Use the Configure TCP/IP (CFGTCP) command to check and/or modify interfaces, routes, set up host table and domain name services, and so on.

Transcription

1 AS/400 Net Server Configuration Information From IBM For Additional Information: For Configuration Assistance: Contact IBM Support IBM Support Line Technical Document Document Number: Document Title: Getting Started with AS/400 NetServer Document Description: The IBM AS/400 Support for Windows Network Neighborhood (AS/400NetServer) allows personal computers running Windows 95/98/ME, Windows NT/2000/XP, and Windows for Workgroups software to seamlessly access data and printers managed by the AS/400e or iseries 400 system. This support does not require any additional software to be loaded on the personal computer. It takes advantage of the native file and print sharing protocol delivered with Windows 95/98/ME, Windows NT/2000/XP, or Windows for Workgroups software. It does not require any software on the AS/400e or iseries 400 system other than the OS/400 operating system including the Host Servers option; however, it is recommended that the Client Access for Windows 95/NT V3R1M3 (or greater) client be installed on a PC so that the Operations Navigator can be used to configure the AS/400 NetServer. The prerequisites for this support are the that the AS/400e or iseries 400 system and the personal computer be configured with TCP/IP and that the file sharing protocol on the personal computer be configured to use TCP/IP. Any data available through the OS/400 integrated file system (including stream files and CD-ROM) and any output queues on the AS/400 system can be shared with the network by the AS/400 system administrator. Starting at R510, NetServer can be configured to act as a Logon server/master Browser on your network. For more information regarding this please look and (Document link: Database 'Rochester Support Line KnowledgeBase', View '1.0 DBManagement View\All\Software', Document 'iseries Netserver Logon Support'). If you just want to have the iseries be the master browser on the network you just would have to change the Logon Server Role ( on the General tab for the NetServer properties) to Server. Nothing further has to be done. Note: Setting up the NetServer to be the master browser may conflict with an existing Master Browser on your network, which has been seen to cause a CPIB687 RC4 when starting NetServer. TCP/IP Support: Verify that TCP/IP support has been configured on your AS/400e or iseries 400 system. You must have at least one external TCP/IP interface configured and active to use the AS/400 NetServer. Use the Configure TCP/IP (CFGTCP) command to check and/or modify interfaces, routes, set up host table and domain name services, and so on. Once the configuration is complete, use the Start TCP/IP (STRTCP) command to activate the support. QSERVER Subsystem: The QSERVER subsystem should be started automatically. Confirm that it is started using the Work with Subsystems (WRKSBS) command. If the QSERVER subsystem is not started, use the Start Subsystem (STRSBS QSERVER) command. The AS/400 NetServer is configured with the following default values: the Server name is Q + the system name; the QCA400 directory file be shared (this is the install source for Client Access); there is no guest profile by default. AS/400 NetServer Name and Domain: Verify that the AS/400 NetServer server name is unique on the network and that the AS/400 NetServer is in the same domain (workgroup) as the majority of the clients accessing the OS/400 file 1 of 21

2 and print services. You must have *IOSYSCFG authority to modify any part of the AS/400 NetServer configuration. To change the AS/400 NetServer default server and domain name, do the following: Note: If Client Access for Windows 95/NT (V3R1M3 or greater) is not already installed on the PC, follow the instructions at the end of this document to install it on the PC. 1 Open the Operations Navigator and click the + sign next to the AS/400e or iseries 400 system. 2 Click the + sign next to Network. 3 Click the + sign next to Servers 4 Click TCP 5 Right-click on NetServer and click Properties from the pop-up menu. 6 From this interface, you can change the AS/400 NetServer name, the domain it is a part of, the text description for the server, and configure a guest user profile if desired. Note: Client Access/400 and AS/400 NetServer should not use the same name for the server. If this is done, the name is recognized by both and the first one to retrieve the name wins, leading to inconsistent results seen by the client. It is recommended that the AS/400 NetServer use a different name in the network by using Q plus the system name. For example, QAS400A would be used for the AS/400 NetServer on an AS/400e or iseries 400 system with the name AS400A. If Client Access is not used, the AS/400 NetServer name can be the same as the system name. Guest AS/400 NetServer User Profile: Guest support is needed for those AS/400 NetServer users requiring only file and print sharing support that do not have an OS/400 user profile. If this field is blank, unknown users do not have access to OS/400 resources through AS/400 NetServer. *IOSYSCFG and *SECADM authority is required to modify AS/400 NetServer guest support. Note: It is recommended that the Guest User Profile is not given a password and must have no special authorities if it is to be used exclusively for file sharing. However, because AS/400 NetServer uses the same host server jobs for Network Print that Client Access uses, a password will be required for the Guest User Profile for access to Network Printing if it is enabled. AS/400 NetServer does not automatically configure guest support. Users without OS/400 user profiles cannot access AS/400 NetServer. Starting and Ending AS/400 NetServer: Any configuration changes made to AS/400 NetServer, with the exception of share and session administration, do not take effect until the you stop and start the server again. To start the AS/400 NetServer, do the following: 1 Open the system in Operations Navigator. 2 Expand Network and Servers and TCP. 3 Right-click on NetServer and click Stop from the pop-up menu. 4 Right-click on NetServer again and click Reset and start from the pop-up menu. Determining if NetServer is running: Use the Work with Active Job (WRKACTJOB) command to verify there is a QZLSSERVER job running under the QSERVER subsystem. If the QZLSSERVER job is not active, AS/400 NetServer must be started. Using the Work with TCP/IP Network Status (NETSTAT *CNN) command, the following entries are shown. If these connections are not displayed, start AS/400 NetServer again. * * netbios > 001:27:44 Listen * * netbios > 000:00:01 *UDP * * netbios > 000:00:00 *UDP 2 of 21

