HP OpenVMS Systems

HP Advanced Server V7.3B for OpenVMS
Release Notes

Problem:

When a directory is backed up from one system and restored on another, stale group ACEs may still be attached to the files that are restored. These ACEs may cause the file server to deny access to users even though they have access to the parent directory.

Solution:

To correct the problem, delete the ACLs on the files after they are restored, using the following DCL command:

$ SET ACL/DELETE filename

Problem:

When an attempt is made to exceed the maximum number of sessions that the server is configured for, the operation fails (as expected) and the following error message appears in the PWRK$LMMCP_nodename.LOG file:

 ...specified XCCB not in use!

Solution:

You can ignore this error message.

13.4.11 You Cannot Map to an OpenVMS Search List

Problem:

You cannot map a share to a search list. In other words, you cannot map to devices or directories using such a search list name as the path device or directory name.

Solution:

Do not use a search list as the path device name. You must map to a specific device.

13.4.12 Do Not Use "DEV" as a Share Name

The name "DEV" is reserved. Do not specify "DEV" as the name of a share.

13.4.13 Limit to Number of Directory Levels

Problem:

The number of levels of directories (nested directories) that can be created in a directory tree are limited. Attempts to create a subdirectory too deep in the directory tree will fail. For example, tests have resulted in failures on ODS-5 volumes when attempting to create subdirectories approximately 60 levels deep.

Solution:

The problem occurs because for each nested directory created, superflous ACEs are inherited from the parent directory's ACL. As each new directory is created deeper in the directory structure, the ACL increases in size until it reaches a limit. Two workarounds are:

1. Use a Windows NT client to view the security permissions on the directory in which the failure occurred, and then select OK. No actual change to security is necessary --- just use Windows NT to view security permissions for the directory, preserving the exact security that already exists. Windows NT automatically removes duplicate ACEs.
2. Change the STORE_SECURITY_ACES parameter in the OpenVMS Registry from its default value to disable propagation of security information to files and directories created in directories. Refer to the HP Advanced Server for OpenVMS Server Administrator's Guide for more information.

This section describes restrictions related to the various languages and ISO-8859 extended character sets that can be configured on the Advanced Server. For related restrictions, see Section 13.10.4.3, Problems Using Certain Characters for a Member Server Computer Name or Cluster Alias Name, and Section 13.3.3, The ^ Character Does Not Get Encoded in Parameter Values.

Problem:

If the Advanced Server and OpenVMS are set to different languages, and you enter extended character set characters in their raw form (single-byte ISO-8959 value), OpenVMS will uppercase the extended character set characters incorrectly, and the wrong data will be provided to the Advanced Server.

Solution:

When you enter the single-byte ISO-8859 characters, enclose them in quotation marks.

13.4.14.2 Relative and Indexed Files with Names Containing Extended Character Set Characters Are Inaccessible

Problem:

Relative or indexed files stored on the server, whose names include extended character set characters (other than those supported by the default character set, ISO-8859-1), are inaccessible by clients of the server.

Solution:

Rename these files manually from OpenVMS so that the names do not include extended character set characters.

13.4.15 File Size Restriction

The maximum size of a file that can be handled by the Advanced Server for OpenVMS is 4 GBs. As documented in Section 7.3.1, prior to Version 7.3A of the Advanced Server for OpenVMS, the maximum size restriction was 2 GBs.

13.4.16 Alias File Names Not Supported on NFS Shares

Problem:

On a shared NFS volume, the server will be unable to create alias file names for files whose names are not compatible with MS-DOS or that contain extended character set characters with code point values of 128 through 255 (hexadecimal 80 through FF).

Solution:

Alias file name support applies only to ODS-2 and ODS-5 volumes. The files can be accessed only by referring to the original names.

13.4.17 Case Sensitivity

OpenVMS Alpha Version 7.3-1 and later supports the option of case-sensitive lookups of file names (where tools and applications can distinguish among file name specifications containing the same alphabetic characters that differ in case only). Case-blind file name lookup is the default behavior for OpenVMS and the Advanced Server. As reported in the OpenVMS Alpha Version 7.3-1 Release Notes, case-sensitive file name lookup is a very significant change in behavior and cannot be expected to work seamlessly with existing applications. HP recommends that you do not enable this feature on systems that run the Advanced Server. Sharing directories that contain files whose names are identical except for case is unsupported and will result in unexpected behavior.

Likewise, command line processing of case-sensitive commands might result in unexpected behavior.

For more information on case sensitivity in file operations, refer to the OpenVMS release notes and the x New Features and Documentation Overview Manual.

