Digital PDFs

AA-RFM4B-TE

May 2001

326 pages

Original

0.8MB

Document:	Compaq Advanced Server for OpenVMS Server Administrator’s Guide
Order Number:	AA-RFM4B-TE
Revision:	0
Pages:	326
Original Filename:	ADSRV_ADMIN_GD.PDF

OCR Text

Compaq Advanced Server for OpenVMS
Server Administrator’s Guide
Order Number: AA–RFM4B–TE

March 2001
This guide presents step-by-step procedures for managing and maintaining
the Advanced Server. It describes how to complete common tasks, such as
managing files and directories, printing, and administering the network.

Revision/Update Information:

This manual supersedes the Server
Administrator’s Guide, AA–RFM4A-TE

Operating System:

OpenVMS Alpha, Version 7.2-1

Software Version:

Advanced Server V7.3 for OpenVMS

Compaq Computer Corporation
Houston, Texas

Compaq, the Compaq logo, VAX, and VMS Registered in U.S. Patent and Trademark Office.
AlphaStation, DEC, DECnet, DECwindows, PATHWORKS, OpenVMS, and POLYCENTER are
trademarks of Compaq Information Technologies Group, L.P. in the United States and other
countries.
Microsoft, MS-DOS, Windows, and Windows NT are trademarks of Microsoft Corporation in the
United States and other countries.
Intel is a trademark of Intel Corporation in the United States and other countries.
UNIX is a trademark of The Open Group in the United States and other countries.
All other product names mentioned herein may be trademarks of their respective companies.
Confidential computer software. Valid license from Compaq required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer
Software Documentation, and Technical Data for Commercial Items are licensed to the U.S.
Government under vendor’s standard commercial license.
Compaq shall not be liable for technical or editorial errors or omissions contained herein. The
information in this document is provided "as is" without warranty of any kind and is subject
to change without notice. The warranties for Compaq products are set forth in the express
limited warranty statements accompanying such products. Nothing herein should be construed
as constituting an additional warranty.
ZK6543
The Compaq Advanced Server for OpenVMS documentation set is available on CD-ROM.

This document was prepared using DECdocument, Version 3.3-1b.

Contents
Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

xix

1 Overview
1.1
The Role of the Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.1.1
Setting Up the Advanced Server Environment . . . . . . . . . . .
1.1.2
Administering the Network . . . . . . . . . . . . . . . . . . . . . . . . . .
1.1.2.1
Maintaining User Accounts, Shares, and Resources . . . . .
1.1.2.2
Monitoring Events and Troubleshooting Server
Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.2
The Advanced Server Network . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.2.1
Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.2.2
Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.2.3
Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.2.4
Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.2.5
Logon Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.2.6
Logon Scripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.2.7
Home Directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.2.8
Advanced Server Licensing . . . . . . . . . . . . . . . . . . . . . . . . . .
1.3
Resource Sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.3.1
Disk Directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.3.2
Printers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.4
Monitoring Events and Troubleshooting . . . . . . . . . . . . . . . . . . . .
1.5
Network Administration Interfaces . . . . . . . . . . . . . . . . . . . . . . .
1.6
The Advanced Server ADMINISTER Command-Line
Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.6.1
Getting Help on ADMINISTER Commands . . . . . . . . . . . . . .
1.6.2
Administering Domains and Servers . . . . . . . . . . . . . . . . . . .
1.6.3
Administrative Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1–2
1–2
1–3
1–3
1–3
1–3
1–4
1–4
1–5
1–5
1–6
1–6
1–7
1–7
1–7
1–8
1–8
1–9
1–9
1–11
1–12
1–13
1–15

iii

2 Managing Domains and Servers
2.1
Managing a Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.1.1
Server Roles in the Domain . . . . . . . . . . . . . . . . . . . . . . . . . .
2.1.1.1
Changing a Server’s Role in a Domain . . . . . . . . . . . . . . .
2.1.1.1.1
Changing the Role of a BDC to a PDC, or Vice
Versa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.1.1.1.2
Changing a BDC to a Member Server, or Vice
Versa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.1.2
Domain Controllers and the SAM Database . . . . . . . . . . . . .
2.1.2.1
Synchronizing SAM Databases on Domain
Controllers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.1.2.1.1
How to Synchronize All Controllers in a Domain . . . .
2.1.2.1.2
How to Synchronize a Specific Backup Domain
Controller with the Primary Domain Controller . . . .
2.1.3
Displaying the Current Domain . . . . . . . . . . . . . . . . . . . . . . .
2.1.4
Administering Another Domain . . . . . . . . . . . . . . . . . . . . . . .
2.1.5
Member Servers and Domain Management . . . . . . . . . . . . . .
2.1.5.1
Administering the Member Server’s Local Database . . . .
2.1.5.2
ADMINISTER Command Variances on Member
Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.1.6
Adding a Computer Account to a Domain . . . . . . . . . . . . . . .
2.1.6.1
Procedure for Adding a Computer to a Domain . . . . . . . .
2.1.7
Removing a Computer Account from a Domain’s Security
Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.1.7.1
Procedure for Removing a Computer from a Domain . . . .
2.1.8
Managing Trust Relationships . . . . . . . . . . . . . . . . . . . . . . . .
2.1.8.1
Establishing Trust Relationships . . . . . . . . . . . . . . . . . . .
2.1.8.2
Displaying the Trust Relationships . . . . . . . . . . . . . . . . .
2.1.8.3
Setting Up a Two-Way Trust Relationship . . . . . . . . . . . .
2.1.8.4
Removing Trust Relationships . . . . . . . . . . . . . . . . . . . . .
2.2
Managing Security Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.2.1
Managing the Account Policy . . . . . . . . . . . . . . . . . . . . . . . . .
2.2.1.1
Example: Setting a User Account Policy . . . . . . . . . . . . .
2.2.1.2
Example: Displaying the Account Policy for a
Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.2.2
Managing the Audit Policy . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.2.2.1
Example: Displaying the Audit Policy for a Domain . . . .
2.2.2.2
Example: Enabling Auditing and Setting the Audit
Policy for a Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3
Managing a Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2–1
2–2
2–4
2–5
2–7
2–7
2–8
2–8
2–9
2–10
2–11
2–12
2–12
2–13
2–14
2–15
2–16
2–16
2–17
2–17
2–19
2–19
2–20
2–21
2–21
2–23
2–23
2–23
2–24
2–25
2–25

Displaying Server Information . . . . . . . . . . . . . . . . . . . . . . . .
Displaying Connections . . . . . . . . . . . . . . . . . . . . . . . . . .
Displaying User Sessions . . . . . . . . . . . . . . . . . . . . . . . . .
Displaying Shared Resources . . . . . . . . . . . . . . . . . . . . . .
Displaying the Advanced Server Version Number . . . . . .
Stopping the Advanced Server . . . . . . . . . . . . . . . . . . . . . . . .
Sending Messages to Users . . . . . . . . . . . . . . . . . . . . . . . . . .
Sending a Message to the User of a Specific
Computer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3.3.2
Sending a Message to Users on a Specific Server . . . . . . .
2.3.4
Managing Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3.4.1
Displaying Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3.4.2
Starting Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3.4.3
Pausing Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3.4.4
Continuing Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3.4.5
Stopping Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3.4.6
Synchronizing Clocks on All Network Computers . . . . . .
2.3.5
Changing Time Zones or Daylight Savings Time Settings . . .
2.4
Advanced Server in OpenVMS Clusters . . . . . . . . . . . . . . . . . . . .
2.4.1
About the Advanced Server Cluster Alias . . . . . . . . . . . . . . .
2.4.2
Defining the Advanced Server Cluster Alias . . . . . . . . . . . . .
2.4.3
Cluster Load Balancing in LANs . . . . . . . . . . . . . . . . . . . . . .
2.4.4
Dynamic Cluster Load Balancing in WANs . . . . . . . . . . . . . .
2.4.4.1
Background and Overview: Advanced Server Clusters
and Load Balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.4.4.2
The Software for Dynamic Cluster Load Balancing in
WANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.4.4.3
Enabling Dynamic Load Balancing Using TCP/IP
Services for OpenVMS . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3.1
2.3.1.1
2.3.1.2
2.3.1.3
2.3.1.4
2.3.2
2.3.3
2.3.3.1

2–25
2–25
2–26
2–27
2–28
2–28
2–29
2–29
2–30
2–30
2–32
2–32
2–32
2–33
2–33
2–34
2–34
2–35
2–36
2–37
2–38
2–39
2–39
2–40
2–40

3 Managing Users and Groups
3.1
Managing Network User Accounts . . . . . . . . . . . . . . . . . . . . . . . .
3.1.1
Built-In User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.2
Types of User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.3
User Account Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.4
Creating User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.4.1
Creating a Network User Account . . . . . . . . . . . . . . . . . .
3.1.4.1.1
Creating a Global User Account . . . . . . . . . . . . . . . . .
3.1.4.1.2
Verifying That the User Has Been Added . . . . . . . . .
3.1.4.1.3
Creating a Local User Account . . . . . . . . . . . . . . . . . .
3.1.4.2
Creating User Account Templates . . . . . . . . . . . . . . . . . .
3.1.4.3
Copying User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . .

3–1
3–1
3–2
3–2
3–4
3–4
3–4
3–5
3–6
3–6
3–7

Specifying Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Changing a User Password . . . . . . . . . . . . . . . . . . . . . . .
Specifying Group Membership . . . . . . . . . . . . . . . . . . . . . . . .
Specifying Logon Hours . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Specifying Logon Scripts . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Setting Up a Logon Script . . . . . . . . . . . . . . . . . . . . . . . .
Providing User Access to Logon Scripts . . . . . . . . . . . . . .
Specifying Workstations . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Specifying Home Directories . . . . . . . . . . . . . . . . . . . . . . . . .
Specifying User Account Expiration Dates . . . . . . . . . . . . . . .
Specifying User Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Displaying User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . .
Example: Sorting the Display by User Full Name . . . . . .
Example: Reviewing User Account Settings for a Specific
User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.14
Modifying User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.14.1
Example: Adding an Existing User to a Group . . . . . . . .
3.1.14.2
Example: Changing a user’s logon hours . . . . . . . . . . . . .
3.1.15
Disabling and Removing User Accounts . . . . . . . . . . . . . . . . .
3.1.15.1
Disabling a User Account . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.15.2
Deleting a User Account . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.16
User Account Host Mapping . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.16.1
Implicit and Explicit Host Mapping . . . . . . . . . . . . . . . . .
3.1.16.2
Establishing User Account Host Mapping . . . . . . . . . . . .
3.1.16.2.1
Setting Up Explicit Host Mapping . . . . . . . . . . . . . . .
3.1.16.2.2
Displaying Host Mapping . . . . . . . . . . . . . . . . . . . . . .
3.1.17
External Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.17.1
Configuring the Server Capacity for External
Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.17.2
Synchronizing Passwords . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.17.3
Bypassing External Authentication When the Network Is
Down . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.17.4
Logging On to Externally Authenticated Accounts . . . . . .
3.1.17.5
Avoiding User Name Conflicts . . . . . . . . . . . . . . . . . . . . .
3.1.17.6
Setting Up External Authentication by a Trusted
Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.17.7
Changing the Default Domain for External
Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.17.8
Requirement for External Authentication Over
DECnet-Plus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.2
Managing Advanced Server Groups . . . . . . . . . . . . . . . . . . . . . . .
3.2.1
Built-In Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.2.2
Setting Up User Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1.5
3.1.5.1
3.1.6
3.1.7
3.1.8
3.1.8.1
3.1.8.2
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.13.1
3.1.13.2

3–7
3–9
3–9
3–9
3–10
3–10
3–11
3–11
3–12
3–13
3–13
3–14
3–15
3–15
3–16
3–16
3–16
3–17
3–18
3–18
3–18
3–19
3–19
3–20
3–20
3–20
3–21
3–21
3–22
3–23
3–24
3–25
3–25
3–25
3–26
3–27
3–28

3.2.3
3.2.3.1
3.2.4
3.2.5
3.2.5.1
3.2.5.2
3.2.5.3
3.2.6

Adding Users to Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Adding Members to a New Group . . . . . . . . . . . . . . . . . .
Copying Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Modifying a Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Adding a Member to an Existing Group . . . . . . . . . . . . . .
Removing a Member From a Group . . . . . . . . . . . . . . . . .
Changing the Description of a Group . . . . . . . . . . . . . . . .
Deleting a Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3–29
3–30
3–30
3–30
3–31
3–31
3–31
3–31

4 Managing Directory and File Sharing
4.1
Planning Directory and File Sharing . . . . . . . . . . . . . . . . . . . . . .
4.1.1
Disk Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.1.2
Advanced Server Security Models . . . . . . . . . . . . . . . . . . . . .
4.1.2.1
Advanced Server Only Security Model . . . . . . . . . . . . . . .
4.1.2.1.1
Windows NT Security Descriptors . . . . . . . . . . . . . . .
4.1.2.2
Advanced Server and OpenVMS Security Model . . . . . . .
4.1.2.2.1
RMS Protections . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.1.2.2.2
Access Control Lists (ACLs) . . . . . . . . . . . . . . . . . . . .
4.1.3
The Advanced Server and Windows NT Security
Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.1.3.1
Inheritance of Directory Permissions . . . . . . . . . . . . . . . .
4.1.3.2
Inheritance of Ownership . . . . . . . . . . . . . . . . . . . . . . . . .
4.1.3.3
ACEs and OpenVMS Volume Index Files . . . . . . . . . . . . .
4.1.3.4
How the File Server Reads Windows NT Security
Information on Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.1.3.5
How the Advanced Server File Server Builds File
Security Descriptor Information . . . . . . . . . . . . . . . . . . . .
4.1.3.6
Streamlining Security Information Storage and
Lookups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.1.3.6.1
Managing the Index File on a Volume with Shared
Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.1.3.6.2
Determining the Number of Index File Headers to
Allocate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.1.3.7
Removing PATHWORKS ACEs . . . . . . . . . . . . . . . . . . . .
4.1.3.8
Displaying Advanced Server for OpenVMS and
PATHWORKS ACEs . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.1.4
Controlling User Access to Disk Resources . . . . . . . . . . . . . .
4.1.4.1
Administrator Access . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.1.4.2
Group Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.1.4.3
User Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.1.4.4
Access Checks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.2
Administrative Shares . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4–2
4–3
4–3
4–4
4–5
4–6
4–6
4–7
4–8
4–8
4–8
4–8
4–9
4–11
4–12
4–14
4–14
4–16
4–17
4–17
4–18
4–18
4–18
4–18
4–19

vii

4.2.1
The ADMIN$ Share . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.2.2
The IPC$ Share . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.2.3
Disk Administrative Shares . . . . . . . . . . . . . . . . . . . . . . . . . .
4.2.3.1
Autoshare Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.2.3.2
Defining Autoshares . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.2.3.3
The Autoshare Parameter . . . . . . . . . . . . . . . . . . . . . . . .
4.2.3.4
The NoAutoshare Parameter . . . . . . . . . . . . . . . . . . . . . .
4.2.3.5
Sharing DECdfs Devices . . . . . . . . . . . . . . . . . . . . . . . . .
4.2.3.6
Autosharing in an OpenVMS Cluster Environment . . . . .
4.2.3.7
Synchronizing Autoshares . . . . . . . . . . . . . . . . . . . . . . . .
4.3
Managing Shared Directories and Files . . . . . . . . . . . . . . . . . . . .
4.3.1
Default Shares . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3.2
Creating a Share . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3.2.1
Preparing to Share a Directory . . . . . . . . . . . . . . . . . . . .
4.3.2.2
Planning Share Permissions . . . . . . . . . . . . . . . . . . . . . .
4.3.2.3
Creating a Share . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3.2.4
Creating a Personal Share . . . . . . . . . . . . . . . . . . . . . . . .
4.3.2.4.1
Procedure for Creating a Personal Share . . . . . . . . . .
4.3.2.5
Stopping Directory Sharing . . . . . . . . . . . . . . . . . . . . . . .
4.3.3
Displaying Information About Shares . . . . . . . . . . . . . . . . . .
4.3.3.1
Displaying Information About a Specific Share . . . . . . . .
4.3.3.2
Displaying Share Permissions . . . . . . . . . . . . . . . . . . . . .
4.3.4
Changing Share Properties . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3.5
Planning File and Directory Access Permissions . . . . . . . . . .
4.3.5.1
File and Directory Access Permissions . . . . . . . . . . . . . . .
4.3.5.2
Setting Permissions on a File or Directory . . . . . . . . . . . .
4.3.5.3
Inheriting Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3.6
Specifying File and Directory Access Permissions . . . . . . . . .
4.3.7
Displaying File and Directory Access Permissions . . . . . . . . .
4.3.8
Using Network Permissions and OpenVMS Protections . . . . .
4.3.8.1
OpenVMS Protections . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3.9
Auditing Directory and File Access . . . . . . . . . . . . . . . . . . . .
4.3.10
Taking Ownership of Files or Directories . . . . . . . . . . . . . . . .
4.3.10.1
Authorizing a User to Take Ownership of a File or
Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3.10.2
Taking Ownership of a File or Directory . . . . . . . . . . . . .
4.3.11
Managing Shares from a Windows NT Server . . . . . . . . . . . .
4.3.11.1
Adding a Share from a Windows NT Server . . . . . . . . . .
4.3.11.2
Displaying and Modifying Shares from a Windows NT
Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.4
Unicode and Extended Character Sets . . . . . . . . . . . . . . . . . . . . .
4.4.1
Requirements and Restrictions . . . . . . . . . . . . . . . . . . . . . . .
4.4.2
Configuring Extended Character Sets . . . . . . . . . . . . . . . . . .

viii

4–20
4–20
4–21
4–21
4–22
4–23
4–24
4–25
4–25
4–26
4–27
4–27
4–27
4–28
4–28
4–29
4–30
4–31
4–32
4–32
4–33
4–33
4–34
4–35
4–35
4–37
4–37
4–38
4–38
4–39
4–39
4–39
4–40
4–40
4–40
4–41
4–41
4–42
4–42
4–46
4–47

How the Advanced Server File Server Stores and Handles
Character Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.4.3.1
File Name Storage and Handling on ODS-2 Volumes . . .
4.4.3.2
File Name Storage and Handling on ODS-5 Volumes . . .
4.4.4
How to Change the Way ADMINISTER Commands Handle
and Display Extended Character Set Characters . . . . . . . . . .
4.4.4.1
How the Default Input and Output Modes Are
Determined . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.4.4.2
Examples: How Each Mode Affects ADMINISTER
Command Input and Output . . . . . . . . . . . . . . . . . . . . . .
4.4.4.3
How to Display the Current Mode Settings . . . . . . . . . . .
4.4.5
Creating Print Shares with Unicode Extended Characters . .
4.5
Using ODS-5 Disk Volumes in the Advanced Server
Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.5.1
Requirements for Using Extended File Specifications and
Extended Character Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.5.2
Managing Shares on ODS-5 Disk Volumes . . . . . . . . . . . . . . .
4.5.2.1
Displaying Shares and Files on ODS-5 Disk Volumes . . .
4.5.2.2
Converting File Names . . . . . . . . . . . . . . . . . . . . . . . . . .
4.5.2.3
Displaying the Disk Volume Type . . . . . . . . . . . . . . . . . .
4.5.2.4
Specifying File Names in ADMINISTER Commands . . . .
4.5.2.5
Storing Files on ODS-5 Disk Volumes . . . . . . . . . . . . . . .
4.5.2.5.1
MS-DOS and Windows File Naming . . . . . . . . . . . . .
4.6
File Names for Files Stored on the Advanced Server . . . . . . . . . .
4.6.1
File Naming Conventions: ODS-2 and ODS-5
Comparisons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.6.2
Support of Alias File Names . . . . . . . . . . . . . . . . . . . . . . . . .
4.6.2.1
Advanced Server Alias File Names . . . . . . . . . . . . . . . . .
4.6.2.2
Example Listing Showing Alias File Names . . . . . . . . . .
4.4.3

4–48
4–48
4–49
4–50
4–51
4–52
4–53
4–53
4–53
4–54
4–55
4–55
4–56
4–56
4–57
4–57
4–58
4–58
4–59
4–61
4–62
4–62

5 Managing Printers, Print Queues, and Print Shares
5.1
OpenVMS Print Queues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.1.1
Types of Advanced Server Print Queues . . . . . . . . . . . . . . . .
5.2
Planning Printer Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.2.1
Sharing Printers and Print Queues . . . . . . . . . . . . . . . . . . . .
5.3
Managing Printers, Print Shares, and Print Jobs . . . . . . . . . . . .
5.3.1
Setting Up a New Printer . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.1.1
Printer Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.1.2
Connecting Your Printer . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.1.3
Creating an Advanced Server Print Queue Using
ADMINISTER Commands . . . . . . . . . . . . . . . . . . . . . . . .
5.3.1.4
Creating a Printer Using Windows NT Print Services . . .

5–2
5–3
5–3
5–3
5–4
5–7
5–7
5–8
5–8
5–9

Managing Printers Using the Advanced Server
ADMINISTER Command-Line Interface . . . . . . . . . . . . . . . .
5.3.2.1
Displaying Print Queue Information, Using
ADMINISTER Commands . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.1.1
Displaying Information About All Print Queues on a
Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.1.2
Displaying Information About a Single Print
Queue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.2
Changing the Printer Type, Using ADMINISTER
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.3
Pausing a Print Queue, Using ADMINISTER
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.4
Continuing a Print Queue, Using ADMINISTER
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.5
Purging Print Jobs from a Print Queue, Using
ADMINISTER Commands . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.6
Deleting a Print Queue, Using ADMINISTER
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.7
Managing Print Shares, Using ADMINISTER
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.7.1
Creating an Advanced Server Print Share . . . . . . . . .
5.3.2.7.2
Creating Print Shares With Names That Include
Unicode Extended Characters . . . . . . . . . . . . . . . . . .
5.3.2.8
Controlling Access to Print Shares, Using ADMINISTER
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.9
Changing Print Share Options, Using ADMINISTER
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.9.1
Example: Changing the Maximum Number of
Connections for an Existing Print Share . . . . . . . . . .
5.3.2.9.2
Example: To Change the Permissions for an Existing
Print Share . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.10
Displaying Information About Print Shares, Using
ADMINISTER Commands . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.11
Stopping a Print Share, Using ADMINISTER
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.12
Managing Print Jobs, Using ADMINISTER
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.12.1
Displaying Print Jobs, Using ADMINISTER
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.12.2
Holding a Print Job, Using ADMINISTER
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.12.3
Releasing a Print Job, Using ADMINISTER
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2

5–9
5–10
5–10
5–10
5–11
5–11
5–12
5–12
5–12
5–14
5–14
5–15
5–15
5–16
5–17
5–17
5–17
5–17
5–18
5–18
5–19
5–19

Restarting a Print Job, Using ADMINISTER
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.2.12.5
Moving a Print Job in a Print Queue, Using
ADMINISTER Commands . . . . . . . . . . . . . . . . . . . . .
5.3.2.12.6
Deleting a Print Job, Using ADMINISTER
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.3
Managing Advanced Server Printers Using Windows NT . . .
5.3.3.1
Using Windows NT Print Services to Manage Advanced
Server Printers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.3.2
Using Windows NT Print Services to Share Printers
Defined on the Advanced Server . . . . . . . . . . . . . . . . . . .
5.3.3.3
Enabling Printer Pooling . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.3.4
Using Advanced Server Windows NT-Compatible
Printers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.3.3.5
Windows NT Printer Management Restrictions . . . . . . . .
5.3.2.12.4

5–19
5–20
5–20
5–21
5–22
5–23
5–23
5–24
5–24

6 Monitoring Events and Troubleshooting
6.1
Monitoring Server Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.1.1
ADMINISTER Commands . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.1.2
Automatic Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.1.3
Event Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.1.3.1
Displaying Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.1.3.1.1
Displaying Events When the Advanced Server Is
Running . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.1.3.1.2
Displaying Events When the Advanced Server Is Not
Running . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.1.3.2
Saving and Clearing the Event Logs . . . . . . . . . . . . . . . .
6.1.3.2.1
Saving an Event Log . . . . . . . . . . . . . . . . . . . . . . . . .
6.1.3.2.2
Clearing an Event Log . . . . . . . . . . . . . . . . . . . . . . . .
6.1.3.3
Auditing Security Events Domain-Wide . . . . . . . . . . . . . .
6.1.3.3.1
Enabling Security Event Auditing . . . . . . . . . . . . . . .
6.1.3.3.2
Disabling Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.1.3.4
Establishing the Audit Policy . . . . . . . . . . . . . . . . . . . . . .
6.1.3.4.1
Example: Setting the Audit Policy . . . . . . . . . . . . . . .
6.1.3.5
Displaying the Audit Policy . . . . . . . . . . . . . . . . . . . . . . .
6.1.3.6
Setting and Displaying Security Event Auditing for Files
and Directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.1.3.6.1
Example: Displaying the Audit Settings for a File . .
6.1.4
Advanced Server Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.1.4.1
Displaying Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.1.4.2
The Advanced Server Common Event Log . . . . . . . . . . . .
6.2
Troubleshooting Server Problems . . . . . . . . . . . . . . . . . . . . . . . . .

6–1
6–1
6–2
6–3
6–5
6–5
6–6
6–7
6–7
6–8
6–8
6–8
6–9
6–9
6–10
6–10
6–10
6–11
6–11
6–12
6–13
6–18

6.2.1
6.2.1.1
6.2.1.2
6.2.1.3
6.2.1.3.1
6.2.2
6.2.2.1
6.2.2.2
6.2.2.3
6.2.2.3.1
6.2.2.4
6.2.2.5
6.2.2.6
6.2.2.7
6.2.2.8
6.2.2.9
6.2.2.10
6.2.2.11

Troubleshooting Overview . . . . . . . . . . . . . . . . . . . . . . . . . . .
Step 1: Collecting Information About the Problem . . . . .
Step 2: Analyzing the Problem . . . . . . . . . . . . . . . . . . . .
Step 3: Solving the Problem . . . . . . . . . . . . . . . . . . . . . .
Gathering Information About Server Status . . . . . . .
The Problem Analysis Process . . . . . . . . . . . . . . . . . . . . . . . .
Intermittent Problems . . . . . . . . . . . . . . . . . . . . . . . . . . .
Domain and Computer Problems . . . . . . . . . . . . . . . . . . .
Server Operation Problems . . . . . . . . . . . . . . . . . . . . . . .
Monitoring Data Cache Use by the File Server . . . . .
Problems with Services . . . . . . . . . . . . . . . . . . . . . . . . . .
Client Connection Problems . . . . . . . . . . . . . . . . . . . . . . .
Share Access Problems . . . . . . . . . . . . . . . . . . . . . . . . . . .
Printer Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
User Account Problems . . . . . . . . . . . . . . . . . . . . . . . . . .
Privileged User Problems . . . . . . . . . . . . . . . . . . . . . . . . .
Problems Connecting to the Advanced Server . . . . . . . . .
License Acquisition and Validation Problems . . . . . . . . . .

6–19
6–19
6–20
6–20
6–21
6–21
6–22
6–23
6–25
6–25
6–27
6–28
6–29
6–31
6–33
6–34
6–35
6–38

7 Managing Server Configuration Parameters
Managing File Server Parameters Affecting System
Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.1.1
Starting the Configuration Manager . . . . . . . . . . . . . . . . . . .
7.1.2
Exiting the Configuration Manager . . . . . . . . . . . . . . . . . . . .
7.1.3
Getting Help on the Configuration Manager . . . . . . . . . . . . .
7.1.4
Modifying Basic Configuration Parameters . . . . . . . . . . . . . .
7.1.4.1
Specifying a Server’s Client Capacity . . . . . . . . . . . . . . . .
7.1.4.2
Specifying the Percent of Physical Memory Used . . . . . . .
7.1.4.3
Specifying Server Data Cache Size . . . . . . . . . . . . . . . . .
7.1.4.4
Specifying the Maximum Number of Concurrent
Signons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.1.4.5
Specifying OpenVMS Process Priority . . . . . . . . . . . . . . .
7.1.5
Modifying Advanced Configuration Parameters . . . . . . . . . . .
7.1.5.1
Enabling and Disabling Open File Caching . . . . . . . . . . .
7.1.5.2
Setting the Open File Caching Interval . . . . . . . . . . . . . .
7.1.5.3
Specifying the Files per Client . . . . . . . . . . . . . . . . . . . . .
7.1.5.4
Specifying the Byte Range Locks per Client . . . . . . . . . .
7.1.5.5
Enabling Dynamic Security Upgrade . . . . . . . . . . . . . . . .
7.1.5.6
Specifying the Server Security Model . . . . . . . . . . . . . . . .
7.1.5.7
Saving Advanced Configuration Parameter Changes . . . .
7.1

xii

7–2
7–3
7–4
7–4
7–4
7–5
7–6
7–7
7–7
7–7
7–8
7–8
7–9
7–9
7–9
7–9
7–10
7–10

7.1.6
Configuring Transports . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.1.6.1
Enabling and Disabling Transports . . . . . . . . . . . . . . . . .
7.1.6.2
Selecting NetBIOS Name Resolution . . . . . . . . . . . . . . . .
7.1.6.3
Saving Transport Configuration Parameter Changes . . . .
7.1.7
Verifying and Saving the New Configuration . . . . . . . . . . . . .
7.1.8
Navigating the Configuration Manager Using a Keyboard . . .
7.2
Managing Server Configuration Parameters Stored in the
OpenVMS Registry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.2.1
OpenVMS Registry Overview . . . . . . . . . . . . . . . . . . . . . . . . .
7.2.1.1
Registry Database Architecture . . . . . . . . . . . . . . . . . . . .
7.2.1.2
The OpenVMS Registry Server . . . . . . . . . . . . . . . . . . . .
7.2.2
Advanced Server Parameters Stored in the Registry . . . . . . .
7.2.3
How to Manage Advanced Server Parameters in the
OpenVMS Registry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.2.3.1
Managing Registry-Stored Advanced Server Parameters
from a Windows NT Computer . . . . . . . . . . . . . . . . . . . . .
7.2.3.2
Managing Registry-Stored Advanced Server Parameters
from OpenVMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.2.4
Using the PWRK$REGUTL Utility to Manage Advanced
Server Parameters in the OpenVMS Registry . . . . . . . . . . . .
7.2.4.1
How to Exit PWRK$REGUTL . . . . . . . . . . . . . . . . . . . . .
7.2.4.2
How to Get Online Help . . . . . . . . . . . . . . . . . . . . . . . . . .
7.2.4.3
PWRK$REGUTL Commands . . . . . . . . . . . . . . . . . . . . . .
7.2.4.4
PWRK$REGUTL Command Format and Environment
Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.2.4.5
Displaying Server Parameter Settings . . . . . . . . . . . . . . .
7.2.4.5.1
Displaying Server Parameters, Including Defaults of
Those Not Currently Stored in the Registry . . . . . . . .
7.2.4.5.2
Displaying Detailed Information About
Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.2.4.5.3
Displaying Both Registry and LANMAN.INI Names
for Server Parameters . . . . . . . . . . . . . . . . . . . . . . . .
7.2.4.6
Modifying Server Parameters . . . . . . . . . . . . . . . . . . . . . .
7.2.4.6.1
Resetting Parameter Values . . . . . . . . . . . . . . . . . . . .
7.2.4.6.2
Creating a Value in the Registry . . . . . . . . . . . . . . . .
7.2.4.7
Deleting Server Parameters . . . . . . . . . . . . . . . . . . . . . . .

7–11
7–11
7–12
7–13
7–14
7–15
7–17
7–17
7–17
7–20
7–20
7–21
7–21
7–22
7–22
7–23
7–24
7–24
7–25
7–27
7–28
7–30
7–31
7–32
7–32
7–33
7–33

xiii

A Server Configuration Parameters
A.1
Server Upgrade and Migration . . . . . . . . . . . . . . . . . . . . . . . . . .
A.2
OpenVMS Registry Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A.2.1
Computer Name Parameters . . . . . . . . . . . . . . . . . . . . . . . . .
A.2.2
Printer Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A.2.3
Browser Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A.2.4
Netlogon Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A.2.5
Advanced Server Process Parameters . . . . . . . . . . . . . . . . . .
A.2.6
Advanced Server File Service Parameters . . . . . . . . . . . . . . .
A.2.7
Advanced Server Share Parameters . . . . . . . . . . . . . . . . . . . .
A.2.8
Advanced Server Parameters . . . . . . . . . . . . . . . . . . . . . . . . .
A.2.9
Lanman Server Parameters . . . . . . . . . . . . . . . . . . . . . . . . . .
A.2.10
Alerter Service Parameters . . . . . . . . . . . . . . . . . . . . . . . . . .
A.2.11
Application Event Log Values . . . . . . . . . . . . . . . . . . . . . . . .
A.2.12
Security Event Log Values . . . . . . . . . . . . . . . . . . . . . . . . . . .
A.2.13
System Event Log Values . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A.2.14
User Service Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . .

A–1
A–2
A–3
A–5
A–5
A–7
A–9
A–10
A–11
A–13
A–16
A–19
A–20
A–21
A–22
A–23

B Network Protocols
B.1
B.2
B.3
B.3.1
B.3.2
B.3.3

Understanding the OSI Reference Model . . . . . . . . . . . . . . . . . . .
Choosing a Network Adapter Card . . . . . . . . . . . . . . . . . . . . . . .
Choosing a Network Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TCP/IP Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
NetBEUI Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
DECnet-Plus Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

B–1
B–4
B–5
B–6
B–7
B–8

ADMINISTER/ANALYZE Command and Display . . . . . . . . .
ADMINISTER/ANALYZE/FULL Command and Display . . . .

6–16
6–18

Index
Examples
6–1
6–2

xiv

Figures
2–1
2–2
7–1
7–2
7–3
7–4
7–5
7–6
B–1
B–2

One-Way Trust Relationship: KANSAS Domain Trusting
LANDOFOZ Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Two-Way Trust Relationship Between Domains KANSAS and
LANDOFOZ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Basic Configuration Parameters Screen . . . . . . . . . . . . . . . . .
Advanced Configuration Parameters Screen . . . . . . . . . . . . .
Transport Configuration Parameters Screen . . . . . . . . . . . . .
Confirmation Screen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Information Screen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Example Keys to Advanced Server Registry Values . . . . . . . .
OSI Reference Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Transport Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2–18
2–20
7–3
7–8
7–11
7–14
7–15
7–19
B–2
B–4

Tables
1–1
1–2
2–1
2–2
2–3
2–4
3–1
3–2
3–3
4–1
4–2
4–3
4–4
4–5
4–6
4–7
4–8
4–9
4–10

Network Administration Interfaces . . . . . . . . . . . . . . . . . . . .
Administrative Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Role Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Disallowed or Restricted Commands When Administering a
Member Server’s Local Database . . . . . . . . . . . . . . . . . . . . . .
Events You Can Audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Network Services on the Advanced Server . . . . . . . . . . . . . . .
User Account Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Uses of Local and Global Groups . . . . . . . . . . . . . . . . . . . . . .
Built-In Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Security Checks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
OpenVMS Group Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Tradeoffs Regarding the STORE_SECURITY_ACES
Parameter Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Network Administrative Shares . . . . . . . . . . . . . . . . . . . . . . .
Sample Default Autoshare Names . . . . . . . . . . . . . . . . . . . . .
Default Shares . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Share Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Directory Access Permissions and Actions on Directories . . .
Directory Access Permissions and Actions on Files . . . . . . . .
Configurable Languages . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1–10
1–16
2–4
2–14
2–24
2–30
3–3
3–27
3–27
4–4
4–7
4–13
4–19
4–24
4–27
4–29
4–36
4–37
4–44

4–11
6–1
6–2
6–3
6–4
6–5
6–6
6–7
6–8
6–9
6–10
6–11
6–12
6–13
6–14
6–15
6–16
6–17
7–1
7–2
7–3
7–4
A–1
A–2
A–3
A–4
A–5
A–6
A–7
A–8
A–9
A–10
A–11
A–12
A–13
A–14

xvi

Advanced Server File-Naming Conventions . . . . . . . . . . . . . .
Alerter Configuration Parameters . . . . . . . . . . . . . . . . . . . . .
Event Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Information in Event Files . . . . . . . . . . . . . . . . . . . . . . . . . . .
ELFREAD Command Options . . . . . . . . . . . . . . . . . . . . . . . .
Log File Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Event Logger Command Qualifiers . . . . . . . . . . . . . . . . . . . .
Procedure for Solving Intermittent Problems . . . . . . . . . . . . .
Procedure for Solving Domain and Computer Problems . . . . .
Procedure for Solving Server Operation Problems . . . . . . . . .
Procedure for Solving Service Problems . . . . . . . . . . . . . . . . .
Procedure for Solving Client Connection Problems . . . . . . . .
Procedure for Solving Share Access Problems . . . . . . . . . . . .
Procedure for Solving Printing Problems . . . . . . . . . . . . . . . .
Procedure for Solving User Account Problems . . . . . . . . . . . .
Procedure for Solving Problems of Privileged Users . . . . . . . .
Procedure for Solving Problems Connecting to the Advanced
Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Procedure for Solving License Validation Problems . . . . . . . .
Security Model Configuration Parameter Settings . . . . . . . . .
Keys for Controlling the Configuration Manager . . . . . . . . . .
PWRK$REGUTL Commands . . . . . . . . . . . . . . . . . . . . . . . . .
PWRK$REGUTL SHOW Command Qualifiers . . . . . . . . . . .
Registry Value Terminology . . . . . . . . . . . . . . . . . . . . . . . . . .
Computer Name Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Print Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Browser Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Netlogon Service Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Advanced Server Process Parameter Values . . . . . . . . . . . . .
Advanced Server File Services Parameter Values . . . . . . . . .
Advanced Server Share Parameter Values . . . . . . . . . . . . . . .
Advanced Server Parameters Values . . . . . . . . . . . . . . . . . . .
Lanman Server Parameter Values . . . . . . . . . . . . . . . . . . . . .
Alerter Service Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Application Event Log Values . . . . . . . . . . . . . . . . . . . . . . . .
Security Event Log Values . . . . . . . . . . . . . . . . . . . . . . . . . . .
System Event Log Values . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4–59
6–2
6–4
6–4
6–6
6–12
6–13
6–22
6–23
6–25
6–27
6–28
6–29
6–31
6–33
6–34
6–35
6–39
7–10
7–15
7–24
7–28
A–2
A–4
A–5
A–6
A–7
A–9
A–10
A–11
A–13
A–16
A–19
A–20
A–21
A–22

A–15
B–1
B–2
B–3
B–4

User Service Parameter Values . . . . . . . . . . . . . . . . . . . . . . .
Supported Transports and Protocols . . . . . . . . . . . . . . . . . . .
TCP/IP Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
NetBEUI Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
DECnet-Plus Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

A–23
B–5
B–6
B–7
B–8

xvii

Preface
Welcome to the Compaq Advanced Server for OpenVMS Server Administrator’s
Guide. For the purpose of this text, the Advanced Server for OpenVMS
software is referred to as the Advanced Server. The Advanced Server and
its associated OpenVMS system platform provide a powerful, reliable, and open
operating environment that meets the demands of client/server computing.
The Compaq Advanced Server for OpenVMS Server Administrator’s Guide
presents step-by-step procedures for managing and maintaining the Advanced
Server. It describes how to complete common tasks, such as managing files
and directories, printing, and administering the network. Unless otherwise
noted, commands used in procedures and examples are Advanced Server
ADMINISTER commands.

Intended Audience
This guide is for the OpenVMS network administrator. As the network
administrator, you must be familiar with the Compaq OpenVMS operating
system to support the server, and with other operating systems to support
clients. It is also expected that you have had experience managing an
OpenVMS system and doing network administration, and that you are familiar
with the specific network configuration being managed.
You are assumed to have read the following product manuals:
•

Compaq Advanced Server for OpenVMS Concepts and Planning Guide

•

Compaq Advanced Server for OpenVMS Server Installation and
Configuration Guide

•

Compaq Advanced Server for OpenVMS Guide to Managing Advanced
Server Licenses

You are assumed to have access to the following documentation:
•

Compaq Advanced Server for OpenVMS Commands Reference Manual

xix

•

Documentation for any clients or servers running other operating systems
in the domain

This guide addresses use of the Advanced Server for OpenVMS only.

Document Structure
The following table lists the chapters in this guide:
Chapter

Description

Chapter 1

Provides an overview of this guide

Chapter 2

Describes how to manage servers and domains with the
Advanced Server for OpenVMS software

Chapter 3

Describes how to manage users and groups in the Advanced
Server environment

Chapter 4

Describes how to manage shared disk resources, including
directories and files

Chapter 5

Describes how to share printer resources, including printers
and print queues

Chapter 6

Describes how to monitor events and troubleshoot your
server

Chapter 7

Describes the Configuration Manager tool and how to use
it to configure and tune your server, and describes how to
manage server configuration parameters in the OpenVMS
Registry

Appendix A

Describes the server configuration parameters in the
OpenVMS Registry

Appendix B

Describes each of the supported network protocols

Related Documents
The following table lists Advanced Server documents:

Document

Description

Compaq Advanced Server for
OpenVMS Commands Reference
Manual

Provides command syntax descriptions for all
ADMINISTER commands and NET command
equivalents

Compaq Advanced Server for
OpenVMS Server Installation
and Configuration Guide

Explains how to install and configure Advanced
Server software

Compaq Advanced Server
for OpenVMS Concepts and
Planning Guide

Provides an overview of and introduction to
the Advanced Server software and associated
networking concepts for system administrators and
operators

Compaq Advanced Server for
OpenVMS Guide to Managing
Advanced Server Licenses

Describes the License Server software and how to
manage Advanced Server licenses

The following table lists related OpenVMS documents:
OpenVMS Document

Description

OpenVMS Version 7.2 New Features and
Documentation Overview

Describes the new features of the
OpenVMS Alpha Version system software.

OpenVMS Alpha Version 7.2 Upgrade
and Installation Manual

Describes how to install the OpenVMS
Alpha Version system software, and how to
set up the required system services

OpenVMS System Manager’s Manual

A task-oriented guide (in two volumes) to
managing an OpenVMS system; describes
how to set up the required system services

OpenVMS System Management Utilities
Reference Manual

A reference guide (in two volumes) to the
utilities and tools used in managing an
OpenVMS system

OpenVMS License Management Utility
Manual

Explains how to load and manage license
Product Authorization Keys (PAKs)

OpenVMS Guide to Extended File
Specifications

Describes Extended File Specifications on
OpenVMS, including how to set up and
enable the ODS-5 file system

OpenVMS Guide to System Security

Describes OpenVMS security features,
including procedures for enabling external
authentication

Compaq C Run-Time Library Utilities
Reference Manual

Describes utilities that help you manage
localization and time zone data for
international software applications

OpenVMS Connectivity Developer’s Guide

Contains COM for OpenVMS, OpenVMS
Registry, and OpenVMS Events information

xxi

For additional information about the OpenVMS products and services, access
the following World Wide Web address:
http://www.openvms.compaq.com/

Reader’s Comments
Compaq welcomes your comments on this manual. Please send comments to
either of the following addresses:
Internet

openvmsdoc@compaq.com

Mail

Compaq Computer Corporation
OSSG Documentation Group, ZKO3-4/U08
110 Spit Brook Rd.
Nashua, NH 03062-2698

How To Order Additional Documentation
Use the following World Wide Web address to order additional documentation:
http://www.openvms.compaq.com/
If you need help deciding which documentation best meets your needs, call
800-282-6672.

Conventions
The following conventions are used in the Advanced Server documentation
set:
Convention

Meaning

Advanced Server

Indicates the file and print server installed from the Advanced
Server for OpenVMS software kit.

Italic

Italic text indicates a place holder for information or parameters
that you must provide. For example, if the procedure asks you to
type file-name, you must type the actual name of a file.
Italic text also indicates path names, new terms, and the titles of
other documents.

xxii

bold

Bold text indicates a server configuration parameter name, a
command button name, or a menu item.

monospace

Monospace text indicates the actual commands, words, or
characters that you type in a dialog box or at a command prompt
or system output.

Convention

Meaning

UPPERCASE
TEXT

Uppercase text indicates names of OpenVMS and Advanced
Server for OpenVMS commands and qualifiers. You can enter
commands and qualifiers in any combination of uppercase and
lowercase letters, unless otherwise noted.

A forward slash in command descriptions indicates that a
command qualifier follows.

An equal sign ( = ) in command descriptions indicates you must
provide information.

[]

In command format descriptions, brackets indicate optional
elements. Multiple elements are separated by vertical bars ( | ).
You can enter as many as you want.

{}

In command format descriptions, braces indicate you must enter
at least one listed element. The elements are separated by bars
( | ).

...

A horizontal ellipsis following an entry in a command line
indicates that the entry or a similar entry can be repeated any
number of times. An ellipsis following a file name indicates that
additional parameters, values, or information can be entered.

.
.
.

A vertical ellipsis in an example indicates that not all the data is
shown.

Note

The use of Note indicates information of special importance.

Caution

The use of Caution indicates information to avoid damaging
hardware or software.

Ctrl/x

While you hold down the Ctrl key, press another key or a
pointing device button.

Return or Enter

In text, Return or Enter indicates where you should press the
Return or Enter key to execute a command or terminate a
sequence. This key is labeled Return or Enter, depending on
your keyboard.

Tab

In examples, a key name enclosed in a box indicates that you
press a key on the keyboard. (In text, a key name is not enclosed
in a box.)
In the HTML version of this document, this convention appears
as brackets, rather than a box.

PF1 x

A sequence such as PF1 x indicates that you must first press and
release the key labeled PF1 and then press and release another
key or a pointing device button.

xxiii

1
Overview
The Advanced Server is an OpenVMS-based network operating system (NOS)
compatible with Microsoft networking technology. The Advanced Server
software provides a flexible system for managing wide area networks (WANs)
and local area networks (LANs). The software lets you use Compaq Computer
Corporation computers as servers to share network resources with supported
clients and is compatible with Windows NT and Windows 2000 servers running
in the same network.
As a server for computers in a network, the Advanced Server provides file and
print services that enable the efficient sharing of computing resources among
a community of desktop users. It can function as a file and print server for
a small, isolated community of users or as the foundation of a large network
distributed over a wide geographical area.
You can perform Advanced Server management tasks from any client or
server that is running Windows NT server administration tools, and from
any Advanced Server using the Advanced Server ADMINISTER commands.
This document shows you how to manage your servers using Advanced Server
software.
This overview of Advanced Server describes the role of the network
administrator, and the features available with Advanced Server, in the
following sections:
•

Section 1.1, The Role of the Administrator, describes what you do, as
the server administrator, and what tasks you perform to administer the
network.

•

Section 1.2, The Advanced Server Network, describes the components of
the network, its features, and services.

•

Section 1.3, Resource Sharing, describes the resources you can share, such
as directories and print queues, and how to share them.

•

Section 1.4, Monitoring Events and Troubleshooting, describes the tools
you use to track resource use and to modify your network configurations.

Overview 1–1

Overview

•

Section 1.5, Network Administration Interfaces, describes the server and
client software interfaces with which you manage your servers, including
the Advanced Server ADMINISTER command-line interface.

•

Section 1.6, The Advanced Server ADMINISTER Command-Line Interface,
describes the Advanced Server ADMINISTER command-line interface.

1.1 The Role of the Administrator
When you administer any network, you plan, set up, and maintain that
network. For information on planning and design, refer to the Compaq
Advanced Server for OpenVMS Concepts and Planning Guide.
To plan a network, complete the following tasks:
•

Organize the network into domains.

•

Decide how to configure each server in a domain.

•

Evaluate new applications and peripherals.

After planning your network and putting all hardware and connecting links in
place, you install and configure Advanced Server software. You can then use
the instructions in this document to customize and manage the server.

1.1.1 Setting Up the Advanced Server Environment
As part of the installation, described in the Compaq Advanced Server
for OpenVMS Server Installation and Configuration Guide, you specify
parameters to establish your network. After installation, you can modify server
configuration parameters in the OpenVMS Registry. For more information,
see Section 7.2, Managing Server Configuration Parameters Stored in the
OpenVMS Registry.
The Advanced Server Configuration Manager allows you to modify server
parameter values, such as client capacity, OpenVMS process priority, and
network transports. For more information, see Section 7.1, Managing File
Server Parameters Affecting System Resources.
Initial server configuration is performed when you install and configure
the server software. The initial configuration command procedure,
PWRK$CONFIG.COM, allows you to invoke the Configuration Manager so
you can specify server parameters during initial configuration. The initial
configuration procedure is described in the Compaq Advanced Server for
OpenVMS Server Installation and Configuration Guide. After you complete the
initial installation and configuration, you can run the Configuration Manager
to modify certain server configuration parameters, and you can modify the
server configuration parameters in the OpenVMS Registry.
1–2 Overview

Overview
1.1 The Role of the Administrator

1.1.2 Administering the Network
Once you have planned and set up your overall network configuration, you
support it by performing the following tasks:
•

Maintaining user accounts, shares, and other resources, such as printers

•

Monitoring events and troubleshooting server problems

1.1.2.1 Maintaining User Accounts, Shares, and Resources
Performing this maintenance includes:
•

Keeping records of the network configuration

•

Adding new users who need access to server resources

•

Removing users who no longer need access to server resources

•

Setting up and controlling shared directories

•

Setting up and controlling shared print queues

•

Controlling server disk storage space

•

Backing up and restoring server files

1.1.2.2 Monitoring Events and Troubleshooting Server Problems
You may need to perform certain infrequently used procedures to resolve
network problems caused by unexpected conditions; for example, faulty wiring,
faulty hardware, or overloaded servers or printers. Advanced Server provides
commands and diagnostic tools to help you isolate and fix such problems.
Chapter 6, Monitoring Events and Troubleshooting, describes some ways to
monitor and troubleshoot your network.

1.2 The Advanced Server Network
An Advanced Server network consists of computers, both servers and clients.
Servers control resources that client systems on the network can use. Clients
are typically PC-based systems that need access to resources on the server.
Workstations and other computers running networking software that can
access network resources can be clients.
Supported client operating systems include Windows 3.11, Windows 95,
Windows 98, Windows 2000, Windows NT, Windows for Workgroups, and
MS-DOS. Compaq PATHWORKS 32 client software is supported but not
required.
Servers in the network can run the following software:
•

Advanced Server for OpenVMS, V7.2-1 (or higher)
Overview 1–3

Overview
1.2 The Advanced Server Network
•

PATHWORKS V6 for OpenVMS (Advanced Server)

•

PATHWORKS V5 for OpenVMS (LAN Manager)

•

Advanced Server for UNIX (Tru64 UNIX)

•

Windows NT Server V3.51 or V4

•

Windows 2000

1.2.1 Domains
To help you manage a large and diverse network, Advanced Server software
lets you divide the network into domains, or administrative groups of servers
and clients. With domains, control of user access to the network and its
resources is centralized and simplified, and you can establish exactly which
servers a specific user can access.
A domain is a collection of computers that share a common security accounts
database and security policy. You create a domain when you install and
configure a primary domain controller. To enable users to access resources
in domains where they have no user accounts, you can establish trust
relationships between domains. This provides flexibility when configuring
large networks with multiple domains. For more information about planning
domains, refer to the Compaq Advanced Server for OpenVMS Concepts and
Planning Guide. For more information on managing domains, see Chapter 2,
Managing Domains and Servers.

1.2.2 Security
Advanced Server provides two security models:
•

Advanced Server Only security model

•

Advanced Server and OpenVMS security model

The Advanced Server Only security model provides access based on Advanced
Server user account security policies and user access rights on shared
resources. The Advanced Server and OpenVMS security model provides
access based on both Advanced Server and OpenVMS security policies. The
Advanced Server and OpenVMS security model is never necessary to control
user access to resources, but is provided to allow administrators of systems
with complex OpenVMS security controls already in place to use those same
controls to restrict access by client users. Note that use of the Advanced Server
and OpenVMS security model results in the extra overhead of validating both
the Advanced Server and OpenVMS settings.

1–4 Overview

Overview
1.2 The Advanced Server Network

1.2.3 Users
A user who needs access to resources shared on a server must have access to
one of the following:
•

An Advanced Server user account established on that server. A user
account contains all the information that the Advanced Server needs to
define a user, including the user name, a description, and a password.

•

A server that provides Guest access to resources.

•

A server that provides access based on domain trust relationships.

The user account, with its associated password, identifies the user to the
Advanced Server software. You can enable logon restrictions for each user
account; for example, limiting the hours during which the user can access
server resources.
By default, a shared resource is available to all users. You can assign access
permissions to users for resources, specifying the type of access each user
can have to a given resource. You can assign a different set of permissions
for each user and for each shared resource. If you use the Advanced Server
Only security model, access permissions grant access to OpenVMS files and
directories on the server, regardless of the OpenVMS file protections. For
more information on the interaction of these two access permissions, see
Section 4.1.2, Advanced Server Security Models.
If a trust relationship has been established between two domains, you
can grant access to resources for users from the trusted domain. To grant
permissions to a user from a trusted domain, include the domain name when
you specify the user name. For more information on trust relationships, see
Section 2.1.8, Managing Trust Relationships.

1.2.4 Groups
To simplify administration of access permissions, you define groups of users.
The members of a group are users and other groups. Groups provide an easy
way to grant common capabilities to several users; group permissions are
provided to all its members.
A group can be either global or local. A global group is a collection of user
accounts allowed to access resources in one domain. It can also be assigned
permissions to use resources in a trusting domain. A global group:
•

Can be used to assign permissions and rights within the domain

•

Cannot contain other groups as members

•

Cannot contain users from another domain

Overview 1–5

Overview
1.2 The Advanced Server Network
•

Cannot contain groups from another domain

A local group can include users and global groups from its own domain and
from trusted domains. Thus, it provides access to resources in its domain to
users in its domain and in trusted domains.
If a trust relationship has been established between two domains, you can
grant access to resources for groups from the trusted domain. To grant
permissions to the members of a group from another domain, include the
domain name when you specify the group name.
For more information about groups, see Chapter 3, Managing Users and
Groups.

1.2.5 Logon Validation
The Advanced Server can validate requests of users to log on to the network.
Logon validation is provided by the NetLogon service and allows the following:
•

A single, domain-wide security accounts database

•

Single domain-wide logon, which lets a user access resources on any server
in the domain and on servers that trust the domain

You create the master security accounts database for the domain when you
configure the primary domain controller. This database is automatically copied
to the backup domain controllers in the domain that are running the NetLogon
service. You do not have to create user accounts separately on each server. All
the servers in the domain that run the NetLogon service use identical copies of
the same domain-wide security accounts database.
Through external authentication, specified OpenVMS users are automatically
validated on the network when they log in to the OpenVMS system running the
Advanced Server. This pass-through style of authentication ensures password
synchronization between OpenVMS user accounts and their corresponding
Advanced Server network account. For more information about external
authentication, see Section 3.1.17, External Authentication.

1.2.6 Logon Scripts
As the network administrator, you can use logon scripts to configure the
working environments of your users by allowing them to automatically make
network connections and start applications. The network administrator can
create logon scripts and then assign a different logon script to each user, or
create a logon script for multiple users. A logon script runs automatically
whenever a user logs on at a workstation running Windows NT, Windows for
Workgroups, Windows 95, Windows 98, or Windows 2000.

1–6 Overview

Overview
1.2 The Advanced Server Network

1.2.7 Home Directories
As the network administrator, you may want to assign a user a home directory
on a server. Users can store private data in their home directories and
have access control over these directories to restrict or grant access to other
users. If users have home directories on computers other than their own,
connections can be made automatically to home directories whenever users
log on. Depending on the client operating system, you may need to specify the
home directory in a logon script. For information about how to specify a logon
script and home directory for a user account, see Section 3.1.3, User Account
Attributes.

1.2.8 Advanced Server Licensing
To access the Advanced Server, clients must be properly licensed with a
valid Client Access license. The Advanced Server includes the Advanced
Server License Server, which distributes client-based licenses to clients during
client startup. The Advanced Server License Registrar validates client-based
licenses when the client establishes a session, and it allocates server-based
licenses. The Compaq Advanced Server for OpenVMS Server Installation and
Configuration Guide describes how to install the License Server. Refer to the
Compaq Advanced Server for OpenVMS Guide to Managing Advanced Server
Licenses for more information about Advanced Server licensing.

1.3 Resource Sharing
Sharing is the process of making resources (printers, directories, and files)
available to users. As the network administrator, you make a resource
available to clients who access the printer or directory, by specifying a share
name and permissions to control access to the share.
Users gain access to a shared resource by:
1. Logging on to the domain or a trusted domain
2. Connecting to the share
As the network administrator, you define which resources to share, which users
and groups can access them, and the type of access each user and group can
have.

Overview 1–7

Overview
1.3 Resource Sharing

1.3.1 Disk Directories
The Advanced Server automatically shares the root directory of all disk devices
connected to the server that are mounted when you start the server process.
This type of share is called an autoshare. It is accessible by Administrators
only.
Advanced Server lets you audit user attempts to access shared files or
directories. You specify the types of access attempts to be audited. When
one of those events occurs, the Advanced Server records an entry in the
Security event log.
For information about setting permissions and auditing for individual files and
directories, see Chapter 4, Managing Directory and File Sharing.
The OpenVMS system supports two file systems:
•

On ODS-2 disk volumes, the traditional file system (RMS). This file system
is useful for OpenVMS system files, layered products, and applications.

•

On ODS-5 disk volumes, the Extended File System (EFS). This file
system is useful for storing directories and files from network clients,
providing greater compatibility with the Windows 2000, Windows 98,
Windows 95, and Windows NT file systems. For information about setting
up EFS, refer to the OpenVMS Guide to Extended File Specifications.
Management of ODS-5 disk volumes in the network environment is
described in Section 4.5, Using ODS-5 Disk Volumes in the Advanced
Server Environment.

1.3.2 Printers
The Advanced Server lets you share printers connected to the network. With
Advanced Server, you can:
•

Create Advanced Server print queues.

•

Share print queues and set print queue permissions to restrict access to
the queue. By default, a print share is available to all users.

•

Manage print queues, print shares, and print jobs.

By default, you manage Advanced Server printers and print shares on the
server using the ADMINISTER command interface. However, you can
configure the server so that you can manage its printers remotely with a
Windows NT system.
For information about managing print shares and queues, see Chapter 5,
Managing Printers, Print Queues, and Print Shares.

1–8 Overview

Overview
1.4 Monitoring Events and Troubleshooting

1.4 Monitoring Events and Troubleshooting
The Advanced Server provides log files for monitoring server resource use and
for recording client and server problems.
The event log records client and server events. It contains the following
information about each event:
•

Nature of the event

•

Event type

•

Date and time when the event occurred

You can establish an audit policy for event types on a server and set auditing
for individual directories or files. The audit policy defines the types of events
to be logged. Auditing also allows you to record server resource use. It can
provide the following information about each access attempt:
•

Name of the server resource accessed

•

Operation performed or attempted

•

Date and time of the operation

•

User name of the user requesting access

For information about setting auditing for specific events and about
troubleshooting server problems, see Chapter 6, Monitoring Events and
Troubleshooting.

1.5 Network Administration Interfaces
You can administer the Advanced Server, another server, or a workstation in
the network, from either a Compaq OpenVMS server or from another computer,
using one of the interfaces listed in Table 1–1, Network Administration
Interfaces.

Overview 1–9

Overview
1.5 Network Administration Interfaces
Table 1–1 Network Administration Interfaces
Computer Type

Interface

Advanced Server for OpenVMS
and PATHWORKS V6 for
OpenVMS (Advanced Server)

Includes the following:

Windows NT Server

•

Advanced Server ADMINISTER commands
(a command-line interface) – to administer
servers, domains, and shares. The complete
command set is described in the Compaq
Advanced Server for OpenVMS Commands
Reference Manual.

•

Advanced Server Configuration Manager (a
character-cell interface) – to manage serverspecific parameters that are not stored in
the OpenVMS Registry. These parameters
are, directly or indirectly, related to the
environment in which the Advanced Server
operates, such as the server’s usage of
OpenVMS system resources and physical
memory. This is described in Section 7.1,
Managing File Server Parameters Affecting
System Resources.

•

On Advanced Server for OpenVMS only,
PWRK$REGUTL (a command-line interface) –
to manage the server configuration parameters
stored in the OpenVMS Registry and which
affect the behavior of the Advanced Server but
not, for the most part, file server resource
consumption. For more information, see
Section 7.2, Managing Server Configuration
Parameters Stored in the OpenVMS Registry.

•

Advanced Server License Manager (a charactercell interface) – to manage the Advanced
Server licenses and License Server. For more
information about the License Manager, refer
to the Compaq Advanced Server for OpenVMS
Guide to Managing Advanced Server Licenses.

Windows NT server administration tools (Windowsbased interfaces, including Server Manager, Print
Manager, User Manager for Domains, and Event
Viewer).
(continued on next page)

1–10 Overview

Overview
1.5 Network Administration Interfaces
Table 1–1 (Cont.) Network Administration Interfaces
Computer Type

Interface

PATHWORKS (LAN Manager)

ADMIN/PATH utility (a character-cell user
interface), or Net commands (a command-line
interface).

LAN Manager V2. x (retail)
servers

Net commands (a command-line interface), or NET
ADMIN (a character-cell interface).

Advanced Server for UNIX

pwadmin commands (a command-line interface), or
net commands (limited functions).

DOS client

Net commands (a command-line interface).

Windows, Windows NT, Windows
2000, Windows 95, or Windows
98 client

MS-DOS Net interface (a command-line interface),
Windows NT server administration tools (Windowsbased user interfaces).

1.6 The Advanced Server ADMINISTER Command-Line
Interface
You can control most aspects of the Advanced Server using the Advanced
Server ADMINISTER command-line interface. You invoke the Advanced
Server ADMINISTER command-line interface by entering the ADMINISTER
command in response to the OpenVMS system prompt. The Advanced Server
command-line interface prompts you with the name of the domain and the
name of the server you are currently administering. For example:
$ ADMINISTER
LANDOFOZ\\TINMAN>
In this example, you are managing a domain called LANDOFOZ and a server
called TINMAN. You can enter ADMINISTER commands at the prompt.
You can also execute ADMINISTER commands on the DCL command line in
the following way:
$ ADMINISTER SET PASSWORD SCARECROW "YellowRoad" "EmeraldCity"
%PWRK-S-PSWCHANGED, password changed for user "SCARECROW" in domain
"LANDOFOZ"
$
In this example, the command-line interface executes a single command and
returns to the OpenVMS system prompt.

Overview 1–11

Overview
1.6 The Advanced Server ADMINISTER Command-Line Interface
The ADMINISTER command-line interface will prompt you for information
required for a given command if you do not supply it on the command line.
For example, you can log on to the network using the LOGON command, as
follows. Note that the password is required, so the software prompts you for it.
When you are prompted for the password, it is not displayed as you enter it.
$ ADMINISTER
LANDOFOZ\\TINMAN> LOGON ADMINISTRATOR
Password:
The server \\TINMAN successfully logged you on as Administrator.
Your privilege level on domain LANDOFOZ is ADMIN.
The last time you logged on was 07/19/00 06:41 PM.
LANDOFOZ\\TINMAN>

1.6.1 Getting Help on ADMINISTER Commands
The Advanced Server ADMINISTER command-line interface has online help
that describes command syntax, options, and qualifiers. It also explains each
command and gives examples of command use. The Help facility for the
ADMINISTER command-line interface has the same structure as OpenVMS
DCL Help.
To use online help, enter one of the following commands:
Syntax

Information Provided

$ ADMINISTER HELP

A list of help topics

$ ADMINISTER HELP command

The description, syntax, qualifiers,
and examples for the specified
ADMINISTER command

$ ADMINISTER
domain\ \ server> HELP

A list of help topics

For complete information on ADMINISTER commands and their syntax, refer
to the Compaq Advanced Server for OpenVMS Commands Reference Manual or
the ADMINISTER command-line interface Help.

1–12 Overview

Overview
1.6 The Advanced Server ADMINISTER Command-Line Interface

1.6.2 Administering Domains and Servers
There are two types of Advanced Server ADMINISTER commands:
•

Commands that operate on a domain
These commands allow you to administer users, groups, or account
policies, audit policies, and trust relationships, and to add, delete, or
display computers. All such ADMINISTER commands can include the
/DOMAIN qualifier to specify a domain other than the one currently being
administered. If you specify the /DOMAIN qualifier, you cannot use the
/SERVER qualifier on these commands; the commands are executed on the
primary domain controller of the specified domain.
A member server does not store or maintain the domain-wide security
accounts database; only domain controllers do. When you administer the
member server’s local security accounts database, certain ADMINISTER
commands are disallowed or their usage is restricted. For information on
managing a member server’s local database, see Section 2.1.5, Member
Servers and Domain Management.

•

Commands that operate on a specific server
These commands allow you to administer shared resources, services, and
server operation; they operate directly on either the default server or on
the server you specify using the /SERVER qualifier. You cannot use the
/DOMAIN qualifier on server-specific commands.

By default, you are set up to administer the local server and the domain
to which it belongs. The default domain remains in effect for the duration
of the current OpenVMS login session, or until you log off the domain or
change the default domain. Commands are executed on the domain and server
indicated by the ADMINISTER command-line interface prompt. For example,
the following prompt indicates the domain currently being administered is
LANDOFOZ, and the server is TINMAN:
LANDOFOZ\\TINMAN>
For administering other (remote) domains and servers with the ADMINISTER
command-line interface, you have these options:
•

SET ADMINISTRATION command — You specify the domain or server, or
both, and all subsequent commands affect the specified domain or server.

•

TELL command — You specify the server and a single command that
is directed to that server. You can use the TELL command to direct
commands to a downlevel server (a server such as the PATHWORKS LAN
Manager server, which runs an earlier network operating system than that
of the Advanced Server).

Overview 1–13

Overview
1.6 The Advanced Server ADMINISTER Command-Line Interface
•

LOGON command — You specify the domain, and all subsequent
commands affect the specified domain. The server name is set to the
local server if the local server is a member of the logged on domain. It is
set to the name of the primary domain controller of the specified domain if
the local server is not a member of the specified domain.

•

/SERVER or /DOMAIN qualifiers — Commands that support these qualifier
allow you to specify the server or domain to be affected by the specified
command.