3 * * netbios > 000:30:57 Listen Note: The NETSTAT command output may be many pages in length. Starting AS/400 NetServer Print Support: For AS/400 NetServer print shares to function properly, the Network Print Server (NPS) must be started. To determine the status of NPS, on the OS/400 command line type the following: WRKACTJOB SBS(QSYSWRK) JOB(QNP*) Press the Enter key. Ensure that there is a QNPSERVD job active and press F14 to include the prestart jobs. Ensure that there is also at least one QNPSERVS job in a PSRW state. If there is no QNPSERVD job, to start the NPS, on the OS/400 command line type the following: STRHOSTSVR *NETPRT Press the Enter key. If there are no QNPSERVS jobs then you must start them. On the OS/400 command line, type the following: STRPJ SBS(QSYSWRK) PGM(QIWS/QNPSERVS)) Press the Enter key. Starting at V4R4M0 with the introduction of the QUSRWRK subsystem, the Network Print Server prestart jobs running in the QUSRWRK subsystem. The QNPSERVSD job still runs in QSYSWRK To determine the status of NPS on a V4R4M0 or higher system, on the OS/400 command line type the following: WRKACTJOB SBS(QSYSWRK) JOB(QNP*) Press the Enter key. Ensure that there is a QNPSERVD job active. ( Daemon job) If there is no QNPSERVD job, to start the NPS, on the OS/400 command line type the following: STRHOSTSVR *NETPRT To check the prestart jobs for the Network Print Server, on the OS/400 command line type the following: WRKACTJOB SBS(QUSRWRK) JOB(QNP*) Press the Enter key and then press F14 to include the prestart jobs. Ensure that there is also at least one QNPSERVS job in a PSRW state. If there are no QNPSERVS jobs then you must start them. On the OS/400 command line, type the following: STRPJ SBS(QUSRWRK) PGM(QSYS/QNPSERVS)) Press the Enter key. Windows Networking Support, Windows 95: Select Settings/Control Panel/Network/Configuration from your Start button and verify that you have Client for Microsoft Networks and TCP/IP added and configured. Then, go to the Identification tab and verify that you have a unique Computer Name on the network and a valid Workgroup name configured (preferably the same one as the AS/400 NetServer). Windows Networking Support, Windows NT: Select Settings/Control Panel/Network/Identification from your Start button and verify that you have a unique Computer Name on the network and a valid Workgroup name configured (preferably the same one as the AS/400 NetServer). Then, go to the Protocols tab and verify that the CP/IP Protocol has been added and is configured properly. Check TCP/IP Support: Test the support by pinging the AS/400e or iseries 400 system from a DOS window as follows: PING AS/400-NetServer-server-name 3 of 21

4 Resolving AS/400 NetServer Name: Add an entry for the AS/400 NetServer to a Domain Name Server (DNS), the local LMHOSTS for the PC, or set up a Windows Internet Name Server (WINS) to resolve the AS/400 NetServer server name. The quickest way is to add an entry to the LMHOSTS file located in the \Windows directory on a Windows 95 PC or the \WINNT\system32\drivers\etc directory on a Windows NT PC. If you cannot find an LMHOSTS file in the specified directory, it might not have been created yet. Rename LMHOSTS.SAM in that same directory to LMHOSTS, and add a line with the following format: TCP/IP-address AS/400-NetServer-server-name For example: QNETSERVER Finding AS/400 NetServer and Shared Resources: AS/400 NetServer may also appear in the Windows Network Neighborhood; however, this depends on the network TCP/IP configuration. Find Computer is more likely to work in all environments. To display AS/400 NetServer shares, double-click on AS/400 NetServer accessed through either Find Computer or Windows Network Neighborhood. Remember that Windows Network Neighborhood is also available through Windows Explorer, so NetServer shares could also be explored. Installing Client Access/400 - Use the AS/400 NetServer to easily install Client Access/400 on your Windows 95 or Windows NT client PC. Administrating AS/400 NetServer from a PC client requires the use of Operations Navigator. AS/400 NetServer automatically shares the QCA400 directory with clients specifically for the purpose of allowing OS/400 users who already have user profiles, to install Client Access on client PCs. To install the client on a PC do the following: 1 From the Windows 95 or NT taskbar, click on Start, Find, and Computer 2 Type the name of the Server (default is Q + the system name), and press the Enter key. The Server name appears in the bottom pane of this window. 3 Double-click on the Server. A window opens showing the shared printers and directories. 4 Double-click on the QCA400 folder icon. Depending on the version of explorer and how it is configured, either a new window opened or the contents of the existing window were changed to reflect the contents of the QCA400 directory. 5 Double-click on the Win32 folder icon. 6 Right-click on the Install folder and click on the Find option from the pop-up menu. 7 Type SETUP.EXE in the input box. Ensure the Include subfolders checkbox is checked, and press the Enter key. Explorer displays the Setup program in the bottom pane. 8 Double-click on the Setup icon to begin the installation. Follow the instructions in the installation wizard and consult the setup manual if you have questions about the installation. 4 of 21

