----------------------------------------------------------------------
NOV-NDS1.DOC -- 19960117 -- Email thread on NetWare Directory Services
----------------------------------------------------------------------

	Feel free to add or edit this document and then email
	it back to faq@jelyon.com




Date: Sat, 14 Oct 1995 20:20:24 EDT
From: "joe_flowers@ncsu.edu" <NOVELL@HCL.CHASS.NCSU.EDU>
Subject: Re: NDS Backup

I know that John Baird was going to do an experiment on how
Petr Jaklin's JCMD utility works as a practical backup utility.
Specifically regarding whether or not JCMD would preserve  the
OBJECT ID, a.k.a. User ID  (The HEX number in SYSCON-
User Information-<select a user>-Other Information). The same number
Pegasus Mail uses (minus the leading zeros) as the default location to
store a user's newmail ("Home mailbox location").  I don't recall Mr.
Baird's report back to the list. Anyway, I just finished the first
stage of this experiment and the answer is YES. JCMD does preserve
these Object IDs.

As was predicted by Joe D. and others, the trustee directory
assignments and user volume space restrictions were NOT restored
with just restoring the NDS. (Thanks to Joe D. for pounding this
into our heads;  it came as no surprise.)

At present my tape drive is running to restore the files and directories
and hopefully the trustee directory assignments and user volume
restrictions with Arcsolo for Windows v3.02.

I'll be interested to see how it handles the compression/suballocation
and the change in block size from 4KB to 64KB on the new drive.

From my experience with NDS, I have to back John Baird on his
insistance that relying on replication alone is not enough. There is
no question.

------------------------------

Date: Sat, 14 Oct 1995 20:49:17 EDT
From: "joe_flowers@ncsu.edu" <NOVELL@HCL.CHASS.NCSU.EDU>
Subject: Re: Removing DS from NW4.10 servers

     I have seen this problem come up over and over again on the list:
Not being able to remove Directory Services from a NW 4.10 server
with LOAD INSTALL.NLM.

     If you are sure you need to remove Directory Services from
your NW 4.10 server (and please think this through to your final
solution before continuing) AND you cannot remove DS with
LOAD INSTALL.NLM,  JCMD.NLM will do it easily.

//
For example, to remove DS with JCMD and then reinstall DS with
INSTALL:

unload ds.nlm
load jcmd.nlm
cd _netware
atrib *.* r- t-
del *.*
exit
load ds.nlm
load install.nlm
//

*****If you need to remove DS from your server, I strongly recommend
you try INSTALL before JCMD. Use JCMD as a last resort.

//
Regarding this problem, JCMD has the advantage over INSTALL
in that with JCMD you do not have to login to DS before
you can remove DS. If DS is badly corrupt, INSTALL is out
of luck, JCMD is not.

------------------------------

Date: Tue, 17 Oct 1995 23:29:26 EDT
From: "joe_flowers@ncsu.edu" <NOVELL@HCL.CHASS.NCSU.EDU>
Subject: Re: NDS Backup

     I wanted to report back to the list on a couple of experiments I
have been working on. I'll try to make it as brief as possible.

Scenario:

    We have 6 NW4.1 servers in our tree. SOCIAL (Internal IPX
number  98016005) is the name of one of them. It has a 1.6G drive
(SYS, 4KB blocks) with suballocation and compression turned on.
NDIR /VOL reveals : "Space saved by compressing files:   ...... ~55%."
Master replica of ROOT.
***SOCIAL was the product of an UPGRADE from NW v3.12 to
NW 4.02 to NW4.10 (SYS volume was never lost).

      I use ArcSolo v3.02 for Windows and JCMD to
backup the servers. ArcSolo v3.02 was made for NW 3.12, but better that
99% of all my users are in a bindery context, so in theory I suppose, my backup
software should work. I have an Archive Python 2-4Gig (with
compression) 4mm DAT drive hooked up to the backup PC.
ODI drivers with NETX on this backup workstation (I
want to make sure I'm getting bindery emulation, no VLM troubles).

In an isolated environment:

Experiment #1:
New NW 4.1 server is made. 1.6G drive. SYS: 64KB blocks.
Compression & Suballocation are turned on.
Name: SOCIAL
Internal IPX number: 98016005
Master Replica of ROOT.
NDS file completely deleted and replaced with JCMD acquired
NDS files from original server.

Result:
*All user account information seems to be restored, except:
No user volume space limits.
No user volume space in use.
No user and group trustee directory assignments.
*** Object IDs are restored.

Now, files and directories are restored from tape backup of original
server.

Result:
User volume space limits restored.
User volume space in use restored.
User and group trustee directory assignments restored.
*Files are restored uncompressed.
*File attributes are restored (A, Sh, T, H, Di, Ri, Ro, etc.)
*Files compressed at 12AM,
NDIR /VOL reveals : "Space saved by compressing files:.. ~53%." the next day.
*File ownership - restored.
*No file corruption found after spot checks.

Experiment #2:
2nd NW4.1 server is made.
Name: SASW
Internal IPX number 98012212.
R/W replica of ROOT.
Power to SOCIAL is turned off, to simulate a crash and burn.
SOCIAL/SYS is deleted with INSTALL.
Netware partition holding SOCIAL/SYS is deleted then recreated.
SOCIAL/SYS recreated.
In NWADMIN- Partition Manager, Server Object SOCIAL
is deleted from NDS.
SASW is made the Master replica of the ROOT.
SOCIAL is installed  back into tree(same tree name) in the same
context as original SOCIAL.
*User OBJECT IDs are not the same as original (not restored) .
SOCIAL is made the Master replica of the ROOT.

Result:
*User OBJECT IDs are not the same as original (not restored).

Files and directories are restored from tape of original server.
Result:
*All user account information seems to be restored, except:
No user volume space limits.
No user volume space in use.
No user and group trustee directory assignments.

Experiment #3:
This experiment was simply a retry of experiment #2.
Same result, but:
*****Interesting point: The user OBJECT IDs were different
from the user OBJECT IDs in Experiment #1 but identical to
the OBJECT IDs of experiment #2. I wonder if this had something to do
with the fact that SOCIAL was the product of an upgrade instead of a
NW 4.1 server made from scratch ?  Continuing down the same line,
I wonder if I backup this "new" SOCIAL again with the tape drive,
then simulate another crash, restore NDS replica from SASW, restore
files and directories from tape, if the OBJECT IDs, Trustee directory
assignments, and Volume space restrictions will be restored ?
*I'll try to finished this experiment and get back to you.

I think the moral to the story is:

If you are not sure what your backup system will produce,
get the JRB utilities and save the trustee directory assignments,
object ids, user volume space limits, user volume space in-use stats, etc.

Get and backup with JCMD, even if you have another NDS backup method
and never use JCMD to restore the NDS.

Experiment and prepare.

BTW, Make sure you know which servers hold the master replicas of
your NDS partitions; make sure if you restore a server's NDS files with JCMD,
you do not inadvertantly end up with 2 master replicas of the same NDS partition.

------------------------------

Date: Wed, 22 Nov 1995 06:04:47 GMT
From: Gerald Khoo Seng Wee <cceksw@LEONIS.NUS.SG>
Subject: Re: NetWare 4.1 TimeSync problem ... HELP

Allison and Michael (almcepud@shellx.best.com) wrote:
>I just installed a NetWare 4.1 server into a network that has a 4.1
>server and a 3.12 server.  The new 4.1 server is giving me an error at
>the console that reads:  Synthetic Time is being issued to partition
>"Partition.Name".  This problem server is a Single TimeServer and the
>other 4.1 server is a Secondary TimeServer.  The problem server has one
>tree with two partitions in its NDS.  Any ideas?  Please help!

This error message is issued when the server time has been set backwards.
NDS uses the server time to do timestamping, hence this error occurs so
as to prevent objects from being time stamped wrongly. The error will
disappear once the time of the server catches up with the partition time
stamp.

However, since your server is the Single Reference, it is not healthy to
leave the server in such a manner. A Single Reference server would not
adjust itself to other's time but expects others to adjusts to him.
You should down the server, set the hardware clock correctly, then up
the server again. You must get a reliable machine to be a Single
Reference or Reference time server.

What you can do also is to do a dsrepair to repair the time stamps. The
option is in "Advance Options" menu, "Replica and partition operation"...
and choosing the partition that contains the incorrect time stamps and
run the "Repair Time stamp and declare new epoch" option.

Note that by rebuilding the replica, the Master replica will be copied
onto all other replicas... so you have to make sure you are not replacing
the "good" copy with a "bad" one.

------------------------------

Date: Wed, 22 Nov 1995 22:27:34 GMT
From: Teo Kirkinen <kirkinen@CC.HELSINKI.FI>
Subject: Re: Decentralized Partition/replication operation

Deepak Bhatia (70404.1143@COMPUSERVE.COM) wrote:
>We are battling for central control of partitioning and replication
>operations.  Since everything is department based, every department
>wants to do their own partitioning/replication operations.
>Can you give some words of wisdom on what kind of damage a decentralized
>partitioning/replication strategy can do to a 4.x environment if every
>admin did whatever they pleased to their partition?

Don't go with decentralised partitioning. At least my opinion is that
partitioning is so difficult to setup that most departmental managers
won't be able to plan it correctly even if they are competent Netware
Managers. I'm not certain that I can design a fail-proof plan for
partitioning and replicating our NDS tree even when I'm the head of
our Computing Center's Netware team and I have been working with
Netware from version 2.15 and we have had Netware 4 servers from the
day NW 4.01 was shipped ;-)

Somebody will hold the replicas of the root partition. Most likely
it will be you if you work in the Computing Center. Then your servers
will hold at least a subordinate replica of each departmental parti-
tion. When some department will mess-up their partition it will
most likely affect your servers because of those subordinate replicas.

An agreement for the centralized management of the partitions would
be a much better solution. If you manage the root of the NDS tree
when you will need the access to every server to be able to run
DSREPAIR and update DS.NLM. If the departments cannot agree to that,
then let them use separate NDS trees.

------------------------------

Date: Thu, 23 Nov 1995 01:05:53 GMT
From: Gerald Khoo Seng Wee <cceksw@LEONIS.NUS.SG>
Subject: Re: New DS.NLM, DSREPAIR.NLM andDSMAINT.NLM

:DS.NLM 4.89c and DSREPAIR.NLM 4.29 are available in ftp.novell.com in the
:/pub/netwire/nsd directory under the name of 41NDS5.EXE. The new
:DSMAINT.NLM 4.90 is also available under the name of DSMNT2.EXE.

