6.9.3  
Windows Server 2008 
 

Contents  
This chapter contains the following sections:
 •   Section 6.9.3.1 "HiPath 3000 Manager E"
 •   Section 6.9.3.2 "Required configuration changes"
 •   Section 6.9.3.3 "Other considerations"

6.9.3.1  
HiPath 3000 Manager E 

Connection to a decentrally installed HiPath 3000/5000 V9 DB Feature Server  
HiPath 3000 Manager E can be used for the connection to a decentrally installed DB Feature Server. From the dialog "Transfer" in HiPath Manager E (File -> Transfer...), the user can configure whether he wishes access to a local or decentrally installed DB Feature Server. The user has the option to specify another computer name or another IP address.

Allocation of IP address to computer name  
Moreover, the user can assign an IP address to a computer name and use the Hosts file of Windows for this purpose; this file can be found at C:\WINDOWS\system32\drivers\etc.\host. The computer name must be real and actually exist - e.g., the computer name of the decentralized PC - and must be appended as an alias to the file mentioned above. During the configuration of HiPath 3000 Manager E with the correct address or the computer name, all the functions listed in the "Transfer" dialog work as if the DB Feature Server were locally installed.
When the "Transfer" dialog is called the first time, a standard computer name is displayed. This is generally the name of the local computer on which HiPath 3000 Manager E is installed. If the user wishes to change this name to the name of a decentralized computer, he or she must click Apply, close the dialog box, and then call it again, so that HiPath 3000 Manager E can recognize the service at the new IP address or computer with the new name.
NOTE  
Please note that HiPath 3000 Manager E will possibly not react after changing the IP address. That is quite normal; in this case, the user merely has to wait till HiPath 3000 Manager E has finished its tasks.  

6.9.3.2  
Required configuration changes 

Introduction  
The connection to a decentralized computer on which Windows Vista or a later Windows version, or Windows Server 2008 is running, makes changes to the settings for the Windows Firewall and the User Account Control (UAC) necessary.
The Windows Firewall (known earlier as the Internet Connection Firewall) Service and the Distributed Component Object Modem (DCOM) can cause access rejection errors (e.g., the error "RPC Server Unavailable" - 0x800706ba or 0x80070005 - general access rejection error) if your decentralized computers used for remote connection are not correctly configured.
Changes to default DCOM settings and Windows Firewall settings can result in the security for other DCOM-capable applications being insufficient. Changes to default DCOM settings must be checked and approved by your system /security administrator.

Contents  
This chapter contains the following sections:
 •   Section 6.9.3.2 "Windows Firewall settings"
 •   Section 6.9.3.2 "Configuration of the DCOM settings of a COM application"
 •   Section 6.9.3.2 "Editing UAC settings on computer B"

6.9.3.2.1  
Windows Firewall settings 
Let us assume that DB Feature Server is installed on computer B and HiPath Manager E on computer A. The diagram below shows a DCOM connection from computer A (the local computer) to computer B (the decentralized computer).
In order to set up this connection, both Windows Firewall as well as DCOM must be correctly configured on computer B.
From Windows 2008 Server and later - on which the DB Feature Server is installed- firewall exceptions are added for all executable programs that are a part of the DB Feature Server. These exceptions are added at the time of installation and removed at the time of uninstalling. However, when the DB Feature Server is upgraded, new firewall rules are not added. Before performing an upgrade, the user must ensure that these firewall rules already exist. If these rules do not exist, the user must uninstall the product manually and then perform a fresh installation of DB Feature Server.
If the firewall of computer A is activated, additional settings may be required.

6.9.3.2.2  
Configuration of the DCOM settings of a COM application 

Dcomcnfg.exe  
Dcomcnfg.exe is a tool contained in Windows. It facilitates the configuration of the DCOM settings of a COM application for the user. Moreover, it provides a user interface from which certain settings in the registry can be edited. By using Dcomcnfg.exe, you can activate the security either computer-wide or process-wide.
You can enable the security for a specific computer, so that the values set by Dcomcnfg.exe are used if a process does not provide its own security settings - either programmed or via the registry values. So also, you can use Dcomcnfg.exe to enable the security only for a certain application.

