(Getting the hang of it)

2002-07-04 07:43 AM

InGroup + Global Groups

Hi,
I have the following problem:
The Domain into which the users login, is on server1, and the batch file defined for them calls kix script, which is on server2.
Kxrpc service is installed in server1.

The problem is that InGroup for any global group defined for the users failes, though local groups are identified correctly.

Thanks,
V.F.

Administrator

(KiX Master Guru)

2002-07-04 08:32 AM

Re: InGroup + Global Groups

so, why you don't install the rpc service also on server2?

cheers,

[ 04 July 2002, 08:32: Message edited by: Lonkero ]

(Getting the hang of it)

2002-07-04 09:28 AM

Re: InGroup + Global Groups

I tried.
It doesn't help.

(Getting the hang of it)

2002-07-04 09:29 AM

Re: InGroup + Global Groups

P.S.
I encounter this problem only on win95 workstations.

Administrator

(KiX Master Guru)

2002-07-04 09:36 AM

Re: InGroup + Global Groups

mmm...
now rereading your post pops up to my mind something.
windows 95 does not understand the difference between these two... or something like that.

what if you try with:
ingroup("globalgroup_name")

it should return the same as with
ingroup("localgroup_name")

(KiX Supporter)

2002-07-04 09:37 AM

Re: InGroup + Global Groups

On the other server that it does not work on.. Is it the same version of KXRPC as the one that it does work on? May seem like a silly question on this new server, did you start the new KXRPC service too?

Do the client(s) have access to:
KX16.DLL
KX32.DLL
KX95.DLL

as well as KIX32.EXE and are all of these DLLs/EXEs of the same version?

Regards,

Kent

(Getting the hang of it)

2002-07-04 10:20 AM

Re: InGroup + Global Groups

The global groups are still not identified.
Workstations has the three dlls, and kix versions are the same.
kxrpc is in status running on both servers.

Thanks,
V.F.

Administrator

(KiX Master Guru)

2002-07-04 10:34 AM

Re: InGroup + Global Groups

mmm...
went to faq and found that if kixrpc is not working the local groups are not workable!
so, the service is running fine...

did you get the groups before you installed the rpc or did you install it before trying without?

cheers,

(Getting the hang of it)

2002-07-05 12:26 AM

Re: InGroup + Global Groups

same results.

(Getting the hang of it)

2002-07-05 12:27 AM

Re: InGroup + Global Groups

Now,
for some odd resons i even don't get the local groups!

(Getting the hang of it)

2002-07-05 12:29 AM

Re: InGroup + Global Groups

I mean, after starting kixtart again

(Getting the hang of it)

2002-07-05 12:30 AM

Re: InGroup + Global Groups

I mean, after starting kxrpc on both servers.

Administrator

(KiX Master Guru)

2002-07-05 12:48 AM

Re: InGroup + Global Groups

huh...
is there something wrong or what [Big Grin]

[Big Grin]

hey, try out:
kix32 /f

{edit}
btw, the kixtart rpc service is needed only on one machine says doc.

[ 04 July 2002, 12:58: Message edited by: Lonkero ]

(Getting the hang of it)

2002-07-04 01:56 PM

Re: InGroup + Global Groups

No difference what so ever

Administrator

(KiX Master Guru)

2002-07-04 02:02 PM

Re: InGroup + Global Groups

what if you un-install the client things of rpc?
like, take out all the kix-dll's and if you have made registry setttings or ini-file or in logon batch set environment for kixrpc...

when you get those all out restart the machine and query the globalgroup it should answer.
if not, then there must be something wrong with the system as it works for others...

cheers,

(KiX Master)

2002-07-04 03:03 PM

Re: InGroup + Global Groups

Terminology questions:

You say the domain is on server 1, so that will mean that the Primary Domain Controller is server1. Is server2 a Backup Domain Controller? If yes, then all Domain Controllers will need the KiXtart RPC service.

Secondly, enable directory replication to replicate the logon script into all NETLOGON folders on all domain controllers.

