Windows Networking, help me understand.

[Vurbal]

Hmmm...one minor complication...I need a Windows Server flavored OS to create a domain.  So I need to make a new machine?  Or run one on a VM?

-superboyac (October 15, 2013, 08:59 PM)

Well it you're just testing a VM is never (okay rarely) a bad idea.

Something else worth thinking about, assuming you're not planning to run any software or services that plugin to Active Directory anyway, is skipping the Windows domain and going with some type of Linux server and OpenLDAP. Active Directory is (mostly) just the Microsoft implementation of LDAP (Lightweight Directory Access Protocol) although it is admittedly the simplest in terms of just plugging things in (users, computers, email software, etc,...) and just having them work with little or no effort.

If you really wanted to you could even setup an OpenLDAP server on Windows though there aren't many situations where that makes a lot of sense if you're installing it to a machine running Windows Server. Regardless of how much I badmouth MS and Windows, if not for some particulars of my network like the antique server (dual PIII 900MHz) and a home version of Windows on my primary desktop I'd use my copy of Server 2003 SBS to setup an AD domain without any hesitation.

[Stoic Joker]

Hmmm...one minor complication...I need a Windows Server flavored OS to create a domain.  So I need to make a new machine?  Or run one on a VM?

-superboyac (October 15, 2013, 08:59 PM)

Yes and no. The Hyper-V host machine should never be a member of the domain it's hosting. This is because it should be a dedicated (to Hyper-V hosting) box (e.g. no AD), and therefore it can't login and authenticate to a domain controller that isn't running yet. So you either run the Hyper-V server(s) in a workgroup, or (if you need to use high-end stuff like Live Migration) in a separate domain.

I currently have 3 physical servers in the rack at the office. The two Hyper-V servers are in a completely separate domain from the production systems, and authenticate to a DC that runs as a VM on the third server which is basically an orphan. The production systems consist of 20 virtual servers for load balancing and redundancy and are spread across the two physical servers.

Having the DC start first is easy enough if the usual trifecta (AD, DNS, DHCP) is the only thing running on the VM, and the other systems are set to wait a minute or two before booting.

Your desire for ultra flexible drive usage may complicate this a bit as added/removed drives would need to sort out which system (physical/virtual/both) they were going to be accessible to.

Or run two DCs, one physical on cheapo hardware to allow the main host system (and guests) to boot cleanly, and one virtual to keep the domain intact in case the budget physical box decides to grenade some day down the road.

Warning: Virtualization is highly addictive!!

[Vurbal]

Hmmm...one minor complication...I need a Windows Server flavored OS to create a domain.  So I need to make a new machine?  Or run one on a VM?

-superboyac (October 15, 2013, 08:59 PM)

Yes and no. The Hyper-V host machine should never be a member of the domain it's hosting. This is because it should be a dedicated (to Hyper-V hosting) box (e.g. no AD), and therefore it can't login and authenticate to a domain controller that isn't running yet. So you either run the Hyper-V server(s) in a workgroup, or (if you need to use high-end stuff like Live Migration) in a separate domain.

I currently have 3 physical servers in the rack at the office. The two Hyper-V servers are in a completely separate domain from the production systems, and authenticate to a DC that runs as a VM on the third server which is basically an orphan. The production systems consist of 20 virtual servers for load balancing and redundancy and are spread across the two physical servers.

Having the DC start first is easy enough if the usual trifecta (AD, DNS, DHCP) is the only thing running on the VM, and the other systems are set to wait a minute or two before booting.

Your desire for ultra flexible drive usage may complicate this a bit as added/removed drives would need to sort out which system (physical/virtual/both) they were going to be accessible to.

Or run two DCs, one physical on cheapo hardware to allow the main host system (and guests) to boot cleanly, and one virtual to keep the domain intact in case the budget physical box decides to grenade some day down the road.

Warning: Virtualization is highly addictive!!

-Stoic Joker (October 15, 2013, 11:14 PM)

I highly recommend the 2 DC setup whenever possible. If a Windows workstation can't reach it's domain controller at the wrong time it can cause all kinds of headaches.

Also I'll second the addictiveness of VMs. As long as you have the horsepower to run them they can simplify so many things. The more functions you're serving from a single server box, the more they simplify your life - but only after all the time you spend experimenting with them.

