Re: Question about support related to Windows 7

QPWDLVL is set to zero currently. First IBM contact did not suggest
changing it.

My co-worker has tried using an all upper and an all lower case password
for his i profile. No difference in the result.

Does this issue exist at 6.1 or 7.1? Boss has already expressed his lack
of confidence in getting current. Asked me what I was going to do if it
failed. That question does have me wondering if staying behind was due to
former sa or his fear of change.

John McKee


On Fri, May 17, 2013 at 8:38 AM, Smith, Mike <Mike_Smith@xxxxxxxxxxxxxx>wrote:

A co-worker was given a new computer with Windows 7. He tried to

recreate

the drive assignments to IFS folders he used on his Windows XP computer.
The drive assignment works. He is unable to access the contents. I do

not

recall the exact error he received.

If your QPWDLVL is at 0 or 1, then that's most likely the problem with
Windows 7 clients (Windows 2008 server also). Ran into it trying to get a
BizTalk server to authenticate as well as desktops.

"Current OS/400 versions enable Windows NT challenge/response version 2
(NTLMv2) authentication. NTLMv2 passwords are case sensitive. Windows NT,
2000, XP (and above) clients use NTLMv2. With QPWDLVL 0 or 1, by default,
passwords must be entered in all uppercase or all lower case if using NT,
2000, XP, or above to make a NetServer connection. However, NetServer can
be configured to allow the use of LANMAN (Lan Manager) Authentication so
long as the Windows Client is capable of also using LANMAN Authentication
(every version of Windows prior to Windows 7 and Windows Server 2008 is
capable of using LANMAN). Using LANMAN will allow the use of mixed case
passwords when using QPWDLVL 0.

Note: Windows 7, Windows Server 2008, and above, can not use LANMAN
authentication. This is a Windows restriction. As a result, if the IBM i is
set to use QPWDLVL 0, then these clients must send an all upper case or all
lower case password in able to connect to the IBM i NetServer."
That's from :

http://www-912.ibm.com/s_dir/slkbase.NSF/643d2723f2907f0b8625661300765a2a/6e5291390ae26d3986257aed0067a5c9?OpenDocument&ExpandSection=-1

Other docs.

http://www-01.ibm.com/support/docview.wss?uid=nas1ec3c802b0543ecf08625790c0041f215
and
http://www-912.ibm.com/s_dir/slkbase.NSF/DocNumber/30795328



I'm sitting with the same problem and trying to assess what could go wrong
before I change the setting.

It's easy to implement but it's understanding all the effects that is the
difficult part. Also, the back out is a pain. You have to restore security
and do an IPL.

I'm figuring that I'm going to have to force a password change on Windows
for all iSeries users that have Windows 7. In my site we have software
that when the password expires on a Windows log in, it syncs a password
change to Mainframe, iSeries and Linux servers. If I don't, the Windows 7
machines will still be sending a mixed case password and after changing the
QPWDLVL to 2, the iSeries will be able to understand the mixed case but
will be comparing to a password that is in all upper and all lower (what
was stored at QPWDLVL 0).

I'm thinking connections like FTPs from non-Windows 7 sources like the
Mainframe or other iSeries LPARs with QPWDLVL at 0 or 1 are cool. I don't
think things like Domino or WebSphere (or MQ) will be a problem and I'm
still accessing things like DDM connections..


Mike




________________________________
Confidentiality: This transmission, including any attachments, is solely
for the use of the intended recipient(s). This transmission may contain
information that is confidential or otherwise protected from disclosure.
The use or disclosure of the information contained in this transmission,
including any attachments, for any purpose other than that intended by its
transmittal is strictly prohibited. Unauthorized interception of this email
is a violation of federal criminal law. If you are not an intended
recipient of this transmission, please immediately destroy all copies
received and notify the sender.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.