5 IBM Support Line Technical Document Document Number: Document Title: Configuring the iseries Netserver to act as the Domain Master Browser Document Description: The only iseries Netserver configuration required in order for the R510 Netserver to act as a Master Browser is to enable the logon server role. To do so, access iseries Netserver Properties and change the logon server role property from None to Server. Once logon server has been enabled, it will take effect the next time the iseries NetServer is started. Prior to ending and restarting iseries Netserver to enable logon server, the ability to act as a Master Browser (MB) should be disabled on every PC in the local network segment to ensure that iseries NetServer will not conflict with an existing MB. Also, there should not be a Primary Domain Controller (PDC) servicing the domain anywhere in the network since that is the role that iseries NetServer will take. Every TCP/IP subnet with servers, which is sharing network resources, needs to have a segment MB for each domain being serviced. When iseries Netserver is configured for logon support it attempts to be the Domain MB (DMB) which is a special MB role performed by the Primary Domain Controller (PDC). It supposedly holds the master list for the domain. By definition, it is also the MB for the local network segment (and domain) that it is in. No other PC can be acting as the DMB when Netserver starts. If a DMB is already active when iseries Netserver starts and does not relinquish this role through an election, then iseries Netserver will fail to register as the DMB. If the other PCs are in a separate subnet, they should not be disabled for being a browser, because they must be capable of browsing their own local network segments in order to report their lists of computers to the DMB (if they can find it). If the PCs are in different subnets, then they should be configured for the same WINS Server as the iseries 400. If WINS is not being used, then maintaining consistent browse lists becomes more difficult because each segment MB must have an alternate means of locating the DMB and providing it with its local browse list. When the iseries Netserver is restarted, it will register itself as the DMB. If the iseries Netserver is unable to register as the DMB, it will generate a message CPIB687 in the QSYSOPR message queue, which says that AS/400 Support for Windows Network Neighborhood started, but an error was encountered. The reason code displayed in the details of the message will be RC2 which states that A Logon Server or Domain Master Browser service already running on xxxxxx conflicts with the AS/400 NetServer (where xxxxxx is the name of the DMB that is already active). This can be confirmed by running the following command from a PC command prompt: nbtstat -a qrchasslh <ENTER> (where qrchasslh is the Netserver name). If the iseries Netserver registered as a MB it will return something similar to the following: Local Area Connection: Node IpAddress: [ ] Scope Id: [] NetBIOS Remote Machine Name Table Name Type Status NETSERVERDOMAIN<1B> UNIQUE NETSERVERDOMAIN<1E> GROUP NETSERVERDOMAIN<1C> GROUP.. MSBROWSE.<01> GROUP NETSERVERDOMAIN<1D> UNIQUE Registered Registered Registered Registered Registered Registered NETSERVERDOMAIN<00> GROUP QRCHASSLH <00> UNIQUE Registered QRCHASSLH <20> UNIQUE Registered MAC Address = A-03-7A-E6 5 of 21

6 If NetServer is configured as a logon server, but is unable to register as the DMB, the <1B> or <1D> names will be missing. The NBTSTAT -a will return something similar to the following: Local Area Connection: Node IpAddress: [ ] Scope Id: [] NetBIOS Remote Machine Name Table Name Type Status MSBROWSE.<01> GROUP Registered CS2LAB <1B> UNIQUE Registered CS2LAB <1C> GROUP Registered CS2LAB <1E> GROUP Registered CS2LAB <00> GROUP Registered QRCHASSLH <00> UNIQUE Registered QRCHASSLH <20> UNIQUE Registered MAC Address = A-03-7A-E6 6 of 21

