CalNetAD Frequently Asked Questions (FAQ)

Updated 9/13/2005

Can I use DHCP to hand out IP addresses?

You can continue to use DHCP to assign IP addresses, but to avoid name collisions, we recommend that you use DNS-based host names for computer accounts and store this information in the AD at the time of computer object creation using the script we provide (or similar). It really only matters what the computer name is if you need to access a host by name for services, in which case either DNS will resolve the name, or you would have to resort to using WINS or LMHOST files, as is the case now.

Assume that after joining AD I receive a lease for a different IP address that resolves to "boalt366-1.law.berkeley.edu". That wouldn't affect anything unless I were providing resources, right? Would I still show up as LAW-REASON in AD?

Correct, the AD "dNSHostName" and "servicePrincipalName" attributes are not dynamic (and would not be unless we were to use AD-integrated DHCP and DDNS). However, these AD values must match the host name as locally configured on the computer for AD logon authentication to succeed, so the local values also must be stable. Neither value actually has to match reality (at least from the DNS perspective) but they must match between AD and the local system for AD logons to work.

And again, correct that this (potential) mismatch would not affect anything unless the host in question were offering services for clients depending on DNS for name resolution. Ideally, if possible, one would configure DHCP to hand out the same IP to the same MAC address each time. This is what the campus LIPS DHCP service does for one's machine homebase IP address, i.e., when you are not roaming with your laptop off of your normal (homebase) subnet.

In this scenario, clients are dynamically configured for IP addresses, but typically obtain the same IP address, and thus remain accessible via DNS. It is true that laptop users might wander into a different subnet and thus violate this accessibility rule, but as long as their local configurations for hostname remain constant, AD logons would still work.

How do move a CalNetID to my OU?

You can move CalNet IDs from the default Faculty, Staff, Affiliate OU container to your OU container using the Move User page. Instructions can be found here.

I see many options for the "Log on to:" in the "Logon On to Windows" dialog box that is displayed at logon: CAMPUS, HAAS, UC, BERKELEY.EDU (Kerberos Realm), etc. Which one should I be using?

For simplicity, we recommend that you use your CalNetID-based User Principal Name (UPN) for logon to the CalNetAD. This means that you would enter:

mycalnetid@BERKELEY.EDU

into the "User name:" field and enter your CalNetID passphrase into the "Password:" field. The "Log on to:" field is disabled when you use a UPN for the user name.

I used my UPN (mycalnetid@BERKELEY.EDU) and passphrase to logon, but when I try to access some resources (maybe an NT4 file server, for example) I receive another user name and password prompt. How can I avoid this?

Some, mostly older, Windows services do not understand the newer user credentials (UPN and Kerberos tickets) that Windows 2000 uses by default. In these cases, Windows 2000 supports using older user credentials based on NTLM and NTLMv2 technology. However, for this to work seamlessly, the CalNetID passphrase and the passphrase for the proxy (shadow) CAMPUS domain user account (CAMPUS\mycalnetid) must be synchronized to be the same. Since by default, the shadow account passphrase is randomized and not known to the user, your OU admin must reset this passphrase to a known value before you can change it to match your CalNetID passphrase.

My OU admin has reset the passphrase for my CAMPUS shadow account (CAMPUS\mycalnetid) to a known value. How do I change this passphrase to match my CalNetID passphrase?

While logged on, from your Windows 2000/XP desktop use the "Ctrl-Alt-Delete" keyboard sequence to bring up the Windows Security dialog box. Select "Change Password...", fill in the "User name:" field with your CalNetID (mycalnetid), select "CAMPUS" for the "Log on to:" field and make the passphrase changes in the remaining fields.

I just upgraded my CalNetID from my employee number to a self-selected ID. When will that change appear in Active Directory?

The new self-selected ID is automatically synchronized overnight with Active Directory. If this overnight processing delay is acceptable, then nothing else needs to be done. However, if there is a need to immediately use the self-selected ID before the automatic nightly process, your local windows administrator can make a manual synchronization of the user attributes in Active Directory.

I am unable to join a Windows 2000/XP machine to my OU in the campus.berkeley.edu domain of CalnetAD. What could be wrong?

There are many factors that can cause errors when joining a machine to the domain. For detailed instructions and requirements when joining machines to CalnetAD, refer to the Kerberos Member Server and Workstation Setup document.

How do I assign student accounts a logon script and other user configuration settings using a GPO if I do not have access to the Student OU?

The solution is to configure loopback processing. With loopback processing, you can configure user settings in a GPO linked to the computer OU and during user logon, the user configuration node settings will also be applied. An illustration of how loopback processing can be used to assign logon scripts is shown in the Assigning a Logon Script to Student Accounts document.