| Previous | Contents | Index |
You can restrict the days and hours during which a user can connect to a server. The default is to allow a user to connect at all times.
Use the ADD USER, COPY USER, or MODIFY USER command with the /HOURS qualifier. Specify the hours to be administered as shown in the following table. The /NOHOURS qualifier specifies that the user cannot log on to the server.
Hours are inclusive: if you grant access during a given hour, access extends to the end of that hour; if no hours are specified for a given day, all hours are allowed.
| To select... | Use, for example... |
|---|---|
| A specific hour | /HOURS=(MONDAY=(8)) |
| A block of hours | /HOURS=(FRIDAY=(8-12)) |
| One entire day | /HOURS=(SUNDAY) |
| A specific hour across all seven days | /HOURS=(SUNDAY=(1),MONDAY=(1),TUESDAY=(1), WEDNESDAY=(1),THURSDAY=(1),FRIDAY=(1), SATURDAY=(1)) |
| All weekdays | /HOURS=(WEEKDAYS) |
| The entire week | /HOURS=(EVERYDAY) |
In the following example, a user called MOUSEQUEEN is added to the domain LANDOFOZ with logon capability on Fridays from 8 a.m. to 12 noon.
LANDOFOZ\\TINMAN> ADD USER MOUSEQUEEN/HOURS=(FRIDAY=(8-12)) %PWRK-S-USERADD, user "MOUSEQUEEN" added to domain "LANDOFOZ" |
The following example adds user BLACKCROW to domain LANDOFOZ, with logon capability from Monday through Friday, all hours.
LANDOFOZ\\TINMAN> ADD USER BLACKCROW/HOURS=(WEEKDAYS) %PWRK-S-USERADD, user "BLACKCROW" added to domain "LANDOFOZ" |
For more details on the /HOURS qualifier, see Section 3.1.14, Modifying User Accounts.
3.1.8 Specifying Logon Scripts
You can specify the execution of a logon script when a user logs on. A
logon script is an executable or batch file of commands that runs on
the client. It is typically used to configure the client for a
particular user, performing such tasks as making network connections
and starting applications. Logon scripts can be tailored to the
requirements of individual users. A logon script typically has a .BAT,
.CMD, or .EXE file extension, depending on its function.
3.1.8.1 Setting Up a Logon Script
When a user logs on, Advanced Server checks the user's account on the logon server for the name of a script. Scripts are kept on the primary and backup domain controllers. By default, user scripts on an Advanced Server are stored in the following location:
PWRK$LMROOT:[LANMAN.REPL.IMPORT.SCRIPTS]
3.1.8.2 Providing User Access to Logon Scripts
For a user to have access to a logon script, the following conditions must be true:
Ensure that permissions on the directory or share where the scripts reside permit access to all users who will be using the scripts. Advanced Server automatically provides Read access to members of the special group Everyone.
When the NetLogon service starts, Advanced Server shares the scripts directory identified with the share name NETLOGON. For logon scripts to run, do not remove the NETLOGON share. You can display information about the NETLOGON share using the SHOW SHARE NETLOGON/FULL command. For example:
LANDOFOZ\\TINMAN> SHOW SHARE NETLOGON/FULL
Shared resources on server "TINMAN":
Name Type Description
------------ --------- ------------------------------------------
NETLOGON Directory Logon Scripts Directory
Path: PWRK$LMROOT:[LANMAN.REPL.IMPORT.SCRIPTS]
Connections: Current: 0, Maximum: No limit
RMS file format: Stream
Directory Permissions: System: RWED, Owner: RWED, Group: RWED, World: RE
File Permissions: System: RWD, Owner: RWD, Group: RWD, World: R
Share Permissions:
Everyone Read
Total of 1 share
LANDOFOZ\\TINMAN>
|
Use the /WORKSTATIONS qualifier to restrict the workstations from which users can log on to domain accounts. The default is to allow a user to log on from any workstation, but you can optionally restrict a user's logons to certain workstations. You can specify up to eight workstations for the user account.
Use the ADD USER, COPY USER, or MODIFY USER command, with the /WORKSTATION qualifier. For example:
LANDOFOZ\\TINMAN> ADD USER LION /WORKSTATION=(LIONS_DEN) %PWRK-S-USERADD, user "LION" added to domain "LANDOFOZ" |
This command creates the new user account LION and specifies that the
user can logon from the LIONS_DEN workstation.