7 IBM Support Line Technical Document Document Number: Document Title: AS/400 NetServer Security Document Description: The following outlines security considerations, which should be reviewed when administering the AS/400 NetServer. Proper configuration and authorities help ensure that no security exposures exist using the AS/400 NetServer. AS/400 NetServer follows the OS/400 security model. Therefore, all user rights and permission that are applicable to OS/400 are also applicable to the AS/400 NetServer. Therefore, OS/400 object authorities should always be implemented as a first step and is always the preferred method of ensuring adequate security. Note: *IOSYSCFG special authority is required to configure AS/400 NetServer. *SECADM special authority is required to configure GUEST profile support. User Logon Authentication for AS/400 NetServer is based on the profile and password used in the Windows desktop logon. If the client Login ID matches the user profile on OS/400, the passwords will be checked. If they do not match, the AS/400 NetServer will prompt the client to type the correct one. However, if the profiles do not match, AS/400 NetServer will prompt the client for the correct profile/password (unless Guest support is enabled). Windows 95/98 Users: Windows 95/98 clients do not prompt for a profile but prompt only for a password. Therefore, if you log on Windows with a profile that does not exist on the AS/400e or iseries 400 system, you will not be able to sign on and access the shares unless you have Guest support enabled. Windows NT prompts for a profile and a Password and, therefore, does not have this restriction. The following table illustrates various log on scenarios that may be encountered: Profile PC Operating exists Password Guest System on Correct Enabled? Result OS/400? Windows Yes Yes Yes or No Access Granted using 95/98/ME Windows Network Login ID Windows Yes No Yes or No Password prompt received 95/98/ME Windows No N/A Yes Access granted using Guest 95/98/ME Windows No N/A No Access denied (however, 95/98/ME will prompt for password) Windows Yes Yes Yes or No Access granted using NT/2000/XP Windows Network Login ID Windows Yes No Yes Login prompt received for NT/2000/XP Password and Profile Windows No N/A No Login prompt received for NT/2000/XP Password and Profile Windows No N/A Yes Access granted using Guest NT/2000/XP of 21

8 Users may verify the user name/profile they are logged into Windows with by issuing the following from an MS DOS command prompt: Windows 95/98/ME: Net Config Windows NT/2000: Net Config Workstation Note: Windows 95/98/ME Users must log on to Windows even if a guest profile will be used for NetServer access. If the user does not log on to Windows necessary Microsoft networking functions are not loaded and the user will be unable to map a drive. Disabled Profiles AS/400 NetServer limits the number of sign on attempts that are not valid based on the system value QMAXSIGN. Due to multiple login attempts by the Windows Networking Client under the covers, it is recommended that this value be set to 5 or higher*. Once this limit has been exceeded, the profile becomes disabled for use with AS/400 NetServer. Other functions are not affected (such as system sign-on). Therefore, the profile does not become completely disabled when attempting to connect through AS/400 NetServer. If a user becomes disabled, issue the Change User Profile (CHGUSRPRF) command for that user (no additional parameters are needed). Starting the AS/400 NetServer again also resets the profile. Notes: 1 Changes to the system value QMAXSIGN do not take effect for AS/400 NetServer users until the server is started again. It is also recommended that the QMAXSIGN system value not be set to *NOMAX. 2 V5R1 has added support to reduce the frequency of profiles being disabled for NetServer use due to multiple login attempts by Windows under the covers. Refer to Rochester Support Center document number , R510 AS/400 NetServer and Disabled User Profiles, for further information. To link to knowledgebase document immediately, click here (Document link: Database 'Rochester Support Line KnowledgeBase', View 'All Documents', Document 'R510 AS/400 NetServer and Disabled User Profiles'). 3 Any user ID will be re-enabled for NetServer access any time the NetServer user cache detects a change in the user profile. For example, the user creates a new object and becomes the owner of an object, which updates the owned object list causing the last access date on the user profile to be updated. The user profile has been changed so it is re-enabled for NetServer access. GUEST Support AS/400 NetServer supports the user of GUEST (or anonymous) profiles. This enables users of Windows workstations who do not have a valid OS/400 profile to access the AS/400 NetServer shares. If GUEST is enabled and the Windows login does not match a valid profile of the iseries or AS/400e server, AS/400 NetServer logs the user in as GUEST. The GUEST profile must already exist on OS/400 and should not have any special authorities. It must be enabled and can have any name. Users are not prompted for security information if the GUEST profile is being used for them. If you want to use GUEST support with Printer shares, the GUEST profile must have a password. (The network print server requires that the profile have a password.) In addition, you may want to specify the initial menu as *SIGNOFF to prevent unauthorized access to an OS/400 command line interface. Securing Objects The AS/400 NetServer follows the OS/400 security model. If a user is not authorized to a directory that is being shared, they do not have access to that share when accessing AS/400 NetServer even if it was created as a 8 of 21