You can use the SET ADMINISTRATION command to administer resources,
services, and server operation in another domain or server, if you have been
validated for a user account that is a member of the Administrators group. For
more information, see Section 2.1.4, Administering Another Domain.
If you have OpenVMS system management privileges SYSLCK and OPER
on the system, you can execute any server-related ADMINISTER commands
on the local server without logging on to the network, except commands that
require operations with other servers. If your local server is a primary
domain controller, you can also execute any domain-related commands
that do not require operations with other servers. When you have these
OpenVMS privileges, you are treated as if you had logged on to the network
as Administrator. If you do not have these OpenVMS privileges, or if you wish
to manage a server other than your local server, you must log on to a network
user account that is a member of the Administrators local group (for example,
the Administrator user account).
To log on to the network, use the LOGON command. For example:
LANDOFOZ\\TINMAN> LOGON
Username: ADMINISTRATOR
Password:
The server \\TINMAN successfully logged you on as Administrator.
Your privilege level on domain LANDOFOZ is ADMIN.
The last time you logged on was 09/19/00 06:41 PM.
LANDOFOZ\\TINMAN>
You are prompted for your user name and password. The password is not
displayed as you enter it. Once you log on to the domain, you remain logged
on after you exit from the ADMINISTER command interface. To log off the
domain, use the LOGOFF command before exiting.
You can administer another server using the TELL command. TELL sends
the command to be executed to the specified server. In the following example,
the server currently being administered is TINMAN, and the other server is
WOODMAN. The command to be executed on server WOODMAN is SHOW
COMPUTERS.

1–14 Overview

Overview
1.6 The Advanced Server ADMINISTER Command-Line Interface
LANDOFOZ\\TINMAN> TELL WOODMAN SHOW COMPUTERS
%PWRK-I-SRVINFO, the server type is: Advanced Server for OpenVMS
Computers in domain "LANDOFOZ":
Computer
Type
Description
-------------------- ------------------------- -------------------------[PD] TINMAN
OpenVMS (NT 4.0) Primary Advanced Server V7.3
for OpenVMS
[BD] WOODMAN

OpenVMS (NT 3.51) Backup

Advanced Server V7.2
for OpenVMS

Total of 2 computers
LANDOFOZ\\TINMAN>
Be sure to use the proper command syntax for the server you are
administering. For example, to administer a server running PATHWORKS
V5 for OpenVMS (LAN Manager), use LAN Manager NET commands. In the
following example, the PATHWORKS V5 for OpenVMS (LAN Manager) server
name is QUEEN.
LANDOFOZ\\TINMAN> TELL QUEEN NET SHARE
%PWRK-I-SRVINFO, the server type is: LAN Manager 2.2 for OpenVMS
Sharename
Resource
Remark
--------------------------------------------------------------------------ADMIN$
Remote Admin
C$
USERS:[PWRK$ROOT]
PATHWORKS share
IPC$
Remote IPC
USERS$
_QUEEN$DUA1:
ODS-2 volume USERS:
VAXVMSV0.55$
_QUEEN$DUA2
ODS-2 volume VAXVMSV0.55:
NETLOGON
Logon Users Directory
PWUTIL
C:[LANMAN.SHARES.WIN]
PATHWORKS Client-based Utilities
RONNIE
USERS:[RONNIE]
RPL
C:[LANMAN.RPL]
Remoteboot server share
RPLFILES
C:[LANMAN.RPL.RPLFILES] Remoteboot server share
USERS
Logon Users Directory
The command completed successfully
LANDOFOZ\\TINMAN>

1.6.3 Administrative Groups
Some of your network users may be designated as members of administrative
groups, such as account operators, print operators, server operators, or
administrators. These users have administrative or operator privileges
that enable them to perform specific tasks, as described in Table 1–2,
Administrative Groups.

Overview 1–15

Overview
1.6 The Advanced Server ADMINISTER Command-Line Interface
Table 1–2 Administrative Groups
Group Name

Tasks

Account Operators

Create and manage user accounts and global and local
groups.

Administrators

Access servers and computers from the network, take
ownership of files, manage auditing and security logs,
perform all account operator tasks, assign user rights,
create groups, keep a local profile, share and stop sharing
directories, files, and printers.

Print Operators

Keep a local profile; share and stop sharing printers.

Server Operators

Access servers and computers from the network, take
ownership of files, manage auditing and security logs, share
and stop sharing directories, files, and printers.

If you have different operators responsible for different parts of your network
and you do not want to assign them full administrative privileges, make them
members of the Server Operators group only at the server they can administer.

1–16 Overview

2
Managing Domains and Servers
This chapter describes the way Advanced Server participates in a domain and
provides the concepts and procedures you use to manage servers and domains
from Advanced Server.
•

Section 2.1, Managing a Domain, describes the way Advanced Server
participates in domains and describes the procedures for administering
domain operations from an Advanced Server.

•

Section 2.2, Managing Security Policies, describes how to manage the
account policy and the audit policy.

•

Section 2.3, Managing a Server, describes the Advanced Server and how to
administer server-specific operations.

•

Section 2.4, Advanced Server in OpenVMS Clusters, describes the way an
OpenVMS Cluster acts as an Advanced Server.

2.1 Managing a Domain
A domain is a set of computers that share a common security accounts
database (also referred to as the Security Account Manager (SAM) database)
and security policy. The security accounts database contains security
information such as user accounts and passwords, and groups, and the
settings of the security policies. When you manage a domain and its services,
you control its system entities and resources, and you can display information
about its resources, such as its computers, connections, users and user sessions,
shares, and services.
The Advanced Server may participate in any of the following three kinds of
domains:
•

Windows NT domains, which consist of primary domain controllers (PDCs),
backup domain controllers (BDCs), and member servers; Advanced Servers
can participate in any of these three roles. A Windows NT domain must
include at least one PDC. The PDC maintains the domain-wide security

Managing Domains and Servers 2–1

Managing Domains and Servers
2.1 Managing a Domain
accounts database. Copies are kept on each BDC. Changes made to the
PDC are replicated to the BDCs in the domain.
•

Windows 2000 mixed-mode domains, which include both Windows 2000
domain controllers and Windows NT or Compaq Advanced Server domain
controllers; Advanced Servers can participate as BDCs and member
servers. A Windows 2000 mixed-mode domain must include at least one
Windows 2000 domain controller.

•

Windows 2000 native-mode domains (also referred to as a pure Windows
2000 domains), in which all domain controllers are Windows 2000 systems;
Advanced Servers can participate as member servers only. A Windows
2000 native-mode domain must include at least one domain controller.
The domain controllers participate in a multi-master domain controller
model, meaning that changes to the SAM database can be made on any
domain controller. Any domain controller can be the replicator, sending
copies of the updated SAM database to the other domain controllers.
This model contrasts to the PDC/BDC model used by Windows NT Servers
and Advanced Server for OpenVMS servers configured as PDCs and BDCs.
In the PDC/BDC model, changes to the SAM database are made on the
PDC first, which then replicates the database changes to the BDCs.

Section 2.1.1, Server Roles in the Domain, describes the roles that the
Advanced Server can take in a domain.

2.1.1 Server Roles in the Domain
The Advanced Server can have one of three roles in a domain:
•

Primary domain controller (PDC)
Each domain running logon validation must have one server that functions
as the primary domain controller. This server has the domain’s master
copy of the security accounts database. The PDC can validate logon
requests in the domain. You can change the security accounts database
from any computer in the domain, and the change is made to the security
accounts database on the PDC.
When you configure the server software into a new domain, the server
establishes the domain’s security accounts database (SAM database) and
becomes the PDC. The default domain name is LANGROUP. You can
specify a name that reflects your company or group.

•

Backup domain controller (BDC)

2–2 Managing Domains and Servers

Managing Domains and Servers
2.1 Managing a Domain
In addition to the primary domain controller, the domain can have backup
domain controllers (BDCs). A BDC keeps a copy of the domain’s master
security accounts database. The copy of the security accounts database
stored on BDCs is synchronized with the PDC’s database, as explained in
Section 2.1.2.1, Synchronizing SAM Databases on Domain Controllers.
Like the PDC, a BDC can validate logon requests. This improves
performance and reliability because the load of logon validation can be
spread among several servers. Furthermore, logon validation in the
domain can continue even if the PDC is unavailable. A BDC can be
promoted to PDC.
When you configure the server software and specify an existing domain
name, you can have the server join the existing domain as a BDC.
The domain must include one active PDC. Note that as a BDC, the
Advanced Server can participate in Windows 2000 mixed-mode domains.
To participate in a native-mode Windows 2000 domain, the Advanced
Server must be configured as a member server, as described below.
•

Member server
A member server is a server that is a member of a domain but does not
store a copy of the domain’s security accounts database and does not
validate logon requests. Member servers rely on domain controllers to
validate credentials of users requesting access to member server shares.
Member servers maintain their own local security accounts database.
For more information on managing a member server’s local database, see
Section 2.1.5, Member Servers and Domain Management.
Configuring the Advanced Server as a member server allows it to
participate in a native-mode Windows 2000 domain without interruption
to the Windows 2000 domain. A native-mode Windows 2000 domain must
include at least one domain controller. Windows NT member servers
can also participate along with Advanced Server member servers in
native-mode Windows 2000 environments.

When you configure the Advanced Server for the first time, you select the role
your server will perform in the domain. There may be times when you need
to change the role of your server. The method you use to change the server
depends on the current role of the server and the role you want to change it to.
For more information on changing a server’s role, see Section 2.1.1.1, Changing
a Server’s Role in a Domain.
In an OpenVMS Cluster, all nodes on the cluster running the Advanced Server
must have the same role.

Managing Domains and Servers 2–3

Managing Domains and Servers
2.1 Managing a Domain
2.1.1.1 Changing a Server’s Role in a Domain
The first server to be configured in a domain is always the primary domain
controller (PDC). The PDC role is established during initial installation and
configuration of the server. When you install a new server into an existing
domain, you can configure it as a backup domain controller (BDC) or member
server. You can change the role of the server from a BDC to a PDC, or
vice versa, using the ADMINISTER SET COMPUTER/ROLE command. To
change the role of a BDC to a member server, or vice versa, you must use
PWRK$CONFIG. To change a PDC to a member server, you must first promote
a BDC to a PDC in that domain. The original PDC is automatically demoted
to a BDC, and then you can use PWRK$CONFIG to reconfigure it as a member
server. Likewise, to change a member server to a PDC, you must first change
the member server to a BDC (using PWRK$CONFIG), and then change the
BDC to a PDC.
Table 2–1, Role Changes, lists possible role changes you can make and
indicates the tools you can use to make the changes: PWRK$CONFIG and/or
the ADMINISTER SET COMPUTER/ROLE command. Section 2.1.1.1.1,
Changing the Role of a BDC to a PDC, or Vice Versa, explains in detail how to
change the role of a BDC to a PCD, or vice versa. Section 2.1.1.1.2, Changing
a BDC to a Member Server, or Vice Versa, explains how to change a BDC to a
member server, or vice versa.
Table 2–1 Role Changes
To Change:

Use:

Notes:

BDC to PDC

ADMINISTER

Promoting the BDC automatically
demotes the current PDC of the domain
to a BDC.

BDC to Member

PWRK$CONFIG

Member to PDC

PWRK$CONFIG,
then ADMINISTER

Member to BDC

PWRK$CONFIG

PDC to BDC

ADMINISTER

First, use PWRK$CONFIG to change
the member server to a BDC, and then
use ADMINISTER to promote the BDC
to a PDC.
Use the ADMINISTER command to
promote a BDC to PDC; this demotes
the PDC to a BDC.
(continued on next page)

2–4 Managing Domains and Servers

Managing Domains and Servers
2.1 Managing a Domain
Table 2–1 (Cont.) Role Changes
To Change:

Use:

Notes:

PDC to Member

ADMINISTER,
First, use ADMINISTER to promote
then PWRK$CONFIG a BDC in the domain to a PDC. This
demotes the original PDC to a BDC.
Then, use PWRK$CONFIG to change
the BDC to a member server.

When you change the server role on one member of an OpenVMS Cluster,
the role on all cluster members running the Advanced Server is also changed
accordingly. For information about running the Advanced Server in a cluster
environment, see Section 2.4, Advanced Server in OpenVMS Clusters.
2.1.1.1.1 Changing the Role of a BDC to a PDC, or Vice Versa You change
the role of the PDC by promoting a BDC. For example, if the PDC needs to be
taken off line for maintenance, you can promote a BDC to be the PDC. When
you promote a BDC, the role of the original PDC is automatically changed to
BDC, at which point you can take it off line. In this case, when the original
PDC comes back on line, it has the role of BDC. You can then promote it to
PDC, if necessary.
If the PDC fails unexpectedly, the domain continues to provide logon validation
as long as the NetLogon service is running on a BDC. However, to make
changes to the security accounts database, a PDC is required. Therefore,
if you think the PDC will be unavailable for more than a short time, you
should promote a BDC. When the original PDC comes back on line after an
unscheduled interruption, it continues to assume the role of PDC. If the PDC
is restarted and you have promoted a BDC in its absence, the NetLogon service
is not started on the server, and the following Alert message is generated and
recorded in the system event log:
A primary domain controller is running in the domain
In this case, you must explicitly change the server’s role to BDC using the SET
COMPUTER/ROLE command. It may take a few minutes to complete a server
role change in a domain.
While server roles are changing, you cannot make changes to the security
accounts database; logon validation remains available during the role change
if there is another BDC running the NetLogon service. See Section 2.3.4,
Managing Services, for more information about the NetLogon service.

Managing Domains and Servers 2–5

Managing Domains and Servers
2.1 Managing a Domain
To change the server role in a domain from BDC to PDC, or vice versa, follow
these steps:
1. Log on as the domain administrator.
2. Use the SHOW COMPUTERS command to check the server’s current role.
3. Use the SET COMPUTER/ROLE command to change a server’s role.
4. Use the SHOW COMPUTERS command to verify the new server role.
For example:
$ ADMINISTER
LANDOFOZ\\TINMAN> LOGON ADMINISTRATOR
Password:
The server \\TINMAN successfully logged you on as Administrator.
Your privilege level on domain LANDOFOZ is ADMIN.
The last time you logged on was 8/11/00 2:57 PM.
LANDOFOZ\\TINMAN> SHOW COMPUTERS
Computers in domain "LANDOFOZ":
Computer
Type
------------ -----------------------[PD] TINMAN
OpenVMS (NT 4.0) Primary

Description
---------------------------Advanced Server V7.3 for OpenVMS

[BD] WOODMAN

OpenVMS (NT 3.51) Backup

Advanced Server V7.2 for OpenVMS

[SV] LIONHEART OpenVMS (NT 4.0) Server

Advanced Server V7.3 for OpenVMS

Total of 3 computers
LANDOFOZ\\TINMAN> SET COMPUTER WOODMAN/ROLE=PRIMARY_DOMAIN_CONTROLLER
Promoting "WOODMAN" to a Primary Domain Controller may take a few minutes.
Do you want to continue with the promotion [YES or NO] (YES) : YES
%PWRK-I-ROLESYNC, synchronizing "WOODMAN" with its primary
%PWRK-I-ROLENLSTOP, stopping the Net Logon service on "WOODMAN"
%PWRK-I-ROLENLSTOP, stopping the Net Logon service on "TINMAN"
%PWRK-I-ROLECHANGE, changing "TINMAN"’s role to Backup Domain Controller
%PWRK-I-ROLECHANGE, changing "WOODMAN"’s role to Primary Domain Controller
%PWRK-I-ROLENLSTART, starting the Net Logon service on "WOODMAN"
%PWRK-I-ROLENLSTART, starting the Net Logon service on "TINMAN"
%PWRK-I-ROLECHANGED, the computers role was successfully changed
LANDOFOZ\\TINMAN> SHOW COMPUTERS
Computers in domain "LANDOFOZ":
Computer
Type
------------ ------------------------[BD] TINMAN OpenVMS (NT 4.0) Backup

Description
------------------------Advanced Server V7.3 for OpenVMS

[PD] WOODMAN OpenVMS (NT 3.51) Primary

Advanced Server V7.2 for OpenVMS

[SV] LIONHEART OpenVMS (NT 4.0) Server

Advanced Server V7.3 for OpenVMS

2–6 Managing Domains and Servers

Managing Domains and Servers
2.1 Managing a Domain
Total of 3 computers
LANDOFOZ\\TINMAN>
Note that a member server (in this example, LIONHEART) is represented with
the display symbol [SV], and the server type is Server.
2.1.1.1.2 Changing a BDC to a Member Server, or Vice Versa To change
the role of a BDC to a member server, you must use the PWRK$CONFIG
procedure. You cannot use the SET COMPUTER/ROLE command. The same
is true of changing the role of a member server to a BDC. These restrictions
are similar (but less restrictive) to those of Windows NT, which requires the
operating system software to be reinstalled to change a domain controller to a
member server, or vice versa. For a list of advantages gained by configuring
your server as a member server, and for details on configuring a server as a
member server, refer to the Compaq Advanced Server for OpenVMS Server
Installation and Configuration Guide.
Caution
If you reconfigure a backup domain controller as a member server,
PWRK$CONFIG automatically removes the domain controller’s
domain user account database. If you reconfigure a member server
to a BDC, PWRK$CONFIG automatically removes the member server’s
local user account database. The removed database is stored in the
PWRK$LMDOMAINS: and PWRK$LMDATAFILES: directories in
case you decide to restore them later. For more information, refer to
the Compaq Advanced Server for OpenVMS Server Installation and
Configuration Guide.
In either case, because of loss of local group information, access to some
resources might be affected. If resource permissions have been set
using local groups, those permissions will have to be reset. If resource
permissions have been set using global groups or global user accounts,
those permissions will remain in effect after the role change.

2.1.2 Domain Controllers and the SAM Database
The NetLogon service ensures that each BDC’s copy of the domain-wide
security accounts (SAM) database is identical to the master copy kept on
the PDC. At regular intervals, any changes made to the master copy of the
security accounts database on the PDC are replicated to all BDCs, as described
in Section 2.1.2.1, Synchronizing SAM Databases on Domain Controllers.
However, the Advanced Server does not replicate user files and directories.

Managing Domains and Servers 2–7

Managing Domains and Servers
2.1 Managing a Domain
If the PDC fails or is stopped, you cannot make changes that affect the
domain’s security accounts database, but logon validation continues as long as
one or more BDCs are running the NetLogon service. Because PDCs and BDCs
keep their own copies of the database, and because the PDC and all BDCs
can validate logon requests, there is no single point of failure in the domain.
However, if the PDC is unavailable for an extended period, you should promote
a BDC to assume the PDC role, so that changes can be made to user accounts.
Each domain in a network is identified internally by a security identifier (SID),
a unique number associated with the domain. When a PDC is installed and
started, a unique SID is assigned. Therefore, if you have an existing domain,
and you want to add a new server to the domain as the PDC, you must install
the new server as a BDC first, then change the server’s role. For information
about changing the server’s role, see Section 2.1.1.1, Changing a Server’s Role
in a Domain.
2.1.2.1 Synchronizing SAM Databases on Domain Controllers
Normally, the domain security databases are synchronized automatically at
regular intervals: the primary domain controller (PDC) replicates its databases
to the backup domain controllers (BDCs). In rare cases, you may need to
synchronize them manually. For example, you may have just added some
new users or groups and you want the BDCs to be able to validate the new
user logons now, rather than after the next periodic synchronization. To do
this, use the SET COMPUTER/ACCOUNT_SYNCHRONIZE command. You
can synchronize all BDCs at once, or synchronize an individual BDC with the
PDC.
2.1.2.1.1 How to Synchronize All Controllers in a Domain To ensure
that all BDCs are synchronized with the PDC, enter the SET COMPUTER
/ACCOUNT_SYNCHRONIZE command, specifying the PDC.
For example, if the PDC is called TINMAN, the following command ensures
that all BDCs in the domain are synchronized with TINMAN. This command
results in each BDC receiving a synchronize status message from the PDC.
The information in this message determines whether the BDC’s databases are
synchronized with the PDC’s databases. If the status message indicates to a
BDC that the PDC’s databases contain changes that are not represented in the
BDC’s databases, the BDC will request a partial synchronization. The PDC
sends the BDC only those database elements that were changed since the last
time the BDC received a status message.

2–8 Managing Domains and Servers

Managing Domains and Servers
2.1 Managing a Domain
LANDOFOZ\\TINMAN> SET COMPUTER TINMAN/ACCOUNT_SYNCHRONIZE
Resynchronizing "LANDOFOZ" domain may take a few minutes.
Do you want to continue with the synchronization [YES or NO] (YES) : YES
%PWRK-S-ACCSYNCHED, account synchronization was successfully initiated
LANDOFOZ\\TINMAN>
Although the command has completed successfully, the synchronization process
takes a few minutes to complete. You can monitor its progress by reviewing
the System event log file using the SHOW EVENTS command. If the BDCs
are already up-to-date, no event log message is recorded.
2.1.2.1.2 How to Synchronize a Specific Backup Domain Controller with
the Primary Domain Controller To synchronize a specific backup domain
controller (BDC) with the primary domain controller (PDC), enter the SET
COMPUTER/ACCOUNT_SYNCHRONIZE command, specifying the BDC
name.
For example, if the BDC is called WOODMAN, the following command
synchronizes only the server WOODMAN with the domain’s primary domain
controller, TINMAN. The BDC requests a full synchronization, meaning that
the entire databases are replicated to the BDC.
LANDOFOZ\\TINMAN> SET COMPUTER WOODMAN/ACCOUNT_SYNCHRONIZE
Resynchronizing "WOODMAN" with its Primary Domain Controller "TINMAN"
may take a few minutes.
After the synchronization has completed, you should check the Event Logs on
"WOODMAN" and "TINMAN" to determine whether synchronization was
successful.
Do you want to continue with the synchronization [YES or NO] (YES) : YES
%PWRK-S-ACCSYNCHED, account synchronization was successful
LANDOFOZ\\TINMAN>
Although the command has completed successfully, the synchronization
process takes a few minutes to complete, and longer if the database contains
thousands of accounts. You can monitor its progress by reviewing the System
event log of the primary domain controller, using the command SHOW
EVENTS/SERVER=pdc_name (where pdc_name is the name of the primary
domain controller). (Note that the primary domain controller periodically
posts an update to its System event log during a full synchronization; the
backup domain controllers post a single update when the synchronization has
completed.)

Managing Domains and Servers 2–9

Managing Domains and Servers
2.1 Managing a Domain

2.1.3 Displaying the Current Domain
When you use the ADMINISTER command-line interface, the command
prompt provides the name of your domain, along with the name of the server.
By default, you are set up to administer the local server and the domain to
which it belongs. The default domain remains in effect for the duration of the
current OpenVMS login session, or until you log off the domain or change the
default domain. (You can change the default server, too.)
To display the current domain and server, execute the ADMINISTER
command. For example:
$ ADMINISTER
LANDOFOZ\\TINMAN>
The domain name and server name are in the command prompt. In this
example, the domain name is LANDOFOZ and the server name is TINMAN.
Any domain name prefixed by the double backslashes indicates a member
server (or workstation) local security accounts database will be the target
of ADMINISTER commands. For more information on managing member
servers, see Section 2.1.5, Member Servers and Domain Management.
Use the SHOW ADMINISTRATION command to display information about the
current domain and your logged-on user account. For example:
LANDOFOZ\\TINMAN> SHOW ADMINISTRATION
Administration information:
The domain being administered is: LANDOFOZ
The domain controller for the domain is: TINMAN
The domain controller type is: Advanced Server for OpenVMS
The server being administered is TINMAN
The server type is: Advanced Server for OpenVMS
The user name is: ADMINISTRATOR
The user is logged on to domain LANDOFOZ and has been authenticated.
The user’s privilege level on this domain is: ADMIN
The user’s workstation is TINMAN and is in domain LANDOFOZ.
LANDOFOZ\\TINMAN>

2–10 Managing Domains and Servers

Managing Domains and Servers
2.1 Managing a Domain

2.1.4 Administering Another Domain
You can administer another domain in either of the following ways:
•

Use the SET ADMINISTRATION /DOMAIN command. You can perform
only administrative functions that do not require you to be logged on to the
domain you are administering, such as the SHOW TRUSTS command. For
example:
LANDOFOZ\\TINMAN> SET ADMINISTRATION/DOMAIN=RUBYPALACE
%PWRK-S-ADMSET, now administering domain "RUBYPALACE", server "QUEEN"
RUBYPALACE\\QUEEN> SHOW TRUSTS
There are currently no domains trusted by domain RUBYPALACE.
Domains permitted to trust domain RUBYPALACE:
LANDOFOZ
In this example, because a server was not specified with the SET
ADMINISTRATION command (using the /SERVER qualifier), and the local
server (TINMAN) is not a member of the specified domain (RUBYPLACE),
the default server is the primary domain controller of the specified domain.
The primary domain controller in domain RUBYPLACE is QUEEN.

•

Use the LOGON command to log on to the domain. You must log on to the
domain to perform some administrative functions, such as the ADD TRUST
command. If you do not supply the password on the LOGON command
line, you will be prompted for it, if necessary. For example:
$ ADMINISTER
LANDOFOZ\\TINMAN> LOGON ADMINISTRATOR/DOMAIN=RUBYPALACE
Password:
The server \\QUEEN successfully logged you on as Administrator.
Your privilege level on domain RUBYPALACE is ADMIN.
The last time you logged on was 08/09/00 07:44 AM.
RUBYPALACE\\QUEEN>
To administer LANDOFOZ again, log off. The LOGOFF command logs you
off the network. After you log off the server QUEEN, you must log on to
the server TINMAN to administer domain LANDOFOZ. For example:
RUBYPALACE\\QUEEN>LOGOFF
ADMINISTRATOR was logged off successfully.
LANDOFOZ\\TINMAN>LOGON ADMINISTRATOR
Password:
The server \\TINMAN successfully logged you on as Administrator.
Your privilege level on domain LANDOFOZ is ADMIN.
The last time you logged on was 08/09/00 07:16 AM.

For information about the requirements for administrative functions, refer to
the Compaq Advanced Server for OpenVMS Commands Reference Manual.

Managing Domains and Servers 2–11

Managing Domains and Servers
2.1 Managing a Domain
Section 2.1.5, Member Servers and Domain Management, explains how to
administer a member server’s local database.

2.1.5 Member Servers and Domain Management
Using ADMINISTER commands on a member server (or directing them to a
member server), you can manage the domain-wide security accounts database
as you would from any domain controller. Although a member server does not
store or maintain the domain-wide database, it still has access to the benefits
of the centralized, domain-wide database.
As with Windows NT, there may be situtations where you would like to allow
people to manage a server without giving them the ability to manage the entire
domain. For this reason, the Advanced Server member server has a local
security account database. This database initially has the users Administrator
and Guest as local to the server.
Both the domain’s Administrator and the local Administrator can manage the
member server. Certain users can set the default to the member server’s local
database, as explained in Section 2.1.5.1, Administering the Member Server’s
Local Database. In any case, certain objects, such as global groups and trusts,
are manageable only when logged into a domain controller’s domain. Certain
ADMINISTER commands will be restricted. Section 2.1.5.2, ADMINISTER
Command Variances on Member Servers, lists the ADMINISTER commands
that are not allowed, or that provide restricted capabilities. The information in
both of these sections applies to workstations as well as member servers.
2.1.5.1 Administering the Member Server’s Local Database
Unless you have changed the default to the member server’s local database,
ADMINISTER commands normally operate domain-wide — that is, on the
domain to which the member server belongs. For example, if you enter the
ADMINISTER command on member server WIZARD in domain LANDOFOZ,
the ADMINISTER prompt displays domain LANDOFOZ and server WIZARD,
as shown:
$ ADMINISTER
LANDOFOZ\\WIZARD>
To manage a member server’s local database, you must log in, or change the
default domain to the local database. To do so, specify for the domain name
the member server’s name preceded by two backslashes (\\). The following
example shows how to specify the SET ADMINISTRATION command to
administer member server WIZARD’s local domain database:

2–12 Managing Domains and Servers

Managing Domains and Servers
2.1 Managing a Domain
LANDOFOZ\\TINMAN> SET ADMINISTRATION/DOMAIN=\\WIZARD
%PWRK-S-ADMSET, now administering domain "\\WIZARD", server "WIZARD"
\\WIZARD\\WIZARD>
As shown, when you administer the member server’s local domain database,
the ADMINISTER prompt displays the domain name preceded by two
backslashes, and the domain name is the same as the name of the member
server.
In an OpenVMS Cluster in which the Advanced Servers are member servers,
you can optionally specify for the domain name the Advanced Server
cluster alias name, preceded by two backslashes. When administering a
clustered member server’s local database, the ADMINISTER prompt displays
the Advanced Server cluster alias name as the domain (preceded by two
backslashes). For the server name, unless you specified a specific server name,
the prompt displays the name of the cluster member that responded first to the
ADMINISTER interface.
2.1.5.2 ADMINISTER Command Variances on Member Servers
As mentioned previously, member servers do not maintain or manage the
domain-wide security accounts database and cannot manage or display
certain objects, such as global groups, primary groups, and trusts. Table 2–2,
Disallowed or Restricted Commands When Administering a Member Server’s
Local Database, lists the commands that are not allowed, or are restricted,
when administering the member server’s local domain and database. If you
attempt to use these commands in such circumstances, the following error
message will be displayed:
%PWRK-E-DCONLY, operation is only valid to a Domain Controller
The affected commands are categorized by each of the following management
objects: COMPUTER, GROUP, TRUST, and USER.

Managing Domains and Servers 2–13

Managing Domains and Servers
2.1 Managing a Domain
Table 2–2 Disallowed or Restricted Commands When Administering a
Member Server’s Local Database
Object

Command

Restriction

COMPUTER

ADD

Not allowed

REMOVE

Not allowed

SET

Not allowed with the /ACCOUNT_
SYNCHRONIZE or /ROLE= qualifiers

SHOW

When you do not specify a computer name
with the command, it displays information
about the member server only (the computer
you are managing) rather than about all the
computers in the domain; note that the
display symbol for a member server is [SV]

GROUP

ADD, COPY, MODIFY,
REMOVE, SHOW

Do not use with global groups, and do not
use the /GLOBAL or /PRIMARY_GROUP
qualifiers; GROUP commands manage local
groups only

TRUST

ADD, REMOVE,
SHOW

Not allowed

USER

ADD, COPY, MODIFY

Do not use with the /PRIMARY_GROUP
qualifier; the ADD USER command adds
the user to the Users local group; these
commands manage memberships in local
groups only

REMOVE, SHOW

These commands manage memberships
in local groups only; the SHOW USERS
command does not display the primary
group or memberships in global groups

2.1.6 Adding a Computer Account to a Domain
For an Advanced Server or a Windows NT computer to become a domain
member, it must be added to the domain’s security accounts database.
When a computer is configured to join an existing domain (for example,
when you install a Windows NT Server or workstation, or when you run
the PWRK$CONFIG.COM command procedure on an Advanced Server),
the computer account can be added to the domain’s security database
automatically. This procedure requires that the user name and password
of a user account with membership in the Administrators group be supplied.

2–14 Managing Domains and Servers

Managing Domains and Servers
2.1 Managing a Domain
Alternatively, use the ADD COMPUTER command to add the computer account
to the domain’s security database. After you add the computer account, the
computer joins the domain automatically when it is started. No password is
required when a computer joins the domain in this case.
The ADD COMPUTER command is useful only if you do not wish to give out
the user name and password of an Administrator account in your domain to
the administrator of the computer that will join your domain. If you do not
wish to supply this information, use the ADD COMPUTER command to add
the computer account to your domain before the computer’s administrator
joins the domain. If you supply password information to the administrator
of the other computer, the administrator can use it when joining and the
computer account will be added to the domain automatically. Note that until
the intended computer account actually joins the domain, it is possible for a
malicious user to give a different computer that computer name, and then have
it join the domain using the computer account you have just created.
If the intended computer does not join the domain immediately, you can remove
the computer account from the domain’s security database using the REMOVE
COMPUTER command, as described in Section 2.1.7, Removing a Computer
Account from a Domain’s Security Database.
2.1.6.1 Procedure for Adding a Computer to a Domain
To add a computer to a domain, follow these steps:
1. Identify the name of the domain to which you will add the computer.
2. Obtain or establish the name of the computer you will add; be sure it is
unique in the network and no more than 15 characters long.
3. Determine whether the computer you are adding is to be a workstation,
server, or backup domain controller.
4. Use the ADD COMPUTER command. Optionally include the /DESCRIPTION
qualifier to provide a description of the computer. If you enter a description
that contains nonalphanumeric characters, spaces, or lowercase letters,
enclose the description string in quotation marks.
For example, the following command adds the computer GREENGIRL as a
Windows NT workstation to the domain LANDOFOZ:
LANDOFOZ\\TINMAN> ADD COMPUTER GREENGIRL
%PWRK-S-COMPADD, computer "GREENGIRL" added to domain "LANDOFOZ"
LANDOFOZ\\TINMAN>

Managing Domains and Servers 2–15

Managing Domains and Servers
2.1 Managing a Domain
The computer is added to the domain’s security database. The SHOW
COMPUTERS command shows GREENGIRL as a Windows NT workstation.
For example:
LANDOFOZ\\TINMAN> SHOW COMPUTERS
Computers in domain "LANDOFOZ":
Computer
Type
------------------------------[PD] TINMAN
OpenVMS (NT 4.0) Primary

Description
-------------------------------Advanced Server V7.3 for OpenVMS

[ws] GREENGIRL Windows NT Workstation
Note that when the computer type display symbol is in lowercase, such as [ws]
in this example, it indicates that the computer is unavailable to the network.
The computer might be unavailable because it has not been configured and
started yet.
To determine whether a specific computer is available, use the SHOW
COMPUTER command, specifying the name of the computer.

2.1.7 Removing a Computer Account from a Domain’s Security
Database
When you remove a computer account from the domain’s security database,
the computer can no longer participate in domain security. It might be useful
to remove a computer account from the domain’s security database if the
computer did not join the domain after its account was added to the domain’s
security database. You cannot remove a primary domain controller.
2.1.7.1 Procedure for Removing a Computer from a Domain
To remove a computer from a domain, follow these steps:
1. Identify the name of the computer you will remove.
2. Enter the REMOVE COMPUTER command. When you execute this
command, you receive a prompt to confirm the requested action.
For example, the following command removes the computer GREENGIRL from
the domain LANDOFOZ:
LANDOFOZ\\TINMAN> REMOVE COMPUTER GREENGIRL
Removing computer "GREENGIRL" from domain "LANDOFOZ" will render it
incapable of authenticating domain logons until it is added to another
domain.
Do you want to continue with the removal [YES or NO] (YES) : YES
%PWRK-S-COMPREM, computer "GREENGIRL" removed from domain "LANDOFOZ"
LANDOFOZ\\TINMAN>

2–16 Managing Domains and Servers

Managing Domains and Servers
2.1 Managing a Domain

2.1.8 Managing Trust Relationships
A trust relationship is a link between two domains, where one domain honors
the users of another domain, trusting the other domain to authenticate the
logons of its users. When trust relationships are properly established among
domains and resource permissions are set properly, a user with an account in
one domain is allowed to access resources on another domain. The domain that
has the user accounts is the trusted domain; the domain with the required
resources is the trusting domain.
The administrators of both domains must supply the same password when
establishing the trust relationship. After the trust relationship is established,
the password is changed periodically by the domain software.
2.1.8.1 Establishing Trust Relationships
Both domains participating in a trust relationship must take an action to
establish the trust. First the domain that will be trusted (that is, the domain
where the user accounts are defined) must indicate that it is willing to be
trusted, by permitting the other domain to trust it. Then the domain that will
be trusting (that is, the domain where the shared resources are defined) can
indicate that it is willing to trust the other domain.
For example, assume there are two domains: LANDOFOZ and KANSAS.
Domain KANSAS has resources required by users who have user accounts in
domain LANDOFOZ. You need to set up a trust relationship so that KANSAS
trusts LANDOFOZ, as shown in Figure 2–1, One-Way Trust Relationship:
KANSAS Domain Trusting LANDOFOZ Domain. This is called a one-way
trust relationship.

Managing Domains and Servers 2–17

Managing Domains and Servers
2.1 Managing a Domain
Figure 2–1 One-Way Trust Relationship: KANSAS Domain Trusting
LANDOFOZ Domain

KANSAS trusts LANDOFOZ

KANSAS Domain

LANDOFOZ Domain
VM-0574A-AI

To set up the trust relationship, use the following procedure:
1. When logged in on domain LANDOFOZ, enter the following command:
LANDOFOZ\\TINMAN> ADD TRUST KANSAS/PERMITTED
Password:
Password verification:
%PWRK-S-TRUSTADD, trust between domains "LANDOFOZ" and "KANSAS" added
LANDOFOZ\\TINMAN>
This adds domain KANSAS to the list of domains permitted to trust
LANDOFOZ.
2. Log on to domain KANSAS, and enter the following command. Use the
same password in this command that was used in the previous command.
KANSAS\\TOPEKA> ADD TRUST LANDOFOZ/TRUSTED
Password:
Password verification:
%PWRK-S-TRUSTADD, trust between domains "KANSAS" and "LANDOFOZ" added
KANSAS\\TOPEKA>
This command adds domain LANDOFOZ to the list of domains trusted by
domain KANSAS.
If the steps to establishing a trust are done in the opposite order (that is, one
domain trusts the other before the other has permitted the first domain to trust
it), the trust will eventually work. However, this can take up to 15 minutes.

2–18 Managing Domains and Servers

Managing Domains and Servers
2.1 Managing a Domain
2.1.8.2 Displaying the Trust Relationships
To display trust relationships, use the SHOW TRUSTS command. In the
following example, a trust relationship has been established to enable domain
KANSAS to trust domain LANDOFOZ. Execute the SHOW TRUSTS command
on domain LANDOFOZ to display its trust:
LANDOFOZ\\TINMAN> SHOW TRUSTS
There are currently no domains trusted by domain LANDOFOZ
Domains permitted to trust domain LANDOFOZ:
KANSAS
LANDOFOZ\\TINMAN>
Execute the SHOW TRUSTS command on domain KANSAS to display its
trust:
LANDOFOZ\\TINMAN> SHOW TRUSTS/DOMAIN=KANSAS
Domains trusted by KANSAS:
LANDOFOZ
There are currently no domains permitted to trust domain KANSAS
LANDOFOZ\\TINMAN>
2.1.8.3 Setting Up a Two-Way Trust Relationship
When a two-way trust relationship has been established, each domain trusts
the other, and users in both domains can access resources in the other domain,
assuming resource permissions have been set up properly.
To set up a two-way trust relationship between domains LANDOFOZ and
KANSAS, as shown in Figure 2–2, Two-Way Trust Relationship Between
Domains KANSAS and LANDOFOZ, follow the steps given below.

Managing Domains and Servers 2–19

Managing Domains and Servers
2.1 Managing a Domain
Figure 2–2 Two-Way Trust Relationship Between Domains KANSAS and
LANDOFOZ
KANSAS trusts LANDOFOZ
LANDOFOZ trusts KANSAS

KANSAS Domain

LANDOFOZ Domain
VM-0575A-AI

1. When logged in on domain LANDOFOZ, add the domain KANSAS to the
list of domains permitted to trust LANDOFOZ, as follows:
LANDOFOZ\\TINMAN> ADD TRUST KANSAS/PERMITTED
2. On domain KANSAS, add the domain LANDOFOZ to the list of domains
trusted by KANSAS, as follows:
KANSAS\\TOPEKA> ADD TRUST LANDOFOZ/TRUSTED
3. On domain KANSAS, add LANDOFOZ to the list of domains that are
permitted to trust KANSAS, as follows:
KANSAS\\TOPEKA> ADD TRUST LANDOFOZ/PERMITTED
4. On domain LANDOFOZ, add KANSAS to the list of domains that are
trusted by LANDOFOZ, as follows:
LANDOFOZ\\TINMAN> ADD TRUST KANSAS/TRUSTED
2.1.8.4 Removing Trust Relationships
If you no longer want a trust relationship to be in effect, you must remove
it. When you remove a trust, both sides of the trust relationship must be
dissolved. The trusting domain must cease to trust the trusted domain, and
the trusted domain must cease to permit the trusting domain to trust it.
To remove a trust relationship, use the REMOVE TRUST/TRUSTED command
and the REMOVE TRUST/PERMITTED command. For example:

2–20 Managing Domains and Servers

Managing Domains and Servers
2.1 Managing a Domain
LANDOFOZ\\TINMAN> REMOVE TRUST KANSAS/PERMITTED
Removing domain "KANSAS" from the Permitted Domains List will
prevent users in domain "LANDOFOZ" from accessing resources in
domain "KANSAS". If you choose to continue, you must also
administer domain "KANSAS" and remove "LANDOFOZ" from its list of
Trusted Domains.
Do you want to continue with the removal [YES or NO] (YES) : YES
%PWRK-S-TRUSTREM, trust between domains "LANDOFOZ" and "KANSAS"
removed
LANDOFOZ\\TINMAN>
To reestablish the trust relationship, you again must supply matching
passwords for the trusting and trusted domains. If only one side of the trust
relationship is broken and reestablished, the trust will appear to work in some
ways and fail in others. For example, you can grant resource access to a user
from the trusted domain, but the user is not actually granted the indicated
access. To eliminate such problems, remove the old trust relationships and
establish new trust relationships.

2.2 Managing Security Policies
You can manage the following security policies:
•

Account Policy — controls how passwords and logon hours are managed for
user accounts.

•

Audit Policy — defines which security events are logged by the server in a
domain.

2.2.1 Managing the Account Policy
You manage the account policy for your domain using the SET ACCOUNT
POLICY command. You can view the account policy with the SHOW
ACCOUNT POLICY command. Changes to the account policy affect every
user at the next logon.
The account policy characteristics that you can specify include:
•

Whether a user connection is forcibly disconnected when the logon hours
specified for that user account are exceeded — specify the SET ACCOUNT
POLICY/FORCE_DISCONNECT command. You specify logon hours for
each user account with the ADD USER, COPY USER, or MODIFY USER
command, using the /HOURS qualifier, as explained in Section 3.1.7,
Specifying Logon Hours.

Managing Domains and Servers 2–21

Managing Domains and Servers
2.2 Managing Security Policies
If you specify /NOFORCE_DISCONNECT for the account policy, the user is
not disconnected when the logon hours are exceeded, but the user cannot
make a new connection until the times (days and hours) specified as the
logon hours for the account.
•

The policy for usage of passwords — use the SET ACCOUNT
POLICY/PASSWORD_POLICY=keyword command. You can specify the
following keywords and values with the /PASSWORD_POLICY qualifier:
[NO]MINAGE=n — the minimum number of days a user’s password
must be used before the user can change it.
[NO]MAXAGE=n — the maximum number of days a user’s password
can be used before the server requires the user to change it.
MINLENGTH=n — the minimum length of a password.
[NO]HISTORY=n — the number of new passwords that must be used
before an old password can be reused.

•

Whether a user account is locked out after a specified number of failed
attempts to logon — use the SET ACCOUNT POLICY/LOCKOUT=keyword
command. To enable account lockout, you must specify the following three
keywords and their values with the /LOCKOUT qualifier:
ATTEMPTS=n, where n specifies the number of failed attempts to
allow before locking the user account.
DURATION=n, where n specifies the number of minutes before a locked
account is automatically unlocked. The value of this parameter must
be greater than, or equal to, the value set for the WINDOW parameter.
WINDOW=n, where n specifies the number of minutes to wait after a
user account has been locked out, before resetting the logon count.
Specify these three parameters with the /LOCKOUT qualifier as shown in
the example in Section 2.2.1.1, Example: Setting a User Account Policy.
By default, user account lockout is disabled, meaning that the user
accounts are never locked out, no matter how many failed logon attempts
are made on a user account. The /NOLOCKOUT qualifier specifies that
user accounts are never locked out.
To unlock a user account that has been locked, use the MODIFY USER
command with the /UNLOCK qualifier.

2–22 Managing Domains and Servers

Managing Domains and Servers
2.2 Managing Security Policies
2.2.1.1 Example: Setting a User Account Policy
The following example shows how to set the account policy for the domain so
that users are disconnected when they exceed their logon hours (/FORCE_
DISCONNECT), and they are locked out after three failed logon attemps. The
failed logon count resets 20 minutes after the last failed login attempt, and
locked-out accounts are unlocked after 25 minutes.
LANDOFOZ\\TINMAN> SET ACCOUNT POLICY/FORCE_DISCONNECT_LANDOFOZ\\TINMAN> /LOCKOUT=(ATTEMPTS=3,WINDOW=20,DURATION=25)
%PWRK-S-ACCPOLSET, account policy set for domain "LANDOFOZ"
2.2.1.2 Example: Displaying the Account Policy for a Domain
The following example shows how to use the SHOW ACCOUNT POLICY
command to display the account policy for a domain:
LANDOFOZ\\TINMAN> SHOW ACCOUNT POLICY
Account Policy for domain "LANDOFOZ":
Minimum password age (days) : 1
Maximum password age (days) : 42
Minimum password length : 0
Length of password history maintained : None
Force user logoff after logon hours expire: YES
Lock out account after how many bad password attempts : 3
Number of minutes account remains locked : 20
Number of minutes to wait before resetting lockout count : 25
Role of server TINMAN : Primary Domain Controller

2.2.2 Managing the Audit Policy
You specify the audit policy using the SET AUDIT POLICY command. When
auditing is enabled, the server records selected security-related activities in
the Security event log. The server can record systemwide events, such as a
user logging on, and file-specific events, such as a user attempting to access
a specific file. You display the audit policy using the SHOW AUDIT POLICY
command.
The audit policy affects Security event logging for all servers in the domain,
because they share the same audit policy. You can specify whether to log
failed events and successful events. See Table 2–3 for a list of the events
that you can audit. Note that to audit events pertaining to files or directories
(ACCESS events), you must also set auditing on the files or directories. For
more information, see Section 6.1.3.6, Setting and Displaying Security Event
Auditing for Files and Directories.

Managing Domains and Servers 2–23

Managing Domains and Servers
2.2 Managing Security Policies
Table 2–3 Events You Can Audit
Audit Event Name

Events Audited

ACCESS

- A user accessing a directory or file that is set for
auditing (SET FILE/AUDIT=)
- A user sending a print job to a printer that is set for
auditing

ACCOUNT_MANAGEMENT - Creating, changing, or deleting a user account or group
- Renaming, disabling, or enabling a user account
- Setting or changing a password
LOGONOFF

- A user logging on or logging off
- A user making a network connection

POLICY_CHANGE

- Changing the audit policy
- Changing a trust relationship
- Changing user rights policies

PROCESS

- Program activation
- Handling duplication
- Indirect object access
- Process exit

SYSTEM

- A user starting or restarting a server
- A system security event
- An event that affects the security log

USER_RIGHTS

- A user exercised a user right such as accessing a file,
except for logon/logoff rights

2.2.2.1 Example: Displaying the Audit Policy for a Domain
The following example shows how to display the audit policy for a domain:
LANDOFOZ\\TINMAN> SHOW AUDIT POLICY
Audit Policy for domain "LANDOFOZ":
Auditing is currently Disabled.
Audit Event states:
Audit Event
Success
------------------- -------ACCESS
Disabled
ACCOUNT_MANAGEMENT Disabled
LOGONOFF
Disabled
POLICY_CHANGE
Disabled
PROCESS
Disabled
SYSTEM
Disabled
USER_RIGHTS
Disabled
LANDOFOZ\\TINMAN>

2–24 Managing Domains and Servers

Failure
-------Disabled
Disabled
Disabled
Disabled
Disabled
Disabled
Disabled

Managing Domains and Servers
2.2 Managing Security Policies
2.2.2.2 Example: Enabling Auditing and Setting the Audit Policy for a Domain
The following example shows how to enable auditing and set the audit policy
for a domain, using the SET AUDIT POLICY/AUDIT command. In this
example, the /SUCCESS=LOGONOFF qualifier enables auditing of successful
logon and logoff operations.
LANDOFOZ\\TINMAN> SET AUDIT POLICY/AUDIT/SUCCESS=LOGONOFF
%PWRK-S-AUDPOLSET, audit policy set for domain "LANDOFOZ"
LANDOFOZ\\TINMAN> SHOW AUDIT POLICY
Audit Policy for domain "LANDOFOZ":
Auditing is currently Enabled.
Audit Event states:
Audit Event
-----------------ACCESS
ACCOUNT_MANAGEMENT
LOGONOFF
POLICY_CHANGE
PROCESS
SYSTEM
USER_RIGHTS

Success
-------Disabled
Disabled
Enabled
Disabled
Disabled
Disabled
Disabled

Failure
-------Disabled
Disabled
Disabled
Disabled
Disabled
Disabled
Disabled

LANDOFOZ\\TINMAN>
To enable auditing of all events, use the following command:
SET AUDIT POLICY/AUDIT/SUCCESS=ALL/FAILURE=ALL

2.3 Managing a Server
When you manage a server, you can display server information, send messages
to users, and start and stop services.

2.3.1 Displaying Server Information
You can display information about the server including connections, user
sessions, shared resources, and the software version number.
2.3.1.1 Displaying Connections
As you manage your server, you may need to know which connections are
active. A connection is a virtual link between a workstation or a server process
and a shared resource on a server.
To display existing connections, use the SHOW CONNECTIONS command.
The SHOW CONNECTIONS command displays information about active
connections to the server, including connections from the Advanced Server. The
information about each connection includes:

Managing Domains and Servers 2–25

Managing Domains and Servers
2.3 Managing a Server
•

Connected user’s name

•

User’s computer name (including connections from the Advanced Server)

•

Name of the shared resource connected to

•

Number of opens to each share

•

Total connect time to the share (in days, hours, minutes)

The following example displays information about all the connections to the
server currently being administered (TINMAN).
LANDOFOZ\\TINMAN> SHOW CONNECTIONS
Connections on server "TINMAN":
User name
-------------------ADMINISTRATOR
SCARECROW
SCARECROW
SCARECROW
SCARECROW

Computer name
--------------TINMAN_176
TINMAN_149
TINMAN_149
TINMAN_149
TINMAN_149

Share name Opens
----------------IPC$
3
ADMIN$
0
IPC$
0
IPC$
1
RAINBOW
0

Time
-------0 11:30
0 00:00
0 00:00
0 00:00
0 06:14

Total of 5 connections
2.3.1.2 Displaying User Sessions
As you manage your server, you may need to know which sessions are active.
A session is a link between a workstation and a server. Multiple share
connections can be established over a single session.
To display user sessions, use the SHOW SESSIONS command. You can include
the /SERVER qualifier to display sessions on a specific server. The display
includes:
•

Name of the user that established the session

•

Name of the computer that established the session

•

Number of resources opened on the server by user

•

Elapsed time since the session was established

•

Elapsed time since the user last initiated an action

•

Whether a session is using Guest access

2–26 Managing Domains and Servers

Managing Domains and Servers
2.3 Managing a Server
For example:
LANDOFOZ\\TINMAN> SHOW SESSIONS/SERVER=WOODMAN
User sessions on server "WOODMAN":
Connected Users
-----------------ADMINISTRATOR
SCARECROW

Computer
--------TINMAN
DOROTHY

Opens
----1
3

Time
------1 22:54
0 03:48

Idle
------0 00:00
0 00:03

Guest
----No
No

Total of 2 connected users
LANDOFOZ\\TINMAN>
2.3.1.3 Displaying Shared Resources
The Advanced Server allows you to display information about shared resources.
You can display information about the share permissions and the OpenVMS
protections on them, as well as the maximum number of connections to the
share allowed at one time. You can specify the display of only the active shares
(those currently connected to) or by the type of share (printers or directories).
To see shared resources from the current server, use the SHOW SHARES
command. This command displays:
•

Name of the share

•

Share type (Directory or Print)

•

Share description

Specify the share name to display information about only one share. Use the
/FULL qualifier to display detailed information about each share.
For example, the following command displays the shares on the server
currently being administered (TINMAN):
LANDOFOZ\\TINMAN> SHOW SHARES
Shared resources on Server "TINMAN":
Name
--------NETLOGON
RAINBOW
PWLIC
PWLICENSE
PWUTIL
USERS

Type
--------Directory
Directory
Directory
Directory
Directory
Directory

Description
---------------------------------Logon Scripts Directory
Local Oz Share
PATHWORKS Client License Software
PATHWORKS Client License Software
PATHWORKS Client-based Utilities
Users Directory

Total of 6 shares
LANDOFOZ\\TINMAN>

Managing Domains and Servers 2–27

Managing Domains and Servers
2.3 Managing a Server
To display hidden shares (shares whose name ends in a dollar sign ($), such
as administrative resources and local device shares (such as C$)), you must
include the /HIDDEN qualifier or specify the share name. For example, the
following command displays the local device share C$:
LANDOFOZ\\TINMAN> SHOW SHARES C$
Shared resources on Server "TINMAN":
Name
Type
Description
------------ --------- ---------------------------------------C$
Directory PATHWORKS share
Total of 1 share

2.3.1.4 Displaying the Advanced Server Version Number
You can verify the version number of Advanced Server software. To display the
version number of server software on your system, use the SHOW VERSION
command. For example:
LANDOFOZ\TINMAN> SHOW VERSION
Advanced Server V7.3 for OpenVMS
LANDOFOZ\\TINMAN>
This command is valid for PATHWORKS for OpenVMS (Advanced Server) and
Advanced Server for OpenVMS servers only.

2.3.2 Stopping the Advanced Server
You can stop the Advanced Server at any time for any reason, which can
include the following:
•

When you want to change server configuration parameters

•

As part of an orderly system shutdown

To stop the Advanced Server, enter the following command:
$ @SYS$STARTUP:PWRK$SHUTDOWN
Shutting down the currently running server(s)...
For a cluster server, enter:
$ @SYS$STARTUP:PWRK$SHUTDOWN CLUSTER

2–28 Managing Domains and Servers

Managing Domains and Servers
2.3 Managing a Server
To stop the Advanced Server as part of an orderly system shutdown, add
the shutdown command to the site-specific system shutdown procedure. In
addition, prior to shutting down the server, announce the planned shutdown
to connected users by using the ADMINISTER SEND/USERS command, as
described in Section 2.3.3, Sending Messages to Users.

2.3.3 Sending Messages to Users
You should send messages to users before you change the operating
characteristics of a server. For example, you might send a message before
disconnecting users or if you need to stop sharing a resource on a computer.
For a message to be sent and received, the Alerter service must be running on
the computer sending the message, and the Messenger service must be running
on the computer receiving the message.
Note
The Messenger service is not supported on the Advanced Server.
Therefore, OpenVMS users on Advanced Servers will not receive
messages sent this way.

2.3.3.1 Sending a Message to the User of a Specific Computer
To send a message to the user of a specific computer, follow these steps:
1. Identify the computer to which you will send your message.
2. Enter the ADMINISTER SEND command, including the computer name
and the message. Enclose the message in quotation marks.
For example, the following command sends the message "Shutdown at 1 pm
today!!!" to the computer called WORTHY.
LANDOFOZ\\TINMAN> SEND WORTHY "Shutdown at 1pm today!!!"
LANDOFOZ\\TINMAN>
The message is displayed in a Messenger Service pop-up window on computer
WORTHY in the following form:
Message from TINMAN to WORTHY on 8/31/00 11:20 AM
"Shutdown at 1pm today!!!"
With the /SERVER=servername qualifier, you can send a message from another
specified server in your domain to a specific group of users in your domain.
With the /USER qualifier, you can send a message to all or specific users on a
server.

Managing Domains and Servers 2–29

Managing Domains and Servers
2.3 Managing a Server
2.3.3.2 Sending a Message to Users on a Specific Server
To send a message to users connected to a specific server, use the /SERVER
qualifier. For example, the following command sends the message "Shutdown
at 1pm today!!!" to all users connected to server WOODMAN.
LANDOFOZ\\TINMAN> SEND/USERS/SERVER=WOODMAN "Shutdown at 1pm today!!!"
LANDOFOZ\\TINMAN>
This command may take a few minutes to complete.

2.3.4 Managing Services
To manage Advanced Server services, you need to know how to start and stop
services and how to configure service startup. Services are set up during server
installation and configuration.
You can start and stop some of the services available on the computer and
determine whether a service will start up automatically when the system
starts. You must be logged on to a user account that has membership in
the Administrators group or the Server Operators group to perform these
operations. Table 2–4, Network Services on the Advanced Server, shows the
default services provided with Advanced Server.
Table 2–4 Network Services on the Advanced Server
Supported
on
Advanced
Servers

Starts
by
Default

Can Be
Paused

Can Be
Stopped

Service

Description

Alerter

Notifies selected users and computers of
administrative alerts that occur on this
server. Used by the server and other
services.

Yes

Browser

Lists network entities, such as domains,
computers, and shared resources.

Yes

EventLog

Records system, security, and application
events in the event logs, and enables
remote access to those logs. Cannot be
stopped separately; stops together with
the Server service.

Yes

(continued on next page)

2–30 Managing Domains and Servers

Managing Domains and Servers
2.3 Managing a Server
Table 2–4 (Cont.) Network Services on the Advanced Server
Supported
on
Advanced
Servers

Starts
by
Default

Can Be
Paused

Can Be
Stopped

Service

Description

NetLogon

Verifies the user name and password
of each user who attempts to log on to
the network or gain access to the server.
Synchronizes security databases.

Yes

Server

Provides file and print sharing.

Yes

No1

TimeSource

Identifies a server as the time server for
a domain. Other computers synchronize
their clocks with the time server.

Yes

Replicator

Replicates user directories and files.

Messenger

Allows receipt of server management
messages

1 Only by using the PWRK$SHUTDOWN command procedure.

The Replicator and Messenger services are supported on Windows NT and
can be stopped and started, but not paused, from the Advanced Server for
OpenVMS.
The Alerter, NetLogon, and TimeSource services can be enabled and disabled
by adding them to the list of services associated with the SrvServices
server configuration parameter stored in the OpenVMS Registry, as described
in Section 7.2, Managing Server Configuration Parameters Stored in the
OpenVMS Registry. When a service is enabled, it is started automatically
when the Advanced Server starts.
Note
For smooth operation of the domain, Compaq recommends that the
NetLogon service always be enabled, even on member servers.

Managing Domains and Servers 2–31

Managing Domains and Servers
2.3 Managing a Server
2.3.4.1 Displaying Services
As you manage your server, you may need to know the state of network
services.
To display available services, use the SHOW SERVICES command. For
example:
LANDOFOZ\\TINMAN> SHOW SERVICES
Services on server "TINMAN":
Service
-------------ALERTER
BROWSER
EVENTLOG
NETLOGON
SERVER
TIMESOURCE

Current State
--------------Started
Started
Started
Started
Started
Started

Total of 6 services
LANDOFOZ\\TINMAN>
Note that the SHOW SERVICES command displays installed services only. It
does not display services that have not yet been started.
2.3.4.2 Starting Services
By default, the Server, Alerter, Browser, and NetLogon services are started
automatically when the server is started.
To start a service, use the START SERVICE command, specifying the full
service name. For example:
LANDOFOZ\\TINMAN> START SERVICE TIMESOURCE
%PWRK-S-SVCSTART, service "TIMESOURCE" started on server "TINMAN"
LANDOFOZ\\TINMAN>
2.3.4.3 Pausing Services
You can suspend execution of the Server and NetLogon services. Unlike
stopping a service, pausing does not cancel resource sharing, terminate
connections or change any settings associated with the service.
Pausing the Server service prevents users from making new connections to
the server’s shared resources; however, users who have already connected to
shared resources can continue to use the resources. Pausing the Server service
does not prevent users who are members of the Administrators group from
connecting to the service.

2–32 Managing Domains and Servers

Managing Domains and Servers
2.3 Managing a Server
Pausing the NetLogon service prevents the server from synchronizing the
domain’s security accounts database. The server will not validate logons.
To pause a service, use the PAUSE SERVICE command. For example:
LANDOFOZ\\TINMAN> PAUSE SERVICE SERVER
Do you really want to pause service "SERVER" [YES or NO](YES): YES
%PWRK-S-SVCPAUSE, service "SERVER" paused on server "TINMAN"
LANDOFOZ\\TINMAN>
2.3.4.4 Continuing Services
You can use the CONTINUE SERVICE command to continue a paused service.
When you continue a service, you restore access to the service.
To continue a service, use the CONTINUE SERVICE command. For example:
LANDOFOZ\\TINMAN> CONTINUE SERVICE SERVER
%PWRK-S-SVCCONT, service "SERVER" continued on server "TINMAN"
LANDOFOZ\\TINMAN>
2.3.4.5 Stopping Services
Stopping a service disables all operations provided by that service. You can use
ADMINISTER commands to stop the following services:
•

Alerter

•

Browser

•

NetLogon

•

TimeSource

To stop the Server service, use the PWRK$SHUTDOWN.COM command
procedure, as described in Section 2.3.2, Stopping the Advanced Server. Before
you stop the Server service, you should follow these steps:
1. Pause the service.
2. Send a message to users connected to the server’s shared resources,
warning them that Advanced Server will be shut down. Your message
should ask all users to stop their current activities and close all files. Give
users adequate time to close their files before you proceed. If you shut
down the server while users are accessing shared resources, they may lose
data.

Managing Domains and Servers 2–33

Managing Domains and Servers
2.3 Managing a Server
To stop a service, use the STOP SERVICE command. For example:
LANDOFOZ\\TINMAN> STOP SERVICE TIMESOURCE
Do you really want to stop service "TIMESOURCE" [YES or NO] (YES): YES
%PWRK-S-SVCSTOP, service "TIMESOURCE" stopped on server "TINMAN"
LANDOFOZ\\TINMAN>
2.3.4.6 Synchronizing Clocks on All Network Computers
You can designate an Advanced Server as the network time server in a domain
by having it run the TimeSource service. Client computers on the network
can synchronize their time with the time server, which makes it possible to
synchronize network events. For Compaq OpenVMS servers, the operating
system maintains the clock, which cannot be set with Advanced Server
commands. (For information on changing the time or time zone for a system,
see Section 2.3.5, Changing Time Zones or Daylight Savings Time Settings.
To run the TimeSource service automatically, do one of the following:
•

Modify the data associated with the SrvServices server configuration
parameter using the PWRK$REGUTL utility described in Section 7.2,
Managing Server Configuration Parameters Stored in the OpenVMS
Registry, specifying TIMESOURCE in the data field.

•

Run the configuration procedure PWRK$CONFIG.COM, and answer YES
to the option ‘‘Enable Timesource service.’’

Then the TimeSource service will start automatically whenever you start the
server.
To activate the TimeSource service after the server is running, use the START
SERVICE TIMESOURCE command.

2.3.5 Changing Time Zones or Daylight Savings Time Settings
To properly represent the time in your local environment, you must set
up the OpenVMS time zone information before the server is started,
as explained in the Compaq Advanced Server for OpenVMS Server
Installation and Configuration Guide. If your server is moved to a location
in a different time zone, you must set the new time zone information
accordingly. If your server system resides in an area that observes daylight
savings time, the time zone information must be modified appropriately
when daylight savings starts and ends. You can use the OpenVMS
SYS$EXAMPLES:DAYLIGHT_SAVINGS.COM procedure to adjust the system
time and TDF automatically twice a year.

2–34 Managing Domains and Servers

Managing Domains and Servers
2.3 Managing a Server
You check and set the time zone and time differential factor (TDF)
settings on your system by running the OpenVMS command procedure
UTC$TIME_SETUP.COM. (This command procedure defines the logicals
needed by the Advanced Server.) From the SYSTEM account, enter the
following command to begin the procedure:
$ @SYS$MANAGER:UTC$TIME_SETUP.COM
When you elect to change the time zone or TDF setting, or both, the changes
are also made clusterwide if your server participates in an OpenVMS Cluster.
If you change any time zone information, you must restart the server for the
time to be properly represented.
For more information on running the command procedure and resetting the
time zone and TDF, refer to the OpenVMS System Manager’s Manual.

2.4 Advanced Server in OpenVMS Clusters
Some servers in your network may be configured in an OpenVMS Cluster
environment. Advanced Servers running in an OpenVMS Cluster share the
same copy of the user accounts and shares databases and assume a single role,
either a primary domain controller, a backup domain controller, or a member
server. They operate as a single entity identified by the Advanced Server
cluster alias name.
When you change the server role on one member of an OpenVMS Cluster,
the role on all cluster members running the Advanced Server is also changed
accordingly.
Use the SHOW COMPUTERS command to display a list of all the nodes in the
cluster with the server role. Because of the way a Windows NT Server detects
the cluster, the information displayed by the Windows NT Server Manager
may not reflect the cluster role information accurately when the cluster is a
primary domain controller.
The following sections discuss the Advanced Server cluster alias and cluster
load balancing in LANs and WANs:
•

Section 2.4.1, About the Advanced Server Cluster Alias, describes the
Advanced Server cluster alias.

•

Section 2.4.2, Defining the Advanced Server Cluster Alias, explains how to
define the Advanced Server cluster alias.

•

Section 2.4.3, Cluster Load Balancing in LANs, describes how the Advanced
Server cluster alias provides cluster load balancing for clients that are on
the same LAN as the server.

Managing Domains and Servers 2–35

Managing Domains and Servers
2.4 Advanced Server in OpenVMS Clusters
•

Section 2.4.4, Dynamic Cluster Load Balancing in WANs, describes how the
Advanced Server cluster alias provides cluster load balancing for clients
that are not on the same LAN as the server.

2.4.1 About the Advanced Server Cluster Alias
In an OpenVMS Cluster, an Advanced Server cluster alias name allows all the
members of the OpenVMS Cluster that are running the Advanced Server to be
addressable as a single entity.
Unlike the DECnet and TCP/IP cluster aliases, the Advanced Server cluster
alias is transport independent. (The TCP/IP cluster alias is also referred to as
the TCP/IP cluster impersonator name.)
Clients can access resources on the OpenVMS Cluster by connecting to the
cluster using the Advanced Server cluster alias or the name of a specific
Advanced Server cluster member. Make sure a static entry for the Advanced
Server cluster alias is defined in each client’s LMHOSTS file, or a static
multihomed entry is defined in the WINS (Windows Internet Name Service)
database; however, if load balancing and failover are desired for LAN or
WAN environments, remove any static entries for the cluster alias from the
LMHOSTS file and the WINS database to ensure that the cluster alias is
resolved appropriately. Failover occurs when the node to which the client is
connected becomes unavailable; the client is reconnected (using the Advanced
Server alias) to the cluster member that is least loaded. For more information
on load balancing, see Section 2.4.3, Cluster Load Balancing in LANs, and
Section 2.4.4, Dynamic Cluster Load Balancing in WANs.
Note
If LMHOSTS is the only method you are using for resolving NetBIOS
names, other domain controllers (including the PDC) that are not in the
same subnet as the Advanced Server cluster must add an entry for the
Advanced Server cluster alias to their LMHOSTS file. The LMHOSTS
file does not offer any means for mapping multiple IP addresses to a
single NetBIOS name. Therefore, the entry for the Advanced Server
cluster alias must be mapped to the IP address of one specific server
cluster member. If the Advanced Server is stopped on that cluster
member, you must modify the LMHOSTS file to map the cluster alias
name to the IP address of a cluster member on which the Advanced
Server is still running. On systems running a Microsoft Windows
operating system, the NetBIOS name cache must also be reloaded
using the command NBTSTAT -R (capital R required).

