computers as they
> do not have designated location. The only software they really use is a
> proprietary management software that they do have individual user
> accounts for. It is very fast pace, and logging on an off, in addition
> to logging on and off of the management software, every time they change
> locations would take way to much time.
>
> But thank you for the suggestion. I'm not sure how to go about
> disabling the iMac from the browser service. This morning I tried
> setting a static IP address on the iMac outside of the DHCP range, but
> have not tested it yet.
>
>

You are welcome for the suggestions.

As for the iMac, you have to find out how to disable it from participating
with the Windows Browser service. It may be something as simple as turning
off Network File and Print services, which is normally used to enable
sharing of its files and printers, which also allows it to broadcast out
services. It appears that enabling File and Print services turns on the
Browser service/daemon, but not sure why it does that other than assuming
you would want to shaer out stuff, but even still, why does it assume to win
the election? In your case, you do not need the iMac to share out anything.
Read the following to get a better idea of what is happening. If that
doesn't work, I suggest to post to the Apple forums.

http://discussions.apple.com/thread....readID=1277379

Ace

"Bill Kearney" <> wrote in message
news: t...
>> In our environment using separate credentials for all of the employees
>> would be too cumbersome for little gain. The five employees who work
>> the reception area all need fast access to any of the computers as they
>> do not have designated location. The only software they really use is a
>> proprietary management software that they do have individual user
>> accounts for. It is very fast pace, and logging on an off, in addition
>> to logging on and off of the management software, every time they change
>> locations would take way to much time.
>
> So use a terminal server instead. That way they can log into a session on
> that box. They can each then have their own account with appropriate
> security. The sessions can stay logged in as they switch around. Works
> quite well in situations like that.
>
>> But thank you for the suggestion. I'm not sure how to go about
>> disabling the iMac from the browser service.
>
> edit the /etc/smb.conf file
>
>> This morning I tried
>> setting a static IP address on the iMac outside of the DHCP range, but
>> have not tested it yet.
>
> That will do nothing to help. If it's in the same subnet then the address
> won't make a difference. Leave it on dynamic. Also, make sure the DHCP
> range is large enough to accommodate the total number of devices that need
> an address.


So it's that easy to disable browser participation in the smb.conf file?
Curious, what setting is it?

Ace

"Bill Kearney" <> wrote in message
news: t...
>>> edit the /etc/smb.conf file
>>>
>> So it's that easy to disable browser participation in the smb.conf file?
>> Curious, what setting is it?
>
> Since it's just running samba it ought to be as simple as editing the
> local, domain and preferred master settings.
>
> In 10.6 it appears to only set 'domain master = no'
>
> Though I'm not sure to what extent edits done directly to the text file
> will conflict with later UI access.
>
>



From the looks of the setting, I would imagine it would just disable browser
service participation, and not affect the UI. :-)

Ace

"Bill Kearney" <> wrote in message
news: t...
>
>>> Though I'm not sure to what extent edits done directly to the text file
>>> will conflict with later UI access.
>>
>> From the looks of the setting, I would imagine it would just disable
>> browser service participation, and not affect the UI. :-)
>
> I've not tried, either way. But Apple is notorious for doing things that
> destroy anything done outside their UI-based tools. But since they have
> no enterprise tools for doing this then manual edits are the only way.
>
> Dynamic browsing sucked when it was implemented, who'da thunk it'd still
> be such a pain in the ass decades later?


Yea, I agree. OSx was never truly "enterprise" ready, especially if Apple
'assumes' to set configs this way that can interfere with normal Windows
functionality. I would imagine if using WINS and the WINS address was
configured in the OSx, that it wouldn't cause issues since it will query
WINS, however in a scenario as described in this thread, being a workgroup,
the OSx seems to want to send out an election and take over as the browse
master all the time.

Oh well...

Ace