13.4.18 Restriction on Roaming User Profiles

Problem:

Usage of roaming user profiles that will be stored on a Advanced Server for OpenVMS share on an ODS-2 disk is limited by the restrictions imposed by the ODS-2 disk structure. Names of folders (such as desktop folder or subfolders created in the My Documents folder) to be stored at the profile path destination must not exceed 32 characters in length; otherwise, the server's attempt to store the folder name as a directory on the share will fail. Folder names that include spaces or nonalphanumeric characters (characters not included in the standard character sets) impose further limits on the length of the name: each such character takes up four characters on the volume.

Solution:

If the structure of the roaming user profiles requires support of folder names exceeding 32 characters in length, HP recommends that you take advantage of the ODS-5 disk volume structure and directory features. For a related restriction, see Section 13.5.6.

13.5 User Interface Restrictions

This section describes restrictions in the management interfaces.

13.5.1 Expired Password Cannot be Changed During Admin Login

Problem:

When you try to login using the ADMINISTER command and the credentials of a Windows 2003 domain user, expired password cannot be changed during login. This problem occurs if the Domain Controllers are running Windows 2003 with SP1. If you try to change the password, the ADMINISTER command will report the following error:

"%PWRK-E-PSWCHERR, error changing password for user "NEWUSER2" on domain
"<W2K3DOMAINNAME>"
-LM-E-ERROR_ACCESS_DE, insufficient privileges for attempted operation"

Solution:

The solution is to change the password through Windows "Change Password" applet.

Alternatively, on Windows 2003 domain controllers execute the following command at the DOS prompt and then restart the server:

net localgroup "pre-windows 2000 compatible access" "anonymous logon" /add

On Windows 2000 domain controllers, execute the following command at the DOS prompt and then restart the server:

net localgroup "pre-windows 2000 compatible access" everyone /add

The ADMINISTER/SHOW FILE command will not give accurate results for directory trees, when the directory tree resides on an NT server. The inaccurate results always take the form of an extra character appended to an otherwise correct file/directory name. If the file is a directory and the /subdirectory and /permissions switches are specified, one or more instances of the following error will be observed:

%PWRK-E-ERRGETFILEACC, error getting access information for <directory name>

This problem will be fixed in a future release.

13.5.3 Configuration Manager (ADMIN/CONFIG) Requires That the Registry Server Be Running

Problem:

Before invoking the Configuration Manager with the ADMINISTER/CONFIGURATION command, make sure the OpenVMS Registry Server is running. If the Registry is not running, you will not be allowed to start the Configuration Manager. A message will notify you of this.

Solution:

HP recommends that you have the Registry Server started automatically with system startup. If you need to start the Registry Server manually, enter the following command at the DCL prompt, as shown:

$ @SYS$STARTUP:REG$STARTUP

Problem:

If you use the ADMINISTER command COPY USER to create a new user account, and you omit the /PASSWORD qualifier, the new user account is created with an encrypted password.

Solution:

Use the MODIFY USER command to set the password for the new user account.

13.5.5 Server Acting as a BDC Will Not Allow Changes to Share Permissions Until Synchronized with PDC

Problem:

If a new user or group is added to the domain, an attempt to set permissions on an object (for example, a file) for the newly added user or group may result in an error message, such as:

 %PWRK-E-ERRMODSHAREPERM, error modifying permissions for share "QUIP"
 -LM-E-NOTALLMAPPED, one or more user or group names were not found

Solution:

Synchronize the BDC with the PDC before adding permissions for the new user or group.

13.5.6 Directory File (Folder) Name Length Restrictions on ODS-2 Disk Volumes

Problem:

The length of a directory file (or folder) name is limited to 39 characters on ODS-2 disk volumes. The length is further restricted if the name includes dots, spaces, or other characters that cannot be used in ODS-2 file names. In general, each instance of these characters reduces the maximum length by four characters. Regular file names (nonfolder names) can have up to 77 characters in the client file name, unless the name includes dots, spaces, or other non-OpenVMS characters.

Solution:

Limit the length of directory and file names accordingly on ODS-2 disk volumes, or either move the share to an ODS-5 disk volume or convert the ODS-2 volume to ODS-5 to use the extended file naming capabilities of ODS-5 disk volumes. Upgrade the file server to Advanced Server for OpenVMS and use the extended file naming capabilities of ODS-5 disk volumes. For a related restriction, see Section 13.4.18, Restriction on Roaming User Profiles.

13.5.7 Alias Name Not in Browse List When Using DECnet Transport Only

Problem:

In an OpenVMS Cluster, the Advanced Server alias name is not seen by the browser if DECnet is the only transport configured. The ADMINISTER SHOW COMPUTER display shows the alias, but it marks it as unavailable. Although the alias is marked as unavailable, you can still connect to shares using the alias name.