[x16wda]

Or run two DCs, one physical on cheapo hardware

-Stoic Joker (October 15, 2013, 11:14 PM)

+1 on that... a DC by itself isn't that heavy a hitter, an old desktop machine should handle it fine in most cases. Just don't put other stuff on the DC (which I always recommend against anyway) and it's quick to spin up a replacement if you need it.

[40hz]

^Indeed.

Even a 900mhz relic will work just fine for a DC if that's all it's for. With the advent of 64-bit only for WS that's probably not a real option anymore. But suffice to say a fairly low-end machine is all you really need for DC in a small network.

Since the HD is the most likely point of failure, keeping a fairly up to date image handy on an external drive makes replacing said HD an absolute half-hour breeze job.

(Note: I'm primarily talking home or really small SOHO use here. Biz or bigger - go the VM route as discussed above.)

[J-Mac]

This thread started out as very interesting to me... Then you folks all apparently switched to another language and lost me.  

It all used to be so damn easy. Now I cannot get files to share at all - with two Windows 7 machines. I know damn well that on the previous OS's I could access everything on the other computers in the house. No more. I can access files on my main computer from my wife's, but not the other way around. It's not too bad now that I am down to only two running boxes here. But when I had five it was murder.

Being disabled it ain't easy to find out why my wife is complaining about not being able to find this or that file, or recovering her emails when she unexpectedly lost them. Not when our main boxes are upstairs in our office and I am downstairs on a laptop! Getting up and down is definitely doable for me - but pretty painful. Now we're both on Windows 7 and access is gone. I have been through about every networking article I can find online without success. And I see a LOT of others with similar complaints posting out there too, so I don’t think it's just a problem here. Microsoft has to know that there are a lot of users who are running a simple home network who don’t need all the crap you guys are discussing. (At least I think you are - you all could be talking about space travel for all I can decipher of most of this thread!!   )

I know I have had this discussion here before - maybe a year of two ago - and I think the simplest suggestion was to use TeamViewer for file access. Can't remember why I abandoned that one; I know I tried it but didn't have the best results with it. I had a subscription to Go To My PC for a few years but that really just allowed me to access my main computer from others. Doesn’t work the other way around IIRC.

Anyway, thanks for the discussion!  

Jim

[40hz]

@Jim:

I'm sure the hive mind here at DoCo can get you sorted if you give us some additional info:

1. What are you using for a home router?

2. What are the router's network and wireless settings (excluding any passwords)?

3. On each machine, -

• what specific flavor of Win 7 are you running?
• are you set up for a workgroup or homegroup?
• what are the network settings for your wireless card or NIC
• what are you using for security software? Is it one of those suites or just an anti-malware package?
• are you running a firewall other than the one built into Windows

 

[Stoic Joker]

^4. Do all of the user accounts used have passwords? (blank passwords cause a silent fail for share connections after XP SP2)

[superboyac]

^4. Do all of the user accounts used have passwords? (blank passwords cause a silent fail for share connections after XP SP2)

-Stoic Joker (October 18, 2013, 03:12 PM)

Oh!  This is interesting.  I think I use blank passwords for one of the machines.  Maybe that's the problem.

[techidave]

there is a setting if your using the Pro version of XP to allow blank passwords.  I usually use gpedit to set this.  let me see if I can find the path for it.

[techidave]

Computer Configuration>Windows Setting>Security Settings>Local Policy>Security Options>Accounts: Limit local account use of blank passwords to console logon only.  It is set to "Enable" by default.  change it to disable.

Here is the explanation by Microsoft of this setting:

Accounts: Limit local account use of blank passwords to console logon only

This security setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If enabled, local accounts that are not password protected will only be able to log on at the computer's keyboard.

Default: Enabled.


Warning:

Computers that are not in physically secure locations should always enforce strong password policies for all local user accounts. Otherwise, anyone with physical access to the computer can log on by using a user account that does not have a password. This is especially important for portable computers.

[J-Mac]

@Jim:

I'm sure the hive mind here at DoCo can get you sorted if you give us some additional info:

1. What are you using for a home router?

-40hz (October 18, 2013, 02:38 PM)

ASUS NT-R16

2. What are the router's network and wireless settings (excluding any passwords)?

There are several pages of them. Do you need all or just specific settings?

