User manual NOVELL OPEN ENTERPRISE SERVER 2.0 SP2 DOMAIN SERVICE FOR WINDOWS

[. . . ] novdocx (en) 7 January 2010 AUTHORIZED DOCUMENTATION Domain Services for Windows Administration Guide Novell® 2. 0 SP2 November 16 2009 Open Enterprise Server www. novell. com OES 2 SP2: Domain Services for Windows Administration Guide novdocx (en) 7 January 2010 Legal Notices Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. [. . . ] Solution 2: If the DNS Locator and Group objects are outside the domain partition, make sure the administrator has privileges to access the objects. Entry already Exists Cause: You see this error when you retry executing a task and the task fails during execution. Solution: For any task that has failed, delete the associated objects from the server and then retry the task. Provisioning Domain Services for Windows 121 novdocx (en) 7 January 2010 Depending on the task that failed, different objects are created. For instance, if the DNS Configuration task failed, you need to delete the Locator object and the Group object ldapmodify Failed Cause: Replica synchronization fails. Solution: To resolve this issue, refer Novell Error Codes Reference Guide (http://www. novell. com/ documentation/nwec/?page=/documentation/nwec/nwec/data/al39nky. html) Assign Rights All details related to task execution and state of the task are recorded in the provisioning. log file "Error: Insufficient Access" on page 122 "Entry already Exists" on page 122 "ldapmodify Failed" on page 122 All details related to task execution and state of the task are recorded in the provisioning. log file Error: Insufficient Access Cause: The administrator being used to execute the ldapmodify command does not have privileges to complete the operation. Solution 1: In the provisioning. log file, search for the ldapmodify command. Make sure the administrator used to execute that command has adequate privileges to execute this command. Solution 2: If the DNS Locator and Group objects are outside the domain partition, make sure the administrator has privileges to access the objects. Entry already Exists Cause: You see this error when you retry executing a task and the task fails during execution. Solution: For any task that has failed, delete the associated objects from the server and then retry the task. Depending on the task that failed, different objects are created. For instance, if the DNS Configuration task failed, you need to delete the Locator object and the Group object ldapmodify Failed Cause: Replica synchronization fails. Solution: To resolve this issue, refer Novell Error Codes Reference Guide (http://www. novell. com/ documentation/nwec/?page=/documentation/nwec/nwec/data/al39nky. html) Establish Trust Cause This error occurs in cases where the parent realm could not be resolved 122 OES 2 SP2: Domain Services for Windows Administration Guide novdocx (en) 7 January 2010 Solution Use the provision -q -q --locate-dc parent. domain command to resolve the parent domain. Update Service Configuration Cause This error occurs in cases where the parent realm could not be resolved Solution Use the provision -q -q --locate-dc parent. domain command to resolve the parent domain. Cleanup Cause This error occurs in cases where the parent realm could not be resolved Solution Use the provision -q -q --locate-dc parent. domain command to resolve the parent domain. Retry executing the task. 7. 9 Executing Provisioning Tasks Manually For details on executing Provisioning tasks manually, see Executing Provisioning Tasks Manually Provisioning Domain Services for Windows 123 novdocx (en) 7 January 2010 124 OES 2 SP2: Domain Services for Windows Administration Guide novdocx (en) 7 January 2010 8 Verifying DSfW Installation 8 This section discusses details on verifying DSfW server after installing and provisioning. Section 8. 1, "Verifying the Installation, " on page 125 8. 1 Verifying the Installation Perform these tasks to verify that eDirectory and DSfW have been installed and configured correctly. NOTE: After you have installed a child domain or an subsequent domain controller, the DNS server running at forest root domain (or the DNS server you are pointing to in /etc/resolv. conf file) must be restarted. Execute the following command on the server hosting the Novell DNS service: rc-novell-named restart Check the /etc/hosts file to ensure that it contains only one entry with this server's primary IP address. For example: 192. 168. 1. 1 oesdc. dsfw. com oesdc Check the /etc/resolv. conf file to ensure that it contains a name server and domain search entry for server on which DNS is hosted. For example: nameserver 192. 168. 1. 1 search dsfw. com Verify that eDirectory has been properly configured by using the following command: /opt/novell/eDirectory/bin/ndsstat -h localhost This command returns information similar to the following: Tree Name: DSFW_TREE Server Name:. CN=OESDC. OU=OESSystemObjects. dc=dsfw. dc=com. T=DSFW_TREE Binary Version: 20217. 06 Root Most Entry Depth: 0 Product Version: eDirectory for Linux v8. 8 SP5 [DS] Execute xadcntrl validate at the terminal prompt. If the services are configured correctly, the result of the command will be similar to the following output: Verifying DSfW Installation 125 novdocx (en) 7 January 2010 Tree Name: DSFW-TREE Server Name: . CN=testfrd. OU=OESSystemObjects. dc=dsfw. dc=com. T=DSFW-TREE. [. . . ] It is found in the partition container under configuration partition. It directly relates to the trust relationships displayed in the Active Directory Domains and Trusts administrative tool. If the Trusted Domain Object is not present in DSfW, cross-domain authentication fails and results in errors. Shortcut trust objects are created when there is more than one domain in the forest. [. . . ]