Forgot to give you the path for dsmnt2.exe...:

	/pub/updates/nwos/nw410

------------------------------

Date: Thu, 23 Nov 1995 02:09:43 GMT
From: Gerald Khoo Seng Wee <cceksw@LEONIS.NUS.SG>
Subject: Re: NDS RESTORE

>I have read the various threads re: NDS RESTORE. I have one q? -- The
>order of restoring NDS partition after failure of server sys volume in
>a multi-server NDS tree. My problem with this is that when
>reinstalling the server,same name,ipx internal #,same location in NDS
>tree, a replica (or partition if necessary)however minimal it may be,
>will be created in the tree.
>
>I understand that the Replicas formerly on this server will have to be
>replaced. How does this effect the newly created replica and NDS tree?
>
>Is one able to take a former R/W replica (of partition of which server
>is part of)and place it on the server?  What happens to the newly created
>partition?  Is it appended to???
>
>In a one server install the newly created Master partition,minimal,
>is indeed appended to be a restore of NDS.  <snip>
>
>Incidentally, because of the NDS complications(although I think its
>implementation and integration very robust and strong) all servers
>have either sys volumes mirrored or RAID5. I wanted to minimize NDS
>Restores as much as possible. I dread however to think if at some
>stage NDS can become corrupted. How would I begin to sort that out in
>a 24 server environment?

I presume you are using NW 4.1 and not NW 4.0x as the way to do it is
vastly different because of the tools provided in NW 4.0x. The new
DSREPAIR.NLM in NW 4.1 is catered for any of such incidents if they happen.

Firstly, we have to differentiate between partitions and replicas. They
are 2 different things altogether. Partitioning is used due to the size
of the NDS tree. In my environment, we have over 27000 objects in our
tree. To store 27000 objects as one database partition, would not be
effective and efficient. Any single change in an object in the partition
would affect the whole partition. Hence, we would split the whole NDS
tree to smaller parts... partitioning. Hence, we get little databases of
each part of the NDS tree.

Now, for robustness and fault tolerance, we would need more than one copy
of the database of each partition. Hence, we replicate the database to
be stored in different servers. The placement of these replicas also play
a role in the NDS stability, robustness, etc.

With that, we now look at the situation. If a server crashes and needs to
be restored, we need to know the following information. The IPX Internal
Network Number, the server name and what replicas are stored on this server.
Presumably there is now more than one replica of every partition. If
there isn't, that whole partition would be lost.

We first have to see if there are any MASTER replicas stored in that
server. If there are, we would have to go and use DSREPAIR to set a R/W
replica of that partition to be a MASTER. Afterwhich, we need to remove
the knowledge of the partitions in that server (also from DSREPAIR). Once
that is done, theoratically, the whole NDS tree knows that that server
hold no replicas now.

Because the NDS partitions are stored in the SYS:_NETWARE directory, a
full SYS volume backup does not backup that directory. A full restore
of SYS would not get those replicas back into the server.

After removing the knowledge of the replicas to that server, we have to
reinstall the server and put it back into the same position of the tree.
Afterthat, by using Partition Manager, place back the replicas to the
server. You may encounter some errors which I hope a DSREPAIR would be
able to correct.

------------------------------

Date: Fri, 24 Nov 1995 09:48:03 GMT0BST
From: Kens Mail List Host <MAIL@DRL.OX.AC.UK>
Subject: Re: IPXRTR NCP Work To Do

>>Some of our Netware 4.1 servers occassionally jump up to 100% CPU
>>utilization and stay there for some time. The console reveals that
>>almost all the work is being done by the 'IPXRTR NCP Work to do'
>>process. We are not routing IPX on the server and is not heavily
>>loaded with users. Does anyone know what this means?
>
>Sounds like you have a serious NDS problem. Go to server console and type:
>	SET DSTRACE=ON
>	SET DSTRACE=+ALL
>	SET DSTRACE=+SYNC
>	SET DSTRACE=*H
>Switch to the DSTRACE Screen and watch for any unsuccessful updates
>and/or errors.  If you do have problems, I would recommend contacting a
>NASC or Novell Tech Support directly, unless you are a NDS
>troubleshooting expert.

This is not a NDS problem. We've just spent several months getting to
the bottom of this one. It's related to packet burst and the VLMs.
Novell have a patch called PBRSTOFF which disables packet burst on
the server. It took our utilisation from 80-100% down to 0-30%.
I'm not sure the patch is generally available but they will give it
out on demand.

Ian Kennedy

------------------------------

Date: Fri, 24 Nov 1995 23:53:58 -0500
From: Dennis Cheek <z007337b@BCFREENET.SEFLIN.LIB.FL.US>
Subject: Re: IPXRTR NCP Work To Do

>>Sounds like you have a serious NDS problem.  Go to server console & type:
>>	SET DSTRACE=ON
>>	SET DSTRACE=+ALL
>>	SET DSTRACE=+SYNC
>>	SET DSTRACE=*H

<snip>

As with most network problems, several problems can produce the same
symptoms.  Sounds like you also need to check your LAN configuration.
Generally, PBRSTOFF is only used at the direction of Novell Tech Support
when troubleshooting actions deem it necessary.  There isn't any inherent
problem running VLMs with Packet Burst (It's on by Default) on a NetWare
4.1 server.  The "IPXRTR NCP Work To Do" problem I experienced was indeed
caused by damaged NDS Replicas and unsynchronized NDS Schemas.

------------------------------

Date: Thu, 23 Nov 1995 11:30:36 GMT
From: Gerald Khoo Seng Wee <cceksw@LEONIS.NUS.SG>
Subject: Re: Decentralized Partition/replication operation

>We are battling for central control of partitioning and replication
>operations.  Since everything is department based, every department
>wants to do their own partitioning/replication operations.
>
>Can you give some words of wisdom on what kind of damage a decentralized
>partitioning/replication strategy can do to a 4.x environment if every
>admin did whatever they pleased to their partition?

I am making the assumption here that there is only one NDS tree and all
the departments are under that NDS tree. If it is not... then go ahead
and let the other departments do their partitioning/replication
operations as long as it does not affect the tree you are residing in.

To do any partitioning/replication operations, you would have to use the
main ADMIN account to do so. This account must have with supervisory rights
from the [Root] of the tree. If everyone has that password, it would be a
major threat to the NDS tree.

An account with OU supervisory rights cannot do any
partitioning/replication operation.

Performing partitioning/replication also takes alot of planning before it
is done. It would also have to cater for fault tolerance and efficiency
of the NDS tree.

Basically, I have never heard of decentralising this function of the NDS.
There has to be a body/person that does it. Once it is
partitioned/replicated properly, it should not be touch thereafter unless
the tree grows extremely big.

Partitioning/replication operations are not thing that you do everyday.
It incurs alot of network traffic and server utilisation.

Also, if a person who does not have a clear picture of the NDS and how it
generally works, his actions on the tree can cause the tree to get
killed! Well... my compliments to Novell for the NW 4.1 tree... which to
date I have only crashed once, on a test tree of course,... as compared to
the NW 4.01 and NW 4.02 days.

------------------------------

Date: Fri, 24 Nov 1995 13:49:32 -0800
From: Virendra Kumar  Rode <virendra@NEXUS.CHAPMAN.EDU>
Subject: Re: Partitioning NDS on NetWare 4.1

>I'm talking to you from Salvador, Bahia, Brazil. Please, I'd like to know
>about the maximum number of leaf objects that i can create into a object
>container, and the ideal limit of objects into a NDS partition.

Partition Guidlines:

Default:
- No WAN Links.
- 15 or fewer servers holding replicas in a partition.
- 5000 or fewer objects in a partition.

If one the above is met then consider parttion the directory tree.

WAN:
Partition the directory tree so that the objects in the partition are on
a single server. This ensures that that any directory updates will be
performed on a single location.

Number of Servers:
If there are more than 15 servers holding the replicas of the parttion
then consider splitting the partition.

Server Proximity:
Once the decision has been to partition the directory tree , group the
servers in a single location.

Subordinate References:
If you are planning for a large geographic site then make sure that
subodinate ref. which are created automatically by NDS is distributed to
the regional organisation.

------------------------------

Date: Fri, 24 Nov 1995 14:26:54 -0800
From: Virendra Kumar Rode <virendra@NEXUS.CHAPMAN.EDU>
Subject: Re: Decentralized Partition/replication operation

>>>>We are battling for central control of partitioning and replication
>>>>operations.  Since everything is department based, every department
>>>>wants to do their own partitioning/replication operations.
>>>>Can you give some words of wisdom on what kind of damage a decentralized
>>>>partitioning/replication strategy can do to a 4.x environment if every
>>>>admin did whatever they pleased to their partition?
>>>
>>>Basically, I have never heard of decentralising this function of the NDS.
>>
>>Well, thats because you never had the need to do so in your organisation.
>>Imagine if you had a world wide or nation wide implementation of the
>>Directory Tree, would you perform Centralised or Decentralised approach.
>>That's something to thing about, each approach has is its pros and cons.
>>Agreed that centralised approach would make managing the directory tree
>>easier in terms of handling the entire tree but what if each IS or ECS
>>department of the remote location did not want corporate guys to
>>screw with lower layer of the directory tree. In that case you might
>>implement a decentralised technique.
>>If the department or branch had confidential data which they did not want
>>the [Root] level supervisor to have access they could simply implement the
>>IRF for the higher level ADMIN.
>>Agreed this implementation would create more layers but this kind of
>>implementation would depend on the kind of organisation structure you have.
>
>You're talking about a different subject here.  The original thread dealt
>strictly with partition management.  Your comments are valid for object
>management but really aren't relevant to partition management.  I don't
>see how there can be any justification in having decentralized partition
>management.

I am looking at the managment point of view. I am not saying that
decentralised is good management implementation but if you are in
a situation where your global distributed directory tree needs seperate
administrative handling then i guess each location will handle their own
location's DT administrative task.