Domains and Rights  
What should be taken into account in particular is whether computer A and computer B belong to the same domain or different domains or whether neither of the two computers is a member of a domain.
If you have several domains, the corresponding settings must be made in both domains, so that domain A considers users from domain B to be reliable and vice versa.
For DCOM to work properly, there should be a reliable connection between the two domain controls. More detailed information on the structure of the reliable connection between domains can be found in the documentation for Microsoft Windows Server. Once the reliable connection between your domain controls has been set up, you can usedcomcnfg.exe to edit the DCOM settings.
If a Windows PC is not a member of a domain, it grades only those user accounts as reliable, which are present in its local security database. If you try to set up a connection to a decentralized server and get an error of type "Access rejected" or something similar, it means that there are authorization problems between the two PCs.
To rectify authorization problems, the user must create EXACTLY THE SAME user account names AND passwords on BOTH the PCs. For this special case, please read through Section 6.9.3.2 "Editing UAC settings on computer B" as well.
On the client PC, HiPath 3000 Manager E must be run with Administrator rights to set up a connection to a decentrally installed DB Feature Server. If the user involved is a standard user (not an administrator), right click on the icon of HiPath 3000 Manager E and then click Run as Administrator.
Once the rights are correctly created, the user can use the tool dcomcnfg.exe.

Creating a HiPath 3000 Manager E user for remote access to Computer B  
To grant a user who is using HiPath 3000 Manager E access to computer B, please proceed as follows on computer B:
 1.   Starting the tool dcomcnfg.exe:
   a)   Click Start -> Execute. The input prompt "Run" is displayed.
   b)   In the field "Open:", enter the following: dcomcnfg.
   c)   Click OK. The tool dcomcnfg.exe now starts and the dialog "Component Services" is displayed.
 2.   Create the new user in the settings "My Computer":
   a)   In the tree view, go down to Console Root -> Component Services -> Computers -> My Computer, till the branchMy Computer is selected. In addition, the tree components "COM+ Applications", "DCOM Config", "Running Processes" and "Distributed Transaction Coordinator" are displayed.
   b)   Right-click in the tree view on My Computer and then in the context menu click Properties. The "My Computer Properties" dialog is displayed.
   c)   Click the COM Security tab. The tab "COM Security" contains "Access Permissions" and "Launch and Activation Permissions". Now, you have to use these two parameters to create and set up the user account to which you wish to grant remote access to computer B.
   d)   In "Access Permissions", click on Edit Limits. The "Access Permission" dialog is displayed with the tab "Security Limits". Proceed as follows to create and set up a new user account:
     1.   Click Add, and create a new account.
     2.   Under "Group or user names", select the added user account.
     3.   In "Permissions for ...", select the two check boxes Local Access and Remote Access.
     4.   Then click OK to save the new settings.
   e)   Under "Launch and Activation Permission", click Edit Limits. The "Launch and Activation Permission" dialog is displayed with the tab "Security Limits". Proceed as follows to create and set up a new user account. This account must be the same account as in the previous step:
     1.   Click Add, and create a new account.
     2.   Under "Group or user names", select the added user account.
     3.   Under "Permissions for ...", select the check boxes Local Launch, Remote Launch, Local Activation and Remote Activation.
     4.   Then click OK to save the new settings.
   f)   In the dialog "My Computer Properties", click OK. The "My Computer" settings are now saved and the "Component Services" dialog is displayed again.
 3.   Creating the new user in the vsrv settings:
   a)   Navigate down in the tree view: Console Root -> Component Services -> Computers -> My Computer -> DCOM Config.
   b)   Double-click DCOM Config. A component list is displayed.
   c)   Right-click in the list on the component vsrv and then in the context menu, click Properties. The "vsrv Properties" dialog is displayed.
   d)   Click the tab General and set the property "Authentication Level" to Default.
   e)   Click the Security tab. The tab "Security" contains "Access Permissions" and "Launch and Activation Permissions".
   f)   In "Access Permissions", click Customize-> Edit. The "Access Permission" dialog is displayed with the tab "Security Limits". Now proceed as follows to create and set up the new user account. This account must be the same account as in the previous step:
     1.   Click Add, and create a new account.
     2.   Under "Group or user names", select the added user account.
     3.   In "Permissions for ...", select the two check boxes Local Access and Remote Access.
     4.   Then click OK to save the new settings.
   g)   Under "Launch and Activation Permission", click Customize-> Edit. The "Launch and Activation Permission" dialog is displayed with the tab "Security Limits". Now proceed as follows to create and set up the new user account. This account must be the same account as in the previous step:
     1.   Click Add, and create a new account.
     2.   Under "Group or user names", select the added user account.
     3.   Under "Permissions for ...", select the check boxes Local Launch, Remote Launch, Local Activation and Remote Activation.
     4.   Then click OK to save the new settings.
   h)   In the dialog "vsrve Properties", click OK. The vsrv settings are now saved and the "Component Services" dialog is displayed again.
 4.   Now, restart the computer to activate the user that has just been created.