Thirdly, use a LOGON.BAT file to call the KiXtart script and use a simple test script like

code:

if ingroup("globalgroup_name")
 ? 'is in group'
else
  ? 'is not in group'
endif

Also, check the KiXtart Starter's Guide in the FAQ section.

Administrator

(KiX Master Guru)

2002-07-04 03:13 PM

Re: InGroup + Global Groups

jens?

quote:
will need the KiXtart RPC service

where did you get that.
anyway, you are right, it's good to put it on all DC's.

cheers,

(KiX Master)

2002-07-04 05:39 PM

Re: InGroup + Global Groups

Lonkero, if I understood correctly, the problem is with Windows 9x clients. Therefore, the recommended installation is to put the KXRPC on all DC. See KXRPC - Everything you wanted to know about KXRPC.

(KiX Master)

2002-07-04 09:39 PM

Re: InGroup + Global Groups

zz...
Are there DLLs in the same folder as where KiX is called from? Also, is there a NetWare client on the Wintendos?

Administrator

(KiX Master Guru)

2002-07-04 10:15 PM

Re: InGroup + Global Groups

jens, you are right like I said. it's recommended but you said:
"If yes, then all Domain Controllers will need the KiXtart RPC service."

and I catched your words as it's not needed.
just recommended.
for more specific explanation see:
http://81.17.37.55/board/ultimatebb.php?ubb=get_topic;f=10;t=000023
the part 2 has more than one option. [Roll Eyes]

[Roll Eyes]

cheers,

(Getting the hang of it)

2002-07-07 10:33 AM

Re: InGroup + Global Groups

Server2 isn't a domain controler.
It's just a file server, and the login script files are on it.

Batch file on server1 calls it.
There are no other dlls, besides the 3 dlls of kix (which are copied to the client if needed).

Thanks,
V.F.

(KiX Supporter)

2002-07-07 03:06 PM

Re: InGroup + Global Groups

Please post your batch file, logon script that are executed from the domain controller, and logon script executed from the member server. Please post the data you have placed in the Logon Script property of the user account (User Manager). How are you calling the script from the member server?

Why are you trying to run logon scripts from a member server? Please descibe your domain architecture.

I believe that you may not fully understand how logon scripts are called and executed on various clients.

Kixtart Starter's Guide

[ 07 July 2002, 15:24: Message edited by: Howard Bullock ]

(Getting the hang of it)

2002-07-07 07:53 PM

Re: InGroup + Global Groups

The architecture is as follows:
server1 is a domain controller.
kxrpc installed and running on server1.
server2 is a file server.

In user manager, user profile, logon script name, defined a.bat, which is on server1.

a.bat calls b.bat on server2.
b.bat copies the 3 kix dlls, if doesn't exist to the client and calls kix with 1.scr.
1.scr uses ingroup to check user membership in one of the groups.
Neither local, nor global groups are identified for a user defined in the domain on server1.

Thanks,
V.F.

(KiX Supporter)

2002-07-07 08:02 PM

Re: InGroup + Global Groups

Why are you calling a second batch file from your initial "a.bat" file? When you call "b.bat" are you using the batch "call" command (example: call b.bat)? Is server server2 in the same domain as server1?

Why are you being so cryptic? Why won't you post the problem code so that we can see if you have a coding issue?

(Fresh Scripter)

2002-07-07 08:12 PM

Re: InGroup + Global Groups

I know this problem, but i don't know the solution. Not yet!

I've played with this serveral times. Tested it with Local and Global groups and the InGroup function and only returns true if Local. No memebership of Global groups are true, though they are.

If I rename the KX95.dll or stop the service, it returns true if member of a Global group, but then no Local memberships are true although they are.

A good point there, installing the KXRPC service on all DC's. It's the first thing i'll tommorow.

Ryan

(KiX Supporter)

2002-07-07 08:25 PM

Re: InGroup + Global Groups

The INGROUP function works with both global groups in the logon domain and local groups in multiple resource domains from all operating systems. I can not understand why either of you have this problem. That is why everyone is asking for the details of the architecture and the code used in the tests.