------------------------------

Date: Sat, 25 Nov 1995 04:59:30 GMT
From: Gerald Khoo Seng Wee <cceksw@LEONIS.NUS.SG>
Subject: Re: NDS replicas

>We completed the installation of our network a couple of months ago with
>the following results: 10 servers spread among 8 OU's resulting in 9
>partitions.  One partition has 2 servers at 4.01 patched, the other 8
>servers are 4.02 patched.  DS is 310.  Each partition is at the end of
>a Frame Relay T1 circuit.
>
>Now it's time to fine tune the replica distribution.  The original
>installation created several subordinate reference replicas.  NWADMIN
>HELP said to create a read/write replica and the subordinate would
>disappear.  For two that's how it worked.  The third one left me with
>the following problem: If I view the partition with NWADMIN Partition
>Manager and click the Replica Button, it shows a read/write replica on
>the server that had a subordinate.  If I view the server that had the
>subordinate it shows it as still having the subordinate for the partition
>in question.
>
>How can I get that subordinate to change to read/write?  I have ran
>DSREPAIR on all servers. Errors have been fixed, but not this replica
>type.  I am using DSREPAIR 4.02.  DS is (310).

Firstly, I would advise that you get the latest DSREPAIR for 4.02, which
can be found in 4X241.EXE at ftp.novell.com. This file contains DSREPAIR
version 2.23. DS 310 is the latest for 4.02 already.

Now, Subordinate references are not something we create, but it is
something that is automatically created when a server which contains a
partition at a lower portion of the NDS tree and does not contain a
replica of the partition on a higher level, and vice versa.

Take the following tree for example and the number of servers:

			[Root]
			  |
			  |-- FS1
			  |
			------------
			|           |
		      Sales      Technical
			|           |
			|-- FS2     |-- FS3

Let us say that there are 3 partitions, [Root], Sales and Technical and
each server under that OU contains only the partition that it is in.
Hence, we can draw a table something like that.

		Partition
	Server  [Root]  Sales   Technical
	FS1     M       Sub     Sub
	FS2     Sub     M       ---
	FS3     Sub     ---     M

For this case, there are only Master (M) replicas.

The NDS tree stores its data in a loosely coupled database on different
servers. Hence for this example, the whole tree is made up of 3 databases
stored in the 3 server. To link the databases together, there must be
some links involved -- Subordinate links. Hence, we see that the Sub
links must exist for the whole NDS tree to be complete... and these Sub
links are something that is automatically created.

As mentioned in the references you have read, it tells you to change the
Sub links to R/W replicas. It isn't really a conversion, but it can be
seen more in the light that if a server contains a database above/below
the one he is containing, he need not hold that link any more. All this
adding or R.W replicas is done in the PARTMGR (Partition Manager)
program. There is  DOS version and a Windows version of PARTMGR. The
windows version id in the NWADMIN. If you have not got NWADMIN 4.10.2 or
NWADMIN 4.10.4, please get it. Older versions do not reflect the
existence of Sub refs when you look at the NDS tree.

Lets now say that I add a R/W replica of the [Root] partition to FS2. The
table will now look as follows:

		Partition
	Server  [Root]  Sales   Technical
	FS1     M       Sub     Sub
	FS2     R/W     M       Sub
	FS3     Sub     ---     M

Note the change in the relation of Subordinate references when the R/W is
added. Now if I add a replica of Technical to FS1, the table will now lok
like this:

		Partition
	Server  [Root]  Sales   Technical
	FS1     M       Sub     R/W
	FS2     R/W     M       Sub
	FS3     Sub     ---     M

And now if I add a replica of the [Root] partition to FS3:

		Partition
	Server  [Root]  Sales   Technical
	FS1     M       Sub     R/W
	FS2     R/W     M       Sub
	FS3     R/W     Sub     M

This is basically what happends as you go on...

There are some things that you have to take note...

1. The [Root] partition is the MOST important! It is always good to be
Kia-su (Singapore slang) about replicating it, but don't over do it else
there would be high overheads... usually have more [Root] replicas.

2. Always try to minimise the number of Subordinate References. This, you
would have to sit down with an NDS tree map and figure it out as how to
do so. At times, depending on the size of the tree and the kind of
network links (WAN, Ethernet, FDDI ?) that you have, you would have to
replicate it properly as replica synchronization take up bandwidth.

3. Each partition of less than 500 objects would be a nice figure, and
each server should not contains more than 8 to 10 of such replicas (and
also depends on the size, capacity, memory, utilization of your server).

4. Allocate sufficient disk space in the SYS volume for the replicas, and
add about 40 MB extra to that. You can check the size of your replica by
RCONSOLEing into the server, press <Alt-F1> and choose the Directory Scan
option into SYS:\_NETWARE directory. Add up all the *.NDS files to get a
rough gauge of the size of the NDS partitions in that server. The *.OLD
files in there are created when you did your DSREPAIR. Hence, there must
be enough disk space to do DSREPAIR (since it makes a copy of the
previous database) and add new replicas, etc, if needed.

------------------------------

Date: Mon, 27 Nov 1995 04:56:05 -0500
From: "Martin C. Mueller" <mcm@MATHEMATIK.UNI-KL.DE>
Subject: Re: Container Login Script

>Does anyone know if it is possible to have a container login script at
>the root that acts like a global login script for all containers below
>the root level?  Or, do you have to place identical copies of the
>login script in each container to get the same result?

NW executes only the container script for the container the user logging
in is directly contained in, so, no way.

Two other ways:
  - use "inlcude <scriptfile>" in al subcontainer scripts, so you only
    need to manage one file
  - use Profile scripts to do the same on a per-user basis.

>Also, I'm looking for sugestions on how to best setup my printing
>environment.  We only have one print server and eight queues distributed
>throughout the network.  Should I create a new container for the printer
>objects or just put them in an existing container?

Put them there, where the rights on them belong in the first hand. Their
location in the tree should reflect their location in your firm's
hierarchy.

------------------------------

Date: Tue, 28 Nov 1995 14:07:31 +0000
From: Mark Cramer <m.cramer@qut.edu.au>
To: netw4-l@bgu.edu
Subject: Re: ****** Why arent my trustee's correct? ***

>>>Im moving everything from an older IBM 3.11 server to a
>>>brandnew compaq 3.12 server.
....
>>>All of the accounts are there but, no trustee assignments.
>
>>Trustee assigments for files is not in the bindery, its in the
>>filesytem. NCOPY dose'nt copy trustee assignments.
>
>Try MIRROR v1.25b2 (from your favourite Novell ftp resource).
>Excerpt from the doc:
>
> Options may be supplied to also copy ownership information,
> directory and/or file trustees.  Ownership and trustee mirroring is
> done using the user name rather than the object ID as this will
> generally differ between servers.

The other way to get trustees (and directory quotas, volume quota,
directory flags etc, etc) is Netcopy from John Bairds excellent set
of NW utilities.  John's NDS aware utilities are coming along nicely.

Both Mirror and Netcopy are a lot faster than backup/restore and
Bindfix/Bindrest isn't the fastest way to copy the bindery. Wolfgang
Schriebers (or John Bairds) Bindclose/Bindopen and copy are a LOT
quicker to replicate the bindery.

------------------------------

Date: Tue, 28 Nov 1995 20:05:03 +0000
From: Richard Letts <R.J.Letts@SALFORD.AC.UK>
Subject: Re: NetWare 4.1 Replica Questions

>Need some input on replica/partition operations:
>
>Is there a limit to the number of replicas that can be placed on 4.1 server?

No - but be sensible!

>Is there a limit to the number of replicas that can be made of a partition?

No - but be sensible. Realistically you need three in most schemes. If you
have lots of replicas they consume time being synchronised.

>Does a subordinate reference cause the same amount of network traffic as
>a Read/write replica?

No - only the objects necessary are replicated using subordinate references;
however if you have alot of them it mught be better for you to have  a RW
replica.

Let me explain our [planned(1)] replication scheme:

One server (yet to be bought; the office test server is currently in use for
this purpose) holds master copies of all of our partitions. This is currently
a DX50 EISA system with 32MB of memory. It will be replaced by a P120 system
with 64MB of memory and duplexed disks.

The tree itself is partitioned into OUs (one per filestore-server),
and a number of OUs for services, like the printing service,
CD-ROM servers, Lab Servers, etc. The choice of filestore-server
partitions/ous was to enable easy use of bindery emulation. I did not want to
go to the effort of rolling-out VLMs, only to replace themn with the client32
a month or so later.

CD-ROM servers hold replicas of the cd-rom parition, lab-servers hold a
replica of the lab-partition, etc.

The Servers holding staff and/or students in a department hold replicas of
the fileservers holding the users in the department.

eg.
  server       users on it               partitions
  Newton-A == Aero-Mech Staff         === Newton-A
	      Maths&Comp-Sci Staff        Newton-B
					  Newton-C

  Newton-B == Aero-Mech Students      === Newton-B
					  Newton-A

  Newton-C == Maths&Comp-Sci Students === Newton-C
					  Newton-A

And so on...where we end up with less than two partitions using this method
we create a replica on a nearby user-server for another department.
eg, CWB-A is replicated on Kochanski(*), CWB-A, Cockcroft-B, and Crescent-1.
(master NDS, our staff server, chemistry server, and an applications server
respecitvely)

Finally, we create a replica on a DISTANT applications server(2), so that
should lightning strike one of the buildings and knock-out the replicas in
it there will be two left over (one on the master NDS server, and one on
the remote applications server)

Mass-user-registration is done against the master NDS server; from
experience it is best to stop(3) it syncronising with the rest of the
tree during this operation as the Sync. traffic can kill the server's
performance.
----------------------
(1) this is currently being implemented; as servers are upgradede to 4.1 they
are grought into this scheme. It's working okay so far.
(2) these are EISA straight-DX50 systems with bus-mastering cards in them.
built to allow 50 people to start wordperfect at the same time without blowing
a gasket.
(3) to do this you tell DS.NLM not to talk to other DS.NLM with revisions < a
big number... this stops the sync in a 'nice' manner.
(*) Kochanski was Dave Lister's girlfriend in Red Dwarf. the other names are
those of buildings; following digits refer to applications servers, following
letters to user filestore servers. At one time we named servers after dwarves
in 'The Hobbit' however the location was based upon the distance from my office,
and the order in which they arrived at Bilbo-Baggins' hole;  I was the only
person who could remember the order so it wasn't much use to anyone else :-)

------------------------------

Date: Tue, 28 Nov 1995 19:25:46 GMT
From: "Khalid Zia [348]" <kz@MHCNET.ATT.COM>
Subject: Re: Partitioning NDS on NetWare 4.1

>What are the maximum number of leaf objects I can create in an object
>container, and the ideal limit of objects into a NDS partition.

According to Novell's documentation, there is no limit on the number
of objects in a container (displaying a very large number
of objects may be a problem though). The max. allowable partition
size is 100,000 objects (usually 5,000 is recommended for
performance reasons).