9 Read/Write share. Conversely, if they have all rights to the object/directory being shared but the share was configured as Read Only, they will have Read authority only to that resource. In this way, an administrator can have better control over objects accessed through the AS/400 NetServer. Authority is determined by the following: Is the profile authorized to the object being shared? o *ALLOBJ special authority? o Specific authority to this object? o Part of an authorization list which has authority? o Group *ALLOBJ? o Specific Group authority? o Group authority to Authorization list o *PUBLIC authority? Is the share Read only or Read/Write? Additionally, shares may be hidden by placing a $ at the end of the share name. However, even though this share is hidden, you can still connect to and use it if you know the name. The AS/400 NetServer may be hidden from the Network Neighborhood by setting the browse announcement interval to 0. This prevents it from announcing itself to the network. (You can still refer to it by name; however, it will not show up in Windows Network Neighborhood.) Profile/Password Considerations Normal OS/400 user profiles and passwords apply to the AS/400 NetServer. However, consider the following: Numeric Passwords: A profile can be created with a numeric password on OS/400 by specifying Q as the first character (for example, Q12345). The user can then login with as the password on the sign-on display. This works because OS/400 precedes the password with the letter Q. Windows does not precede the password with the letter Q; therefore, a numeric password fails. It is, therefore, recommended that passwords begin with an alphabetic character. Profile/Password Length: OS/400 profile and password lengths are limited to 10 characters for all pre-v5r1 systems or for systems where QPWDLVL is set to 0 or 1. However, Windows clients can have profiles/passwords that are greater than 10 characters. If you have a Windows profile that is greater than 10 characters, the GUEST support is adopted. If the profile is 10 characters or less (and is a valid OS/400 profile) but the password is greater than 10 characters, GUEST support is not used and you are prompted for the correct password. V5R1 systems have a Password Level (QPWDLVL) system value which enables long password support. This may cause problems for 95/98 or ME clients. This system value should be left at '0' if these clients require access to NetServer. 9 of 21

10 IBM Support Line Technical Document Document Number: Document Title: AS/400 NetServer Security Requirements for Printing Product: Operating System/400 - OS/400 PRINT/SPOOL (5769SS1SP) Release: V4R2M0; V4R3M0; V4R4M0 Document Description: General Security Requirements AS/400 NetServer allows you to access files and printers in OS/400 without any additional code on a Windows PC. Because AS/400 NetServer uses Microsoft Networking, you must log into Windows when you boot up your PC. If you do not log into Windows, Windows network printing will not work. Once you sign onto Windows, the AS/400 NetServer security checking works as shown in the following table: AS/400 and AS/400 and Windows Guest User Log on AS/400 Windows User Name Password NetServer Allowed Identical Identical No Yes Identical Different No Password Prompt Different Identical or Different No No (see Note 1) Identical Identical Yes Yes Identical Different Yes Password Prompt (see Note 2) Different Identical or Different Yes Yes, Using Guest Access (see Note 3) Notes: 1 In this situation, a password prompt appears. Windows 9x is prompting for a password only, so logon is not possible under these circumstances. Windows NT prompts for user name and password, logon is possible when providing the correct information. 2 In this situation, access is only possible with the correct OS/400 password. The guest user access is not used. 3 In this situation, only the AS/400 NetServer Guest user profile will be used, thus a matching OS/400 user ID is not needed. 10 of 21

11 Using Guest Access If you decide to use a guest access for some of your users, you can set up guest support by doing the following steps: 1 Create a user profile containing no special authorities and limited capabilities *YES. Set the initial program to *SIGNOFF and give it a password. CRTUSRPRF USRPRF(guest-user-profile) + PASSWORD(GUEST) PWDEXP(*NO) + STATUS(*ENABLED) USRCLS(*USER) + INLMNU(*SIGNOFF) LMTCPB(*YES) + SPCAUT(*NONE) MAXSTG(*NOMAX) + TEXT('Guest User Profile for AS/400 NetServer') 2 Specify the name of the user profile you created in the Next Start tab or button under the AS/400 NetServer properties. 3 Stop AS/400 NetServer by right clicking on AS/400 NetServer and selecting Stop from the screen shown below. 4 To start AS/400 NetServer, right-click on AS/400 NetServer and selecting Start from the screen shown above. 11 of 21

12 IBM Support Line Technical Document Document Number: Document Title: Accessing Netserver with a Web Browser Product: HOST SUPPORT (5722SS1HS); HOST SUPPORT (5769SS1HS) Release: V4R2M0; V4R3M0; V4R4M0; V4R5M0; V5R1M0 Document Description: The IFS can be accessed with a Web browser if NetServer is configured and active on the iseries 400. Directions for configuring NetServer can be found in the following Rochester Support Center knowledgebase documents: (Document link: Database 'Rochester Support Line KnowledgeBase', View 'All Documents', Document 'Getting Started with AS/400 NetServer') , Getting Started with AS/400 NetServer (Document link: Database 'Rochester Support Line KnowledgeBase', View 'All Documents', Document 'Creating an AS/400 NetServer File Share') , Creating an AS/400 NetServer File Share The following addresses can be used to connect to the IFS when using Microsoft Internet Explorer: FILE:\\NetserverName\ShareName (FILE is used in place of HTTP or FTP) FILE://NetserverName/ShareName \\NetserverName\ShareName \\NetserverName (this will connect to the root of the IFS) The Netscape Web browser works differently than Internet Explorer when trying to access the IFS. Netscape appears to handle this request the same way that it handles an FTP request. Netscape appears to send an anonymous user ID unless a user ID is specified in the address. The following address examples can be used to connect to the IFS when using the Netscape Web browser: FILE://UserID@NetserverName (this prompts for a password and connects to the root of the IFS) FILE://UserID@NetserverName/ShareName Notes: 1 Netscape does not appear to be able to connect to a share that has been created using the root of the IFS ( / ) as the share path. Trying to connect to a share that uses the root of the IFS as a path results in an error message that says Netscape is unable to find the file or directory. Netscape also appears to be unable to access the IFS if Netscape is configured to use a network proxy. 2 Substitute the actual NetServer Name for NetserverName and the actual share name for ShareName when using the example addresses above. 3 IBM provides no support for accessing the IFS with any Web browser. 12 of 21

