How to stop PXE asking for password on Altiris eXpress folder

We had this issue quite some time ago when I first started at new job around 3′ish years ago, Altiris has changed version and even companies in that time; a reference anyways :)

PXE is asking for a password for the eXpress folder

Problem

PXE is displaying the error…

“Initializing TCP/IP MS DOS TCP/IP 1.0a
The command completed successfully
The password is invalid for serverexpress
Type the password for serverexpress”

Cause
Windows Server 2003, when promoted to a domain controller, will require SMB signing, which requires the client to connect using this mechanism. Because DOS does not support SMB signing, the client will fail to connect in a Windows Domain. An “Access Denied” message appears after being prompted for the password when mapping the drive.

Resolution
The only way to have the eXpress share on a Windows 2003 DC from DOS is to not require the Security of SMB signing. However, this can open up the computer to “man in the middle” attacks. Because there is no other way to resolve this, do not install the Client Access Point on a Windows 2003 Server Domain Controller.

Change the setting in the registry by going to “HKLM_LOCAL_MACHINESystemCurrentControlSetServicesLanManServerParametersEnableSecuritySignature” and setting the value to 0.

This will disable SMB signing requirement. If the client uses SMB signing and the server is enabled, then it will use it. This setting just doesn’t require it, thus allowing non-SMB signed clients to connect (e.g., Microsoft Windows 95, 98, and NT4 pre-SP3).

Then in regedit set the permissions of the Perameters key for “SYSTEM” so that in the special permissions it cannot Change Value. If this is not done Windows 2003 server will set the value to 1 on reboot, and the problem will occur again.

    Did you enjoy this post? Why not leave a comment below and continue the conversation, or subscribe to my feed and get articles like this delivered automatically to your feed reader.

    Comments

    [...] Windows 2003 DC from DOS is to not require the Security of SMB signing. However…….. Read more Easy Rad Articles —————– Topics of interest easyreadarticles easy read easy read articles technical [...]

    Leave a comment

    (required)

    (required)


    *