Microsoft Services for Network File System

Microsoft® Services for Network File System (NFS) provides a file sharing solution for enterprises that have a mixed Windows and UNIX environment. With Microsoft Services for NFS, you can transfer files between computers running Microsoft Windows Server™ 2003 R2 and UNIX operating systems using the NFS protocol.

Microsoft Services for NFS is an update to the NFS components that were previously available in Windows® Services for UNIX 3.5. Microsoft Services for NFS includes the following new features:

  • Active Directory Lookup. The Identity Management for UNIX Active Directory schema extension, available in Windows Server 2003 R2, includes UNIX user identifier (UID) and group identifier (GID) fields, which enables NFS clients to look up UNIX identity information directly from Active Directory.

  • 64-bit support. Microsoft Services for NFS components can be installed on all editions of Windows Server 2003 R2, including 64-bit editions.

  • Enhanced server performance.

  • Support for UNIX special devices (mknod).

Microsoft Services for NFS enables you to support a mixed environment of Windows-based and UNIX-based operating systems. It also allows you to update your company's computers while supporting older technology during the transition phase. The following scenarios are examples of how enterprises can benefit from deploying Microsoft Services for NFS.

  • Allow UNIX clients to access resources on computers running Windows Server 2003 R2. Your company may have UNIX clients accessing resources, such as files, on UNIX file servers. To take advantage of new Windows Server 2003 features, such as Shadow Copies for Shared Folders, you can move resources from your UNIX servers to computers running Windows Server 2003 R2 and then configure Microsoft Services for NFS to enable access by UNIX clients that are running NFS software. All of your UNIX clients will be able to access the resources using the NFS protocol with no changes required.

  • Allow computers running Windows Server 2003 R2 to access resources on UNIX file servers. Your company may have a mixed Windows and UNIX environment with resources, such as files, stored on UNIX file servers. You can use Microsoft Services for NFS to enable computers running Windows Server 2003 R2 to access these resources when the file servers are running NFS software.

  • Take advantage of new 64-bit hardware. You can run Microsoft Services for NFS components on 64-bit editions of Windows Server 2003 R2.


Help for Microsoft Services for Network File System

What's new in Microsoft Services for NFS

Best practices for configuring and using Microsoft Services for NFS

Installing and removing Microsoft Services for NFS components

Administering Microsoft Services for NFS

Microsoft Services for NFS troubleshooting

Microsoft Services for NFS command-line tools


What's new in Microsoft Services for NFS

Microsoft Services for Network File System (NFS) provides many improvements that make it easier than ever to integrate Windows and UNIX networks effectively.

Active Directory Lookup

The Identity Management for UNIX Active Directory schema extension, available in Microsoft Windows Server 2003 R2, includes UNIX user identifier (UID) and group identifier (GID) fields, which enables Server for NFS and Client for NFS to look up Windows-to-UNIX user account mappings directly from Active Directory. Identity Management for UNIX simplifies Windows-to-UNIX user account mapping management in Active Directory.

Note

After this release, the User Name Mapping component will no longer ship with Microsoft Services for NFS.

64-bit support

You can install Microsoft Services for NFS components on all editions of Windows Server 2003 R2, including 64-bit editions.

Enhanced server performance

Microsoft Services for NFS includes a file filter driver, which significantly reduces common server file access latencies.

UNIX special device support

Microsoft Services for NFS supports UNIX special devices (mknod).

Enhanced UNIX support

Microsoft Services for NFS now supports the following versions of UNIX:

  • Sun Microsystems Solaris version 9

  • Red Hat Linux version 9

  • IBM AIX version 5L 5.2

  • Hewlett Packard HP-UX version 11i

Deprecated features

To streamline and simplify Microsoft Services for NFS, the following features were removed from this release:

  • Gateway for NFS

  • Server for PCNFS

  • All PCNFS components of Client for NFS


Best practices for configuring and using Microsoft Services for NFS

Use the correct utilities to administer Microsoft Services for NFS.

You cannot use Microsoft Services for Network File System (NFS) or command-line utilities to administer earlier versions of Microsoft Services for NFS. Also, you cannot use earlier versions of Microsoft Services for NFS or command-line utilities to administer newer versions of Microsoft Services for NFS.

You can use Microsoft Services for NFS to administer NFS components on a remote computer if both computers are running a Windows Server 2003 R2 operating system.

