Article ID: 319784
Article Last Modified on 4/18/2005
APPLIES TO
- Microsoft SNA Server 4.0
- Microsoft SNA Server 4.0 Service Pack 1
- Microsoft SNA Server 4.0 Service Pack 2
- Microsoft SNA Server 4.0 Service Pack 3
- Microsoft SNA Server 4.0 Service Pack 4
- Microsoft Host Integration Server 2000 Standard Edition
This article was previously published under Q319784
SYMPTOMS
When the SNA Manager is opened on a Microsoft SNA Server or Microsoft Host Integration Server 2000 system, you may receive the following error message:
Additionally, the following corresponding entry may be posted in the application event log:
This latter error message indicates that SnaBase service cannot access the configuration file.
CAUSE
The message is quite accurate: the configuration file, Com.cfg, cannot be read.
This problem may occur for various reasons, including inappropriate permissions, the path to the file is not found, or the configuration file is corrupted.
RESOLUTION
The resolution depends on the cause:
- If the file is corrupted, try to export and recompile the file using the SNACFG utility as documented in the SNA Server Reference Guide.
- If the configuration file cannot be accessed by means of the COMCFG share of the Primary SNA Server or Host Integration Server, you have to resolve the path issue.
- If the file cannot be accessed because of a data security issue, you have to work with the security settings to resolve this problem.
STATUS
MORE INFORMATION
You can test the configuration file for corruption, and you may be able to fix it by exporting the file to text, and then recompiling it by using the SNACFG utility. You can use the /v (for verbose) switch on the recompile to monitor progress or identify a failing location. For additional information about how to pipe out and recompile a configuration file, click the article number below to view the article in the Microsoft Knowledge Base:
222087 How To Combine Multiple SNA Subdomains Into One Using Snacfg
You can test whether you can reach, read and copy the configuration file on the Primary Server by connecting to the COMCFG share and then trying to copy the Com.cfg file. Test by connecting using the UNC name and by IP Address to determine whether name resolution is working, and then copy the file to the backup server. You can expect the connection to succeed without a logon prompt. If you can make a connection with the UNC name and an IP address, this indicates that a path to the file is not the issue. However, it does not rule out data security as a problem.
If an SNABase trace shows an inability to copy the file and the issues mentioned in the previous paragraph are not issues, then the problem may be data security. The presence of a 705 event in the application event log would indicate that data security is the issue.
IMPORTANT: To resolve a data security issue, you must understand the context in which a file access request is being made. To do so, verify the context under which the SNABase service has been installed. Troubleshooting methods vary a lot, depending on whether the account has been installed in a local account, in the local system account, or in a domain account.
Troubleshooting the local account and domain account are similar and straightforward, except that you must verify a domain account on a domain controller. Troubleshooting the local system account is more complex, but the concept is the same: "is this user (context) permitted access to the file?". Test the access to the file by using the same credentials as are used by the SNA Server and associated services.
When SNA Server or Host Integration Server is running in a local system context as a backup server, the concept and use of "null sessions" becomes important. For additional information, click the article numbers below to view the articles in the Microsoft Knowledge Base:
132679 Local System Account and Null Sessions in Windows NT
122702 Using the System Account as a Service in Windows NT 3.5
It is important to understand that if a service is using the system account to access resources, the service logs on with a set of "null credentials". The null credentials are passed to the primary server with the request to copy the configuration file. Instead of explaining null credentials, "null sessions" and such, this article provides the following solution:
- Install SNA Server or Host Integration Server 2000 into a domain account.
- Let the install process create the user with all the appropriate rights.
- If you use a local account, create the same user name and password combination as a local user on each SNA Server. This will enable "passthrough authentication".
- If SNA Server is installed in a local system account, Microsoft recommends that you set the permissions on the configuration file to EVERYONE\Read\manage by means of the SNA Manager subdomain properties tool (instead of by setting permissions in the NTFS file system).
Whenever possible, set the configuration file permissions using the SNA Manager. It has been seen that setting permissions through NTFS may cause a "view only" or "unable to open configuration file" issue, which may not be recoverable.
Additional query words: HIS 2000
Keywords: kbinfo KB319784