13 IBM Support Line Technical Document Document Number: Document Title: Creating an AS/400 NetServer File Share Product: Operating System/400 - OS/400 BASE (5769SS100) Release: V4R2M0; V4R3M0; V4R4M0; V4R5M0 Document Description: This document will help you create a file share on the AS/400 NetServer, using Client Access Operations Navigator. For Client Access for Windows 95/NT R313, open Operations Navigator and go to the OS/400 name, Network, Servers. For Client Access for Windows 95/NT R320 or for Client Access Express, open Operations Navigator, and go to the OS/400 name, Network, Servers, TCP/IP. Double-click on AS/400 NetServer. 13 of 21

14 Right-click on Shared Objects and go to New, File. Give your new file share a name, an optional description, and set access to Read Only or Read/Write. Click the Browse button, and select the path for the new share. Click OK to return the path to the Path name field of the file share screen. Examples: Selecting the AS/400 name gives you the following path: / Selecting the directory 4remote gives you the following path: /4remote 14 of 21

15 Share name: The name that appears in Windows network neighborhood Description: A brief description of the file share. This could be the same as the directory name, the same as the user name the share is created for, the same as the department which will use the share, etc Access: Designates if the share is Read Only or Read/Write. The default is Read Only. If the share is created as Read Only, no one will be able to save data to this share Maximum Number Can be set at NOMAX or can be a designated number of of Users: users Path name: The path to the directory that the share points to. / designates the root directory. /USERDIR designates a directory called USERDIR which is on the root of the IFS Click OK, and the File Share is created. 15 of 21

16 IBM Support Line Technical Document Document Number: Document Title: Installing Client Access and Service Packs Using AS/400 NetServer Support Document Description: The IBM AS/400 Support for Windows Network Neighborhood (AS/400 NetServer) allows PCs running Windows 95, Windows 98, Windows ME, Windows NT, Windows 2000, and Windows for Workgroups software to seamlessly access data and printers managed by the AS/400e or iseries system. This support does not require any additional software to be loaded on the PC. It takes advantage of the native file and print sharing protocol delivered with Windows software. It does not require any software on the iseries system; however, it is recommended that Client Access for Windows 95/NT V3R2M0 (or greater) client be installed on a PC so Operations Navigator can be used to configure the AS/400 NetServer. The prerequisites for this support are that the iseries system and the PC be configured with TCP/IP and that the file sharing protocol on the PC be configured to use TCP/IP. Also, the Client for Microsoft Networks is required to be installed on Windows. Any data available through the OS/400 integrated file system (including stream files and CD-ROM) and any output queues on the iseries system can be shared with the network by the system administrator. To install a Client Access service pack using AS/400 NetServer support, do the following. Section 1: To ensure that AS/400 NetServer is started, do the following: 1 From a PC with Client Access V3R2M0 or newer, open Operations Navigator. 2 Click on the + in front of the system name. 3 Click on the + in front of Network (if this option is not listed, run Selective Setup to install it). 4 Click on the + in front of Servers. 5 Click on TCP/IP. 6 Find AS/400 NetServer in the list. If it is not started, right-click, and select Start. 7 Right-mouse click on AS/400 NetServer, and select Properties. 8 Make note of the NetServer name (by default it is Q + system name). Section 2: To verify TCP/IP support, do the following: 1 Try to PING the NetServer name from the PC 2 If you cannot PING NetServer, an entry for name resolution must be added to a Domain Name Server (DNS), the local LMHOSTS file for the PC, or to the Windows Internet Name Server (WINS) configuration. The quickest way to do this is to use the LMHOSTS file on the PC. Find this file, and add a line with the following format: TCP/IPaddress AS/400-NetServer-server-name. For example: QNETSERVER #PRE Note: For this command to take effect, run the command NBTSTAT -R from a DOS prompt or reboot the PC. To verify that the change was successfully made, run the command NBTSTAT -c from a DOS prompt. The entry just added should now be listed in the table. Section 3: To find AS/400 NetServer, do the following: 1 On a Windows 95, Windows 98, Windows NT, or Window ME PC, go to Start -> Find -> Computer. 2 On a Windows 2000 PC, right-click on the My Network Places icon, and choose Search for Computer. 3 Type the NetServer name, and search for it. 4 If it is unable to find the NetServer name, search for the AS/400 or iseries system by TCP/IP address. Note: Finding the AS/400 or iseries system by TCP/IP address is not allowed in Windows 95. Section 4: To access AS/400 NetServer, do the following: After finding the AS/400 or iseries system by system name or TCP/IP address, double-click on it to access the shared resources. If you are prompted for a user ID and password, see the redbook Advantage AS/400 NetServre, SG , Section This publication can be found by searching for it from the following Website: 16 of 21