Open firewall ports.

Microsoft Services for NFS requires several ports, which must be open on Windows Firewall and other firewalls. When prompted, make sure you allow Microsoft Services for NFS components.

For information about changing port settings, see Microsoft Services for NFS troubleshooting.

See Also

  • Server for NFS best practices
  • User Name Mapping best practices
  • Client for NFS best practices


Server for NFS best practices

General best practices

Provide user-level security.

With Server for NFS, you can control access by users and groups to Network Files System (NFS) resources. You must configure and populate Active Directory with user identifier (UID) and group identifier (GID) information or install User Name Mapping on one computer in your network to associate Windows user accounts with UNIX user accounts. In some cases you may also need to install Server for NFS Authentication, see Server for NFS Authentication for more details.

Secure files.

Server for NFS only supports storage volumes that are formatted for NTFS. NTFS volumes enable you to provide file-level security by allowing and denying file access to specific users and groups. When you want anonymous users to access files, make sure directory and file permissions provide appropriate access for anonymous users. In addition, when sharing the directory, use host-level NFS access control when creating the NFS share to provide an additional level of security to protect the files in the directory.

Secure new drives.

When you add a new drive to a computer running Server for NFS, be sure to modify the permissions protecting the root directory of the drive to ensure untrusted users, including Everyone users, cannot write to the directory. This will prevent untrusted users from being able to compromise Server for NFS security by protecting shared directories on the drive.

Allow users to disconnect before stopping the Server for NFS service.

Before you stop Server for NFS or uninstall it, notify users who are connected to NFS shares that you are about the stop the service. You can then stop the service after the users have had the opportunity to close open files and disconnect from shared directories.

Use naming conventions to identify shares with EUC encoding.

If a directory is shared with one type of Extended UNIX Code (EUC) encoding (such as EUC-JP), and a client that is configured to use a different EUC encoding (such as EUC-TW) attempts to connect to the shared directory, unexpected results can occur. To prevent this, establish a naming convention to use when sharing directories with EUC encoding so users of client computers can know how shared directories are encoded.

Protect configuration files.

If you create configuration files (such as a character translation file or an audit log file), be sure to protect them with a discretionary access control list (DACL) that grants Full Control to the built-in System account and to the Administrators group. The DACL should contain no other entries.

Best practices for running Server for NFS in a server cluster

Stop Server for NFS before stopping the server cluster.

To ensure proper operation of Server for NFS in a server cluster, when stopping the server cluster, first stop Server for NFS, then stop the server cluster.

Ensure share availability when a node fails.

To ensure that a shared directory cluster resource will be available after the node containing the resource fails, make the cluster resource dependent on the appropriate physical disk resource.

Use the appropriate tool to manage Network File System (NFS) share cluster resources.

Although you can use Windows Explorer to view properties of an NFS share cluster resource, you should not use it to change those properties. You should only use Cluster Administrator or the cluster command to create and administer shared NFS directories on a server cluster.

Avoid conflicting share names.

Ensure that the share name of every shared directory on the server cluster is unique. Otherwise, if one node in the cluster fails over to another node, and if shared directories on the two nodes have the same name, then only one of the shared directories will be available.

Ensure the availability of audit logs.

Do not designate a shared disk resource as the location of the Server for NFS audit log. Only one node in the cluster can own the log file. This means that if the ownership of a group is moved to another node, the audit events for the remaining shares on the original node cannot be recorded in the file. To ensure the availability of Server for NFS audit logs, you should log events to the Event Viewer event log.

Move file shares or take them offline before stopping Server for NFS.

When Server for NFS is stopped on a cluster node hosting active NFS share resources, the Cluster service responds as though this were a failure of one of its managed resources. Consequently, the Cluster service will try to restart the service in an attempt to keep the resource available. Before you attempt to stop Server for NFS on a server cluster node, either move all groups containing NFS file shares to another node on the cluster, or take all NFS file shares on the node offline.

Take resources offline before modifying.

Be sure to take an NFS share directory resource offline before modifying its properties. Failing to do so might produce unexpected results.

Administer Server for NFS only from computers in a trusted domain.