Khalid

------------------------------

Date: Wed, 29 Nov 1995 08:29:52 PST
From: Brian_Weatherill@ea.xerox.com (Weatherill,Brian)
To: floyd@direct.ca
Subject: Creating Inherited Login Scripts

Creating Inherited Login Scripts:

A useful, but undocumented feature of Netware 4.1 is the ability to
include the login script from the parent container.  You may only
inherit one level of login script, as shown by the example below:

Take the tree:		O=corp
			  |
		OU=east--------OU=west
		  |		  |
		OU=NYC		OU=LA

If you want to have a common service available to everyone in the
eastern region, say a timesheet system or some such, create the
following login script for the OU=east.O=Corp container:

	map errors off
	map display off
	map x:=S16:=.CN=directory_map.OU=east.O=corp:

This script simply maps drive X as the last search path
The 'feature' is included in the container with the target users
in it, the OU=NYC.OU=east.O=corp container
Create a script for the NYC container similar to the following:

	map errors off
	map display off
	include .
	map Z:=S1:=public_DM

	etc. as per usual script

The significant line is 'Include .' which executes the login script for
the parent container.  You may also include a specific object name, or
 .. to execute the script two levels up.

You can now create login scripts that are propagated down through the
tree.  This effect is not cumulative, you cannot have an 'include .'
statement in the OU=east container.

------------------------------

Date: Wed, 29 Nov 1995 18:24:06 +0000
From: Richard Letts <R.J.Letts@SALFORD.AC.UK>
Subject: Re: NetWare 4.1 Partition Questions

>Here is a design question.  Tree is as shown below:
>
>	      ORG
>	       |
>    ----------------------
>   |          |           |
>  NYC        CNJ         BOS
>   |
>---------------------------------------------
>|       |        |        |        |        |
>Dept1  Dept2   Dept3    Dept4    Dept5    Dept6
>
>The NYC OU is all encompassed in 1 building with about 10,000 objects.
>Following the guidelines of 5,000 objects per partition, one could make 2
>partiitons
>What would be advanatages if one made a separate partition for each
>department. Partition operation will be centralized, whereas container
>administration will be decentralized.

I assume NYC=new York? CNJ=New Jersey, BOS=Boston

Depending upon what capacity the links were between these sites, you would
want to keep the number of replicas shared between the sites to a minimum.
NDS is quite a chatty protocol, and mass syncronisation traffic can swamp
slower links. I'd partition the tree across the WAN links so that only the
(small) root and any subordinate references were plreicated across the WAN
links (of if these are T1 or greater this isn't necessary). Only changes
are transmitted in the sync. operations, unless you choose 'send all' from
ds-repair, or you are creating new partitions (tip: do this sort of
operation late at night, the traffic is high). I have been told that later
versions of DS will have the ability to scedule sync. operations more
flexibly, which will be helpfull in some situations.

The important piece of information missing is the distribution of
fileservers: it is a good idea to have a number of replicas close to where
the users are, and one a bit further away in case of disaster.

I would tend to partition by department, and insist that one partition was
held outside the department on a central machine (say). The way to approach
NDS design is to minimise the replicas across slow links, and to imagine
what you would be doing if you were looking at storing backups of your data.

Replication is there to make access of the data fast (because it is local),
secure (becuase copies ate kept repmotely) and reliable (because it gets
backed-up automatically)

------------------------------

Date: Wed, 29 Nov 95 15:17:00 PST
From: Mark Hashiguchi <MHashi@msmail.radisys.com>
To: netw4-l <netw4-l@bgu.edu>
Subject: RE: NDS Containers - How much is too much?

>I have a client that is merging to Netware 4.1.  They have many
>departments/sections, and many printers, shared drives, etc. are
>logically separate by sections.  They also have 13 floors, and each
>floor has similar characteristics, floor printers, etc...
>
>The question is, what is the better approach to building the NDS tree?
>Do we logically separate each section into its own container, or do we
>separate the floors into containers.  The departments sounds like the
>better choice, until I mention there are 65 sections.
>
>Any reactions?  We are looking at a site of 800+ people, 13 floors, and
>65 sections.  Is dividing the NDS into 65 containers too much, or will
>65 containers be easy to manage???  Should they rather separate by floors
>instead?

I would organize NDS around the organizational structure since I tailor
login scripts, trustee assignments, groups, printers, etc., around groups
that work together rather than around people who happen to work on the same
floor. In my experience, people from disparate groups can occupy the same
building, floor and/or office eventhough they have nothing to do with each
other and may in fact operate quite differently.

You may reduce the granularity of the groups a bit and "boil down" the 65
containers down to say 15 organizational units that really do behave in the
same way, i.e., have the same drive mappings, same applications, trustee
assignments, etc., and make some of your other distinctions with profiles
and groups.

------------------------------

Date: Wed, 29 Nov 1995 21:50:36 -6
From: "Mike Avery" <mavery@aus.sig.net>
To: netw4-l@bgu.edu
Subject: Re: NDS Containers - How much is too much?

>I have a client that is merging to Netware 4.1.  They have many
>departments/sections, and many printers, shared drives, etc. are
>logically seperate by sections.  They also have 13 floors, and each
>floor has similiar characteristics, floor printers, etc...

>The question is, what is the better approach to building the NDS
>tree.  Do we logically seperate each section into its own container,
>or do we seperate the floors into containers.  The departments
>sounds like the better choice, until I mention there are 65
>sections.

>Any reactions?  We are looking at a site of 800+ people, 13 floors,
>and 65 sections.  Is dividing the NDS into 65 containers too much,
>or will 65 containers be easy to manage???  Should they rather
>seperate by floors instead?

Novell's early recommendations were to divide up the structure strictly
by organizational units (sections).  However, examination of that
principle revealed high amounts of traffic on WAN links.

The second suggestion was to break up the NDS by geography, and then
by organizational structure.

You mention that there are 13 floors, but it is not stated whether
those 13 floors are in a single building, a campus, or distributed
across the country.  Enough information is provided to suggest that
the single building is probably the correct answer.

With a reasonable backbone in place, and if there are no plans to
relocate organizational units to areas that are not on the same
campus, I think that structuring the NDS tree to follow the
organizational structure is not going to cause terrible network
traffic problems.

Of course, that's not the end of the matter.  Structuring the NDS to
follow the organizations' structure leaves the system manager in a
bind - when reorganizations occur, lots of work has to be re-done,
often for no real reason.

As has been pointed out many times, reorganizations are often about
as meaningful as rearranging the deck chairs on the Titanic.  The
same people wind up doing pretty much the same work and
communicating and sharing data with pretty much the same people.
(And the ship is still sinking.)

So, what would I do?  Or more to the point, what have I done and what
were the results?  My organization extends from Texas to central
Europe.  The WAN traffic issue is quite signifigant to me.

As a result, I created a NDS tree that first concentrated on
physical location, then on the organizational structure.  I
conentrated first on the city, then the building within the city,
and then on the organizational unit.  The added granularity of
specifying the floor was not signifigant.  The performance has been
quite good, once we reigned in partition mirroring.

In the situation discussed above, I would look at the structural
stability of the company and then cover my butt.  Or - I'd first
organize by geographical area (floor), then by organizational
unit (section).  Fortunatly, with 4.1, restructuring the tree has
become pretty easy to manage, so the decisions we make today can be
revisited when they no longer serve us.  From what I've seen, I
don't think that 65 organizational units is a real problem.

The suggested structure would allow the company to move to other
parts of the city - or world - without catastophic levels of WAN
traffic, and would accomodate changes to the organizational structure
quite well.

Printers are always problematical - no matter what you do, someone
will point out you are wrong.  I would place the printers at a level
in the NDS above the organizational units, or at the level based on
geographical location, so that anyone in the area could use the
printers, unless there was a compelling reason to restrict the
printers to specific sections (check writing printers, high quality
color printers, large plotters are examples of resources that should
probably be restricted).  My own preference is to treat printers as
shared resources and let everyone use them - that reduces the overall
number of printers - but I also realize that many people do not share
my views.

One other consideration is to allow everyone to use every printer.
We have realized considerable savings by distrubuting documents via
distributed printers as opposed to physically mailing actual
documents.  Our librarian can send the results of a data base search
to her users as an email document, or print them to a printer near
the user.

I hope this gives you some food for thought,

Mike Avery

------------------------------

Date: Thu, 30 Nov 1995 01:53:28 -0500
From: BrianChi@aol.com
To: netw4-l@bgu.edu
Subject: Re: NDS Containers - How much is too much?

I have just completed converting 600 people to 4.1.  Let me recommend
organizing them by organization.  If the floors have different departments
it will be tremendously more difficult to organize and maintain NDS.  NDS
was designed to organize departments and there interconnectivity.  While
geographic condsideration may require several containers per department,
this is ususally dependant on WAN traffic, not LAN traffic if the LAN is
properly developed.  One thing to consider, if any of the users in the 65
containters need to access your tree in bindery emulation, you are limited
to 255 caracters for the total length of you bindry context, so keep you
context's short.  We had 9 departments in one NetFrame superserver and the
combined bindery context of all the departments exceeded the limit of
bindery contexts allowed.

------------------------------

Date: Thu, 30 Nov 1995 05:45:41 -0500
From: SNanni@aol.com (Scott Nanni)
To: Netw4-l@bgu.edu
Subject: Re: NDS Containers - How much is too much?

A point to keep in mind is after you have layed out your NDS tree, you
should be able to easily layout your partitioning and replication scheme.
The size of your LAN/WAN is an important factor.  Are all users in the same
building, how many servers, what are your growth plans, etc.?  Using
geographical locaters is very important for proper partitioning.  If you
have say half a dozen servers scattered throughout the building maybe you
can live with one partition and putting replicas on key servers.  If you
have multiple facilities you may want to partition at each facility.

Proper NDS tree design makes all of this much easier to deal with.  Good
general guideline, geographical locators, then company structure, but
every installation is different.

------------------------------

Date: Thu, 30 Nov 1995 11:14:16 -0600
From: Joe Doupnik <JRD@CC.USU.EDU>
Subject: Re: '_' in the name of a bindery object

>Could someone give me some ideas why the objects with a
>"_" in their name created by a bindery call appear in the NDS with
>a " " instead of the "_"?
>
>Is it a "feature" ?
------------
	Yes, it has been a feature of NW 4 since day one. That is why the
Utah Standard for naming/numbering IPX objects specifies a hyphen ("-",
dash, minus sign) as a joiner.
	Joe D.