2–36 Managing Domains and Servers

Managing Domains and Servers
2.4 Advanced Server in OpenVMS Clusters
Due to the LMHOSTS limitations noted above, it is difficult (and
perhaps unmanageable) to gain the benefits of load balancing and
failover using an LMHOSTS file.

2.4.2 Defining the Advanced Server Cluster Alias
You define the Advanced Server cluster alias name when you run the
PWRK$CONFIG configuration procedure. The Advanced Server cluster
alias name is a NetBIOS name that is unique among domain names and server
names. OpenVMS Clusters running DECnet may have a DECnet cluster alias
name defined as well. The DECnet cluster alias name is used by the DECnet
transport only. OpenVMS Clusters running TCP/IP may have a cluster alias
defined for the purpose of providing failover for Network File System (NFS)
clients. The Advanced Server cluster alias can be the same as the TCP/IP
cluster alias and/or the DECnet cluster alias; however, Compaq strongly
recommends that the Advanced Server cluster alias not be the same as the
TCP/IP cluster alias.
Note
Do not use the name of the domain as the Advanced Server cluster
alias; if they are the same, the NetLogon service will fail to start.

During the initial configuration process (when you run PWRK$CONFIG.COM),
you can accept the default Advanced Server cluster alias name (nodename_
ALIAS), or you can specify a different name. For more information about the
PWRK$CONFIG.COM command procedure and configuring the Advanced
Server alias, refer to the Compaq Advanced Server for OpenVMS Server
Installation and Configuration Guide.
When an Advanced Server running on an OpenVMS Cluster joins a domain,
a computer account by the name of the cluster alias is created in the domain
security database; a separate account is not created for each cluster member
running the Advanced Server.
Clients using the Advanced Server cluster alias to obtain Advanced Server
services can gain the benefit of load balancing, in which the alias is resolved
to the Advanced Server cluster member that has the least load. For more
information on cluster load balancing, see Section 2.4.3, Cluster Load
Balancing in LANs, and Section 2.4.4, Dynamic Cluster Load Balancing in
WANs.

Managing Domains and Servers 2–37

Managing Domains and Servers
2.4 Advanced Server in OpenVMS Clusters
Note that when a client connects to a server using the Advanced Server cluster
alias, the connection is associated with the network address of the cluster
member to which the client is actually connected. Additional connections made
from the same client to the Advanced Server alias are made directly to the
same cluster member. Once a client is connected, no further load balancing for
that client is done. When the node to which the client is connected becomes
unavailable, failover is possible: the client is reconnected (using the Advanced
Server alias) to the cluster member that is least loaded.
Note
To perform administrative functions on a particular cluster member,
you must connect to that member by using its specific node name,
rather than the cluster alias.

The Advanced Server cluster alias is stored in the OpenVMS Registry as value
AliasName in the following key:
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
To display the current Advanced Server cluster alias, as defined in the
OpenVMS Registry, use the following command:
$ REGUTL SHOW VALUE * ALIASNAME
For more information about using REGUTL, see Section 7.2.4, Using the
PWRK$REGUTL Utility to Manage Advanced Server Parameters in the
OpenVMS Registry.

2.4.3 Cluster Load Balancing in LANs
The Advanced Server cluster alias makes load balancing possible for clients
that are on the same LAN as the server. To gain the benefits of load balancing
and failover, clients must connect to the Advanced Server on the OpenVMS
Cluster by using the Advanced Server cluster alias. The clients use the
NetBIOS broadcast facility to request resolution of the Advanced Server cluster
alias. Only one Advanced Server node in the cluster is designated to respond
to the request: the Advanced Server node that is the least loaded of the servers
in the cluster. The relative loads of the servers in the cluster are checked
periodically, and so the node designated to respond will change from time to
time.
Cluster load balancing is not available if clients using Windows Internet Name
Service (WINS) to resolve the Advanced Server cluster alias have a static entry
for this alias in the WINS database.

2–38 Managing Domains and Servers

Managing Domains and Servers
2.4 Advanced Server in OpenVMS Clusters

2.4.4 Dynamic Cluster Load Balancing in WANs
Dynamic cluster load balancing is available for service requests from WAN
clients that are outside the server cluster’s LAN. Dynamic cluster load
balancing for WAN environments is provided by Compaq TCP/IP Services
for OpenVMS (Version 5 or later), and uses a Domain Name System (DNS)
server to resolve the Advanced Server cluster alias name, instead of WINS
or LMHOSTS. The Advanced Server cluster alias name should be registered
as a cluster name (that is, as having multiple A resource records for a single
host name) at the authoritative DNS server for the TCP/IP domain to which
the cluster belongs. This DNS name server must support dynamic updates
(Berkeley Internet Name Domain (BIND) server, Version 8.1.1 or later).
The DNS server associates the Advanced Server cluster alias name with an
ordered list of the IP addresses of all, or more typically, a subset of, associated
cluster nodes that are running the Advanced Server. The order of the list
is based on the relative loads of the servers in the cluster. The DNS name
server returns this ordered list to any client querying for the server cluster
alias name. Periodically, the cluster load balancing software dynamically
updates this cluster alias entry at the DNS server, providing a new ordered
list of associated IP addresses, based on the latest relative loads on the servers
running in the cluster.
Note
To have DNS resolve NetBIOS names, you must enable NetBIOS
name resolution using DNS, as described in Section 7.1.6.2, Selecting
NetBIOS Name Resolution. To correctly resolve the Advanced Server
cluster alias and gain the benefits of cluster load balancing, all clients
and servers should enable NetBIOS name resolution using DNS.

2.4.4.1 Background and Overview: Advanced Server Clusters and Load Balancing
The Advanced Server encompasses many of the features of the OpenVMS operating system, including OpenVMS Clusters and symmetric multiprocessing.
Advanced Servers in your network that are configured in an OpenVMS Cluster
environment share the same copy of the domain security accounts and shares
databases and assume a single role, either a PDC, BDC, or member server.
For Advanced Servers in an OpenVMS Cluster, you must define a server
cluster alias so that client workstations and network nodes can address the
Advanced Servers in the OpenVMS Cluster as a single entity.

Managing Domains and Servers 2–39

Managing Domains and Servers
2.4 Advanced Server in OpenVMS Clusters
Clients should connect to the Advanced Server using the Advanced Server
cluster alias; the client is connected to the least-loaded server in the OpenVMS
Cluster. To gain the benefits of load balancing and failover using DNS, remove
any entries for the cluster alias from the LMHOSTS file on clients, and remove
any static entries for the cluster alias from the WINS database on WINS
servers that might be used by clients.
2.4.4.2 The Software for Dynamic Cluster Load Balancing in WANs
The Advanced Server for OpenVMS in conjunction with TCP/IP Services for
OpenVMS provides dynamic load balancing through use of the load broker. The
load broker is a configurable software component that calculates the relative
loads of Advanced Server cluster members so that client requests for services
can be distributed appropriately among these members. For information about
configuring the load broker, refer to the latest TCP/IP Services for OpenVMS
documentation of cluster load balancing with BIND servers.
The load broker periodically polls the Metric Server running on the cluster
members to determine the current load on each member and then compiles a
list of all cluster members associated with the Advanced Server cluster alias,
dropping any systems that are not responding, and ordering the list based on
the relative loads. The load broker provides this list when it sends a dynamic
update request to a specified DNS server. The DNS server then updates the
Advanced Server cluster alias name entry in the DNS name server database.
The DNS name server uses this ordered list to answer client requests for the
Advanced Server cluster alias name. In addition, to further balance the load
among the server members of the cluster, the name server uses round-robin
scheduling. For every consecutive request for resolving the Advanced Server
cluster alias, the name server returns a new list, rotated by one (the second
server in the preceding list now being the first server in the new list, and so
on).
2.4.4.3 Enabling Dynamic Load Balancing Using TCP/IP Services for OpenVMS
To enable dynamic cluster load balancing for service requests from WAN
clients, complete the following tasks:
•

Remove all static entries for the cluster alias from the WINS database of
all WINS servers that are used by clients.

•

Remove all entries for the cluster alias from the LMHOSTS file of all
clients and servers.

•

Ensure that all hosts in the cluster are running Compaq TCP/IP Services
for OpenVMS. On each member of the cluster that is running the Advanced
Server, enable the Metric Server. The Metric Server calculates the load on
the cluster member that it is running on.

2–40 Managing Domains and Servers

Managing Domains and Servers
2.4 Advanced Server in OpenVMS Clusters
•

Configure the load broker, as explained in the latest TCP/IP Services for
OpenVMS Management guide.

•

Ensure TCP/IP connectivity between the cluster members and the load
broker.

•

At the authoritative DNS (BIND) name server for the cluster, ensure that
the Advanced Server cluster alias name is registered as a cluster alias
name (that is, as having multiple A resource records for a single host
name). The cluster name is associated with the IP addresses of all cluster
members that are running the Advanced Server.

•

Configure the authoritative DNS name server to allow dynamic updates
from the host on which the load broker is running, as explained in the
TCP/IP Services for OpenVMS Management guide.

•

Optionally, as appropriate, configure the parameters and logical names
described in the latest TCP/IP Services for OpenVMS Management guide.

Review the following guidelines:
•

The server cluster alias and the TCP/IP cluster alias should be different
(in many environments, this will facilitate troubleshooting problems that
involve name resolution).

•

Cluster hosts and clients are not required to be on the same bridged LAN.

•

The number of cluster member hosts is limited to 32.

•

The load broker can also be a cluster member.

•

A DNS (BIND) name server can also be a cluster member host.

•

The authoritative name server can be any name server that supports BIND
Version 8.1.1 or later, or that supports dynamic updates.

Managing Domains and Servers 2–41

3
Managing Users and Groups
On OpenVMS, you use Advanced Server ADMINISTER commands to manage
network user accounts and groups for domains and computers. You can also
use the Windows NT server administration tool, User Manager for Domains, to
perform these tasks.
The following topics are discussed in this chapter:
•

Section 3.1, Managing Network User Accounts, describes how to add,
modify, disable, enable, delete, rename, and display network user accounts
and how to specify passwords, logon hours, scripts, workstations, and other
user account information.

•

Section 3.2, Managing Advanced Server Groups, describes how to create,
copy, modify, delete, and display network groups.

Network user accounts and groups are separate and distinct from OpenVMS
user accounts and groups. This guide discusses management of network user
accounts and groups using Advanced Server.

3.1 Managing Network User Accounts
A network user account contains all the information that defines an Advanced
Server user. This includes user name, password, and group memberships. It
can also include information such as the user’s full name, the user account
description, user profile information, a list of logon workstations, and a
schedule of authorized logon hours.

3.1.1 Built-In User Accounts
Two predefined, built-in user accounts are provided when an Advanced Server
is installed:
•

The Administrator user account is used to manage the server’s users,
groups, and resources. The Administrator account belongs to the
Administrators, Domain Admins, and Domain Users built-in groups.

Managing Users and Groups 3–1

Managing Users and Groups
3.1 Managing Network User Accounts
You can use the Administrator account to administer a new server or
workstation before you have had the opportunity to create an account for
yourself. You cannot delete or disable the Administrator account. This
ensures that you will never lock yourself out of the computer. When you
initially configure the Advanced Server, you are prompted to choose a
password for the Administrator account. Always assign a password to the
Administrator account to help ensure security.
•

The Guest user account belongs to the Domain Guests group and allows
logons for users who do not have accounts in the computer’s domain, or in a
domain trusted by the domain where the Guest account has been enabled.
By default, the Guest account is disabled at installation. You can enable it
if Guest access is desired.
Note
Guest users should not create files in their default directory that they
do not want other users to access, because all users logged on as Guest
access the same default directory.

3.1.2 Types of User Accounts
Every network user account is either a global account or a local account:
•

Global user accounts provide access to resources in the domain where the
user account is created, and can also provide access to resources in domains
that trust the domain where the user account is created.

•

Local user accounts are restricted to the local domain. A local account
can be used only to access server resources over the network. It cannot be
used to log on to a Windows NT Server or workstation computer from the
console.

3.1.3 User Account Attributes
The user account identifies the user to Advanced Server. The user account is
used to authenticate the user both when the user logs on to the domain and
when the user requests access to shared resources.
Each user account must have a unique user name in the domain. When you
create a user account, you can specify the user account attributes shown in
Table 3–1, User Account Attributes.

3–2 Managing Users and Groups

Managing Users and Groups
3.1 Managing Network User Accounts
Table 3–1 User Account Attributes
Attribute

Contains

User name

The user’s account name (up to 20 alphanumeric
characters).

Password

The password the user enters to log on to the account (up
to 14 uppercase and lowercase alphanumeric characters).
Passwords entered on ADMINISTER command lines are
converted to uppercase unless enclosed within quotation
marks.

Full name

User’s full name, typically more complete than the account
name (up to 256 characters).

Description

A brief text string describing the account.

Expiration date

Date when the account expires.

Type

Global or local.

Group names

The names of groups of which the user is a member.
Determines privileges and access.

Logon restrictions

Logon hours and valid workstations.

Logon script

A script that is executed when the user logs on.

Home directory

A specified location containing files and programs for the
user.

User profile

Setup information for the user’s specific environment.

Advanced Server allows you to integrate OpenVMS user accounts with
network user accounts. Network user accounts can be linked (host mapped) to
OpenVMS user accounts, simplifying user account management, ensuring
password synchronization, and providing automatic access to network
administration functions for OpenVMS system manager and operators.
See Section 3.1.16.2, Establishing User Account Host Mapping, for more
information.
To set account characteristics across all network user accounts, set the account
policy, as described in Section 2.2.1, Managing the Account Policy.
User accounts are stored in the domain’s Security Account Manager (SAM)
database. The SAM database is maintained by the primary domain controller
and periodically updated on the backup domain controllers. One of the
computers in the domain must be running as a primary domain controller in
order for user accounts to be created or modified.

Managing Users and Groups 3–3

Managing Users and Groups
3.1 Managing Network User Accounts

3.1.4 Creating User Accounts
You create network user accounts on the Advanced Server with the ADD USER
or COPY USER command.
3.1.4.1 Creating a Network User Account
When you create a user account, you must provide all the information relevant
to that user. You can use the ADD USER command to create a user account,
or the COPY USER command to copy another account and modify it to suit the
specific user.
When you display user information, the users are listed alphabetically by user
name; you can optionally sort the display based on the full name. Therefore,
follow the same conventions for all users when you enter full names; for
example, Cowardly Lion or Lion, Cowardly.
Passwords for network user accounts are case sensitive. Passwords entered
on the ADMINISTER command line default to all uppercase characters,
unless you enclose them in quotation marks. To preserve lowercase letters,
spaces, and other nonalphanumeric characters in passwords when you enter
ADMINISTER commands, enclose the password in quotation marks, or enter
the password in response to the prompt instead of on the command line. The
following example shows how to enter a mixed-case password on the command
line:
LANDOFOZ\\TINMAN> ADD USER SCARECROW/PASSWORD="OverTheRainbow"
%PWRK-S-USERADD, user "SCARECROW" added to domain "LANDOFOZ"
LANDOFOZ\\TINMAN>
You can specify an optional description for the user by including the
/DESCRIPTION qualifier. If the description contains nonalphanumeric
characters, spaces, or lowercase letters, enclose the description in quotation
marks.
3.1.4.1.1 Creating a Global User Account Use the ADD USER command to
create a global user account, as in the following example:
LANDOFOZ\\TINMAN> ADD USER SCARECROW/PASSWORD _LANDOFOZ\\TINMAN> /DESCRIPTION= "The Straw Man" _LANDOFOZ\\TINMAN> /FULLNAME="Man, Straw"
Password:
Password verification:
%PWRK-S-USERADD, user "SCARECROW" added to domain "LANDOFOZ"
LANDOFOZ\\TINMAN>

3–4 Managing Users and Groups

Managing Users and Groups
3.1 Managing Network User Accounts
You can let Advanced Server prompt you for the user name and the password.
The password is not displayed as you enter it. You should always supply a
password when you add a user account, or explicitly specify that the user
account has no password (using the /NOPASSWORD qualifier); otherwise
the password value is unknown. By default, a user account is created with
an expired password. The user must enter a new password at first logon.
To remove the need for users to reset their passwords at first logon, use the
/FLAGS=(NOPWDEXPIRED) qualifier with the ADD USER command.
You can specify additional details about the user account, including an account
description, expiration date, a full name, type of account (global or local), a
home directory, logon hours, group membership, user profile, logon script, and
workstation names, if any. For details on the ADD USER command, refer to
the Compaq Advanced Server for OpenVMS Commands Reference Manual.
The ADD USER command does not create an OpenVMS user account.
However, if the user also has an OpenVMS account, you can associate the
two user accounts. For more information, see Section 3.1.16, User Account
Host Mapping.
Users with both a network account and an OpenVMS account have two
passwords: one for each user account. You can enable external authentication
for these users, providing automatic password synchronization between
the OpenVMS password and the network password. For information about
external authentication, see Section 3.1.17, External Authentication.
3.1.4.1.2 Verifying That the User Has Been Added To verify that the user
you created an account for has been added, use the SHOW USERS command.
You can display details about a user account with the SHOW USERS/FULL
command. For example:
LANDOFOZ\\TINMAN> SHOW USERS SCARECROW/FULL
User accounts in domain "LANDOFOZ":

Managing Users and Groups 3–5

Managing Users and Groups
3.1 Managing Network User Accounts
User Name
Full Name
Type
Description
-------------------- -------------------- ------ --------------SCARECROW
Man, Straw
Global The Straw Man
User Profile:
Logon Script:
Primary Group: Domain Users
Member of groups: Domain Users
Workstations: No workstation restrictions
Logon Flags: Login script is executed, Password is expired
Account Type: Global
Account Expires: Never
Logon hours: (All hours)
Last Log On: 08/23/00 05:07 PM
Password Last Set: 06/30/00 11:03 AM
Password Changeable: 06/30/00 11:03 AM
Password Expires: 09/11/00 11:03 AM
Total of 1 user account
LANDOFOZ\\TINMAN>
A primary group is used when a user logs on using Windows NT Services for
Macintosh, or runs POSIX applications.
3.1.4.1.3 Creating a Local User Account To create a local user account,
use the ADD USER command as shown previously, and include the /LOCAL
qualifier.
3.1.4.2 Creating User Account Templates
You can create a template for user accounts, specifying user account
information common to the new user accounts you need to create. Most user
account information can be copied from the template to the new user accounts,
except for user name and password. For example, you could create a template
user account as follows:
LANDOFOZ\\TINMAN> ADD USER TEMPLATE/LOCAL/HOURS=(8-5) _LANDOFOZ\\TINMAN> /MEMBER_OF_GROUPS=MUNCHKINS
%PWRK-S-USERADD, user "TEMPLATE" added to domain "LANDOFOZ"
You can then use the COPY USER command to create many new user accounts
that have these same characteristics. Once you have completed adding all
your new user accounts, you can then delete or disable the TEMPLATE
user account, as described in Section 3.1.15, Disabling and Removing User
Accounts.

3–6 Managing Users and Groups

Managing Users and Groups
3.1 Managing Network User Accounts
3.1.4.3 Copying User Accounts
You can use the COPY USER command to create a new user account from
an existing account or a template account. Some of the original user account
information is copied to the new user account, such as group memberships and
logon restrictions. A template account makes it easier to create many similar
user accounts with fewer errors than to create them one by one. Some user
account information, such as user name and password, is not copied to the new
user account. You should always supply a password when you create a new
user account, or explicitly specify that the user account has no password (using
the /NOPASSWORD qualifier); otherwise the password value is unknown.
Use the /PASSWORD qualifier with the COPY USER command to specify the
password for the new user account. For example, to create a new user LION
based on a user account template (TEMPLATE), enter the following command:
LANDOFOZ\\TINMAN> COPY USER TEMPLATE LION/PASSWORD="Roaring1"_LANDOFOZ\\TINMAN> /FULL_NAME="Cowardly Lion"
%PWRK-S-USERCOPY, user "TEMPLATE" copied to "LION" in domain "LANDOFOZ"
LANDOFOZ\\TINMAN>
This example copies the TEMPLATE user account information to a new
account for user LION and uses the /FULL_NAME qualifier to provide the
full name for the new user. The /PASSWORD qualifier specifies the password
for the account LION. You can verify that the user is correctly added, by using
the SHOW USERS command.

3.1.5 Specifying Passwords
Users must specify their password when they log on to the domain. The user
name and password are validated against the security accounts database.
Advanced Server password characteristics are controlled by the following:
•

The /FLAGS qualifier with the ADD USER, COPY USER, and MODIFY
USER commands.
For example, use ADD USER/FLAGS=(keyword) to specify password
characteristics when you create a user account. The keywords that control
the password characteristics are:
[NO]DISPWDEXPIRATION, which prevents the password from
expiring.
[NO]PWDEXPIRED, which specifies whether the password is initially
expired. This forces the user to specify a new password when they log
on the first time.

Managing Users and Groups 3–7

Managing Users and Groups
3.1 Managing Network User Accounts
[NO]PWDLOCKED, which specifies whether the user is allowed to
change the password.
For more information about these commands and qualifiers, refer to the
Compaq Advanced Server for OpenVMS Commands Reference Manual.
•

The SET ACCOUNT POLICY/PASSWORD_POLICY command.
This command sets domain-wide account policy characteristics that pertain
to all passwords, including the:
Maximum password age
Minimum password age
Minimum length of the password
Whether password history is maintained
For more information on how to use this command to establish a policy for
password usage, see Section 2.2.1, Managing the Account Policy.

•

The SET ACCOUNT POLICY/LOCKOUT command.
This command establishes how failed attempts to logon to the network
are handled. You can use this command to specify the number of failed
logon attempts before the account is locked, as explained in detail in
Section 2.2.1, Managing the Account Policy.
By default, user account lockout is disabled, meaning that the user
accounts are never locked out, no matter how many failed logon attempts
are made on a user account.
For more information about setting the account policy, see Section 2.2,
Managing Security Policies and refer to the Compaq Advanced Server for
OpenVMS Commands Reference Manual.

Network users who also have OpenVMS user accounts have two passwords,
one for each account. If password synchronization is important, as with
external authentication, be careful to observe limitations in password length
and characters required by OpenVMS as well as Advanced Server. Network
passwords can be up to 14 characters long; OpenVMS passwords can be longer.
To help ensure security, select secure passwords using words not found in the
dictionary, including numbers or nonalphabetic characters.
When you add a new user or modify the password for an existing user, you
specify the password for that user. For example:
LANDOFOZ\\TINMAN> ADD USER SCARECROW/PASSWORD="YellowRoad"
%PWRK-S-USERADD, user "SCARECROW" added on domain "LANDOFOZ"
LANDOFOZ\\TINMAN>

3–8 Managing Users and Groups

Managing Users and Groups
3.1 Managing Network User Accounts
To preserve case in a password, enclose it in quotation marks. By default, a
password entered on the command line that is not enclosed in quotation marks
is stored in uppercase letters. However, case is preserved for a password
entered in response to a prompt.
3.1.5.1 Changing a User Password
To change a user’s password, you can use the SET PASSWORD command or
the MODIFY USER/PASSWORD command. For example:
LANDOFOZ\\TINMAN> SET PASSWORD SCARECROW "YellowRoad" "EmeraldCity"
%PWRK-S-PSWCHANGED, password changed for user "SCARECROW" in domain
"LANDOFOZ"
LANDOFOZ\\TINMAN>
In this example, the user name is SCARECROW, the existing password is
"YellowRoad" and the password is changed to "EmeraldCity."

3.1.6 Specifying Group Membership
Group membership allows you to control multiple user accounts and to grant
permissions to use resources to a group of users rather than specifying
individual users for resource permissions. By default, all user accounts
are included in the special group Everyone. For the purposes of network
administration, the user account is also included in the groups Domain Users
and Users.
When you create a user account, you can specify membership in additional
groups using the ADD GROUP or COPY GROUP command. For example,
to include the user SCARECROW in the group MUNCHKINS, add the user
account including the /MEMBER_OF_GROUPS qualifier, as follows:
LANDOFOZ\\TINMAN>ADD USER SCARECROW/PASSWORD/MEMBER_OF_GROUPS=(MUNCHKINS)
Password:
Password verification:
%PWRK-S-USERADD, user "SCARECROW" added to domain LANDOFOZ"
LANDOFOZ\\TINMAN>

3.1.7 Specifying Logon Hours
You can restrict the days and hours during which a user can connect to a
server. The default is to allow a user to connect at all times. To specify logon
hours, use the ADD USER, COPY USER, or MODIFY USER command with
the /HOURS qualifier. Specify the hours to be administered as shown in the
following table. The /NOHOURS qualifier specifies that the user cannot log on
to the server.

Managing Users and Groups 3–9

Managing Users and Groups
3.1 Managing Network User Accounts
Hours are inclusive: if you grant access during a given hour, access extends
to the end of that hour; if no hours are specified for a given day, all hours are
allowed.
To select . . .

Use, for example . . .

A specific hour

/HOURS=(MONDAY=(8))

A block of hours

/HOURS=(FRIDAY=(8-12))

One entire day

/HOURS=(SUNDAY)

A specific hour across all seven
days

/HOURS=(SUNDAY=(1),MONDAY=(1),
TUESDAY=(1), WEDNESDAY=(1),
THURSDAY=(1),FRIDAY=(1), SATURDAY=(1))

All weekdays

/HOURS=(WEEKDAYS)

The entire week

/HOURS=(EVERYDAY)

In the following example, a user called MOUSEQUEEN is added to the domain
LANDOFOZ with logon capability on Fridays from 8 a.m. to 12 noon.
LANDOFOZ\\TINMAN> ADD USER MOUSEQUEEN/HOURS=(FRIDAY=(8-12))
%PWRK-S-USERADD, user "MOUSEQUEEN" added to domain "LANDOFOZ"
The following example adds user BLACKCROW to domain LANDOFOZ, with
logon capability from Monday through Friday, all hours.
LANDOFOZ\\TINMAN> ADD USER BLACKCROW/HOURS=(WEEKDAYS)
%PWRK-S-USERADD, user "BLACKCROW" added to domain "LANDOFOZ"
For more details on the /HOURS qualifier, see Section 3.1.14, Modifying User
Accounts.

3.1.8 Specifying Logon Scripts
You can specify the execution of a logon script when a user logs on. A logon
script is an executable or batch file of commands that runs on the client. It
is typically used to configure the client for a particular user, performing such
tasks as making network connections and starting applications. Logon scripts
can be tailored to the requirements of individual users. A logon script typically
has a .BAT, .CMD, or .EXE file extension, depending on its function.
3.1.8.1 Setting Up a Logon Script
When a user logs on, Advanced Server checks the user’s account on the logon
server for the name of a script. Scripts are kept on the primary and backup
domain controllers. By default, user scripts on an Advanced Server are stored
in the following location:
PWRK$LMROOT:[LANMAN.REPL.IMPORT.SCRIPTS]

3–10 Managing Users and Groups

Managing Users and Groups
3.1 Managing Network User Accounts
3.1.8.2 Providing User Access to Logon Scripts
For a user to have access to a logon script, the following conditions must be
true:
•

The SCRIPTS directory must be shared.

•

The user must have R (read) permission for the script. By default, all users
in group Everyone have R (read) permission to access the scripts directory.

Ensure that permissions on the directory or share where the scripts reside
permit access to all users who will be using the scripts. Advanced Server
automatically provides Read access to members of the special group Everyone.
When the NetLogon service starts, the Advanced Server shares the scripts
directory identified with the share name NETLOGON. For logon scripts to run,
do not remove the NETLOGON share. You can display information about the
NETLOGON share using the SHOW SHARE NETLOGON/FULL command.
For example:
LANDOFOZ\\TINMAN> SHOW SHARE NETLOGON/FULL
Shared resources on server "TINMAN":
Name
Type
Description
------------ --------- -----------------------------------------NETLOGON
Directory Logon Scripts Directory
Path: PWRK$LMROOT:[LANMAN.REPL.IMPORT.SCRIPTS]
Connections: Current: 0, Maximum: No limit
RMS file format: Stream
Directory Permissions: System: RWED, Owner: RWED, Group: RWED, World: RE
File Permissions: System: RWD, Owner: RWD, Group: RWD, World: R
Share Permissions:
Everyone
Read
Total of 1 share
LANDOFOZ\\TINMAN>

3.1.9 Specifying Workstations
Use the /WORKSTATIONS qualifier to restrict the workstations from which
users can log on to domain accounts. The default is to allow a user to log on
from any workstation, but you can optionally restrict a user’s logons to certain
workstations. You can specify up to eight workstations for the user account.
To manage logon workstations, use the ADD USER, COPY USER, or MODIFY
USER command, with the /WORKSTATION qualifier. For example:
LANDOFOZ\\TINMAN> ADD USER LION /WORKSTATION=(LIONS_DEN)
%PWRK-S-USERADD, user "LION" added to domain "LANDOFOZ"

Managing Users and Groups 3–11

Managing Users and Groups
3.1 Managing Network User Accounts
This command creates the new user account LION and specifies that the user
can log on from the LIONS_DEN workstation.

3.1.10 Specifying Home Directories
A user’s home directory is accessible to the user and contains files and
programs for that user. When a user logs on at a workstation, a connection can
be made to that user’s home directory automatically. Depending on the client
computer, you may need to specify the home directory in a logon script. The
home directory becomes the user’s default directory for file access and for all
applications that do not have a defined working directory. Home directories
can make it easier for an administrator to back up user files because they keep
many or all of a user’s files in one location.
On a server running Advanced Server software, the default parent directory
for user account home directories is:
PWRK$LMROOT:[LANMAN.ACCOUNTS.USERDIRS]
You can specify a home directory as an absolute path name or as a UNC
(Universal Naming Convention) path name, which is domain wide. To specify
the default parent directory for user account home directories, enter:
\\server\LANMAN\ACCOUNTS\USERDIRS
If you omit the /HOME qualifier when you create a user account, no home
directory is defined for a user.
Note
The Advanced Server home directory is not associated with the
OpenVMS SYS$LOGIN directory.

A home directory can be assigned to a single user or it can be shared by several
users. It can be a local directory on a user’s workstation or a shared network
directory. If you specify a network path for the home directory, an attempt
is made to create that home directory. If the directory cannot be created, a
message instructs you to create the directory manually.
To specify a home directory, use the ADD USER, COPY USER, or MODIFY
USER command, with the /HOME=(PATH=pathname) qualifier. The home
directory pathname must be specified in one of the following forms:
•

The absolute path of a directory local to the user’s workstation

3–12 Managing Users and Groups

Managing Users and Groups
3.1 Managing Network User Accounts
•

The UNC path for a shared network directory, as follows:
\\servername\sharename\directoryname
If you specify a UNC path, you must also specify a drive letter that is not
currently being used on the user’s workstation, to be assigned to the path
when the user logs on.

For example, to modify user account LION, specifying a home directory on
server TINMAN to be associated with drive D, enter the following command:
LANDOFOZ\\TINMAN> MODIFY USER LION/HOME=(PATH=\\TINMAN\USERS\LION,DRIVE=D:)
%PWRK-S-USERMOD, user "LION" modified on domain "LANDOFOZ"
LANDOFOZ\\TINMAN>

3.1.11 Specifying User Account Expiration Dates
You can assign an expiration date for a user account, at which time the account
is automatically expired but not removed from the accounts database. You can
reactivate an expired account by removing the expiration date or by assigning
a new date.
By default, there is no expiration date for a user account. Use the ADD USER,
COPY USER, or MODIFY USER command with the /EXPIRATION qualifier to
define the account expiration date for a user account.
When an account has an expiration date, the account is disabled at the end of
the previous day. When an account expires, a user who is logged on remains
logged on, but cannot establish new network connections or log on again after
logging off.
For example, to add a user named FRIENDLY to the domain LANDOFOZ and
set the account to expire on June 9, 1999, enter the following command:
LANDOFOZ\\TINMAN> ADD USER FRIENDLY/PASSWORD="PotOfGold"_LANDOFOZ\\TINMAN>/EXPIRATION_DATE=09-JUN-1999
%PWRK-S-USERADD, user "FRIENDLY" added to domain "LANDOFOZ"

3.1.12 Specifying User Profiles
User profiles allow you to set up the user’s environment so that it can be
downloaded to the user’s workstation when the user logs on to the network.
The user profile contains configuration information such as:
•

Desktop arrangement

•

Personal program groups and program items

•

Screen colors and screen savers

•

Network connections
Managing Users and Groups 3–13

Managing Users and Groups
3.1 Managing Network User Accounts
•

Mouse settings

•

Window size and positions

When the user logs on, the user profile is downloaded and the user’s
workstation is configured accordingly.
You create user profiles using the Windows NT Server tool User Profile Editor.
Refer to your Windows NT Server documentation for more information.
When you add a user, you can specify a profile and its path.
To specify a profile, use the ADD USER or MODIFY USER command with the
/PROFILE qualifier. For example, to add user SCARECROW with a profile
that is stored on the server TINMAN, enter the following command:
LANDOFOZ\\TINMAN> ADD USER SCARECROW/PROFILE="\\TINMAN\PROFILES\SCARECROW.USR"
%PWRK-S-USERADD, user "SCARECROW" added to domain "LANDOFOZ"
LANDOFOZ\\TINMAN>
Note that the network path to the profile is enclosed in quotation marks.

3.1.13 Displaying User Accounts
To display information about user accounts, use the SHOW USERS command.
For example:
LANDOFOZ\\TINMAN> SHOW USERS
User accounts in domain "LANDOFOZ":
User Name
-------------Administrator
Guest
LION
SCARECROW

Full Name
-----------

Type
Description
------ -----------------------Global Built-in account for
administering the domain
Global Built-in account for
guest access to the domain
Lion,Cowardly Global Cowardly Lion
Man, Straw
Global The Straw Man

Total of 4 user accounts
LANDOFOZ\\TINMAN>

3–14 Managing Users and Groups

Managing Users and Groups
3.1 Managing Network User Accounts
3.1.13.1 Example: Sorting the Display by User Full Name
To sort the display by user full name, use the SHOW USERS/SORT=FULLNAME
command, as in the following example:
LANDOFOZ\\TINMAN> SHOW USERS/SORT=FULLNAME
User accounts in domain "LANDOFOZ:"
Full Name
User Name
-------------- ------------Administrator
Guest
Lion, Cowardly LION
Man, Straw
SCARECROW

Type
Description
------ --------------------------Global Built-in account for
administering the domain
Global Built-in account for guest
access to the domain
Global Cowardly Lion
Global The Straw Man

Total of 4 user accounts
LANDOFOZ\\TINMAN>
3.1.13.2 Example: Reviewing User Account Settings for a Specific User
To display user account settings for a specific user, use the SHOW USERS/FULL
command. For example, the following display shows the settings for user
LION.
LANDOFOZ\\TINMAN> SHOW USERS LION/FULL
User accounts in domain "LANDOFOZ":
User Name
Full Name
Type
Description
--------------- --------------- ------- ------------LION
Lion, Cowardly Global Cowardly Lion
User profile:
Logon script:
Home Path: D: Path: \\TINMAN\USERS\LION
Primary Group: Domain Users
Member of groups: Domain Users, MUNCHKINS
Workstations: No workstation restrictions
Logon Flags: Logon script is executed, Password is expired
Account Type: Global
Account Expires: Never
Logon hours (All hours)
Last Log On: 08/23/00 05:07 PM
Password Last Set: 06/30/00 11:03 AM
Password Changeable: 06/30/00 11:03 AM
Password Expires: 09/11/00 11:03 AM
Total of 1 user account
LANDOFOZ\\TINMAN>

Managing Users and Groups 3–15

Managing Users and Groups
3.1 Managing Network User Accounts

3.1.14 Modifying User Accounts
Use the MODIFY USER command to change the attributes of an existing user
account. You can:
•

Change group membership

•

Add, change, or delete a description

•

Specify a full name

•

Specify whether the user is a global or local user

•

Change the user’s account settings

•

Remove a user from a group

•

Specify workstations that the user can access

3.1.14.1 Example: Adding an Existing User to a Group
To add an existing user to a group, use the MODIFY USER/ADD_TO_GROUPS
command, as in the following example:
LANDOFOZ\\TINMAN> MODIFY USER SCARECROW/ADD_TO_GROUPS=MUNCHKINS
%PWRK-S-USERMOD, user "SCARECROW" modified on domain "LANDOFOZ"
You can then enter the SHOW GROUPS/FULL command to see that the group
MUNCHKINS now includes the user SCARECROW:
LANDOFOZ\\TINMAN> SHOW GROUPS MUNCHKINS/FULL
Groups in domain "LANDOFOZ":
Group Name
Type
Description
-------------------- ------ -----------------------------------MUNCHKINS
Global Users in the Land of Oz
Members: [US]LION, [US]SCARECROW)
Total of 1 group)
LANDOFOZ\\TINMAN>
3.1.14.2 Example: Changing a user’s logon hours
To change the hours when a user can log on, use the MODIFY USER/HOURS
command. For example, to restrict a user to logging on only on Monday from 8
a.m. to 9 a.m. and from 3 p.m. to 8 p.m., specify /HOURS=(MON=(8-9,15-20)).
For example, to modify LION’s logon hours, use the MODIFY USER command,
as follows.
LANDOFOZ\\TINMAN> MODIFY USER LION/HOURS=(MON=(8-9,15-20))
%PWRK-S-USERMOD, user "LION" modified on domain "LANDOFOZ"
LANDOFOZ\\TINMAN>

3–16 Managing Users and Groups

Managing Users and Groups
3.1 Managing Network User Accounts
You can verify that the change was made correctly using the SHOW
USERS/FULL command. For example:
LANDOFOZ\\TINMAN> SHOW USERS LION/FULL
User accounts in domain "LANDOFOZ":
User Name
Full Name
Type
Description
--------------- --------------- ------- ------------LION
Lion, Cowardly Global Cowardly Lion
User profile:
Logon script:
Home Path: D: Path: \\TINMAN\USERS\LION
Primary Group: Domain Users
Member of groups: Domain Users, MUNCHKINS
Workstations: No workstation restrictions
Logon Flags: Logon script is executed, Password is expired
Account Type: Global
Account Expires: Never
Logon hours: 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 2 2 2 2
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
Sunday: - - - - - - - - - - - - - - - - - - - - - - - Monday: - - - - - - - - X X - - - - - X X X X X X - - Tuesday: - - - - - - - - - - - - - - - - - - - - - - - Wednesday: - - - - - - - - - - - - - - - - - - - - - - - Thursday: - - - - - - - - - - - - - - - - - - - - - - - Friday: - - - - - - - - - - - - - - - - - - - - - - - Saturday: - - - - - - - - - - - - - - - - - - - - - - - Last Log On: 08/23/00 05:07 PM
Password Last Set: 06/30/00 11:03 AM
Password Changeable: 06/30/00 11:03 AM
Password Expires: 09/11/00 11:03 AM
Total of 1 user account
LANDOFOZ\\TINMAN>

3.1.15 Disabling and Removing User Accounts
A user’s ability to log on can be rescinded by either disabling or removing the
user account. A disabled user account still exists, but the user is not permitted
to log on. It continues to appear in the user accounts list. It can be restored to
enabled status at any time. A removed account is permanently removed and
cannot be recreated with the same security settings.
Each user in a domain is identified by a unique security identifier (SID). The
SID is created when a user account is created and is used when assigning
permissions to a resource. Because a SID is unique to an account, a new
account, even with the same user name, is assigned a new SID. Therefore,
if you delete a user account and then need to create another user account
for the same user with the same user name, the new user account will not

Managing Users and Groups 3–17

Managing Users and Groups
3.1 Managing Network User Accounts
have the rights or permissions that previously were granted to the old user
account, because the user account will have a different SID. To avoid problems,
first disable a user account you want to remove and then remove it after a
reasonable time.
3.1.15.1 Disabling a User Account
Set the account to Disabled, using the MODIFY USER/FLAGS=(DISUSER)
command.
3.1.15.2 Deleting a User Account
To delete a user account, use the REMOVE USER command. You are prompted
for confirmation before the command executes.
A deleted user account is removed from the user accounts list and cannot be
restored or recreated. Make sure that you want to delete a user account before
doing so. For example:
LANDOFOZ\\TINMAN> REMOVE USER LION
Each user account is represented by a unique identifier which is
independent of the user name. Once the user account is deleted,
even creating an identically named user account in the future will
not restore access to resources which currently name this user
account in the access control list.
Remove user "LION" [YES or NO] (YES) : YES
%PWRK-S-USERREM, user "LION" removed from domain "LANDOFOZ"
LANDOFOZ\\TINMAN>

3.1.16 User Account Host Mapping
Advanced Server provides user account host mapping, which associates
a network user account with an OpenVMS user account, simplifying the
management of both user accounts. Host mapping is required for users
who are externally authenticated, as described in Section 3.1.17, External
Authentication.
Every file on an OpenVMS system must have an owner. Host mapping
establishes which OpenVMS account is assigned as the owner when an
Advanced Server user creates files or directories. Host mapping is also
used to determine the OpenVMS user name when logging on to OpenVMS
using external authentication. Additionally, when the Advanced Server and
OpenVMS security model is enabled, host mappings are used to determine the
OpenVMS access rights permitted to the user. The security models are selected
using the Configuration Manager, as described in Section 7.1, Managing File
Server Parameters Affecting System Resources.

3–18 Managing Users and Groups

Managing Users and Groups
3.1 Managing Network User Accounts
3.1.16.1 Implicit and Explicit Host Mapping
The Advanced Server supports both explicit and implicit host mapping between
OpenVMS and Advanced Server user accounts. You can explicitly map a
network user name to an OpenVMS user name using the ADMINISTER
command ADD HOSTMAP.
Implicit host mapping is established when:
•

An OpenVMS user name matches a network user name exactly.

•

The network user name is one of the following:
Administrator (implicitly mapped to the SYSTEM account)
Guest (implicitly mapped to PWRK$GUEST)
PWRK$DEFAULT (used when no match is found)

Host mapping is used to determine the OpenVMS user name when logging on
to OpenVMS using external authentication. The user account Administrator
is implicitly mapped to the OpenVMS user account SYSTEM. Therefore, if
you enable the OpenVMS user account SYSTEM for external authentication,
you can log in to the SYSTEM account using the Administrator user name
and password, without explicitly defining any host map information. See
Section 3.1.17, External Authentication, for more information.
Implicit host mapping is based on the user account names. Therefore, if you
copy the Administrator account or the Guest account, you must specifically set
up host mapping for the new user accounts. If you rename the Administrator
or Guest account, the implicit mapping is not preserved. You must explicitly
map the newly renamed account name to the OpenVMS SYSTEM account
using the ADMINISTER command ADD HOSTMAP.
3.1.16.2 Establishing User Account Host Mapping
By default, if a user name for a network user account is identical to the user
name for an OpenVMS user account, the user accounts are host mapped. Files
created by the network user are automatically designated with the OpenVMS
owner setting. This feature is controlled by a set of server configuration
parameters, described in Section 7.2, Managing Server Configuration
Parameters Stored in the OpenVMS Registry, and listed in Appendix A, Server
Configuration Parameters, including:
•

HostMapUseVMSNames, which specifies whether host mapping is
enabled or not. By default, host mapping is enabled.

•

HostMapDomains, which specifies domain names for user accounts in
trusted domains.

Managing Users and Groups 3–19

Managing Users and Groups
3.1 Managing Network User Accounts
•

HostMapDefault, which specifies the default OpenVMS user name to
associate with user accounts that have no default or specified mapping.

When a user creates a file or directory using the Advanced Server, the resource
is assigned the OpenVMS ownership associated with the user’s mapped
account. The mapped account is used for OpenVMS resource ownership.
(For more information about enabling this security model, see Section 7.1,
Managing File Server Parameters Affecting System Resources.)
3.1.16.2.1 Setting Up Explicit Host Mapping To set up explicit host mapping,
use the ADD HOSTMAP command in the following form:
ADD HOSTMAP network-user-name OpenVMS-user-name
In the following example, the network user account for SCARECROW is host
mapped to the user’s OpenVMS user account STRAWMAN. If SCARECROW
creates a file, the file is assigned the RMS ownership attributes associated with
the OpenVMS account STRAWMAN.
LANDOFOZ\\TINMAN> ADD HOSTMAP SCARECROW STRAWMAN
%PWRK-S-HOSTMAPADD, user "SCARECROW" mapped to host user "STRAWMAN"
LANDOFOZ\\TINMAN>
3.1.16.2.2 Displaying Host Mapping
HOSTMAP command. For example:

To display host mapping, use the SHOW

LANDOFOZ\\TINMAN> SHOW HOSTMAP
Host Mappings for server "TINMAN":
User Name
---------------------------Guest
SCARECROW
LION

Host Name
----------PWRK$GUEST
STRAWMAN
CLION

Total of 3 host mappings
LANDOFOZ\\TINMAN>

3.1.17 External Authentication
External authentication allows the OpenVMS system manager to set up
an OpenVMS user account for which login authentication is verified by
the Advanced Server domain security. External authentication allows the
Advanced Server to do the user authentication for both Advanced Server
domain user and OpenVMS user accounts.

3–20 Managing Users and Groups

Managing Users and Groups
3.1 Managing Network User Accounts
External authentication is an option for users who have both OpenVMS and
Advanced Server domain user accounts. It is not required. User host mapping
provides the link between these two accounts, as described in Section 3.1.16,
User Account Host Mapping.
With external authentication, users get automatic password synchronization
between their OpenVMS account and their corresponding Advanced Server
domain account. The passwords are synchronized whenever a user logs in to
the OpenVMS account, provided that an Advanced Server domain controller is
available to service the request. Externally authenticated users are considered
to have a single password and are not subject to OpenVMS password policies,
such as password expiration, password history, and minimum and maximum
password length restrictions. Users are, however, subject to the Advanced
Server domain user account policy that is defined. All other OpenVMS account
restrictions remain in effect, such as disabled accounts, time restrictions, and
quotas. For information on enabling external authentication, refer to the
Compaq Advanced Server for OpenVMS Server Installation and Configuration
Guide. For information about setting up the system and enabling OpenVMS
user accounts for external authentication, refer to the OpenVMS Guide to
System Security.
3.1.17.1 Configuring the Server Capacity for External Authentication
By default, the Advanced Server can support up to 10 simultaneous external
authentication logon requests (signons). You can modify this maximum to suit
the server requirements, using the Configuration Manager. For more details,
see Section 7.1.4.4, Specifying the Maximum Number of Concurrent Signons.
3.1.17.2 Synchronizing Passwords
The password of an externally authenticated OpenVMS user is automatically
synchronized with the host mapped Advanced Server domain user, regardless
of the role of the Advanced Server in the domain.
When a user changes the OpenVMS password using the OpenVMS command
SET PASSWORD, and external authentication is set for the user, OpenVMS
forwards the password change request to the Advanced Server. When the
password change request is successfully processed, OpenVMS updates the
OpenVMS user password. If Advanced Server is not running when the
OpenVMS command SET PASSWORD is executed, the domain password is
not changed.
When users change their passwords from their client workstations, or the
server administrator changes a password with the ADMINISTER command
SET PASSWORD, the Advanced Server processes the password change as
usual. The OpenVMS password is synchronized when the user next logs in
to OpenVMS. All password changes are synchronized. When an OpenVMS
Managing Users and Groups 3–21

Managing Users and Groups
3.1 Managing Network User Accounts
user no longer has the external authentication flag set, the password for the
OpenVMS user account is the same as the one that was last set by Advanced
Server.
When users change their password on the OpenVMS system or on their client
computer, they should use the new password to log in to OpenVMS. If, for some
reason, the Advanced Server software is down at the time of the OpenVMS
login, users can use their old OpenVMS password to log in, but only if you
have enabled overriding of external authentication. In this case, privileged
users can enter the /LOCAL_PASSWORD qualifier after their OpenVMS user
name at the login prompt, as explained in Section 3.1.17.3, Bypassing External
Authentication When the Network Is Down. This causes OpenVMS to perform
local authentication.
Note
Password synchronization may fail due to the different sets of valid
characters allowed by OpenVMS and Advanced Server. Keep this in
mind when changing the password of an externally authenticated user.

3.1.17.3 Bypassing External Authentication When the Network Is Down
External authentication cannot occur if a network connection is required and
the network is down. However, as a temporary solution, privileged users can
enter the /LOCAL_PASSWORD qualifier after the OpenVMS user name at the
login prompt, to specify local authentication. Be sure to specify the OpenVMS
user name and password when using the /LOCAL_PASSWORD qualifier.
Because using the /LOCAL_PASSWORD qualifier effectively overrides the
security policy established by the system manager, it is allowed only when the
user’s account has SYSPRV as an authorized privilege. This allows the system
manager to gain access to the system when the network is down.
When Bit 1 is set in the SYS$SINGLE_SIGNON logical name, nonprivileged
users who are normally externally authenticated can log in locally (the
/LOCAL_PASSWORD qualifier need not be specified).
For more information about the /LOCAL_PASSWORD qualifier for the login
command line, refer to the OpenVMS Guide to System Security.

3–22 Managing Users and Groups

Managing Users and Groups
3.1 Managing Network User Accounts
3.1.17.4 Logging On to Externally Authenticated Accounts
OpenVMS accepts the user name in one of the following formats for user
accounts set for external authentication:
•

ASusername (network user name)

•

Domainname\ASusername

•

ASusername@Domainname

The form of the user name string determines the order in which OpenVMS
verifies the logon:
•

If ASusername is used, this name is first interpreted as an OpenVMS
user name. If the user name exists (in the OpenVMS System User
Authorization File (SYSUAF)), and that user is not set for external
authentication, the authentication is done as a standard OpenVMS login.
Advanced Server authentication does not take place.
If the user name does not exist in SYSUAF, the Advanced Server checks
the domain accounts database (SAM) for the name and looks for an explicit
host mapping to find the ASusername user’s OpenVMS account. The server
then verifies that the OpenVMS account is set for external authentication.

•

If the domain name is included in the user name, OpenVMS activates
external authentication of the user, using the name of the domain
supplied:
If the domain name is the same as that of the local server, the local
server will proceed to authenticate this request.
If the domain name is different from that of the local server, the
software first checks whether the user name is mapped to the domain
name explicitly. If so, the authentication request is forwarded to the
specified domain for authentication. (For more information about host
mapping, see Section 3.1.16.1, Implicit and Explicit Host Mapping.)
If the user name is not mapped to the domain name explicitly, the
local server software checks the server configuration parameter
HostMapDomains in the OpenVMS Registry to verify whether the
specified domain is in the list of those trusted domains that the server
allows to externally authenticate Advanced Server users. If the domain
is listed there, the authentication request is forwarded to the specified
domain for authentication. If the domain is not listed there, the logon
request is denied.

Managing Users and Groups 3–23

Managing Users and Groups
3.1 Managing Network User Accounts
3.1.17.5 Avoiding User Name Conflicts
Because external authentication depends on host mapping information, it is
important to set up user accounts and host mapping carefully. For example, if
the same user name exists in the Advanced Server and OpenVMS, but they are
not the same user, external authentication may not work as you expect.
In the following examples, you have Advanced Server running on OpenVMS
node VMS1 in the domain SaleOffice, with network users Smith and J_Smith
and OpenVMS users Smith and V_Smith:
•

You enable external authentication for both of the OpenVMS users and
then specify the user host mapping as follows:
$ ADMINISTER ADD HOSTMAP SMITH V_SMITH
$ ADMINISTER ADD HOSTMAP J_SMITH SMITH
When OpenVMS user Smith uses his network user name J_Smith and
password to log on to VMS1, this logon will be successful, providing the
password is correct.
However, when OpenVMS user V_Smith uses her network user name
Smith and password to log on to VMS1, this logon will fail because of the
name space conflict between Advanced Server and OpenVMS.
To log on, OpenVMS user V_Smith must specify her network user name,
specifying the domain name (either Smith@SaleOffice or SaleOffice\Smith).

•

You enable external authentication only for OpenVMS user V_Smith,
specifying the following command:
$ ADMINISTER ADD HOSTMAP SMITH V_SMITH
When OpenVMS user V_Smith uses her network user name Smith to log
on to VMS1, the logon will fail, because Smith will first be interpreted as
an OpenVMS user name. Because the OpenVMS user name exists, and it
is not enabled for external authentication, the OpenVMS authentication
mechanism is used to verify the password.
To log on, the OpenVMS user V_Smith must specify the domain name with
her network user name (either Smith@SaleOffice or SaleOffice\Smith).

3–24 Managing Users and Groups

Managing Users and Groups
3.1 Managing Network User Accounts
3.1.17.6 Setting Up External Authentication by a Trusted Domain
You can set up an OpenVMS account to be externally authenticated by a
trusted domain in your network. To enable this feature, you must include the
trusted domain name in the data field for the server configuration parameter
HostMapDomains in the OpenVMS Registry. See Section 7.2, Managing
Server Configuration Parameters Stored in the OpenVMS Registry.
For example, if your OpenVMS system is in the SaleOffice domain, and this
domain trusts the Marketing domain, set up OpenVMS user Jones to be
externally authenticated by the Marketing domain as follows:
1. Set the data field for the server configuration parameter HostMapDomains
to include the trusted domain name, as follows:
$ REGUTL :== $SYS$SYSTEM:PWRK$REGUTL
$ REGUTL SET PARAM/CREATE VMSSERVER HOSTMAPDOMAINS Marketing
2. Ensure that a network user account with user name Jones exists in the
Marketing Domain.
3. Enable external authentication for OpenVMS user account Jones.
4. To log on, the user must specify the user name in one of the following
forms:
Jones@Marketing
Marketing\Jones
3.1.17.7 Changing the Default Domain for External Authentication
The local server’s domain is the default domain for users when external
authentication is established. If you want to change the default domain
for users using external authentication, define the Advanced Server logical
PWRK$ACME_DEFAULT_DOMAIN on the system as follows:
$ DEFINE/SYS/EXE PWRK$ACME_DEFAULT_DOMAIN domain_name
where domain_name is the name of the new default domain. After defining
this logical, if a user does not specify a domain name at login, the system will
use the specified default domain for external authentication.
3.1.17.8 Requirement for External Authentication Over DECnet-Plus
To allow users to be externally authenticated over DECnet-Plus for OpenVMS,
set the system parameter NET_CALLOUTS to 255. This enables Advanced
Server user ID mapping and authentication for network logins.

Managing Users and Groups 3–25

Managing Users and Groups
3.2 Managing Advanced Server Groups

3.2 Managing Advanced Server Groups
Groups are collections of user accounts and other groups. When you add a user
to a group, the user has all the rights and permissions granted to the group.
This provides an easy way to grant common capabilities to sets of users. (For
additional information about planning Advanced Server groups, refer to the
Compaq Advanced Server for OpenVMS Concepts and Planning Guide.)
Note
OpenVMS system groups are unrelated to Advanced Server domain
groups.

You use groups to manage access to resources like directories, files, and
printers. To do this, assign permissions to the resource, specifying the group
names, and add the user accounts to the groups. To change the permissions
for a group, add or remove the permissions on the resource for the group,
rather than for each user. Or, if you need to give a user access to specific
resources (for example, certain directories and files), add the user’s account to
the appropriate group rather than changing permissions on each individual
resource. Maintaining permissions for a group is simpler than maintaining
permissions for individual user accounts.
Every group is either a global group or a local group.
•

Global groups can be used both in their own domain and in trusting
domains. You can use global groups to grant rights and permissions to
global users. By default, new groups are global groups. Global groups can
be members of a local group.

•

Local groups can be granted permissions and rights only for the servers in
their domain. However, they can contain user accounts and global groups
both from their domain and from trusted domains. Local groups let you
create sets of users from both inside and outside the domain, to access
resources in the domain where the local group is created. The use of local
groups in permissions lists for files and shares can also help reduce disk
space consumption, as noted in Section 4.1.3.6, Streamlining Security
Information Storage and Lookups.

3–26 Managing Users and Groups

Managing Users and Groups
3.2 Managing Advanced Server Groups
Table 3–2 summarizes how to organize local and global groups.
Table 3–2 Uses of Local and Global Groups
If . . .

Need to access a resource on . . .

You put them in a . . .

User accounts from this
domain

The servers and workstations of this
domain or of trusting domains

Global group

User accounts from trusting
domains

The servers of this domain

Local group

Global groups from this
domain

The servers of this domain

Local group

Global groups from trusting
domains

The servers of this domain

Local group

3.2.1 Built-In Groups
The Advanced Server creates several built-in groups automatically during
installation. Each built-in group has a unique set of access rights. To give one
such set of access rights to a user account, add the user to the appropriate
group. By default, all users belong to the built-in group Domain Users.
Table 3–3 lists the built-in groups, with their group type (global or local), and
their default members.
Table 3–3 Built-In Groups
Group Name

Group
Type

Default
Members

Account Operators

Local

Members can administer domain
user and group accounts.

None

Administrators

Local

Members can fully administer
the domain.

Administrator,
Domain
Admins

Backup Operators

Local

Members can bypass file security
to back up files.

None

Domain Admins

Global

Designated administrators of the
domain.

Administrator

Domain Guests

Global

All domain guests.

Guests

Description

(continued on next page)

Managing Users and Groups 3–27

Managing Users and Groups
3.2 Managing Advanced Server Groups
Table 3–3 (Cont.) Built-In Groups
Group Name

Group
Type

Description

Default
Members

Domain Users

Global

All domain users.

Administrator,
user
accounts

Guests

Local

Users granted guest access to
the domain.

Domain
Guests

Print Operators

Local

Members can administer domain
printers.

None

Server Operators

Local

Members can administer domain
servers.

None

Users

Local

Ordinary users.

Domain
Users

3.2.2 Setting Up User Groups
To set up a new user group, use the ADD GROUP command. To create a local
group, include the /LOCAL qualifier on the command line. For example, to add
the local group MUNCHKINS, enter the following command. Note that the
description of the group is enclosed in quotation marks. If you do not specify
the group type, the default is to add the group as a global group.

3–28 Managing Users and Groups

Managing Users and Groups
3.2 Managing Advanced Server Groups
LANDOFOZ\\TINMAN> ADD GROUP MUNCHKINS/DESCRIPTION="Oz local group"/LOCAL
%PWRK-S-GROUPADD, group "MUNCHKINS" added to domain "LANDOFOZ"
LANDOFOZ\\TINMAN> SHOW GROUPS
Groups in domain "LANDOFOZ":
Group Name
Type
--------------------- ----------Account Operators
Local
Administrators
Backup Operators

Local
Local

DEVAS
DEVIS
Domain Admins
Domain Guests
Domain Users
Guests
MONKEYS
MUNCHKINS
Print Operators
Replicator
Server Operators
Users

Global
Global
Global
Global
Global
Local
Global
Local
Local
Local
Local
Local

Description
------------------------------------Members can administer domain user and
group accounts
Members can fully administer the domain
Members can bypass file security to back
up files
Designated administrators of the domain
All domain guests
All domain users
Users granted guest access to the domain
Users in the Land of Oz
Oz local group
Members can administer domain printers
Supports file replication in a domain
Members can administer domain servers
Ordinary users

Total of 15 groups
LANDOFOZ\\TINMAN>

3.2.3 Adding Users to Groups
You can add users to groups in any of the following ways:
•

When you use the ADD GROUP command, include the /MEMBERS
qualifier.

•

When you add a new user (using the ADD USER command), include the
/MEMBER_OF_GROUPS qualifier. (See Section 3.1.6, Specifying Group
Membership, for more information.)

Local groups can include users from domains other than the one currently
being administered. To specify a user account from another domain, a trust
relationship must be established that allows the domain being administered to
trust the domain where the user account is defined.
To specify a user account or global group in a trusted domain, enter a domainqualified name (domain-name\member-name), such as KANSAS\DOLE, where
KANSAS is the name of the trusted domain, and DOLE is the user or group
name defined in the trusted domain. If you omit a domain name, the user or
group is assumed to be defined in the domain being administered.

Managing Users and Groups 3–29

Managing Users and Groups
3.2 Managing Advanced Server Groups
3.2.3.1 Adding Members to a New Group
To add members to a new group, include the /MEMBERS qualifier on the
ADD GROUP command. For example, to add a new group MUNCHKINS
and specify the group members SCARECROW and STRAWMAN, enter the
following command:
LANDOFOZ\\TINMAN> ADD GROUP MUNCHKINS/MEMBERS=(SCARECROW,STRAWMAN)
%PWRK-S-GROUPADD, group "MUNCHKINS" added to domain "LANDOFOZ"
LANDOFOZ\\TINMAN>

3.2.4 Copying Groups
To simplify creating a new group, you can use the COPY GROUP command
to copy an existing group to the new group, with a new name, keeping the
members and description from the previous group. For example, to form a new
group called QUADLINGS from an existing group called MUNCHKINS, use
the following command:
LANDOFOZ\\TINMAN> COPY GROUP MUNCHKINS QUADLINGS
%PWRK-S-GROUPCOPY, group "MUNCHKINS" copied to "QUADLINGS" in domain "LANDOFOZ"
LANDOFOZ\\TINMAN>
This command copies the description and group members from MUNCHKINS
to the new group named QUADLINGS. You can display information about
the new group using the SHOW GROUPS/FULL command. For example,
the following command displays the type, description, and members of the
QUADLINGS group.
LANDOFOZ\\TINMAN> SHOW GROUPS QUADLINGS/FULL
Groups in domain "LANDOFOZ":
Group Name
Type
Description
------------------------------------------QUADLINGS
Local
Oz local group
Members: [US]LION,[US]SCARECROW
Total of 1 group
LANDOFOZ\\TINMAN>

3.2.5 Modifying a Group
You can change the membership or description of an existing group.

3–30 Managing Users and Groups

Managing Users and Groups
3.2 Managing Advanced Server Groups
3.2.5.1 Adding a Member to an Existing Group
To add a member to an existing group, use the MODIFY GROUP command
with the /ADD_MEMBERS qualifier. For example, to add the user LION to the
group MONKEYS, enter the following command:
LANDOFOZ\\TINMAN> MODIFY GROUP MONKEYS/ADD_MEMBERS=LION
%PWRK-S-GROUPMOD, group "MONKEYS" modified on domain "LANDOFOZ"
LANDOFOZ\\TINMAN> SHOW GROUP MONKEYS
Groups in domain "LANDOFOZ":
Group Name
Full Name
-----------------MONKEYS
Members: [US]LION

Type
Description
------- -----------------------Global Winged monkeys

Total of 1 group)
LANDOFOZ\\TINMAN>
3.2.5.2 Removing a Member From a Group
To remove a member from a group, use the MODIFY GROUP command with
the /REMOVE_MEMBERS qualifier. For example, to remove SCARECROW
from the group MUNCHKINS, enter the following command:
LANDOFOZ\\TINMAN> MODIFY GROUP MUNCHKINS/REMOVE_MEMBERS=SCARECROW
%PWRK-S-GROUPMOD, group "MUNCHKINS" modified on domain "LANDOFOZ"
LANDOFOZ\\TINMAN>
3.2.5.3 Changing the Description of a Group
To change the group description, use the MODIFY GROUP/DESCRIPTION
command, as in the following example:
LANDOFOZ\\TINMAN> MODIFY GROUP MUNCHKINS/DESCRIPTION="First Floor"
%PWRK-S-GROUPMOD, group "MUNCHKINS" modified on domain "LANDOFOZ"

3.2.6 Deleting a Group
Deleting a group removes only that group; it does not delete user accounts or
global groups that are members of the deleted group. You cannot recover a
deleted group.
Internally, the Advanced Server recognizes every group by its security identifier
(SID), which is used when assigning permissions to a resource. If you delete
a group and then create another group with the same group name, the new
group does not inherit access to any resources available to the old group
because the groups have different SIDs. To delete a group, use the REMOVE
GROUP command, as in the following example:

Managing Users and Groups 3–31

Managing Users and Groups
3.2 Managing Advanced Server Groups
LANDOFOZ\\TINMAN> REMOVE GROUP QUADLINGS
Each group is represented by a unique identifier which is independent
of the group name. Once this group is deleted, even creating an
identically named group in the future will not restore access to
resources which currently name this group in the access control list.
Remove "QUADLINGS" [YES or NO] (YES) : YES
%PWRK-S-GROUPREM, group "QUADLINGS" removed from domain "LANDOFOZ"
LANDOFOZ\\TINMAN>
The command deletes the group QUADLINGS from the LANDOFOZ domain.

3–32 Managing Users and Groups

4
Managing Directory and File Sharing
You use the ADMINISTER command-line interface to set up files and
directories for sharing. To do this, you need to become familiar with the
concepts and procedures described in this chapter:
•

Section 4.1, Planning Directory and File Sharing, describes how to plan the
sharing of directories and files for your users and the access permissions
you can set.

•

Section 4.2, Administrative Shares, describes the disk administrative
resources.

•

Section 4.3, Managing Shared Directories and Files, describes how to
secure directories and files, share a directory on the OpenVMS system,
audit directory and file access, and take ownership of directories and files.
It also describes how to manage Advanced Server shares from Windows NT
Server computers.

•

Section 4.4, Unicode and Extended Character Sets, describes how the
Advanced Server can support extended character sets (including certain
Unicode characters). The supported extended characters can be used in file
and share names, and other objects manageable by the Advanced Server.

•

Section 4.5, Using ODS-5 Disk Volumes in the Advanced Server
Environment, describes how to manage and use shares stored on ODS-5
disk volumes.

•

Section 4.6, File Names for Files Stored on the Advanced Server, describes
the conventions for Advanced Server file names and how they are stored on
the server.

Managing Directory and File Sharing 4–1

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing

4.1 Planning Directory and File Sharing
To serve your users most effectively, you should plan carefully for sharing files
and directories. Some projects will require directory sharing, and some groups
may need to share only certain files. Use the Shares Worksheet in the Compaq
Advanced Server for OpenVMS Concepts and Planning Guide to help you set
up your shares.
Sharing a directory makes the directory and the files located in it available to
other network users. The Advanced Server integrates two levels of permissions
for shared files and directories: share permissions, and file and directory access
permissions.
•

Share permissions specify the maximum access possible for a user or group
on all files and directories residing on that share. For example, setting
share permissions to Read for the group Everyone would allow all users
to read a file, and prevent any user from altering the contents of the file.
You set share permissions using the ADD SHARE and MODIFY SHARE
commands. If you do not specify share permissions when you add the
share, the default is to allow all users to access the share.

•

File and directory access permissions specify the access that a group or user
is granted to a particular directory or file in a shared directory. You set
file and directory access permissions with the SET FILE/PERMISSIONS
command, as described in Section 4.3.6, Specifying File and Directory
Access Permissions.
Note
When you copy files or directories, security permissions set on them
are discarded in addition to ownership and auditing information. The
files inherit a new set of permissions from the directory into which they
have been copied. If the new directory does not specify permissions
for files, only the file’s owner (the person who copied the file) will have
permission to use the file.

In addition to the two levels of permissions supported by the Advanced Server,
the OpenVMS file system imposes a set of protections, which are used if the
Advanced Server and OpenVMS security model is enabled. These must be
considered when managing shared directories. (For more information, see
Section 4.1.2, Advanced Server Security Models.) Shared directories must have
the appropriate OpenVMS system protections applied to them if interactive
OpenVMS users and other OpenVMS processes need access to them.

4–2 Managing Directory and File Sharing

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing

4.1.1 Disk Resources
Advanced Server for OpenVMS supports the following OpenVMS file systems:
•

ODS-2, the traditional OpenVMS file system, which is based on the Files-11
disk structure

•

ODS-5, the optional extended file system provided by OpenVMS Version
7.2 and higher, which provides Extended File Specifications and deep
directories

For more information about Extended File Specifications, refer to the
OpenVMS Guide to Extended File Specifications. For details about managing
disk resources on ODS-5 disk volumes, see Section 4.5, Using ODS-5 Disk
Volumes in the Advanced Server Environment.
Disk resources include the disk devices on a server, the directories on those
devices, and the files in the directories. With Advanced Server you can create a
share for a directory, including the root directory for a disk, and specify access
permissions for the share. Access permissions define the network users or
groups permitted to access the share, and the kinds of operations that each
may perform.
You cannot create a share for a file. Users access files through the directory
share where the files reside. However, you can set access permissions on
shares, directories, and files.
By configuring the server security model, you can enhance access permissions
using OpenVMS file protection mechanisms.

4.1.2 Advanced Server Security Models
All Advanced Server users have either a network user account or access to the
Guest account. The type of access allowed to each user account is determined
by the access permissions set on the resource. Each network user account may
be mapped to an OpenVMS user account. This mapping enables the Advanced
Server to integrate network security with OpenVMS file access security.
You can define the level of integration by setting the server configuration
parameter that specifies one of the following security models:
•

Advanced Server Only (default)
Only network security is enforced; OpenVMS access checks are bypassed.
Advanced Server Only is the default security model when you install
the server software. Unless you change the default parameter setting
for the security model, Advanced Server Only security is established on
your server. Advanced Server Only security is sufficient for most network
environments.

Managing Directory and File Sharing 4–3

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing
•

Advanced Server and OpenVMS
Both network security and OpenVMS security are enforced. If the user’s
access request passes the Advanced Server security check, Advanced Server
checks the OpenVMS security set on the requested resource, determined
by the OpenVMS user account to which the network user account is
mapped. Access is granted when the user passes both security checks. For
information on how network user accounts are mapped to OpenVMS user
accounts, see Section 3.1.16.2, Establishing User Account Host Mapping.
The Advanced Server and OpenVMS security model is best suited for
environments that require the additional control provided by the OpenVMS
operating system. For example, this model would benefit systems with
legacy OpenVMS data already protected by the elaborate OpenVMS
security settings. Rather than having to establish the same security
settings at the server level, you could simply give Everyone full control
and let OpenVMS security settings determine access. Note that use of
the Advanced Server and OpenVMS security model results in the extra
overhead of validating both the Advanced Server and OpenVMS settings.

You can change the security model configuration parameter setting, using
the Configuration Manager as described in Chapter 7, Managing Server
Configuration Parameters.
The following sections describe the security models in more detail. Each
security model provides the security checks shown in Table 4–1, Security
Checks.
Table 4–1 Security Checks

For this security model:

The server checks Advanced
Server permissions:

And checks
OpenVMS
protections:

Advanced Server Only

Yes

Advanced Server and OpenVMS

Yes

4.1.2.1 Advanced Server Only Security Model
Whether the Advanced Server grants or denies a file access request depends on
three factors:
•

The security model in effect on the server

•

Permissions established for the group of which the user is a member

•

Permissions established for the user

4–4 Managing Directory and File Sharing

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing
To effectively implement the Advanced Server Only security model, keep the
following in mind:
•

Network users cannot use a directory or file unless they have been granted
permission to do so or belong to a group that has permission to do so.

•

Share permissions are cumulative, except that the No Access permission
overrides all other permissions. For example, the MUNCHKINS group
has Write permission for a file and the WINKIES group has only Read
permission. User SCARECROW is a member of both groups; therefore,
SCARECROW is granted Read and Write permission.
If you change the WINKIES group’s permission for the file to No Access,
SCARECROW cannot use the file even though he is a member of the
MUNCHKINS group, which still has access to it.

•

The user who creates a file or directory is the owner of that file or directory.
The owner can always control access to the file or directory by changing the
permissions set on it. Network administrators can always take ownership
of a file or directory.
For files and directories that existed on an OpenVMS device before the
share was created, the owner of the file or directory is set to be the user
who created the share.

•

The easiest way to administer security is by setting permissions for groups,
not individual users. Typically, a user needs access to many files. If the
user is a member of a group that has access to the files, you can end the
user’s access by removing the user from the group rather than changing
the permissions on each of the files.

4.1.2.1.1 Windows NT Security Descriptors As enforced by the Advanced
Server Only security model, network security uses Windows NT security
descriptors for each shared directory and file.
A Windows NT security descriptor contains information such as the Windows
NT owner of the file and a list of Windows NT users and groups with their
respective access levels for that file.
These descriptors are stored in OpenVMS application access control entries
(ACEs) that are included in the OpenVMS access control lists (ACLs)
associated with the file.

Managing Directory and File Sharing 4–5

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing
4.1.2.2 Advanced Server and OpenVMS Security Model
In this security model, OpenVMS security is enforced in addition to the
Advanced Server security model. The OpenVMS security is based on the
OpenVMS user account to which the network user is mapped.
An OpenVMS account identifies a user to the OpenVMS operating system.
The account includes the user’s name, a password, privileges, and access to
directories and files associated with the account. Network user accounts are
associated with OpenVMS user accounts by means of host mapping. For more
information on host mapping, see Section 3.1.16, User Account Host Mapping.
OpenVMS stores a security profile for each directory or file. The security
profile contains the following types of information:
•

User identification code (UIC) of the owner of the object (file, directory, or
device). The system uses this element to help interpret the RMS protection
code.

•

Protection code defining access to objects (files, directories, or devices)
based on categories of system, owner, group, and world. This protection
code controls broad categories of users.

•

The access control list (ACL) identifying the users and groups allowed or
denied access to the file or directory. The ACL contains an entry for each
user and group. These entries are called access control entries (ACEs).

In short, the OpenVMS operating system provides two methods of assigning
protection to files and directories:
•

RMS protections (see Section 4.1.2.2.1, RMS Protections)

•

Access control lists (ACLs) (see Section 4.1.2.2.2, Access Control Lists
(ACLs))

4.1.2.2.1 RMS Protections RMS sets protection on files and directories based
on user identification codes (UICs). A UIC consists of a group code and a user
code assigned to every OpenVMS user by the system administrator. The user’s
UIC determines which categories a user belongs to. Table 4–2, OpenVMS
Group Codes, lists and describes the group codes.

4–6 Managing Directory and File Sharing

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing
Table 4–2 OpenVMS Group Codes
UIC Category

Includes

System (S)

Users with SYSTEM privileges (the OpenVMS privilege SYSPRV) or
users with low group numbers in their UICs, as determined by the
system administrator.

Owner (O)

The user who is the owner of a file or directory. The user code of the
UIC associated with the file or directory matches the user code of
the UIC of a user.

Group (G)

All users who have the same group code in their UICs.

World (W)

All users regardless of UIC.

RMS assigns file protections for each of these categories according to the
following format:
•

R for read-only access

•

W for write access

•

E for execute access

•

D for delete access

The default protections are: System: RWED, Owner: RWED, Group: no
access, World: no access. This RMS protection allows read, write, execute, and
delete access to the system and to the owner of the file, but users in the same
group and other users have no access to the file.
4.1.2.2.2 Access Control Lists (ACLs) An access control entry (ACE) is an
entry in an access control list (ACL) that controls access to files and directories
by resource identifiers. ACLs give you more control than RMS protections. For
example, with RMS, the only way to grant READ access to users in different
UIC groups is to grant World Read (W:R) access. In contrast, with ACLs, you
can provide users from several UIC groups with access to a file or directory
without granting World access, and you can deny specific users access to
specific files.
If you use both RMS protections and ACLs, OpenVMS checks ACEs in the
ACLs before it checks the RMS protections. For more information on RMS
protections and ACLs, refer to the OpenVMS System Manager’s Manual.

Managing Directory and File Sharing 4–7

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing

4.1.3 The Advanced Server and Windows NT Security Information
The Advanced Server supports both OpenVMS and network security, and
ownership information. It achieves this by storing Windows NT security
descriptors for directories and files on OpenVMS disk devices. (For more
information on Windows NT security descriptors, see Section 4.1.2.1.1,
Windows NT Security Descriptors.
The following sections explain how the Advanced Server handles file security
information and describes utilities you can use to manipulate this information.
4.1.3.1 Inheritance of Directory Permissions
Each Windows NT directory has two sets of permissions: (A) directory-specific
security permissions that provide access control to the directory itself and (B)
inheritable permissions that will be inherited automatically by any file created
in that directory, becoming the default access permissions for that new file.
The Advanced Server is designed to conform with Windows NT security
behavior. When you create a file in a shared directory, the parent directory’s
inheritable permissions (B) are propagated to that file to become the file’s
access permissions. When you create a subdirectory, both the parent directory’s
access control permissions (A) and inheritable permissions (B) propagate to
the subdirectory becoming the subdirectory’s access control (A) and inheritable
permissions (B), respectively.
4.1.3.2 Inheritance of Ownership
In conformance with Windows NT security behavior, Advanced Server security
is designed to assign ownership of a file or directory to the user who creates
the file or directory. The owner can always control access to the file or directory
by changing the permissions set on it.
4.1.3.3 ACEs and OpenVMS Volume Index Files
Every OpenVMS file has a file header block stored in the volume index file,
INDEXF.SYS. Each file header is limited to 512 bytes. The ACL for a file is
stored in the file’s header. When a file contains several ACEs, it may exceed
the 512-byte limit, and a secondary file header (known as an extension file
header) is allocated.
When a file has a large number of ‘‘PATHWORKS’’ ACEs (displayed as
PATHWORKS ACES, these are ACEs created by Advanced Server or
PATHWORKS servers; see Section 4.1.3.8, Displaying Advanced Server for
OpenVMS and PATHWORKS ACEs), the secondary headers required to store
the ACEs will consume additional space in the index file. As the index file
extends to provide more headers, the space available for other files is reduced,
and the index file itself becomes fragmented. In addition, there is a limit to

4–8 Managing Directory and File Sharing

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing
the number of times the index file can be extended. Its header can become full
from mapping its own multiple extensions.
You can reduce the number of ACEs by using local groups in permissions
lists for files and directories, rather than by adding individual users or global
groups. Ideally, each file and directory permissions list should reflect only local
groups, and no two entries in a permissions list should duplicate the same
permissions. The Advanced Server for OpenVMS can help reduce the number
and size of the ACEs created, and thereby reduce the consumption of index
header blocks used for secondary headers.
For example, the file server parameter Store_Security_Aces allows you to
control the amount of Windows NT security information stored with the file at
file creation. By default (parameter value equals YES), the file server writes a
complete set of Windows NT security information to a new file. By changing
the value of the Store_Security_Aces parameter to NO, only the ownership
information is represented in the file’s ACL, excluding all the file access
permission ACEs. For more information on this parameter, see Section 4.1.3.6,
Streamlining Security Information Storage and Lookups. This can make more
efficient use of disk space.
Note that there are tradeoffs for using the Store_Security_Aces=NO setting.
For example, while conserving disk space, additional run-time is required
to determine access permissions for files that do not have explicit access
permissions associated with them. Section 4.1.3.6, Streamlining Security
Information Storage and Lookups, discusses the tradeoffs in more detail,
and explains how to recover from over consumption of disk space caused by
oversized file security descriptors (excessive ACEs on a file) or inappropriate
propagation of ACEs to files.
4.1.3.4 How the File Server Reads Windows NT Security Information on Files
When a client accesses a shared file whose ACL contains the complete Windows
NT security descriptor information (that is, owner, group, discretionary access
control lists (DACLs) and system access control lists (SACLs)), then the
Advanced Server uses that information to determine the access rights to
the file.
If the file lacks any or all of the required Windows NT security descriptor
information, the file server builds a complete security descriptor for the
file, getting the required security descriptor information from the directory
hierarchy above the file. (A file lacks all Windows NT security information if
it was not created by an Advanced Server for OpenVMS or by a PATHWORKS
Advanced Server; an example is a file that was created on an OpenVMS system
before the directory became shared.)

Managing Directory and File Sharing 4–9

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing
If, for example, a file has owner information but no group, DACL, and SACL
information, the server looks up the directory structure, level by level, as far
as the device root, but a maximum of up to 15 levels, until it finds enough
information to build a complete Windows NT security descriptor for that file.
If nothing is found in the search all the way to the root, the server creates a
default descriptor for the file in which Everyone has full access control.
The file server might not find all the required file security information at the
same directory level. In some cases, it might extract the information from
several different directory levels.
For example, given a file with no security information available, the server
might find the owner information in the file’s parent directory, but then have to
search up one or more additional directory levels to find the other information.
When the file server finds a directory that has the Windows NT security
descriptor information it is seeking, it inserts the needed information in the
file’s security descriptor. The owner of the file was already determined from
the file’s parent directory: the file server does not use the higher directory’s
ownership for the file’s security descriptor.
In summary, the file server must determine the access rights for a file in these
circumstances:
•

If the complete Windows NT security descriptor is explicitly stored in a
file’s ACL, the file server uses this information to determine a user’s access
rights (without needing to look up the directory structure to determine
additional Information).

•

If the file has no security information, the file server looks up the directory
structure for the information required to build the file’s Windows NT
security descriptor. If no security information is found in the directory
hierarchy (from that file’s parent directory up to the device root), the server
creates a default security descriptor for the file, giving Everyone access to
the file.

•

If the file has some but not all of the security information in its security
descriptor, the file server looks up the directory structure for the missing
information.

•

When searching up the directory structure for the needed information, the
file server might either:
–

Find all the information at the parent directory level, or if none is
available there, all at a higher directory level

–

Find part of the information at one level, and pull the rest of the
missing information from one or more levels above that level

4–10 Managing Directory and File Sharing

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing
–

Not find the information at all (searching in vain up to the device root
level)

4.1.3.5 How the Advanced Server File Server Builds File Security Descriptor
Information
One subtle difference exists in how and when the Advanced Server and
Windows NT build security information for a file. By default, both the
Advanced Server and Windows NT are designed to write complete security
information for a file when the file is created, propagating it from the parent
directory as necessary. However, the Advanced Server file server allows
you to change this default behavior to make more efficient use of security
information and disk space. For more information, see the discussion of the
Store_Security_Aces parameter in Section 4.1.3.6, Streamlining Security
Information Storage and Lookups.
As a result of making this change, when a file is created in a shared directory,
only the owner information is stored with the new file. When a user attempts
to access the file, the server uses security information from the parent directory
structure to dynamically build a Windows NT security descriptor for the file.
The file server does not modify the file or the security information stored with
the file in any way.
After the file server has used the dynamically built Windows NT security
descriptor to determine whether the user has permission to access the file, the
dynamically built Windows NT security descriptor is discarded. The next time
a client attempts to access the file, the file server again dynamically builds a
Windows NT security descriptor to determine the access permission for the file.
A significant consequence of this behavior, which is unique to the Advanced
Server file server, is that the file security information for a file (whose security
descriptor is built dynamically) can change when the security information in
the directory structure above it changes. For example, assume a directory
named ACCOUNT is owned by user JOHNSON and has full access for
Everyone. User CARTER creates file CABINET in that directory. On a
Windows NT system, the new file’s security descriptor will include:
•

CARTER as owner (creator gets ownership)

•

Full access for Everyone (permissions inherited from the parent directory,
ACCOUNT)

By default, the same would be true on an Advanced Server share. But, if the
Store_Security_Aces parameter is changed from the default YES to NO, the
security descriptor for file CABINET sets CARTER as the owner but does not
store any access rights information. Nevertheless, when a client attempts to
access the file CABINET, the file server dynamically determines that access to

Managing Directory and File Sharing 4–11

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing
file CABINET is full access for Everyone (determining the access permissions
from the parent directory, ACCOUNT).
If the access permissions for the ACCOUNT directory are changed to read
access for Everyone, then on a Windows NT system, and by default, on an
Advanced Server share, the access for file CABINET remains full access for
Everyone (as originally inherited from the parent directory when CABINET
was created). But, if the value of the Advanced Server Store_Security_Aces
parameter is NO, the access for the shared file CABINET would be READ
access for Everyone: the access permissions were not stored with CABINET
at file creation, so the server builds the file’s security descriptor dynamically,
determining the file’s access permissions from the parent directory, ACCOUNT.
4.1.3.6 Streamlining Security Information Storage and Lookups
As noted previously, the default propagation of security information to new
files in shared directories can require that secondary headers be allocated for
these files to store the security ACEs. Over time, this excessive consumption
of file headers can cause excessive growth of the volume’s index file, reducing
the disk space available for creating new files. Techniques for minimizing file
header usage are described later on in this section.
If disk space is not a problem, multiple extensions of the index file can still
fragment the file across the volume, making access to the file headers less
efficient, and eventually making further extension of the index file impossible.
The solution is to make the index file contiguous, and make it large enough to
help eliminate the need for further extensions in the future. However, be sure
not to make the index file too large, or else space will be wasted.
You can make the volume and all of its files (including the index file)
contiguous by performing a simple backup and restore of the volume. In
addition, before doing the restore, you can initialize the volume with a larger
index file, if appropriate. However, there is currently no easy way to determine
how much the index file has grown, how many times it has grown (how
fragmented it has become), or how many free headers it currently contains.
For details on making the index file contiguous and estimating an appropriate
size for the index file, see Section 4.1.3.6.1, Managing the Index File on a
Volume with Shared Files.
If consumption of disk space is a problem, you can change the Store_
Security_Aces OpenVMS Registry parameter to NO. The default value
(YES) causes the file server to write a complete set of Windows NT security
information to a new file’s ACL. By changing the parameter value to NO, you
limit the amount of security information stored with the new file: only the
ownership information is represented in the file’s ACL, and all the file access
permission ACEs are excluded. Use PWRK$REGUTL to modify the value of

4–12 Managing Directory and File Sharing

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing
the Advanced Server OpenVMS registry server parameter. This parameter is
stored in the registry key:
SYSTEM\CurrentControlSet\Services\AdvancedServer\FileServiceParameters
Note the tradeoffs between using the default (YES) or changing the parameter
to NO, described in Table 4–3. In short, setting the parameter to NO saves
file header usage but might result in increased file access times. Because the
security information is not propagated to the files in a directory, the file server
must look up the directory tree to determine missing information.
Table 4–3 Tradeoffs Regarding the STORE_SECURITY_ACES Parameter
Settings

If using the default (store all
security information)

If setting to NO
(store owner
information
only)

Server Behaves as Windows NT
does?

Yes

Performance

Faster

Slower

File Header Usage

Higher

Lower

How Security Settings Are
Determined

Direct from files

Dynamically,
using the file’s
directory tree

If security problems arise because of inappropriate ACEs on files, or if you
want to minimize consumption of disk space by index blocks required for storage of ACEs, use the Advanced Server utility SYS$SYSTEM:PWRK$FIXACE.EXE.
This utility optimizes disk storage by compressing ACEs, removing
unnecessary ACEs, and preventing ACEs from being propagated to files created
in shares.
Invoke this utility as follows:
$ MCR PWRK$FIXACE
In addition, you can clean up unwanted ACEs by using the PWRK$DELETEACE
utility, as documented in Section 4.1.3.7, Removing PATHWORKS ACEs. This
utility will help you reclaim disk space.

Managing Directory and File Sharing 4–13

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing
4.1.3.6.1 Managing the Index File on a Volume with Shared Files This
section provides examples of the image backup and restore operations that
make the index file (and all other files) on a volume contiguous.
To make the index file on a volume contiguous, follow these steps. For details,
refer to the OpenVMS System Manager’s Manual.
1. Perform an image backup of the volume, using the OpenVMS DCL
BACKUP/IMAGE command.
2. If a larger index file is indicated, manually reinitialize the volume, using
the /HEADERS qualifier to specify an appropriate value for the number
of headers to allocate. For more information on how to determine the
appropriate value, see Section 4.1.3.6.2, Determining the Number of Index
File Headers to Allocate.
$ INITIALIZE/HEADERS=n disk_volume:
3. Restore the backup using the OpenVMS DCL BACKUP/IMAGE command.
If the disk was manually initialized in step 2, then the /NOINITIALIZE
qualifier is also necessary to preserve the new index file size.
4.1.3.6.2 Determining the Number of Index File Headers to Allocate This
section explains how to determine whether a larger index file is indicated,
and if so, how many file headers to specify with the INITIALIZE/HEADERS
command. As stated previously, there is no easy way to determine how much
the index file has grown, how fragmented it has become, or how many free
headers it currently contains.
You can estimate whether the index file should be made larger by monitoring
the size of the index file and the total count of all shared files on the volume.
Suppose you observe that an index file is growing rapidly, most likely because
of an increase in the number of shared files on the volume. If you can estimate
how much the number of shared files might grow in the future, you can
calculate how much larger the index file might become as well. From this
value, you can approximate the total number of headers to specify.
If you suspect that the index file is fragmented, but have no data to support
any estimates, you may still perform the image backup and restore without
changing the index file size, and then start monitoring the volume as described
above.
For example, assume earlier monitoring revealed these results:

4–14 Managing Directory and File Sharing

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing
$ DIRECTORY/SIZE DKB0:[000000]INDEXF.SYS
Directory DKB0:[000000]
INDEXF.SYS;1

24426

Total of 1 file, 24426 blocks.
$ DIRECTORY/GRAND_TOTAL DKB0:[SHARE_DIRECTORIES...]
Grand total of 56 directories, 13512 files.
Assume current monitoring reveals the following results:
$ DIRECTORY/SIZE DKB0:[000000]INDEXF.SYS
Directory DKB0:[000000]
INDEXF.SYS;1

90704

Total of 1 file, 90704 blocks.
$ DIRECTORY/GRAND_TOTAL DKB0:[SHARE_DIRECTORIES...]
Grand total of 73 directories, 37182 files.
Then you can calculate the increase in file count and the associated increase in
the size of the index file. In this example, these calculations are as follows:

Shared file count increase = 37,182 - 13,512 = 23,670 files
Index file size increase = 90,704 - 24,426 = 66,278 blocks.
If you estimate that the number of shared files will grow to 120,000 in the
lifetime of the current configuration, then the number of files will have
increased by 82,818 files (subtract 37,182 from 120,000).
From that calculation, you can estimate the index file growth by use of simple
proportions, where the ratio of the projected file count increase to the projected
index file header increase (n) is equal to the ratio of the observed file count
increase (23,670 files) to the observed index file header increase (66,278 blocks):
82,818
23,670
------ = -----n
66,278
Thus, the projected index file header increase (n) is calculated as follows:
82,818 * 66,278
n = --------------- = 231,897 blocks
23,670

Managing Directory and File Sharing 4–15

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing
The total size of the future index file will then be its current size plus the
projected increase, or:

24 426 + 231 897 = 256 323
;

;

blocks

Given that each file header occupies one disk block, and assuming for simplicity
that the entire index file consists of file headers (this is an overestimation), the
total number of headers needed in the future is 256,323. Thus, to initialize
the volume, you would specify this value for the /HEADERS qualifier in the
INITIALIZE command mentioned in step 2 in the preceding section.
You can also apply this same reasoning independently to any other product that
maintains a large number of files on the volume, such as MAIL or ALL-IN-1, or
products such as POLYCENTER HSM (Hierarchical Storage Management) for
OpenVMS that maintain file headers in INDEXF.SYS when shelving specified
files.
4.1.3.7 Removing PATHWORKS ACEs
To remove some or all ACEs associated with Advanced Server for OpenVMS
and PATHWORKS products, use the SYS$SYSTEM:PWRK$DELETEACE.EXE
utility provided with the Advanced Server software.
The PWRK$DELETEACE utility allows you to selectively remove:
•

PATHWORKS and Advanced Server for OpenVMS file attribute ACEs
(the utility refers to these ACEs as ‘‘PW ACEs’’). When you display file
ACEs (see Section 4.1.3.8, Displaying Advanced Server for OpenVMS
and PATHWORKS ACEs), these begin with ‘‘UNKNOWN=%X80’’ and are
used by Advanced Server for OpenVMS, PATHWORKS V6 for OpenVMS
(Advanced Server), and PATHWORKS V5 for OpenVMS (LAN Manager) to
store file attributes and dates. These ACEs should be removed only on files
that are no longer accessed by the server.

•

Advanced Server for OpenVMS and PATHWORKS V6 for OpenVMS
(Advanced Server) security ACEs. These ACEs begin with ‘‘UNKNOWN=%X86’’
and are used to store Windows NT-style security information, such as
owner, DACL, and SACL.

•

PATHWORKS V5 for OpenVMS (LAN Manager) security ACEs. These
begin with ‘‘UNKNOWN=%X82’’.

•

PATHWORKS V4 ACEs. V4 ACEs begin with ‘‘IDENTIFIER =PCFS$READ’’,
‘‘IDENTIFIER=PCFS$UPDATE’’, or ‘‘APPLICATION’’.

•

PATHWORKS for OpenVMS (Macintosh) comment ACEs (the utility refers
to these as ‘‘AFP Comment ACEs’’).

4–16 Managing Directory and File Sharing

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing
The following example shows how the PWRK$DELETEACE utility works:
$ MCR PWRK$DELETEACE
Exit=x File Spec: DKA200:[LMSHARES.CSCSEC]*.*
Cancel=x Delete V4 ACEs Y/N: Y
Cancel=x Delete PW ACEs Y/N: Y
Cancel=x Delete V5 security ACEs Y/N: Y
Cancel=x Delete V6 security ACEs Y/N: Y
Cancel=x Delete AFP Comment ACEs Y/N: Y
DKA200:[LMSHARES.C CSCSEC]DEFAULT_SECURITY.EXAMPLE;1 ACEs removed
DKA200:[LMSHARES.CSCSEC]NEW__20FOLDER.DIR;1
ACEs removed
DKA200:[LMSHARES.CSCSEC]WYSIWYG.EXAMPLE;1
ACEs removed
Exit=x FileSpec: x
$
4.1.3.8 Displaying Advanced Server for OpenVMS and PATHWORKS ACEs
If you execute the DCL command SHOW SECURITY, DIRECTORY/SECURITY,
or DIRECTORY/FULL for files that contain Advanced Server for OpenVMS
and PATHWORKS ACEs, the hexadecimal representation for each ACE is no
longer displayed. Instead, the commands summarize the total number of ACEs
encountered for each file in this message:
"Suppressed n PATHWORKS ACES."
To display the suppressed ACEs, use the DCL DIRECTORY command with the
/NOSUPPRESS qualifier along with either the /FULL, /SECURITY, or /ACL
qualifier.

4.1.4 Controlling User Access to Disk Resources
To control user access, you can assign permissions to shares. By default,
when a directory is shared, all users have full access to the share. You
can set or modify the permissions at the share level (using the ADD
SHARE/PERMISSIONS= or MODIFY SHARE/PERMISSIONS= command).
You can also assign permissions to specific files or directories within a shared
directory (using the SET FILE/PERMISSIONS= command).
Share permissions determine which users can access the shared directory or
file, and the type of access those users are allowed. These permissions control
network access to the directory or file.
In general, the simplest method to control access to disk resources is to
assign FULL access for Everyone to the share (the default), and then restrict
access at the directory or file level with the SET FILE command. For more
information, see Section 4.3.5, Planning File and Directory Access Permissions,
and Section 4.3.6, Specifying File and Directory Access Permissions.

Managing Directory and File Sharing 4–17

Managing Directory and File Sharing
4.1 Planning Directory and File Sharing
4.1.4.1 Administrator Access
Server administrators can access all resources shared on a server, but only if
they have the appropriate access permissions set for those resources. Access
permissions apply to administrators as well as ordinary users. However,
network administrators can always take ownership of a file or directory.
4.1.4.2 Group Access
If a user belongs to two groups, both of which are assigned access permissions
for a resource, then that user has all access permissions assigned to both
groups. For example, if the MUNCHKINS group has RW (Read and Write)
access permission and the WINKIES group has E (Execute) access permission
for the resource REPORTS, then a user who is a member of both groups has
RWE access permissions for that resource. A user account that is a member of
a group that has been denied access gets no access. (See Section 3.2, Managing
Advanced Server Groups, for more information about network groups).)
4.1.4.3 User Access
If you assign access permission explicitly to a specific user, that user has only
that access permission, regardless of the permissions assigned to any groups
that include that user. For example, a user who is a member of the groups
MUNCHKINS and WINKIES, but who has been assigned only R (Read) access
permission for the share GREATOZ has only Read permission for GREATOZ. If
the user is also in a group denied access, the user has no access.
4.1.4.4 Access Checks
In general, the ability to connect to a resource does not guarantee the ability to
perform operations with that resource. If the user name and password match
an account in the security accounts database, the user is granted access based
on the permissions set on the resource. If the user name is invalid, the user
may be able to access the resource as a Guest.
If the resource is a file or directory, the server performs the following checks:
1. For a file, the server checks access permission on the file and the share.
Both the file and the share must grant the requested access. If access is
permitted, the server continues to step 2. If the check fails at any level,
the server denies access.
2. If the Advanced Server and OpenVMS security model is enabled, the
server verifies OpenVMS access to the resource based on the host mapped
OpenVMS user name.

4–18 Managing Directory and File Sharing

Managing Directory and File Sharing
4.2 Administrative Shares

4.2 Administrative Shares
The Advanced Server automatically creates special shares for administrative
and system use. Only network administrators can change their properties.
Table 4–4, Network Administrative Shares, lists some of the default shares
created when the software is installed.
Table 4–4 Network Administrative Shares
Share Name

Type

Description

ADMIN$

Directory

The root share, an administrative resource that
provides a connection to the root of the directory
tree containing the Advanced Server’s data files.
On an Advanced Server, C$ is equivalent to
PWRK$LMROOT:[000000].

IPC$

IPC

The IPC share, an administrative resource that
supports interprocess communication.

A server’s administrative shares allow network administrators to perform
certain tasks on the server, including examining the shares, administering the
server remotely, and running distributed applications.
Administrative shares include ADMIN$, IPC$, and disk administrative
shares. They are hidden from most network users; only administrators can
see information about them using the ADMINISTER command-line interface.
To display information about hidden shares, including administrative shares,
include the /HIDDEN qualifier on the ADMINISTER command SHOW
SHARES. For example:
LANDOFOZ\\TINMAN> SHOW SHARES/HIDDEN
Shared resources on server "TINMAN":

Managing Directory and File Sharing 4–19

Managing Directory and File Sharing
4.2 Administrative Shares
Name
-----------ADMIN$
ALP072$
C$
IPC$
NETLOGON
PAGE_TINMAN$
PWLIC
PWLICENSE
PWODS5$
PWROOT$
PWTEST
PWUTIL
USERS

Type
--------Directory
Directory
Directory
IPC
Directory
Directory
Directory
Directory
Directory
Directory
Directory
Directory
Directory

Description
----------------------------------------Admin Share
PATHWORKS share
IPC Share
Logon Scripts Directory
PATHWORKS Client License Software
PATHWORKS Client License Software

PATHWORKS Client-based Utilities
Users Directory

Total of 13 shares
The following sections explain the function of each administrative share and
compare how these shares are shared.

4.2.1 The ADMIN$ Share
The ADMIN$ share controls access to server administration functions. A
server’s ADMIN$ share must be shared if that server is to be administered
remotely. When a server starts, Advanced Server automatically shares
ADMIN$. You cannot stop sharing the ADMIN$ share.
When you begin an administration session, Advanced Server makes a
connection to the ADMIN$ share.

4.2.2 The IPC$ Share
The IPC$ share controls interprocess communication, such as communication
between different components of a program, different computers running parts
of a single program, or two programs working together. In the Advanced Server
environment, interprocess communication occurs when a user or administrator:
•

Views a list of a server’s available resources

•

Administers the server remotely

•

Runs a distributed application

Servers share the IPC$ share automatically. You cannot stop sharing the IPC$
share. When the IPC$ share is needed, Advanced Server makes a connection
to it automatically.

4–20 Managing Directory and File Sharing

Managing Directory and File Sharing
4.2 Administrative Shares

4.2.3 Disk Administrative Shares
The Advanced Server automatically defines disk devices as shares by offering
all mounted disk devices as autoshares (automatic shares) at server startup
time. An autoshare points to the top-level (root) directory on the disk. For
example, if you connect to the autoshare USER1_DISK$, a volume label, you
access the directory USER1_DISK:[000000].
Only administrators can connect to disk administrative resources. Such
connections allow access to all directories and files on the disk. Administrators
working at remote servers or clients cannot make these connections if the
ADMIN$ and IPC$ resource are not shared.
4.2.3.1 Autoshare Names
The Advanced Server creates an autoshare name using the OpenVMS volume
label of the associated OpenVMS disk device. Autoshare names must conform
to network resource naming restrictions (no more than 11 characters), with the
last character a dollar sign ($), which identifies the share name as a hidden
share.
Note
The autoshare name C$ is reserved. By default, Advanced Server
defines C$ as an autoshare alias for PWRK$LMROOT:[000000]. If you
define another volume as C$, the share name will be rejected.

When you create shares for directories using the ADMINISTER ADD SHARE
command, you can specify any of the following for the device name in the share
path:
•

The autoshare name

•

The physical device name

•

An OpenVMS device logical name (search lists are not supported)

For more information, see Section 4.3.2, Creating a Share.
Note that when a logical name is specified for the device in the share path,
if you need to move the share later to another device, you simply assign the
same logical name to the new device when you mount the device. Then users
can continue to access the same share in the new location, as if nothing had
changed.

Managing Directory and File Sharing 4–21

Managing Directory and File Sharing
4.2 Administrative Shares
4.2.3.2 Defining Autoshares
Sometimes the autoshare name created by the Advanced Server is not ideal for
the situation. The Advanced Server lets you define your own autoshare names.
This is useful when:
•

You have a disk device whose volume label exceeds the 11-character limit.

•

You want to map a server device to a single letter to accommodate the DOS
disk device-naming convention.

•

You do not want to autoshare some devices.

The server cannot define devices with volume labels that exceed the 11character limit as autoshares. When the server starts, disk devices with
volume labels that exceed the limit are not shared, and an event is recorded
in the Advanced Server log file, which is viewable with the ADMIN/ANALYZE
command. (For information about using the ADMIN/ANALYZE command, see
Section 6.1.4.2, The Advanced Server Common Event Log.)
You use the Autoshare value in the OpenVMS Registry to define autoshare
names for the server to create in addition to the autoshares that the server
creates automatically. Use the NoAutoshare value to specify the names of
devices that you do not want to autoshare.
The Autoshare and NoAutoshare parameters function as follows:
•

If a device is listed in the NoAutoshare parameter, that device is not
shared and cannot be accessed by the Advanced Server. Existing shares on
the device are no longer accessible.

•

If a device is listed in the Autoshare parameter, that device is shared and
mapped to the specified autoshare name. If the length of the device volume
label is 11 characters or less, the device will also be shared using the label
name.

•

If a device is not specified in either the NoAutoshare or Autoshare
parameter, the Advanced Server creates a default autoshare using the
volume label (as long as the volume label does not exceed the 11-character
name limit). For a disk with a volume label longer than 11 characters,
the Advanced Server does not create a disk administrative share, and the
device is not accessible to the Advanced Server.

If you are running Advanced Server in an OpenVMS Cluster environment,
see Section 4.2.3.6, Autosharing in an OpenVMS Cluster Environment, for
information about defining autoshares and preventing autoshare creation on
specific nodes in the cluster.

4–22 Managing Directory and File Sharing

Managing Directory and File Sharing
4.2 Administrative Shares
4.2.3.3 The Autoshare Parameter
The Autoshare value in the registry specifies an alias for the autoshare name
created by default for an OpenVMS disk device. Advanced Server creates an
autoshare for each mounted OpenVMS disk device when the server starts. To
create a more meaningful share name or to map the device name to a DOS
format, use the Autoshare value in the OpenVMS registry.
The format of the data associated with the Autoshare value is as follows,
where devname_n is the device name (such as DUA2:), and sharename_n is the
name of the autoshare:
devname_1=sharename_1, . . . , devname_n=sharename_n
For example, the following command creates an autoshare named M$ for
device DOT$DUA2:, and an autoshare named WORK5$ for device DOT$DUA3:
(for more information about using REGUTL, see Section 7.2.4, Using the
PWRK$REGUTL Utility to Manage Advanced Server Parameters in the
OpenVMS Registry):
$ REGUTL SET VALUE * AUTOSHARE DOT$DUA2=M, DOT$DUA3=WORK5
The following command displays the autoshare values in the OpenVMS
Registry:
$ REGUTL SHOW VALUE * AUTOSHARE
Key: SYSTEM\CurrentControlSet\Services\AdvancedServer\ShareParameters
Value: Autoshare
Type: String
Current Data: DOT$DUA2=M,DOT$DUA3=WORK5
As shown in the first command example above, when adding multiple entries,
delimit each entry in the list with a comma. Note that the share name cannot
exceed 11 characters. In addition, do not append a dollar sign ($) to the device
name; the Advanced Server does this automatically.
Table 4–5, Sample Default Autoshare Names, shows physical device names and
volume labels for disk devices mounted on node DOT and the autoshare names
that the Advanced Server creates by default.

Managing Directory and File Sharing 4–23

Managing Directory and File Sharing
4.2 Administrative Shares
Table 4–5 Sample Default Autoshare Names
Device

Volume Label

Autoshare Name

DOT$DUA0:

AXPVMS072

AXPVMS072$

DOT$DUA1:

USERS_1

USERS_1$

DOT$DUA2:

USERS_2

USERS_2$

DOT$DUA3:

WORK_DISK055

None: the volume label exceeds the
11-character limit.

For example, the data associated with the AutoShare value in the OpenVMS
Registry appears as follows:
DOT$DUA2=M
DOT$DUA3=WORK5
The Autoshare parameter directs the Advanced Server to create an autoshare
named M$ for device DOT$DUA2: and an autoshare named WORK5$
for device DOT$DUA3:. If an administrator maps a network drive to the
hidden share name M$, administrators connecting to M$ are accessing
DOT$DUA2:[000000]. When you display the list of hidden shares, these
autoshare names will also be listed. These autoshare names may also be used
in share paths when creating directory shares.
As shown in Table 4–5, Sample Default Autoshare Names, the Advanced
Server did not create an implicit autoshare for the device DOT$DUA3:,
because the volume label WORK_DISK055 exceeds the 11-character limit.
But Advanced Server allows you to include the device name (DOT$DUA3) in
the autoshare list in the registry and creates the explicit autoshare WORK5$
for DOT$DUA3:.
4.2.3.4 The NoAutoshare Parameter
The NoAutoshare parameter specifies the OpenVMS device names that
should not be automatically shared or available to the Advanced Server. If
a device is listed in both the Autoshare list and the NoAutoshare list, the
NoAutoshare definition takes precedence.
If the server configuration includes many disk devices, you may want to specify
which devices are not shared automatically. By sharing some devices and not
sharing others, you can separate OpenVMS disk resources from Advanced
Server resources and reduce unnecessary resource consumption by the server.

4–24 Managing Directory and File Sharing

Managing Directory and File Sharing
4.2 Administrative Shares
The NoAutoshare parameter value is a comma-delimited list of implicit
wildcard device references. For example, the following data associated with the
NoAutoshare value in the OpenVMS Registry specifies search strings DFS*,
DAD*, and PWRK$DKB1*:
DFS,DAD,PWRK$DKB1
With this data, any OpenVMS device names that begin with the strings
DFS, DAD, or PWRK$DKB1 are not autoshared. If you want to exclude a
specific device and negate the use of the wildcard, include the colon in the
device specification. For example, the NoAutoshare value PWRK$DKB1: will
always apply to a single device, while the value PWRK$DKB1 can apply to
many devices, such as PWRK$DKB100:.
4.2.3.5 Sharing DECdfs Devices
DECdfs is a DECnet-based layered product that provides OpenVMS users with
the ability to use remote disks as if they were directly attached to the local
system. By default, Advanced Server does not automatically share devices
managed by DECdfs. The OpenVMS registry contains the following default
data associated with the NoAutoshare value:
DAD,_DFS
You cannot assign permissions to DECdfs devices; therefore, if you override the
default and allow the Advanced Server to create an autoshare for a DECdfs
device, users with user or operator privileges cannot access that device. Access
to a shared DECdfs device is restricted to users in the Administrators group.
4.2.3.6 Autosharing in an OpenVMS Cluster Environment
OpenVMS disk devices mounted clusterwide are offered to users as shared
devices (autoshares) by all server nodes in an OpenVMS Cluster system.
Devices mounted on a specific server (not clusterwide) are accessible to users
connected to that server only.
The OpenVMS Registry contains two types of values to define autoshares:
•

Autoshare and NoAutoshare

•

Autoshare_nodename and NoAutoshare_nodename

In an OpenVMS Cluster system, you can make a device available clusterwide
by using the AutoShare value. You can restrict device availability using the
NoAutoshare value.
In addition, you can control the devices to be automatically shared
on a single node in the cluster, using the Autoshare_nodename and
NoAutoshare_nodename values.

Managing Directory and File Sharing 4–25

Managing Directory and File Sharing
4.2 Administrative Shares
The following registry examples show how you can share disk devices in an
OpenVMS Cluster. For this example, the cluster contains two members: DOT
and TINMAN.
•

On both DOT and TINMAN, the following value is defined:
Key: SYSTEM\CurrentControlSet\Services\AdvancedServer\ShareParameters
Value: Autoshare = PCS524$DKA100=J,PCS524$DKA200=K

•

On the cluster member named DOT, the following value is defined:
Key: SYSTEM\CurrentControlSet\Services\AdvancedServer\ShareParameters
Value: Autoshare_DOT = DUA1001=H,DUA1002=G,DUA1006=I

•

On the cluster member named TINMAN, the following value is defined:
Key: SYSTEM\CurrentControlSet\Services\AdvancedServer\ShareParameters
Value: Autoshare_TINMAN = DUA1001=H,DUA1002=G
Key: SYSTEM\CurrentControlSet\Services\AdvancedServer\ShareParameters
Value: NoAutoshare_TINMAN = DUA1006

In this example:
•

PCS524$DKA100 and PCS524$DKA200 are available as shared devices on
autoshares J: and K: on all OpenVMS Cluster server nodes.

•

DUA1001 and DUA1002 are available as shared devices on autoshares H:
and G: on server nodes DOT and TINMAN, respectively.

•

DUA1006 is available as a shared device on autoshare I: on node DOT only.

The Advanced Server compares the clusterwide definitions with the nodespecific definitions. If the same device is listed in both the clusterwide and
node-specific Autoshare parameters, the clusterwide definition prevails. The
NoAutoshare parameter uses the union of the clusterwide and node-specific
autoshare lists.
4.2.3.7 Synchronizing Autoshares
By default, each disk device available to the Advanced Server when it starts
is assigned an autoshare name. If you mount a disk device after the server
has started, you must synchronize the available devices using the SET
COMPUTER command, to make the disk device available to the Advanced
Server. For example:
LANDOFOZ\\TINMAN> SET COMPUTER TINMAN/AUTOSHARE_SYNCHRONIZE
%PWRK-S-AUTOSHRSYNCHED, autoshare synchronization was successful
LANDOFOZ\\TINMAN>
In the OpenVMS Cluster environment, you must enter this command on every
node in the cluster.
4–26 Managing Directory and File Sharing

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files

4.3 Managing Shared Directories and Files
Advanced Server allows you to create shared and personal shared directories.
Some shares are provided by default.

4.3.1 Default Shares
When you install Advanced Server software, it creates the default shares
shown in Table 4–6, Default Shares.
Table 4–6 Default Shares
Share Name

Description

USERS

Contains user home directories. This shared directory is created
only when logon validation is enabled.

NETLOGON

Default location for logon scripts. This directory is shared if the
Netlogon service is running.

PWLIC

Client Licensing Software

PWLICENSE

Client Licensing Software

PWUTIL

Default location for Advanced Server utilities.

4.3.2 Creating a Share
A share is a shared directory. By sharing a directory, you allow users on the
network to access the directory.
Any directory on the server can be shared, including the root directory of a disk
device. Users specify the share name when accessing and displaying shares.
No two resources on the same server can have the same share name.
When you create a shared directory, you assign access permissions to users and
groups. These permissions define the access to the share for the specified users
and groups. If you do not specify permissions when you add a share, all users
are allowed to access the share.
You can define an OpenVMS system logical name that refers to an OpenVMS
physical device. Then you can specify the logical name when you create the
share using the ADD SHARE command. This allows you to move the physical
structure to another device, redefine the logical name, and continue to provide
access to the structure by the same share name. Users connected to the share
will have to reconnect after this change.

Managing Directory and File Sharing 4–27

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files
4.3.2.1 Preparing to Share a Directory
When you share directories on a server, it is important to be well organized. If
many users access the same directory for different purposes and activities, the
directory can become a clutter of unrelated files. If you take the time to create
separate directories organized by group and function, it will be easier to keep
files organized and to ensure security.
Before setting up a shared directory, prepare a list of directories you will need
to share on the server. Also prepare a list of the users and groups that will
require access to each shared directory and the kinds of permissions they
will need. Use the worksheets in the Compaq Advanced Server for OpenVMS
Concepts and Planning Guide to help you prepare these lists.
When sharing a directory on a server, you specify the names of the users and
groups who can access the shared directory by setting share permissions, and
who can access the subdirectories and files in the share by setting file and
directory access permissions as described in Section 4.3.6, Specifying File and
Directory Access Permissions. This allows you to set different permissions for
each subdirectory and file in the shared directory.
You can also set up auditing of each type of access and of specific files and
directories, as described in Section 4.3.9, Auditing Directory and File Access.
This provides event log messages when the files and directories are accessed.
To create a share, you must be a member of the Administrators or Server
Operators group, and the associated OpenVMS directory must already
exist. If a directory to be shared does not exist, you must create it either
on OpenVMS or remotely. To create a directory on the OpenVMS system, use
the OpenVMS command CREATE/DIRECTORY. For example, to create the
directory [SHARED] on disk device USER1, enter the following OpenVMS
command:
$ CREATE/DIRECTORY USER1:[SHARED]
4.3.2.2 Planning Share Permissions
To secure shared directories effectively, keep the following in mind:
•

Share permissions apply to network users, not OpenVMS users. However,
network user accounts can be host mapped to OpenVMS user accounts,
providing access to OpenVMS resources for network users based on their
OpenVMS user accounts.

•

Share permissions apply to all files and subdirectories created in the
shared directory. You can set access permissions for specific files and
subdirectories in the share. For more information, see Section 4.3.5.3,
Inheriting Permissions. Note that you can restrict user access to specific

4–28 Managing Directory and File Sharing

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files
files and subdirectories in a share (using the SET FILE command),
or you can restrict user access at the share level (using the ADD
SHARE/PERMISSIONS= or MODIFY SHARE/PERMISSIONS= command).
For example, you can restrict a user to READ access to the contents of a
share by modifying the permissions for that share. This would override
any other access previously granted the user to the contents of that share.
Table 4–7, Share Permissions, shows permissions available for shares and the
actions available to users for each permission.
Table 4–7 Share Permissions
Read
Access

Change
Access

Full
Control

Display subdirectory names and file names

Display file data and attributes

Users can do the following . . .

No
Access

Run program files

Go to subdirectories of the directory

Create subdirectories and add files

Change data in and append data to files

Change file attributes

Delete subdirectories and files

Change permissions (Windows NT files and
directories only)

Take ownership (Windows NT files and
directories only)

4.3.2.3 Creating a Share
You can share an existing OpenVMS directory. When you share a directory,
you specify its location on the server, including the disk device, the directory
name, and the name for the share. The following example shows how to share
a directory on the server:
Use the ADD SHARE/DIRECTORY command. For example:
LANDOFOZ\\TINMAN> ADD SHARE/DIRECTORY RAINBOW USER1:[SHARED] _LANDOFOZ\\TINMAN> /HOST_ATTRIBUTES=(RMS_FORMAT=STREAM)
%PWRK-S-SHAREADD, share "RAINBOW" added on server "TINMAN"
This command adds a directory share named RAINBOW for the directory
USER1:[SHARED]. Files created in this directory will be RMS stream-format
files. Because the /PERMISSIONS qualifier is not included on the command
line, the new share is available to all network users.
Managing Directory and File Sharing 4–29

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files
4.3.2.4 Creating a Personal Share
The Advanced Server allows you to set up personal shares, which are typically
used for sharing a user’s OpenVMS login directory. Personal shares are unique
in that they are hidden (they will not appear in the list of shares users can
display, such as in Network Neighborhood), but the names of personal shares
do not end with a dollar sign ($). Thus, when users want to map a drive to
their OpenVMS login directory, they specify a personal share name (typically
the same as their user name) without having to include a dollar sign in the
share name.
Note
Users cannot specify personal shares in the UNC path when connecting
to or listing resources. To access such a file or run an application from
the personal share, users must specify the device associated with the
share.

A personal share typically points to the root directory of a user’s OpenVMS
account. For example, network user SCARECROW has a personal share that
is mapped to the OpenVMS directory [STRAWMAN] on server TINMAN. If you
display the personal shares on TINMAN, the following information appears:
LANDOFOZ\\TINMAN> SHOW SHARES/TYPE=PERSONAL
Shared resources on server "TINMAN":
Name
Type
Description
------------ --------- ------------------------------------STRAWMAN
Personal
Total of 1 share
STRAWMAN, the host mapped OpenVMS account, has a login directory
defined in the UAF record; for example: DUA1:[000000]STRAWMAN.DIR,
or DUA1:[STRAWMAN]. You can use the AUTHORIZE utility to display a
system’s UAF records. For example:
$ MCR AUTHORIZE
UAF> SHOW STRAWMAN

4–30 Managing Directory and File Sharing

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files
Username:
STRAWMAN
Account:
SYSTEM
CLI:
DCL
Default:
DUA1:[STRAWMAN]
LGICMD: LOGIN
.
.
.

Owner: SYSTEM MANAGER
UIC: [360,44] ([PCSA,STRAWMAN])
Table: DCLTABLES

Only users in the Administrators group can display and access all the personal
shares on a server.
Note
A user with OpenVMS user accounts on multiple servers in a domain
may have a personal share associated with an account on each server.

4.3.2.4.1 Procedure for Creating a Personal Share
create a personal share:

Follow these steps to

1. Add a share using the ADD SHARE/PERSONAL command.
2. Use the SHOW SHARES/TYPE=PERSONAL command to display the
share. Include the /FULL qualifier to display the path and permissions.
For example:
LANDOFOZ\\TINMAN> ADD SHARE GREATOZ USER1:[USERS] _LANDOFOZ\\TINMAN> /PERSONAL/NOPERMISSIONS/PERMISSIONS=(LION=FULL)
%PWRK-S-SHAREADD, share "GREATOZ" added on server "TINMAN"
LANDOFOZ\\TINMAN> SHOW SHARES/TYPE=PERSONAL/FULL
Shared resources on server "TINMAN":
Name
Type
Description
------------ --------- -----------------------------------------GREATOZ
Personal
Path: USER1:[USERS]
Connections: Current: 0, Maximum: No limit
RMS file format: Stream
Directory Permissions: System: RWED, Owner: RWED, Group: RWED, World: RE
File Permissions: System: RWD, Owner: RWD, Group: RWD, World: R
Share Permissions:
LION
Full Control
Total of 1 share
LANDOFOZ\\TINMAN>

Managing Directory and File Sharing 4–31

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files
After the personal share is created, you can set up the associated directory
as the user’s home directory. The home directory contains files and programs
for the user, and is automatically accessible when the user logs on to the
network. For information about setting up home directories, see Section 3.1.10,
Specifying Home Directories.
4.3.2.5 Stopping Directory Sharing
You may need to stop sharing a directory when the directory is no longer being
used and you want to delete it; for example, when a project requiring the use of
shared files is completed. Advise users when you are planning to stop sharing
a directory.
For example, to stop sharing the directory GREATOZ, use the ADMINISTER
command REMOVE SHARE, as follows:
LANDOFOZ\\TINMAN> REMOVE SHARE GREATOZ/NOCONFIRM
%PWRK-S-SHAREREM, share "GREATOZ" removed from server "TINMAN"
LANDOFOZ\\TINMAN>
This example removes the share named GREATOZ from the server named
TINMAN; no confirmation is required. When you stop sharing a directory, the
share name is removed from the share database and no longer appears on the
list of available shares. However, the directory and its files are not deleted.

4.3.3 Displaying Information About Shares
You can use the SHOW SHARES command to display the shares provided by a
server and to see which shares are available to the network. Before sharing a
new directory from the server, first check which shares are currently available.
The following example shows how to display the shared directories for your
server:
LANDOFOZ\\TINMAN> SHOW SHARES
Shared resources on server "TINMAN":
Name
-----------NETLOGON
PWLIC
PWLICENSE
PWUTIL
USERS

Type
--------Directory
Directory
Directory
Directory
Directory

Description
--------------------------------------Logon Scripts Directory
PATHWORKS Client License Software
PATHWORKS Client License Software
PATHWORKS Client-based Utilities
Users Directory

Total of 5 shares
LANDOFOZ\\TINMAN>

4–32 Managing Directory and File Sharing

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files
The default display does not show administrative shares and personal shares.
You can display information about administrative shares (those that end with
$) using the SHOW SHARES/HIDDEN command, as described in Section 4.2,
Administrative Shares.
You can display information about personal shares using the SHOW
SHARES/TYPE=PERSONAL command.
You can display information about all shares using the SHOW SHARE/TYPE=ALL
command.
4.3.3.1 Displaying Information About a Specific Share
You can display information about any share, regardless of the type of share,
by specifying the share name, as in the following example:
LANDOFOZ\\TINMAN> SHOW SHARES RAINBOW
Shared resources on server "TINMAN":
Name
Type
Description
------------ --------- -------------------RAINBOW
Personal
Total of 1 share
4.3.3.2 Displaying Share Permissions
To display share permissions, use the SHOW SHARES command with the
/PERMISSIONS qualifier. For example:

Managing Directory and File Sharing 4–33

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files
LANDOFOZ\\TINMAN> SHOW SHARES/PERMISSIONS
Shared resources on server "TINMAN":
Name
Type
Description
------------ --------- -------------------------------------------------DICK
Printer
Dick’s print share
Share Permissions:
Everyone
Full Control
NETLOGON
Directory Logon Scripts Directory
Share Permissions:
Everyone
Read
PATHWORKS
Directory
Share Permissions:
Everyone
Full Control
PWLIC
Directory PATHWORKS Client License Software
Share Permissions:
Administrators
Full Control
Everyone
Read
PWLICENSE
Directory PATHWORKS Client License Software
Share Permissions:
Administrators
Full Control
Everyone
Read
PWUTIL
Directory PATHWORKS Client-based Utilities
Share Permissions:
Everyone
Read
USERS
Directory Users Directory
Share Permissions:
Everyone
Full Control
Total of 7 shares
LANDOFOZ\\TINMAN>

4.3.4 Changing Share Properties
You can change the properties of an existing share using the MODIFY SHARE
command. You can change the following share properties:
•

Number of users allowed to connect to a shared directory

•

Shared directory’s description

•

Share permissions

To change the properties of a shared directory, you must be logged on as a
member of the Administrators or Server Operators group.
The following example shows how to use the MODIFY SHARE command to
add permissions on an existing directory share called GREATOZ and to grant
READ access to the user SCARECROW:

4–34 Managing Directory and File Sharing

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files
LANDOFOZ\\TINMAN> MODIFY SHARE GREATOZ/PERMISSIONS=(SCARECROW=READ)
%PWRK-S-SHAREMOD, share "GREATOZ" modified on server "TINMAN"
LANDOFOZ\\TINMAN>

4.3.5 Planning File and Directory Access Permissions
Users and groups can be granted or denied access to specific files and
subdirectories in a shared directory. A user denied access to a file or directory,
either individually or as a member of a group, can connect to the share but
cannot perform any operations with the files and directories in the share.
You can grant specific unique access permissions for files and directories in
shares that users can access. Once a user connects to the resource, the file and
directory access permissions control the operations that the user can perform.
For information about specifying share permissions, see Section 4.3.2.2,
Planning Share Permissions.
You can enable users to set access permissions on their own files and
directories. These users can then control whether other users can read, write,
or modify files in that directory. To enable users to set access permissions, give
them full control using the SET FILE command.
4.3.5.1 File and Directory Access Permissions
Table 4–8, Directory Access Permissions and Actions on Directories, lists the
types of access users can have and the permissions to set on directories.

Managing Directory and File Sharing 4–35

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files
Table 4–8 Directory Access Permissions and Actions on Directories

User can...

READ

Display directory file
names

Display directory
attributes

Go to directory
subdirectories

Change directory
attributes

Create subdirectories
and add files

Delete the directory

ADD

FULL
CHANGE CONTROL

LIST

Display directory owner
and permissions

NONE

ADD
AND
READ

Delete any file or
empty subdirectory
in a directory

Change directory
permissions

Take ownership of the
directory

Table 4–9, Directory Access Permissions and Actions on Files, lists the types of
access users can have to files and the permissions to set on them.

4–36 Managing Directory and File Sharing

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files
Table 4–9 Directory Access Permissions and Actions on Files

User can...
Display file owner and
permissions

NONE

LIST

READ
X

ADD

ADD
AND
READ

FULL
CHANGE CONTROL

Display file data

Display file attributes

Run a program file

Change file attributes

Change data in and
append data to the file

Delete the file

Change the file
permissions

Take ownership of the
file

4.3.5.2 Setting Permissions on a File or Directory
By default, anyone with a valid network user name and password can log
on to a server and connect to a share on that server. However, a user must
have the requisite permissions to access the directories and files in the
share. You use the SET FILE/PERMISSIONS command to set permissions
on a shared directory. You may need to change access permissions if users
cannot access the directories or files they need, or if unauthorized users can
access them. For information on how a file or directory that does not have
explicit permissions inherits the permissions, see Section 4.1.3.1, Inheritance
of Directory Permissions, and Section 4.3.5.3, Inheriting Permissions.
Permissions for disk resources are stored on the disk with each resource as an
OpenVMS Access Control List (ACL). Thus, resource permissions are backed
up by the OpenVMS BACKUP utility.
4.3.5.3 Inheriting Permissions
As you create subdirectories and files in shared directories that have existing
permissions, those permissions are automatically propagated to the new
subdirectories and files. However, if you decide to share a directory that
contains existing subdirectories and files, the permissions you assign to the
new share are not propagated to its subdirectories and files. You can either
explicitly set permissions for each subdirectory and file, or you allow their
permissions to be inherited.
Managing Directory and File Sharing 4–37

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files

4.3.6 Specifying File and Directory Access Permissions
When sharing a directory on a server, you specify the name of the groups
and users who can access the share, its subdirectories, and its files, and the
permissions each group or user has for the share. After the share has been
created, you can modify the permissions on the files and directories in the
share. The following example shows how to use the SET FILE/PERMISSIONS
command to modify permissions. In this example, the command specifies the
access permissions for all files with the .C extension in the directory CURTAIN
in share GREATOZ.
LANDOFOZ\\TINMAN> SET FILE GREATOZ\CURTAIN\*.C _LANDOFOZ\\TINMAN> MUNCHKINS/PERMISSIONS=READ _LANDOFOZ\\TINMAN> SCARECROW/PERMISSIONS=FULL_CONTROL
%PWRK-S-FILEMOD, "GREATOZ\CURTAIN\FILE1.C" modified on server "TINMAN"
%PWRK-S-FILESMODIFIED, total of 1 file modified
LANDOFOZ\\TINMAN>
As a result, the following permissions are set:
•

Group MUNCHKINS has READ access

•

User SCARECROW has FULL access

4.3.7 Displaying File and Directory Access Permissions
To display directory and file permissions, use the SHOW FILES/PERMISSIONS
command, specifying a share name and its path. For example, with a share
called RAINBOW and a file called LOGS.TXT, you can display permissions as
follows:
LANDOFOZ\\TINMAN> SHOW FILES RAINBOW\LOG.TXT /PERMISSIONS
Files in: \\TINMAN\RAINBOW
LOGS.TXT
Permissions:
Administrators
Everyone
Server Operators
SYSTEM
Total of 1 file
LANDOFOZ\\TINMAN>

4–38 Managing Directory and File Sharing

Full (All)
Change (RWXD)
Change (RWXD)
Full (All)

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files

4.3.8 Using Network Permissions and OpenVMS Protections
If the Advanced Server and OpenVMS security model is enabled, and a
network user attempts to access a file or directory, the access must be allowed
by two security checks: network permissions, and OpenVMS file and directory
protections.
4.3.8.1 OpenVMS Protections
Every file on an OpenVMS system has four protection codes:
•

The OpenVMS SYSTEM UIC group (System).

•

The OpenVMS owner of a file (Owner).

•

The OpenVMS group that can access a file (Group). (This is the OpenVMS
group to which the owner belongs.)

•

The world, which means everyone else (World).

To set OpenVMS system file protections, use the OpenVMS command SET
PROTECTION.
When a network user attempts to access a file, the following rules determine
the way that OpenVMS system protections control the access:
•

If the network user account is mapped to the OpenVMS user account that
is the owner of the file, then the Owner protections apply.

•

If the network user account is mapped to an OpenVMS user that is in the
same UIC group as the file owner, then Group protections apply.

•

If the user’s UIC group is in the range of SYSTEM UIC group numbers,
then the System protections apply.

•

Otherwise, World protections apply.

4.3.9 Auditing Directory and File Access
When you assign permissions for a resource, you can also audit use of the
resource. The Advanced Server can write an entry to the Security event log
whenever a user accesses the resource in a certain way. The audit entry shows
the resource, action performed, user who performed it, and date and time of
the event.
Events that Advanced Server can audit for directory and file access include:
•

Successful and failed attempts to take ownership of a file or directory

•

Successful and failed attempts to access a file or directory

Managing Directory and File Sharing 4–39

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files
•

Successful or failed attempts to change access permissions on a file or
directory

For more information about auditing and viewing events, see Chapter 6,
Monitoring Events and Troubleshooting.

4.3.10 Taking Ownership of Files or Directories
When you create a file or directory, you become its owner. By granting
permissions, the owner controls how the file or directory is used. The owner
can grant permission to another user to take ownership of a file or directory.
Otherwise, you must be logged on as a member of the Administrators
group to take ownership. Although an administrator can take ownership,
an administrator cannot transfer ownership to others. This preserves security.
To make sure that your files are secure, you should check their ownership
regularly using the SHOW FILES/OWNER command.
4.3.10.1 Authorizing a User to Take Ownership of a File or Directory
You can specify permission to take ownership of a file or a directory using the
following commands:
•

SET FILE/PERMISSIONS=FILE_SPECIFIC=TAKE_OWNERSHIP

•

SET FILE/PERMISSIONS=DIRECTORY_SPECIFIC=TAKE_OWNERSHIP

For example, to authorize the user SCARECROW to take ownership of a file
called SIMIANS.DAT that is stored on domain LANDOFOZ in the directory
\WITCH\MKEY, enter the following command:
LANDOFOZ\\TINMAN> SET FILE WITCH\MKEY\SIMIANS.DAT _LANDOFOZ\\TINMAN>SCARECROW/PERMISSIONS=FILE_SPECIFIC=TAKE_OWNERSHIP
%PWRK-S-FILEMOD, "\\TINMAN\WITCH\MKEY\SIMIANS.DAT" modified
4.3.10.2 Taking Ownership of a File or Directory
To take ownership of a file or directory, use the TAKE FILE OWNERSHIP
command as follows:
TAKE FILE OWNERSHIP UNCpath [/qualifiers])
For example, the following command takes ownership of the file called
SIMIANS.DAT that is stored on domain LANDOFOZ in the directory
\WITCH\MKEY:
LANDOFOZ\\TINMAN> TAKE FILE OWNERSHIP WITCH\MKEY\SIMIANS.DAT
%PWRK-S-FILEMOD, "\\TINMAN\WITCH\MKEY\SIMIANS.DAT" modified
LANDOFOZ\\TINMAN>

4–40 Managing Directory and File Sharing

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files

4.3.11 Managing Shares from a Windows NT Server
You can manage shares on the Advanced Server using a Windows NT
Server. When the Windows NT Server performs server administration, the
Windows NT server administration tool Server Manager attempts to verify the
share path locally before passing the server operation request to the Advanced
Server. Any share path that does not conform to the device:\ directory
convention, where device: is a single letter drive letter, fails the share path
verification; therefore, you cannot manage an Advanced Server share from
the Windows NT Server Manager if the share path does not conform to the
device:\directory convention.
The following sections describe ways to manage an Advanced Server share
from the Windows NT Server.
4.3.11.1 Adding a Share from a Windows NT Server
To add an Advanced Server share using a Windows NT Server, use one of the
following procedures:
•

Define the OpenVMS device using the Autoshare server configuration
parameter in the OpenVMS Registry. This server parameter allows
you to map the OpenVMS device to a single letter DOS device. (See
Section 4.2.3.2, Defining Autoshares, for more information.)
When a device is defined as an autoshare this way, you can add the
share using the Windows NT Server by specifying the share path as
device:\ directory, where device is the mapped device letter.
For example, to share the directory DUA1:[SHARE1] using the device
letter D, include the following in the OpenVMS Registry:
Key: SYSTEM\CurrentControlSet\Services\AdvancedServer\ShareParameters
Value: Autoshare= DUA1=D
To add this share using the Windows NT Server Manager, specify the share
path as follows:
d:\share1

•

Convert the share path input string from the OpenVMS directory path by
adding C:\ to the beginning of the path specification. Instead of specifying
device:[share], enter device\share. The Advanced Server is designed to
interpret C: correctly.
For example, if the OpenVMS directory that you want to share is
DUA1:[SHARE1], specify the share path as follows:
C:\DUA1\SHARE1

Managing Directory and File Sharing 4–41

Managing Directory and File Sharing
4.3 Managing Shared Directories and Files
By default, the C: device is defined as PWRK$LMROOT:[000000]. To add
this share, use the following path name:
C:\SHARE1
In this case, the actual OpenVMS specification is PWRK$LMROOT:[SHARE1].
4.3.11.2 Displaying and Modifying Shares from a Windows NT Server
To display and modify the OpenVMS share from a Windows NT Server, use the
following share path:
C:\vmsdevicename\directorypath
For example, if you add a share using the ADMINISTER command ADD
SHARE, and you specify $1$DUA2:[SHARE.LEVEL2] as the share path for
share LEVEL2, when you display this share from the Windows NT Server
Manager, the share path is displayed in the following format:
C:\$1$DUA2\SHARE\LEVEL2

4.4 Unicode and Extended Character Sets
Unicode and extended character sets provide an extensive character coding
system and standard designed to support written texts of the diverse languages
of the modern world, independent of the platform, application, or language. It
provides applications a consistent way of encoding multilingual plain text and
brings order to a chaotic state of affairs that made it difficult to exchange text
files internationally.
Previous to the development of this coding system, hundreds of encoding
systems existed, but none of these was extensive enough to include all possible
characters — including punctuation and other special characters, symbols,
or glyphs — in a given language. Any given computer (especially servers)
needs to support many different encodings; yet whenever data is passed
between different encodings or platforms, that data always runs the risk of
misinterpretation. That is, two encodings might use the same number for two
different characters, or use different numbers for the same character. This
conflict between the encodings causes a misrepresentation of the character set.
The design of extended character sets is based on the simplicity and
consistency of the ASCII encoding, but goes far beyond ASCII’s limited
ability to encode only the Latin alphabet. Ultimately, the design provides the
capacity to encode all of the characters used for the written languages of the
world. To keep character coding simple and efficient, it assigns each character
a unique 16-bit value, and does not require the use of complex modes or escape
codes. It provides codes for diacritics, which are modifying character marks

4–42 Managing Directory and File Sharing

Managing Directory and File Sharing
4.4 Unicode and Extended Character Sets
(such as the tilde (~)) that are used in conjunction with base characters to
encode accented or vocalized letters (for example, ñ).
As an overview of character sets, codes, and encoding, the simplest and most
widely known example is the 7-bit ASCII character set. The character codes
defined by the ASCII standard assigns positive integers or code numbers,
consecutively, to an ordered set of 128 characters. The character set includes
the writable letters of the English alphabet (A to Z, and a to z), the digits
(0 to 9), the space character, and the punctuation and symbols found on the
standard English keyboard, plus several control characters (such as linefeed
(LF) and escape (ESC)). The ASCII standard specifies a character encoding in
which each code number is assigned a unique 8-bit character with the same
value. (Although ASCII uses 7 bits, the encoding refers to 8-bit characters
because all standard computers are designed to handle 8-bit bytes.) Octets
(code values or positions) 128 through 255 are not used in ASCII. Code values
0 to 31 and 127 do not correspond to printable characters. The ASCII character
set is a common denominator contained in all other common character sets.
The ASCII coding had many limitations. Previous to V7.3 of the Advanced
Server for OpenVMS, the only character set other than ASCII supported by
the file server on OpenVMS V7.2 systems was the 8-bit ISO Latin-1 character
set (ISO-8859-1). The ISO Latin-1 character set includes the ASCII characters
(occupying code positions 0 to 127) plus various accented characters and other
letters for writing languages of Western Europe, and some special characters
(these latter groups occupy positions 160 to 255; positions 127 through 160, as
well as 0 through 31, are reserved for control characters).
MS-DOS and Windows 3.1 developed language-specific character sets called
code pages to expand beyond the limitations of the ASCII set. They are ordered
sets of 255 characters with an 8-bit numeric index to represent each character.
Language-specific code pages were developed because the sum of characters
used in languages worldwide exceeds 255. All the language-specific code pages
overlay the same set of 8-bit representations. For example, a specific 8-bit
coding in a code page used for the English language can be used for another
character in a code page used for the Cyrillic language. An application has to
be set to interpret the codes in the context of the selected code page.
Each 8-bit index value or code position in a code page is called a code point
or code value. Most code pages, including those of the Advanced Server, map
characters 0 to 128 to the ASCII character set.
ISO 10646 is an international standard that defines thousands of characters.
Unicode is a standard that defines a character set and character code
compatible with ISO 10646, and also defines a character encoding. It includes
coding for virtually all character sets around the world. The Unicode encoding

Managing Directory and File Sharing 4–43

Managing Directory and File Sharing
4.4 Unicode and Extended Character Sets
UCS-2 presents each code number as a two-byte integer. It is the most common
Unicode set in use today.
A client computer that supports Unicode, or which is configured to use a code
page that is not related to a Western European language, can create files with
characters in the file name that are not part of the ISO Latin-1 character set.
However, any Advanced Server for OpenVMS previous to V7.3 could not store
files using these file names.
The latest version of the Advanced Server for OpenVMS file server can now
support certain Unicode characters or extended character sets that are foreign
to the Western European languages. The characters that the Advanced Server
for OpenVMS can support at any time depend on the language configured for
the server. Each language is associated with one of the ISO-8859 character
sets supported by the Advanced Server. Each ISO-8859 character set supports
one or more languages.
You can configure any one of over 40 languages. Table 4–10 lists each
configurable language and the associated client code page and ISO-8859
character set. Notice that two of these languages provide support for the Euro
currency symbol:
English (USA) + Euro
Western Europe + Euro.
For an up-to-date list of languages that are officially supported by the
Advanced Server, refer to the Software Product Description (SPD).
Table 4–10 Configurable Languages
Language

Code Page

Character Set

Afrikaans

CP850

ISO8859-1

Albanian

CP852

ISO8859-2

Basque

CP850

ISO8859-1

Belarussian

CP866

ISO8859-5

Bulgarian

CP866

ISO8859-5

Catalan

CP850

ISO8859-1

Croatian

CP852

ISO8859-2

Czech

CP852

ISO8859-2
(continued on next page)

4–44 Managing Directory and File Sharing

Managing Directory and File Sharing
4.4 Unicode and Extended Character Sets
Table 4–10 (Cont.) Configurable Languages
Language

Code Page

Character Set

Danish

CP850

ISO8859-1

Dutch

CP850

ISO8859-1

English (USA)

CP437

ISO8859-1

English (USA) + Euro

CP437

ISO8859-1-EURO

English (Other)

CP850

ISO8859-1

Faeroese

CP850

ISO8859-1

Finnish

CP850

ISO8859-1

French

CP850

ISO8859-1

French (Canada MS-DOS)

CP863

ISO8859-1

German

CP850

ISO8859-1

Greek

CP737

ISO8859-7

Greek (IBM)

CP869

ISO8859-7

Hebrew

CP862

ISO8859-8

Hungarian

CP852

ISO8859-2

IBM Cyrillic

CP855

ISO8859-5

Icelandic

CP850

ISO8859-1

Icelandic (MS-DOS)

CP861

ISO8859-1

Indonesian

CP850

ISO8859-1

Italian

CP850

ISO8859-1

Nordic L. (MS-DOS)

CP865

ISO8859-1

Norwegian

CP850

ISO8859-1

Polish

CP852

ISO8859-2

Portuguese

CP850

ISO8859-1

Portuguese (MS-DOS)

CP860

ISO8859-1

Romanian

CP852

ISO8859-2

Russian

CP866

ISO8859-5

Serbian (Cyrillic)

CP866

ISO8859-5

Serbian (Latin)

CP852

ISO8859-2

Slovak

CP852

ISO8859-2
(continued on next page)

Managing Directory and File Sharing 4–45

Managing Directory and File Sharing
4.4 Unicode and Extended Character Sets
Table 4–10 (Cont.) Configurable Languages
Language

Code Page

Character Set

Slovenian

CP852

ISO8859-2

Spanish

CP850

ISO8859-1

Swedish

CP850

ISO8859-1

Turkish

CP857

ISO8859-9

Ukrainian

CP866

ISO8859-5

Western Europe + Euro

CP850

ISO8859-1-EURO

The langagues and their associated ISO-8859 character sets are a subset of the
Unicode (UCS-2) character sets supported on OpenVMS ODS-5 disk structures.
As mentioned, you configure the Advanced Server to support one, and only one,
of the languages at a time.
Support of the extended character set characters makes available a broader
set of characters for objects manageable by the Advanced Server, including
file names, user names, group names, and file and print share names. Each
character set also applies to text strings (such as descriptions) that users can
specify when managing any of these objects. Windows NT-compatible Advanced
Server printer description and location fields support all Unicode characters.
(These characters are not supported in computer names, alias names, domain
names, and trusted domain names.)
Each character set maps the 8-bit code point values (0 to 255) to 16-bit UCS-2
(Unicode) characters, and thus are much more extensive than the standard
7-bit ASCII character set.

4.4.1 Requirements and Restrictions
Observe the following requirements and restrictions regarding the use of
extended character sets with the Advanced Server:
•

Compaq recommends that once you set a language to be used for the server,
you do not change it again.

•

The same language is used by all Advanced Servers in the same cluster.
The same language must be used by all Advanced Servers in the same
domain. In addition, Advanced Servers in a trust relationship should use
the same language.

4–46 Managing Directory and File Sharing

Managing Directory and File Sharing
4.4 Unicode and Extended Character Sets
•

Compaq recommends that clients be configured to support the same
language configured for the Advanced Server; otherwise, names containing
characters that are not supported by the server language might not appear
to clients as expected.

•

For an up-to-date list of languages that are officially supported by the
Advanced Server, refer to the Software Product Description (SPD).

4.4.2 Configuring Extended Character Sets
By default, the language of the Advanced Server is ‘‘English (USA)’’,
associated with character set ISO-8859-1. During the configuration procedure
(PWRK$CONFIG.COM), you can specify any one of over 40 languages, each
which maps to one of the nine supported ISO-8859 character sets. The Compaq
Advanced Server for OpenVMS Server Installation and Configuration Guide
explains how to configure the Advanced Server language. For an up-to-date
list of languages that are officially supported by the Advanced Server, refer to
the Software Product Description (SPD).
Although you can change the server’s language at any time (after stopping the
Advanced Server), Compaq recommends that once a choice is made, you do not
alter that choice. Certain objects might exist whose names include characters
that are not included in the new language that you select. After you select
a new language, PWRK$CONFIG converts all text strings in the Security
Account Manager (SAM), access control list (ACL), and share databases from
the old character set (for the previous language) to the new set (for the new
language). Note that for some languages, only the client code page value is
changed.
If any of these databases contain text strings that cannot be converted (that
is, object names that contain characters not included in the newly configured
Advanced Server language character set), the PWRK$CONFIG procedure
reverts to the set of databases that existed prior to conversion attempt. Error
messages will indicate the names that could not be converted, and the language
is reset to the original language. You must rename (or remove) the objects that
cannot be converted, and rerun PWRK$CONFIG to change the language.
All Advanced Servers in the same cluster will automatically share the same
language (they share the same registry database).
Each supported character set has an associated Locale file that defines the
casing rules specific to the character set and is consistent with ODS-5. The
Locale file for each character set is defined in the OpenVMS Registry as server
parameter value ServerLocale, in the following key:
SYSTEM\CurrentControlSet\Services\AdvancedServer\Parameters

Managing Directory and File Sharing 4–47

Managing Directory and File Sharing
4.4 Unicode and Extended Character Sets
Note that server Locale files contain casing rules that match the Unicode
rules used on OpenVMS ODS-5. The Locale files use the same character
classifications as defined by UTF8-20, for all characters in the Advanced Server
character set. (UTF8-20 defines an efficient method for encoding Unicode
characters. It optimizes the encoding of ASCII characters, which appear in the
majority of text-based communications.)

4.4.3 How the Advanced Server File Server Stores and Handles
Character Data
All text data sent between the Advanced Server and a client is in one of
two formats: Unicode (UCS-2) or a client code page (OEM code page). Usually,
Windows NT, Windows 95, Windows 98, and Windows 2000 clients use Unicode.
Earlier clients such as MS-DOS and Windows for Workgroups communicate
using a client code page.
When the file server receives data from a client, it converts the character data
from its source format to the file server’s character set. If any characters in the
source data cannot be converted (because the characters do not exist in the file
server’s character set), the server returns an error (ERROR_NO_UNICODE_
TRANSLATION) to the client and records an event log entry with event
number 1113. (Note that these errors should not occur in processes involving
the OpenVMS Registry and the Windows NT-compatible Remote Procedure
Calls (RPCs) supported by the Advanced Server, because these components
fully support Unicode (UCS-2).)
Once the character data is converted, it remains in the converted format for its
lifetime on the file server.
Character data in the various databases used by the Advanced Server,
including the SAM, ACL, and share databases, is stored in the file server’s
character set.
File names are stored in one of two formats, depending on the storage file
system: ODS-2 or ODS-5.
4.4.3.1 File Name Storage and Handling on ODS-2 Volumes
ODS-2 volumes do not support Unicode characters in file names. Therefore, the
Advanced Server file server resorts to storing characters in an escape-encoded
format by representing unsupported characters as a sequence of supported
characters in the form _XX, where XX represents a pair of hexadecimal
digits corresponding to the encoded character’s code point in the file server’s
character set.

4–48 Managing Directory and File Sharing

Managing Directory and File Sharing
4.4 Unicode and Extended Character Sets
Before the file server sends a file name from the ODS-2 volume to another
system, the file server converts the _XX escape sequence back to the file server’s
character set. If the code point in the file server’s code set at code point XX is
not defined, the escape sequence is not decoded. It is returned in the file name
as is.
Note
If you plan to configure one of the alternative languages supported by
the Advanced Server for OpenVMS (V7.3 and higher), and your ODS-2
disk device includes escape-encoded characters in file names, you must
convert all the file names, as explained in Section 4.5.2.2, Converting
File Names. Do this before configuring the new language.

4.4.3.2 File Name Storage and Handling on ODS-5 Volumes
On ODS-5 volumes, names are stored in either ISO-8859-1 or Unicode (UCS-2)
format. In general, Unicode is used, but if a file name is composed entirely of
ISO-8859-1 characters, the ISO-8859-1 format is used by the file system to save
space in the directory file.
Before the file server sends a file name from the ODS-5 volume to another
system, the file server converts the name from the ODS-5 format (ISO-8859-1,
or UCS-2) into the server’s character set, and then to either UCS-2 or the client
code page for MS-DOS or Windows for Workgroups.
If a file on the ODS-5 volume has a file name containing characters that cannot
be mapped to the Advanced Server character set (or to the client code page
for MS-DOS or Windows for Workgroups), the file server ignores the file name
and does not return it to the client system. For the client to access that file,
the file name must first be changed appropriately from OpenVMS. If the file
in question is contained in a directory that the client is attempting to delete,
the client will not be able to delete the directory until that file is deleted from
OpenVMS.

Managing Directory and File Sharing 4–49

Managing Directory and File Sharing
4.4 Unicode and Extended Character Sets

4.4.4 How to Change the Way ADMINISTER Commands Handle and
Display Extended Character Set Characters
To change the way ADMINISTER commands handle Unicode or extended
character set characters (code points) with values of hexadecimal 128 or
higher, use the new ADMINISTER SET MODE command with the appropriate
qualifiers. The SET MODE command also determines the OpenVMS parse
style for ADMINISTER commands entered at the DCL prompt. The qualifiers
can be the following:
•

/RAW
For terminals that support the ISO-8859-n character sets, the actual
extended character set characters in the Advanced Server’s character set
are used for input and output. The characters are not converted. If this
qualifier is set for a terminal that does not support ISO-8859-n character
sets, and filtering is not enabled, output will be unpredictable. Enable
filtering with the /OUTPUT qualifier.

•

/VTF7
Code point values that map to Unicode hexadecimal values 0080 to 00FF
(128 to 255 decimal) are input and displayed in the ^xx format, where xx is
a two-digit hexadecimal number. Code point values 0100 to FFFF (256 to
65,535 decimal) are input and displayed in the ^Uxxxx format, where xxxx
is a four-digit hexadecimal number.
Notice that the extended character set characters for Unicode values 0080
to 00FF (128 to 255 decimal) can be input in either of two different formats:
^xx and ^uxxxx, where xx and xxxx are two-digit and four-digit hexadecimal
numbers, respectively. Unicode values above 00FF (255 decimal) must be
entered in the ^uxxxx format.

•

/INPUT=mode
Sets only the input mode. The mode keyword can be one of the following:
Mode

Description

RAW

The input characters are handled as the actual characters in the
Advanced Server’s character set.

VTF7

The input characters are handled as VTF-7 characters.

Note that if the input and output modes differ, your command input might
appear in one format while being displayed in another.
•

/OUTPUT=mode

4–50 Managing Directory and File Sharing

Managing Directory and File Sharing
4.4 Unicode and Extended Character Sets
Specifies the output mode only. The mode keyword can be one of the
following:
Mode

Description

RAW

The output characters are displayed as the actual characters in
the Advanced Server’s character set.

VTF7

The output characters are handled as VTF-7 characters.

[NO]FILTER

Specifies whether output characters are filtered before being
output. If filtering is enabled (the default), the C1 character
codes (127 through 160 decimal) are converted to spaces before
being output. If filtering is not enabled (NOFILTER), output on
some terminals might be unpredictable.

Note that if the input and output modes differ, your command input might
appear in one format while being displayed in another.
4.4.4.1 How the Default Input and Output Modes Are Determined
Settings made with the SET MODE command are preserved until you log out
from the system. These settings will determine the default modes that take
effect each time you invoke the ADMINISTER command interface. If you have
not yet used the SET MODE command to change input or output mode settings
during your present system user login session, the defaults are determined by
the current OpenVMS DCL parse style. If the parse style is TRADITIONAL
(the OpenVMS default), ADMINISTER command input and output modes are
RAW; if the parse style is EXTENDED, ADMINISTER input and output modes
are VTF7.
You can set permanent defaults by inserting the appropriate SET MODE
command in your login command file. For example, to set input and output
modes to VTF7, with output unfiltered, enter the following command in your
LOGIN.COM file. The server does not have to be running for this command to
execute.
$ ADMINISTER SET MODE/VTF7/OUTPUT=NOFILTER
To determine the current modes in effect for ADMINISTER commands, use the
ADMINISTER SHOW MODE command, as described in Section 4.4.4.3, How
to Display the Current Mode Settings.

Managing Directory and File Sharing 4–51

Managing Directory and File Sharing
4.4 Unicode and Extended Character Sets
4.4.4.2 Examples: How Each Mode Affects ADMINISTER Command Input and Output
When output is set to RAW mode on a server using the Spanish language,
Spanish characters are displayed as shown in the following example (assuming
the terminal supports the ISO-8859-1 character set, which is used when the
Spanish language is configured). In this example, only the output is changed
to RAW. The default input here is VTF7. Note how the Spanish characters are
handled differently on input and output.
LAPLAYA\\VALENCIA> SET MODE/OUTPUT=RAW
LAPLAYA\\VALENCIA> SHOW SHARE ^BFESPA^F1OL /FULL
Shared resources on server "VALENCIA":
Name
Type
Description
------------ --------- ------------------------------------------------------¿ESPAÑOL
Directory
Path: USER1:[¿ESPAÑOL]
Connections: Current: 0, Maximum: No limit
RMS file format: Stream
Directory Permissions: System: RWED, Owner: RWED, Group: RWED, World: RE
File Permissions: System: RWD, Owner: RWD, Group: RWD, World: R
Share Permissions:
Everyone
Full Control
Total of 1 share
Note that when the input mode is VTF7, the extended character set characters
for Unicode hexadecimal values 0080 to 00FF (128 to 255 decimal) can be
input in either of two different formats: ^xx and ^uxxxx. Unicode hexadecimal
values above 00FF (255 decimal) must be entered in the ^uxxxx format.
The following example shows how certain code point values in the Spanish
language’s character set are displayed when the output is set to VTF7 mode.
LAPLAYA\\VALENCIA> SET MODE/OUTPUT=VTF7
SHOW SHARE ^BFESPA^F1OL /FULL
Shared resources on server "VALENCIA":
Name
Type
Description
------------ --------- ------------------------------------------------------^BFESPA^F1OL Directory
Path: USER1:[^BFESPA^F1OL]
Connections: Current: 0, Maximum: No limit
RMS file format: Stream
Directory Permissions: System: RWED, Owner: RWED, Group: RWED, World: RE
File Permissions: System: RWD, Owner: RWD, Group: RWD, World: R
Share Permissions:
Everyone
Full Control
Total of 1 share

4–52 Managing Directory and File Sharing

Managing Directory and File Sharing
4.4 Unicode and Extended Character Sets
4.4.4.3 How to Display the Current Mode Settings
To display the current input and output modes in effect, use the ADMINISTER
SHOW MODE command. In the following example, the input and output
modes are set to VTF7. Output is filtered.
LANDOFOZ\\TINMAN> SHOW MODE
Current mode settings:
Input: VTF7
Output: VTF7, FILTER

4.4.5 Creating Print Shares with Unicode Extended Characters
OpenVMS queue names support any uppercase and lowercase letters, digits,
the underscore (_), and dollar sign ($). When you create an Advanced Server
print share, specifying Unicode characters other than these supported
characters, the Advanced Server creates an OpenVMS queue using the
standard ODS-2 format for these characters: _ _XX, where XX is the 8-bit code.
Because OpenVMS restricts the length of queue names to 31 characters, the
length of Advanced Server print share names are restricted accordingly. For
example, seven characters is the maximum length for a print share name
consisting entirely of unsupported characters.

4.5 Using ODS-5 Disk Volumes in the Advanced Server
Environment
With OpenVMS Version 7.2-1 and higher, you can use the Extended File
Specifications feature to offer file system services that are compatible with
Windows 95, Windows 98, and Windows NT file systems. To take advantage
of the capabilities of Extended File Specifications, be sure to complete the
following steps:
1. Convert disk volumes that are used for storing shared directories and
files from the ODS-2 to ODS-5 file system. For instructions, refer to the
OpenVMS Guide to Extended File Specifications.
2. Convert existing shared files on those disk volumes. For instructions, refer
to the Compaq Advanced Server for OpenVMS Server Installation and
Configuration Guide.
Note
If you plan to configure one of the alternative languages supported
by the Advanced Server for OpenVMS (V7.3 and higher), and your
ODS-2 disk device includes escape-encoded characters in file names
(characters that are in the format _XX), you must convert all the file
Managing Directory and File Sharing 4–53

Managing Directory and File Sharing
4.5 Using ODS-5 Disk Volumes in the Advanced Server Environment
names, as explained in Section 4.5.2.2, Converting File Names. Do
this before configuring the new language. For information on language
support, see Section 4.4, Unicode and Extended Character Sets. For
information on configuring a new language for the server, refer to
the Compaq Advanced Server for OpenVMS Server Installation and
Configuration Guide.

To simplify share access, you may want to set up all shared disk volumes as
ODS-5 disk volumes.
The Advanced Server for OpenVMS, Version 7.3 or higher, can now support 8bit extended character set characters for a selected set of objects, as discussed
in Section 4.4, Unicode and Extended Character Sets.

4.5.1 Requirements for Using Extended File Specifications and
Extended Character Sets
To take advantage of Extended File Specifications and extended character sets,
your process must be enabled for Extended File Specifications and extended
character sets. By default, you cannot enter Extended File Specifications or
extended character set characters in DCL command lines. To enable Extended
File Specifications and extended character sets, enter the following command:
$ SET PROCESS/PARSE_STYLE=EXTENDED
Assuming the ADMINISTER SET MODE command has not been used
to change the mode settings during the current user login session, the
ADMINISTER interface will recognize that the process parse style was set
to EXTENDED and will then allow use of extended character set characters in
the ^Uxxxx and ^xx formats on input. For more information about using these
characters in the ADMINISTER command interface, see Section 4.4.4, How
to Change the Way ADMINISTER Commands Handle and Display Extended
Character Set Characters. For more information about using Extended File
Specifications and extended character sets at the DCL command level, refer to
the OpenVMS Guide to Extended File Specifications.
Depending on the type of client computer, file naming conventions on ODS-5
disk volumes differ from those on ODS-2 disk volumes as described in the
Section 4.5.2.5, Storing Files on ODS-5 Disk Volumes.

4–54 Managing Directory and File Sharing

Managing Directory and File Sharing
4.5 Using ODS-5 Disk Volumes in the Advanced Server Environment

4.5.2 Managing Shares on ODS-5 Disk Volumes
When ODS-5 disk volumes are used for client file access, you manage them the
same way you manage shares on ODS-2 disk volumes. In addition, you can:
•

Display shares and files on ODS-5 disk volumes using OpenVMS
commands and ADMINISTER commands.

•

Convert file names from ODS-2 encoding to ODS-5.

•

Display the type of disk volume (ODS-2 or ODS-5).

•

Specify file names for client-created files using DCL commands and
ADMINISTER commands.

The following sections describe the procedures for managing ODS-5 disk
volumes.
4.5.2.1 Displaying Shares and Files on ODS-5 Disk Volumes
As with ODS-2 volumes, you can display information about a share on an
ODS-5 volume — information such as the disk device on which the share is
stored, the current connections to that share, RMS file format, and permissions
— using the SHOW SHARES command with the /FULL qualifier. For example,
to display information about the share STATES, enter the following command:
LANDOFOZ\\TINMAN> SHOW SHARES STATES/FULL
Shared resources on server "TINMAN":
Name
Type
Description
------------ --------- ----------------------------------------STATES
Directory
Path: AABOUT$MDA1::[STATES]
Connections: Current: 1, Maximum: No limit
RMS file format: Stream
Directory Permissions: System: RWED, Owner: RWED, Group: RWED, World: RE
File Permissions: System: RWD, Owner: RWD, Group: RWD, World: R
Share Permissions:
Everyone
Full Control
Total of 1 share
You can display the files in a share on the ODS-5 disk volume, in the same
way as you would on an ODS-2 volume, using the ADMINISTER command
SHOW FILES. To display the contents of subdirectories as well, include the
/SUBDIRECTORIES qualifier. For example, if the share STATES is on an
ODS-5 disk volume, display the files in the directory [STATES.KANSAS], as
well as all files in all subdirectories by entering the following command:

Managing Directory and File Sharing 4–55

Managing Directory and File Sharing
4.5 Using ODS-5 Disk Volumes in the Advanced Server Environment
LANDOFOZ\\TINMAN> SHOW FILES STATES\KANSAS\* /SUBDIRECTORIES
Files in: \\TINMAN\STATES\KANSAS
FILE1.DAT
Permissions:
Administrators
Everyone
Server Operators
SYSTEM
Audit Events: (None specified)
Owner: Scarecrow

Full (All)
Change (RWXD)
Change (RWXD)
Full (All)

FILE2.DAT
Permissions:
Administrators
Everyone
Server Operators
SYSTEM
Audit Events:
Everyone
Owner: Scarecrow

Full (All)
Change (RWXD)
Change (RWXD)
Full (All)
Success
Failure
RW---RWXDPO

Total of 2 files
This example displays auditing, permissions, and owner information about
all files in the shared directory KANSAS in the share STATES, including
subdirectories.
4.5.2.2 Converting File Names
After a disk volume has been converted to ODS-5, it may contain file names
with ODS-2 escape-encoded characters. These file names should be converted
to the ODS-5 nonencoded character set, using the PWCONVERT utility, as
described in Compaq Advanced Server for OpenVMS Server Installation and
Configuration Guide.
4.5.2.3 Displaying the Disk Volume Type
To determine whether a specific disk volume is an ODS-5 disk volume, use the
OpenVMS command SHOW DEVICE/FULL command, as follows:
$ SHOW DEVICE MDA1:/FULL
Disk AABOUT$MDA1:, device type RAM Disk, is online, allocated, deallocate
on dismount, mounted, file-oriented device, shareable.
Error count
0 Operations completed 155
.
.
.
Volume Status: ODS-5, subject to mount verification, file high-water
marking, write-back caching enabled.

4–56 Managing Directory and File Sharing

Managing Directory and File Sharing
4.5 Using ODS-5 Disk Volumes in the Advanced Server Environment
$
The summary display line shows the type of disk volume (in this case, ODS-5).
4.5.2.4 Specifying File Names in ADMINISTER Commands
When you specify a file name as part of an ADMINISTER command line, you
can enter the file name as it appears on the client computer, assuming your
server is configured to support the same language as that supported on that
client, and your workstation or terminal are configured to support the client
language. Be sure to enclose the file name in quotation marks if it contains
a space or other nonalphanumeric characters (such as a question mark (?),
punctuation mark, and so forth). If the input mode is set to VTF7, you can
enter such file names without quotation marks, using the ^xx or ^uxxxx
formats for the special characters. For example, assuming the input mode is
set to RAW, you can change the file permissions of the file named My File.Txt
in the share LIONTAIL by entering the following ADMINISTER command:
LANDOFOZ\TINMAN>SET FILE \LIONTAIL\"My File.Txt" SCARECROW\PERMISSIONS=READ
If input mode is set to VTF7, you would enter the space character as ^_ or ^20
(20 is the hexadecimal representation for the space character).
For information on entering such file names on the OpenVMS DCL command
line, see the appropriate OpenVMS documentation.
4.5.2.5 Storing Files on ODS-5 Disk Volumes
When clients store files on ODS-5 disk volumes, the length and characters
included in the file name depend on the limitations of the software that created
the file. For example, on MS-DOS clients, file names are limited to the ‘‘8.3’’
convention: file names can be no longer than eight characters, there must
be one period to separate the file name from the file extension, and the file
extension can be up to three characters. Therefore, MS-DOS clients do not
take advantage of the full capabilities of the ODS-5 disk volume. ODS-5 disk
volumes (as well as ODS-2) support these types of files.
Windows 95, Windows 98, Windows 2000, and Windows NT clients can write
longer file names, which may contain more than one period, and have file
extensions of any length within the file name length limit. Therefore, Windows
95, Windows 98, Windows 2000, and Windows NT clients take advantage of the
features of ODS-5 disk volumes.

Managing Directory and File Sharing 4–57

Managing Directory and File Sharing
4.5 Using ODS-5 Disk Volumes in the Advanced Server Environment
4.5.2.5.1 MS-DOS and Windows File Naming If you are using the Advanced
Server in an environment where long file names are not always supported,
users should continue using MS-DOS file naming conventions. For example,
if your clients are running Windows 3.11, or older Windows applications that
only recognize the 8.3 file format, file names should follow the 8.3 file-naming
convention; if your clients are running Windows 95, Windows 98, or Windows
2000, they can use long file names.
On MS-DOS, Windows NT, Windows 95, Windows 98, and Windows 2000
clients, the following names are reserved and cannot be used for files or
directories on either ODS-5 or ODS-2 disk volumes: AUX, COM1, COM2,
COM3, COM4, CON, LPT1, LPT2, LPT3, NUL, and PRN.
On Windows NT, Windows 95, Windows 98, and Windows 2000 clients, file
names preserve uppercase and lowercase characters, but are not case sensitive.
This behavior is supported on ODS-5 volumes, and to some extent on ODS-2
volumes.
For more details on file naming conventions supported by each type of client,
refer to the appropriate documentation for that client operating system.

4.6 File Names for Files Stored on the Advanced Server
The conventions for file names on ODS-5 disk volumes are more liberal than for
those on ODS-2 disks, as outlined in Section 4.6.1, File Naming Conventions:
ODS-2 and ODS-5 Comparisons. In addition, to enable compatibility with
legacy applications (such as MS-DOS) whose file naming conventions are
more restricted than those used by the Advanced Server, Advanced Server for
OpenVMS servers, Version 7.3 or later, automatically create alias file names
for files whose names do not comply with the file naming standards of those
applications. For more information on alias file names, see Section 4.6.2,
Support of Alias File Names.
The language configured for the Advanced Server defines the character set and
client code page to be used by the server for storing file names on either ODS-2
and ODS-5 volumes. For information on how to configure the server language,
refer to the Compaq Advanced Server for OpenVMS Server Installation and
Configuration Guide. Parameters that set up the server language are described
in Appendix A, Server Configuration Parameters.
The Advanced Server allows client computers to create, access, or delete any
file whose file name characters map to the language currently configured on
the server. If the client computer attempts to create, for example, a file whose
name includes characters that are not contained in the server’s currently
configured language, the client computer receives an error message such as

4–58 Managing Directory and File Sharing

Managing Directory and File Sharing
4.6 File Names for Files Stored on the Advanced Server
the following, where filename.ext is the file name consisting of one or more
characters not contained in the current server language:
Cannot copy filename.ext: No mapping for the Unicode character exists in
the target multi-byte code page.

4.6.1 File Naming Conventions: ODS-2 and ODS-5 Comparisons
File naming conventions for files stored on the Advanced Server depend on
whether the disk volume used for storing files is an ODS-2 disk volume or an
ODS-5 disk volume.
The Advanced Server uses the file naming conventions shown in Table 4–11,
Advanced Server File-Naming Conventions. For each aspect of file names, the
table shows the conventions supported by each type of OpenVMS file system.
Table 4–11 Advanced Server File-Naming Conventions
Convention

Supported on ODS-2

Supported on ODS-5

File name length

Up to 78 characters, including
the extension (39.39 format).
Separate the extension from the
name by using a period.1

Up to 236 8-bit (Latin-1)
characters (or 118 16bit Unicode characters),
including the extension.
Separate the extension
from the name by using a
period.

File names can contain
characters other than (A-Z, a-z,
0-9), dollar sign ($), underscore
(_) and hyphen (-).

Yes

1 When clients store files whose names include spaces or nonalphanumeric characters (such as Unicode

characters not included in the standard character sets), the length of a file name on an ODS-2 volume is
limited further: Each such character takes up four characters on the disk volume.

(continued on next page)

Managing Directory and File Sharing 4–59

Managing Directory and File Sharing
4.6 File Names for Files Stored on the Advanced Server
Table 4–11 (Cont.) Advanced Server File-Naming Conventions
Convention

Supported on ODS-2
2

Supported on ODS-5

File names can contain any of
the 8-bit characters of the ISO
Latin-1 character set in addition
to the alphanumeric characters
described in the preceding
row, with the exception of the
following characters: C0 control
codes (0x00 to 0x1F inclusive)
Double quotation marks (")
Asterisk (*)
Backslash (\ )
Colon (:)
Left angle bracket (<)
Right angle bracket (>)
Slash (/)
Question mark (?)
Vertical bar ( | )

Yes

Any OpenVMS system file or
directory name that contains
excluded characters is neither
visible nor accessible by the
client.

Yes

On-disk character support

Characters that are not
alphanumeric characters are
stored with escape encoding.
For more information, see
Section 4.4.3.1, File Name
Storage and Handling on ODS-2
Volumes.

All supported characters
are stored without
encoding. Some ISO
Latin-1 characters
require an escape
character to precede them
in a file specification in
order to be interpreted as
literal characters rather
than special function
characters.

Uppercase and lowercase
characters are allowed

Yes; however, file names are
stored in all uppercase.

Yes: file names are stored
in mixed case; however,
file name comparisons are
not case sensitive.

2 Characters that are not in the set listed in the previous row are encoded as _ _XX, where XX is the 8-bit code.

4–60 Managing Directory and File Sharing

Managing Directory and File Sharing
4.6 File Names for Files Stored on the Advanced Server

4.6.2 Support of Alias File Names
Some clients and client applications are more restrictive than the Advanced
Server and Windows NT in both the lengths of file names and in the set of
valid characters supported for file names. For example, MS-DOS file names
are limited to the ‘‘8.3’’ convention: file names can be no longer than eight
characters, with a period separating the file name from the file extension, and
the file extension can be up to three characters. Obviously, these applications
do not take full advantage of the capabilities of the OpenVMS ODS-5 disk
volume and longer file names supported on Windows NT, the Advanced Server,
and other systems.
To maintain compatibility between MS-DOS clients and Windows NT, and
between legacy applications and Windows NT, the Windows NT Server provides
an alternate way of accessing files with names that are not compatible with
MS-DOS conventions. Windows NT generates MS-DOS-compatible alias names
for these files.
Beginning with Version 7.3 of the Advanced Server for OpenVMS, the
Advanced Server file server now also creates MS-DOS-compatible alias file
names for shared files whose names do not conform to the MS-DOS format.
As a result, client applications that must use, or choose to use, the MS-DOS
format for file names, can access these shared files on the server by using the
file’s associated alias name. Clients (depending on their file systems) can use
either the real file name or the alias file name to access the file.
Note
Alias file names are usually used by client applications. Users will
seldom need to use them.

An alias file name is also created for any file whose real name contains any
extended character set characters with values of 128 through 255 (hexadecimal
0080 through 00FF). This is done even when the real filename is MS-DOScompatible (has the 8.3 format and contains no characters that are explicitly
invalid in MS-DOS file names). The Advanced Server V7.3 for OpenVMS
returns a file’s alias name, instead of the real file name, to an MS-DOS client
only if the real name is not MS-DOS-compatible, or if any extended character
set character in the real name does not map to the client code page. Otherwise,
the Advanced Server returns the file’s real name to the MS-DOS client. For
more information on support of extended character sets, see Section 4.4,
Unicode and Extended Character Sets.

Managing Directory and File Sharing 4–61

Managing Directory and File Sharing
4.6 File Names for Files Stored on the Advanced Server
4.6.2.1 Advanced Server Alias File Names
The Advanced Server alias file names are functionally equivalent to the alias
names generated by the Windows NT Server in that each alias file name:
•

Is MS-DOS compatible

•

Is unique among all file names, real or alias, within the parent directory

•

Positively identifies the associated file

•

Has a first character and an extension derived from the real file name

For generating its alias file names, the Advanced Server uses a different
algorithm than does Windows NT; consequently, the alias file names generated
by the Advanced Server do not resemble alias file names generated by the
Windows NT Server. An Advanced Server alias file name always includes
an eight-character base, and includes an extension of the same length as the
original extension, if any, up to three characters. The first character and
extension of the alias file name are derived from the real file name and its
extension, substituting an underscore (_) for any such character that is not
MS-DOS-compatible.
4.6.2.2 Example Listing Showing Alias File Names
The following example shows an MS-DOS directory listing that includes alias
file names generated for MS-DOS compatibility. In this example:
•

The first file name listed, 12345678.123, has a standard length (8.3 or
less) with no invalid or extended characters, and so no alias file name is
generated.

•

The name of the second file, 123456789.1234, is longer than the standard,
so the alias file name 14AD1’HA.123 is created.

•

The name of the third file (LONG FILENAME) exceeds the standard length
and also includes an invalid character (the space) for an MS-DOS file name.
The alias file name (L1JKGVAM) does not include an extension because the
original file name does not have an extension.

•

The fourth file name (ESPAÑOL.PS) follows the 8.3 format but contains an
extended character set character (Ñ). The alias file name (E0G(4B%3.PS)
includes the same extension as the original name.

•

The fifth file name listed (X.1+345678) has an extension that exceeds the
standard length and includes a character (+) that is not compatible with
MS-DOS. Accordingly, the alias file name extension includes an underscore
(_) for the incompatible character.

4–62 Managing Directory and File Sharing

Managing Directory and File Sharing
4.6 File Names for Files Stored on the Advanced Server
•

The last file name (+.+) includes an incompatible character in the name
and extension. The alias file name generated for this file has an underscore
in its name and extension.

F:\DEMO>dir/x
Volume in drive F is USER1
Volume Serial Number is 0000-0001
Directory of F:\DEMO
03/01/00
08/31/99
08/31/99
08/31/99
08/31/99
08/31/99
08/31/99
08/31/99

01:14p
<DIR>
04:14p
<DIR>
04:30p
16
04:30p
16 14AD1’HA.123
04:30p
16 L1JKGVAM
04:30p
16 E0G(4B%3.PS
04:30p
16 X2$’XC‘R.1_3
04:30p
16 _0XY8I@H._
8 File(s)
2,144 bytes
215,788,032 bytes free

.
..
12345678.123
123456789.1234
LONG FILENAME
ESPAÑOL.PS
X.1+345678
+.+

Managing Directory and File Sharing 4–63

5
Managing Printers, Print Queues, and Print
Shares
Advanced Server software lets you share printers connected to the network
(accessible from the OpenVMS system). You can create an Advanced Server
print share for any OpenVMS print queue and assign access permissions to
that share. Users can then send print jobs to the queue specified by the share
as though they were using a local printer.
The procedures you use to manage shared printers are described in this
chapter:
•

Section 5.1, OpenVMS Print Queues, describes OpenVMS print queues and
explains how to create and manage them.

•

Section 5.2, Planning Printer Services, explains how to plan printer
services to meet client needs.

•

Section 5.3, Managing Printers, Print Shares, and Print Jobs, explains how
to manage printers, print shares, and print jobs:
–

Section 5.3.1, Setting Up a New Printer, explains how to set up
network printers on the server.

–

Section 5.3.2, Managing Printers Using the Advanced Server
ADMINISTER Command-Line Interface, explains how to manage
printers by using the ADMINISTER command interface.

–

Section 5.3.3, Managing Advanced Server Printers Using Windows NT,
explains how to manage printers, print queues, and print shares on the
Advanced Server by using the Windows NT print services provided by
a Windows NT Server or workstation.

The Advanced Server makes printers available to network users through
shared print queues. A print queue stores print jobs as users submit them.
When a printer associated with the queue becomes available, the Advanced
Server routes a job to that printer.

Managing Printers, Print Queues, and Print Shares 5–1

Managing Printers, Print Queues, and Print Shares

To share a printer, you add the printer (print queue) to the server’s share
database. You can use ADMINISTER commands to add a print queue and set
it up for sharing. You assign the share name to a queue that points to the
printer. Alternatively, you can use Windows NT to add printers and to allow
them to be shared.
Because the Advanced Server is based on the OpenVMS operating system, the
print queues and the printers that you share can be OpenVMS print queues
and printers. However, note that the characters valid for Advanced Server
print share or print queue names are not restricted to those supported by
OpenVMS queues and printers. Advanced Server print share and print queue
names can include Unicode extended characters, for example. For information
on restrictions that do apply to print share names containing Unicode extended
characters, see Section 5.3.2.7.2, Creating Print Shares With Names That
Include Unicode Extended Characters.
This chapter explains how to share printers that are connected to the network,
accessible from the OpenVMS system.

5.1 OpenVMS Print Queues
OpenVMS systems use execution queues and generic queues to provide access
to printers as follows:
•

One or more execution queues can be created for each printer.

•

One or more generic queues can point to multiple execution queues and,
therefore, multiple printers.

•

Print jobs can be submitted either to a generic queue or to an execution
queue.

You can use any of the following methods to create and manage OpenVMS
print queues:
•

OpenVMS commands such as INITIALIZE/QUEUE, which can be used
to create execution queues or generic queues, and SET QUEUE, which
modifies the attributes of the created queue.

•

Advanced Server ADMINISTER commands such as ADD PRINT QUEUE
and SET PRINT QUEUE, which primarily do the same as the OpenVMS
INITIALIZE/QUEUE and SET QUEUE commands.

•

Windows NT print services from a remote Windows NT system, as
described later in this guide. Note that Windows NT views an OpenVMS
execution queue as a port. You can only use Windows NT print services
to create Advanced Server shared printers that are associated with an
existing port. Likewise, you can only use ADMINISTER commands to

5–2 Managing Printers, Print Queues, and Print Shares

Managing Printers, Print Queues, and Print Shares
5.1 OpenVMS Print Queues
add a print queue that is associated with an existing OpenVMS execution
queue. You cannot create a new port or OpenVMS execution queue using
ADMINISTER commands or Windows NT print services. You must use
OpenVMS to create a new port or execution queue. For a conceptual
discussion of the differences between managing printers using Advanced
Server ADMINISTER commands and using Windows NT print services,
refer to the Compaq Advanced Server for OpenVMS Concepts and Planning
Guide.
Refer to the OpenVMS System Manager’s Manual for information about setting
up print queues on OpenVMS systems.

5.1.1 Types of Advanced Server Print Queues
An Advanced Server print queue can be either of the following:
•

A printer queue pointing directly to a physical printer. A printer queue is
equivalent to an OpenVMS execution queue.

•

A routing queue that points to one or more printer queues. A routing
queue is equivalent to an OpenVMS generic queue.

5.2 Planning Printer Services
To support the printing needs of your users, plan print queues and print shares
to meet their requirements. You can set up printers as shared devices, and you
can establish constraints on print queues.

5.2.1 Sharing Printers and Print Queues
The way you make printers available to Advanced Server users depends on
your server installation and whether you want to share existing OpenVMS
print queues or create new ones.
•

If you have installed Advanced Server software on a server for the first
time and the printer you want to share has an existing OpenVMS queue,
you can share that queue or create and share a new queue. You can
display existing print queues using the ADMINISTER SHOW PRINT
QUEUE command. You must define an Advanced Server print share
for every OpenVMS print queue that you want Advanced Server users
to access. Section 5.3.2.7.1, Creating an Advanced Server Print Share,
explains how to set up and define a print share, using the Advanced Server
ADMINISTER command interface. Section 5.3.3.2, Using Windows NT
Print Services to Share Printers Defined on the Advanced Server, explains
how to use Windows NT print services to share a printer defined on the
Advanced Server.

Managing Printers, Print Queues, and Print Shares 5–3

Managing Printers, Print Queues, and Print Shares
5.2 Planning Printer Services
•

If the printer you want to share does not have an existing OpenVMS print
queue, you can create one using the procedure in Section 5.3.1, Setting Up
a New Printer.

Advanced Server users access the print queue by specifying a print share.
To make a print share operational, a print queue must be established first. To
establish both a print queue and a print share, first set up the print queue,
then set up the print share.
With the ADMINISTER interface, you create a print share so that users can
send print requests to the print share rather than to individual print queues.
For access from Windows NT, Windows 95, Windows 98, and Windows 2000
clients that will print to a Advanced Server shared print queue, the share
name and the queue name must be the same; for other clients, like Windows
3.11, the share and queue name can be different. Multiple print shares can
point to the same print queue.
The Advanced Server print queue name (or, from the perspective of Windows
NT management, the printer name) is limited to no more than 12 characters.
If the OpenVMS print queue name has more than 12 characters, you can define
an OpenVMS logical name for the print queue, to translate the queue name.
You might use a logical name that is the same as the share name.
For example, the following OpenVMS command defines a logical name
GLENDA for the OpenVMS print queue GLENDASPRINTER:
$ DEFINE/SYSTEM GLENDA GLENDASPRINTER
Then, when you use ADMINISTER commands, you can use the logical name to
specify the print queue when you create a print share for it.

5.3 Managing Printers, Print Shares, and Print Jobs
By default, you manage printers, print shares, and print jobs by using the
ADMINISTER command-line interface. You can choose to manage server
shared printers remotely from a Windows NT Server or workstation, using
the Windows NT print services, including the easy-to-use Windows NT Print
Manager dialog boxes.
If you prefer the ADMINISTER command-line interface and the way you
have worked with shared printers on the Advanced Server in the past, you
can continue using the ADMINISTER command-line interface for print queue
management.

5–4 Managing Printers, Print Queues, and Print Shares

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
If you prefer the advantages that Windows NT printer management offers,
then you might consider enabling that style of management when you configure
your server. Whichever style you choose, you only have full functionality from
the style chosen. Earlier versions of the Advanced Server for OpenVMS
have always supported elementary management functions from Windows
NT, such as pausing, deleting, and displaying print jobs, and this support is
still available on the latest Advanced Server for OpenVMS if you maintain
the default of using ADMINISTER commands to manage server printers.
Likewise, if you configure the Advanced Server to support Windows NT
printer management, you can still use ADMINISTER commands for several
minor printer management functions, and you can continue to use all the
ADMINISTER commands for managing other objects (users, groups, file
shares, and so forth). However, you should not use the following commands:
ADD SHARE/PRINT
REMOVE PRINT QUEUE
SET PRINT QUEUE
The concepts, terminology, and procedures used for managing Advanced
Server shared printers differ significantly for each style of management. The
management of shared printers with the ADMINISTER command involves
creating a print queue (ADD PRINT QUEUE command), defining it as either
a printer queue (OpenVMS execution queue) or a routing queue (OpenVMS
generic queue), and then creating a share for that queue.
Basic first-step management of shared printers with the ADMINISTER
command involves:
1. Creating a print queue using the ADD PRINT QUEUE command, defining
it as either a printer queue (OpenVMS execution queue) or a routing queue
(OpenVMS generic queue)
2. Creating a share for that queue, using the ADD SHARE/PRINT command.
With Windows NT-style management, you manage printers, printer ports, print
queues, and the associated parameters defined in each printer’s OpenVMS
Registry entry. You use the Add Printer Wizard to add a printer to the server.
The Add Printer Wizard allows you to select such options as whether:
•

To enable printer pooling — a printer pool, similar to an Advanced Server
routing queue or OpenVMS generic queue, is a group of printers connected
to a server; when a print job is sent to the server, it goes to the first
available printer in the pool.

•

To share the printer, and the name of the share

Managing Printers, Print Queues, and Print Shares 5–5

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
For more understanding about the conceptual and functional differences
between ADMINISTER and Windows NT printer management, refer to the
Compaq Advanced Server for OpenVMS Concepts and Planning Guide.
Some of the advantages of using Windows NT-style printer management
include the following:
•

Simple management of Advanced Server shared printers by using the
Windows NT print services dialog boxes.

•

When adding a printer to the Advanced Server, the Windows NT Add
Printer Wizard installs the required drivers for the printer on the server;
these drivers are provided by the administrator (such as from the Windows
NT installation CD-ROM). When a client is set up to use the printer, these
drivers are available for downloading to the client computer. When new
drivers are distributed, administrators have to update a single location
only.

•

Use of Windows NT access permissions for Advanced Server shared
printers.

•

When Windows NT printer management is enabled, printers or print
queues that were already defined on the server are upgraded automatically
so that clients can continue to share these printers; but the upgrade does
not provide full Windows NT printer management functionality for these
upgraded printers. To acquire full Windows NT printer management
functionality, use Windows NT print services to delete the upgraded
Advanced Server printers from the Advanced Server and then add the
printers back onto the Advanced Server.

To enable remote management of Advanced Server printers from Windows NT,
you must reconfigure the server and change the appropriate configuration
setting. For information on enabling remote Windows NT printer management,
refer to the Compaq Advanced Server for OpenVMS Server Installation and
Configuration Guide. For information on how to manage Advanced Server
printers, print queues, and print shares from Windows NT, see Section 5.3.3,
Managing Advanced Server Printers Using Windows NT.
For a list of restrictions that apply when Windows NT printer management is
enabled, see Section 5.3.3.5, Windows NT Printer Management Restrictions.

5–6 Managing Printers, Print Queues, and Print Shares

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs

5.3.1 Setting Up a New Printer
The information in this section applies only to printers supported by the
OpenVMS operating system. If you start with no OpenVMS queue and create
an Advanced Server print queue, the Advanced Server creates the OpenVMS
print queue.
To set up a new printer to make it available to Advanced Server clients:
1. Connect the printer to your server or network. Refer to your printer
documentation for physical connection information. See Section 5.3.1.2,
Connecting Your Printer, for information about specifying printer
connections to OpenVMS systems.
2. If Windows NT printer management is enabled on your server, add printers
and set them up for sharing on the server by using the Windows NT print
services, as explained in Section 5.3.3, Managing Advanced Server Printers
Using Windows NT. Skip the remaining steps listed below in this section.
If Windows NT printer management is not enabled, use the ADMINISTER
interface to:
a. Create a printer queue for the printer, as described in Section 5.3.1.3,
Creating an Advanced Server Print Queue Using ADMINISTER
Commands.
b. Create a routing print queue (optional), as described in Section 5.3.1.3,
Creating an Advanced Server Print Queue Using ADMINISTER
Commands.
c. Create a print share for the queue, as described in Section 5.3.2.7.1,
Creating an Advanced Server Print Share.
5.3.1.1 Printer Types
To share a PostScript printer, selected PostScript printers might require use
of the DECprint Supervisor for OpenVMS (DCPS) software for communication
with the printers over DECnet or TCP/IP. In this case, use DCPS to create the
queue. Then set up the queue as an Advanced Server print share.
If Windows NT printer management is enabled on your server, set up the
printer for sharing, as explained in Section 5.3.3.2, Using Windows NT Print
Services to Share Printers Defined on the Advanced Server; otherwise,
use the ADMINISTER ADD SHARE/PRINT command, as explained in
Section 5.3.2.7.1, Creating an Advanced Server Print Share.
Printers supported by Advanced Server software include:
•

All printers supported by OpenVMS

Managing Printers, Print Queues, and Print Shares 5–7

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
•

PostScript printers supported by DECprint Supervisor for OpenVMS
software

To use the Advanced Server ADMINISTER command interface to display the
printers that are supported, enter the following command:
LANDOFOZ\\TINMAN>HELP ADD PRINT QUEUE /TYPE
If you have Windows NT-style printing enabled, the Advanced Server supports
any printers supported by the Windows NT computer from which you add the
printer. The required drivers for the printer must be available. These drivers
are provided by the administrator (such as from the Windows NT installation
CD-ROM), and are installed by Windows NT when the printer is added.
5.3.1.2 Connecting Your Printer
When you connect your printer, make a note of the printer type and the name
of the physical device or port to which it is connected.
The list of physical device connectors or ports includes, but is not limited to:
•

OPxn

•

TTxn

•

TXxn

•

LTxnnn

For example, the type of printer may be a DL3200 (a DEClaser 3200), and the
physical device or port to which it is connected may be LTA201.
5.3.1.3 Creating an Advanced Server Print Queue Using ADMINISTER Commands
A print queue can be either a printer queue associated with a physical printing
device, or a routing queue that routes print requests to one or more print
queues. Typically, a routing queue points to a group of printers that have
similar characteristics. You could also set up several print queues for the
same printer. This might be useful if you want to set up different print queue
characteristics for a printer.
To create queues for printers on your server, you must be logged on to a user
account that is a member of one of the following groups:
•

Administrators

•

Server Operators

•

Print Operators

5–8 Managing Printers, Print Queues, and Print Shares

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
To create a printer queue or routing queue, use the ADD PRINT QUEUE command. Use the SET PRINT QUEUE command to change the characteristics of
an existing queue.
For each Advanced Server queue, you must specify whether it is a printer
queue or a routing queue. For a printer queue, you can specify the printer
device type and the port to which the printer is connected to the OpenVMS
system. For a routing queue, you can specify one or more printer queues to
which the print jobs in the routing queue will be sent.
For example, the following command creates a printer queue called GLENDA1
for the DEClaser 3200 printer that is connected to LTA201:
LANDOFOZ\\TINMAN> ADD PRINT QUEUE GLENDA1 /PRINTER=LTA201_LANDOFOZ\\TINMAN> /TYPE=DL3200
%PWRK-S-QUEADD, queue "GLENDA" added on server "TINMAN"
The following command sets up or establishes the routing queue called
GLENDA. Print jobs sent to GLENDA go to either of the two printer queues,
GLENDA1 or GLENDA2. The description of the routing queue is "Glenda’s
routing queue."
LANDOFOZ\\TINMAN> ADD PRINT QUEUE GLENDA /ROUTE_TO=(GLENDA1,GLENDA2) _LANDOFOZ\\TINMAN> /DESCRIPTION="GLENDA’s routing queue"
%PWRK-S-QUEADD, queue "GLENDA" added on server "TINMAN"
LANDOFOZ\\TINMAN>
5.3.1.4 Creating a Printer Using Windows NT Print Services
Use the Windows NT Add Printer Wizard to create a printer to be shared by
the Advanced Server, as explained in Section 5.3.3.1, Using Windows NT Print
Services to Manage Advanced Server Printers.

5.3.2 Managing Printers Using the Advanced Server ADMINISTER
Command-Line Interface
This section provides information about displaying, modifying, and managing
print queues from the Advanced Server, using the ADMINISTER command
interface. To manage print queues, you must be logged on to a user account
that is a member of one of the following groups:
•

Administrators

•

Server Operators

•

Print Operators

There are no special requirements for displaying print queue information.

Managing Printers, Print Queues, and Print Shares 5–9

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
5.3.2.1 Displaying Print Queue Information, Using ADMINISTER Commands
Using the SHOW PRINT QUEUE command, you can display a list of the
server’s print queues, information about a specific queue, or information about
the print jobs in each queue. To display information about the print queues on
a server, use one of the following procedures.
5.3.2.1.1 Displaying Information About All Print Queues on a Server To
display information about all print queues on a server, use the SHOW PRINT
QUEUES command, as in the following example:
LANDOFOZ\\TINMAN> SHOW PRINT QUEUES
Name
Jobs Status
---------------- ------ -----User_PRNT
2
destination
paused
GLENDA
0
PAUSED

Printer/Routing
--------------LRA0:GENERIC

Description
--------------

LANDOFOZ\\TINMAN>
The Advanced Server displays, in tabular form:
•

Queue name

•

Number of jobs in the queue

•

Queue status

•

If a printer queue, ‘‘printer device:printer type’’; if a routing queue, the list
of printer queues to which print jobs are routed

•

The queue description

If a job is currently printing from a given queue, an additional line is displayed
that contains the job ID (job identification number), the user name that queued
the print job, and the status of the print job.
5.3.2.1.2 Displaying Information About a Single Print Queue To display
information about a single print queue, specify the queue name with the
SHOW PRINT QUEUE command, as in the following example:
LANDOFOZ\\TINMAN> SHOW PRINT QUEUE TOTO
Name
Jobs
Status
Printer/Routing
--------------------------------------TOTO
1
printing
LRA0:GENERIC

Description
----------------

LANDOFOZ\\TINMAN>
The Advanced Server displays the queue name and status of the queue and the
number of print jobs currently in the queue.

5–10 Managing Printers, Print Queues, and Print Shares

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
5.3.2.2 Changing the Printer Type, Using ADMINISTER Commands
Specify the type of printer supported by a shared print queue using the SET
PRINT QUEUE command with the /TYPE qualifier. For example, the following
command sets the print queue TOTO to support a DEClaser 3200 printer:
LANDOFOZ\\TINMAN> SET PRINT QUEUE TOTO/TYPE=DL3200
%PWRK-S-QUESET, characteristics set for queue "TOTO" on server "TINMAN"
LANDOFOZ\\TINMAN>
5.3.2.3 Pausing a Print Queue, Using ADMINISTER Commands
You can hold or pause a print queue; this prevents the queue from sending any
jobs to printers. When you do this, printers associated with the queue finish
printing their current jobs, but all further jobs stay in the queue until the
queue is released.
To pause a print queue, use the PAUSE PRINT QUEUE command, as in the
following example:
LANDOFOZ\\TINMAN> PAUSE PRINT QUEUE TOTO
Do you really want to pause print queue "TOTO" [YES or NO] (YES) : YES
%PWRK-S-QUESET, queue "TOTO" paused on server "TINMAN"
LANDOFOZ\\TINMAN> SHOW PRINT QUEUE
Name
Jobs Status
---------- ----- -----------------BRUCE_PRNT
0 destination paused
PARSIFAL
0 ACTIVE
TOTO
0 PAUSED

Printer/Routing
--------------LRA0:GENERIC
BRUCE_PRNT
BRUCE_PRNT

Description
---------------Printer in the
Land of Oz

LANDOFOZ\\TINMAN>
You can also pause a print queue with the SET PRINT QUEUE/PAUSE
command. In the following example, the queue called BRUCE_PRNT is a
printer queue that points to a physical device, LRA0:GENERIC, and the
queues GLENDA and TOTO are routing queues that point to the printer queue
BRUCE_PRNT.
LANDOFOZ\\TINMAN> SET PRINT QUEUE TOTO/PAUSE
%PWRK-S-QUESET, queue "TOTO" paused on server "TINMAN"
LANDOFOZ\\TINMAN> SHOW PRINT QUEUE
Name
Jobs Status
-------------- -----------------BRUCE_PRNT
0 destination paused
GLENDA
0 ACTIVE
TOTO
0 PAUSED

Printer/Routing
--------------LRA0:GENERIC
BRUCE_PRNT
BRUCE_PRNT

Description
-----------Printer in the
Land of Oz

LANDOFOZ\\TINMAN>

Managing Printers, Print Queues, and Print Shares 5–11

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
5.3.2.4 Continuing a Print Queue, Using ADMINISTER Commands
After you have paused a print queue, you can continue printing on the queue,
returning it to normal status. Continuing a queue that is in an error condition
clears the error. Use the SET PRINT QUEUE /CONTINUE command, as in
the following example:
LANDOFOZ\\TINMAN> SET PRINT QUEUE TOTO/CONTINUE
%PWRK-S-QUESET, queue "TOTO" continued on server "TINMAN"
LANDOFOZ\\TINMAN>
This example continues a paused print queue. Any jobs that were waiting in
the paused print queue can now print.
5.3.2.5 Purging Print Jobs from a Print Queue, Using ADMINISTER Commands
You can purge a shared print queue; that is, you can delete all jobs in the
queue except the one currently printing. Use the SET PRINT QUEUE /PURGE
command, as in the following example:
LANDOFOZ\\TINMAN> SET PRINT QUEUE TOTO/PURGE
%PWRK-S-QUESET, queue "TOTO" purged on server "TINMAN"
LANDOFOZ\\TINMAN>
5.3.2.6 Deleting a Print Queue, Using ADMINISTER Commands
To remove an Advanced Server print queue from network access, use the
REMOVE PRINT QUEUE command. Removing the queue deletes the
OpenVMS queue, but does not remove any print shares assigned to the print
queue; these must be removed manually.
The following rules and restrictions apply to deleting print queues:
•

You can delete only queues created by the Advanced Server. You cannot
use ADMINISTER commands to delete a queue created by DECprint
Supervisor for OpenVMS or OpenVMS software.

•

Before deleting a printer queue (one that points directly to an OpenVMS
execution queue), you must execute the following commands, in the order
shown:
1. PAUSE PRINT QUEUE — to pause the print queue. Pausing the
queue is an OpenVMS restriction. You do not have to pause a routing
queue before deleting it. (When you use the REMOVE PRINT QUEUE
command to delete a print queue, the queue is not deleted until all jobs
in that queue complete.)
2. REMOVE PRINT QUEUE — to delete any routing queues that point to
the printer queue.

5–12 Managing Printers, Print Queues, and Print Shares

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
Then, use the REMOVE PRINT QUEUE command to delete the printer
queue. The following example shows the sequence of commands required
to remove printer queue GLENDA1. Routing queue GLENDA points to
GLENDA1.
LANDOFOZ\\TINMAN> PAUSE PRINT QUEUE GLENDA1/NOCONFIRM
%PWRK-S-QUESET, queue "GLENDA1" paused on server "TINMAN"
LANDOFOZ\\TINMAN> REMOVE PRINT QUEUE GLENDA
Do you really want to remove print queue "GLENDA" [YES or NO] (YES) : YES
%PWRK-S-QUEREM, queue "GLENDA" removed from server "TINMAN"
LANDOFOZ\\TINMAN> REMOVE PRINT QUEUE GLENDA1
Do you really want to remove print queue "GLENDA1" [YES or NO] (YES) : YES
%PWRK-S-QUEREM, queue "GLENDA1" removed from server "TINMAN"
•

To delete a print queue and all pending jobs in that queue except the job
currently printing, first use the SET PRINT QUEUE/PURGE command
to delete the pending print jobs, then use the REMOVE PRINT QUEUE
command.

•

To remove a print queue and all jobs in its queue, including the one
currently printing, use the following commands, in the order shown:
1. SET PRINT QUEUE/PURGE — to delete all pending print jobs.
2. SET PRINT JOB/DELETE — to delete the currently printing job.
3. REMOVE PRINT QUEUE — to delete the queue.
Note
Do not use the REMOVE PRINT QUEUE command if Windows NT
printer management is enabled. Use Windows NT print services to
remove the printer and all jobs.

To delete a print queue, use the REMOVE PRINT QUEUE command, as in the
following example:
LANDOFOZ\\TINMAN> REMOVE PRINT QUEUE TOTO
Do you really want to remove print queue "TOTO" [YES or NO] (YES) : YES
%PWRK-S-QUEREM, queue "TOTO" removed from server "TINMAN"
LANDOFOZ\\TINMAN>
This command removes the print queue called TOTO from the list of print
queues known to the server called TINMAN. All jobs in the queue complete
before the queue is removed.

Managing Printers, Print Queues, and Print Shares 5–13

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
5.3.2.7 Managing Print Shares, Using ADMINISTER Commands
The following sections describe how to create print shares, set permissions on
print shares to control access to the printers, how to change the characteristics
of a print share, and how to stop sharing a print queue. To manage print
shares, you must be logged on to a user account that is a member of one of the
following groups:
•

Administrators

•

Account Operators

•

Server Operators

•

Print Operators

There are no special requirements for displaying print share information.
5.3.2.7.1 Creating an Advanced Server Print Share To give network users
access to a print queue, you share that queue over the network by creating a
print share. To access the print queue, network users specify the share name
associated with that queue. If you do not specify permissions when you add the
print share, it is available to all users. You control user access by specifying
permissions for the print share. When multiple permissions apply to a print
share, the minimum permission is used. To create a print share, use the ADD
SHARE/PRINT command and set permissions for the share. You should add a
print share based on a routing queue that points to the specific printer queue.
For example:
1. Set up your routing queue.
2. Set up your print share with the same name as the routing queue.
For example, the following command sets up a print share called GLENDA.
The share name is the same as the routing queue name, as required by
Windows NT.
LANDOFOZ\\TINMAN> ADD SHARE/PRINT GLENDA/DESCRIPTION="GLENDA’s print share"
%PWRK-S-SHAREADD, share "GLENDA" added on server "TINMAN"
LANDOFOZ\\TINMAN>
Note
Do not use the ADD SHARE/PRINT command if Windows NT printer
management is enabled. Use Windows NT print services to set up a
share. For more information, see Section 5.3.3.2, Using Windows NT
Print Services to Share Printers Defined on the Advanced Server.

5–14 Managing Printers, Print Queues, and Print Shares

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
5.3.2.7.2 Creating Print Shares With Names That Include Unicode Extended
Characters OpenVMS queue names support any uppercase and lowercase
letters, digits, the underscore (_), and dollar sign ($). When you create an
Advanced Server print share, specifying Unicode characters other than these
supported characters, the Advanced Server creates an OpenVMS queue using
the standard ODS-2 format for these characters: _ _XX, where XX is the 8-bit
code in the server character set.
OpenVMS restricts the length of queue names to 31 characters. Because the
Advanced Server must use the standard ODS-2 four-character substitution
in the queue name for each unsupported character in the print share name,
restrict the length of Advanced Server print share names accordingly. For
example, seven characters is the maximum length for a print share name
consisting entirely of unsupported characters.
For more information on Unicode extended character sets, see Section 4.4,
Unicode and Extended Character Sets.
5.3.2.8 Controlling Access to Print Shares, Using ADMINISTER Commands
Always set permissions explicitly on a print share; the permissions set on
the share will apply to the queue as well. If you do not specify permissions
on a print share, the default is to allow access by all users (that is,
/PERMISSIONS=(EVERYONE=FULL)). The default setting sets permissions
on the share, not on the queue. Any permissions that applied previously to
a queue (that is, which previously were associated with another share) are
retained and not explicitly visible. Therefore, when you add a print share that
points to an existing queue, the queue may have permissions retained from
a previous print share, which may conflict with the permissions on the print
share. To ensure that permissions are set correctly, set permissions when you
set up a new print share.
You can specify the following access permission levels for print shares:
•

NONE—Users have no access to the share.

•

PRINT—Users have print access to the share. Can pause and delete their
own print jobs.

•

MANAGE_DOCUMENTS—Users can manage print jobs; for example,
pause and delete print jobs not their own.

•

FULL—Users have full access to the share. Can modify and delete both
shares and queues. This is the default if you do not specify permissions
when creating the share.

Managing Printers, Print Queues, and Print Shares 5–15

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
As part of monitoring printer security, you can enable auditing and keep track
of successful and failed attempts to access a print share. The server logs these
events in the audit trail. To set auditing for printer access, use the SET AUDIT
POLICY command. For example:
LANDOFOZ\\TINMAN> SET AUDIT POLICY/AUDIT/SUCCESS=ACCESS/FAILURE=ACCESS
%PWRK-S-AUDPOLSET, audit policy set for domain "LANDOFOZ"
See Section 6.1.3.3, Auditing Security Events Domain-Wide, for information
about enabling auditing for printer events.
To set permissions for a shared print queue, use the ADD SHARE/PRINT
command or the MODIFY SHARE command. The following example adds a
share called WESTWITCH and sets the permissions for the print share so that
user SCARECROW has full access to the share, but user LION has no access
to the share. The share WESTWITCH is a print share for an existing print
queue named WESTWITCH.
LANDOFOZ\\TINMAN> ADD SHARE/PRINT WESTWITCH_LANDOFOZ\\TINMAN>/PERMISSIONS=(SCARECROW=FULL,LION=NONE)
_LANDOFOZ\\TINMAN>/DESCRIPTION="Shared Print Queue in the Land of Oz"
%PWRK-S-SHAREADD, share "WESTWITCH" added on server "TINMAN"
LANDOFOZ\\TINMAN>
Note
Do not use the ADD PRINT/SHARE command if Windows NT printer
management is enabled. Use Windows NT print services to set up a
share. For more information, see Section 5.3.3.2, Using Windows NT
Print Services to Share Printers Defined on the Advanced Server.

5.3.2.9 Changing Print Share Options, Using ADMINISTER Commands
The Advanced Server lets you change the options for an existing print share.
For example, you may want to revise the share’s description. Changes you
make take effect immediately for new print jobs, but do not affect jobs already
in the queue, except for changes in the routing list. Use the MODIFY SHARE
command.
The options you can change include:
•

Description

•

Maximum number of users (limit)

•

Permissions

5–16 Managing Printers, Print Queues, and Print Shares

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
5.3.2.9.1 Example: Changing the Maximum Number of Connections for an
Existing Print Share To set the print share TOTO to have no limit on the
number of client connections, enter the following command:
LANDOFOZ\\TINMAN> MODIFY SHARE TOTO/NOLIMIT
%PWRK-S-SHAREMOD, share "TOTO" modified on server "TINMAN"
LANDOFOZ\\TINMAN>
5.3.2.9.2 Example: To Change the Permissions for an Existing Print Share
The following example modifies permissions for the print share WESTWITCH,
so that user LION has PRINT access to the share, and user TINY has
MANAGE_DOCUMENTS access to the share:
LANDOFOZ\\TINMAN> MODIFY SHARE WESTWITCH _LANDOFOZ\\TINMAN>/PERMISSIONS=(LION=PRINT,TINY=MANAGE_DOCUMENTS)
%PWRK-S-SHAREMOD, share "WESTWITCH" modified on server "TINMAN"
5.3.2.10 Displaying Information About Print Shares, Using ADMINISTER Commands
You can display the print share information, including the permissions on the
share. Use the SHOW SHARES /FULL command. For example, to display the
permissions for the print share WESTWITCH, enter the following command:
LANDOFOZ\\TINMAN> SHOW SHARES WESTWITCH/FULL
Shared resources on server "TINMAN":
Name
Type
Description
----------- --------- --------------------------------------WESTWITCH
Printer
Shared Print Queue in the Land of Oz
Path: TOTO
Connections: Current: 0, Maximum: No limit
Share Permissions:
Everyone
Full Control
LION
Print
TINY
Manage Documents
Total of 1 share
LANDOFOZ\\TINMAN>
5.3.2.11 Stopping a Print Share, Using ADMINISTER Commands
You may need to stop sharing a print share for several reasons:
•

To reorganize shared print queues

•

To remove a printer, if this printer is the only printer servicing the queue

•

To remove a shared print queue that is no longer needed

Managing Printers, Print Queues, and Print Shares 5–17

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
To stop sharing a print share, use the REMOVE SHARE command. The queue
still exists and can be displayed using the SHOW PRINT QUEUE command,
but it is unavailable to network users. Jobs in the print queue complete as
usual. For example:
LANDOFOZ\\TINMAN> REMOVE SHARE TOTO
Do you really want to remove share "TOTO" [YES or NO] (YES) : YES
%PWRK-S-SHAREREM, share "TOTO" removed from server "TINMAN"
LANDOFOZ\\TINMAN>
5.3.2.12 Managing Print Jobs, Using ADMINISTER Commands
The Advanced Server lets you display and control print jobs in Advanced
Server print queues.
This section provides information on the following topics:
•

Displaying print jobs

•

Holding a print job

•

Releasing a print job

•

Restarting a print job

•

Moving a print job in a print queue

•

Deleting a print job

To manage print jobs, you must be logged on to a user account that is a
member of one of the following groups:
•

Administrators

•

Server Operators

•

Print Operators

There are no special requirements for displaying print job information.
5.3.2.12.1 Displaying Print Jobs, Using ADMINISTER Commands
print jobs, use the SHOW PRINT JOBS command. For example:
LANDOFOZ\\TINMAN> SHOW PRINT JOBS
Routing Queue TOTO : ACTIVE
Job User Name
Size
---- --------------- ----------5 system
512
6 system
512
7 system
512
LANDOFOZ\\TINMAN>

5–18 Managing Printers, Print Queues, and Print Shares

Status
---------QUEUED
QUEUED
PAUSED

To display

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
5.3.2.12.2 Holding a Print Job, Using ADMINISTER Commands If you have
FULL or MANAGE_DOCUMENTS permission on the share, you can hold any
print job that the queue has not yet sent to the printer. The held job stays in
the queue until you release it; other jobs in the queue are printed. Other users
can hold and release their own print jobs.
To hold a print job, use the SET PRINT JOB /HOLD command. For example:
LANDOFOZ\\TINMAN> SET PRINT JOB 3330/HOLD
%PWRK-S-JOBSET, print job 3330 held on server "TINMAN"
LANDOFOZ\\TINMAN> SHOW PRINT JOB
Routing Queue TOTO : PENDING
Job User Name
---- ---------------3330 system

Size
Status
------------ --------------512 PAUSED

LANDOFOZ\\TINMAN>
This example pauses or holds print job number 3330.
5.3.2.12.3 Releasing a Print Job, Using ADMINISTER Commands You can
release a print job that has been held, as described below. The job prints when
it reaches the top of the queue.
To release a print job, use the SET PRINT JOB /RELEASE command. For
example:
LANDOFOZ\\TINMAN> SET PRINT JOB 3330/RELEASE
%PWRK-S-JOBSET, print job 3330 released on server "TINMAN"
LANDOFOZ\\TINMAN>
This example releases the specified print job that was on hold. The job then
proceeds to print.
5.3.2.12.4 Restarting a Print Job, Using ADMINISTER Commands You can
restart a print job, printing it again from the beginning. This can be useful if a
job is interrupted by an error or printer problem.
To restart a print job, use the SET PRINT QUEUE /RESTART command. For
example:
LANDOFOZ\\TINMAN> SET PRINT QUEUE TOTO/RESTART
%PWRK-S-JOBACTION, print job 1 at server "TINMAN" has been restarted
LANDOFOZ\\TINMAN>

Managing Printers, Print Queues, and Print Shares 5–19

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
5.3.2.12.5 Moving a Print Job in a Print Queue, Using ADMINISTER
Commands You can use the SET PRINT JOB command to move a print
job to the beginning or end of the queue.
To move a print job to the first position in its queue, use the SET PRINT
JOB/FIRST command. For example:
LANDOFOZ\\TINMAN> SET PRINT JOB 3330/FIRST
%PWRK-S-JOBSET, job 3330 set to first position on server "TINMAN"
LANDOFOZ\\TINMAN>
This example moves job number 3330 in the print queue to the first position in
the queue. It prints as soon as any currently printing job is done.
To move a print job to the last position in a queue, use the SET PRINT JOB
/LAST command. For example:
LANDOFOZ\\TINMAN> SET PRINT JOB 3330/LAST
%PWRK-S-JOBSET, job 3330 set to last position on server "TINMAN"
LANDOFOZ\\TINMAN>
This example moves print job number 3330 to the last position in the print
queue. The print job prints after all other print jobs currently in the queue are
done.
5.3.2.12.6 Deleting a Print Job, Using ADMINISTER Commands If you have
FULL or MANAGE_DOCUMENTS permission on the share, you can delete
any job that is waiting in a print queue. Other users can delete their own print
jobs. Use the SET PRINT JOB /DELETE command to delete a print job. To
abort a print job that is currently printing, use the SET PRINT JOB /ABORT
command.
To delete a print job, use the SET PRINT JOB/DELETE command, as in the
following example:
LANDOFOZ\\TINMAN> SET PRINT JOB 3330/DELETE
%PWRK-S-JOBSET, print job 3330 deleted on server "TINMAN"
LANDOFOZ\\TINMAN>
This example deletes job number 3330 from the print queue.
To cancel a print job that is currently printing, use the SET PRINT
QUEUE/ABORT command.
When you need to shut down a printer immediately, you may need to cancel a
print job that is printing. Or you may need to cancel a print job that is printing
incorrectly, such as a PostScript file that is printing as an ASCII or text file.
For example:

5–20 Managing Printers, Print Queues, and Print Shares

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
LANDOFOZ\\TINMAN> SET PRINT JOB 3330/ABORT
%PWRK-S-JOBSET, print job 3330 aborted on server "TINMAN"
LANDOFOZ\\TINMAN>
This example cancels print job number 3330 while it is printing. To restart a
deleted job, you must resubmit the print job.

5.3.3 Managing Advanced Server Printers Using Windows NT
The Advanced Server for OpenVMS can be configured to manage printers
and print queues remotely from a Windows NT Server or workstation. Any
administrators, print operators, or server operators on the Windows NT system
can manage these printers. These users can manage and conceptualize printers
in Windows NT-familiar terms: they manage printers, printer ports, print
queues, and the associated parameters defined in each printer’s OpenVMS
Registry entry. Notice that all users can add a printer and manage their own
print jobs from their Windows NT computer.
By default, Advanced Server shared printers are managed locally by means of
the ADMINISTER command interface. To change the default on the Advanced
Server for OpenVMS so that you can manage Advanced Server shared printers
using Windows NT print services, you must reconfigure the server using
PWRK$CONFIG and enable Windows NT printer management. For more
information about enabling Windows NT printer management, refer to the
Compaq Advanced Server for OpenVMS Server Installation and Configuration
Guide.
The printers defined on the Advanced Server and managed by Windows NT are
often referred to as the Advanced Server’s Windows NT-compatible printers.
Note
When running PWRK$CONFIG to reconfigure the Advanced Server,
printers or print shares that have been upgraded previously are not
upgraded again.

Each Advanced Server printer created and managed from Windows NT has:
•

A registry entry that defines printer parameters such as the name of the
printer, location, and printing information, including the share name,
printer queue (execution queue), and so forth.

Managing Printers, Print Queues, and Print Shares 5–21

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
•

A print share that is used primarily by client browsers to display
printers. The print share name does not have to be the same as the
printer name. In addition, the Advanced Server for OpenVMS creates
a PRINT$ share during server installation (the share is located at
PWRK$LMROOT:[LANMAN.SHARES.PRINTDRIVERS]). Printer drivers
are placed in the PRINT$ share when a printer is created using the
Windows NT Add Printer Wizard.

•

A routing queue (an OpenVMS generic queue) that is created automatically
by the Advanced Server if printer pooling is selected. The routing queue
name is the same as the printer name.

•

A printer queue (an OpenVMS execution queue), which is identical to a
Windows NT port to which a printer is connected physically.

•

Support for Windows NT Application Programming Interfaces (APIs) to be
used by the Windows NT print services.

5.3.3.1 Using Windows NT Print Services to Manage Advanced Server Printers
With Windows NT printer management enabled on your Advanced Server,
you can use the same tools on Windows NT to manage printers defined on the
Advanced Server that you would use to manage other Windows NT printers.
For example, to add a Windows NT-compatible printer, double-click on the icon
for the Advanced Server in the Network Neighborhood, then select the Printers
folder. Now, double-click on the Add Printer icon in the Printers folder for the
Advanced Server being managed, and use the Windows NT Add Printer Wizard
to guide you through the process. The wizard allows you to select:
•

A port (an OpenVMS executive queue) to print to

•

The name of the printer

•

Whether to share the printer, and the name of the share

•

Whether to enable printer pooling

•

The type of printer

For examples and illustrations, refer to the Compaq Advanced Server for
OpenVMS Concepts and Planning Guide.
The Advanced Server printer name must not exceed 12 characters in length.
If printer pooling is enabled, the printer name must differ from the OpenVMS
execution queue name. They can be the same if printer pooling is disabled.

5–22 Managing Printers, Print Queues, and Print Shares

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
When you are prompted to select a port for the printer, the list box displays the
available OpenVMS execution queues found by the Advanced Server. Click on
the appropriate execution queue.
Note
You can only create Windows NT-compatible server printers that
are associated with an existing port (OpenVMS execution queue).
You cannot create a new port. You must use the OpenVMS
INITIALIZE/QUEUE and SET QUEUE commands to create and set up
a new execution queue. Execution queues are regarded by Windows NT
as ports.

When you are prompted for the type of printer and the operating systems
of the clients to be using the printer, you must have the appropriate printer
drivers available (supplied on a CD-ROM, for example).
When the Add Printer Wizard completes, the printer is added to the Printers
folder. To see the new printer in the Printers folder, you might have to refresh
the folder view.
To share this printer, see Section 5.3.3.2, Using Windows NT Print Services to
Share Printers Defined on the Advanced Server.
5.3.3.2 Using Windows NT Print Services to Share Printers Defined on the Advanced
Server
When you add a printer using the Windows NT Add Printer Wizard, one of
the dialog boxes gives you the option of sharing the printer. If you indicate
that the printer is to be shared, you can enter a name for the shared resource
(which defaults to the first word of the printer name).
To share an existing printer, right-click the printer in the Printers folder, and
then click Properties. Click the Sharing tab, and then click Shared and enter
the share name.
5.3.3.3 Enabling Printer Pooling
To set up a printer for printer pooling (similar to setting up an OpenVMS
generic queue or Advanced Server routing queue), use the Windows NT Add
Printer Wizard to select several ports to point the printer to, and check the box
that enables printer pooling. When the printer is created, the Advanced Server
creates a routing queue with the same name as the printer name. The routing
queue routes to the ports (execution queues) you selected with the Add Printer
Wizard.

Managing Printers, Print Queues, and Print Shares 5–23

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
5.3.3.4 Using Advanced Server Windows NT-Compatible Printers
Users who want to use an Advanced Server print share can add the associated
printer to their computers, in the same way as described in Section 5.3.3.1,
Using Windows NT Print Services to Manage Advanced Server Printers. The
Add Printer Wizard allows the user to download and install the printer drivers
from the server. When that is done, an icon for the printer appears in the
user’s Printer folder, and the user can now print to that printer.
5.3.3.5 Windows NT Printer Management Restrictions
The following restrictions apply to the Windows NT style management of
Advanced Server print shares:
•

With Windows NT printer management enabled, Compaq recommends
managing printers defined on the Advanced Server only from Windows NT.
In specific, do not use the following ADMINISTER commands:
ADD SHARE/PRINT
REMOVE PRINT QUEUE
SET PRINT QUEUE
You can still use the following ADMINISTER commands, and all other
ADMINISTER commands not related directly to printer management:
ADD PRINT QUEUE
CONTINUE PRINT QUEUE
PAUSE PRINT QUEUE
SHOW PRINT QUEUES

•

The length of the name of a Windows NT manageable printer must not
exceed 12 characters.

•

If printer pooling is enabled, the name of the printer must not be the same
as the name of the OpenVMS execution queue selected from the list of
printer ports during printer creation.

•

Advanced Server print shares cannot be renamed from Windows NT. If
you use Windows NT to try to rename a shared printer that is defined
on the Advanced Server, the printer name will revert to the original
name. No error messages are displayed. Likewise, the Advanced Server
ADMINISTER command-line interface as well as OpenVMS do not allow
renaming of printers, print shares, or print queues.

•

To view changes to print jobs, you must select the Refresh item from the
View menu for the print queue.

•

You cannot adjust the scheduling properties of Advanced Server printers
(this property is normally accessed from the Windows NT printer’s
Properties window, under the Scheduling tab).

5–24 Managing Printers, Print Queues, and Print Shares

Managing Printers, Print Queues, and Print Shares
5.3 Managing Printers, Print Shares, and Print Jobs
•

You cannot set the Take Ownership security property.

•

Upgraded printers (that is, printers or print shares that were already
defined on an Advanced Server when Windows NT printer management
was enabled) cannot be managed with all the management functionality
available for printers that were added to the server by Windows NT print
services. Note, for example, that you cannot use Windows NT to add an
upgraded server printer to another workstation.
To gain full Windows NT printer management functionality for these print
queues and shares, delete them using the command procedure provided
with your kit, and add them again using Windows NT print services.

Managing Printers, Print Queues, and Print Shares 5–25

6
Monitoring Events and Troubleshooting
Advanced Server provides several ways for you to determine the specific cause
of a server problem and to implement a solution.
This chapter describes the procedures you can use to monitor events and
troubleshoot problems:
•

Section 6.1, Monitoring Server Events, describes commands and utilities
that allow you to monitor current server activity and display information
about server events in log files, including:
ADMINISTER commands
Alert messages
Event logs
Advanced Server log files

•

Section 6.2, Troubleshooting Server Problems, describes how to
troubleshoot Advanced Server problems.

6.1 Monitoring Server Events
Advanced Server lets you monitor server events as they happen and capture
events in log files. The following sections describe the tools you can use to
monitor and evaluate server events.

6.1.1 ADMINISTER Commands
Advanced Server ADMINISTER commands let you display information about
current server activity and status, as well as recorded events and error
messages. In addition, you can use ADMINISTER commands to modify items
in the server database to correct certain types of problems.
For example, the SHOW SESSIONS command displays current client sessions.
To remove a session that is no longer being used, enter the CLOSE SESSION
command.

Monitoring Events and Troubleshooting 6–1

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
Refer to the procedures described in Section 6.2.2, The Problem Analysis
Process, for information about ADMINISTER commands you can use to help
solve certain types of server problems.

6.1.2 Automatic Alerts
Advanced Server includes an Alerter service that sends automatic alert
messages to specified clients and users when:
•

The number of failed logon attempts exceeded the set alert level.

•

Errors are encountered during server startup.

•

Any event log file is 80% or more full.

•

A printer is malfunctioning.

•

A print request has been deleted.

The Alerter service can also tell you when certain events occur, as specified
by the data associated with the Alerter server configuration parameters in
the OpenVMS Registry. You control when the Alerter service sends messages
for these events by modifying the data for the appropriate value in the
OpenVMS Registry, as described in Section 7.2, Managing Server Configuration
Parameters Stored in the OpenVMS Registry.
Table 6–1, Alerter Configuration Parameters, lists the server configuration
parameters you can modify to control the way the Alerter service works.
Table 6–1 Alerter Configuration Parameters
To specify...

Use this Value

Default Data

The total number of errors that can occur before
the server sends an alert message. You can set
the value for this keyword to any positive integer.

ErrorAlert

The total number of incorrect password attempts
that can occur before the server sends an alert
message. You can set the value for this keyword
to any positive integer.

LogonAlert

The total number of resource access violations
that can occur before the server sends an alert
message. You can set the value for this keyword
to any positive integer.

AccessAlert

The Alerter service runs automatically when the server starts, if the Alerter
service is included in the data associated with the ServerServices server
parameter in the OpenVMS Registry. The Alerter service is included in

6–2 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
the initial configuration by default. To disable the Alerter service, remove
the Alerter name from the list of data for the ServerServices value. See
Section 2.3.4, Managing Services, for more information about services.
You can specify that Advanced Server users and clients are to receive alert
messages. Include the names of these users and clients in the data field
for the AlertNames value in OpenVMS Registry. See Appendix A, Server
Configuration Parameters, for more information about OpenVMS Registry
values and data.
Note
Client workstations must be running the Messenger service to receive
alert messages. The Messenger service does not run on the OpenVMS
system; therefore, users logged on from OpenVMS processes will not
receive alert messages.

6.1.3 Event Logging
In the Advanced Server, an event is any significant occurrence in the system or
in an application that requires user notification. For events that do not require
immediate attention, the Advanced Server adds data to an event log file. This
event logging service starts automatically every time you start the Advanced
Server.
Event logs can provide valuable information about server activities.
Event messages are stored in event files in PWRK$LMROOT:[LANMAN.LOGS].
Each event type is maintained in a separate event log file, as shown in
Table 6–2, Event Log Files.

Monitoring Events and Troubleshooting 6–3

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
Table 6–2 Event Log Files
Event Type

Event Log File Name

Description

Application events

APPEVENT.EVT

Application event messages are generated by
applications. For example,
user-written applications
may store messages in the
application event log.

Security events

SECEVENT.EVT

Event messages are
generated based on the audit
policy specified for the server,
including files or directories.
(For more information, see
Section 6.1.3.3, Auditing
Security Events DomainWide.)

System events

SYSEVENT.EVT

System event messages
are generated by server
components.

Table 6–3, Information in Event Files, lists the information shown in each line
in an event file.
Table 6–3 Information in Event Files
Item

Meaning

Source

The server component that logged the message.

Class

The event class, either information, warning, error, success audit,
or failure audit.

Time

The date and time of the event.

Category

Classification of the message.

Message ID

Unique number for the message.

User

The user account name for the user who was logged on and
working when the message was logged. N/A indicates that the
entry does not specify a user.

Computer

The name of the computer where the message was generated.

6–4 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
6.1.3.1 Displaying Events
You can display events recorded in the event log file in either of the following
ways:
•

If the Advanced Server is running, use the ADMINISTER command SHOW
EVENTS.

•

If the Advanced Server is not running, use the ELFREAD utility.

These methods are described below.
6.1.3.1.1 Displaying Events When the Advanced Server Is Running The
following example shows how to display events while the Advanced Server
is running, using the SHOW EVENTS command. Use the /TYPE qualifier to
specify one of the types of events, as follows: SYSTEM (default), SECURITY,
or APPLICATION. In this example, the SHOW EVENTS command displays
the system events.
LANDOFOZ\\TINMAN> SHOW EVENTS
T Date
Time
Source
- -------- ----------- ------I 08/26/98 11:49:56 AM SYSTEM
W 08/27/98 12:07:01 PM Eventlog
I 08/27/98 12:15:31 PM Print
W 08/27/98 12:46:31 PM BROWSER
Total of 4 events

Category
Event
----------- ----None
528
None
603
None
604
None
605

User
---N/A
N/A
N/A
N/A

Computer
----------TINMAN
TINMAN
TINMAN
TINMAN

LANDOFOZ\\TINMAN>
You can display detailed information for each event, as generated by the
application that was the source of the event record, by specifying the SHOW
EVENTS/FULL command. The information might include such additional
information as the domain and system names. Not all sources or events
generate event details. The following example shows a portion of the data that
might be displayed with the SHOW EVENTS/FULL command:
E 06/17/00 12:13:50 PM NETLOGON None
5513 N/A
TINMAN
NET5513: The computer DOROTHY tried to connect to the server TINMAN using
the trust relationship established by the LANDOFOZ domain. However, the
computer lost the correct security identifier (SID)
when the domain was reconfigured. Reestablish the trust
relationship.
E 06/17/00 12:13:48 PM NETLOGON None
5513 N/A
TINMAN
NET5513: The computer DOROTHY tried to connect to the server TINMAN using
the trust relationship established by the LANDOFOZ domain. However, the
computer lost the correct security identifier (SID)
when the domain was reconfigured. Reestablish the trust
relationship.

Monitoring Events and Troubleshooting 6–5

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
E 06/17/00 12:13:48 PM NETLOGON None
5513 N/A TINMAN
NET5513: The computer DOROTHY tried to connect to the server TINMAN using
the trust relationship established by the LANDOFOZ domain. However,
the computer lost the correct security identifier (SID)
when the domain was reconfigured. Reestablish the trust
relationship.
.
.
.
6.1.3.1.2 Displaying Events When the Advanced Server Is Not Running To
display events when the Advanced Server is not running, use the ELFREAD
utility. The ELFREAD utility allows you to display records in the event file in
the following ways:
•

In reverse chronological order (default)

•

In chronological order

You can view records in brief (default) or detail format.
The ELFREAD command is defined as part of the Advanced Server command
set in the SYS$STARTUP:PWRK$DEFINE_COMMANDS.COM command
procedure.
The syntax for the ELFREAD command is:
ELFREAD [-o] [-d] event-type
Use the optional parameters to control the ELFREAD output as described in
Table 6–4, ELFREAD Command Options.
Table 6–4 ELFREAD Command Options
To display...

Include:

Records in chronological order

-o

Detail records

-d

event-type

The event log file specified, one of the following:

6–6 Monitoring Events and Troubleshooting

•

SYSTEM

•

SECURITY

•

APPLICATION

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
6.1.3.2 Saving and Clearing the Event Logs
You can display the event logs and, when necessary, clear the event logs. The
Alerter service sends you a message advising you when an event log becomes
80% or more full. When an event file is full, no additional event logging will
take place until the event file is cleared. Before clearing an event file, you
should save it to a backup file for future reference. The maximum size of an
event file is specified by server configuration parameters in the OpenVMS
Registry. The server parameter controlling the event log file size is stored in
the key associated with each event log and is called MaxSize. (See Appendix A,
Server Configuration Parameters, for more information.)
Note
Before changing the value of this parameter (or before restarting the
server, once you have changed the parameter), you should rename
or delete the current event log file to which the parameter applies.
Table 6–2, Event Log Files lists the event log file names.

When an event log becomes full, you can save and clear the event log:
•

Saving an event log causes the current event log entries to be written to a
specified archive file on the local computer.

•

Clearing an event log causes the current event log entries to be deleted.

6.1.3.2.1 Saving an Event Log To save an event log, use the SAVE EVENTS
command. The event log is stored, using the file name and location that you
specify in the command line. For example, to save the Security event log to the
file SEVENTS.BKP, enter the following command:
LANDOFOZ\\TINMAN> SAVE EVENTS SEVENTS.BKP/TYPE=SECURITY
%PWRK-S-ELFSAVE, Security Event Log from server "TINMAN" saved
LANDOFOZ\\TINMAN>
If you do not specify a path as part of the file name, the event file is created
in the PWRK$LMLOGS: directory. You can save the event log file of a remote
Advanced Server by specifying the server name with the /SERVER qualifier, as
in the following example:
LANDOFOZ\\TINMAN> SAVE EVENTS SYSTEM.BKP/TYPE=SYSTEM/SERVER=DOROTHY
%PWRK-S-ELFSAVE, System Event Log from server "DOROTHY" saved
This saves the system event log file of server DOROTHY to the file
PWRK$LMLOGS:SYSTEM.BKP on server DOROTHY.

Monitoring Events and Troubleshooting 6–7

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
You can display the saved event file by using the ADMINISTER SHOW
EVENTS /TYPE command, specifying the event file name and location and
the types of events to be viewed. See Section 6.1.3.1.1, Displaying Events
When the Advanced Server Is Running.
6.1.3.2.2 Clearing an Event Log To clear an event log, enter the CLEAR
EVENTS command. The specified event log entries are deleted. For example:
LANDOFOZ\\TINMAN> CLEAR EVENTS/TYPE=SECURITY
Clear the Security Event Log [YES or NO] (YES) : YES
%PWRK-S-ELFCLEARED, Security Event Log on server "TINMAN" cleared
If you do not specify the event log type, the default is to clear the system event
log.
6.1.3.3 Auditing Security Events Domain-Wide
The Advanced Server can track selected activities of users by auditing security
events and then placing entries in a server’s security log. You must enable
auditing in order for the server to record security events. By default, auditing
is not enabled.
To enable auditing, you must use the SET AUDIT POLICY command, as
documented in Section 6.1.3.3.1, Enabling Security Event Auditing. You
can use the command to establish an audit policy for the entire domain.
(The command affects the security logs of the domain controller and of all
server domain controllers in the domain: they all share the same audit policy.
Member servers maintain their own auditing policy.) You can select any of
several types of security events to be logged in the domain. For example, you
can log:
•

A systemwide event such as a user logging on or off

•

An attempt by a user to access a specific directory or file

•

An attempt by a user to rename a user account or change a password

You can select whether successful or unsuccessful attempts at specific
operations are to generate event messages.
For more information on setting an auditing policy, see Section 6.1.3.4,
Establishing the Audit Policy.
6.1.3.3.1 Enabling Security Event Auditing To enable auditing on the
server, use the SET AUDIT POLICY command with the /AUDIT qualifier. For
example:
LANDOFOZ\\TINMAN> SET AUDIT POLICY/AUDIT
%PWRK-S-AUDPOLSET, audit policy set for domain "LANDOFOZ"

6–8 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
6.1.3.3.2 Disabling Auditing To disable auditing on the domain, use the SET
AUDIT POLICY command with the /NOAUDIT qualifier.
6.1.3.4 Establishing the Audit Policy
The audit policy defines the types of events to be included in the Security event
log. You can change the audit policy for the domain using the SET AUDIT
POLICY command.
The SET AUDIT POLICY command lets you specify event results for which
auditing is enabled, including both successful and failed attempts to perform
certain functions. Include the /SUCCESS qualifier to specify successful
completion of operations, and the /FAILURE qualifier to specify failed
operations.
The following list shows the events you can specify:
•

All events

•

None of the events

•

Attempts to access a directory or file set for auditing or to send a print job
to a shared print queue set for auditing

•

Attempts to create, change, and delete user accounts and groups; attempts
to rename, disable, and enable a user account; attempts to set or change a
password

•

Attempts to log on to the domain, log off the domain, and make server
connections

•

Attempts to change user rights policies, auditing policies, or trust
relationships

•

Attempts to invoke a program, and handle duplication, indirect accesses,
and process exits

•

Attempts to restart or shut down the system, and events that affect system
security or the security log

•

Attempts to exercise a user right (except those associated with logging on
and logging off)

For more information about using the SET AUDIT POLICY command, refer to
the Compaq Advanced Server for OpenVMS Commands Reference Manual or
the ADMINISTER command interface online help.

Monitoring Events and Troubleshooting 6–9

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
6.1.3.4.1 Example: Setting the Audit Policy The following example shows
how to use the SET AUDIT POLICY command to log all failures of logon and
logoff attempts:
LANDOFOZ\\TINMAN> SET AUDIT POLICY/AUDIT/FAILURE=(LOGONOFF)
%PWRK-S-AUDPOLSET, audit policy set for domain "LANDOFOZ"
LANDOFOZ\\TINMAN>
6.1.3.5 Displaying the Audit Policy
To display the audit policy, enter the SHOW AUDIT POLICY command. This
displays the audit policy currently established for the server. For example:
LANDOFOZ\\TINMAN> SHOW AUDIT POLICY
Audit Policy for domain "LANDOFOZ":
Auditing is currently Enabled.
Audit Event states:
Audit Event
-----------------ACCESS
ACCOUNT_MANAGEMENT
LOGONOFF
POLICY_CHANGE
PROCESS
SYSTEM
USER_RIGHTS

Success
-------Disabled
Disabled
Disabled
Disabled
Disabled
Disabled
Disabled

Failure
-------Disabled
Disabled
Enabled
Disabled
Disabled
Disabled
Disabled

LANDOFOZ\\TINMAN>
6.1.3.6 Setting and Displaying Security Event Auditing for Files and Directories
You can set and display the audit trail for a specific file or directory using the
SET FILE and SHOW FILE commands.
Use the SET FILE command with the /AUDIT qualifier to specify the events to
audit.
The following list shows the types of operations you can audit for files and
directories:
•

All events

•

Attempts to display file names, attributes, permissions, owner, or data

•

Attempts to create subdirectories and files, change attributes, and display
permissions and owner

•

Attempts to display attributes, permissions, and owner; attempts to change
subdirectories; and attempts to run program files

6–10 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
•

Attempts to delete a directory or file

•

Attempts to change directory or file permissions

•

Attempts to change directory or file ownership

For more information about using the SET FILE command, refer to the
Compaq Advanced Server for OpenVMS Commands Reference Manual or
the ADMINISTER command interface online help.
For example, to set auditing of operations on the user file SIMIANS.DAT, enter
the following command:
LANDOFOZ\\TINMAN> SET FILE \WITCH\MKEY\SIMIANS.DAT_LANDOFOZ\\TINMAN>/AUDIT=(SUCCESS=ALL,FAILURE=ALL)
%PWRK-S-FILEMOD, "\\TINMAN\WITCH\MKEY\SIMIANS.DAT" modified
%PWRK-S-FILESMODIFIED, total of 1 file modified
LANDOFOZ\\TINMAN>
6.1.3.6.1 Example: Displaying the Audit Settings for a File The following
example shows how to display the audit settings for a file, using the SHOW
FILES /AUDIT command:
LANDOFOZ\\TINMAN> SHOW FILES \WITCH\MKEY\SIMIANS.DAT/AUDIT
\\TINMAN \WITCH\MKEY\SIMIANS.DAT
SIMIANS.DAT
Audit Events:
Success
Failure
LION
RWXDPO
RWXDPO
Total of 1 file
LANDOFOZ\\TINMAN>

6.1.4 Advanced Server Log Files
The Advanced Server records several types of messages in log files in the
following locations:
•

PWRK$LOGS:, the logical name for the directory PWRK$COMMONROOT:[LOGS]

•

PWRK$LMLOGS:, the logical name for the directory
PWRK$LMROOT:[LANMAN.LOGS]

Table 6–5, Log File Names, lists the log files kept in the PWRK$LOGS and
PWRK$LMLOGS areas. In each case, nodename refers to the name of the
server node.

Monitoring Events and Troubleshooting 6–11

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
Table 6–5 Log File Names
Log File Name

Message Type

In PWRK$LOGS:
NETBIOS_nodename.LOG

NetBIOS protocol over DECnet

NETBIOS_ERROR.LOG

NetBIOS protocol over DECnet
error

NETBIOS_OUTPUT.LOG

NetBIOS protocol over DECnet
output

PWRK$CONFIG_INFO_nodename.LOG

Configuration information

PWRK$CONFIG_ERROR_nodename.LOG

Configuration errors

PWRK$KNBDAEMON_nodename.LOG

NetBIOS protocol over TCP/IP

PWRK$LICENSE_R_nodename.LOG

License Registrar

PWRK$LICENSE_REGISTRAR_nodename.LOG

License Registrar

PWRK$LICENSE_S_nodename.LOG

License Server

PWRK$LICENSE_SERVER_nodename.LOG

License Server

PWRK$MASTER_nodename.LOG

Master process (process start and
shutdown)

PWRK$NBDAEMON_nodename.LOG

NetBIOS protocol over NetBEUI

In PWRK$LMLOGS:
PWRK$ADMIN_n _ nodename .LOG

Remote task command

PWRK$LMMCP_nodename. LOG

Master control process

PWRK$LMSRV_nodename.LOG

File server process

PWRK$LMBROWSER_nodename.LOG

Browser

PWRK$UPGRADE.LOG

Upgrade utility

6.1.4.1 Displaying Log Files
You can use any ASCII text editor to look at log files, so long as the log files
are not open (that is, in use by the Advanced Server). Even if open, most log
files can be read using the TYPE command. A convenient way to view the end
of most log files is to include the /TAIL and /PAGE qualifiers with the TYPE
command, as in the following example, where nodename is the name of the
server node:
$ TYPE/TAIL=50/PAGE PWRK$LMLOGS:PWRK$LMSRV_nodename.LOG

6–12 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
The log files record messages that have occurred during server operation. Not
all the messages in the log need your attention. Many messages are caused
by communication problems from which the server recovers automatically.
If the server fails to recover from a problem, log files can provide you with
information about the cause of the problem.
You can examine messages recorded in any log file. Each line in a log
file provides information about logged entries, including a date and time
stamp. For example, the PWRK$LMSRV_nodename.LOG file might contain
information about cache exhaustion conditions.
To examine log files that are in use, use the OpenVMS DCL command
BACKUP/IGNORE=INTERLOCK to back them up to a text file, as in the
following example:
$ BACKUP/IGNORE=INTERLOCK PWRK$LOGS:NETBIOS_DOROTHY.LOG;_$ PWRK$LOGS:NETBIOS_DOROTHY.TXT
6.1.4.2 The Advanced Server Common Event Log
The Advanced Server provides its own common event log for recording events
that cannot be recorded in the System, Security, or Application event logs.
These events include process startup and shutdown, autoshare errors, problems
caused by underlying OpenVMS errors (such as disk quota exceeded), and
failed attempts to connect because of licensing problems.
The Advanced Server provides the ADMIN/ANALYZE utility for viewing events
in Advanced Server common event log files. The events are logged in the file
PWRK$COMMON:EVTLOG.DAT on each server.
To view output or to purge the EVTLOG.DAT file, enter the following
command:
$ ADMINISTER/ANALYZE
Table 6–6, Event Logger Command Qualifiers, lists the qualifiers you can use
with the ADMINISTER/ANALYZE command.
Table 6–6 Event Logger Command Qualifiers
Qualifier

Description

/AFTER=dd-mmm-yy hh:mm:ss.cc

Restricts the report or the purge operation to events after
the specified time.
(continued on next page)

Monitoring Events and Troubleshooting 6–13

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
Table 6–6 (Cont.) Event Logger Command Qualifiers
Qualifier

Description

/BEFORE=dd-mmm-yy hh:mm:ss.cc

Restricts the report or the purge operation to events before
the specified time.

/CLASS=event_class

Filters the logged events that are written to the report or
purged from the EVTLOG.DAT file. The available classes
are:
•

ALL—all events; the default

•

ERROR—events that affect server operation, but are
not necessarily fatal

•

WARNING—events that do not directly affect server
operation; informational

/FULL or /BRIEF

The /FULL qualifier generates a report that includes all
information logged for each event. The /BRIEF qualifier
outputs only the event header and is the default.

/INPUT=event_log_file

Specifies the name of the event log file. The default file is:
SYS$SYSDEVICE:[PWRK$ROOT]EVTLOG.DAT

/OUTPUT=report_file

Specifies the name of the output file you want the report
written to. The default output is written to SYS$OUTPUT.

/PID=pid

Specifies the process ID whose events you want to display.

/PURGE

Purges entries from the EVTLOG.DAT file on the local
server.
If you use the /PURGE qualifier without other qualifiers,
all entries are purged and EVTLOG.DAT file is empty.
You can use /PURGE with other qualifiers to specify which
entries you want to purge. For example, to purge all
events in the EVTLOG.DAT file on the server that are
classed as ERROR and written to the file before October 1,
2000, enter the following command:

$ ADMIN/ANALYZE/PURGE/CLASS=ERROR/BEFORE=01-OCT2000
(continued on next page)

6–14 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
Table 6–6 (Cont.) Event Logger Command Qualifiers
Qualifier

Description

/SOURCE=event_source

Filters the logged events that are written to the report or
purged from the EVTLOG.DAT file. The available sources
are:
•

ALL—includes events from all sources; this is the
default

•

COMMON_SERVICES—events originating from
common components, such as the PATHWORKS lock
manager and PATHWORKS file system

•

LAN_MANAGER—events originating from LAN
Manager

•

LICENSE_MANAGER—events originating from the
license management utility

•

MANAGEMENT—events originating from the Monitor
process or Configurator

•

MASTER_PROCESS—events originating from the
master process, PWRK$MASTER

•

TRANSPORT—events originating from any of the
transports

Monitoring Events and Troubleshooting 6–15

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
Example 6–1, ADMINISTER/ANALYZE Command and Display, shows a
sample report from the Event logger generated by the following command
executed on the server TINMAN.
Example 6–1 ADMINISTER/ANALYZE Command and Display
$ ADMINISTER/ANALYZE/INPUT=EVTLOG.DAT
:::::::::: PATHWORKS Error Log Report ::::::::::
DATE: 25-OCT-2000 15:52:06.88
================= EVENT #1 ==================
Event Time: 18-OCT-2000 17:14:09.04
Process Id: 000001DB
Event:
Master Process starting
Event Source: Master Process
Event Class: Audit
Process Id:

Node: TINMAN

000001DB(X)

================= EVENT #2 ==================
Event Time: 18-OCT-2000 17:14:19.57
Node: TINMAN
Process Id: 000001DB
Event:
NetBEUI Daemon process starting
Event Source: Master Process
Event Class: Audit
Process Id:

000002DE(X)

================= EVENT #3 ==================
Event Time: 18-OCT-2000 17:14:23.26
Node: TINMAN
Process Id: 000001DB
Event:
NetBEUI Daemon process shutting down
Event Source: Master Process
Event Class: Audit
Process Id:
Status:

000002DE(X)
SYSTEM-S-NORMAL, normal successful completion

================= EVENT #4 ==================
Event Time: 18-OCT-2000 17:14:29.04
Node: TINMAN
Process Id: 000001DB
Event:
NetBIOS transport process starting
Event Source: Master Process
Event Class: Audit
Process Id:

00000262(X)

(continued on next page)

6–16 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
Example 6–1 (Cont.) ADMINISTER/ANALYZE Command and Display
================= EVENT #5 ==================
Event Time: 18-OCT-2000 17:14:37.19
Node: TINMAN
Process Id: 000001DB
Event:
LANman Controller process starting
Event Source: Master Process
Event Class: Audit
Process Id:

00000282(X)

================= EVENT #6 ==================
Event Time: 18-OCT-2000 17:14:50.93
Node: TINMAN
Process Id: 000001DB
Event:
License Registrar process starting
Event Source: Master Process
Event Class: Audit
Process Id:

000002D1(X)
.
.
.

================= EVENT #19 ==================
Event Time: 19-OCT-2000 09:23:34.63
Node: TINMAN
Process Id: 000003DE
Event:
No license for client - access denied
Event Source: LAN Manager Server
Event Class: Warning
Client:

PCGURU
.
.
.

=============== EVENT #25 ===================
Event Time: 19-OCT-2000 10:38:11.85
Node: TINMAN
Process Id: 555749340
Event:
Unexpected System Error Encountered
Event Source: PATHWORKS Printing Services
Event Class: Error

Monitoring Events and Troubleshooting 6–17

Monitoring Events and Troubleshooting
6.1 Monitoring Server Events
Example 6–2, ADMINISTER/ANALYZE/FULL Command and Display, shows
a portion of the more detailed report generated when you use the /FULL
qualifier.
Example 6–2 ADMINISTER/ANALYZE/FULL Command and Display
$ ADMINISTER/ANALYZE/FULL/INPUT=EVTLOG.DAT
:::::::::: PATHWORKS Error Log Report ::::::::::
DATE: 25-OCT-2000 15:52:06.88
================= EVENT #1 ==================
Event Time: 18-OCT-2000 17:14:09.04
Node: TINMAN
Process Id: 555749340
Event:
PATHWORKS Lock Database is 90% full
Event Source: Common Services PLM
Event Class: Warning
0x00000032
0x0000002D
0x00000019
0x00000017
0x00000004

Total Database Resources:
Current Resources in Use:
Currently open Streams:
Currently unique Opens:
Currently Locked Ranges:

50
45
25
23
4

Decode information unavailable (Hex. output):
0x62426141
0x64446343
0x66466545
0x68486747
0x00006949
.
.
.

6.2 Troubleshooting Server Problems
To troubleshoot server problems, you should be familiar with the following
topics:
•

OpenVMS system administration and troubleshooting
The OpenVMS log files, system administration procedures, and parameter
settings are described in the OpenVMS operating system documentation.

•

Advanced Server concepts
The Advanced Server concepts are described in the Compaq Advanced
Server for OpenVMS Concepts and Planning Guide.

6–18 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
•

Site-specific network configuration
Advanced Server provides data-gathering tools that are useful for
describing the server and the network environment; in addition, each
server system should have a log of the installation and configuration
setup, including client requirements and shared resources, network
administration accounts, and domain trust information.

•

Client environment
You should be familiar with the software running on the client computers
that access the server, including their server requirements and their
network capabilities. For clients running PATHWORKS client software,
see the extensive PATHWORKS client documentation that describes client
configuration, modification, and error messages.

6.2.1 Troubleshooting Overview
The following sections describe how to determine the cause of a server problem
and solve it if possible. Problem resolution includes determining whether or
not the problem is caused by the Advanced Server software. To solve clientbased problems, hardware problems, and application-specific problems, see the
documentation for the specific products involved.
Troubleshooting a server problem requires the following steps:
1. Collecting information about the problem
2. Analyzing the problem to determine its characteristics and to isolate the
cause of the problem
3. Solving the problem
The following sections describe each step in more detail.
6.2.1.1 Step 1: Collecting Information About the Problem
When you first detect a server problem, or when the problem is reported,
collect as much information as possible immediately. Record the following
information:
•

The time and date that the problem occurred

•

The type of work that the user was performing when the problem occurred,
including applications running, shares accessed, and resources used

•

Specific information about the network transport the client uses to connect
to the server, the server name that the client uses to connect, whether the
user account is currently logged on, and the physical location of the client
connection to the network

Monitoring Events and Troubleshooting 6–19

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
If you are investigating a recurring or ongoing problem, you should, if possible,
implement an immediate solution that allows the client to continue working.
Record server problems and save a dump file, if one was generated, and save
associated log files and data files before restarting the server or changing
the server configuration. You can use the information gathering command
procedure SYS$STARTUP:PWRK$GATHER_INFO.COM to save these files.
6.2.1.2 Step 2: Analyzing the Problem
When you analyze the server problem, you should also look for the solution
to the problem. Therefore, you must isolate the component that needs to be
modified, replaced, removed, or enhanced.
Advanced Server software provides information in log files and tools to help
you determine the cause of a server problem. These tools keep records of
activities and errors. You can use them to isolate problem areas and to help
solve problems. You may be able to solve the problem using the Advanced
Server commands and utilities.
6.2.1.3 Step 3: Solving the Problem
The cause of a server problem may be within your ability to correct. At best,
you may determine a configuration or definition change that will correct the
problem. Or, you may be able to modify a server parameter or disable a service
until the problem is solved more satisfactorily.
The procedure for solving a server problem depends on your ability to capture
information about the problem and the state of the server at the time of
the problem. If a problem is reported to be intermittent and is difficult to
reproduce at will, the procedure for analysis and solution will take longer
and be more difficult. Thus, it is particularly important to collect detailed
information as soon as the problem is reported.
The following sections show how to use the Advanced Server tools in the
problem-solving process. Using these tools, you can modify the server to
report on network activity and events, providing more detailed investigation of
problems that you have already determined to be caused by the server or its
network resources.
If you cannot determine the cause of a server problem, or if you cannot solve
the problem, report the problem to your software specialist and keep the
Advanced Server data structure PWRK$LMROOT and the log files for future
analysis.
To help you report the information required for analyzing a server problem, the
Advanced Server software includes a procedure you can run to gather server
information.

6–20 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
6.2.1.3.1 Gathering Information About Server Status To invoke the
procedure provided by the server to gather server status information, enter
the following commands:
$ SET DEFAULT SYS$STARTUP
$ @PWRK$GATHER_INFO.COM
The resulting file (ADVANCED_SERVER_AS_INFO.BCK) is a BACKUP
saveset containing copies of the Advanced Server database, logs, and, if
present, process dump files.
If the problem you are investigating causes a systemwide failure, create a
dump file for the system. The system dump file captures system information.
Be sure to verify that your system dump file size is sufficient to capture a full
system dump.

6.2.2 The Problem Analysis Process
Problem analysis is a process of elimination. Given little information to
start, you must begin at the general level and use the information-gathering
tools described in this chapter to determine the area from which the problem
originates. If you have sufficient information at the beginning to isolate the
problem area or if the problem is ongoing or if you can reproduce the problem,
you can proceed directly to the section in this chapter that addresses the type
of problem you are investigating.
The problem-solving procedure differs depending on the type of problem
reported. The following sections describe several types of problems, in
analytical order, from the generic characteristics of server problems to the
more specific.
Problem types are characterized by behavior or source as follows:
•

Intermittent

•

Domain and Computer

•

Server operation

•

Services

•

Client connection

•

Share access

•

Printer

•

User account

•

Privileged user

Monitoring Events and Troubleshooting 6–21

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
•

License acquisition

6.2.2.1 Intermittent Problems
Intermittent problems are those that are not easily reproducible. They may not
prevent server operation, like ongoing problems, and they may be difficult to
analyze and solve. For these types of problems, your analysis depends heavily
on the log files and messages reported before and during the time the problem
occurred. To help locate such problems, you can use network traces, both on
the condition where the problem can be reproduced, and when the problem is
intermittent.
Table 6–7, Procedure for Solving Intermittent Problems, describes the steps
you may take to determine the cause of an intermittent problem.
Table 6–7 Procedure for Solving Intermittent Problems
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

Record the time and date
when the problem occurred,
the nature of the symptoms,
the computer name of the
client, if any. Related
information can include
applications that have
connections to the server,
server shares, and resources
consumed by the client.

Check for alerts around the
time the problem occurred.
Attempt to reproduce the
problem on the same client
and on other clients in the
domain.

You can enable and modify
the Alerter service to provide
more specific, immediate error
notification, as described in
Table 6–1, Alerter Configuration
Parameters. If the problem
circumstances can be reproduced, use the Alerter service to
watch the messages during the
occurrence of the problem.

If the problem is unique to a
specific group or one client,
see Analyze the Problem in
the next column of this table.

Use the SHOW EVENTS
command to see the event
messages that were recorded
for the time the problem
occurred. Enable additional
event/audit tracking to get
more detailed information.
See Section 6.1.3 in this
guide for more information.

Review events and log files to
isolate the cause of the problem
and address it accordingly.

If the problem is continuous,
or if you can reproduce the
problem at will, continue
to the section Domain and
Computer Problems.

Check Advanced Server log
files for additional messages,
as described in Section 6.1.4,
Advanced Server Log Files.

6–22 Monitoring Events and Troubleshooting

Intermittent problems that do
not prevent use of the server
may be due to faulty hardware.
Check the connections to the
client, the client configuration,
and the network hardware.

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
6.2.2.2 Domain and Computer Problems
The domain-wide functions of the server depend on its role in the domain
and on the other servers in the domain. The Advanced Server command-line
interface lets you display information about the domain and modify server
activity in the domain.
Table 6–8, Procedure for Solving Domain and Computer Problems, described
how to determine the cause of server and domain problems and what to do
about them.
Table 6–8 Procedure for Solving Domain and Computer Problems
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

Determine whether
users of other computers
in the domain receive
error messages when
attempting to connect to a
server, or whether server
administrators receive
error messages using
ADMINISTER commands.

If so, the problem may be
due to a server’s relationship
to the other servers in the
domain. Use the SHOW
COMPUTERS command to
determine the status of other
computers in the domain.

Use the REMOVE COMPUTER
command to take the computer
off the domain.

Determine whether domain
problems require changes
on multiple servers in the
domain.

Use the SHOW
ADMINISTRATION
command to display the
server and domain name of
the server currently being
administered.

Use the SET COMPUTER
/ACCOUNT_SYNCH command
to synchronize the security
accounts database across the
domain.
Use the SET COMPUTER/ROLE
command to change the server
role of a server in the domain,
as described in Section 2.1.1.1,
Changing a Server’s Role in a
Domain.

Use the SET ADMINISTRATION
command to set the server and
domain name of the server to
be managed, as described in
Section 2.1.4, Administering
Another Domain.

(continued on next page)

Monitoring Events and Troubleshooting 6–23

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
Table 6–8 (Cont.) Procedure for Solving Domain and Computer Problems
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

When setting up trusts
between domains, you receive
the error message ‘‘Could not
find domain controller for
this domain.’’

Check that each domain has
a running domain controller.

Start at least one server in each
domain.

Check that both domains are
running the same transport
protocol (TCP/IP, DECnet, or
NetBEUI).

Use the Configuration Manager
to enable the same transport
on both domains, as described
in Section 7.1, Managing File
Server Parameters Affecting
System Resources.

6–24 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
6.2.2.3 Server Operation Problems
If the server fails to complete routine operations, the log files and error
messages from the software usually indicate the nature and source of the
problem.
Table 6–9, Procedure for Solving Server Operation Problems, describes how
to determine the cause of a problem in server operation and what do to about
it.
Table 6–9 Procedure for Solving Server Operation Problems
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

Check the error messages
seen during failing
procedures and operations.

Use Advanced Server log files
to display messages about
problems during software
startup and operation.

Use the Configuration Manager
to modify server parameters
that affect the way the
server runs, as described in
Section 7.1, Managing File
Server Parameters Affecting
System Resources, or modify
server configuration parameters,
as described in Section 7.2,
Managing Server Configuration
Parameters Stored in the
OpenVMS Registry.

Check service startup
failures, which are logged
in the system event log files.

Use the SHOW EVENTS
command to display system
events.

Use the START SERVICES and
STOP SERVICES commands to
manage services, as described
in Section 2.3.4, Managing
Services.

6.2.2.3.1 Monitoring Data Cache Use by the File Server Advanced Server
uses its data cache for caching the security databases, in addition to client file
data. To ensure a balance of cache usage, the file server periodically monitors
its use of the data cache, as follows:
•

Total security databases utilization
The file server monitors the total utilization of the data cache by the
security databases. If the file server detects that the utilization of the
data cache for these files exceeds thirty-five percent (35%), a warning
message is posted to the file server log file indicating that the current
cache configuration may not be adequate for the current load imposed on
the file server.

Monitoring Events and Troubleshooting 6–25

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
For example:
BlobCache Warning: Sum of Blob file control areas
is 950272 bytes (45% of data cache).
The condition reported by this warning message will not prevent the file
server from being able to properly process requests associated with the
security databases. The message (shown below) indicates that you should
increase the size of the data cache.
•

Individual security database utilization
The file server monitors utilization of the data cache by individual security
database files. When the database expands in size, more cache resources
are required to continue operating. If the file server detects that an
operation will cause a database file expansion, and that expanding the
database file will cause it to utilize more than fifty percent (50%) of the
data cache, error messages are recorded in the file server log, as in the
following example:
BlobCache Error: The largest single Blob file control area
is 1187840 bytes (57% of data cache).
BlobCache Error: The largest single Blob file control area
is PWRK$LMROOT:[LANMAN.DOMAINS]DOMAIN1.
In addition to recording the problem in the file server log, the software
generates an operator message and raises a server alert.
These messages indicate that the operation will prevent the file server from
completing the current and future operations. In this case, you should use
the Configuration Manager (ADMIN/CONFIG), as described in Section 7.1,
Managing File Server Parameters Affecting System Resources, to increase
the size of the data cache so that utilization of the data cache by a single
database file remains under 50%. The change to the data cache size takes
effect the next time you start the server.

You can use the ADMIN/ANALYZE command to monitor these warning
messages and error messages, as described in Section 6.1.4.2, The Advanced
Server Common Event Log.

6–26 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
6.2.2.4 Problems with Services
Advanced Server software includes several optional services. For example,
Auditing is a service useful for analyzing server problems. However, the
services must be enabled.
Table 6–10, Procedure for Solving Service Problems, describes how to
determine whether a problem is caused by network service problems and
what do to about them.
Table 6–10 Procedure for Solving Service Problems
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

Check whether the services
are running.

Use the SHOW SERVICES
command to display the
services that are running.

Use the following commands
to control the operation of the
services:
START SERVICE
STOP SERVICE
PAUSE SERVICE
CONTINUE SERVICE
(See Section 2.3.4, Managing
Services, for more information.)

Monitoring Events and Troubleshooting 6–27

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
6.2.2.5 Client Connection Problems
Clients may be individually or collectively reporting a failure to connect to the
server or reporting slow response time in connecting to the server or the share.
Table 6–11, Procedure for Solving Client Connection Problems, describes the
causes behind many typical client connection problems and what to do about
them. For information on problems connecting to shares or specific files, see
Section 6.2.2.6, Share Access Problems.
Table 6–11 Procedure for Solving Client Connection Problems
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

If a client cannot end a
session or there are too many
sessions, you can control the
user sessions.

Use the SHOW SESSIONS
command to display current
Advanced Server client
sessions.

Use the CLOSE SESSION
command to close unneeded
sessions.

If more than one client
reports a problem when
connection to the server is
lost or with slow response
time, the problem may
be caused by too many
connections to the same
server.

Use the SHOW
CONNECTIONS command to
display the connections that
clients have established to
Advanced Server shares.

Use the CLOSE CONNECTION
command to end one or more
connections.

When a client tries to log on
over a WAN, the following
message is received: ‘‘You
were logged on, but have not
been validated by a server.’’

Clients may use NetBIOS
broadcasts to send logon
requests, and these requests
do not go over the router.

To locate domain controllers
capable of authenticating
logons, use a WINS Server or
LMHOSTS entries that include
the #DOM directive.

6–28 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
6.2.2.6 Share Access Problems
Clients may fail to connect to shares or lose existing connections. The shares
must be set to permit client access. Share setup includes:
•

Allowing access to users who are members of user groups that have access
to the share

•

Setting permissions to allow access to the share such as read access

•

Setting OpenVMS file and directory protections, if the Advanced Server
and OpenVMS security model is in use

•

Setting the maximum connection limit to allow the required connects

Table 6–12, Procedure for Solving Share Access Problems, describes the causes
behind some typical share access problems and what to do about them.
Table 6–12 Procedure for Solving Share Access Problems
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

Determine whether the client
is connected but failing
to access resources in the
shares. For example, the
client computer displays the
connection to the server but
is unable to list all the files
and directories to which the
client requires access.

Use the SHOW USER
command to display the
groups to which the user
belongs.

To add the user to a group,
use the MODIFY GROUP
command to add the user name.
To let the user’s group access
a share, use the MODIFY
SHARE/PERMISSIONS
command, as described in
Section 4.3.4, Changing Share
Properties.

Use the SHOW SHARE
command to display the
groups allowed to access the
share.

Use the SHOW FILE
command to display access
permissions on the resources.
If the OpenVMS and
Advanced Server security
model is enabled, use
the OpenVMS command
DIRECTORY/SECURITY to
display the OpenVMS owner
and protection information.

Use the Advanced Server
SET FILE/PERMISSIONS
command, as described
in Section 4.3.5.2, Setting
Permissions on a File or
Directory, to modify the
permissions on the file to
give the user or group access
to the specific resource.
Use the OpenVMS SET
FILE/PROTECTION command
to modify the RMS protections
on a directory or file.
(continued on next page)

Monitoring Events and Troubleshooting 6–29

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
Table 6–12 (Cont.) Procedure for Solving Share Access Problems
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

Use the Advanced Server
SHOW HOSTMAP command
to display host mapped user
accounts.

Use the ADD HOSTMAP
command, as described in
Section 3.1.16.2, Establishing
User Account Host Mapping,
to associate a network user
account with an OpenVMS user
account.

If some clients report
problems connecting to a
share, the problem may
be caused by too many
connections.

Use the SHOW SHARES
command to display
information about the
connection limit on the share.

Use the MODIFY SHARE
command to change the
connection limit on the share,
as described in Section 4.3.4,
Changing Share Properties.

If clients report failure to
access a specific file, the
problem may be caused by
incorrect permission settings
on the file.

Use the SHOW FILE
command to display files
that are open, clients who
have the files open, and the
permissions granted to the
clients.

Use the SET FILE
/PERMISSIONS command,
as described in Section 4.3.6,
Specifying File and Directory
Access Permissions, to set the
file permissions correctly.

6–30 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
6.2.2.7 Printer Problems
Problems with the print software can occur after changes in hardware
configuration or print queues. The Advanced Server provides commands to
modify and remove print jobs and print queues.
Table 6–13, Procedure for Solving Printing Problems, describes the causes
behind some typical printing problems and what to do about them.
Table 6–13 Procedure for Solving Printing Problems
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

Obtain the physical printer
name, the print queue name,
the print share name, and
the specific print command
used to submit the print job.

Use the SHOW PRINT
JOBS command to display
information about print jobs.

Use the SET PRINT JOB
command to change the status of
a print job or delete a print job,
as described in Section 5.3.2.12,
Managing Print Jobs, Using
ADMINISTER Commands.

Set the audit policy to record
printer-related events by
using the following command:
ADMINISTER SET AUDIT
POLICY/SUCCESS=ACCESS.
If you have enabled Windows
NT-style management, you
can establish auditing of a
shared printer from Windows
NT: select the printer from
the Printers folder, view the
properties, select the Security
tab, and then select the
Auditing button.

(continued on next page)

Monitoring Events and Troubleshooting 6–31

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
Table 6–13 (Cont.) Procedure for Solving Printing Problems
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

During printer maintenance
and when printers are off
line, you may need to prevent
users from submitting print
jobs.

Use the SHOW PRINT
QUEUE command to display
information about the print
queue, the print jobs in the
print queue, and the status of
the print queue.

Use the following commands to
control the print queue while
you correct the problem:
•

PAUSE PRINT QUEUE

•

CONTINUE PRINT
QUEUE

•

REMOVE PRINT QUEUE

See Section 5.3.2, Managing
Printers Using the Advanced
Server ADMINISTER
Command-Line Interface, for
more information.

Windows NT, Windows 95,
Windows 98, or Windows
2000 client cannot print to a
shared print queue.

Use the ADMINISTER
The share name and the queue
SHOW SHARES/TYPE=PRINT name must differ for printing
command to view the shared
from these Windows clients.
print queues.

6–32 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
6.2.2.8 User Account Problems
When one user reports a problem connecting to the server or a share, establish
whether the problem is caused by the Advanced Server user account definition.
You can help users with password problems immediately, by changing their
passwords.
Table 6–14, Procedure for Solving User Account Problems, describes the
symptoms of some typical problems in user account definition and what do to
about them.
If a client reports a failure to log on to the network, use the procedure
described in this table.
Table 6–14 Procedure for Solving User Account Problems
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

Determine whether the user
account is set up properly.

Use the SHOW USER
command to display user
account information. Look
for logon restrictions, such as
logon hours, which might give
the client access only during
specific hours of the day and
days of the week. Check
also whether the account has
expired or is locked out.

Use the MODIFY USER
command to change user
account information like
restricted hours, or to unlock
the user account, as described
in Section 3.1.3, User Account
Attributes.

Determine whether the
user is entering the correct
password.

Use the SET PASSWORD
command to change a user
account password, as described
in Section 3.1.5, Specifying
Passwords.

Monitoring Events and Troubleshooting 6–33

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
6.2.2.9 Privileged User Problems
Users with responsibility for privileged operations, such as administrators,
printer operators, and server operators, may receive error messages when
attempting to use privileged commands and procedures. Make sure the user is
a member of the appropriate group.
If users are unable to perform privileged operations, use the procedure
described in Table 6–15, Procedure for Solving Problems of Privileged Users.
Table 6–15 Procedure for Solving Problems of Privileged Users
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

Determine whether users
are unable to perform
administrative operations
on a file, such as deleting
the file, modifying file
protections, and displaying
directory information about
the file.

Check the user accounts
and predefined groups for
operators and administrators.

If an Advanced Server user
does not have the required
user rights, use the MODIFY
USER/ADD_TO_GROUP
command to add the user to the
appropriate groups, as described
in Section 3.1.14, Modifying
User Accounts.

Determine whether users
are unable to perform
administrative operations
on a file, such as deleting
the file, modifying file
protections, and displaying
directory information about
the file.

Use the SHOW FILES
command to display the
permissions set on the file.
Use this information to notify
users of changes you plan to
make to the file.

Use the TAKE FILE
OWNERSHIP or SET FILE
/PERMISSIONS command
to obtain the desired control
over a file and set permissions
appropriately, as described
in Section 4.3.10, Taking
Ownership of Files or
Directories, and Section 4.3.6,
Specifying File and Directory
Access Permissions.

6–34 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
6.2.2.10 Problems Connecting to the Advanced Server
Clients and servers in the network that communicate with the Advanced
Server to perform various tasks might receive error messages when attempting
to locate the Advanced Server. Use the procedures described in Table 6–16,
Procedure for Solving Problems Connecting to the Advanced Server, to address
host-to-host communication problems.
Table 6–16 Procedure for Solving Problems Connecting to the Advanced Server
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

The client computer receives
the following error when
attempting to map a network
drive:

Can the client communicate
with any other system on the
network? Use PING or NCP
LOOP commands against
other systems on the same
physical segment.

Check the physical cabling and
network adapter of the client for
loose connections.

Can the client communicate
with the target server at
the transport level? For
example, can the client PING
or TELNET to the server
using the server’s IP address?
If a Wide Area Network path
is used, verify communication
along each segment of the
network using a utility such
as Tracert.

Check the transport configuration such as IP address,
subnet mask, broadcast address,
and default gateway/routes of
systems involved.

‘‘Network path not found’’

(continued on next page)

Monitoring Events and Troubleshooting 6–35

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
Table 6–16 (Cont.) Procedure for Solving Problems Connecting to the Advanced
Server
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

Can the source system
resolve the NetBIOS name(s)
of the target system, and
can the target server resolve
the NetBIOS name(s) of the
source system? You can use
tools such as NBTSTAT.EXE
on Windows systems and
NBSHOW KNBSTATUS
on Advanced Server and
PATHWORKS systems to
perform limited NetBIOS
name resolution testing.
In addition, you can use
Windows NT Resource Kit
utilities such as DOMMON,
NLTEST, and BROWSTAT to
test connectivity.

Ensure NetBIOS name
registration is occurring on
the correct WINS Server or that
appropriate NetBIOS names are
represented in LMHOSTS files.

Is the problem license
related?

See Section 6.2.2.11, License
Acquisition and Validation
Problems.

Is the Advanced Server file
server process running? Use
the PWSHOW command
and verify that the
PWRK$LMSRV process is
present.

If the PWRK$LMSRV process
is not running, restart the
Advanced Server with the
command PWRESTART.

(continued on next page)

6–36 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
Table 6–16 (Cont.) Procedure for Solving Problems Connecting to the Advanced
Server
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

The client computer receives
the error ‘‘Network name not
found.’’

This error usually indicates
that the share name cannot
be found or the share path
is not available. Use the
ADMINISTER SHOW
SHARE/PATH command
to verify that the share
exists and the share path
is correct. Verify that the
share path is available
(that is, that the device
reference is valid). Use the
ADMINISTER/ANALYZE
command to check for device
and autoshare related errors.

If the share path is incorrect,
the share must be removed and
added again using the correct
path.
If the device is not mounted,
mount it.
For autoshare errors, change the
volume label to 11 characters or
less or establish a different
autoshare name for the device
as described in Section 4.2.3.2,
Defining Autoshares.
If the device was mounted after
the Advanced Server started,
use the following ADMINISTER
command to make it accessible
to the Advanced Server:
SET COMPUTER/
AUTOSHARE_SYNCHRONIZE.

Monitoring Events and Troubleshooting 6–37

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
6.2.2.11 License Acquisition and Validation Problems
For a client to use the services of an Advanced Server for OpenVMS V7.3 (or
higher) server, the Client Access license (PWLMXXXCA07.03) is required. A
client can acquire either one of the following:
•

Client-based license from a License Server

•

Server-based license from the Advanced Server for OpenVMS system to
which the client connects

A client-based license is acquired once, and thereafter it is verified during
client startup. The License Server is responsible for assigning and verifying
client-based licenses. Once acquired, the client-based license is presented for
validation when establishing a session to any Advanced Server for OpenVMS
server. The License Registrar on each Advanced Server for OpenVMS server
is responsible for validating client-based licenses or assigning a server-based
license, if available, when clients establish a session.
A server-based license is assigned to a client only for the duration of the client’s
session with the server.
Note that client-based licensing involves two distinct operations:
•

Obtaining (or verifying, once initially acquired) the appropriate license
from a License Server during startup

•

Validating the appropriate license when establishing a session to an
Advanced Server for OpenVMS server

Clients using client-based licensing may report license acquisition (or
verification) problems during startup. These problems typically result in a
‘‘LICnnnn error’’ being displayed on the client. Refer to the Compaq Advanced
Server for OpenVMS Guide to Managing Advanced Server Licenses for more
information on these messages.
All clients, whether using client-based licensing or not, may also report
problems connecting to a server that could be the result of a license validation
issue. To address these issues, see Table 6–17, Procedure for Solving License
Validation Problems.

6–38 Monitoring Events and Troubleshooting

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
Table 6–17 Procedure for Solving License Validation Problems
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

When mapping a network
drive, the Windows NT or
Windows 2000 client sees:

If a license problem is
preventing a client from
connecting to a server,
a warning message is
written to the Advanced
Server common event log
($ ADMIN/ANALYZE)
indicating ‘‘No server license
for client - access denied,’’
along with the name of the
client.

Add server-based licenses
to the server, or check the
License Server to ensure
adequate client-based licenses
are available to clients. For
more information, refer to the
Compaq Advanced Server for
OpenVMS Guide to Managing
Advanced Server Licenses.

Also check for applicable
messages in the License
Registrar log file on the
server (PWRK$LICENSE_
REGISTRAR_nodename.LOG).

Extend the logging performed
by the License Registrar
process, and then recheck
the PWRK$LICENSE_
REGISTRAR_nodneame.LOG
file for errors. For details
on logging capabilities, see
the comments in the License
Registrar process startup file,
SYS$STARTUP:PWRK$
LICENSE_R_START.COM.

•

The error message:
‘‘A connection to the
server could not be
made because the
limit on the number
of concurrent connections
for this account has been
reached.’’

•

If the Alerter service is
running on the server,
a Messenger pop-up
window indicating that
the connection attempt
was denied because
the server failed to
authenticate a license for
the client.

(continued on next page)

Monitoring Events and Troubleshooting 6–39

Monitoring Events and Troubleshooting
6.2 Troubleshooting Server Problems
Table 6–17 (Cont.) Procedure for Solving License Validation Problems
Step 1: Collect Information

Step 2: Analyze the Problem

Step 3: Solve the Problem

When mapping a network
drive, the Windows 95 or
Windows 98 client sees the
following error message:
‘‘The local device type and
the network resource type are
not the same.’’

See analysis instructions
above.

See problem-solving instructions
above.

6–40 Monitoring Events and Troubleshooting

7
Managing Server Configuration
Parameters
Advanced Server allows you to make additional adjustments to the server
software configuration after running the server configuration procedure
PWRK$CONFIG.COM.
To modify server-specific parameters that are not stored in the OpenVMS
Registry, you can use the Configuration Manager, a character-cell user
interface. These parameters are, for the most part, directly or indirectly
related to the environment in which the Advanced Server operates, such as the
server’s usage of OpenVMS system resources (physical memory, for example).
Examples of these parameters include the server’s client capacity, the size of
its data cache, and which network transports it should use.
To manage server-specific configuration parameters that are stored in
the OpenVMS Registry, you can use the PWRK$REGUTL utility. These
parameters identify the Advanced Server and affect the behavior of the
Advanced Server but not, for the most part, file server resource consumption.
Examples of these parameters include the name for the Advanced Server on
the network, its cluster alias, values that specify how the Advanced Server
deals with Browser activity, values that affect network logon, and values that
define the shares created automatically by the Advanced Server.
This chapter includes the following sections:
•

Section 7.1, Managing File Server Parameters Affecting System Resources,
describes how to use the Configuration Manager to manage the server’s
system environment configuration.

•

Section 7.2, Managing Server Configuration Parameters Stored in the
OpenVMS Registry, describes the OpenVMS Registry and how to manage
server configuration parameters stored in the OpenVMS Registry.

Managing Server Configuration Parameters 7–1

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources

7.1 Managing File Server Parameters Affecting System
Resources
After you install the server software, you can use the Configuration Manager
to modify server-specific parameters that are not stored in the OpenVMS
Registry. These parameters are, for the most part, directly or indirectly
related to the environment in which the Advanced Server operates, such as the
server’s usage of OpenVMS system resources (for example, physical memory).
Examples of these parameters include the server’s client capacity, the size of
its data cache, and which network transports it should use.
The Configuration Manager has a character-cell user interface. If you are
using DECterm or an equivalent terminal emulator, you can access all the
functions of the Configuration Manager using a mouse input device. If you
are using a keyboard to control the Configuration Manager, see Section 7.1.8,
Navigating the Configuration Manager Using a Keyboard, for information
about the keys you can use to control the Configuration Manager.
The server parameters you can modify using the Configuration Manager
include:
•

Basic configuration parameters, including:
The client capacity of the server
The percentage of free physical memory to be considered available to
the server
The size of the server’s data cache
The maximum number of concurrent user signons
The OpenVMS process priority for the server process

•

Advanced configuration parameters, including:
Enabling and disabling open file caching, which delays the actual
closing of user files
The time interval controlling open file caching
The average number of files allowed open per client
The average number of byte range locks held per client
Enabling and disabling dynamic security upgrading of PATHWORKS
V5 for OpenVMS (LAN Manager) files
The security model that the server uses at the file access level

7–2 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources
•

Transport parameters, including:
The selection of transports enabled
The wide-area networking (WAN) capabilities of the server, if any

Each type of parameter is presented on a separate screen by the Configuration
Manager. Each parameter is described in more detail in a later section.

7.1.1 Starting the Configuration Manager
To start the Configuration Manager, log in to the OpenVMS SYSTEM account,
or to an account with similar privileges, and enter the following command:
$ ADMINISTER/CONFIGURATION
The screen shown in Figure 7–1, Basic Configuration Parameters Screen,
appears.
Figure 7–1 Basic Configuration Parameters Screen
Advanced Server Configuration for node COBRAZ
Options

Help

Server's Client Capacity
[ ] Maximize Client Capacity Using AUTOGEN/Reboot
[*] Maximize Client Capacity Without AUTOGEN or Reboot
[ ] User Supplied Client Capacity
Client Capacity: 151
Percent of Physical Memory Used: 80
___
Data Cache Size (Kbytes): 20180
______
Maximum Concurrent Signons: 10
___
OpenVMS Process Priority: 9
__
Verify

Quit

Advanced...

Transports...

Test for supportable configuration
VM-0215A-AI

The Basic Configuration Parameters screen allows you to modify the basic
server configuration parameters and provides access to the Advanced
Configuration Parameters screen and the Transport Configuration Parameters
screen. It allows you to verify the current configuration settings or to quit
the Configuration Manager without changing any configuration settings, and
provides online help information through the Help menu.

Managing Server Configuration Parameters 7–3

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources

7.1.2 Exiting the Configuration Manager
To exit the Configuration Manager, select one of the following buttons on the
Basic Configuration Parameters screen, and press the Enter or Return key:
•

The Verify button allows you to verify and save the configuration you
have established. For more information about saving and verifying your
parameter settings, see Section 7.1.7, Verifying and Saving the New
Configuration.

•

The Quit button allows you to exit the Configuration Manager without
saving your changes to the server parameters. To quit the Configuration
Manager, select the Quit command button and press the Enter or Return
key, choose the Quit menu item in the Options menu, or press Ctrl/Z.

7.1.3 Getting Help on the Configuration Manager
To get help while running the Configuration Manager, select the Help menu at
the top of the Basic Configuration Parameters screen.
From the Help menu, you can choose to display the following types of
information:
•

The Overview menu item describes the purpose and operation of the
Configuration Manager.

•

The Basic configuration menu item describes the server parameters you
change on the Basic Configuration Parameters screen.

•

The Advanced configuration menu item describes the server parameters
you change on the Advanced Configuration Parameters screen.

•

The Transport configuration menu item describes the server parameters
you change on the Transport Configuration Parameters screen.

The following sections describe each screen and each parameter in detail.

7.1.4 Modifying Basic Configuration Parameters
The first screen that appears when you start the Configuration Manager is
the Basic Configuration Parameters screen. It allows you to change the basic
server configuration parameters, as described in the following sections.

7–4 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources
7.1.4.1 Specifying a Server’s Client Capacity
Client capacity is the maximum number of client sessions the server can
support at a time. You can enter a value, or you can let the Configuration
Manager determine a value based on current resources.
To specify the client capacity, on the Basic Configuration Parameters screen:
1. Select User Supplied Client Capacity.
2. Enter the new value in the Client Capacity text box.
The Configuration Manager may need to run AUTOGEN or reboot your system
to make additional resources available to support such a configuration.
To allow the Configuration Manager to determine the appropriate setting,
select one of the following:
•

Maximize Client Capacity Using AUTOGEN or Reboot
Determines the maximum number of clients the server can accommodate
simultaneously given the maximum resource capacity of your system.
The Configuration Manager may need to run AUTOGEN, reboot your
system, or do both, to make additional resources available to support such
a configuration.

•

Maximize Client Capacity Without Using AUTOGEN/Reboot
Determines the maximum number of clients the server can accommodate
simultaneously, using the system resources currently being accessed.
You do not need to run AUTOGEN or reboot the system for such a
configuration.

To determine the maximum number of clients, use the following procedure:
1. Make sure the values on the Advanced Configuration Parameters screen
and the Transport Configuration Parameters screen are correct.
2. Choose one of the Client Capacity option buttons on the Basic Configuration
Parameters screen to control the way the determination will be made.
3. Select the Verify command button to verify and save the server parameter
settings, as described in Section 7.1.7, Verifying and Saving the New
Configuration.
After you determine the maximum number of clients the server will
accommodate, be sure that the network transports you want to use can accept
at least this many links. If not, configure the transports to accept more links.
•

For the DECnet family of products, the configuration change depends
on the version of DECnet. For DECnet Phase IV, the default maximum
number of transport links is 32. For this version of DECnet, you can
Managing Server Configuration Parameters 7–5

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources
configure the transport to accept 100 links by entering the following
commands:
$ MCR NCP DEFINE EXECUTOR MAXIMUM LINKS 100
$ MCR NCP SET EXECUTOR MAXIMUM LINKS 100
•

For DECnet-Plus, the default maximum number of transport links is 200.
To raise this maximum to 300, enter the following commands:
$ MCR NCL SET NODE 0 NSP MAXIMUM RECEIVE BUFFERS 6000
$ MCR NCL SET NODE 0 NSP MAXIMUM TRANSPORT CONNECTIONS 300
Note that the number of receive buffers should be set to 20 * n, where n
is the maximum number of transport connections. In addition, be sure
to edit the NET$LOGICALS.COM file to increase the NET$ACP quotas
appropriately.

For more information about configuring the DECnet transport, refer to the
Compaq DECnet for OpenVMS Network Management Utilities manual.
7.1.4.2 Specifying the Percent of Physical Memory Used
The Configuration Manager allows you to specify the maximum percentage of
the system’s physical memory that the configuration may use, primarily for the
number of clients and the data cache size. For example, if you set the value to
50%, and your Advanced Server currently has 200 MB of free memory available
(when the Configuration Manager verifies the configuration), the Configuration
Manager allows a maximum of 100 MB of memory to be available to support
the number of clients and data cache size currently configured for the server.
If, in the preceding example, the Configuration Manager determines that 100
MB is not enough to support the currently configured client capacity and data
cache size, then you can do either of the following:
•

Increase the percentage of physical memory used

•

Reduce the number of supported clients and/or the data cache size to
accommodate the percentage of physical memory available.

You can specify from 1% to 100% of physical memory. If you set the maximum
percentage value too high, other OpenVMS applications might not have enough
memory to operate. The default setting is 80%.
To modify the percentage of physical memory the server may use, on the Basic
Configuration Parameters screen, enter the percent value in the Percent of
Physical Memory Used field.

7–6 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources
7.1.4.3 Specifying Server Data Cache Size
The Configuration Manager allows you to specify the size of the data cache
for the server’s file data. A proper setting can decrease the amount of disk
I/O, improving server response. You can set this value from 512 Kbytes to
131,072 Kbytes (128 Mbytes). The default setting is 2048 Kbytes (2 Mbtyes).
Compaq recommends a minimum of 128 Kbytes of cache per concurrent client
session. For example, if you expect 200 concurrent client sessions, set the data
cache size to at least 25,600 Kbytes. When the Advanced Server starts, it
allocates pages directly off the free page list to create the data cache. For more
information about setting the data cache size, see Section 6.2.2.3.1, Monitoring
Data Cache Use by the File Server.
To modify server data cache size, on the Basic Configuration Parameters
screen, enter the number of Kbytes in the Data Cache Size field.
7.1.4.4 Specifying the Maximum Number of Concurrent Signons
The Configuration Manager allows you to specify the maximum number of
external authentication signon operations that can take place concurrently.
External authentication allows the Advanced Server to do the logon validation
for both network accounts and OpenVMS user accounts. For more information
about external authentication, see Section 3.1.17, External Authentication.
You can enter any number from 2 through 999. The default value for this
parameter is 10.
To modify the maximum number of concurrent signons, on the Basic
Configuration Parameters screen, enter the new value in the Maximum
Concurrent Signons field.
7.1.4.5 Specifying OpenVMS Process Priority
The Configuration Manager allows you to specify the base priority assigned
to main server processes for scheduling purposes. Values from 9 to 12 are
most appropriate. Server processes below base priority 9 can be preempted
by interactive processes, and processes above base priority 12 will not receive
their priority boosts.
To change the base process priority for the server, on the Basic Configuration
Parameters screen, enter the value in the OpenVMS Process Priority field.

Managing Server Configuration Parameters 7–7

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources

7.1.5 Modifying Advanced Configuration Parameters
The Advanced Configuration Parameters screen allows you to modify
configuration parameters that are less frequently modified. To change
advanced parameters, select the Advanced command button on the Basic
Configuration Parameters screen. The screen shown in Figure 7–2, Advanced
Configuration Parameters Screen, appears.
Figure 7–2 Advanced Configuration Parameters Screen
Advanced Configuration Parameters
Server's Client Capacity
[X] Use Open File Caching
5000
Open File Caching Interval (msec): _____
Files per Client: 12
____
6
Byte Range Locks per Client: ____
[X] Enable Dynamic Security Upgrade
Security Model
[*] Advanced Server Only
[ ] Advanced Server and OpenVMS

Cancel

Use Advanced Server security only
VM-0015A-AI

The following sections describe the advanced configuration parameters and
how to set them.
7.1.5.1 Enabling and Disabling Open File Caching
When Open File Caching is enabled, the server delays the actual closing of files
in case they are reopened shortly. Open File Caching is enabled by default.
You can disable Open File Caching by deselecting the Use Open File Caching
option on the Advanced Configuration Parameters screen.
To enable or disable Open File Caching, on the Advanced Configuration
Parameters screen, select Use Open File Caching. The check box contains
an X when open file caching is enabled.

7–8 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources
7.1.5.2 Setting the Open File Caching Interval
When Open File Caching is enabled, you can specify the amount of time to
delay the actual closing of files. The default setting is 5000 msec (milliseconds),
which is 5 seconds. You can specify from 0 to 65,535 milliseconds.
To modify the Open File Caching interval, on the Advanced Configuration
Parameters screen:
1. Be sure that the Use Open File Caching option is checked.
2. Enter the number of milliseconds to delay in the Open File Caching
Interval field.
7.1.5.3 Specifying the Files per Client
The Configuration Manager allows you to specify the average number of files
open per client. This value is used to compute values for a number of other
parameters having to do with open files and file I/O. You can specify any
nonzero value for this parameter; the default average is 12 open files per
client.
To modify the Files per Client value, on the Advanced Configuration
Parameters screen, enter the new value in the Files per Client field.
7.1.5.4 Specifying the Byte Range Locks per Client
The Configuration Manager allows you to specify the average number of byte
range locks held per client. Byte range locks are used by client applications for
locking portions of open shared files. You can specify any nonzero value for this
parameter; the default is 6 byte range locks per client.
To modify the value of Byte Range Locks per Client, on the Advanced
Configuration Parameters screen, enter the new value in the Byte Range
Locks per Client field.
7.1.5.5 Enabling Dynamic Security Upgrade
The Configuration Manager allows you to specify whether the server performs
dynamic upgrading of network security on files it accesses. When enabled,
any file the server accesses whose security is specified entirely according
to PATHWORKS V5 for OpenVMS (LAN Manager) security, is upgraded to
PATHWORKS V6 for OpenVMS (Advanced Server) security. The mapping
file created by the V6 Upgrade utility must be in place for dynamic security
upgrade to be performed. Refer to the Compaq PATHWORKS for OpenVMS
Server Migration Guide for more information about the Upgrade utility. By
default, dynamic security upgrade is not enabled.

Managing Server Configuration Parameters 7–9

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources
To enable or disable Dynamic Security Upgrade, on the Advanced Configuration
Parameters screen, select the Enable Dynamic Security Upgrade option. The
check box contains an X when dynamic security upgrading is enabled.
7.1.5.6 Specifying the Server Security Model
The Configuration Manager lets you specify the security model that the server
uses when checking access to a file, as shown in Table 7–1, Security Model
Configuration Parameter Settings.
Table 7–1 Security Model Configuration Parameter Settings
If you choose...

The server uses...

Advanced Server Only

A security model in which only network permissions
are checked. This is the default.

Advanced Server and OpenVMS

A security model in which both network permissions
and OpenVMS protections are checked.

For more information about the security models, see Section 4.1.2, Advanced
Server Security Models.
To select the server security model, on the Advanced Configuration Parameters
screen, select either Advanced Server Only or Advanced Server and OpenVMS.
7.1.5.7 Saving Advanced Configuration Parameter Changes
You can save the Advanced Configuration Parameters you have modified, or
you can quit without saving your changes.
To save advanced configuration parameters changes, on the Advanced
Configuration Parameters screen, select the OK button. If any setting is not
appropriate, the Configuration Manager displays an Information screen (such
as shown in Figure 7–5, Information Screen. If all the settings are appropriate,
the Basic Configuration Parameters screen reappears.
To ignore advanced configuration parameters changes, on the Advanced
Configuration Parameters screen, select the Cancel button or press Ctrl/C.
The Basic Configuration Parameters screen reappears.

7–10 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources

7.1.6 Configuring Transports
The Transport Configuration Parameters screen allows you to specify the
types of transports that are enabled on the server, and the type of wide-area
network capabilities, if any. To change the transport parameters, select the
Tranports command button on the Basic Configuration Parameters screen. The
Transport Configuration Parameters screen appears, such as the one shown in
Figure 7–3, Transport Configuration Parameters Screen.
Figure 7–3 Transport Configuration Parameters Screen
Transport Configuration Parameters
Transports
[X] DECnet
[X] NetBEUI
[X] TCP/IP

NetBIOS Name Resolution for TCP/IP
[ ] Enable LMHOSTS Resolution
[ ] Enable DNS Resolution
[ ] Enable WINS Resolution
WINS Server Address: __ - __ - __ - __

Cancel

Save any transport parameter changes
VM-0016A-AI

The transport configuration parameters are described in the following
sections.
7.1.6.1 Enabling and Disabling Transports
The Configuration Manager lets you enable or disable one or more of the
following transports: DECnet, NetBEUI, TCP/IP. (Note that for wide area
networking, the TCP/IP transport is required. DECnet also supports wide
area networks but the functionality it provides is not as extensive as that
provided by TCP/IP. NetBEUI is recommended only for use in small LAN-only
environments (approximately 50 nodes or less).) For more information on
transports and the protocols they support, see Appendix B, Network Protocols.

Managing Server Configuration Parameters 7–11

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources
To enable and disable a transport, on the Transport Configuration Parameters
screen, select the transport names. The transport is enabled if the check box
contains an X.
7.1.6.2 Selecting NetBIOS Name Resolution
The Configuration Manager lets you select name resolution for wide-area
network support, using LMHOSTS, WINS, and DNS name resolution. (You can
enable one, two, or all three of these name resolution methods.)
•

The Enable LMHOSTS Resolution option allows the server to resolve
NetBIOS names by looking them up in a local database that maps NetBIOS
names to TCP/IP addresses.

•

The Enable DNS Resolution option allows the server to act as a DNS client,
which will use a specified DNS server for NetBIOS name resolution as a
last resort if all other methods fail to resolve a NetBIOS name.
Note
DNS is not configured as a replacement for WINS or LMHOSTS but
rather as a supplement. DNS is used primarily for resolving node or
computer names; it is not used for resolving domain names. With DNS,
the Advanced Server still uses WINS, LMHOSTS, or both methods for
resolving domain names and certain other names.

•

The Enable WINS Resolution option allows the server to act as a WINS
client, which will use a specified WINS Server for NetBIOS name
registration and resolution.
The WINS Server Address field allows you to specify the TCP/IP address
for the WINS Server if WINS Resolution is enabled.

For additional procedures required to set up wide-area networking, refer to the
Compaq Advanced Server for OpenVMS Server Installation and Configuration
Guide.
To enable or disable LMHOSTS, on the Transport Configuration Parameters
screen, select Enable LMHOSTS Resolution. The checkbox contains an X when
LMHOSTS Resolution is enabled.
To enable or disable DNS name resolution, on the Transport Configuration
Parameters screen, select Enable DNS Resolution. The check box contains an
X when DNS name resolution is enabled.

7–12 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources
To enable or disable WINS name resolution, on the Transport Configuration
Parameters screen, select Enable WINS Resolution. The check box contains an
X when WINS name resolution is enabled.
When WINS name resolution is enabled, you must supply the TCP/IP address
for the WINS Server.
To supply the TCP/IP address for the WINS Server, on the Transport
Configuration Parameters screen:
1. Be sure Enable WINS Resolution is enabled.
2. Enter the TCP/IP address of the WINS Server in the WINS Server Address
field.
Note
If your Advanced Server runs in an OpenVMS Cluster in the domain
and you have it set up for dynamic cluster load balancing using DNS,
then enable the use of DNS for NetBIOS name resolution on all
servers and clients. Remove any entries for the cluster alias from
the LMHOSTS file and from the WINS database on WINS servers that
might be used by clients. For information on setting up dynamic load
balancing, see Section 2.4.4, Dynamic Cluster Load Balancing in WANs.

7.1.6.3 Saving Transport Configuration Parameter Changes
You can save the changes you have made to the transport configuration, or you
can quit without saving your changes.
To save transport configuration parameter changes, on the Transport
Configuration Parameters screen, choose the OK command button. If any
setting is not appropriate, the Configuration Manager displays an Information
screen, such as the one shown in Figure 7–5, Information Screen. If all the
settings are appropriate, the Basic Configuration Parameter screen reappears.
To ignore transport configuration parameter changes, on the Transport
Configuration Parameters screen, choose the Cancel command button, or
press Ctrl/C. The Basic Configuration Parameters screen reappears.

Managing Server Configuration Parameters 7–13

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources

7.1.7 Verifying and Saving the New Configuration
When you verify the configuration, the Configuration Manager determines
whether the new configuration can be supported.
To verify the new configuration, on the Basic Configuration Parameters screen,
select the Verify command button.
•

If any basic configuration parameter settings are inappropriate, the
Configuration Manager displays an Information screen, such as the one
shown in Figure 7–5, Information Screen.

•

If all the settings are appropriate, the Configuration Manager displays
either a Confirmation screen, as the one shown in Figure 7–4, Confirmation
Screen, or an Information screen, depending on whether the configuration
can be supported.

If the configuration can be supported, the Configuration Manager displays a
Confirmation screen that allows you to accept or reject the new configuration.
The Confirmation screen also tells you whether the server must be restarted
for the new settings to take effect, or if AUTOGEN and/or reboot will be
necessary to use the new configuration.
Figure 7–4 Confirmation Screen
Confirmation
A maximum of 796 clients can be supported.
You do not need to run AUTOGEN to use this configuration,
but you must restart the server.
Do you accept this configuration?
Yes

VM-0017A-AI

•

Choose the Yes button to accept the configuration you have established.
If you select Yes, the Configuration Manager saves the new configuration
and allows you to choose whether the AUTOGEN, reboot, or both should be
performed immediately, if required.

•

Choose the No button to reject the configuration you have established.
If you select No and reject the configuration, the Basic Configuration
Parameters screen reappears.

7–14 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources
If the configuration cannot be supported, or if it requires AUTOGEN, reboot,
or both, the Configuration Manager displays an Information screen, such as
the one shown in Figure 7–5, Information Screen, which allows you to view the
configuration log file for details.
Figure 7–5 Information Screen
Information
The number of clients specified (1200) CAN NOT be supported.
Click on "View Log File" for more details.
OK

View Log File

VM-0018A-AI

To view the log file, select the View Log File button. The log file shows
the OpenVMS SYSGEN parameter changes required to support the new
configuration, or why the configuration cannot be supported at all.
To dismiss the Information screen, select the OK button.

7.1.8 Navigating the Configuration Manager Using a Keyboard
You can control the Configuration Manager using a mouse or using keys on
the keyboard. Using the mouse, you can navigate through the Configuration
Manager screens by pointing and clicking on the desired item to select
(highlight) items in the menus, scroll boxes, or dialog boxes. (You must have
a DECterm window or equivalent emulator.) Table 7–2, Keys for Controlling
the Configuration Manager, lists the keys you use to control the action of the
Configuration Manager.
Table 7–2 Keys for Controlling the Configuration Manager
To...

Do the following...

Access the menu bar

Press F10, or press PF1 twice. Use the Tab
key to select the first item on the menu bar.

Move from one menu to another

Use the left and right arrow keys.

Point to a menu item

Use the up and down arrow keys.
(continued on next page)

Managing Server Configuration Parameters 7–15

Managing Server Configuration Parameters
7.1 Managing File Server Parameters Affecting System Resources
Table 7–2 (Cont.) Keys for Controlling the Configuration Manager
To...

Do the following...

Select a menu item within a menu

Use the up and down arrow keys, then
press the Enter or Return key.

Select a menu or an item within a menu

Move to the menu or menu item, then press
the Enter or Return key.

Exit the menu bar

Press Ctrl/Z.

Point to buttons and items in a dialog
box

Press the Tab key to advance, and PF1 Tab
to back up.

Move within a set of buttons or check
boxes

Use the arrow keys.

Choose among a set of options (radio
buttons)

Advance to the currently selected option
button using Tab or PF1 Tab. Then use the
arrow keys to choose a new option within
the set.

Change the state of a check box (on or
off)

Advance to the check box, then press the
space bar to toggle the state of the box.

Press a command button

Advance to the button and press the space
bar or the Return key. This executes the
button’s command.

Enter new text in a text box

Advance to the text box using Tab or PF1
Tab, and enter the new text. Any previous
text is erased.

Edit text or edit text in a text box

Advance to the text box using Tab or PF1
Tab. Use the arrow keys to move within
existing text.

Refresh the display at any time

Press Ctrl/W.

Save any changes made in a dialog box,
and return to the previous dialog box

At the OK command button, press the
Enter or Return key.

Discard any changes made in a
dialog box and return to the Basic
Configuration parameters screen.

At the Cancel command button, press
the Enter or Return key; or press Ctrl/C;
or press the Enter or Return key at the
Quit button on the Basic Configuration
Parameters screen.

7–16 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry

7.2 Managing Server Configuration Parameters Stored in the
OpenVMS Registry
Previous versions of the Advanced Server, such as the PATHWORKS for
OpenVMS servers, stored server parameters in the LANMAN.INI file. The
Advanced Server for OpenVMS stores most server parameters in the OpenVMS
Registry, which is similar to the Windows NT Registry. If you are upgrading a
system from PATHWORKS V6 for OpenVMS (Advanced Server) to Advanced
Server for OpenVMS, the server parameters and settings in the existing
LANMAN.INI file are migrated to the registry the first time you run the
PWRK$CONFIG.COM configuration procedure, as described in the Compaq
Advanced Server for OpenVMS Server Installation and Configuration Guide.

7.2.1 OpenVMS Registry Overview
The OpenVMS Registry, like the Windows NT Registry, is a single clusterwide
hierarchical database of configuration information about hardware and
software (including both the operating system and applications). The
OpenVMS Registry database stores information in a hierarchical structure
of keys and associated values. The database is maintained by the OpenVMS
Registry server. The OpenVMS Registry server controls all OpenVMS Registry
operations, such as maintaining the OpenVMS Registry database, and creating,
displaying, modifying, or deleting keys and values.
The OpenVMS Registry is accessible from Windows NT applications as
well as from OpenVMS utilities and Advanced Server utilities. Compaq
recommends using the PWRK$REGUTL utility to manage server parameters
in the OpenVMS Registry. Section 7.2.4, Using the PWRK$REGUTL Utility
to Manage Advanced Server Parameters in the OpenVMS Registry explains
how to use this utility. (For more information about managing the OpenVMS
Registry, refer to the OpenVMS System Manager’s Manual or the OpenVMS
Connectivity Developer’s Guide (included in the OpenVMS Documentation
CD-ROM).)
7.2.1.1 Registry Database Architecture
As does the Windows NT Registry, the OpenVMS Registry contains keys and
values:
•

A key is a basic element of the registry and may contain subkeys or values,
or both. Keys are arranged hierarchically and have unlimited depth. The
full key name specifies the path to follow from the root key to a specific
value.

•

A value is a named element of data. Each value has a name, a type, and
associated data.

Managing Server Configuration Parameters 7–17

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
The OpenVMS Registry contains two predefined root keys:
•

HKEY_LOCAL_MACHINE, which is reserved for keys pertaining to hardware,
software, security, and general system configuration.

•

HKEY_USERS, which is reserved for keys pertaining to each user.

Parameters defining the configuration of the Advanced Server are stored in the
root key HKEY_LOCAL_MACHINE. Appendix A, Server Configuration Parameters,
lists many of these server parameters and the keys under which each is
defined.
Figure 7–6, Example Keys to Advanced Server Registry Values, shows the
registry architecture on OpenVMS as displayed by the Windows NT registry
editor.

7–18 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
Figure 7–6 Example Keys to Advanced Server Registry Values
Registry Editor
Registry Edit Tree View Security Options Window Help

HKEY_LOCAL_MACHINE on VOGH
- HKEY_LOCAL_MACHINE
AlertNames:REG_MULTI_SZ:Administrator
+ HARDWARE
+ SAM
SECURITY
+ SOFTWARE
- SYSTEM
Clone
- CurrentControlSet
+ Control
Select
- Services
+ AdvancedServer
+ Alerter
Parameters
+ Browser
+ EventLog
+ LanmanServer
+ LanmanWorkstation
+ Netlogon
+ Replicator
+ Registry

VM-0099A-AI

The left-hand pane displays the key hierarchy. The right-hand pane displays:
•

The value (AlertNames) for the selected subkey (Parameters).

•

The data associated with AlertNames is ‘‘Administrator’’, indicating the
user to receive administrative alerts.

•

The data type is indicated by the symbol REG_MULTI_SZ, which signifies
a text string. (Section A.2, OpenVMS Registry Values, lists the other data
type symbols used by the Windows NT registry editor.)

For more information about server configuration parameters and data that may
be associated with them, see Appendix A, Server Configuration Parameters.
(Note that this appendix does not list all the server parameters in the
OpenVMS Registry. It lists those that you can modify.)

Managing Server Configuration Parameters 7–19

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
7.2.1.2 The OpenVMS Registry Server
The OpenVMS Registry server must be running for the Advanced Server
to run. If the OpenVMS Registry server is not running when you initially
configure the Advanced Server or when the Advanced Server is started,
the Advanced Server attempts to start the OpenVMS Registry server. For
information about configuring and starting the OpenVMS Registry server,
refer to the Compaq Advanced Server for OpenVMS Server Installation and
Configuration Guide. For more information, refer also to the OpenVMS System
Manager’s Manual or the OpenVMS Connectivity Developer’s Guide (included
in the OpenVMS Documentation CD-ROM).

7.2.2 Advanced Server Parameters Stored in the Registry
A server parameter is stored in the OpenVMS Registry when:
•

The initial configuration procedure (PWRK$CONFIG.COM) sets the value
of the server parameter.

•

The server parameter is migrated from the LANMAN.INI file.

•

You set the server parameter using a registry management tool described
in Section 7.2.3, How to Manage Advanced Server Parameters in the
OpenVMS Registry.

For a detailed list of most of the server configuration parameters that can be
stored in the OpenVMS Registry, including descriptions of the parameters,
LANMAN.INI parameter mappings, default data settings and minimum and
maximum values for integer data, see Appendix A, Server Configuration
Parameters.
Note
The Advanced Server startup procedure records a list of all Advanced
Server parameters that are defined in the OpenVMS Registry. You can
use this list as a reference if you should ever need the latest parameter
values. The list is stored in the following location, where nodename is
the name of your server node:
PWRK$PARAMS:PWRK$REGISTRY_PARAMS_nodename.LIS

7–20 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry

7.2.3 How to Manage Advanced Server Parameters in the OpenVMS
Registry
You can manage server parameters in the OpenVMS Registry using any one
of a number of utilities and tools, depending on the way you manage the
Advanced Server software.
7.2.3.1 Managing Registry-Stored Advanced Server Parameters from a Windows NT
Computer
You can manage Advanced Server software parameters in the OpenVMS
Registry remotely, from a Window NT computer running Windows NT Server or
Workstation software. However, Compaq recommends that you manage these
parameters from an OpenVMS system so that you can use PWKR$REGUTL,
which has built-in knowledge of keys and values used by the Advanced Server,
as explained in Section 7.2.3.2, Managing Registry-Stored Advanced Server
Parameters from OpenVMS.
Windows NT provides two registry editor utilities: REGEDT32 and REGEDIT.
Use the REGEDT32 application to display and modify server parameters;
the REGEDIT utility cannot be used to modify the OpenVMS Registry. For
more information about using REGEDT32, refer to the Window NT product
documentation.
When you access the OpenVMS Registry from a network client, the connection
is based on network user authentication. Therefore, you must be logged on
to the network to access the registry from a network client. If you are using
Windows NT REGEDT32 to modify server parameters, you must be logged on
as a privileged user.
To access the server parameters in the OpenVMS Registry:
1. Start the REGEDT32 application using the Run... menu item in the Start
menu.
2. Select the Select Computer... menu item from the Registry menu.
3. Enter the name of the OpenVMS server in Computer: text box. Click on
OK.
4. Select the panel HKEY_LOCAL_MACHINE on the OpenVMS server.
5. Expand the key you want to open by double-clicking on it.
6. Display the data associated with a value by double-clicking on the value.
Figure 7–6, Example Keys to Advanced Server Registry Values, provides an
example of the REGEDT32 display.

Managing Server Configuration Parameters 7–21

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
7.2.3.2 Managing Registry-Stored Advanced Server Parameters from OpenVMS
If you are managing the Advanced Server from the OpenVMS system (you
are using a workstation or terminal emulator), you can use either the
OpenVMS system registry control program (REG$CP) or the PWRK$REGUTL
utility supplied with the Advanced Server. You can modify registry entries
in the OpenVMS Cluster only; you cannot modify entries for remote
servers. For information about REG$CP, see the REG$CP online help.
The PWRK$REGUTL utility is described in Section 7.2.4, Using the
PWRK$REGUTL Utility to Manage Advanced Server Parameters in the
OpenVMS Registry.
Compaq recommends that you use PWKR$REGUTL to manage server
configuration parameters, for the reasons outlined in Section 7.2.4, Using
the PWRK$REGUTL Utility to Manage Advanced Server Parameters in the
OpenVMS Registry.
Note
Figure 7–6, Example Keys to Advanced Server Registry Values, shows
the registry architecture as displayed by the Windows NT registry
editor. The architecture shown includes several keys that are not
accessible by the PWRK$REGUTL utility on OpenVMS. Those keys and
the values they include are referenced for use by other applications.
The PWRK$REGUTL utility accesses Advanced Server configuration
parameters that directly pertain to the operation of the server and
its services. Compaq recommends modifying only those parameters
accessible by PWRK$REGUTL.

7.2.4 Using the PWRK$REGUTL Utility to Manage Advanced Server
Parameters in the OpenVMS Registry
The PWRK$REGUTL utility allows you to display, set, and delete server
configuration parameters in the OpenVMS Registry. The PWKR$REGUTL
utility is available to use after you install the Advanced Server software.
Compaq recommends that you use PWRK$REGUTL to manage server
configuration parameters in the OpenVMS Registry for the following reasons:
•

It has built-in knowledge of keys and values used by the Advanced Server,
including the attributes of the data, such as minimum, maximum, and
default values. As such, it restricts you from setting inappropriate values
for server parameters.

•

It prevents you from managing parameters in the OpenVMS Registry that
should not be modified.

7–22 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
•

It accepts either of two syntax styles for input: registry style or
LANMAN.INI style. For more information, see Section 7.2.4.4,
PWRK$REGUTL Command Format and Environment Settings.

The program is found at:
SYS$SYSTEM:PWRK$REGUTL.EXE
If your process has defined the Advanced Server command definitions provided
in the PWRK$DEFINE_COMMANDS.COM file, or if you have defined the
REGUTL command, you can start the PWRK$REGUTL utility by entering the
REGUTL command. To define the REGUTL command and start the utility,
enter the following commands at the OpenVMS command prompt:
$ REGUTL :== $SYS$SYSTEM:PWRK$REGUTL.EXE
$ REGUTL
REGUTL>
As shown, the PWRK$REGUTL utility responds by displaying the REGUTL>
prompt.
To use PWRK$REGUTL to access the OpenVMS Registry, your process must
have one of the following:
•

OpenVMS SYSPRV system privileges

•

REG$UPDATE right identifier associated with the user account

The PWRK$REGUTL utility has a command-line user interface that is
compatible with OpenVMS DCL command conventions.
When you use the PWRK$REGUTL utility, the OpenVMS Registry server must
be running on the OpenVMS system. However, the Advanced Server need not
be running. This allows you to modify server configuration parameters before
the Advanced Server is started.
7.2.4.1 How to Exit PWRK$REGUTL
To exit the PWRK$REGUTL utility, enter the EXIT command in response to
the REGUTL> prompt, or press CTRL/Z. For example:
REGUTL> EXIT
$

Managing Server Configuration Parameters 7–23

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
7.2.4.2 How to Get Online Help
The PWRK$REGUTL program includes complete online help, displaying
the PWRK$REGUTL commands, qualifiers, and parameters. The following
sections describe some common operations performed with PWRK$REGUTL.
To get online help, enter the HELP command at the REGUTL> prompt:
REGUTL> HELP
The PWRK$REGUTL utility is provided with Advanced Server for OpenVMS
for setting and modifying server configuration parameters. Refer to
the Advanced Server for OpenVMS Server Administrator’s Guide for more
information about using this utility.
You can get more help by entering any of the following commands:
CREATE REQUIRED KEYS
DELETE KEY
DELETE KNOWN VALUES
DELETE VALUE
HELP
SET VALUE
SHOW VALUE

CREATE REQUIRED VALUES
DELETE KNOWN KEYS
DELETE PARAMETER
EXIT
SET PARAMETER
SHOW PARAMETER

Topic?
This example shows the top-level help, listing the possible commands. The
help file displays further information about specific commands when you enter
the command name after the Topic? prompt.
7.2.4.3 PWRK$REGUTL Commands
The PWRK$REGUTL commands are described in Table 7–3, PWRK$REGUTL
Commands.
Table 7–3 PWRK$REGUTL Commands
Command Name

Purpose

CREATE REQUIRED KEYS

Creates all the server parameter keys in the
registry. For use by authorized software specialists
only.

CREATE REQUIRED VALUES

Creates all the server parameters in the registry.
For use by authorized software specialists only.

DELETE KEY

Deletes the specified key from the registry. The
key will not be deleted if it contains any values or
subkeys.
(continued on next page)

7–24 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
Table 7–3 (Cont.) PWRK$REGUTL Commands
Command Name

Purpose

DELETE KNOWN KEYS

Deletes all server keys from the registry. A key will
not be deleted if it currently contains any registry
values or subkeys.

DELETE KNOWN VALUES

Deletes all server parameter values currently stored
in the registry.

DELETE PARAMETER

Deletes the specified server parameter from the
registry. You specify the server parameter by using
its LANMAN.INI section and keyword names.

DELETE VALUE

Deletes the specified value (a server parameter)
from the registry. You specify the server parameter
by using its registry key and value names.

EXIT

Exits the PWRK$REGUTL utility.

HELP

Displays information about the PWRK$REGUTL
commands.

SET PARAMETER

Sets a value in the registry for the named server
parameter. You specify the server parameter by
using its LANMAN.INI section and keyword names.

SET VALUE

Sets data in the registry for the named value
(a server parameter). You specify the server
parameter by using its key and value names.

SHOW PARAMETER

Displays the value in the registry for the named
server parameter. You specify the server parameter
by using its LANMAN.INI section and keyword
names.

SHOW VALUE

Displays the data in the registry for the named
value (a server parameter). You specify the server
parameter to display by using its registry key and
value names.

7.2.4.4 PWRK$REGUTL Command Format and Environment Settings
You can display, set, or delete server configuration parameters in the OpenVMS
Registry by using either of two syntax styles for PWRK$REGUTL commands:
registry style or LANMAN.INI style. The registry-style commands are SHOW
VALUE, SET VALUE, and DELETE VALUE. The corresponding LANMAN.INI
style commands are SHOW PARAMETER, SET PARAMETER, and DELETE
PARAMETER. Whatever style you use, specify the following in the command
line:

Managing Server Configuration Parameters 7–25

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
•

The parameter path. In registry-style syntax, the parameter path is the
registry key under the root key. In LANMAN.INI-style syntax, it is the
section name.

•

The parameter name. In registry-style syntax, the parameter name is the
registry value name. In LANMAN.INI-style syntax, it is the LANMAN.INI
keyword.

For example, to modify the SrvComment (server description) parameter
in registry style, use the SET VALUE command, specifying the registry key,
SYSTEM\CURRENTCONTROLSET\SERVICES\LANMANSERVER\PARAMETERS
and value name (SrvComment). The command sets the server description as
‘‘I.L.M. Server’’.
REGUTL> SET VALUE SYSTEM\CURRENTCONTROLSET\SERVICES_REGUTL> \LANMANSERVER\PARAMETERS SRVCOMMENT "I.L.M. Server"
This example includes the command-line continuation character (-) to allow
the command to be continued past the end of the first line. You can use the
wildcard character (*) instead of the key name, simplifying the command input,
as in the following example:
REGUTL> SET VALUE * SRVCOMMENT "I.L.M. Server"
To modify the SrvComment server parameter in LANMAN.INI style, use
the SET PARAMETER command, specifying the LANMAN.INI section and
keyword names.
REGUTL> SET PARAMETER SERVER SRVCOMMENT "I.L.M. Server"
To simplify command input, you can specify the asterisk (*) wildcard character
for the LANMAN.INI section name.
The LANMAN.INI syntax style conforms to the structure and naming of server
parameters as used in PATHWORKS V6 for OpenVMS (Advanced Server). You
can use the LANMAN.INI style if you are more familiar with the LANMAN.INI
structure and terminology. Remember that when you use the LANMAN.INI
syntax style, the server parameters are actually retrieved and modified in
the OpenVMS Registry: the Advanced Server for OpenVMS does not use the
LANMAN.INI file (the PATHWORKS V6 for OpenVMS (Advanced Server)
does).

7–26 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
7.2.4.5 Displaying Server Parameter Settings
You can display server parameters and settings that are established by
the server configuration procedure, those that have been migrated from
the LANMAN.INI file if the server was upgraded from PATHWORKS V6
for OpenVMS (Advanced Server), and any parameters that have been set
using a registry management tool. You can display the default values for
server parameters that are not currently stored in the registry by using the
/KNOWN qualifier with the SHOW command, as described in Section 7.2.4.5.1,
Displaying Server Parameters, Including Defaults of Those Not Currently
Stored in the Registry.
To display information about server parameters currently stored in the
OpenVMS Registry, use the SHOW VALUE or SHOW PARAMETER command.
For example, to display information about the Scripts parameter in registry
style, enter the following command. The registry key and value names are
displayed along with other information.
REGUTL> SHOW VALUE SYSTEM\CURRENTCONTROLSET\SERVICES_REGUTL> \NETLOGON\PARAMETERS SCRIPTS
Key: SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Value: Scripts
Type: Expanded String
Current Data: PWRK$LMROOT:[LANMAN.REPL.IMPORT.SCRIPTS]
You can specify the wildcard character (*) for the parameter path and name,
or to replace a portion of the command option. (The percent (%) wildcard
character is not valid.) For example, to display the location where logon scripts
are stored, enter the following registry-style command:
REGUTL> SHOW VALUE * SCRIPTS
Key: SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Value: Scripts
Type: Expanded String
Current Data: PWRK$LMROOT:[LANMAN.REPL.IMPORT.SCRIPTS]

Note
To show all server parameters, use the SHOW VALUES command with
a wildcard. Using the SHOW PARAMETERS command with a wildcard
(such as, SHOW PARAMETERS * *) displays only those server
parameters equivalent in name to the parameters originally defined
in the PATHWORKS V6 (Advanced Server) software (the LANMAN.INI
file). In other words, the SHOW PARAMETERS command does not
display all the server-related registry data that can be set. It omits

Managing Server Configuration Parameters 7–27

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
the several server parameters that have been added to the Advanced
Server for OpenVMS software and are foreign to PATHWORKS V6.

To display information about the Scripts parameter in LANMAN.INI style,
enter the following command:
REGUTL> SHOW PARAMETER NETLOGON SCRIPTS
Section Name: netlogon
Keyword Name: scripts
Type: Expanded String
Current Data: PWRK$LMROOT:[LANMAN.REPL.IMPORT.SCRIPTS]
The display shows the LANMAN.INI section and keyword names.
To display specific information about the registry values, use the appropriate
qualifier with the SHOW VALUE or SHOW PARAMETER command. The
SHOW command qualifiers are listed in Table 7–4, PWRK$REGUTL SHOW
Command Qualifiers.
Table 7–4 PWRK$REGUTL SHOW Command Qualifiers
/DIFFERENCE

Displays only those parameters whose settings have
been changed from their default values.

/FULL

Displays complete information about parameters,
including data type and the minimum and maximum
values.

/KNOWN

Displays values or data for Advanced Server
parameters currently stored in the registry and the
server defaults for those not currently stored in
the registry. Using the SHOW command without
the /KNOWN qualifier displays only those server
parameters currently stored in the registry.

/MAP_NAME

Displays the registry key and value names, along with
the corresponding LANMAN.INI section and keyword
names.

7.2.4.5.1 Displaying Server Parameters, Including Defaults of Those Not
Currently Stored in the Registry To display all Advanced Server parameters,
including the default values of those not currently stored in the registry, use
wildcards and the /KNOWN qualifier with the SHOW PARAMETER or SHOW
VALUE command, such as in the following example (registry style):
REGUTL> SHOW VALUE * * /KNOWN

7–28 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
When you use the SHOW command without the /KNOWN qualifier, the display
includes only those server parameters currently stored in the registry (in
other words, those that have been set or created with a registry management
tool). Refer to the restriction noted in Section 7.2.4.5, Displaying Server
Parameter Settings, about displaying parameters with a wildcarded SHOW
PARAMETERS command.
Note that the Advanced Server startup procedure records a list of all Advanced
Server parameters that are set in the OpenVMS Registry. You can use this
list as a reference if you should ever need the latest parameter values. For
more information, see Section 7.2.2, Advanced Server Parameters Stored in the
Registry.
For a list and description of most of the server parameters that can be stored
in the OpenVMS Registry, along with the LANMAN.INI names for those
parameters, see Appendix A, Server Configuration Parameters.
You can use the /KNOWN qualifier to display server parameters associated
with a specific key, such as in the following example. In this example,
the SHOW command displays all parameters associated with the key
SYSTEM\CURRENTCONTROLSET\SERVICES\NETLOGON\PARAMETERS,
both those currently stored in the registry and the defaults for those not being
stored in the registry. The ‘‘Source:’’ field indicates whether the value for the
parameter is obtained from the registry or the server software default.
REGUTL> SHOW VALUE SYSTEM\CURRENTCONTROLSET\SERVICES_REGUTL> \NETLOGON\PARAMETERS * /KNOWN
Key: SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Value: LogonQuery
Source: Default
Type: Integer
Default Data: 900
Key: SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Value: Pulse
Source: Default
Type: Integer
Default Data: 300
Key: SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Value: QueryDelay
Source: Default
Type: Integer
Default Data: 2

Managing Server Configuration Parameters 7–29

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
Key: SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Value: Randomize
Source: Default
Type: Integer
Default Data: 30
Key: SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Value: RelogonDelay
Source: Default
Type: Integer
Default Data: 2
Key: SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Value: Scripts
Source: Registry
Type: Expanded String
Current Data: PWRK$LMROOT:[LANMAN.REPL.IMPORT.SCRIPTS]
Key: SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Value: SsiPasswdAge
Source: Default
Type: Integer
Default Data: 604800
Key: SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Value: Update
Source: Registry
Type: String
Current Data: NO
7.2.4.5.2 Displaying Detailed Information About Parameters To display
complete information about server parameters in the OpenVMS Registry,
use the /FULL qualifier with the SHOW VALUE or SHOW PARAMETER
command. The display includes information such as the parameter default
setting, and minimum and maximum values allowed. For example, to display
detailed information about the MaxSize server parameter, enter the following
command (registry style):
REGUTL> SHOW VALUE * MAXSIZE/FULL
Key: SYSTEM\CurrentControlSet\Services\EventLog\Application
Value: MaxSize
Source: Registry
Type: Integer
Current Data: 524288
Default Data: 524288
Min: 1024
Max: -1

7–30 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
Key: SYSTEM\CurrentControlSet\Services\EventLog\Security
Value: MaxSize
Source: Registry
Type: Integer
Current Data: 524288
Default Data: 524288
Min: 1024
Max: -1
Key: SYSTEM\CurrentControlSet\Services\EventLog\System
Value: MaxSize
Source: Registry
Type: Integer
Current Data: 524288
Default Data: 524288
Min: 1024
Max: -1
This example shows that the MaxSize parameter is defined in three registry
keys: one for each type of event log maintained by the Advanced Server:
•

Application event log

•

Security event log

•

System event log

Normally, the parameter is assigned the same data in all three sections, as
is the case in this example. Note that the value ‘‘-1’’ shown for the maximum
value indicates that there is no limit.
7.2.4.5.3 Displaying Both Registry and LANMAN.INI Names for Server
Parameters To display both the registry key and value names and the
corresponding LANMAN.INI section and keyword names, use the /MAP_
NAME qualifier with the SHOW VALUE or SHOW PARAMETER command.
With the SHOW VALUE command, the registry key and value names are
displayed first, then the corresponding LANMAN.INI section and keyword
names, as in the following example. With the SHOW PARAMETER command,
the LANMAN.INI section and keyword names are displayed first, followed by
the corresponding registry key and value names.
REGUTL> SHOW VALUE * SCRIPTS/MAP_NAME
Key: SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Value: Scripts
Section Name: netlogon
Keyword Name: scripts
Type: Expanded String
Current Data: PWRK$LMROOT:[LANMAN.REPL.IMPORT.SCRIPTS]

Managing Server Configuration Parameters 7–31

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
7.2.4.6 Modifying Server Parameters
To modify the data settings for any server parameter stored in the OpenVMS
Registry, use the PWRK$REGUTL SET VALUE or SET PARAMETER
command. For example, to change the text string associated with the
SrvComment parameter, enter the following command (registry style):
REGUTL> SET VALUE SYSTEM\CURRENTCONTROLSET\SERVICES\LANMANSERVER_REGUTL>\PARAMETERS SRVCOMMENT "My OpenVMS Server"
This registry-style command line includes the key and value names. The
continuation character (-) allows the command to be continued past the end
of the first line. You can use the wildcard character (*) instead of the key
name (or, in a LANMAN.INI style command, instead of the section name),
simplifying the command input. (Do not use the wildcard character for the
value or keyword name in a SET command line.)
To enter this command in LANMAN.INI style, enter the following:
REGUTL> SET PARAMETER SERVER SRVCOMMENT "My OpenVMS Server"
PWRK$REGUTL enforces the minimum and maximum values allowed for each
server parameter. If you enter a value below the minimum, the value is set to
the minimum. If you enter a value above the maximum, the value is set to the
maximum. For example, the following command attempts to set the maximum
client session capacity to 150, which is higher than the maximum setting:
REGUTL> SET VALUE * NUMCLIENT_SESSION 150
%REGUTL-I-VALTOMAX, value set to maximum of 128
As the PWRK$REGUTL message indicates, the maximum value is set as a
result of this command. This command example also shows the use of the
wildcard character (*) for the parameter path.
Similarly, the PWRK$REGUTL utility prevents you from entering a server
parameter that is not recognized by the Advanced Server. For example, if
you misspell the parameter value in the registry, the following message is
displayed:
REGUTL> SET VALUE * NUM_CLIENTSESSION 150
%REGUTL-W-VALUNKWN, unknown value NUM_CLIENTSESSION
7.2.4.6.1 Resetting Parameter Values To reset the data setting for a
parameter to the default setting, omit the data and include the /DEFAULT
qualifier on the SET PARAMETER or SET VALUE command line.

7–32 Managing Server Configuration Parameters

Managing Server Configuration Parameters
7.2 Managing Server Configuration Parameters Stored in the OpenVMS Registry
7.2.4.6.2 Creating a Value in the Registry You cannot use the SET command
to modify the value of a parameter that is not in the registry (you will receive
an error message). To create a parameter that is not in the OpenVMS Registry,
include the /CREATE qualifier on the SET VALUE command line. To create a
parameter that is not currently stored in the registry and to set the data value
to the default setting, enter the SET VALUE command with both the /CREATE
and /DEFAULT qualifiers. For example, the following registry-style commands
show how to define the NumClient_Session parameter in the OpenVMS
Registry, set its value to the default setting, and then display the setting:
REGUTL> SET VALUE SYSTEM\CURRENTCONTROLSET\SERVICES\ADVANCEDSERVER_REGUTL>\PROCESSPARAMETERS NUMCLIENT_SESSION/CREATE/DEFAULT
REGUTL> SHOW VALUE * NUMCLIENT_SESSION
Key:SYSTEM\CurrentControlSet\Services\AdvancedServer\ProcessParameters
Value: NumCLIENT_SESSION
Type: Integer
Current Data: 32
PWRK$REGUTL only allows you to create values known to the Advanced
Server. To create other keys and values, use another registry editor such as
those listed in Section 7.2.3, How to Manage Advanced Server Parameters in
the OpenVMS Registry.
7.2.4.7 Deleting Server Parameters
The PWRK$REGUTL utility allows you to remove a server parameter and
its set data values from the OpenVMS Registry. To remove a parameter and
its setting, use the DELETE VALUE or DELETE PARAMETER command.
For example, to remove the server parameter NumClient_Session from the
registry, enter the following PWRK$REGUTL DELETE VALUE (registry-style)
command. As shown, a subsequent SHOW VALUE command results in a
message indicating the server parameter does not exist in the registry.
REGUTL> DELETE VALUE \SYSTEM\CURRENTCONTROLSET\SERVICES_REGUTL>\ADVANCEDSERVER\PROCESSPARAMETERS NUMCLIENT_SESSION
REGUTL> SHOW VALUE * NUMCLIENT_SESSION
%REGUTL-W-NOTINREG, known but not found in registry

Managing Server Configuration Parameters 7–33

A
Server Configuration Parameters
The server configuration parameters for the Advanced Server are stored and
referenced from the OpenVMS Registry. The registry contains a collection of
parameters that define the configuration of the Advanced Server software.
When the Advanced Server is installed, default settings are assigned to these
parameters. For information about managing server configuration parameters,
see Section 7.2, Managing Server Configuration Parameters Stored in the
OpenVMS Registry.
This appendix lists the configuration parameters, including:
•

Registry values

•

Registry keys

•

Associated LANMAN.INI keyword and section

•

Description of each value

•

Type of data and default data associated with each value

•

Parameters for setting data associated with each value

For more information about managing the server configuration parameters
in the OpenVMS Registry, see Section 7.2, Managing Server Configuration
Parameters Stored in the OpenVMS Registry.

A.1 Server Upgrade and Migration
On PATHWORKS for OpenVMS servers, the LANMAN.INI file is used to
modify and store server parameters. Advanced Server stores these parameters
in the OpenVMS Registry, which is similar to the Windows NT Registry.
The Advanced Server for OpenVMS software relies on the OpenVMS
Registry to store and reference server parameters. Parameters stored in
the LANMAN.INI file are not used by the Advanced Server.

Server Configuration Parameters A–1

Server Configuration Parameters
A.1 Server Upgrade and Migration
If you are upgrading a system from PATHWORKS V6 for OpenVMS (Advanced
Server) to Advanced Server for OpenVMS, the parameters and settings in the
existing LANMAN.INI file are migrated to Registry parameters the first time
you run the PWRK$CONFIG.COM configuration procedure.
When the configuration procedure migrates LANMAN.INI parameters to
the registry, it creates the LanmanIniMigrated value in the Advanced
Server Parameters key, and, as the associated data, stores the date when
the parameters were migrated from the LANMAN.INI file to the OpenVMS
Registry.

A.2 OpenVMS Registry Values
Table A–1, Registry Value Terminology, describes the terms used in this
appendix to describe the server configuration parameters and how they are
stored in the OpenVMS Registry.
Table A–1 Registry Value Terminology
Term

Definition

Key

The path to follow from the root key
HKEY_LOCAL_MACHINE to find the value.

Value

The name under which the server configuration
parameter is stored in the OpenVMS Registry.

Valid Data

Describes the valid parameters of the data
associated with the value, such as minimum and
maximum values for integer data.

Default

The data associated with the value by default.

LANMAN.INI Section Name

For parameters migrated from the LANMAN.INI
file, the LANMAN.INI section name.

LANMAN.INI Keyword

For parameters migrated from the LANMAN.INI
file, the LANMAN.INI parameter name.

Parameter Type

The type of parameter, either static or dynamic. If
you modify a static parameter, you must restart the
server for the change to be effective. If you modify
a dynamic parameter, changes are effective the next
time the parameter is used.
(continued on next page)

A–2 Server Configuration Parameters

Server Configuration Parameters
A.2 OpenVMS Registry Values
Table A–1 (Cont.) Registry Value Terminology
Term

Definition

Data Type

The type of data that may be associated with the
value. The data type information as displayed by
the PWRK$REGUTL utility, and the information
displayed by the Windows NT registry editor,
REGEDT32, are listed below. The multistring
data type refers to a concatenated array of
strings. The expanded data type is a string of
Unicode characters. For more information about
using REGEDT32 to display server configuration
parameters in the OpenVMS Registry, see
Section 7.2.1.1, Registry Database Architecture.
As Displayed by
PWRK$REGUTL

As Displayed by
REGEDT32

Integer

REG_DWORD

String

REG_SZ

Multistring

REG_MULTI_SZ

Expanded string

REG_EXPAND_SZ

For more information about managing the server configuration parameters
stored in the OpenVMS Registry, see Section 7.2, Managing Server
Configuration Parameters Stored in the OpenVMS Registry.
The following sections describe many of the server configuration parameters
that can be stored in the OpenVMS Registry. Most of these are available for
modification. You may see additional values in the OpenVMS Registry that are
not documented here; you should not modify undocumented values.

A.2.1 Computer Name Parameters
The Computer Name key may include values that specify the way the server is
identified on the network.
The Computer Name key is:
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName

Server Configuration Parameters A–3

Server Configuration Parameters
A.2 OpenVMS Registry Values
Table A–2, Computer Name Values, lists the values that may be stored in the
Computer Name key.
Table A–2 Computer Name Values
Value

Description

ComputerName_nodename

Specifies the name of the server on the network. This
value allows users to connect to the server using the
specified node name.
Do not change the computer name by editing the
OpenVMS Registry. To change the computer name,
use the PWRK$CONFIG.COM configuration procedure.

AliasName

Valid Data:

Up to 15 alphanumeric
characters

Default Data:

The server node name

LANMAN.INI Section:

NODE_servername

LANMAN.INI Keyword:

listenname

Parameter Type:

Static

Data Type:

String

Specifies the Advanced Server cluster alias. This value
allows users to connect to the server in an OpenVMS
Cluster configuration. (See Section 2.4.1, About the
Advanced Server Cluster Alias for more information.)
Do not change the Advanced Server cluster alias by editing the OpenVMS Registry. To change the PATHWORKS
cluster alias, use the PWRK$CONFIG.COM configuration procedure.

A–4 Server Configuration Parameters

Valid Data:

Up to 15 alphanumeric
characters

Default Data:

OpenVMS Cluster alias

LANMAN.INI Section:

VMSSERVER

LANMAN.INI Keyword:

pwrkalias

Parameter Type:

Static

Data Type:

String

Server Configuration Parameters
A.2 OpenVMS Registry Values

A.2.2 Printer Parameters
The Print key includes a value that indicates whether Advanced Server shared
printers have been upgraded as a result of Windows NT-style management
support. (For more information on Windows NT-style management support of
printers, see Section 5.3.3, Managing Advanced Server Printers Using Windows
NT.)
The Print key is:
SYSTEM\CurrentControlSet\Control\Print
Table A–3, Print Values, lists the value that may be stored in the Print key.
Table A–3 Print Values
Value

Description

PathworksUpgrade

Specifies whether the shared printers defined on the
Advanced Server have been upgraded as a result of
enabling Windows NT-style printer management. Do
not change the value of this parameter manually. Its
value is changed automatically by the Advanced Server
when you configure the server (using PWRK$CONFIG)
to support Windows NT-style printer management.
Valid Data:

Upgraded or null string

Default Data:

Null string

LANMAN.INI Section:

VMSSERVER

LANMAN.INI Keyword:

Upgraded

Parameter Type:

Static

Data Type:

String

A.2.3 Browser Parameters
The Browser Parameters key may include values that specify how the server
deals with Browser activity. A Master Browser polls for domains, and builds
and updates a master list of its domain. Backup Browsers send a request to
the Master Browser to update their own list. The Browser service is always
started at server startup.
The key containing the Browser values is:
SYSTEM\CurrentControlSet\Services\Browser\Parameters

Server Configuration Parameters A–5

Server Configuration Parameters
A.2 OpenVMS Registry Values
Table A–4, Browser Values, lists the values that may be stored in the Browser
Parameters key.
Table A–4 Browser Values
Value

Description

MasterUpdate

Specifies the interval (in seconds) after which domain
updates occur.

BackupUpdate

BackupRecovery

Valid Data:

Minimum: 60
Maximum: unlimited

Default Data:

720 seconds (12 minutes)

LANMAN.INI Section:

Browser

LANMAN.INI Keyword:

masterupdate

Parameter Type:

Static

Data Type:

Integer

Specifies the interval (in seconds) after which a backup
Browser updates its list by querying the Master Browser.
Valid Data:

Minimum: 60
Maximum: unlimited

Default Data:

720 seconds (12 minutes)

LANMAN.INI Section:

Browser

LANMAN.INI Keyword:

backupupdate

Parameter Type:

Dynamic

Data Type:

Integer

Specifies the interval (in seconds) after which recovery
is initiated if the backup Browser gets no response from
the Master Browser.
Valid Data:

Minimum: 60
Maximum: unlimited

Default Data:

1800 seconds (30
minutes)

LANMAN.INI Section:

Browser

LANMAN.INI Keyword:

backuprecovery

Parameter Type:

Static

Data Type:

Integer
(continued on next page)

A–6 Server Configuration Parameters

Server Configuration Parameters
A.2 OpenVMS Registry Values
Table A–4 (Cont.) Browser Values
Value

Description

MoreLog

Specifies whether the Browser is to log more details.
Valid Data:

YES or NO

Default Data:

LANMAN.INI Section:

Browser

LANMAN.INI Keyword:

morelog

Parameter Type:

Static

Data Type:

String

A.2.4 Netlogon Parameters
The Netlogon Parameters key may include values related to network logon
and the Security Account Manager (SAM) database. The NetLogon service is
started automatically at server startup.
The Netlogon Parameters key is:
SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Table A–5, Netlogon Service Values, lists the values that may be stored in the
Netlogon Parameters key.
Table A–5 Netlogon Service Values
Value

Description

Pulse

Specifies the number of seconds that the primary domain
controller waits before sending update notices to each
backup domain controller.
Valid Data:

Minimum: 60 seconds
Maximum: 3600 seconds

Default Data:

300 seconds (5 minutes)

LANMAN.INI Section:

Netlogon

LANMAN.INI Keyword:

pulse

Parameter Type:

Static

Data Type:

Integer
(continued on next page)

Server Configuration Parameters A–7

Server Configuration Parameters
A.2 OpenVMS Registry Values
Table A–5 (Cont.) Netlogon Service Values
Value

Description

Randomize

Specifies the number of seconds that a backup domain
controller waits to request updates after receiving an
update notice from the primary domain controller. This
parameter decreases the odds of servers in the same
domain requesting an update from the primary domain
controller at the same time.
Valid Data:

Scripts

Minimum: 5 seconds
Maximum: 120 seconds

Default Data:

30 seconds

LANMAN.INI Section:

Netlogon

LANMAN.INI Keyword:

randomize

Parameter Type:

Static

Data Type:

Integer

Specifies the location of logon scripts. See Section 3.1.8,
Specifying Logon Scripts, for information about logon
scripts.
Default Data:
PWRK$LMROOT:[LANMAN.REPL.IMPORT.SCRIPTS]

Update

A–8 Server Configuration Parameters

LANMAN.INI Section:

Netlogon

LANMAN.INI Keyword:

scripts

Parameter Type:

Static

Data Type:

String

Indicates whether the backup domain controller requests
a full synchronization when it starts. This parameter
applies only to a backup domain controller and is ignored
by the primary domain controller.
Valid Data:

YES
NO

Default Data:

LANMAN.INI Section:

Netlogon

LANMAN.INI Keyword:

update

Parameter Type:

Static

Data Type:

String

Server Configuration Parameters
A.2 OpenVMS Registry Values

A.2.5 Advanced Server Process Parameters
The Advanced Server Process Parameters key may include values that define
the way the server process operates in response to resource requests.
The Advanced Server Process Parameters key is:
SYSTEM\CurrentControlSet\Services\AdvancedServer\ProcessParameters
Table A–6, Advanced Server Process Parameter Values, lists the values that
may be stored in the Advanced Server Process Parameters key.
Table A–6 Advanced Server Process Parameter Values
Value

Description

NumCLIENT_SESSION

Specifies the number of links for internal communication
that this server can initiate. This represents the maximum
number of domains that this domain can trust, plus one
(number of trusted domains plus 1).
Valid Data:

NumSERVER_SESSION

Minimum: 5
Maximum: 128

Default Data:

LANMAN.INI Section:

Netlogon

LANMAN.INI Keyword:

maxclisess

Parameter Type:

Static

Data Type:

Integer

Specifies the number of links used for internal communication that this server can accept. This number must include
the number of domains that trust this domain; and the
number of backup domain controllers, member servers, and
Windows NT workstations in this domain (trusting domains
+ BDCs + Member Servers + NT workstations).
Valid Data:

Minimum: 5
Maximum: unlimited

Default Data:

200

LANMAN.INI Section:

Netlogon

LANMAN.INI Keyword:

maxsrvsess

Parameter Type:

Static

Data Type:

Integer

Server Configuration Parameters A–9

Server Configuration Parameters
A.2 OpenVMS Registry Values

A.2.6 Advanced Server File Service Parameters
The Advanced Server File Service Parameters key may include values that
define the way the file services operate.
The Advanced Server File Services Parameters key is:
SYSTEM\CurrentControlSet\Services\AdvancedServer\FileServiceParameters
Table A–7, Advanced Server File Services Parameter Values, lists the value
that may be stored in the Advanced Server File Services Parameters key.
Table A–7 Advanced Server File Services Parameter Values
Value

Description

STORE_SECURITY_ACES

Determines whether the file server writes a complete
set of Windows NT security information to a new file.
By changing the value from the default (YES) to NO,
you limit the amount of security information stored with
the new file. For more information, see Section 4.1.3.6,
Streamlining Security Information Storage and Lookups.

A–10 Server Configuration Parameters

Valid Data:

Minimum: YES or NO

Default Data:

YES

LANMAN.INI Section:

VMSSERVER

LANMAN.INI Keyword:

Store_Security_Aces

Parameter Type:

Static

Data Type:

String

Server Configuration Parameters
A.2 OpenVMS Registry Values

A.2.7 Advanced Server Share Parameters
The Advanced Server Share Parameters key may include values that define
the shares created automatically by Advanced Server.
If both Autoshare and NoAutoshare values contain the same device name, the
NoAutoshare definition takes precedence.
(See Section 4.2.3.2, Defining Autoshares, for more information about defining
autoshares.)
The Advanced Server Share Parameters key is:
SYSTEM\CurrentControlSet\Services\AdvancedServer\ShareParameters
Table A–8, Advanced Server Share Parameter Values, lists the values that may
be stored in the Advanced Server Share Parameters key.
Table A–8 Advanced Server Share Parameter Values
Value

Description

Autoshare

Specifies a synonym for the autoshare name created by
default for an OpenVMS disk device. The value for this
keyword is a list of OpenVMS device names (or volume
labels) and share name synonym to which each device
maps.

NoAutoshare

Valid Data:

Up to 512 characters,
including commas

Default Data:

All OpenVMS disk
devices are automatically
shared, and share names
are based on the volume
label of each disk device.

LANMAN.INI Section:

VMSSERVER

LANMAN.INI Keyword:

autoshare

Parameter Type:

Static

Data Type:

Expanded string

Specifies a disk device or list of devices that should
not be automatically shared when the server starts.
Autosharing DFS devices is not recommended.
Valid Data:

Up to 512 characters,
including commas
(continued on next page)

Server Configuration Parameters A–11

Server Configuration Parameters
A.2 OpenVMS Registry Values
Table A–8 (Cont.) Advanced Server Share Parameter Values
Value

Autoshare_nodename

NoAutoshare_nodename

Description
Default Data:

dad,_dfs

LANMAN.INI Section:

VMSSERVER

LANMAN.INI Keyword:

noautoshare

Parameter Type:

Static

Data Type:

Expanded string

Specifies a synonym for the autoshare name created
by default for an OpenVMS disk device on the system
specified by nodename. The value for this keyword is a
list of OpenVMS device names (or volume labels) and
share name synonym to which each device maps. This
value associates the autoshare list with the specific node
in an OpenVMS Cluster.
Default Data:

All OpenVMS disk
devices are automatically
shared, and share names
are based on the volume
label of each disk device.

LANMAN.INI Section:

NODE_nodename

LANMAN.INI Keyword:

autoshare

Parameter Type:

Static

Data Type:

Expanded string

Specifies a disk device or list of devices that should
not be automatically shared when the specified server
starts. This value associates the noautoshare list with
the specific node in an OpenVMS Cluster.
Valid Data:

A–12 Server Configuration Parameters

Up to 512 characters,
including commas

Default Data:

dad,_dfs

LANMAN.INI Section:

NODE_nodename

LANMAN.INI Keyword:

noautoshare

Parameter Type:

Static

Data Type:

Expanded string

Server Configuration Parameters
A.2 OpenVMS Registry Values

A.2.8 Advanced Server Parameters
The Advanced Server Parameters key may contain values that define how the
Advanced Server services operate on server startup.
The Advanced Server Parameters key is:
SYSTEM\CurrentControlSet\Services\AdvancedServer\Parameters
Table A–9, Advanced Server Parameters Values, lists the values that may be
stored in the Advanced Server Parameters key.
Table A–9 Advanced Server Parameters Values
Value

Description

ServerServices

Specifies the services that start automatically when the
server is started. Because services are started in the
order they appear in this registry parameter, you must
ensure that NetLogon appears before any services that
require it.
The Browser service is not controlled by this keyword.
It is started automatically when the Advanced Server
starts.

DomainName

Valid Data:

alerter, netlogon,browser

Default Data:

alerter, netlogon

LANMAN.INI Section:

VMSSERVER

LANMAN.INI Keyword:

srvservices

Parameter Type:

Static

Data Type:

Expanded string

Defines the name of the domain that the server is in.
Do not change the domain name by editing this value in
the OpenVMS Registry. Use the PWRK$CONFIG.COM
configuration procedure to change the domain name.
Valid Data:

Up to 15 characters

Default Data:

LANGROUP

LANMAN.INI Section:

WORKSTATION

LANMAN.INI Keyword:

domain

Parameter Type:

Static

Data Type:

String
(continued on next page)

Server Configuration Parameters A–13

Server Configuration Parameters
A.2 OpenVMS Registry Values
Table A–9 (Cont.) Advanced Server Parameters Values
Value

Description

LanmanIniMigrated

Specifies when the parameters in the LANMAN.INI file
were migrated to the OpenVMS Registry.

ServerLanguage

Valid Data:

Date

Default Data:

Null string

LANMAN.INI Section:

VMSSERVER

LANMAN.INI Keyword:

LanmanIniMigrated

Parameter Type:

Static

Data Type:

String

Specifies the language and associated character set that
the Advanced Server uses for encoding text, such as file
and share names, user names, description strings, and
any content of ADMINISTER command displays. Do not
change the parameter by editing the OpenVMS Registry.
To change this parameter, use the PWRK$CONFIG.COM
configuration procedure.
Valid Data:

Codepage

Minimum: 1
Maximum: unlimited

Default Data:

English (USA)

LANMAN.INI Section:

VMSSERVER

LANMAN.INI Keyword:

serverlanguage

Parameter Type:

Static

Data Type:

String

Specifies the code page to use when handling data
exchanged between the Advanced Server and any
client that does not support UCS-2 Unicode coding for
characters (such as DOS and Windows for Workgroups
clients). This parameter is set automatically according to
the language that is configured for the Advanced Server.
Do not directly change the parameter, such as by editing
the OpenVMS Registry. Use the PWRK$CONFIG.COM
configuration procedure to change the server language.
Valid Data:

Minimum: 1
Maximum: unlimited

Default Data:

437
(continued on next page)

A–14 Server Configuration Parameters

Server Configuration Parameters
A.2 OpenVMS Registry Values
Table A–9 (Cont.) Advanced Server Parameters Values
Value

ServerLocale

NT_print_enable

Description
LANMAN.INI Section:

VMSSERVER

LANMAN.INI Keyword:

codepage

Parameter Type:

Static

Data Type:

String

Specifies the casing rules specific to the character
set and consistent with ODS-5. This parameter is
set automatically according to the language that is
configured for the Advanced Server. Do not directly
change the parameter, such as by editing the OpenVMS
Registry. Use the PWRK$CONFIG.COM configuration
procedure to change the server language.
Valid Data:

Minimum: 1
Maximum: unlimited

Default Data:

PWRK$ISO8859-1

LANMAN.INI Section:

VMSSERVER

LANMAN.INI Keyword:

serverlocale

Parameter Type:

Static

Data Type:

String

Specifies whether Windows NT printer management is
enabled. Do not change the value of this parameter by
editing the OpenVMS Registry. To change the type of
printer management support, use PWRK$CONFIG.
Valid Data:

YES or NO

Default Data:

LANMAN.INI Section:

VMSSERVER

LANMAN.INI Keyword:

NT_print_enable

Parameter Type:

Static

Data Type:

String

Server Configuration Parameters A–15

Server Configuration Parameters
A.2 OpenVMS Registry Values

A.2.9 Lanman Server Parameters
The Lanman Server Parameters key path may contain parameters that define
the operation of the server, as shown in the following table.
The Lanman Server Parameters key path is:
SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
Table A–10, Lanman Server Parameter Values, lists the values that may be
stored in the Lanman Server Parameters key.
Table A–10 Lanman Server Parameter Values
Value

Description

AccessAlert

Specifies the number of resource access violations
that can occur before the server sends an alert to the
alertnames list. See Section 6.1.2, Automatic Alerts for
more information about managing alert messages.
Valid Data:

AutoDisconnect

ErrorAlert

Minimum: 0
Maximum: unlimited

Default Data:

LANMAN.INI Section:

SERVER

LANMAN.INI Keyword:

accessalert

Parameter Type:

Dynamic

Data Type:

Integer

Specifies the interval, in minutes, that the server waits
before dropping the virtual circuit to an inactive client.
Valid Data:

Minimum: 0
Maximum: unlimited

Default Data:

0 (no automatic
disconnect)

LANMAN.INI Section:

SERVER

LANMAN.INI Keyword:

autodisconnect

Parameter Type:

Dynamic

Data Type:

Integer

Specifies the number of errors that can occur before the
server sends an alert to the alertnames list.
(continued on next page)

A–16 Server Configuration Parameters

Server Configuration Parameters
A.2 OpenVMS Registry Values
Table A–10 (Cont.) Lanman Server Parameter Values
Value

LogonAlert

SrvAnnounce

SrvComment

Description
Valid Data:

Minimum: 0
Maximum: unlimited

Default Data:

LANMAN.INI Section:

SERVER

LANMAN.INI Keyword:

erroralert

Parameter Type:

Dynamic

Data Type:

Integer

Specifies the number of logon violations that can occur
before the server sends an alert to the alertnames list.
Valid Data:

Minimum: 0
Maximum: unlimited

Default Data:

LANMAN.INI Section:

SERVER

LANMAN.INI Keyword:

logonalert

Parameter Type:

Dynamic

Data Type:

Integer

Specifies the interval (in seconds) at which the server
announces its presence to the network. This parameter
has effect only if the Hidden value is set to NO (see
below).
Valid Data:

Minimum: 1
Maximum: unlimited

Default Data:

180 seconds

LANMAN.INI Section:

SERVER

LANMAN.INI Keyword:

srvannounce

Parameter Type:

Static

Data Type:

Integer

Specifies the descriptive message that the server sends
when it announces its presence to the network.
Valid Data:

Up to 48 characters,
including spaces
(continued on next page)

Server Configuration Parameters A–17

Server Configuration Parameters
A.2 OpenVMS Registry Values
Table A–10 (Cont.) Lanman Server Parameter Values
Value

Hidden

UserPath

Description
Default Data:

Advanced Server for
OpenVMS Systems

LANMAN.INI Section:

SERVER

LANMAN.INI Keyword:

srvcomment

Parameter Type:

Dynamic

Data Type:

String

Specifies whether the server is hidden on the network. If
the server is not hidden, it announces its presence at the
interval set by the SrvAnnounce parameter and can be
viewed using the ADMINISTER SHOW COMPUTERS
command.
Valid Data:

YES
NO

Default Data:

LANMAN.INI Section:

SERVER

LANMAN.INI Keyword:

srvhidden

Parameter Type:

Dynamic

Data Type:

String

Specifies the OpenVMS system directory on the server to
be used as a default parent directory for home directories
for new user accounts. See Section 3.1.10, Specifying
Home Directories for more information about home
directories.
Valid Data:

Absolute path name
or Universal Naming
Convention (UNC) path
name.

Default Data:
PWRK$LMROOT:[LANMAN.ACCOUNTS.USERDIRS]

A–18 Server Configuration Parameters

LANMAN.INI Section:

SYSTEM

LANMAN.INI Keyword:

userpath

Parameter Type:

Dynamic

Data Type:

String

Server Configuration Parameters
A.2 OpenVMS Registry Values

A.2.10 Alerter Service Parameters
The Alerter Service Parameters key may contain values that define how the
Alerter Service operates.
The Alerter Service Parameters key is:
SYSTEM\CurrentControlSet\Services\Alerter\Parameters
Table A–11, Alerter Service Values, lists the values that may be stored in the
Alerter Service Parameters key.
Table A–11 Alerter Service Values
Value

Description

AlertNames

Specifies a list of the Advanced Server user accounts to
receive administrative alerts. To receive alerts, a client
workstation must be running the Messenger service.
The Messenger service is not supported on Compaq
OpenVMS servers.
Valid Data:

Unlimited

Default Data:

Administrator

LANMAN.INI Section:

SERVER

LANMAN.INI Keyword:

alertnames

Parameter Type:

Dynamic

Data Type:

Expanded string

Server Configuration Parameters A–19

Server Configuration Parameters
A.2 OpenVMS Registry Values

A.2.11 Application Event Log Values
The Application Event Log key may contain values defining the way the
Advanced Server maintains the Application event log. For more information
about event logs, see Section 6.1.3, Event Logging.
The Application Event Log key is:
SYSTEM\CurrentControlSet\Services\EventLog\Application
Table A–12, Application Event Log Values, lists the values that you can store
in the Application Event Log key.
Table A–12 Application Event Log Values
Value

Description

MaxSize

Specifies the maximum size, in kilobytes, of the
Application event log file.
Valid Data:

Retention

A–20 Server Configuration Parameters

Minimum: 1024
Maxmimum: unlimited

Default Data:

524288

LANMAN.INI Section:

SERVER

LANMAN.INI Keyword:

maxapplog

Parameter Type:

Static

Data Type:

Integer

Specifies the amount of time, in seconds, to maintain the
Application event log.
Valid Data:

Minimum: 0
Maximum: unlimited

Default Data:

604800

Parameter Type:

Static

Data Type:

Integer

Server Configuration Parameters
A.2 OpenVMS Registry Values

A.2.12 Security Event Log Values
The Security Event Log key may contain values defining the way the Advanced
Server maintains the Security event log. For more information about event
logs, see Section 6.1.3, Event Logging.
The Security Event Log key is:
SYSTEM\CurrentControlSet\Services\EventLog\Security
Table A–13, Security Event Log Values, lists the values that may be stored in
the Security Event Log key.
Table A–13 Security Event Log Values
Value

Description

MaxSize

Specifies the maximum size, in kilobytes, of the Security
event log file.

Retention

Valid Data:

Minimum: 1024
Maximum: unlimited

Default Data:

524288

LANMAN.INI Section:

SERVER

LANMAN.INI Keyword:

maxauditlog

Parameter Type:

Static

Data Type:

Integer

Specifies the amount of time, in seconds, to maintain the
Security event log.
Valid Data:

Minimum: 0
Maximum: unlimited

Default Data:

604800

Parameter Type:

Static

Data Type:

Integer

Server Configuration Parameters A–21

Server Configuration Parameters
A.2 OpenVMS Registry Values

A.2.13 System Event Log Values
The System Event Log key may contain values defining the way the Advanced
Server maintains the system event log. For more information about event logs,
see Section 6.1.3, Event Logging.
The System Event Log key is:
SYSTEM\CurrentControlSet\Services\EventLog\System
Table A–14, System Event Log Values lists the values that may be stored in
the System Event Log key.
Table A–14 System Event Log Values
Value

Description

MaxSize

Specifies the maximum size, in kilobytes, of the system
event log file.
Valid Data:

Retention

A–22 Server Configuration Parameters

Minimum: 1024
Maximum: unlimited

Default Data:

524288

LANMAN.INI Section:

SYSTEM

LANMAN.INI Keyword:

maxerrlog

Parameter Type:

Static

Data Type:

Integer

Specifies the amount of time, in seconds, to maintain the
system event log.
Valid Data:

Minimum: 0
Maximum: unlimited

Default Data:

604800

Parameter Type:

Static

Data Type:

Integer

Server Configuration Parameters
A.2 OpenVMS Registry Values

A.2.14 User Service Parameters
The User Service Parameters key may contain values that define the way
OpenVMS user names are associated with network user names. (See
Section 3.1.16, User Account Host Mapping for more information.)
The User Service Parameters key is:
SYSTEM\CurrentControlSet\Services\AdvancedServer\UserServiceParameters
Table A–15, User Service Parameter Values, lists the values that may be stored
in the User Service Parameters key.
Table A–15 User Service Parameter Values
Value

Description

HostmapUseVMSNames

Checks to see if the network user name matches an
OpenVMS user account name when the user logs onto
the domain. Explicit host mapping is checked and
used first. If host mapping has not been specified, the
software searches for a matching OpenVMS user name.

HostmapDomains

Valid Data:

YES or NO

Default Data:

YES

LANMAN.INI Section:

VMSSERVER

LANMAN.INI Keyword:

hostmapusevmsnames

Parameter Type:

Static

Data Type:

String

Specifies domain names for user accounts in trusted
domains, allowing the Advanced Server to perform
external authentication on a network user name located
in the domains. Checks to see if the user’s domain name
matches one of the domains listed, where the network
user name matches an OpenVMS user account name.
Valid Data:

domainname,
domainname,...
(List of domains used for
OpenVMS host mapping.)

Default Data:

None. The server’s
domain name is assumed.

LANMAN.INI Section:

VMSSERVER
(continued on next page)

Server Configuration Parameters A–23

Server Configuration Parameters
A.2 OpenVMS Registry Values
Table A–15 (Cont.) User Service Parameter Values
Value

HostmapDefault

A–24 Server Configuration Parameters

Description
LANMAN.INI Keyword:

hostmapdomains

Parameter Type:

Static

Data Type:

Multistring

The data associated with this value is used when no
other host mapping definitions apply.
Valid Data:

ADMINISTRATOR,
DEFAULT, GUEST, or
REJECT

Default Data:

DEFAULT

LANMAN.INI Section:

VMSSERVER

LANMAN.INI Keyword:

hostmapdefault

Parameter Type:

Static

Data Type:

String

B
Network Protocols
With its open architecture, the Advanced Server software can operate over
several popular protocols simultaneously, including:
•

TCP/IP

•

NetBEUI

•

DECnet Phase IV or DECnet-Plus

This appendix provides information on the following topics:
•

Section B.1, Understanding the OSI Reference Model, describes the
seven-layer networking software model.

•

Section B.2, Choosing a Network Adapter Card, provides pointers on how
to select your network adapters.

•

Section B.3, Choosing a Network Protocol, briefly describes the protocols
you can use, including TCP/IP, NetBEUI, and DECnet-Plus.

Before you explore the specific drivers and protocols supported by the Advanced
Server, you should understand both the OSI Reference Model and the purpose
of network interface card drivers. If you already understand these topics, you
can skip to Choosing a Network Protocol, which includes an overview and
description of each protocol that interoperates with the Advanced Server.

B.1 Understanding the OSI Reference Model
In 1978 the International Organization for Standardization (ISO) developed
a model for computer networking called the Open Systems Interconnection
(OSI) Reference Model. The model describes the flow of data in a computer
network—from the physical connections of the network to the applications used
by the end user.
The OSI Reference Model is an idealized version of networking; few systems
follow it exactly. However, the model is useful for discussion and comparison of
networks.

Network Protocols B–1

Network Protocols
B.1 Understanding the OSI Reference Model
The OSI Reference Model includes seven layers, as shown in Figure B–1, OSI
Reference Model. Each of the layers is responsible for a specific and discrete
aspect of networking.
Figure B–1 OSI Reference Model
Application Layer
Presentation Layer
Session Layer
Transport Layer
Network Layer
Data Link Layer
Physical Layer
VM-0012A-AI

The following list describes each OSI Reference Model layer in detail:
•

The Physical Layer is responsible for getting bits from one computer to
another. It also regulates the transmission of a stream of bits over a
physical medium. This layer defines how the cable is attached to the
network adapter card and which transmission technique is used to send
data over the cable. It also defines bit synchronization and checking.

•

The Data Link Layer packages raw bits from the Physical Layer into
frames. A frame is a logical, structured packet in which data can be
placed. The Data Link Layer is responsible for transferring frames from
one computer to another without errors. After the Data Link Layer sends
a frame, it waits for an acknowledgment from the receiving computer.
Frames that are not acknowledged are resent.

•

The Network Layer addresses messages and translates logical addresses
and names into physical addresses. It also determines the route along
the network from the source to the destination computer, and it manages
traffic problems such as switching, routing, and controlling the congestion
of data packets.

•

The Transport Layer is responsible for error recognition and recovery,
ensuring the reliable delivery of messages. It also repackages messages
when necessary by dividing long messages into small packets for
transmission. At the receiving end, it rebuilds the small packets into

B–2 Network Protocols

Network Protocols
B.1 Understanding the OSI Reference Model
the original message. The receiving Transport Layer also sends an
acknowledgment of receipt.
•

The Session Layer allows two applications on different computers to
establish, use, and end a session. This layer establishes dialog control
between the two computers in a session, regulating which side transmits,
when, and for how long.

•

The Presentation Layer translates data from the Application Layer into an
intermediary format. This layer also manages security issues by providing
services such as data encryption, and it compresses data to reduce the
number of bits that need to be transferred on the network.

•

The Application Layer enables end-user applications to access network
services.
When two computers communicate over a network, the software at
each layer on one computer communicates with the same layer on the
other computer. For example, the Transport Layer of one computer
communicates with the Transport Layer on the other computer. As
shown in Figure B–2, Transport Protocol, the Transport Layer on the first
computer is not involved with how the communication actually passes
through the lower layers of the first computer, passes across the physical
media, and up through the lower layers of the second computer.

Network Protocols B–3

Network Protocols
B.1 Understanding the OSI Reference Model
Figure B–2 Transport Protocol
✸✸✸✸✸✸✸✸✸✸✸✸✸✸✸✸✸✸ ✸✸✸✸✸✸✸✸
✸✸ ✸✸✸✸✸✸✸✸✸
✸✸✸✸✸✸ ✸✸✸✸✸
❘❘❘❘❘❘❘❘❘❘❘❘❘✸✸ ❘❘❘❘ ✸✸✸✸✸✸✸✸
✸✸ ✑✐✐☎
✸✸
✸✸✸❘❘❘❘❘❘❘❘❘✸✸✸ ✒✒ ✸✸✸✸✸✸✸✸✸❘❘❘❘❘❘✸✸✸✸✸✸✸✸✸✸
✸✸✸✸✸✸✸✸✸

✸✸✸✸✸
✸✸✸✸✸
✸✸✸✸✸
✸✸✸✸✸
✸✸✸✸✸
✸✸✸✸

✪✡

✦✥

✭✡
✲

✸✸✸✸✸
✸
✸✸✸✸✸
✸
✸✸✸✸✸
✸
✸✸✸✸✸
✸
✸✸✸✸✸✸✸
✸✸✸✸✸✸✸
✸✸✸✸✸✸✸✸
✸✸✸✸✸✸✸

✸✸✸✸✸✸✸
✸✸✸✸✸✸✸
✸✸✸✸✸✸✸

✸✸✸✡✰
✭✡
✸✸✸✸✸✸✸
✹
✸✸✸✸✸✸✸ ✸✸✸✸✸✸
✸✸✸✸✸✸✸
✸✸✸✸✸✸✸✸✸✸
✸✸✸✸ ✸✸✸✸✸✸✸
✸✸✸✸✸✸✸✸✸
✸✸✸✸✸✸✸✸✸✸✸✸
✸✸✸✸
✸✸✸✸

✸✸✸✸✸✸✸✸✸✸✸✸✸✸✸✸✸✸ ✸✸✸✸✸✸✸✸
✸✸ ✸✸✸✸✸✸✸✸✸
✸✸✸✸✸✸ ✸✸✸✸✸
❘❘❘❘❘❘❘❘❘❘❘❘❘✸✸ ❘❘❘❘ ✸✸✸✸✸✸✸✸
✸✸ ✑✐✐☎
✸✸
✸✸✸❘❘❘❘❘❘❘❘❘✸✸✸ ✒✒ ✸✸✸✸✸✸✸✸✸❘❘❘❘❘❘✸✸✸✸✸✸✸✸✸✸
✸✸✸✸✸✸✸✸✸

✪✵

✸✸✸✸✸
✸✸✸✸✸
✸✸✸✸✸
✸✸✸✸✸
✸✸✸✸✸
✸✸✸✸

✪✡

✦✥

✭✡
✲

✸✸✸✸✸
✸
✸✸✸✸✸
✸
✸✸✸✸✸
✸
✸✸✸✸✸
✸
✸✸✸✸✸✸✸
✸✸✸✸✸✸✸
✸✸✸✸✸✸✸✸
✸✸✸✸✸✸✸

✸✸✸✸✸✸✸✸
✸✸✸✸✸✸✸✸
✸✸✸✸✸✸✸✸

✸✸✸✸✸✸✸
✸✸✸✸✸✸✸
✸✸✸✸✸✸✸

✖

✪✵

✸✸✸✸✸✸✸✸
✸✸✸✸✸✸✸✸
✸✸✸✸✸✸✸✸
✖

Application Layer

Presentation Layer

Session Layer

Transport Layer
Network Layer

Transport Layer
Transport
Protocol

Network Layer

Data Link Layer

Physical Layer

Physical Medium (Network Cable)

VM-0013A-AI

B.2 Choosing a Network Adapter Card
A network adapter card, also called a network interface card or a network
interface controller (NIC), is an adapter board installed in a computer to let it
function on a network. The network adapter card provides ports to which the
network cable can connect physically. The card physically transmits data from
the computer to the network cable, and back.
Every network computer must have a network adapter card driver, a software
driver that controls the network card. Every network adapter card driver is
configured to run with a certain type of network card.
When choosing network adapter cards, you first must choose cards that
support your network’s architecture (such as Ethernet or Token Ring) and
cabling media (such as Thinnet or twisted pair). You also should consider the
tradeoffs of performance and cost.
Performance for network adapter cards depends mostly on bus width and
onboard memory. The best performance is achieved when the bus width of the
card closely matches the internal bus width of the computer. Onboard memory
enables a card to buffer frames going to and from the network. A card with the
most memory is not always the best choice. At some point, diminishing returns

B–4 Network Protocols

Network Protocols
B.2 Choosing a Network Adapter Card
and the maximum speed of other network components limit the performance
gains of onboard memory.
When you consider the cost of network cards, factor in the cost of buying
spare cards to replace the ones that fail. You should also ensure that your
network hardware budget allows for cable, hubs, repeaters, routers, and other
hardware, as well as the labor costs associated with installing them.
Before you decide on a type of network card, make sure that the OpenVMS
operating system you are using supports it. Also, make sure the vendor can
support your business needs. If you are working with a reseller, check that the
reseller has good communication with the card manufacturer.

B.3 Choosing a Network Protocol
In addition to the network card and the network card driver, a network
computer must have a protocol driver, also called a transport protocol or
a protocol. The protocol driver works between the upper-level network
software—such as the workstation and server—and the network adapter card.
The protocol packages the data that are sent over the network in a way that
the computer on the receiving end will understand.
The process of associating a protocol driver with the network adapter card with
which it will work and establishing a communication channel between the two
is called binding.
For two computers to communicate on a network, they must use identical
protocols. In the case where computers are configured to use multiple
protocols, they need to have only one protocol in common to communicate. For
example, a server that uses both NetBEUI and TCP/IP can communicate both
with workstations that use only NetBEUI and with workstations that use only
TCP/IP.
The Advanced Server allows connections from the transports and protocols
shown in Table B–1, Supported Transports and Protocols.
Table B–1 Supported Transports and Protocols
Protocol

Client Transport

Server Transport Component

TCP/IP

Internet

Product-specific

NetBEUI (with
NETBIOS)

LAN Manager

DECnet (proprietary)

DECnet

Network Protocols B–5

Network Protocols
B.3 Choosing a Network Protocol
The remainder of this section provides an overview of each of these
protocols with basic information about each protocol and its advantages
and disadvantages.

B.3.1 TCP/IP Protocol
TCP/IP was developed in the late 1970s as a result of a research project on
network interconnection by the Department of Defense Advanced Research
Projects Agency (known as ARPANet, the precursor to the Internet). TCP/IP
is actually a suite of protocols that defines various interactions between
computers sharing the protocol.
Since the PC began its rise in popularity, TCP/IP has become a standard
protocol for support in the PC networking environment.
TCP/IP has a reputation as a difficult protocol to configure and manage.
However, current implementations are making it easier. For example, in
TCP/IP, the Dynamic Host Configuration Protocol (DHCP) provides server
support and is one of the most important advances in PC networking.
Without DHCP, system administrators had to manually assign the fourbyte IP addresses to each computer. With DHCP enabled, a DHCP server can
manage a range of IP addresses and assign one to each computer as it logs on
to the network.
The principal advantage of TCP/IP is that it provides communication across
interconnected networks with different operating systems and hardware
architectures.
TCP/IP provides compatibility with the Internet, a collection of networks and
gateways linking universities, corporations, government offices, and military
installations worldwide.
Table B–2, TCP/IP Protocol, summarizes the advantages and disadvantages of
using the TCP/IP protocol.
Table B–2 TCP/IP Protocol
Advantages

Disadvantages

Provides connectivity across different operating
systems and hardware platforms.

Slower than NetBEUI on small
LANs.

Provides Internet connectivity.

Can be difficult to administer.

Provides routing support.

More overhead than NetBEUI.

B–6 Network Protocols

Network Protocols
B.3 Choosing a Network Protocol

B.3.2 NetBEUI Protocol
The NetBIOS Extended User Interface (NetBEUI) was first introduced by
IBM in 1985. NetBIOS, an integral part of the NetBEUI protocol driver,
is a programming interface that implements many session layer functions.
NetBEUI is a small, efficient, and fast protocol with low overhead.
Note
‘‘Overhead’’ in this context refers to the additional network control
information, such as routing and error checking, that the protocol adds
to data that the application layer needs to send across the network.

One reason for NetBEUI’s lower overhead is that NetBEUI does not require an
explicit acknowledgment (ACK) of each frame before it sends the next. Instead,
the computer packages up several ACKs and sends them all at once. Requiring
an ACK for every packet wastes network resources. NetBEUI dynamically
determines the number of frames the sender can transmit before receiving an
ACK, based on the network’s current conditions.
NetBEUI was developed for LANs segmented into workgroups of 20 to 200
computers, with gateways connecting LAN segments to one another or to
mainframes. NetBEUI is optimized for very high performance when used in
departmental LANs or LAN segments. For traffic within a LAN segment,
NetBEUI typically is the fastest protocol.
While NetBEUI is fast on small LANs, it is not so effective on large networks
because it has a poor addressing scheme. NetBEUI does not allow duplicate
computer names on the same network. This prevents a network from having
two computers with the same name—something difficult to eliminate on a
large network.
Table B–3, NetBEUI Protocol, summarizes the advantages and disadvantages
of the NetBEUI protocol.
Table B–3 NetBEUI Protocol
Advantages

Disadvantages

Tuned for small LAN communication, and
therefore is very fast on LANs.

Not routable.

Good error protection.

Performance across WANs is poor.

Small memory usage.

Requires each network computer to
have a unique name.

Network Protocols B–7

Network Protocols
B.3 Choosing a Network Protocol

B.3.3 DECnet-Plus Protocol
DECnet-Plus is a proprietary protocol; it is a collection of many layered
protocols offered together as a major data communications network. Developed
as a distributed network, it supports a wide range of applications and
programs.
One of the DECnet protocol’s major advantages is flexibility in network
configuration and applications functionality. DECnet-Plus includes the Local
Area Transport (LAT) protocol that terminal servers use to communicate with
hosts.
Table B–4, DECnet-Plus Protocol, lists the advantages and disadvantages of
the DECnet-Plus protocol:
Table B–4 DECnet-Plus Protocol
Advantages

Disadvantages

Major flexibility in network configuration.

Complex network architecture.

Routable.

Proprietary.

Maintains a high level of availability, even in the
event of node or link failure.
Supports a wide range of communications
facilities, such as Ethernet and X.25.

B–8 Network Protocols

Index
A
Access
permissions, 1–5
to shares, 4–17
AccessAlert server configuration parameter,
A–16
Access control entry, 4–7
and OpenVMS index files, 4–8
compressing for optimal disk storage,
4–13
displaying, 4–17
PATHWORKS
removing, 4–16
Access control entry (ACE), 4–6
Access control list (ACL), 4–6, 4–7
Account lockout, 3–8
Account policy, 2–21
displaying, 2–23
managing, 2–21
Accounts lockout, 2–22
ACE
See Access control entry
ACL
See Access control list
ADD command
COMPUTER, 2–15
on member servers, 2–14
GROUP, 3–28
HOSTMAP, 3–20
PRINT QUEUE, 5–9
SHARE, 5–14
TRUST
on member servers, 2–14

ADD command (cont’d)
USER, 3–4
on member servers, 2–14
Adding server configuration parameters to
the OpenVMS Registry, 7–33
ADMIN$ share, 4–20
ADMIN/ANALYZE command, 6–13
ADMINISTER commands
input and output mode, 4–50
obtaining online help for, 1–11
on a member server, 2–12
overview of, 1–11
specifying file names in (on ODS-5
volumes), 4–57
Administrative
groups, 1–15
interfaces, 1–9
shares, 4–19
displaying, 4–19
Administrator
access to shared resources, 4–18
account, 3–1
responsiblities, 1–2
Advanced configuration parameters, 7–2
modifying, 7–8
saving, 7–10
Advanced Configuration screen, 7–8
Advanced Server
and Windows NT file security information,
4–8
cluster alias, A–4
about, 2–36
defining, 2–37
displaying, 2–38
parameter, A–4

Index–1

Advanced Server (cont’d)
file-naming conventions, 4–59
licenses, 1–7
overview of, 1–1
status information, 6–21
stopping, 2–28
Alerter service, 6–2
description, 2–30
parameters, A–19
AlertNames server configuration parameter,
A–19
Alerts, 6–2
Alias, cluster
Advanced Server
defining, 2–37
displaying, 2–38
Aliases, cluster
about, 2–36
Alias file names, 4–61
description of, 4–62
AliasName server configuration parameter,
A–4
Application event log parameters, A–20
ASCII character set, 4–43
Auditing
See also Events, Event log files
disabling, 6–9
displaying, 6–10
enabling, 6–8
file usage, 6–10
security events, 6–8
setting, 6–10
Audit log size, 6–7
Audit policy, 2–21, 6–9
displaying, 2–24, 6–10
establishing, 6–9
managing, 2–23
specifying, 2–25
AutoDisconnect server configuration
parameter, A–16
Automatic alerts, 6–2
Autoshare errors
logging of, 6–13

Index–2

Autoshares, 1–8, 4–21
defining in registry, 4–22
in OpenVMS Cluster, 4–25
naming, 4–21
synchronizing, 4–26
Autoshare server configuration parameter,
4–23, A–11
Autoshare_nodename server configuration
parameter, A–12

B
Backup domain controllers
defined, 2–2
designating, 2–4
BackupRecovery server configuration
parameter, A–6
BackupUpdate server configuration
parameter, A–6
Basic configuration parameters, 7–2
BDC
See Backup domain controllers
Browser services, 2–30
parameters, A–5
Built-in groups, 3–27
Byte range locks
specifying per client, 7–9

C
C$ resource, 4–19, 4–21
Character set, 4–53
Character sets, 4–42
supported by the Advanced Server, 4–44
CLEAR EVENTS command, 6–8
CLI
See Command-line interface
Client capacity
determining, 7–5
specifying, 7–5
Client code page, 4–44, 4–47, 4–48, 4–49,
4–58, 4–59, A–14
Clients, 1–3
connection problems, 6–28

Clients (cont’d)
determining the maximum number of,
7–5
Clocks
synchronizing, 2–34
Cluster alias
Advanced Server
about, 2–36
defining, 2–37
displaying, 2–38
parameter, A–4
Cluster aliases, 2–36
Code page
defined, 4–43
Codepage server configuration parameter,
A–14
Code point, 4–43
Command-line interface, 1–11
Common event log, 6–13
Computer accounts
adding to a domain, 2–14
removing from a domain, 2–16
Computer Name parameters, A–3
ComputerName_nodename server
configuration parameter, A–4
Computer problems, solving, 6–23
Computer type display symbol, 2–16
Configuration Manager
exiting, 7–4
getting help, 7–4
modifiable server parameters, 7–2
navigating using keyboard, 7–15
overview, 7–2
starting, 7–3
Configuration parameters
See Server configuration parameters
Connection failures due to licensing problems
logging of, 6–13
Connections, 2–25
CONTINUE SERVICE command, 2–33
Controlling access to shares, 4–17
COPY command
GROUP, 3–30
USER, 3–4, 3–7
on member servers, 2–14

D
Data cache size, specifying, 7–7
Daylight savings time
setting, 2–34
DCL parse style
and ADMINISTER commands, 4–50,
4–51
DECnet, B–8
enabling and disabling, 7–11
protocol, B–8
DECnet alias, 2–36
Default values for server configuration
parameters, displaying, 7–32
Defining the REGUTL command, 7–23
Deleting server configuration parameters
from the OpenVMS Registry, 7–33
DFS devices, autosharing, 4–25
Directories
See also Files
auditing access, 4–39
inheriting access permissions, 4–37
managing, 4–27
managing shared, 4–2
ownership, 4–40
personal shares, 4–30
planning access permissions, 4–35
setting access permissions, 4–37
sharing, 4–27, 4–28, 4–29
stopping sharing, 4–32
Disk administrative shares, 4–21
Disk resources, 4–3
sharing, 1–8
Disk volume type, displaying, 4–56
Displaying
Advanced Server cluster alias, A–4
all server configuration parameters, 7–28
all server configuration parameters stored
in the registry, 7–29
server configuration parameter default
values, 7–32
server configuration parameter details
stored in the registry, 7–30
server configuration parameters, 7–27

Index–3

Displaying (cont’d)
server configuration parameters in the
registry
registry and equivalent LANMAN.INI
names, 7–31
shares and files on ODS-5 disk volumes,
4–55
DNS name resolution, 7–12
Domain controllers
See also Primary domain controllers,
Backup domain controllers
synchronizing, 2–8
Domain database
See Security Account Manager (SAM)
database, Security accounts database
Domain name, 2–2
DomainName server configuration
parameter, A–13
Domain parameter, A–13
Domains, 1–4
adding computers to, 2–14
administering, 1–13, 2–1
on member servers, 2–12
creating, 1–4, 2–2
default administered, 1–13, 2–10
defined, 2–1
displaying current, 2–10
displaying information about current
domain, 2–10
managing, 2–1
naming, 2–2
security identifier, 2–8
solving problems, 6–23
Domain user accounts database
See Security Account Manager (SAM)
database, Security accounts database
Dynamic security upgrade
enabling and disabling, 7–9

E
ErrorAlert server configuration parameter,
A–16

Index–4

Euro currency symbol, 4–44
Event log
application, A–20
Event log files
changing size of, 6–7
common event log, 6–13
table of, 6–3
Event logging, 6–3
See also Auditing
Event logs, 1–9
saving, 6–7
EventLog service
description, 2–30
Events, 6–3
autoshare errors, 6–13
connection failures due to licensing
problems, 6–13
displaying, 6–5
monitoring, 6–1
process startup and shutdown, 6–13
related to OpenVMS errors, 6–13
security, 6–8
Execution queue, 5–2, 5–3, 5–22
Exiting
Configuration Manager, 7–4
PWRK$REGUTL, 7–23
Expanded data type, A–3
Expiration dates for user accounts, 3–13
Extended character sets, 4–42, 4–53
enabling, 4–54
in print share names, 5–15
requirements for use of, 4–54
Extended File Specifications, 4–53
enabling, 4–54
requirements for use of, 4–54
External authentication, 3–20
bypassing, 3–22
maximum number of signon operations,
7–7
server capacity, 3–21

F
Failover, 2–37, 2–38
defined, 2–36
OpenVMS cluster, defined, 2–37
File names
aliases for, 4–61
and MS-DOS compatibility, 4–61
and ODS-5 disk volumes, 4–49
converting from ODS-2 to ODS-5, 4–56
for files stored on the Advanced Server,
4–58
length of on ODS-5 volumes, 4–57
MS-DOS and Windows, 4–58
specifying in ADMINISTER commands,
4–57
with Unicode characters, 4–58
Files
access permissions, 4–36
auditing access, 4–39
displaying on ODS-5 volumes, 4–55
inheriting access permissions, 4–37
managing, 4–27
naming conventions for Advanced Server,
4–59
naming conventions for MS-DOS, 4–58
naming conventions for Windows
computers, 4–58
ownership, 4–5, 4–40
ownership inheritance for created files,
4–8
permissions inheritance for created files,
4–8, 4–11
improving disk space usage for, 4–12
optimizing disk storage space, 4–13
planning access permissions, 4–35
security information
and optimizing disk storage space,
4–13
building of, 4–11
optimizing disk storage space for,
4–12
problems, 4–13
setting access permissions, 4–37

Files (cont’d)
storing on ODS-5 volumes, 4–57
File security information
OpenVMS, 4–6
Windows NT, 4–5
File security problems
fixing, 4–13
File service parameters, A–10
Files per Client value
specifying, 7–9
File systems (OpenVMS), 4–3

G
Generic queue, 5–2, 5–3
Global groups, 1–5, 3–26
how they are used, 3–27
Global user accounts
description of, 3–2
Groups, 1–5
access to shared resources, 4–18
adding users to, 3–16
administrative, 1–15
built-in, 3–27
copying, 3–30
deleting, 3–31
global, 3–26
local, 3–26
modifying, 3–30
planning for, 3–26
primary group, 3–6
setting up, 3–28
term defined, 3–26
Guest account
description of, 3–2

H
Help
for ADMINISTER commands, 1–12
for PWRK$REGUTL, 7–24
Hidden server configuration parameter,
A–18

Index–5

Home directories, 1–7
specifying for users, 3–12
HostmapDefault server configuration
parameter, A–24
Host mapping, 3–5
defined, 3–18
displaying, 3–20
establishing, 3–19
explicit, 3–19
implicit, 3–19
setting up, 3–20
HostmapUseDomains server configuration
parameter, A–23
HostmapUseVMSNames server configuration
parameter, A–23

I
Index file
managing, 4–14
Inheriting permissions, 4–37
Interfaces
PWRK$REGUTL, 7–22
table of, 1–9
Intermittent problems
troubleshooting, 6–22
IPC$ share, 4–19, 4–20
ISO Latin-1 character set, 4–43

K
Keys (OpenVMS Registry), 7–17
root, 7–18
server configuration parameter, 7–18

L
Language
and ODS-2 disk devices, 4–53
server configuration parameter for, A–14
LANMAN.INI parameters
migrating, 7–17, A–1

Index–6

LanmanIniMigrated server configuration
parameter, A–2, A–13
Lanman Server parameters, A–16
Licenses
acquisition problems, 6–38
for Advanced Server, 1–7
Listenname server configuration parameter,
A–4
LMHOSTS name resolution, 7–12
Load balancing, 7–13
in LANs, 2–38
in WANs, 2–39
Local authentication, 3–22
Locale configuration parameter
See ServerLocale server configuration
parameter
Locale file, 4–47
Local groups, 1–6, 3–26
how they are used, 3–27
Local user accounts
description of, 3–2
Lockout policy
See Accounts lockout, User accounts
Log files, 6–11
displaying, 6–12
table of, 6–11
Login validation, 1–6
LOGOFF command, 2–11
LogonAlert server configuration parameter,
A–17
LOGON command, 1–14, 2–11
Logon scripts, 1–6
controlling access to, 3–11
setting up, 3–10
specifying, 3–10

M
Management interfaces
table of, 1–9
Managing
printers, using ADMINISTER commands,
5–9
remote domains and servers, 1–13
shared directories, 4–2, 4–27

Managing (cont’d)
shared files, 4–27
shared printers, locally, 5–14
shared printers, remotely, 5–21
shared server printers
overview, 5–4
MasterUpdate server configuration
parameter, A–6
Maxclisess parameter, A–9
Maximum concurrent signons
specifying, 7–7
MaxSize parameter
changing, 6–7
MaxSize server configuration parameter
for application event log, A–20
for security event log, A–21
for system event log, A–22
Maxsrvsess parameter, A–9
Member server
defined, 2–3
designating, 2–7
displaying, 2–7
local domain management, 2–12
management, 1–13, 2–12
Memory, physical, 7–6
Messages, sending, 2–29
Messenger service, 6–3
Migrating server configuration parameters to
the OpenVMS Registry, 7–17, A–1
MODIFY command
GROUP, 3–31
SHARE, 5–17
USER, 3–16
on member servers, 2–14
Modifying
server configuration parameters, 7–17,
7–32
MoreLog server configuration parameter,
A–6
MS-DOS file naming conventions, 4–58
Multistring data type, A–3

N
NetBEUI protocol, B–7
NetBEUI transport, enabling and disabling,
7–11
NetBIOS name resolution, 7–12
NETLOGON default share, 4–27
Netlogon service
and security accounts database, 2–7
parameters, A–7
NetLogon service, 1–6
and logon scripts, 3–11
description, 2–30
enable recommended, 2–31
on member servers, 2–31
Network
administration overview, 1–3
clients, 1–3
displaying events, 6–13
logging on, 1–14
overview, 1–3
printers, 5–7, 5–22
security, 4–4
servers, 1–3
time server, 2–34
Network adapter card, B–4
Network interface card
See Network adapter card
NIC
See Network adapter card
NoAutoshare server configuration parameter,
4–24, A–11
NoAutoshare_nodename server configuration
parameter, A–12
NT_print_enable configuration parameter,
A–15
NumCLIENT_SESSION server configuration
parameter, A–9
NumSERVER_SESSION server configuration
parameter, A–9

Index–7

O
ODS-2 disk volumes
and file names, 4–48
converting, 4–53
converting to ODS-5, 4–56
ODS-5 disk volumes
and file names, 4–49
displaying information about, 4–56
displaying shares and files on, 4–55
managing shares on, 4–55
specifying file names in ADMINISTER
commands, 4–57
storing files on, 4–57
using on Advanced Server, 4–53
Open File Caching
delay interval, 7–9
enabling and disabling, 7–8
Open files, specifying maximum, 7–9
OpenVMS
access control, 4–39
ACLs, 4–7
file security information, 4–6
host, mapping to, 3–18
permissions, mapping of, 4–39
print queues, 5–2
privileges, 1–14
process priority, 7–7
Registry, A–1
RMS protections, 4–6
security, 4–6
UIC group codes, 4–6
OpenVMS cluster
failover, 2–37, 2–38
OpenVMS Clusters
autosharing in, 4–25
displaying list of nodes, 2–35
dynamic load balancing, 7–13
environment, 2–35
load balancing in LANs, 2–38
load balancing in WANs, 2–39
servers in, 2–35

Index–8

OpenVMS errors
logging events related to, 6–13
OpenVMS Registry, 7–17
architecture, 7–17
database, 7–17
keys to server configuration parameters,
7–18
list of parameter values at startup, 7–27
managing server parameters in the, 7–21
overview, 7–17
root keys, 7–18
server, 7–17, 7–20
setting parameters, 7–20
values, A–2
OSI protocol, B–1
OSI Reference Model, B–2
overview, B–1
Ownership of files and directories, 4–40
inheritance for created files, 4–8, 4–11

P
Parameters
See Server configuration parameters
Parse style
and ADMINISTER commands, 4–50,
4–51
Password policy
setting, 2–22
Passwords, 3–4
changing, 3–9
commands that control, 3–7
for user accounts, 3–7
managing, 3–5
setting domain-wide account policy for,
3–8
synchronizing for externally authenticated
account, 3–21
Password synchronization, 3–21
PATHWORKS file access control entries
removing, 4–16
PathworksUpgrade configuration parameter,
A–5

PAUSE command
PRINT QUEUE, 5–11
SERVICE, 2–33
PDC
See Primary domain controllers
Performance analysis, 1–9
Permissions, 1–5
file access, 4–36
inheriting, 4–37
mapping between OpenVMS and
Advanced Server, 4–39
planning, 4–35
shares, 4–29
type of, 4–2
Personal shares
creating, 4–30, 4–31
Physical memory, specifying amount used,
7–6
Planning networks, 1–2
Pool, printer, 5–5
Pooling, 5–22
PostScript printers, sharing, 5–7
Primary domain controllers
defined, 2–2
designating, 2–4
Primary group, 3–6
Printer parameters, A–5, A–15
Printer permissions, table of, 5–15
Printer pooling, 5–5, 5–22
Printer queue, 5–3
Printers, 5–15
adding, from Windows NT, 5–22
adding, using ADMINISTER commands,
5–9
connecting, 5–8
controlling access to, with ADMINISTER
commands, 5–15
management of, ADMINISTER versus
Windows NT, 5–4
management of, locally, 5–9
management of, remotely, 5–21
management of, using ADMINISTER
commands, 5–9
network, 5–7, 5–22
planning services, 5–3

Printers (cont’d)
PostScript, 5–7
problems, 6–31
setting up, 5–7, 5–22
sharing, 1–8, 5–1, 5–3, 5–4, 5–23
type of, changing with ADMINISTER
command, 5–11
types of, 5–7
Print jobs
canceling, using ADMINISTER
commands, 5–20
deleting, using ADMINISTER commands,
5–20
displaying, using ADMINISTER
commands, 5–18
holding, using ADMINISTER commands,
5–19
managing, using ADMINISTER
commands, 5–18
moving, using ADMINISTER commands,
5–20
releasing, using ADMINISTER
commands, 5–19
resequencing, using ADMINISTER
commands, 5–20
restarting, using ADMINISTER
commands, 5–19
Print queue, 5–3
defined, 5–1
Windows NT management of, 5–5
Print queues
changing options, using ADMINISTER
commands, 5–16
continuing with ADMINISTER commands,
5–12
creating, from Windows NT, 5–22
creating with ADMINISTER commands,
5–8, 5–9
deleting with ADMINISTER commands,
5–12
displaying, from Windows NT, 5–22
displaying, using ADMINISTER
commands, 5–10
managing locally with ADMINISTER
commands, 5–9

Index–9

Print queues (cont’d)
naming, 5–4, 5–22
pausing with ADMINISTER commands,
5–11
purging with ADMINISTER commands,
5–12
sharing, 5–3
stopping sharing, using ADMINISTER
commands, 5–17
types of Advanced Server, 5–3
types of OpenVMS, 5–2
Print share
Windows NT management of, 5–5
Print shares
changing maximum number of
connections, 5–17
changing options, using ADMINISTER
commands, 5–16
changing permissions, using
ADMINISTER commands, 5–17
creating, from Windows NT, 5–23
creating with ADMINISTER commands,
5–14
displaying, using ADMINISTER
commands, 5–17
managing with ADMINISTER commands,
5–14
naming, 5–4, 5–15
setting up, 5–4
stopping, using ADMINISTER commands,
5–17
upgraded to Windows NT-compatibility,
5–6, A–5
Privileges
OpenVMS, 1–14
required to use PWRK$REGUTL, 7–23
Problem-solving techniques, 6–19
Process parameters, A–9
Process startup and shutdown
logging of, 6–13
Profiles
See User profiles
Protocols
choosing, B–5
DECnet-Plus, B–8

Index–10

Protocols (cont’d)
NetBEUI, B–7
network, B–1
Pulse server configuration parameter, A–7
PWLIC default share, 4–27
PWLICENSE default share, 4–27
PWRK$DELETEACE utility, 4–16
PWRK$FIXACE.EXE, 4–13
PWRK$LMLOGS logical, 6–11
PWRK$LMROOT, 4–19
directory, 6–3
PWRK$LMSRV log file, 6–13
PWRK$LOGS logical, 6–11
PWRK$REGUTL
DELETE PARAMETER command, 7–33
DELETE VALUE command, 7–33
environment settings, 7–25
exiting, 7–23
online help for, 7–24
privileges required, 7–23
SET PARAMETER command, 7–32
SET VALUE command, 7–32
SHOW PARAMETER command, 7–27
SHOW PARAMETER qualifiers, 7–28
SHOW VALUE command, 7–27
SHOW VALUE qualifiers, 7–28
using, 7–22
PWRK$REGUTL SHOW command
/DIFFERENCE qualifier, 7–28
/FULL qualifier, 7–28
/KNOWN qualifier, 7–28
/MAP_NAME qualifier, 7–28
PWUTIL default share, 4–27

Q
Queues
See Print queues

R
Randomize server configuration parameter,
A–7

REG$CP utility, using, 7–22
REGEDT32, using, 7–21
Registry
See OpenVMS Registry
REGUTL
See PWRK$REGUTL
REGUTL command, defining, 7–23
Remote management, 1–13
REMOVE command
COMPUTER, 2–16
on member servers, 2–14
GROUP, 3–31
PRINT QUEUE, 5–13
SHARE, 5–18
TRUST, 2–20
on member servers, 2–14
USER, 3–18
Resources, 1–7
Retention server configuration parameter
application event log, A–20
security event log, A–21
system event log, A–22
RMS protections, 4–6, 4–7
Root keys, 7–18
Routing queue, 5–3
creating, from Windows NT, 5–22
creating remotely with Windows NT,
5–22
creating with ADMINISTER commands,
5–8

S
SAM database
See Security Account Manager (SAM)
database, Security accounts database
SAVE EVENTS command, 6–7
Scripts
logon, 1–6
server configuration parameter, A–8
Security
dynamic upgrading on files, 7–9
event logging, 2–23
file and directory protections, 4–6
identifier, 2–8, 3–17

Security (cont’d)
identifiers for user groups, 3–31
integrating with OpenVMS, 4–3
models, 4–3, 4–4
printer, 5–6, 5–15
set up, 4–3
Security Account Manager (SAM) database,
1–6, 2–1, 3–3, 4–47
See also Security accounts database
parameters affecting, A–7
Security accounts database, 1–6
adding to, 2–14, 2–15
creation of, 2–2
defined, 2–1
on backup domain controllers, 2–3
on primary domain controllers, 2–2
removing accounts from, 2–16
synchronizing domain-wide, 2–7, 2–8
Security database
See Security Account Manager (SAM)
database, Security accounts database
Security event log
parameters, A–21
Security events, 6–8
Security models, 1–4
Advanced Server and OpenVMS, 4–6
Advanced Server Only, 4–4
specifying, 7–10
Security policy
See also Account policy, Audit policy
managing, 2–21
SEND command, 2–29
Server administrator responsibilities, 1–2
Server character set, 4–59
Server clocks
synchronizing, 2–34
Server configuration parameters
adding to the OpenVMS Registry, 7–33
affecting Advanced Server services, A–13
affecting Alerter service, A–19
affecting Application event log, A–20
affecting Browser services, A–5
affecting file services, A–10
affecting Netlogon service, A–7
affecting network user names, A–23

Index–11

Server configuration parameters (cont’d)
affecting processes, A–9
affecting Security event log, A–21
affecting shares, A–11
affecting system event log, A–22
AliasName, A–4
ComputerName_nodename, A–4
deleting from the OpenVMS Registry,
7–33
displaying, 7–27
in OpenVMS Registry, 7–27
Lanman Server, A–16
list of, A–1
managing, 7–17
migrating from LANMAN.INI to
OpenVMS Registry, A–1
modifiable by Configuration Manager,
7–2
modifying, 7–21, 7–32
saving, 7–10
stored in the OpenVMS Registry, 7–20,
7–27
upgraded printers, A–5
Windows NT printer management, A–15
Server data cache size, specifying, 7–7
Server events
monitoring, 6–1
Server language, 4–59
ServerLanguage server configuration
parameter, A–14
ServerLocale server configuration parameter,
A–15
Server problems
analysis of, 6–21
intermittent, 6–22
troubleshooting, 6–18
Servers, 1–3
administering, 1–13, 2–25
capacity for external authentication, 3–21
changing role of, 2–4
default administered, 1–13, 2–10
displaying current, 2–10
displaying information about, 2–25, 6–1
displaying version numbers, 2–28
managing, 2–25

Index–12

Servers (cont’d)
operation problems, 6–25
roles of, overview, 2–2
setting parameters, 1–2
specifying the security model, 7–10
Server service
description, 2–31
ServerServices server configuration
parameter, A–13
Server status
displaying, 6–1
Server status information
gathering, 6–21
Services
Alerter, 6–2
continuing, 2–33
displaying information about, 2–32
enabling, 2–30
list of, 2–30
managing, 2–30
Messenger, 6–3
parameters affecting, A–13
pausing, 2–32
problems, 6–27
starting, 2–32
stopping, 2–33
SET command
ACCOUNT POLICY, 2–21
ADMINISTRATION, 2–11
for member servers, 2–13
AUDIT POLICY, 2–23, 2–25, 6–9, 6–10
COMPUTER, 2–4, 2–8
on member servers, 2–14
COMPUTER/AUTOSHARE_
SYNCHRONIZE, 4–26
FILE/AUDIT, 6–10
PRINT JOB/DELETE, 5–20
PRINT JOB/HOLD, 5–19
PRINT JOB/LAST, 5–20
PRINT JOB/RELEASE, 5–19
PRINT QUEUE/ABORT, 5–20
PRINT QUEUE/CONTINUE, 5–12
PRINT QUEUE/PURGE, 5–12
PRINT QUEUE/RESTART, 5–19
PRINT QUEUE/TYPE, 5–11

SET MODE command, 4–50
defaults, 4–51
SET PARAMETER
/CREATE qualifier, 7–33
/DEFAULT qualifier, 7–32
Setting
permissions for file and directory access,
4–37
server parameters, 1–2
SET VALUE
/CREATE qualifier, 7–33
/DEFAULT qualifier, 7–32
Shared directories
creating, 4–27
displaying, 4–32
Shared printers, 5–3
managing, 5–1
OpenVMS print queues, 5–2
Shared resources
displaying information about, 2–27
planning, 4–2
Shares
access problems, 6–29
administrative, 4–19
administrator access, 4–18
changing properties of, 4–34
checking access, 4–18
controlling access, 4–17
creating, 4–27, 4–29
disk administrative, 4–21
displaying, 4–32
displaying information about, 2–27
displaying on ODS-5 volumes, 4–55
group access, 4–18
managing on ODS-5 disk volumes, 4–55
parameters affecting, A–11
permissions, 4–2, 4–29
personal, 4–30
planning permissions, 4–28
table of defaults, 4–27
Sharing
directories, 4–27
printers, 5–4
resources, 1–7

SHOW command
ACCOUNT POLICY, 2–23
ADMINISTRATION, 2–10
AUDIT POLICY, 2–24
COMPUTERS, 2–5
on member servers, 2–14
CONNECTIONS, 2–25
EVENTS, 6–5
FILE/AUDIT, 6–11
GROUPS
on member servers, 2–14
HOSTMAP, 3–20
PRINT QUEUES, 5–10
SERVICES, 2–32
SHARES, 2–27
TRUSTS, 2–19
on member servers, 2–14
USERS, 3–5, 3–14
VERSION, 2–28
SHOW DEVICE/FULL command, 4–56
SHOW PARAMETER
/FULL qualifier, 7–30
/KNOWN qualifier, 7–28
SHOW PARAMETER command
PWRK$REGUTL, 7–27
qualifiers, 7–28
SHOW SHARES/HIDDEN command, 4–19
SHOW VALUE
/FULL qualifier, 7–30
/KNOWN qualifier, 7–28
SHOW VALUE command
PWRK$REGUTL, 7–27
qualifiers, 7–28
Shutdown procedure, 2–28
SID
See Security identifier
SrvAnnounce server configuration parameter,
A–17
SrvComment server configuration parameter,
A–17
Srvhidden parameter, A–18
Srvservices parameter, A–13
Starting services, 2–32

Index–13

START SERVICE command, 2–32
Stopping
services, 2–34
STOP SERVICE command, 2–34
STORE_SECURITY_ACES parameter,
4–12, A–10
Syntax modes
PWRK$REGUTL utility, 7–25
System event log
parameters, A–22

T
TCP/IP, B–6
address, 7–13
enabling and disabling, 7–11
TCP/IP cluster alias, 2–36
TCP/IP cluster impersonator name, 2–36
TDF
See Time differential factor
Time differential factor
modifying, 2–34
Time servers
designating, 2–34
TimeSource service
description, 2–31
running, 2–34
Time zone
modifying, 2–34
Transmission Control Protocol/Internet
Protocol
See TCP/IP
Transport configuration parameters, 7–2,
7–11
enabling and disabling, 7–11
saving, 7–13
Transport configuration screen, 7–11
Transports
configuring, 7–11
enabling and disabling, 7–11
supported by Advanced Server, B–1
Transports and protocols
table of, B–5

Index–14

Troubleshooting, 6–1, 6–19
Trust relationships
displaying, 2–19
establishing two-way, 2–19
managing, 2–17
removing, 2–20

U
UIC, 4–6
Unicode
in file names, 4–58
Unicode (UCS-2)
See Extended character sets
Unicode (UCS-2) encoding, 4–43
Update server configuration parameter, A–8
User access to shared resources, 4–18
User accounts, 1–5
adding to a group, 3–16
Administrator, 3–1
attributes, 3–2
built-in, 3–1
changing logon hours, 3–16
changing passwords, 3–9
copying, 3–7
creating, 3–4
creating from existing accounts, 3–7
creating templates, 3–6
disabling, 3–17, 3–18
displaying, 3–5
displaying host mapping, 3–20
displaying information, 2–10
displaying information about, 3–14
establishing host mapping, 3–18
external authentication, 3–20
global, 3–2
Guest, 3–2
home directories, 3–12
local, 3–2
lockout policy, 3–8
lockout policy, establishing, 2–22
mapping with OpenVMS account, 3–5
modifying, 3–16
planning, 3–1
problems, 6–33

User accounts (cont’d)
removing, 3–17, 3–18
restricting logon hours, 2–22, 3–9
restricting logon workstations, 3–11
setting policy for passwords, 3–8
specifying expiration dates, 3–13
specifying logon scripts, 3–10
specifying passwords, 3–7
specifying user profiles, 3–13
User accounts database, 2–1
User groups
See Groups
UserPath server configuration parameter,
A–18
User profiles, 3–13
Users
forcing disconnects of, 2–22
solving problems with privileges, 6–34
USERS default share, 4–27
User service parameters, A–23
User sessions, displaying information about,
2–26

V
Validation, logon, 1–6
Values (OpenVMS Registry)
defined, 7–17

Windows NT
file security information, 4–5, 4–8
security descriptors, 4–5
Windows NT-compatible printers
managing, 5–22
naming, 5–22
OpenVMS Registry entries, 5–21
Windows NT-compatible shared printers,
5–21
Windows NT Event Viewer, 1–10
Windows NT file-naming conventions, 4–58
Windows NT file security information
how read by the Advanced Server, 4–9
Windows NT printer management, 5–5,
5–21
advantages of, 5–6
configuration parameter, A–5, A–15
enabling, 5–6
restrictions, 5–6, 5–24
Windows NT printer pool, 5–5
Windows NT Print Manager, 1–10
Windows NT Server Manager, 1–10
inaccurate cluster information, 2–35
shares not manageable by, 4–41
Windows NT User Manager for Domains,
1–10, 3–1
WINS name resolution, 7–13
Workstations
management, 2–12
Workstations, specifying, 3–11

Wide-area network support
name resolution for, 7–12
Windows 2000
domain environment, 2–2, 2–3
Windows 2000 file-naming conventions,
4–58
Windows 2000 mixed-mode domain, 2–2,
2–3
Windows 2000 native-mode domain, 2–2,
2–3
Windows 95 file-naming conventions, 4–58
Windows 98 file-naming conventions, 4–58

Index–15