17 You will see the shared resources on the AS/400 or iseries system. Right-click on any shared folder, and select Map Network Drive to assign a drive to the folder. Section 5: To install the Client Access Service Pack using NetServer, do the following: 1 Follow the steps above to ensure that NetServer is started and that the PC can access it. 2 From the IBM AS/400 Client Access Express program group, double-click on Client Access Properties. 3 Go to the Service tab. 4 Near the bottom of the screen, change Source directory to \\NetServer name\qibm, where NetServer name is the name of the NetServer as was noted under Step 8 of the Section 1 above. 5 Click Apply and then OK to close Client Access Properties. 6 From the IBM AS/400 Client Access Express program group, open the Service folder. 7 Double-click on Install Service Pack Section 6: To install Client Access Express from the iseries System, do the following: 1 Map a network drive to \\NetServername\QIBM, where NetServer name is the name of the NetServer as was noted under Step 8 of the Section 1 above. Note: If you had to find the NetServer by TCP/IP address in Step 4 of Section 3, use \\IPaddress\QIBM. 2 From that network drive, open the folders \ProdData\CA400\Express\Install\Image. In the Image folder there, there is a file named SETUP.EXE. Run this file to start the installation of Client Access Express. Note: The Image folder contains the Client Access installation image. It can be copied to a PC, server, or CD if you want to install the Client Access code from a different source. 17 of 21

18 IBM Support Line Technical Document Document Number: Document Title: Finding the AS/400 NetServer Using Find Computer Product: Operating System/400 - OS/400 PRINT/SPOOL (5769SS1SP) Release: V4R2M0; V4R3M0; V4R4M0 Document Description: To use Find Computer to find the AS/400 NetServer, certain requirements must be met. To use AS/400 NetServer, you must have Microsoft networking and TCP/IP installed on the PC. To check this, go to Start, Settings, Control Panel, and Network. Once you are sure of your PC configuration, you can continue with the next step. Before you will be able to see the AS/400 NetServer in Network Neighborhood or find it using Find Computer, you must be able to PING the AS/400 NetServer name. Go to Start, Programs, MS-DOS Prompt and type Ping AS/400 NetServer Name. Note: If you can PING the IP address of the iseries 400 system, but cannot PING the AS/400 NetServer name, AS/400 NetServer will not work. If you are unable to PING the AS/400 NetServer, there are several things you can do: 1 Add the AS/400 NetServer to your DNS server. To do this, please refer to the documentation for your DNS. 18 of 21

19 2 Add the AS/400 NetServer to your WINS server. For assistance with this, you will need to contact Microsoft. 3 Add the AS/400 NetServer to your LMHOSTS file. The LMHOSTS file is located in \Windows directory for Windows 95 and Windows 98 and \WINNT\system32\drivers\etc directory for Windows NT. You can edit the LMHOSTS file using any Windows editor; however, many editors will add an extension to this file (LMHOSTS.TXT or LMHOSTS.DOC). This will not work. You will need to rename the file because there must not be an extension. Thus, the easiest way to edit the file is using the DOS editor. If editing LMHOSTS file with another editor (Wordpad, Notepad), double quoting the name when you save the LMHOSTS file will prevent the editor from adding the.txt extension. Once the LMHOSTS file has been saved, run nbtstat - R. The uppercase R purges and reloads the remote cache name table. Note: When using Windows NT, the default is to not search DNS. Windows NT users must check Enable DNS for Windows Resolution. Windows/NT does check enable LMHOSTS lookup; therefore, this must be checked for LMHOSTS to work. Once the AS/400 NetServer has been added to the DNS, WINS, or LMHOSTS, you can PING and find the AS/400 NetServer. To find the AS/400 NetServer, click on Start, Find, Computer. Once You Find the AS/400 NetServer If the system name is found, but the location is Unknown, you have connected via NetServer, but the user ID that is logged on to Windows Networking is not a valid user ID on OS/400. If the system name is found, and the location and comment are what the NetServer is configured with under Operations Navigator, you connected via NetServer and are authenticated. For Windows 2000 and Windows ME to find a computer Right click on My Network Places and use Search For Computer. 19 of 21