------------------------------

Date: Thu, 30 Nov 1995 17:04:09 -0600
From: Joe Doupnik <JRD@CC.USU.EDU>
Subject: "Novell's Vision of Distributed Services"

	<snip> the current
issue of Novell Developer Notes has a interesting article by Drew Major,
the Chief Architect of NW, on where distributed services are going over
the long term. Distributed resources, including a file system abstracted
one level to separate filenames/locations from the physical storage spots
(plural, in case there are copies on the net and/or local drives), covers
just about all networking actions. I can't reproduce the material here,
naturally, but you can obtain a copy from Novell: 1-(800) 394-5088 /
1-(801) 342-3451, for a small charge. The article title is "Novell's Vision
of Distributed Services" in the Nov 1995 issue. Many interesting concepts
are expressed in it. It reads as a transcript of one of Drew's oral
presentations: lots of pauses for reflecting "Hey, that's a clever idea."
	Joe D.

------------------------------

Date: Fri, 1 Dec 1995 00:15:01 GMT
From: Art & Barbara Lamb <ablamb@TIAC.NET>
Subject: Re: Book info needed on NDS and Netware 4.1

One of the best that I have found is "NDS Troubleshooting"
by Peter Kuo & Jim Henderson, New Riders Publishing.

Art

------------------------------

Date: Fri, 1 Dec 1995 08:45:46 -0500
From: Kevin Webb <webbk@nmbnet.army.mil>
To: netw4-l@bgu.edu
Subject: Re: Movious Users

>My question is related to the 65+ containers question.
>
>We are in the process of setting up a WAN, which will connect 5 LAN's
>throughout the city.  Everyone in the organization has a desk at one or
>another site.  So it makes sense to place them in the sites container.
>As long as they are at their site logging in is simple.
>
>But my question is, what happens when they want to log in from another
>context (site).  Is it a training issue, have them login with their long
>name joe.users.downtown., and hoping that they get the dots in all the
>right places?  Or is setting up aliases easier, of course there are 100
>users and 5 sites?  Is there a way for login to search up the NDS tree,
>then back down?  It seems to only search backwards to the root, but
>doesn't seem to bounce back.  To me that would be ideal.

We fought with this problem when we first changed over to 4.1.  There is
no clean way (you can try writing batch files and such to process error
messages from the user not bring in the proper context and try another
context, but like i said nothing clean.) to have the login search the nds
the best solution is to set the "name context=" in the net.cfg file on
each users desktop to the context the are in, then make sure the
containers they are in in the nds tree as closely represent the users
view of where s/he works.  Eg. user.department.organization.location,
then do your best to explain to themthe login process using their full
name.  We have 500 users and got plenty of questions, but works ok for
the most part.  I am located in one building....one thing you have to
worry about being in multiple sites is access to network printers and
other resources that are unique to each location. in this instance
aliases for the travelling user is probably best.

------------------------------

Date: Fri, 1 Dec 1995 16:35:59 GMT
From: Jason Lamb <jdlamb@INDIRECT.COM>
Subject: Evaluate DS Expert for NetWare 4.1

NetPro's DS Expert 1.0 is now shipping.

For info and to evaluate DS Expert visit NetPro's World Wide Web site:
	http://www.netpro.com/

DS Expert is the first network management tool for NetWare 4.1 networks
that provides realtime, centralized NetWare Directory Services (NDS)
monitoring, troubleshooting, and optimization information. DS Expert
provides the information necessary to monitor your NDS database, as well
as the information needed to troubleshoot NDS problems, via a Windows
Client. DS Expert also provides NDS statistical information which can
be used to optimize the design of your NDS database.

DS Expert monitors the structure and activity of NDS by both reading the
NDS tree, and by receiving information from DS Expert Agents, which are
installed on NetWare 4.1 NDS servers. Alerts and alert thresholds, NDS
statistics, and NDS tree information are accessible through the DS Expert
Windows console. DS Expert also provides a Windows based, multiple server,
DSTRACE console, for viewing and analyzing DSTRACE "conversations".
DS Expert uses a monitor / agent NLM architecture to minimize network
traffic. This architecture also includes DS Expert agent software
distribution and version control.

DS Expert Features:

	NDS Network Views
	NDS Alerts
	Server Alerts
	NDS Statistical Information
	Multi-Server Trace

------------------------------

Date: 01 Dec 95 09:48:05 EST
From: Deepak Bhatia <70404.1143@compuserve.com>
Cc: NW4 Mailing List <NETW4-L@bgu.edu>
Subject: RE: Movious Users

Scott:

With SFLOGIN from Network Design Systems Pty Limited, a user can login
from any context using their common name or one of the names listed under
'Other Names'.  This program replaces the old FLOGIN.

SFLOGIN allows users to login from any context, without specifying a full
or partial name.  It searches the NDS tree before login, to locate
specified objects (Wildcards supported).  SFLOGIN can emulate the
appearance of the Novell LOGIN, or provide a customizable full screen
interface.

PacMan :-)

------------------------------

Date: Mon, 4 Dec 1995 21:29:34 -0800
From: Virendra Rode <virendra@NEXUS.CHAPMAN.EDU>
Subject: Re: Can the NDS Tree span two diff nets addr

Re: Can the NDS Tree span two diff nets addr?
>Yes it is possible.  That is the very reason for the development of NDS,
>to span multi-site networks.  HTH.

Agreed, but what kind of link are we talking about. You want to make sure
when partitioning the tree for multiple organisation site the partition
crosses via high speed link otherwise the updates which takes place won't
be done efficiently.

Make sure you do not create too many partition which will suffer from the
following:

* Administrative overhead. Handle may replicas for the new partitions and
subbordinate reference which created automatically by NDS.

* Nagivagating of the tree becomes difficult because of multiple layers.

* Creates minor network traffic.

The upper-layer of the directory tree after the [root] is defined by
  the physical location and network infrastructure.
The upper-layer is setup at the individual site.
The upperlayer at the single site is defined by number of objects within
  the branch containers and not by the  physical location.
If the network bandwidth is the criteria then create fewer partition and
  replicas of the tree, which will further reduce the synchronization
  process.

The lower-layer is defined by the organization level.
The directory tree defines the lower-layer at the organization,
  departmental and workgroup structure.

Lower-layer of the directory tree is defined by the number of objects
  within branch container and make sure that size of the tree is sufficient
  and holds not more than 5000 objectsin agiven partition.

Virendra Kumar Rode

------------------------------

Date: Wed, 6 Dec 1995 04:58:25 GMT
From: Gerald Khoo Seng Wee <cceksw@LEONIS.NUS.SG>
Subject: Re: NDS Replica Synchronization

:Generally speaking, would increasing the number of partitions
:(i.e., making more but smaller partitions in a tree) increase
:the amount of replica synchronization traffic? Why (or why not)?
:Khalid

If you make your partitions smaller, the affected NDS database would be
smaller. If I am not wrong, there are certain NDS activities that make
immediate synchronization (e.g. account creation and deletion) and some
wait till the scheduled time to sync. I think it would reduce the amount
of traffic for the full sync if the partitions are smaller. It should be
faster to sync too... being a smaller database. But with smaller
partitions, you should spread them to multiple servers or even set up
replica servers to ease the load of the original server that was holding
the partition. If you split up to smaller partitions but still on the
same server, I don't think there would be much difference.

------------------------------

Date: Tue, 12 Dec 1995 12:41:15 GMT
From: Gerald Khoo Seng Wee<cceksw@LEONIS.NUS.SG>
Subject: Re: Deleting a Server in Novell 4.1

>We have a Network with some 3.12 Servers. Now we have begun to insert some
>4.1. We had no problem in doing it, but some time after we decided to
>modify the NDS structure. We moved a server because it was in a bad
>Organization Unit. But the server is not actually moved! We have also
>tried to delete it, but we haven't succeeded. The Netware Administration
>Utility (nwadmin)tells us that the server is currently being moved, and
>we can't delete it by the moment.  We have tried using dsrepair, but no
>good results have been obtained. The code error obtained is:
>	80155:-637 The partition is in process of sincronization to
>	complete a previous process of translating.
>Could anyone help us? Thanks in advance.

To move a server object from one OU to another this is what you have to do:

1. Use NWADMIN or NWTADMIN to move the server object in the tree
2. Go to the server console and do the following:
3. Type "set dstrace=on"
4. Type "set dstrace=+limber"
5. Type "set dstrace=*l"
6. Toggle to the DS screen and check the DS screen for the message
   Limber:
   start connectivity check and limber: end connectivity check.

------------------------------

Date: Wed, 13 Dec 1995 02:13:37 GMT
From: Gerald Khoo Seng Wee <cceksw@LEONIS.NUS.SG>
Subject: Re: School Server Crashed? No Response/But Hardware is fine? Any ideas?

>We're running a novell netware network at school, and apparently the
>entire thing just crashed today and i have a feeling it has to do with
>the server.  The setup:
>	1 Server running novell netware
>	6 Clients..
>	All of them are using SMC-8000 cards..
>It appears as if the clients can no longer access the server.  We've
>also run some tests to check for bad cabling, and it appears that the
>cabling is fine between each client->server, and even a
>client->client.  They each were able to get a test message to each
>other.. So its not cabling, or routing...
>
>So we've pretty much got it narrowed to the server -- which pops up
>with a strange little message as its booting up that i dont quite
>catch.. it beeps, and a tiny error message goes flying by something
>about:  "Cannot locate local database, please use
><something>repair.??? to try to fix it."  Or something like that.. It
>looks negligible, since after that it boots up fine.  The deal is now
>none of the clients can access the the server!  For instace if i type
>F: from a client (F: being on the server) it sits there for say.. 15-20
>seconds then dumps back to C: without giving any message at all..  Its
>like its no longer hooked up..  Any ideas?  Could it be that lil error
>about Local database not found that could be doing this?

I believe the message is to run the DSREPAIR. I have encountered a
situation similar to yours. As long as the DS does not get loaded, or is
unable to load, no one is able to login. What you should normally see in
the system console's MONITOR would be something like this:

  Server name: 'XXXX' in Directory tree 'YYYY'

when the DS is unable to load, all yo will see on that line is:

  Server name: 'XXXX'

The server will bootup fine and you will see all your screens, but no one
will be able to login.

Do an unattended DSREPAIR, and keep your fingers crossed that the
DSREPAIR would solve all the problems. If it doesn't work, call up Novell
Tech Support for them to dial in to repair your NDS.