We can not understand your situation without the details of the environment and code.

(Fresh Scripter)

2002-07-07 09:16 PM

Re: InGroup + Global Groups

Howard,

I have the following question; Do you have a mixed situation? I mean do you have both 9x and NT clients?

Maybe your talking pure hypothetically, cuz theoretically everything works, but "life" is also about experience.

Ryan

Administrator

(KiX Master Guru)

2002-07-07 09:22 PM

Re: InGroup + Global Groups

ryan took my words on that question.

hoby, have you tested separately on win95/win98 machines that it's working correctly.

but about the problem, ryan yours is different.

can't still say though what might be the issue as no script posted nor batches...

can't test it anywhere as I don't use rpc-service as it does not fit to administration policy to help w9x clients to come along.

cheers,

(KiX Supporter)

2002-07-07 09:24 PM

Re: InGroup + Global Groups

My KiXtart script supports Win95, Win98, Me, NT4, Win2000, and XP. To date we have not found any INGROUP issues other than the functional change brought about in KiXtart 4.x

RESOLVED - BUG Help 4.01 INGROUP Failures

[ 07 July 2002, 22:07: Message edited by: Howard Bullock ]

(Getting the hang of it)

2002-07-08 10:08 AM

Re: InGroup + Global Groups

Here is the code:

code:

a.bat:
rem echo off
echo calling b.bat
pause
call \\server2\netlogon\b.bat
echo after b.bat
pause

code:

b.bat:
rem echo off
set SERVER=server2
if not exist %windir%\system\kx16.dll copy \\%SERVER%\netlogon\kx16.dll %windir%\system
if not exist %windir%\system\kx32.dll copy \\%SERVER%\netlogon\kx32.dll %windir%\system
if not exist %windir%\system\kx95.dll copy \\%SERVER%\netlogon\kx95.dll %windir%\system
if not exist %windir%\system\kx16.dll goto COPY_ERROR
if not exist %windir%\system\kx32.dll goto COPY_ERROR
if not exist %windir%\system\kx95.dll goto COPY_ERROR
\\%SERVER%\netlogon\kix32 \\%SERVER\netlogon\script.scr /e:1024
goto EXIT
:COPY_ERROR
   echo unable to copy dlls.
   pause
:EXIT

code:

script.scr:
select
       case InGroup("Domain Users")
            "in Global Group" ?
       case InGroup("Guests")
            "in Local Group"
endselect
"end of select" ?
get $dummy

Domain Users is a global group, and guest is a local group.
the user is member of both groups, yet only "end of select" is being printed to the output.

Thanks,
V.F.

{edit}
[Howard Bullock] Edited text to include code tags.

[ 08 July 2002, 13:09: Message edited by: Howard Bullock ]

(Getting the hang of it)

2002-07-08 10:09 AM

Re: InGroup + Global Groups

I mean Guests group.

Administrator

(KiX Master Guru)

2002-07-08 10:19 AM

Re: InGroup + Global Groups

could you also make your scr to:
? "ingroup returns for domain users:"
InGroup("Domain Users")
? "with errorcode:" @error
? "ingroup returns for Guests:"
case InGroup("users") ;changed the group
? "with errorcode:" @error
get $dummy

also, if you could use test with user only on domain users not guests.
I changed the script as don't like the idea of a user belonging to guests and users at the same...

this also can cause the problem as guests group is a restrictive...

(KiX Supporter)

2002-07-08 04:15 PM

Re: InGroup + Global Groups

I have tested your KiXtart code on one of my Win95 computers. The script outputs the I am in the "Domain Users" group.

I do not believe that your batch files have any bearing on your particular issue. Try executing your script after logon:

Kix32 \\server\share\script.scr

Did the script behavior change? Also have you applied any network component updates to tyour client? If not and your script still fails, I would recommend that you find and apply updates to your client and retest.