Solution:

Use the Advanced Server Configuration Manager
(ADMINISTER/CONFIGURE command) to configure the Advanced Server to use either TCP/IP or NetBEUI in addition to DECnet.

13.5.8 Mouse Selection Highlights Entire Screen

Problem:

Under certain circumstances, the entire screen is highlighted when you select a button using the mouse input device.

Solution:

When this occurs, press Ctrl/W key to clear the screen, then select the button again.

13.5.9 Advanced Server Unable to Resolve Job Logical Translation as Part of a File Specification

Problem:

If you use a job logical as part of a file specification for any ADMINISTER command, the operation will fail. The file server does not support using a job logical as part of a file specification. Using a job logical as part of a file specification to an ADMINISTER command results in an error, where the error message may not be explicit about the cause of the problem.

For example, the following command will fail with an "insufficient privileges" error message.

$ ADMIN SAVE EVENT SYS$LOGIN:EVT_BACKUP.EVT

The source of the problem, however, is not the privilege level of the user; rather, it is the use of the SYS$LOGIN job logical.

Solution:

Do not use job logicals in file specifications in the ADMINISTER command line.

13.5.10 Server Description (SrvComment) Restriction

The ADMINISTER SET COMPUTER/DESCRIPTION command accepts a maximum string length of 256 characters for the server description. However, some file servers, including the Advanced Server for OpenVMS file server, allow a limit of 48 characters for the string.

If you attempt to set the Advanced Server description to a string that is over 48 characters in length, your description string is not accepted, and is set to the default string instead.

13.5.11 Cannot Delete Stale Host Mappings

Problem:

If no server domain controller for a trusted domain is accessible by the Advanced Server, attempts to remove host mappings to the trusted domain's users with the ADMINISTER REMOVE HOSTMAP command fail, unless you specify the /HOSTUSER qualifier to remove all user account mappings to a specified OpenVMS user name. The following example shows what happens when specifying the REMOVE HOSTMAP command to remove a host mapping to user account THEO in the trusted domain KANSAS:

LANDOFOZ\\TINMAN> REMOVE HOSTMAP KANSAS\THEO
%PWRK-E-ERRGETUSRGRP, error getting information for user or group
"KANSAS\THEO"
-PWRK-E-USRGRPNOTFND, the user or group cannot be found

Solution:

To delete the host mapping, specify the /HOSTUSER qualifier to delete all mappings to the OpenVMS user account with the specified user name, as in the following example:

LANDOFOZ\\TINMAN> REMOVE HOSTMAP KANSAS\THEO/HOSTUSER
%PWRK-S-HOSTMAPSREM, mappings to host user "THEO" removed

Problem:

When you issue the SHOW SERVICES command to display all the services on a Windows 2000, Windows XP, or Windows NT system (Service Pack 4 or later), the command fails, as in the following example:

LANDOFOZ\\TINMAN> SHOW SERVICES /SERVER=WNTD23
 %PWRK-E-ERRGETSVCS, error getting service information
 -LM-E-ERROR_MORE_DATA, additional data is available

The SHOW SERVICES command does work if you specify a specific service for which information should be displayed (such as SHOW SERVICES ALERTER). Note, however, when you specify a service name, it must be 15 characters or less, or else you receive an error as in the following example:

LANDOFOZ\\TINMAN> SHOW SERVICES "CARBON_COPY_SCHEDULER"\SERVER=WNTD23
%PWRK-E-INVSVCNAME, invalid service name "CARBON_COPY_SCHEDULER"
-PWRK-E-VALLENGTH, a service name must be 1 to 15 characters in length

In addition, the command fails if the service name includes spaces, as in the following example:

LANDOFOZ\\TINMAN> SHOW SERVICE "Carbon Copy 32" /SERVER=WNTD23
%PWRK-E-ERRGETSVC, error getting information for service
"Carbon Copy 32"
-LM-E-NERR_SERVICENOT, the service has not been started

Solution:

This problem is due to the specified Windows NT software. You can use the SHOW SERVICES command successfully with earlier versions of Windows NT (prior to Service Pack 4) and to any PATHWORKS or Advanced Server for OpenVMS servers as well as Advanced Server for UNIX (Tru64 UNIX) servers. You can use the SHOW SERVICES command successfully on any Windows system if you specify a specific service in the command line. The service name specified should be 15 characters or less in length, and should not include spaces. If the service name does include spaces, you can omit the spaces when you specify the name in the command line, as in the following example showing how to display information for the service named "Carbon Copy 32" on a Windows NT Server:

LANDOFOZ\\TINMAN> SHOW SERVICES "CarbonCopy32" /SERVER=WNTD23

Problem:

When you specify a password for a user account, such as when adding a user account or changing the user password, if the password is shorter than the minimum length, you get a different error message than was returned in previous versions of the Advanced Server. The following is an example showing a message returned with the current version of the Advanced Server:

LANDOFOZ\\TINMAN> ADD USER SCARECROW/PASSWORD=PWD_4 -
 _LANDOFOZ\\TINMAN> /FLAGS=NOPWDEXPIRED
%PWRK-E-ERRADDUSER, error adding user "SCARECROW"
-LM-E-NERR_BADPASSWOR, the password parameter is invalid

Previous versions return other messages.

Solution:

To display the default minimum password length, use the SHOW ACCOUNT POLICY command. Use the SET ACCOUNT POLICY/PASSWORD_POLICY command to modify the minimum length.

13.5.14 Local Group Names Limited to 20 Characters in Length

Problem:

With Windows NT, the maximum length of local group names is 256 characters. The ADMINISTER user interface allows a maximum of 20 characters. If a local group name is created from Windows NT with a length exceeding 20 characters, and you try to execute an ADMINISTER command with that name specified in the command line, you will see an error message such as the following:

%PWRK-E-INVUSRGRPNAME, invalid user or group name
"Local Group CAD-Admin"
-PWRK-E-VALLENGTH, a name must be 1 to 20 characters in length

Solution:

For managing local group names exceeding 20 characters in length, use the Windows NT management tools.

13.5.15 ADMINISTER Commands Cannot Act on Event Log Files of Remote Windows 2000 or Windows NT SP6 Servers

Problem:

You cannot use the ADMINISTER SHOW EVENTS, CLEAR EVENTS, and SAVE EVENTS commands to display, clear, or save the contents of an event log file located on a remote Windows 2000 or Windows NT server with Service Pack 6. In other words, these commands do not work when the default server is a Windows 2000 or Windows NT server (using the /SERVER qualifier with the command, or after using the SET ADMINISTRATION command, to set the remote server as the default). The commands also fail when using the /COMPUTER qualifier. You will see errors such as the following examples:

LANDOFOZ\\TINMAN> SET ADMINISTRATION/SERVER=WIZ2000
%PWRK-S-ADMSET, now administering domain "LANDOFOZ", server "WIZ2000"
LANDOFOZ\\WIZ2000> SHOW EVENTS
%PWRK-E-EVTERROPEN, error opening event log SYSTEM at server \\WIZ2000
-LM-E-RPC_X_BAD_STUB_, The stub received bad data
   .
   .
   .
LANDOFOZ\\TINMAN> SHOW EVENTS /COMPUTER=WIZ2000 /TYPE=APP
%PWRK-I-EVTNOREC, Application Event Log on server "WIZ2000" has no
records
   .
   .
   .
LANDOFOZ\\TINMAN> SAVE EVENTS /SERVER=WIZ2000 /TYPE=SECURITY
   .
   .
   .
%LM-E-ERROR_BAD_PATHN, bad pathname

The commands work successfully against a remote HP Advanced Server.

Solution:

Use the Windows NT or Windows 2000 server's local tools to show, clear, or save its events.

13.5.16 ADMINISTER SET PASSWORD Command Fails If the PDC is Windows 2000 or Windows XP

Problem:

If the primary domain controller (PDC) is a Windows 2000 or Windows XP system, do not use the ADMINISTER SET PASSWORD command to change the password for your domain user account. If you do, you will not be validated; you will not be able to log on to the domain again afterward. Neither can you set the password when logging on to the domain after the password has expired (you are prompted for the new password, but the password you enter will not be accepted).

Solution:

To change your domain user account password in a domain where the PDC is Windows 2000 or Windows XP, use the ADMINISTER MODIFY USER /PASSWORD command or the DCL SET PASSWORD command.

13.5.17 SHOW COMPUTER Command Might Fail with -LM-E-NERR_SERVICENOT Error

Problem:

When the master browser is not the PDC in the domain, the ADMINISTER SHOW COMPUTER command might fail with the following error messages:

%PWRK-E-ERRGETCOMP, error getting computer information from
"\\pdc-name"
-LM-E-NERR_SERVICENOT, the service has not been started

Solution:

You can use the SHOW COMPUTER/TYPE=DOMAIN_MEMBERS, which will display only those computers that are members of the domain (that is, in the server's SAM database), excluding those that are listed by the Computer Browser service as active in the domain.

To regain full functionality of the SHOW COMPUTER command, start the Browser service on the PDC.