To ensure that Server for NFS configuration changes are properly replicated, always use a computer that belongs to a trusted domain when you administer Server for NFS running on a cluster. This is necessary because Server for NFS configuration changes are not properly replicated among nodes in a cluster if you run Microsoft Services for NFS Administration or nfsadmin on a computer that belongs to a domain that is not trusted by the domain of the cluster.

Restart the Server for NFS service after the Cluster service restarts.

If the Cluster service must be restarted on a node in the cluster, stop and then restart the Server for NFS service on that node. This will ensure that Server for NFS configuration changes will be replicated properly among the nodes of the cluster.

Choose the appropriate sharing mode.

When you create an NFS share directory resource, you have the option of sharing the root of the specified directory or all the subdirectories in the directory. Before choosing this option, first decide whether you will need to control access to the subdirectories or change their share names. If you need to do this, you must share the subdirectories separately because when you create an NFS share directory resource to share the subdirectories, you cannot set access permissions, allow (or deny) anonymous access, or change the share name of the subdirectories separately.

If you choose to share all the subdirectories in the directory, make sure that the permissions protecting the directory do not allow untrusted users to create subdirectories. Otherwise, a malicious user can overwhelm the Cluster service by creating a very large number of subdirectories that would automatically be shared as a cluster resource.

Use the command line properly when creating or modifying NFS share cluster resources.

If you use the cluster command to create and modify NFS share cluster resources, the following considerations apply:

  • When you create the cluster resource using the cluster command, you can set some nonprivate properties, but not all.

  • When using the cluster command to set properties, do not rely on default values because they might be invalid for an NFS share cluster resource. Always set property values explicitly.

  • To set or view permissions on an NFS share cluster resource, use Cluster Administrator. You can also use the nfsshare command to view permissions, but not to set them.

Use hard mounts.

Users of client computers should be instructed to use hard mounts when mounting NFS directories shared on the server cluster. This will ensure that, if the node sharing the directory fails, the client computer will not time out before the failover to another node is complete.

Use the correct virtual server name.

Users of client computers should be instructed to mount NFS directories shared on the server cluster using the virtual server name from the same group as the shared directory. Using a virtual server name from another group, or the node name, allows the client computer to mount the directory, but the mount can be lost in case of a failover.


User Name Mapping best practices

Install User Name Mapping on a domain controller.

If you have a large number of user maps, installing User Name Mapping on a domain controller improves performance by reducing network traffic when maps are first created or refreshed.

Create a User Name Mapping server pool.

You can use DNS round robin to create a pool of computers running User Name Mapping. This will provide improved performance on wide area networks as well as provide failover capability when one of the servers is no longer available. For more information, see Creating a User Name Mapping pool.

Configure User Name Mapping on a server cluster.

You can use a User Name Mapping server cluster to provide high availability of User Name Mapping. To ensure proper operation of User Name Mapping on a server cluster, when stopping the server cluster, first stop User Name Mapping, then stop the server cluster. For more information, see Configuring User Name Mapping on a server cluster

Make sure User Name Mapping can download users from all domains.

In order to download users from a Windows domain, make sure that the User Name Mapping server belongs to a domain that is trusted by the Windows domain which it is trying to access.

If Active Directory was installed with permissions compatible with the Windows Server 2000 Server option, do one of the following:

  • If the computer running User Name Mapping is a member of the domain, add the computer to the Pre-Windows 2000 Compatible Access security group.

  • If the computer running User Name Mapping does not belong to the domain (that is, it belongs to a trusted domain), add the special group Everyone to the Pre-Windows 2000 Compatible Access security group of the Active Directory domain.

Refresh data whenever a user is added or changed.

To ensure that the user will have immediate access to Network File System (NFS) resources, refresh the User Name Mapping database immediately after you add a user or otherwise make changes to the user's Windows or UNIX accounts that would affect the user's mapping. For information about refreshing the database, see Refreshing maps.

Place password and group files on the User Name Mapping server.

If User Name Mapping is configured to use password and group files, these files must be located on a hard drive on the server to ensure that User Name Mapping can access the files whenever it refreshes the mapping database.

Use appropriate permissions to protect password and group files.

Protect password and group files with permissions that allow access only by appropriate users. We recommend that the permissions list contain only entries that grant Full Access to SYSTEM and the Administrators group. Also, do not change the permissions that Microsoft Services for NFS applies to other User Name Mapping configuration files.

Back up complex maps whenever you make changes.