------------------------------

Date: Thu, 14 Dec 1995 22:10:21 GMT
From: Khalid Zia <kz@MHCNET.ATT.COM>
Subject: Re: NDS Replica Synchronization

: : Generally speaking, would increasing the number of partitions
: : (i.e., making more but smaller partitions in a tree) increase
: : the amount of replica synchronization traffic? Why (or why not)?
: : Khalid

: If you make your partitions smaller, the affected NDS database would be
: smaller. If I am not wrong, there are certain NDS activities that make
: immediate synchronization (e.g. account creation and deletion) and some
: wait till the scheduled time to sync. I think it would reduce the amount
: of traffic for the full sync if the partitions are smaller. It should be
: faster to sync too... being a smaller database. But with smaller
: partitions, you should spread them to multiple servers or even set up
: replica servers to ease the load of the original server that was holding
: the partition. If you split up to smaller partitions but still on the
: same server, I don't think there would be much difference.

According to Novell's documentation, when replicas are synchronized,
only changes are sent over the network (e.g., user's phone number change)
instead of sending the whole replica. So, I think the size of the replica
would not affect the sync traffic. There are however two types of
sync: immediate, and periodic, but the replica size should not affect
sync traffic in either case. Comments?

------------------------------

Date: Mon, 18 Dec 1995 14:15:13 -500
From: Mark Nguyen <MARK@ARLHOSP.ORG>
Subject: IPXRTR NCP Work To Do

>>>Sounds like you have a serious NDS problem.  Go to server console
>>>and enter:
>>>	SET DSTRACE=ON
>>>	SET DSTRACE=+ALL
>>>	SET DSTRACE=+SYNC
>>>	SET DSTRACE=*H
>>>Switch to the DSTRACE Screen and watch for any unsuccessful
>>>updates and/or errors.  If you do have problems, I would
>>>recommend contacting a NASC or Novell Tech Support directly,
>>>unless you are a NDS troubleshooting expert.
>>
>>This is not a NDS problem. We've just spent several months getting
>>to the bottom of this one. It's related to packet burst and the
>>VLMs.  Novell have a patch called PBRSTOFF which disables packet
>>burst on the server. It took our utilisation from 80-100% down to
>>0-30%.
>>I'm not sure the patch is generally available but they will give it
>>out on demand.
>
>As with most network problems, several problems can produce the same
>symptoms.  Sounds like you also need to check your LAN configuration.
>Generally, PBRSTOFF is only used at the direction of Novell Tech
>Support when troubleshooting actions deem it necessary.  There isn't
>any inherent problem running VLMs with Packet Burst (It's on by
>Default) on a NetWare 4.1 server.  The "IPXRTR NCP Work To Do" problem
>I experienced was indeed caused by damaged NDS Replicas and
>unsynchronized NDS Schemas.

We set all the DS trace paramters (mentioned above) ON and there are
no errors.  Yet our IPXRTR NCP Work To Do is still unusually high (70-
90%).  I tried to find PBRSTOFF.NLM (as recommended above) everywhere
without any success.  We have checked and double checked and triple
checked everything else on the server and everything checks out fine.
Could our problems stem from the client.  We have VLMs 1.2a installed.
What should I do now?  (Performance does not seem to suffer that much
even though utilization is high).  All the lastest release patches
have been installed.

------------------------------

Date: Mon, 18 Dec 1995 19:05:23 GMT
From: Teo Kirkinen <kirkinen@CC.HELSINKI.FI>
Subject: Re: Designing a large, stable network

>Depressingly familiar - we have 10 servers running NW4.1 and have
>been plagued with Page Fault Abends, we also had a major NDS 'crisis'
>which required Novell European Tech Support to dial in to fix it.

Yes, this sounds familiar ;-) Only about one third of our servers (but
those that are the most heavily used) suffered from PFPE's. 410IT5
cured most of them. We have had two or three severe crisis with the
NDS but we are learning all the time.

We haven't had the pleasure to use Novell's European support service
because their Finnish representative (LAN Group Inc) is very very slow
in responding to support requests.

>I only wish I had the opportunity to get away from NW4 - frankly I do
>not believe it can hack a real situation with thousands of users!

But what other NOS could? I don't believe that Windows NT is yet any
better - maybe in a couple of years. Netware 3.x won't be available
very long - my guess it that it will be discontinued in 1997.
I think that the key to managing thousands of users with Netware 4.1
is having enough servers: two servers for each 5000 user accounts.
The first one for the master replica of the NDS partition and the
second one for the file and print services (with a RW replica). Having
(we don't have yet) so many servers to keep the NDS in good health
makes it easy to have enough server capasity for more than 1000
simultaneous users ;-)

------------------------------

Date: Tue, 19 Dec 95 10:14:20 PST
From: "Bala Sadras" <bsadras@link.dcmdw.dla.mil>
To: netw4-l@bgu.edu
Subject: Re: Centralized Management & Master Partitions

>If centralized Management of NetWare 4.1 is to be implemented, what are
>the pros and cons of locating all Master Partitions in one location?

If your 4.1 servers are linked by WAN locating all Master Partitons in
one location will create lot of WAN traffic coming to your central
location.  Since NDS is a distibuted global database, it is designed
with keeping NDS partitions distributed so that you have at least 3
copies of the partiton.  From the WAN point of view keeping the three
replicas with the fastest links will be ideal.

------------------------------

Date: Wed, 20 Dec 1995 16:42:01 EST-10
From: "Frank Hooper" <F.Hooper@hbs.gu.edu.au>
To: netw4-l@bgu.edu
Subject: Re: Centralized Management & Master Partitions

>If centralized Management of NetWare 4.1 is to be implemented, what are
>the pros and cons of locating all Master Partitions in one location?

Cons:
If  by one location you mean on one server then if that server crashes
you will have lost _all_  your Master replicas rather than 
only a portion of them.

Depending on how many partitions you have, making the one server 
Master of all partitions will mean the Read/Write and Read replicas 
will access that one Server when updates are propagated. This will 
put an undue load on the server.

------------------------------

Date: Thu, 21 Dec 1995 22:45:41 -0800
From: rgrein@halcyon.com (Randy Grein)
To: netw4-l@bgu.edu
Subject: Re: Change NDS Tree Name

>Can I change the name of the NDS tree?  If it can be done, how?

Not really change, (technically), but this is as good:

Create a new tree with the name you desire. Then use dsmerge to import the
existing tree! simple, eh?

------------------------------

Date: Wed, 27 Dec 1995 22:00:27 -0800
From: rgrein@halcyon.com (Randy Grein)
To: netw4-l@bgu.edu
Subject: Re: 4.x Partitions and security

>What is the best way to setup partitions for individual Departments in
>such a way that the individual departments can do their administrative
>tasks without jeapordizing partition and replication operations of the
>NY OU?

You sure you want them managing partitioning? You must have a HUGE network
for that to be necessary. Be careful, what they do CAN affect the
partitions that contain the NY OU, but nothing higher. Make sure you give
an admin user higher up explicit full access to each of the lower OUs, that
way when someone fouls things up and filters out all rights from higher
partitions you're not locked out.

>What rights are required to place a Master  or Read/Write Replica
>on a server?
>
>OU=NY
> |---------------------|---------------------|...
>OU=Dept1     OU=Dept2          OU=Dept3

You've got to have supervisory access to that OU, but I can't remember if
you need rights higher up. I'd think so, but can't prove it. Yet.

------------------------------

Date: Thu, 28 Dec 1995 20:50:55 +0300
From: "Alexander E. Arm" <alarm@MODULE.VYMPEL.MSK.RU>
Subject: Re: Context Problem

>I am having a problem logging in to a 4.1 server.  During the login process
>a message stating that the context ktg.smat.sprin does not exist. The login
>then procedes by using the server context mktg.smat.sprint.  The first and
>last characters of the context are droped for some reason.  The NAME CONTEXT
>= mktg.smat.sprint is set correctly in my net.cfg.  I also see the same
>problem loading nwadmin.  When nwadmin loads it tells me that the current
>context ktg.smat.sprin does not exist and procedes to use the root. I have
>attachments to both a 3.12 and 4.1 server but the same thing happens is I
>just login to the 4.1 server. I am using VLM 1.20b and have had the same
>problem using 1.20. Has anyone seen this before?  How can I fix it?

Place double quotes around context name in NET.CFG.

------------------------------

Date: Thu, 28 Dec 1995 23:02:44 -0800
From: rgrein@halcyon.com (Randy Grein)
To: netw4-l@bgu.edu
Subject: Re: renaming server that holds master partician.

>I have two servers in the same tree where the names & volumes
>associated with it must change to our name standard. I realize
>that the autoexec.ncf must change, the associated login script
>references must change, any references to a particular server
>in the win.ini may need changed, as well as the volume names
>& server names in the NDS structure. My question is this:
>
>Is there a proper order to make such changes so that the
>NDS updates accordingly?
>
>I am worried about changes in the
>server that holds the master replica.

Jan, don't forget that you've got time server names that need to be
changed. The login script, ini file and autoexec.ncf changes can be made
first as they won't take effect til later, or you can change them MUCH
later by changing the names in DS then creating alias objects with the
original names. Good luck.

------------------------------

Date: Thu, 28 Dec 1995 23:02:49 -0800
From: rgrein@halcyon.com (Randy Grein)
To: netw4-l@bgu.edu
Subject: Re: Replicating NDS over 56kb WAN

>I will be updating a 3.12 server to 4.x tomorrow across
>town and will be using Compaq SmartStart to do the upgrade.
>At the time the NDS is built I would like to insert it into
>our Main Tree because it is a small site and once configured
>will have few changes. Here is my present configuration....
>
>(orginal)                               (new )
>
>   O=B_Inc  (tree)              O=B_Inc (tree name)
>    |                           |
>    |                           |
>    - OU=HQ                     _ OU=HQ (AND ALL PREV OBJECTS)
>      |                         |
>       _ hq_server1             - OU=P2 ( AND ALL ITS NEW OBJECTS)
>       - hq_server2
>       - users, printers, etc.
>        .
>        .
>        .
>
>I know this is a valid structure but I am concerned about 2 things:
>
>        1. Replicating to my Master hq_server1 over a 56Kb line
>        2. Performing 3.12 to 4.x upgrade & inserting into tree
>                in one step.