3.1.10 Specifying Home Directories
A user's home directory is accessible to the user and contains files and programs for that user. When a user logs on at a workstation, a connection can be made to that user's home directory automatically. Depending on the client computer, you may need to specify the home directory in a logon script. The home directory becomes the user's default directory for file access and for all applications that do not have a defined working directory. Home directories can make it easier for an administrator to back up user files because they keep many or all of a user's files in one location.
On a server running Advanced Server software, the default parent directory for user account home directories is:
PWRK$LMROOT:[LANMAN.ACCOUNTS.USERDIRS]
You can specify a home directory as an absolute path name or as a UNC (Universal Naming Convention) path name, which is domain wide. To specify the default parent directory for user account home directories, enter:
\\server\LANMAN\ACCOUNTS\USERDIRS |
If you omit the /HOME qualifier when you create a user account, no home directory is defined for a user.
The Advanced Server home directory is not associated with the OpenVMS SYS$LOGIN directory. |
A home directory can be assigned to a single user or it can be shared by several users. It can be a local directory on a user's workstation or a shared network directory. If you specify a network path for the home directory, an attempt is made to create that home directory. If the directory cannot be created, a message instructs you to create the directory manually.
Use the ADD USER, COPY USER, or MODIFY USER command, with the /HOME=(PATH=pathname) qualifier. The home directory pathname must be specified in one of the following forms:
\\servername\sharename\directoryname |
For example, to modify user account LION, specifying a home directory on server TINMAN to be associated with drive D, enter the following command:
LANDOFOZ\\TINMAN> MODIFY USER LION/HOME=(PATH=\\TINMAN\USERS\LION,DRIVE=D:) %PWRK-S-USERMOD, user "LION" modified on domain "LANDOFOZ" LANDOFOZ\\TINMAN> |
You can assign an expiration date for a user account, at which time the account is automatically expired but not removed from the accounts database. You can reactivate an expired account by removing the expiration date or by assigning a new date.
By default, there is no expiration date for a user account. Use the ADD USER, COPY USER, or MODIFY USER command with the /EXPIRATION qualifier to define the account expiration date for a user account.
When an account has an expiration date, the account is disabled at the end of the previous day. When an account expires, a user who is logged on remains logged on, but cannot establish new network connections or log on again after logging off.
For example, to add a user named FRIENDLY to the domain LANDOFOZ and set the account to expire on June 9, 1999, enter the following command:
LANDOFOZ\\TINMAN> ADD USER FRIENDLY/PASSWORD="PotOfGold"- _LANDOFOZ\\TINMAN>/EXPIRATION_DATE=09-JUN-1999 %PWRK-S-USERADD, user "FRIENDLY" added to domain "LANDOFOZ" |
User profiles allow you to set up the user's environment so that it can be downloaded to the user's workstation when the user logs on to the network. The user profile contains configuration information such as:
When the user logs on, the user profile is downloaded and the user's workstation is configured accordingly.
You create user profiles using the Windows NT Server tool User Profile Editor. Refer to your Windows NT Server documentation for more information.
When you add a user, you can specify a profile and its path.
To specify a profile:
Use the ADD USER or MODIFY USER command with the /PROFILE qualifier. For example, to add user SCARECROW with a profile that is stored on the server TINMAN, enter the following command:
LANDOFOZ\\TINMAN> ADD USER SCARECROW/PROFILE="\\TINMAN\PROFILES\SCARECROW.USR" %PWRK-S-USERADD, user "SCARECROW" added to domain "LANDOFOZ" LANDOFOZ\\TINMAN> |
Note that the network path to the profile is enclosed in quotation
marks.