Please add a "Case 1" line and output if both previous CASE tests fail.

[ 08 July 2002, 16:26: Message edited by: Howard Bullock ]

(Getting the hang of it)

2002-07-09 10:08 AM

Re: InGroup + Global Groups

Scripts behaviour remains the same when executing after logon.
No network updates were performed recently.
@error, after the case, returns 0.
case 1 is executed correctly.

Thanks,
V.F.

Administrator

(KiX Master Guru)

2002-07-09 11:04 AM

Re: InGroup + Global Groups

zz, please, leave the case out of it and check error of the group membership functions.

(Getting the hang of it)

2002-07-10 10:42 AM

Re: InGroup + Global Groups

Error returns 0.

I forgot to mention that there's another domain on server2.
Does it metter?

Here's the correct architecture:
server1 is a domain controller, to which users login.
server2 is a file server where the kix script files are positioned. It also conatins, because of historical reasons, an old domain, to which no one logins.

For each user in the domain of server1 defined a.bat, which calls b.bat on server2, which calls the kix script.

Thanks again,
V.F.

Administrator

(KiX Master Guru)

2002-07-10 10:45 AM

Re: InGroup + Global Groups

zz, if no users logon to that old domain, why don't you make it normal member server in the new domain?

cheers,

(Getting the hang of it)

2002-07-10 10:59 AM

Re: InGroup + Global Groups

There's trust relathionship between the two domains, so I fon't think it metters...

Administrator

(KiX Master Guru)

2002-07-10 11:27 AM

Re: InGroup + Global Groups

zz, did you try it with:

? "ingroup returns for domain users:"
InGroup("Domain Users")
? "with errorcode:" @error
? "ingroup returns for Guests:"
InGroup("users") ;changed the group
? "with errorcode:" @error
get $dummy

?

(Getting the hang of it)

2002-07-11 12:26 AM

Re: InGroup + Global Groups

Exactly this code.
I got zeroes for ingroup & @error

Administrator

(KiX Master Guru)

2002-07-11 12:37 AM

Re: InGroup + Global Groups

ok...
so going for more. test the macros. do a script similar to this:

?"KIX @KIX"
?"WUSERID @WUSERID"
?"USERID @USERID"
?"DOMAIN @DOMAIN"
?"LDOMAIN @LDOMAIN"
?"FULLNAME @FULLNAME"
?"COMMENT @COMMENT"
?"HOMESHR @HOMESHR"
?"PRIV @PRIV"
?"PRIMARYGROUP @PRIMARYGROUP"
?"LSERVER @LSERVER"
?"LDRIVE @LDRIVE"

and what is the result?

also, didn't find in this thread anything about version. what is your kix version?

cheers,

(KiX Supporter)

2002-07-10 01:08 PM

Re: InGroup + Global Groups

The users logon to the domain of server1, correct? Are you trying to see if the user is a member of a global group in the domain of server2?

Please tell use which domain the groups belong to.

(Fresh Scripter)

2002-07-10 02:18 PM

Re: InGroup + Global Groups

I just wanna give feedback about my problem, descripted earlier. And thank you all for your support. My problem is solved.

I want to point the need of the KXRPC service on all dc's, although the manual says, it's not neccesary but recommended. My opinion is, that it's needed on all dc's.

Info;
-Domain called VANDRA
-PDC called VANDRA00
-BDC called VANDRA01
-BDC called VANDRA05

This was the situation:
I'd only installed the KXRPC service on Vandra00, the PDC, and made an KiXtart.ini file in the Netlogon Share's.

[KXRPCMapping]
VANDRA=\\VANDRA00
Default=\\VANDRA00

This is what the ini-file looked like. I'd used the following code to test the membership;

code:

If InGroup("Beheerders") = 1 ; Local Group
    ? "A member of Local Group!"
Else
    ? "Not a member of Local Group!"
EndIf

If InGroup("Domein Beheerders") = 1 ; Global Group
    ? "A member of Global Group!"
Else
    ? "Not a member of Global Group!"
EndIf

My problem was, that I couldn't reach the Global Groups with the service on, but could reach the Local Groups. When I turned the service off, I could reach the Global Groups again, but not the Local Groups. And ofcourse I'm a member of both groups. So I didn't use the service.