Jan, the replication won't be any big deal if you partition things
correctly. Novell has some very nice standards for this now; I've applied
them and come off looking like a wizard! Simply create a partition at OU=HQ
down to root, then after you've installed the new server into the tree
partition it OU=P2; then use the partition manager to place the master of
that partition on server hq_server1, a rw partition on hq_server2, and a rw
partition of OU=p2 and the root partition on the new server. You'll have
very little replication traffic, and it will be a snap to login, manage,
etc. BTW, as you're upgrading I'd do it in two steps. Make sure you've got
a good backup!

------------------------------

Date: Sat, 30 Dec 1995 09:35:05 GMT
From: Teo Kirkinen <kirkinen@CC.HELSINKI.FI>
Subject: Re: Bindery Emulation & R/W Replicas

>Say there are 10 4.x fileservers in a OU that is its own partition.
>3 of those servers have Read Write Replicas of the partition, and 7
>don't. Is there any way the other 7 servers FileSystems can be accessed
>via Bindery Emulation by 3.x users running either netx or vlms.

The only way is to put a RW replica on each server.

Perhaps you should re-design your NDS-tree? You may have too many users
in one partition if you need 10 servers to serve them.

------------------------------

Date: Fri, 29 Dec 1995 08:50:27 -0600
From: Patty Smith <Patty_Smith@MAIL.UND.NODAK.EDU>
To: netw4-l@bgu.edu
Subject: renaming server that holds master partician. -Reply

During a $200 "service call" with Novell, we learned the hard way that
you should NEVER rename a 4.x server or tree.  This advice came from
Novell's "back room" technicians.  He said that the server name
is used to generate the time stamp which is placed on every
object, file and transaction.  Even though Novell's software will allow you
to change the name, it is strongly discouraged because it does not
update the time stamps.

Your best bet would be to bring up a new server (you can get 2 user
licenses from Novell for $50), move the objects to the new server, then
properly remove the old servers.  Then reinstall Novell on the old servers
and bring them into the tree.  Then transfer the objects back to the old
servers.  You WILL lose some object rights with this, so be sure to have
written documentation on all object rights.

We just accomplished this recently and it went surprisingly smooth.
There are some tricks involving the removal order of objects and
replicas.  If you would like more specifics, please e-mail me directly.

------------------------------

Date: Mon, 1 Jan 1996 23:20:00 MET
From: "Arthur B." <arthur-b@ZEELANDNET.NL>
Subject: Re: Admin/Supervisor

>The netware 4.10 manual advises that one gives the administration
>privileges to a supervisory account and restrict the default admin
>account.

And a panic-account I hope -- an account at root-level in the NDS-tree
which has the same rights to the root-object (not the volumes) as admin
has (but is *NOT* security-equivalent to admin)

Novell probably means that you shouldn't use admin for your daily
maintaining. They suggest to use another account for that and use
admin as little as possible.

And 'administration' is/are the people who maintain the entire network.
Like: network-administrator.

>Can someone tell me what would be involved to give this access to a
>different account.  I'm very concerned about restricting the admin
>account before I'm sure that the access has been properly transferred.
>I'd hate to be locked out of certain privileges that I never knew
>existed.

Sorry, but are you a network-administrator or the boss of one?

Copy user admin to the root object. Give it another name.
You're not restricted then but copied.

Make sure the new user account has Supervisory rights on the root-object.
If you have Supervisory rights on the root-object you have all the rights.

Also, make sure only the people that really know what there doing have
all the rights. Managers and so on should have *at most* Read Scan rights
in the NDS-objects at root level.
Reason for this is simple. Only people how really know what they are doing
should have modification rights in crucial parts of the network.
People who are the bosses of those people may look but not touch. OK?

Is somewhat like a bodyguard that has to protect Mister X. For that reason
he gets a gun from Mister X, but Mister X thinks it's smart to keep the
bullets himself, because *he* feels safer that way. Of course, Mister X
is now buried and the bodyguard too perhaps.

------------------------------

Date: Wed, 3 Jan 1996 17:39:39 +0000
From: "David Beaudoin" <beaudoin@remus.rutgers.edu>
To: netw4-l@bgu.edu
Subject: Help with NDS design

I'm just starting to lay out the NDS for our new 4.1 SFT III servers.
I'm considering the following design and I'd like to hear any
suggestions, comments, or warnings.

 Root
 |_
    (Organization)
	  |_
	  |   (OU) New York
	  |              |_
	  |              |   (OU) Department 1
	  |              |                  |_
	  |              |                  |_  User A
	  |              |                  |_  User B
	  |              |                       Printer
	  |              |_
	  |              |   (OU) Department 2
	  |              |                 |_
	  |             etc.             |_ User C
	  |                                    User D
	  |_
	  |   (OU) New Jersey
	  |               |_
	  |               |   (OU) Department 3
	  |               |_
	  |               |   (OU) Department 4
	  |               |
	  |_            etc.
	  |  Group including User A and User B
	  |_
	  |  Group including User C and User D
	  |
	    etc.

  Is it a bad idea to have a separate OU container for each department?
I figured if I set it up this way, with the Group objects at the O
level, then I could easily see and make changes to the Group objects
using NWAdmin.
  OTOH, is it better to only make OU containers for each
location (states in our case), and lump all the users, printers, and
other leaf objects at that location, regardless of departmental
affiliation, into the location container? With this approach I could
still create groups (which would mimic departmental affiliations) at
the Organization level for ease of administration.
  Then again, is it a bad idea to create Group objects at the
Organization level?

---------

Date: Thu, 4 Jan 1996 21:38:07 -0800
From: rgrein@halcyon.com (Randy Grein)
To: netw4-l@bgu.edu
Subject: Re: Help with NDS design

>I'm just starting to lay out the NDS for our new 4.1 SFT III servers.
>I'm considering the following design and I'd like to hear any
>suggestions, comments, or warnings.

<big snip of lovely ASCII art!>

Dave, what you've got looks pretty good. This is actually one of the
recommended designs, although the great thing is that it's pretty easy to
change latter. Some caviats:

Use the container objects to organize things logically; ie, so that "near"
objects are together. It's easier to grab and use DS objects that way. It
appears you've followed this recommendation.

I don't quite see what the groups at the O level are for. Are you
anticipating a presently undefined need, or do you actually have something
specific in mind? The reason I ask is that it may (or may not) affect
partitioning.

Where are the servers going to be, and have you planned out partitioning
yet? This is a BIG issue. I've taken WANS as small as 4 sites with only 50
users that were bogged with high server utilization, plagued with dropoffs,
and sluggish wan links and corrected the problems simply by partitioning as
recommended. Hint: split partitions allong wan links and replicate...

------------------------------

Date: Thu, 4 Jan 1996 22:05:11 GMT
From: "James L Cason, III" <jlcason@PINN.NET>
Subject: Re: Synthetic Time

>I run a Novell 4.1 25 User system and I keep getting the following
>message ever 2 min's.
>	Synthetic Time is being issued on partition "MES_TREE"
>
>Could someone please tell what this message is about and how to stop it.

Unlike earlier NetWare versions, the NDS in version 4.x is time-sensitive.
While there are other possible causes, the usual one is that, for some
reason, the time has been set back.  NDS time-stamps all events, and if it
detects that the time of an event is before an event that is already in
it, it will issue Synthetic Time.  This can also be the result of
partitioning , but, if you are running a single server, that is not
likely.  If the time period is short, it will correct itself, as soon as
you pass the last timestamp event.  Otherwise, you may find that you need
to load DSREPAIR, go to Advanced Options, and declare a new Epoch.
Suggestions:  Never reset the time at the console prompt.  Down the
server, bring up DOS, and set time and date there (I have these commands
in my AUTOEXEC.BAT of each server).  Hope this helps.

---------

Date: Fri, 5 Jan 1996 20:26:57 GMT
From: Teo Kirkinen <kirkinen@CC.HELSINKI.FI>
Subject: Re: Synthetic Time

James L Cason, III (jlcason@pinn.net) wrote:
>Suggestions:  Never reset the time at the console prompt.  Down the
>server, bring up DOS, and set time and date there (I have these commands
>in my AUTOEXEC.BAT of each server).  Hope this helps.

The command  SET TIMESYNC ADJUST +/- TimeDifference can used the
adjust the network time to the "real" time.

------------------------------

Date: Fri, 5 Jan 1996 20:03:29 +0000
From: Richard Letts <R.J.Letts@SALFORD.AC.UK>
Subject: Re: DSMERGE

>I would appreciate any information on the above  and also any other
>suggestions, tips, tricks etc that anyone has come across when merging
>trees.

Make sure time synchronisation is establish properly across BOTH trees.
Without this you are into serious pain and NDS tree damage.

[do this before you merge the trees]

Richard Letts

------------------------------

Date: Fri, 5 Jan 1996 16:08:14 -0600
From: Todd W Herring <THERRING@SPEANET.IUPUI.EDU>
Subject: Compression Info...

I just read about a SET parameter to SET COMPRESS SCREEN = ON and
decided to try it.  Works great.  Problem is I don't know what any of the
numbers mean.  I have an idea, of course, that they have to do with
uncompressed size in bytes, compressed size.  But what else, and
which column is which.  Anyone know?  Below is an example.

* MSACC20.INI  69    130248     41328      2296      7236  0  0  0  0  5
* MISC.GRP     55    322560    147240      8180     17920  1  0  0  0  5
* ACCESSOR.GRP 53    233928    110520      6140     12996  1  0  0  0  5

---------

Date: Fri, 5 Jan 1996 17:30:31 -0800
From: John Navarro <jnavarro@MCGRAW-HILL.COM>
Subject: Re: Compression Info...

Here is what all that stuff means when you SET COMPRESS = ON.
...Starting from the left:

File Size
% compress
decompress speed
compress speed
compress size
decompress size

Now for the last 5 bytes, all I know is that if you see a 1 in byte 1, 2,
or 3 there was an error during compression or decompression; much like
pkzip. Compress/decompress speed is in bytes and is a barometer for speed.

------------------------------

Date: Sat, 6 Jan 1996 09:36:32 GMT
From: Teo Kirkinen <kirkinen@CC.HELSINKI.FI>
Subject: Re: Access rights help needed

>I need a tool to modify the root of my NDS to allow read access
>to every user object's FullName.  I've looked at UIMPORT, and it
>will only allow me to modify an object, but not the rights of
>an object.  Since I have several hundred of these modifications
>to make, a batch tool would be preferable to mouse and click under
>NWADMIN.  Is there such a tool available?

The rights are inherited donw the NDS tree. You need only to give
the right to [root] or preferably to your organisation or OU
containers.

