Re: iSeries domain logon support

[Charles Wilt <charles.wilt@xxxxxxxxx>]

Tom,

The domain login support you mention is the legacy WinNT domains, not
the newer kerberos based Active Directory supported by Win2k and
higher.

I'm pretty sure XP is the last version to support the legacy NT domains.

Theoretically, it should be possible for Windows XP and higher clients
to authenticate to a non-Active Directory kerberos server (including
the one on the IBM i running in PASE) .....but good luck with that :)
Not to mention that AD does provide some "management" functionality in
addition to authentication.
http://serverfault.com/questions/33564/how-to-get-windows-xp-to-authenticate-against-kerberos-or-heimdal

In the short & long term, it's probably easier to just get a couple of
PCs running Win 2003 or 2008 server. (primary & backup)

HTH,
Charles

On Fri, Jul 10, 2009 at 4:20 PM, Tom<tomh@xxxxxxxxxxx> wrote:
> We have a new v6r1 box, model M15.  In the infocenter documentation, there's
> info how to setup and configure the iSeries to provide Domain Logon support
> (http://publib.boulder.ibm.com/iseries/v5r2/ic2924/index.htm?info/rzahl/rzah
> ldmnlogonspt.htm).  As I understand it, this would essentially allow me to
> remove the Win2K server (running on an IXS on an old 400) out of our
> network.  The Win2K server on the iXS is the primary domain controller, and
> that's really all it's used for (no DHCP, no DNS, etc).
>
>
>
> Apparently, in order for the user PCs (all XP at this time) to be able to
> login to the domain I'll need to install/configure client software on each
> PC; ok, no biggie, I can do that.
>
>
>
> Brings up some questions:
>
>
>
> -          What if the user can't authenticate to the iSeries domain
> controller?  Will they be 'locked out' of the PC until they do network
> authentication, or will they be logged in using a stored copy of their
> Windows user profile, or will something else happen?
>
> -          What if we upgrade client systems from XP to Vista or Windows 7?
>
>
>
> Tom
>
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.