Default Novell Login mode for Windows 2008 R2 servers?

Question

We're using Novell Client 2 SP3 for Windows 7 (IR6).
All our Windows 7 workstations behave so that the Novell Logon is always the default (ie: you do CTRL-ALT-DEL and always get the Novell Logon first), then of course you get logged into ZCM and then our MS AD environment.
However, using the SAME client with the SAME settings (unattend.txt or whatever) on a Windows 2008 R2 server with Citrix OR TS enabled, yields different results.
Sometimes you get just the Windows logon (and then of course, you're not logged into eDirectory), sometimes you get the Novell one first.
Any ideas on what setting to check?
On 4.951 SP5 there was Gina chaining, but Windows7/2008 use credential provider order (I think), but I have no idea why it would behave differently.
Thanks!

Answer 1

Originally Posted by Alan Adams
kjhurni <[email protected]> wrote:
> So we tested on a non-Citrix server (but it still has Terminal Services
> enabled).
>
> It seems if someone goes in via the console (vmware or rdp) and does a
> "workstation only" login (I should say specifically where you pick the
> option to NOT use the Novell Client), that's where the issue arises.
>
> So is there a Novell Client setting to use to always make it use the
> Client? (I thought I had that set already)
> Or is this a Terminal Server issue and we need to look somewhere in MS
> land?
I'm not clear exactly on what you're seeing, but it sounds like you're
describing going to the interactive console login process and picking
"a completely non-Novell Client-related credential".
Meaning once you have selected the credential and can see the username
and the password field you need to enter the password in to, there is
NEITHER a "Novell Logon" nor "Computer Only Logon" link offered on
that credential, because that credential isn't one generated by Novell
Client / NCCredProvider at all.
I agree, if that's what you mean, that it sound like the kind of
process we were suspecting could be occurring, where Windows now
defaults to "the last credential provider you used" and that's NOT
Novell Client because some other credential was selected and used
during the previous login.
Normally, simply having "Novell Login = ON" does cause "Novell Client
to be the only credential provider available", but that statement
really only holds true on a "standard Windows machine" where only the
Microsoft-supplied in-box credential providers are present.
The way Novell Client achieves this is to actually "filter out" a
couple of the Microsoft in-box credential providers, so that instead
of seeing "both the Microsoft-generated credential tiles and the
Novell Client NCCredProvider-generated credential tiles as ones you
can choose from", by filtering out the Microsoft credential providers
you end up seeing only NCCredProvider-generated credentials.
Meaning, instead of getting a Windows-only credential tile generated
by Microsoft's in-box "PasswordProvider" credential provider
(AUTHUI.DLL) /AND/ the Novell Client NCCredProvider-generated
credential tiles, you instead only get the NCCredProvider-generated
tiles, and if you want to login Windows-only you have to select
"Computer Only Logon" from the NCCredProvider-generated credential.
But the behavior you're seeing, and a behavior not uncommon with
third-party credential providers, is that some other product wanted to
extend the functionality of Microsoft's in-box "PasswordProvider"
credential provider. So this third-party /also/ filters Microsoft's
"PasswordProvider" credential provider out (just like NCCredProvider
does), but then internally the third-party "wraps" the Microsoft
"PasswordProvider" credential provider in order to present "99% normal
PasswordProvider behavior, but with 1% of new third-party-specific
behavior."
Which means, from a Windows perspective, these credentials are now
being created by the third-party "wrapper", not the Microsoft
"PasswordProvider" credential provider directly. So even though
Novell Client filtered "PasswordProvider" out, there is this new
unique third-party wrapper's credential tiles still being shown, which
just happen to "look at feel just like PasswordProvider but with 1% of
additional third-party-specific functionality."
From your perspective, it simply looks like "Novell Client never
disabled Microsoft's PasswordProvider", which in actuality we have
filtered it out, but some other third-party is "making their own
instances of Microsoft's PasswordProvider credentials." Since the
credentials are no longer being created by a credential provider which
has Microsoft's well-known GUID for the "PasswordProvider" credential
provider, filtering out that GUID no longer stops the credentials from
"appearing anyway".
One option is to add the GUID of the third-party wrapper (whomever
that is) to the Novell Client's "FilterList" value under
[HKEY_LOCAL_MACHINE\Software\Novell\Authentication\ NCCredProvider].
This is where the Microsoft "PasswordProvider" GUID is already listed,
and you would just add the additional GUID(s) to this REG_MULTI_SZ
list value.
Maybe the third-party has some additional functionality or utility
knowledge that they learn by wrapping Microsoft's credential provider,
but in your case you are wanting to select the NCCredProvider-based
credential anyway, so you're not going to be selecting the
third-party's "wrapped" Microsoft PasswordProvider credential. And
the fact that the third-party's "extra" credential tiles are being
offered and can be "accidentally" selected is breaking your desired
default behavior of "always send the end-users to NCCredProvider."
If it's not clear what credential provider / wrapper on the system may
be doing this, export
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential
Providers] to a .REG file and then just cut-n-paste the .REG file text
contents into a post here.
Alan Adams
Novell Client CPR Group
[email protected]
Novell, Inc.
www.novell.com
Thanks Alan,
In this case it seems simply putting the Novell Client on a Windows server with Terminal Services enabled is enough to cause the issue.
On an actual server login (ie: Vmware console) you press CTRL-ALT-DEL
You see the Novell Login section (this is server 2012 R2, BTW) with the userid/password
2 lines below it it says:
Computer Only Logon
If you choose Computer Only Logon
Then it "stays" at Computer Only Logon for all subsequent logons/reboots.
I'm going to guess it's probably a Windows setting (we only have a few GPO settings pushed out to servers via AD).
Anyway, here's the reg key contents:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{1b283861-754f-4022-ad47-a5eaaa618894}]
@="Smartcard Reader Selection Provider"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{1D7BE727-4560-4adf-9ED8-5EEC78C6ECFF}]
@="CtxKerbProvider"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{1ee7337f-85ac-45e2-a23c-37c753209769}]
@="Smartcard WinRT Provider"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{2135f72a-90b5-4ed3-a7f1-8bb705ac276a}]
@="PicturePasswordLogonProvider"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{25CBB996-92ED-457e-B28C-4774084BD562}]
@="GenericProvider"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{3dd6bec0-8193-4ffe-ae25-e08e39ea4063}]
@="NPProvider"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{600e7adb-da3e-41a4-9225-3c0399e88c0c}]
@="CngCredUICredentialProvider"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{60b78e88-ead8-445c-9cfd-0b87f74ea6cd}]
@="PasswordProvider"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{60b78e88-ead8-445c-9cfd-0b87f74ea6cd}\LogonPasswordReset]
@="{8841d728-1a76-4682-bb6f-a9ea53b4b3ba}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{8FD7E19C-3BF7-489B-A72C-846AB3678C96}]
@="Smartcard Credential Provider"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{94596c7e-3744-41ce-893e-bbf09122f76a}]
@="Smartcard Pin Provider"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{cb82ea12-9f71-446d-89e1-8d0924e1256e}]
@="PINLogonProvider"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{e74e57b0-6c6d-44d5-9cda-fb2df5ed7435}]
@="CertCredProvider"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{F8A0B131-5F68-486c-8040-7E8FC3C85BB6}]
@="WLIDCredentialProvider"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Authentication\Credential Providers\{f9cf286d-a029-41f9-86f6-90acf0618aa4}]
@="NcCredProvider"
Hope this helps.