------------------------------

Date: Sat, 6 Jan 1996 09:50:35 GMT
From: Teo Kirkinen <kirkinen@CC.HELSINKI.FI>
Subject: Re: nds query

>Is there a product which can stop my servers from communicating with
>each other so often. I don't wont them to talk to each other every
>time someone logs.

When somebody logs to the network the workstation has to walk to
NDS tree from the current context to the [root] and from there
to the context of the user object. You can minimize this network
traffic by placing replicas so that the needed partition(s) are
accessible locally.

Also when the use has logged in the login time and network address
are  stored on a RW or Master replica of the partition where the
OU of user account is located.

------------------------------

Date: Sun, 7 Jan 96 00:54 MET
From: arthur-b@ZeelandNet.nl (Arthur B.)
To: netw4-l@bgu.edu
Subject: Re: User rights

>What's the best way to make a user Admin-equivalent without using the 
>"Security Equal To" property?

Give it all rights in Root.
This way you have also a so called 'panic account'.

>And, when I create a home directory for new users during the user 
>object setup, only Read and File Scan rights are given to the user 
>for their own home directory (eg SYS:USERS\username). Is there any 
>way to change that? Will I have to manually grant every user a 
>Create, Modify, etc. right to their home directory?

Use the USER_TEMPLATE.

---------

Date: Fri, 12 Jan 1996 14:05:44 +0000
From: "David Beaudoin" <beaudoin@remus.rutgers.edu>
To: netw4-l@bgu.edu
Subject: Re: User rights

>>What's the best way to make a user Admin-equivalent without using the 
>>"Security Equal To" property?
>>
>>And, when I create a home directory for new users during the user 
>>object setup, only Read and File Scan rights are given to the user 
>>for their own home directory (eg SYS:USERS\username). Is there any 
>>way to change that? Will I have to manually grant every user a 
>>Create, Modify, etc. right to their home directory?
>
>Are you using a template to create new users?

I took your advice and created a USER_TEMPLATE only to find out that 
templates don't have a "Rights to Files and Directories" property!!

------------------------------

Date: Sun, 7 Jan 1996 19:36:28 -0800
From: rgrein@halcyon.com (Randy Grein)
To: netw4-l@bgu.edu
Subject: Re: User rights

>What's the best way to make a user Admin-equivalent without using the
>"Security Equal To" property?

You're on the right track. If you make them admin-equivalent, the rights
disappear if someone filters out or deletes admin. Grant the user explicit
Supervisor rights to the root. For Good Measure, explicitly grant that user
supervisor rights to each container.

>And, when I create a home directory for new users during the user
>object setup, only Read and File Scan rights are given to the user
>for their own home directory (eg SYS:USERS\username). Is there any
>way to change that? Will I have to manually grant every user a
>Create, Modify, etc. right to their home directory?

I've never seen a fix for this, but you can use the uimport utility to
create users en masse, and specify whatever you desire.

------------------------------

Date: Mon, 8 Jan 1996 02:08:14 -0500
From: RHROMYKO@aol.com (Russ Hromyko)
To: netw4-l@bgu.edu
Subject: Re: DSMERGE

I just merged two trees myself using DSMERGE which did affect connections
that were on the source tree so I would log everything out on the source
network.  The target network was not affected.  A bit of advice, make sure
you have the latest versions of DS.NLM, DSREPAIR.NLM and DSMERGE.NLM.  I
didn't and ran into some problems.  Also, when you use PARTMGR to move the
source tree under a certain context on the target tree you most likely will
have NDS errors so be prepared for that.

------------------------------

Date: Tue, 9 Jan 1996 16:15:33 -0600
From: Joe Doupnik <JRD@CC.USU.EDU>
Subject: Re: NDS Partitions and Replicas

>How is it that a user can access resources from an NDS
>partition for which there is no replica or subref on his default
>server.  In other words, if I have server that exists in a
>partition named NewYork and the only replica stored on
>that server is the Master of NewYork (i.e. No replicas of the
>[Root] or subrefs to other child partitions), how is it that a
>user on that server can access NDS objects in other
>partitions.  Where does it get its info on NDS objects in
>other partitons if it only has the one replica on its server ?
---------
	NDS searches upward in the tree for the desired object,
and if necessary all the way to the [root] and down another branch.
Clearly there are traffic issues created by such arrangements.
	Joe D.

------------------------------

Date: Wed, 10 Jan 1996 20:55:45 -0500
From: Debbie Becker <dbecker@clark.net>
Subject: Re: login without group name

>I am trying to create login scripts in Novell Netware 4.1 I created
>an Organizational Unit (Group). I assigned users to that group, but
>I'm trying to get the users to login without having to type their groupname.
>For example:..when they log in they have to type their username.purchasing.
>I am trying to avoid having to type all that and just type their username.


An Organizational Unit isn't the same thing as a Group (which is it's own
object). An Organizational Unit is a container object, which is included in
the full (distinguished) name of an object in a 4.1 tree (kind of like using
directory names in the path for a filename). You can't login to NetWare 4.1
without the full name being used in one way or another. This is what allows
you to have two users with the same common name (i.e., Bob) in different
containers (one in Purchasing and one in Marketing). Their full names in the
NDS database are different.

You can get around users having to know their full names (I know few users
who would want to login using "LOGIN .DEBBIE.CORP.INTERMEDIA". Edit the
NET.CFG file (in C:\NWCLIENT) and add a line in the NetWare DOS Requestor
section:

	   NAME CONTEXT = "OU=Purchasing.O=Organization_name"

This will set the workstation's position in the tree to the Purchasing
Organizational Unit. Then the user can just use "LOGIN DEBBIE" to login.

------------------------------

Date: Wed, 10 Jan 1996 20:55:49 -0500
From: Debbie Becker <dbecker@clark.net>
Subject: Re: NDS Partitions and Replicas

>How is it that a user can access resources from an NDS
>partition for which their is no replica or subref on his default server?

You don't actually have to have access to a copy of a partition that contains
the objects in order to access them. In fact, you don't even have to have a
replica of any type on a server.

For example, you turn on your workstation and attach to server NYC_MKTG,
which has no replica on it. The Read Write partition that your user object is
in is on server NYC_CORP. So when you login, you are authenticated through
server NYC_CORP. (And may get a message telling you that you're "ATTACHED TO
SERVER NYC_MKTG and AUTHENTICATED TO SERVER NYC_CORP"). This is not a
licensed connection.

Your login script CAPTURES to a queue on a volume of the NYC_MKTG server. NDS
background authenticates you by going to the NYC_CORP partition and finding
the object in question (print queue) and verifying that you have rights to
access it. This gives you a licensed connection to NYC_MKTG.

The script next MAPs a drive to your user directory on NYC_MKTG. Again, NDS
background authenticates through the replica on NYC_CORP. This is also a
licenses connection to NYC_MKTG (but, since you already have one, you're
okay).

Next you're MAPPED to a directory on the NYC_CORP server. Same background
authentication at work, and you now *also* have a licensed connection to
NYC_CORP.

The final mapping is to a database directory on server CHI_PROD. Background
authentication goes through your user object on NYC_CORP. The volume object
from server CHI_PROD isn't on this replica, so NDS searches upand down the
tree to find it based on the path you've given in the MAP statement. Once
rights are verified, you have your mapping (and a licensed connection to
CHI_PROD).

You now have licensed connections to three servers. You can see why folks
like using utilities that allow you to map a drive, run a program and then
delete the mapping -- why tie up all of those licensed connections?

------------------------------

Date: Fri, 12 Jan 1996 23:49:48 -0800
From: rgrein@halcyon.com (Randy Grein)
To: netw4-l@bgu.edu
Subject: Re: Senthetic Time

>OK,  This has got to be simple.  When I installed Netware 4.1 on our new
>server the CMOS time was off by one hour.  Probably becouse we purchased
>the server form another time zone.  I set the correct time at the cmos
>and at the console.  Now I get a message at the console "server X is
>issuing synthetic time" or somthing to that effect.

It's simple now, but they don't cover it in class - the fix is new. At the
server console, load DSREAIR. Go to advanced options, select replica and
partition operations, select the partition replica you're dealing with, and
finally choose repair time stamps and declare a new epoch. NEVER, NEVER
change the server time this way!

Also:

Get the new DSENHANCE.ZIP from the web, ftp or Compuserve Novell sites. The
current rev of DS is 3.89b; it solves LOTS of problems. Plus this fix only
works with the DSREPAIR that comes in the update.

The trouble is that EVERYTHING in the 4.1 database gets timestamps; when
you just set the time back there have been NDS updates that now have
timestamps in the future - clearly impossible except to a computer. In
order to keep these database updates straight until they can be applied,
the system needs to be able to hold change commits in some fashion.
Synthetic time is a way to "ignore" the discrepancy until the timestamps
are no longer in the future, and still allow NDS changes to occur. When the
server time catches up to each "future time stamp", the change is resolved
as though it had been applied at that moment. When the last "future time
stamp" is applied, synthetic time ceases.

------------------------------

Date: Sun, 14 Jan 1996 11:58:36 GMT
From: Teo Kirkinen <kirkinen@CC.HELSINKI.FI>
Subject: Re: Upgrade to 4.1 on new server?

Baird, John (BAIRD2@WHIO.LINCOLN.AC.NZ) wrote:
>It was for us when we recently upgraded a 3.11 server to 4.10 (600+
>users) and replaced the hardware at the same time. By doing a minimal
>install of 3.11 on the new machine with a 64 KB block size for SYS,
>copying across the bindery and doing an inplace upgrade, then copying
>files from the old server to the new using a netware savy program, we
>were able to achive the 3 requirements of (a) retaining
>passwords (b) setting 64 KB blocks and (3) suballocation.

We achieve the same by running NETSYNC on the 3.x and the new 4.1
servers. If there is no new computer for the 4.1 server, then we
copy the 3.x-bindery to an old spare. After that we generate the
trustees, change the mail-directory-id's etc. via batch files that
call different JRBUTILS.

In our tests migrate didn't set every NDS property we wanted. If I
recall correctly at least DEFAULT_SERVER and HOME_DIRECTORY had to
be set separatery.

I agree that retaining password is the most important goal in
large networks. We are going to move 5000 users from 3.11 to
4.1 netx week! At least if Novell's ESC has time to fix our NDS
before that - we cannot add any new server to our [root]-partition
because there is a hole in the NDS. We have already waited four
week for the fix.

It's also important to turn compression OFF from SYS:, I'm not
sure if this can be done in all different options in Migrate.

------------------------------