NOVELL GENIUSES HERE

[thurmj33]

Ok, heres my problem what I need to do is make it so I have only one account log on to certain machines. I have not been able to find out how you make this happen. So basically I need to lock the username so only that user can log on to that machine. I am up for anything right now so if anyone has anything to offer please send me a line. Thanks

 

[reicherb]

I'm not exactly sure that you can.

One thing that might effectively solve your problem if your users aren't very NetWare savvy is to put the desired user(s) in a separate container, set the context on those workstations and then remove the advanced button. Then the only way users could log into the machine would be if they new their distinguished names.

 

[Santa]

If it is Windows NT or 2000 box you could make it so they are forced to enter a local windows account and password also and this way you can configure the box to only have the account of the user who is to be logging in there.

Kind of a nightmare to syncronize but this way you can authenticate to the network then to the box and if they both match up your in.

Most Novell admins just set it to automatically syncronize and login with the same user name and password as the user and this may work in your case but it depends on your novell client.

I would be surprised if Novell doesn't have this feature since you have been able to do this since NT 4.0..

 

[ATLien247]

There's a simple way to do it...

Are you using ConsoleOne or NWAdmin?

 

[reicherb]

Originally posted by: ATLien247
There's a simple way to do it...

Are you using ConsoleOne or NWAdmin?

How about telling us one way or the other? Or both? I assume most every NetWare admin probably still uses both and definitely has access to both.

 

[ATLien247]

Well, the basic idea is to specify a Network Address Restriction (or just Address Restriction in C1). This is found in the properties of a user object. You can specify a number of different address types (e.g. IP, IPX, MAC, etc.) which will allow a user to login only from that address.

There's a way you can configure Client32 to achieve similar results, but I have to leave now, so I won't go into that. If anyone's interested I can check this thread later tomorrow.

 

[reicherb]

He's not interested in knowing how to restrict where a user logs in. He's interested in knowing how to limit who can log into a workstation which you idicated you know how to do. Will you please detail it for us? (I appolgize if I sound rude. I'm not trying to be.)

 

[SaigonK]

Ok so I am not sure exactly what you need so can you be more specific?

First what version of Netware are you running?
What version of Zen For Desktops?

"I need to do is make it so I have only one account log on to certain machines."
Are these systems in the same location or in different places around a building?

"So basically I need to lock the username so only that user can log on to that machine."
If you have Zenworks 3 or higher, you can set a policy to do what you want. Under an older version it isnt as robust.

One option is if the systems are ok to be logged on at all times, you could enable auto-logon, your specific account would auto logn, the nuse workstation policies by container to limit the access they have. Remove the logoff option from the start menu so they cant logon as someone else.


OR


Associate all of your lab workstations and import them with unigue identifiers for the workstation object (using the MAC address can get hard to keep track of). Through the workstation object you can associate users to them so they only are allowed for where you want them.
again you need to use extensible workstaion policies viaZen.

 

[ATLien247]

ZEN would have been my first choice as well, but since the originator of this thread didn't give much detail, I described the traditional method.

As for reicherb's remark, you would have to restrict addresses for every user object that you did not want to have access to that particular workstation.

For example, let's say you were working with three workstations and three users...

WS1 = 10.0.0.1
WS2 = 10.0.0.2
WS3 = 10.0.0.3

If you only wanted User1 user to use WS1, you would specify 10.0.0.1 as the IP address you want to restrict for that user object. That user would not be able to login to WS2 or WS3. However, the other two users would be able to login to WS1 unless you specified an address restriction for their user objects as well.

If you took this a step further and specified 10.0.0.2 for User2, and 10.0.03 for User3, then the end result would be:

User1 can login from only WS1
User2 can login from only WS2
User3 can login from only WS3

So, basically, you would need to add an address restriction for ALL the workstations that you want a user to be able to login from. The workstations you don't want them to login from would be omitted from the list. It could get really hairy if you were working with a large nubmer of users and workstations.

As for the client workaround that I mentioned in my first post, it looks as though it has already been mentioned indirectly. You could setup only one local user account on the workstation, then configure the default location profile to synchronize passwords with that account.

 

[SaigonK]

Yeah IP scheming would work..but man that's a pain in the arse.
If you only have a few workstations it should not be that bad, but if you have hundreds of them like I do then I coudlnt imagine doing it without ZEN

 

[BarryAZ]

Right -- with a lot of workstations, Zenworks is going to be the way to go -- you might also look over at the Novell support newsgroups as well -- there are newsgroups specific to Zenworks (as well as specific to Client 32 for NT/2K/XP) that might help on more complex queries.

Then again, I might be a tad biased <smile>

 

[SaigonK]

Ahh our own Novell Support connection guy. You actually work for them? If so what is up with Legato on Novell?

 

[BarryAZ]

Actually -- I am not a Novell employee. The volunteer sysop program (which has a decade plus history) is composed of around 35 volunteers around the world (well mostly ranging from Australia and New Zealand, across the US and in Canada, and in Europe). We get support from Novell in terms of technical support, and some goodies including training opportunities and knowledgebase material), but we are mostly on our own.

I have a small consulting practice in the Phoenix area (been in private practice for 8 years).

I've been an online volunteer sysops for a LONG time (started back in 88 in Borland's TeamB volunteer group on CompuServe).

Regarding Legato -- no clues here -- not my focus area in the Novell newsgroups.