Error correction  
For correcting DCOM security problems, you can switch on the DCOM fault correction to get specific information on the exact DCOM error that has occurred. Further information on DCOM logging can also be found in the Microsoft Knowledge Base article http://support.microsoft.com/kb/892500 . ActivationFailureLoggingLevel and CallFailureLoggingLevel are two registration keys that can be added using the Registry Hive Editor to resolve DCOM security problems. Further information on how to activate these keys can be found in the aforementioned Microsoft KB article.

6.9.3.2.3  
Editing UAC settings on computer B 
If computer B does not belong to any domain, additional considerations come into play. In Windows Server 2008 Variants and especially Windows Vista or later, UAC has an effect on connections for user accounts without domains.
If you set up a connection to a decentralized computer through a user account that does not belong to any domain, but which is present in the local administrator group of the decentralized computer, then you must explicitly grant that account the rights for decentralized DCOM access, activation and startup.
Further information on this can be found in the Microsoft Knowledge Base article
http://support.microsoft.com/kb/951016 .
In addition, you must disable the decentralized UAC restrictions, since the user would otherwise get access rejection errors if he or she is working with HiPath 3000 Manager E and using the dialog to set up a decentralized connection to a DB Feature Server.

Deactivating the decentralized UAC restrictions  
Proceed as below to deactivate the decentralized UAC restrictions on computer B:
 1.   Start the tool regedit.exe:
   a)   Click Start -> Run. The input prompt "Run" is displayed.
   b)   In the field "Open:", enter the following: regedit.
   c)   Click OK. The tool regedit.exe now starts and the dialog "Registry Editor" is displayed.
 2.   Navigate down in the tree view to HKEY_LOCAL_MACHINE -> SOFTWARE: -> Microsoft -> Windows -> CurrentVersion -> Policies -> System, till the branch System is displayed as selected. The registry entries of the branch "System" are displayed.
 3.   If the registry entry LocalAccountTokenFilterPolicy is not present, proceed as follows:
   a)   Click Edit -> New -> DWORD Value.
   b)   Input LocalAccountTokenFilterPolicy and then on the keyboard, press the ENTER key. The registry entry LocalAccountTokenFilterPolicy is now generated.
 4.   Right-click LocalAccountTokenFilterPolicy and then in the context menu, click Modify.
 5.   In the data field "Value", input the number 1 and then click OK.
 6.   Close the registry editor.
 7.   Then restart the decentralized computer to activate the new setting.

6.9.3.3  
Other considerations 
Hipath 3000 Manager E uses functions that set up a connection to the registry and to the Service Manager of the decentralized computer.

Error correction  
During the error correction, the user can check whether he or she can access the services. To do so, he or she can use the tool integrated in Windows to decentrally set up a connection to the Windows Registry (regedit) or to the Service Manager. This is performed via the options Administration Tool -> Computer Management. If the user cannot set up a connection using this tool with the existing user authorization, the problem is most probably in the configuration of the access rights.

Stopping the DB Feature Service if TAPI 170 is installed.  
To stop the DB Feature Server Service when TAPI 170 is installed, right-click on the icon DB Feature Server in the taskbar. Then double-click Stop Service.

HiPath 3000/5000 V9, Service Documentation, Issue 7   up Top
Disclaimer & Copyright   ID: P31003H3590S100017620   2012-06-25