20 IBM Support Line Technical Document Document Number: Document Title: The AS/400 NetServer Does Not Appear in Windows Network Neighborhood Document Description Product: Operating System/400 - OS/400 BASE (5769SS100) Release: ALL Classification: Public Use Keywords: SMB Client Document Description: A common problem is for some or all PCs on a network to not be able to see the AS/400 NetServer in Network Neighborhood even though they can directly access the server using a Find Computer or Net Use command. Network neighborhood uses the Microsoft Windows Browser service to track servers that are active on the network and display them to users. Note that you do not need to see the AS/400e or iseries 400 in Network Neighborhood to be able to use it. The browsing process is separate from computer name resolution, the process used with the NET USE or FIND commands to resolve the AS/400 NetServer name to an IP address. For information on how to map a network drive or printer to your AS/400 NetServer, see document To link to immediately, click here (Document link: Database 'AS400 Support Line KnowledgeBase', View '1.0 DBManagement View\All', Document 'Finding the AS/400 NetServer Using Find Computer'). To resolve the Network Neighborhood problem, you must understand TCP/IP subnetting and how Microsoft networking functions. This process can be quite complex in networks that span multiple TCP/IP subnets. Browsing on a Single Subnet Verify that the PCs and AS/400 NetServer are in the same workgroup (domain name) and the same subnet. The AS/400 NetServer domain name property can be accessed by using Operations Navigator. Expand the tree through Network, Servers, TCP/IP, AS/400 NetServer and select properties. After verifying the domain name, start (or end and start) the AS/400 NetServer It may take 15 minutes or more before the AS/400e or iseries 400 system appears in Network neighborhood. There can be multiple workgroups in the subnet but there must be at least one PC capable of being a master browser in the same workgroup as the AS/400e or iseries 400 system. If your AS/400e or iseries 400 system is multihomed (it has multiple TCP/IP interfaces defined), then verify that you have the latest NetServer PTFs applied. For a list of the current PTFs, see Informational APAR II To link to II11081 immediately, click here (Document link: Database 'AS/400 APAR Database', View 'APARs by Number'). Browsing with WINS Configured Verify that the AS/400 NetServer's WINS configuration is correct. Verify that you have the HIPER PTF for APAR MA18084 applied. For further information on NetServer PTFs, see Informational APAR II11081 (link above). If the AS/400 NetServer uses a different WINS server than that of the failing PC, verify that replication between the WINS server is configured and working. For information on how to configure a Microsoft WINS server, please contact Microsoft. Browsing Across Multiple Subnets Enabling TCP/IP browsing (Network Neighborhood) across multiple subnets without using WINS is a complex process. The AS/400 NetServer has no role in browsing other than to send a broadcast announcing it is present. Because the Computer Browser Service is implemented only on Microsoft products, you will need to consult your Microsoft networking documentation for information on how to configure browsing in a TCP/IP network that uses multiple subnets. Some of the Microsoft resources that may be helpful include: o Microsoft NT Server Resource Kit o Microsoft Knowledge Base Article ID: Q Information on Browser Operation o Microsoft Knowledge Base Article ID: Q Domain Browsing with TCP/IP and LMHOSTS Files Note: This information is current for the Windows NT, Windows 98, Windows 95, and Windows for Workgroups operating systems. 20 of 21

21 IBM Support Line Technical Document Document Number: Document Title: Mixed Case Passwords Fail with R510 NetServer at Password Level 0 and 1 Document Description: OS/400 R510 provides several security enhancements including AS/400 NetServer support for Microsoft clients that use the Windows NT challenge/response version 2 (NTLMv2) authentication. When the OS/400 Password Level is set to 0 or 1, clients that use OS/400 authentication methods treat the password as being case insensitive. AS/400 NetServer clients do not use OS/400 authentication. Instead, these clients use Microsoft networking authentication methods which may include NTLMv2. NTLMv2 passwords are case sensitive. Microsoft clients that use NTLMv2 authentication against an OS/400 system set to Password level 0 or 1, must use a password that consists of all lowercase or all uppercase letters. The list of clients that use NTLMv2 includes Windows NT, Windows 2000 and Windows XP. Windows 95, Windows 98 and Windows Me do not normally use NTLMv2; however, support for NTLMv2 canbe added through an optional download from Microsoft. See Microsoft Product Support Services Article ID Q for further information. When OS/400 Password Level is set to level 0 or 1 (system value QPWDLVL), the password is saved with a one-way encryption as two equivalent case-sensitive passwords. An all uppercase and all lowercase version is stored. Note that AS/400 NetServer cannot correct the case-sensitive password sent in from the Windows client. In NTLMv2, the password is encrypted and hashed before being sent. The password used for the Microsoft Windows network connection must match one of these two forms. Visit for additional information about the CPIB687 message. Once the Netserver has been registered as the DMB, it is up the PC's to contact the Netserver and ask for a list to populate their Network Neighborhood. If they don't ask, then the list in Network Neighborhood will still show up as empty or incomplete. Related Microsoft resources: support.microsoft.com/default.aspx?scid=kb;en-us;q Visit for additional information Instructions are in the installation wizard and you can consult the setup manual if you have questions about the installation. For Additional Information or questions about this content, please contact IBM Support Line. 21 of 21