3. On each machine, -

• what specific flavor of Win 7 are you running?
• are you set up for a workgroup or homegroup?
• what are the network settings for your wireless card or NIC
• what are you using for security software? Is it one of those suites or just an anti-malware package?
• are you running a firewall other than the one built into Windows

Windows 7 Professional (My computer) and Windows 7 Home Premium (Wife's computer)
Both setup for Workgroup
Both hardwire-connected to router
Security software on both machines:
Anti-Virus = Norton AntiVirus 2013 (Standalone AV - no suites)
My computer also has Malwarebytes Pro, while my wife's has Malwarebytes Free version.
Network settings for NIC:

*** What all do you need here? The Properties box for the NIC on each machine? Status box?

Thanks!

Jim

[4wd]

@Jim:

I'm sure the hive mind here at DoCo can get you sorted if you give us some additional info:

1. What are you using for a home router?

-40hz (October 18, 2013, 02:38 PM)

ASUS NT-R16

-J-Mac (October 20, 2013, 11:28 PM)

Same as mine, what firmware are you running, (Tomato 1.28 by Shibby here) ?

I don't have any problems with shares across the network between Win7, XP, WHS2011, and WDTV Live.

Here's my basic WAN, LAN, WLAN settings for comparison:
Windows Networking, help me understand.Windows Networking, help me understand.Windows Networking, help me understand.

It might pay to also reset to factory defaults and re-enter all info - I had a problem with mine recently, (power outage), that caused it to start dropping the connection every few hours.  So possibly some info in the NVRAM got corrupted - factory reset with NVRAM wipe restored normal operation.

But I'm more inclined to think a problem with shares will come down to either AV/FW or network settings on the computers.

[mwb1100]

I'm assuming that you're not using a domain controller; so, one thing to check is the accounts and passwords for each machine.  If you and your wife each use separate user accounts, then they have to be set up on both machines and have to have the same password on each machine.  And as mentioned by Stoic Joker above, blank passwords can cause problems with Windows networking.

[J-Mac]

We do have separate user accounts, none with blank passwords. However I do have both configured for auto-login so the passwords for each of our users do not have to enter the passwords every time.

No, I don’t have users setup on each machine for each of us. That was never a requirement on past OS's. Something new on Windows 7?

I have the ASUS stock firmware on my router. I haven't updated it yet. I was told in the past by ASUS Support - when I was planning to update firmware on an ASUS motherboard based on someone's suggestion - that I should never update their firmware unless I was having a specific problem and the newer firmware is supposed to address that problem. (True? Good advice?)

I haven't changed the firmware to Tomato or DD-WRT. Why not? Because I don’t know much at all about it and all help/instructions/tutorials I have reviewed did not seem to be addressed to the "uninitiated". So not being knowledgeable and not really having any specific firmware problems, I figured why screw with it. I know it is supposed to give me more options and more control, etc., but then again I have read a lot of sad posts from folks whose attempt to update to those firmwares failed - and they don’t seem to receive a whole lot of support getting things running again. They usually get told that if they didn't know what they were doing then they shouldn’t have tried updating. Sounded like pretty good advice to me!

My router settings have a lot more screens to show the same info as yours, 4wd. I can post screen caps of all if necessary though.

Thanks!

Jim

[mwb1100]

No, I don’t have users setup on each machine for each of us. That was never a requirement on past OS's. Something new on Windows 7?

-J-Mac (October 21, 2013, 10:24 AM)

Are different user IDs being used on the different machines?  If so, then to network those user IDs may need to be on each machine (with the same password).

If you're using the same user ID on both machines, then the password should be the same on both machines.

When connecting to a non-domain machine, Windows will essentially logon to the remote machine using the user ID and password of the current account for many operations. 

When connecting to a remote share you do have the option to use alternate credentials (at least with some of the UIs - I'm not sure if "easy networking" provides the capability).  You might want to clear out any saved network connections in case they have cached an old set of credentials that aren't valid any more.

I think if you're having trouble, one decent troubleshooting step is to set up the machines so they have the same account IDs and passwords. It just makes it so there's one less area for Windows to trip up on.

[Stoic Joker]

No, I don’t have users setup on each machine for each of us. That was never a requirement on past OS's. Something new on Windows 7?

-J-Mac (October 21, 2013, 10:24 AM)

That has always* been the (incredibly annoying) case for workgroup file sharing for the reasons given by mwb1100 above. Only alternative would be to go the Home Group route which allows machines to pre-authenticate via group membership.

*By always I mean NT4 and up, since Win9x was a DOS not a NOS and therefore doesn't count.

[40hz]

No, I don’t have users setup on each machine for each of us. That was never a requirement on past OS's. Something new on Windows 7?

