Thursday, August 28, 2008

The Case of Digitally Signed Network Communications

It has been a while I did not post anything here due to the work load, tight schedule and some traveling. Couple of days back I was asked to help in one of the project where they can't fix the network drive mapping under DOS automation environment after PXE boot from Altiris.

No network error was generated in the Windows Event Log for that host server and limited information from the DOS prompt after unsucessful "net use"......

Initially my though was it could due to he HANDLE leak which addresses ubder KB936087. So I launched the Process Explorer from Microsoft SysInternals and nothing seem to be suspicious. Next thing I have in mind to to give kernrate (you can down the kernrate from MS website, which is a very useful tool to trouble memory leak related issue) a try and see what I can get from there but I did not find anything abnormal either.

After some thought and "googling" around I decided to give Process Monitor a try and if procmon can get something useful or some indication on what went wrong with the host system. Beside the default filtering which built into prommon, I added a new filter to specifically look at the registry and processes related to "MS Network" and found that everytime I try to "net use" to map a drive it read the registry value which tie to the policy named "Microsoft Network : Digitally sign communications (always)" set to Enabled.

This is the common issue where you have this enabled, DOS and Win9x client will have problem map the shared drive from the host system. I proceeded to disabled this policy which pushed by the DC and forced a Group Policy refresh by "gpupdate /force". I was lucky that this will help to refreshed the local policy without a reboot.

"net use" again from the DOS client under the automation envirmonment after PXE boot and it worked !

No comments: