Article ID: 192711
Article Last Modified on 10/28/2006
APPLIES TO
- Microsoft SNA Server 3.0 Service Pack 4
- Microsoft SNA Server 4.0
- Microsoft SNA Server 3.0 Service Pack 2
- Microsoft SNA Server 3.0 Service Pack 3
- Microsoft SNA Server 4.0 Service Pack 1
- Microsoft SNA Server 4.0
This article was previously published under Q192711
SYMPTOMS
Users who have the Host Security Configuration tool (UDConfig.exe) installed with the SNA Server Windows 95 or Windows NT Workstation client cannot change their own Host Account Cache entries unless they have "log on locally" rights or are part of the Administrators or Domain Admins group.
Steps to Reproduce the Problem:
- Open Host Account Manager.
- The following expected message from UDCONFIG appears: You do not have sufficient privilege to change the configuration of other users. You can change your own configuration.
- Click OK and make a change in the Host Account Cache from either the mapped entries or the replicated entries. Click Update Cache.
- A dialog box appears, prompting you for the current Windows NT password. Type it in, and then click OK.
- The following message from UDCONFIG appears: The operation failed because your password could not be verified. Would you like to retry the operation?
CAUSE
SNA Server Password Management Process (PMP) was trying to authenticate the user with logon type = LOGON32_LOGON_INTERACTIVE, which required the "log on locally[ASCII 148] right for the user. To correct this, a change was made to Snapmp.exe, removing this requirement and changing type to logon type = LOGON32_LOGON_NETWORK. This allows all domain users the ability to change their own cache configuration.
RESOLUTION
SNA Server 3.0
To resolve this problem, obtain the latest service pack for SNA Server version 3.0. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
184307 How to Obtain the Latest SNA Server Version 3.0 Service Pack
SNA Server 4.0
This problem was corrected in the latest SNA Server version 4.0 U.S. Service Pack. For information on obtaining this Service Pack, query on the following word in the Microsoft Knowledge Base (without the spaces):
S E R V P A C K
STATUS
Microsoft has confirmed that this is a problem in SNA Server versions 3.0(all service packs), 4.0, and 4.0 SP1. This problem was first corrected in SNA Server 3.0 Service Pack 4.
MORE INFORMATION
Below is an example of an SNA WinNT Account Synchronization trace (Pmpintx.atf), showing where the failure occurs:
Logon Attempt Failed. Error: 1385 Target PDC: \\<NT_Server_Name> Administrators Group: ADMINISTRATORS Checking for group Membership Entering MemberOfLocalGroup MachineName : <NT_Server_Name>, NT Major Version: 4 Group: <Same_Name_as_Host_Security_Domain_Name> Group: Users Group not found. No Administrator Privilege User rights could not be validated, err e1900021 ProcessRequest returned 0xE1900021 ProcessRequest no out message SrvrRpcProcessRequestInternal end
Keywords: kbbug kbfix kbfaq KB192711