-J-Mac (October 21, 2013, 10:24 AM)

That has always* been the (incredibly annoying) case for workgroup file sharing for the reasons given by mwb1100 above. Only alternative would be to go the Home Group route which allows machines to pre-authenticate via group membership.

*By always I mean NT4 and up, since Win9x was a DOS not a NOS and therefore doesn't count.

-Stoic Joker (October 21, 2013, 11:29 AM)

Oh. Ok. I didn't realize that was the case. So rather than ditz witj my lengthy list of questions, why not just set up identical logins for you and your wife on both machines and see if that cures the problem. I'm very sure it will.
 

[J-Mac]

No, I don’t have users setup on each machine for each of us. That was never a requirement on past OS's. Something new on Windows 7?

-J-Mac (October 21, 2013, 10:24 AM)

That has always* been the (incredibly annoying) case for workgroup file sharing for the reasons given by mwb1100 above. Only alternative would be to go the Home Group route which allows machines to pre-authenticate via group membership.

*By always I mean NT4 and up, since Win9x was a DOS not a NOS and therefore doesn't count.

-Stoic Joker (October 21, 2013, 11:29 AM)

I hear what you're saying.... but before I had these two computers I had five XP machines in my house, and I could access ALL files from any one of the others. And I did not have the same user ID and password on more than one. Did it like that for a few years. So I don’t know why there's a discrepancy between what you say has always been the case and what I was doing!

Jim

[J-Mac]

No, I don’t have users setup on each machine for each of us. That was never a requirement on past OS's. Something new on Windows 7?

-J-Mac (October 21, 2013, 10:24 AM)

That has always* been the (incredibly annoying) case for workgroup file sharing for the reasons given by mwb1100 above. Only alternative would be to go the Home Group route which allows machines to pre-authenticate via group membership.

*By always I mean NT4 and up, since Win9x was a DOS not a NOS and therefore doesn't count.

-Stoic Joker (October 21, 2013, 11:29 AM)

Oh. Ok. I didn't realize that was the case. So rather than ditz witj my lengthy list of questions, why not just set up identical logins for you and your wife on both machines and see if that cures the problem. I'm very sure it will.
 

-40hz (October 21, 2013, 12:09 PM)

Planning to do that tonight when I get back upstairs.   

Jim

[Stoic Joker]

I had these two computers I had five XP machines in my house, and I could access ALL files from any one of the others. And I did not have the same user ID and password on more than one. Did it like that for a few years. So I don’t know why there's a discrepancy between what you say has always been the case and what I was doing!

-J-Mac (October 21, 2013, 12:43 PM)

Probably got lucky with the OOB default of having Simple File Sharing enabled, which shares everything with everyone IIRC. Closest thing to that in 7 is a HomeGroup.

...But if I say HomeGroup one more time I think 40hz is going to shoot me.

[J-Mac]

If you say it one more time I might shoot you!

Naturally Windows 7 defaults to that when you first set up a network. I guess it isn't bad for a lot of folks who don’t have many needs, but it is very limiting, at least for me. I hate HomeGroup!

Thanks!

Jim

[Vurbal]

Probably got lucky with the OOB default of having Simple File Sharing enabled, which shares everything with everyone IIRC.

-Stoic Joker (October 21, 2013, 03:34 PM)

Like I said, simple = simpleton.

Closest thing to that in 7 is a HomeGroup.

...But if I say HomeGroup one more time I think 40hz is going to shoot me.

I won't shoot you but I may chip in for ammo.   

[4wd]

I have the ASUS stock firmware on my router. I haven't updated it yet. I was told in the past by ASUS Support - when I was planning to update firmware on an ASUS motherboard based on someone's suggestion - that I should never update their firmware unless I was having a specific problem and the newer firmware is supposed to address that problem. (True? Good advice?)

-J-Mac (October 21, 2013, 10:24 AM)

Generally, if you're happy with the stock and there's no problems with it or you don't need the features an alternate provides, (Tomato, DD-WRT, etc), then just leave it as it is.

The RT-N16 can usually be recovered from a failed firmware update without a drama by putting it into recovery mode and then running the Asus Firmware Restoration Utility.

[Stoic Joker]

If you say it one more time I might shoot you!

-J-Mac (October 21, 2013, 11:40 PM)

I won't shoot you but I may chip in for ammo.

-Vurbal (October 22, 2013, 04:21 AM)

There's just so much love in the room..