This is my new situation:
I've installed the KXRPC serive on all DC's. And deleted the KiXtart.ini file. And quess what. . ., it worked fine! All domain info is returned correctly for the few Windows 9x workstations on our domain.

Ryan

(KiX Master)

2002-07-10 03:22 PM

Re: InGroup + Global Groups

That's why pretty much everybody (at least the power KiXtarters) on this board STRONGLY recommends to install the KiXtart RPC service on all domain controllers. It solves a lot of trouble-shooting time when Windows 9x clients are involved. Besides, I am not aware of any kind/type/shape of adverse effect runnign that particular service on the domain controllers.

(Getting the hang of it)

2002-07-10 05:20 PM

Re: InGroup + Global Groups

I just founf out something really interesting:
In c:\windows\temp I found kixtart.log.
In kixtart.log was the following line:
"Error occured during retrieval of network information: Access is denied. (0x5/5)"

To what network resourses does kix need access?

(KiX Supporter)

2002-07-10 06:58 PM

Re: InGroup + Global Groups

You stated that you are logging on to the domain at server1.

Again, please tell if the global groups that are failing are in the domain on server1 or the domain of server2.

Since the "logon domain" is that of server1 (I wish zz_vf_zz would give use some names to reference), the KXRPC service is not needed on server2 because it is not a DC in the logon domain.

We still do not know what version of KiXtart you are using. Please execute the code (macro printouts) supplied by Lonkero so that we have additional information with which to help understand what may be wrong here.

[ 10 July 2002, 18:59: Message edited by: Howard Bullock ]

(Getting the hang of it)

2002-07-11 07:34 AM

Re: InGroup + Global Groups

O.K. server1 = LogonServer;
server2 = FileServer

Almost all the macros return blank, except:
KIX 3.47
PRIV Guests
LSERVER FileServer
LDRIVE Z:

The groups that are failing defined in the domain of LogonServer.
There is no problem with groups defined in the domain of FileServer (If I define a temp user in domain of FileServer, and logon to it, I get both global groups and local groups correctly)
The users are defined in the domain of LogonServer.
Again, domain on FileServer is just for historical reasons.

Thanks,
V.F.

(Getting the hang of it)

2002-07-11 07:45 AM

Re: InGroup + Global Groups

Also, all the users in the domain of LogonServer are also members of global group NTFS_PERMISIONS, which includes NTFS permisions for FileServer to allow them to access files on FileServer.

Administrator

(KiX Master Guru)

2002-07-11 07:51 AM

Re: InGroup + Global Groups

zz(top),
have you thought of upgrading?
uttleast to 3.6*

otherwise, will start searching bug-fix-list from history if this is something fixed after your kix.

cheers,

(KiX Master)

2002-07-11 04:35 PM

Re: InGroup + Global Groups

You should definitely upgrade to 4.10a. The new commands will definitely come in handy down the road and you can take advantage of the huge UDF collection posted to this board. KiXtart 3.47 is definitely out-dated.

(Getting the hang of it)

2002-07-14 04:27 PM

Re: InGroup + Global Groups

Hi,

I'm not sure it would solve my problem - kix.log says that I have an access problem to retrieve network resources (See my message above).
Can it change in the newer version?
Could you please explain what kind of network resourses does kix need access to?

Thanks allot,
V.F.

(KiX Master)

2002-07-15 12:51 AM

Re: InGroup + Global Groups

Okay, do the following:

1) Download KiXtart 4.10a

2) Install the KiXtart RPC service on ALL domain controllers.

3) Run a simple test script to validate a single INGROUP statement.

4) Report back if there are still problems.

(KiX Supporter)

2002-12-01 07:28 AM

Re: InGroup + Global Groups

solved?