3.1.13 Displaying User Accounts
To display information about user accounts, use the SHOW USERS command. For example:
LANDOFOZ\\TINMAN> SHOW USERS
User accounts in domain "LANDOFOZ":
User Name Full Name Type Description
-------------- ----------- ------ ------------------------
Administrator Global Built-in account for
administering the domain
Guest Global Built-in account for
guest access to the domain
LION Lion,Cowardly Global Cowardly Lion
SCARECROW Man, Straw Global The Straw Man
Total of 4 user accounts
LANDOFOZ\\TINMAN>
|
To sort the display by user full name:
Use the SHOW USERS/SORT=FULLNAME command. For example:
LANDOFOZ\\TINMAN> SHOW USERS/SORT=FULLNAME
User accounts in domain "LANDOFOZ:"
Full Name User Name Type Description
-------------- ------------- ------ ---------------------------
Administrator Global Built-in account for
administering the domain
Guest Global Built-in account for guest
access to the domain
Lion, Cowardly LION Global Cowardly Lion
Man, Straw SCARECROW Global The Straw Man
Total of 4 user accounts
LANDOFOZ\\TINMAN>
|
To review user account settings for a specific user:
Use the SHOW USERS/FULL command. For example, the following display shows the settings for user LION.
LANDOFOZ\\TINMAN> SHOW USERS LION/FULL User accounts in domain "LANDOFOZ": User Name Full Name Type Description --------------- --------------- ------- ------------- LION Lion, Cowardly Global Cowardly Lion User profile: Logon script: Home Path: D: Path: \\TINMAN\USERS\LION Primary Group: Domain Users Member of groups: Domain Users, MUNCHKINS Workstations: No workstation restrictions Logon Flags: Logon script is executed, Password is expired Account Type: Global Account Expires: Never Logon hours (All hours) Total of 1 user account LANDOFOZ\\TINMAN> |
Use the MODIFY USER command to change the attributes of an existing user account. You can:
To add an existing user to a group:
Use the MODIFY USER/ADD_TO_GROUPS command. For example:
LANDOFOZ\\TINMAN> MODIFY USER SCARECROW/ADD_TO_GROUPS=MUNCHKINS %PWRK-S-USERMOD, user "SCARECROW" modified on domain "LANDOFOZ" |
You can then enter the SHOW GROUPS/FULL command to see that the group MUNCHKINS now includes the user SCARECROW:
LANDOFOZ\\TINMAN> SHOW GROUPS MUNCHKINS/FULL
Groups in domain "LANDOFOZ":
Group Name Type Description
-------------------- ------ ------------------------------------
MUNCHKINS Global Users in the Land of Oz
Members: [US]LION, [US]SCARECROW)
Total of 1 group)
LANDOFOZ\\TINMAN>
|
To change a user's logon hours:
To change the hours when a user can log on, use the MODIFY USER/HOURS command. For example, to restrict a user to logging on only on Monday from 8 a.m. to 9 a.m. and from 3 p.m. to 8 p.m., specify /HOURS=(MON=(8-9,15-20)).
For example, to modify LION's logon hours, use the MODIFY USER command, as follows.
LANDOFOZ\\TINMAN> MODIFY USER LION/HOURS=(MON=(8-9,15-20)) %PWRK-S-USERMOD, user "LION" modified on domain "LANDOFOZ" LANDOFOZ\\TINMAN> |
You can verify that the change was made correctly using the SHOW USERS/FULL command. For example:
LANDOFOZ\\TINMAN> SHOW USERS LION/FULL
User accounts in domain "LANDOFOZ":
User Name Full Name Type Description
--------------- --------------- ------- -------------
LION Lion, Cowardly Global Cowardly Lion
User profile:
Logon script:
Home Path: D: Path: \\TINMAN\USERS\LION
Primary Group: Domain Users
Member of groups: Domain Users, MUNCHKINS
Workstations: No workstation restrictions
Logon Flags: Logon script is executed, Password is expired
Account Type: Global
Account Expires: Never
Logon hours: 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 2 2 2 2
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
Sunday: - - - - - - - - - - - - - - - - - - - - - - - -
Monday: - - - - - - - - X X - - - - - X X X X X X - - -
Tuesday: - - - - - - - - - - - - - - - - - - - - - - - -
Wednesday: - - - - - - - - - - - - - - - - - - - - - - - -
Thursday: - - - - - - - - - - - - - - - - - - - - - - - -
Friday: - - - - - - - - - - - - - - - - - - - - - - - -
Saturday: - - - - - - - - - - - - - - - - - - - - - - - -
Total of 1 user account
LANDOFOZ\\TINMAN>
|
A user's ability to log on can be rescinded by either disabling or removing the user account. A disabled user account still exists, but the user is not permitted to log on. It continues to appear in the user accounts list. It can be restored to enabled status at any time. A removed account is permanently removed and cannot be recreated with the same security settings.
Each user in a domain is identified by a unique security identifier (SID). The SID is created when a user account is created and is used when assigning permissions to a resource. Because a SID is unique to an account, a new account, even with the same user name, is assigned a new SID. Therefore, if you delete a user account and then need to create another user account for the same user with the same user name, the new user account will not have the rights or permissions that previously were granted to the old user account, because the user account will have a different SID. To avoid problems, first disable a user account you want to remove and then remove it after a reasonable time.
Set the account to Disabled, using the MODIFY USER/FLAGS=(DISUSER) command.
Use the REMOVE USER command. You are prompted for confirmation before the command executes.
A deleted user account is removed from the user accounts list and cannot be restored or recreated. Make sure that you want to delete a user account before doing so. For example:
LANDOFOZ\\TINMAN> REMOVE USER LION Each user account is represented by a unique identifier which is independent of the user name. Once the user account is deleted, even creating an identically named user account in the future will not restore access to resources which currently name this user account in the access control list. Remove user "LION" [YES or NO] (YES) : YES %PWRK-S-USERREM, user "LION" removed from domain "LANDOFOZ" LANDOFOZ\\TINMAN> |
Advanced Server provides user account host mapping, which associates a network user account with an OpenVMS user account, simplifying the management of both user accounts. Host mapping is required for users who are externally authenticated, as described in Section 3.1.17, Enabling External Authentication.
Hostmapping allows you to establish personal shares and to impose
OpenVMS security as well as Advanced Server security. The security models
are selected using the Configuration Manager, as described in
Section 7.1, Using the Configuration Manager.
3.1.16.1 Implicit Host Mapping
External authentication supports both explicit and implicit user host mapping between OpenVMS and Advanced Server. You can explicitly map a network user name to an OpenVMS user name using the ADMINISTER command ADD HOSTMAP.
Implicit host mapping is established when:
Host mapping is used to determine the OpenVMS user name when logging on to OpenVMS using external authentication. The user account Administrator is implicitly mapped to the OpenVMS user account SYSTEM. Therefore, if you enable the OpenVMS user account SYSTEM for external authentication, you can log in to the SYSTEM account using the Administrator user name and password, without explicitly defining any hostmap information. See Section 3.1.17, Enabling External Authentication, for more information.
Implicit host mapping is based on the user account names. Therefore, if
you copy the Administrator account or the Guest account, you must
specifically set up hostmapping for the new user accounts.
3.1.16.2 Establishing User Account Host Mapping
By default, if a user name for a network user account is identical to the user name for an OpenVMS user account, the user accounts are host mapped. Files created by the network user are automatically designated with the OpenVMS owner setting. This feature is controlled by a set of server configuration parameters, described in Section 7.2, Managing Server Configuration Parameters, and listed in Appendix A, Server Configuration Parameters, including:
When a user creates a file or directory using Advanced Server, the resource is assigned the OpenVMS ownership associated with the user's mapped account. The mapped account is used for OpenVMS resource ownership, if the Advanced Server and OpenVMS Security model is enabled. (For more information about enabling this security model, see Section 7.1, Using the Configuration Manager.)
Use the ADD HOSTMAP command in the following form:
ADD HOSTMAP network-user-name OpenVMS-user-name
In the following example, the network user account for SCARECROW is host mapped to the user's OpenVMS user account STRAWMAN. If SCARECROW creates a file, the file is assigned the RMS ownership attributes associated with the OpenVMS account STRAWMAN.
LANDOFOZ\\TINMAN> ADD HOSTMAP SCARECROW STRAWMAN %PWRK-S-HOSTMAPADD, user "SCARECROW" mapped to host user "STRAWMAN" LANDOFOZ\\TINMAN> |
Use the SHOW HOSTMAP command. For example:
LANDOFOZ\\TINMAN> SHOW HOSTMAP Host Mappings for server "TINMAN": User Name Host Name ---------------------------- ----------- Guest PWRK$GUEST SCARECROW STRAWMAN LION CLION Total of 3 host mappings LANDOFOZ\\TINMAN> |
| Previous | Next | Contents | Index |