To avoid loss of complex advanced maps in case of system difficulty, or to aid in transferring maps to another server, be sure to back up your User Name Mapping data whenever you change advanced maps.

Ensure consistency of group mapping.

To ensure proper file access, Windows and UNIX groups that are mapped to each other should contain the same users, and the members of the Windows and UNIX groups should be properly mapped to each other.

Specify the computers that can access User Name Mapping.

User Name Mapping requires you to identify the computers that can access User Name Mapping in the .maphosts file. (If the list in this file is empty, only the computer that is running User Name Mapping can access the service.) To maintain a high level of security, you should explicitly specify the computers that can access User Name Mapping, rather than using the plus sign (+) by itself to grant access to all computers. For more information, see Securing access to the User Name Mapping server.


Client for NFS best practices

Use the correct command prompt.

If you are running Client for NFS and use a command prompt, you should use the 32-bit version (Cmd.exe) available through the Start menu. Do not use the 16-bit version (Command.com).

Avoid using hard mounts.

Regardless of the mount type, Client for NFS will not indefinitely try to mount an NFS share. Once the share has been successfully mounted, and it is a hard mount, Client for NFS will continue to try to access the share until it is successful. As a result, if the Network File System (NFS) server is unavailable when a program tries to access the mounted share, Windows will appear to hang if the mount type is hard. Incidentally, the umount command will disconnect a hard mount even if the server is unavailable.

Have correct rights when changing file ownership.

In order for a user to use the chown command on a file on the server, from UNIX, the user must be logged on as root or must be one of the following:

  • The owner of the file.

  • A user who is granted the right to restore files and directories (run secpol.msc and select Local Policies > User Rights Assignment).

  • A member of the Backup Operators group.


Installing and removing Microsoft Services for NFS components

Installing Microsoft Services for NFS components

Removing Microsoft Services for NFS


Installing Microsoft Services for NFS components

To install Microsoft Services for Network File System (NFS) components

  1. Click Start, point to Settings, and click Control Panel.

  2. Double-click Add or Remove Programs.

  3. Click Add/Remove Windows Components. The Windows Component Wizard appears.

  4. From the list of components, double-click Other Network File and Print Services.

  5. Select the Microsoft Services for NFS box and click OK.

  6. To select individual components, click Details. Then, select the check boxes of the components to install and click OK.

  7. Click Next and follow the on-screen prompts to complete the installation.


Removing Microsoft Services for NFS

To remove Microsoft Services for Network File System (NFS) components

  1. Click Start, point to Settings, and click Control Panel.

  2. Double-click Add or Remove Programs.

  3. Click Add/Remove Windows Components. The Windows Component Wizard appears.

  4. From the list of components, double-click Other Network File and Print Services.

  5. Select the Microsoft Services for NFS box and click OK.

  6. To remove individual components, click Details. Then, select the check boxes of the components to remove and click OK.

  7. Click Next and follow the on-screen prompts to remove the component.


Administering Microsoft Services for NFS

Using the Microsoft Services for NFS snap-in

Server for NFS administration

User Name Mapping administration

Client for NFS administration


Using the Microsoft Services for NFS snap-in

To access Microsoft Services for Network File System

  1. Click Start, point to Programs, point to Administrative Tools, and click Microsoft Services for Network File System.

  2. Use this documentation to help you to administer Microsoft Services for Network File System (NFS).


Server for NFS administration

Understanding the Server for NFS component

Starting and stopping Server for NFS

Configuring Server for NFS

Securing Server for NFS

Optimizing Server for NFS performance

Using file systems with NFS

Managing NFS shares

Managing NFS client groups

Using Microsoft Services for NFS with server clusters

Server for NFS Authentication


Understanding the Server for NFS component

With Server for NFS, a computer running the Microsoft Windows Server 2003 R2 operating system can act as a Network File System (NFS) server. Users can then share files in a mixed environment of computers, operating systems, and networks.

Users on computers running NFS client software can gain access to directories (called shares) on the NFS server by connecting (mounting) those directories to their computers. From the viewpoint of the user on a client computer, the mounted files are indistinguishable from local files.

UNIX computers follow advisory locking for all lock requests. This means that the operating system does not enforce lock semantics on a file, and applications that check for the existence of locks can use these locks effectively. However, Server for NFS implements mandatory locks even for those locking requests that are received through NFS. This ensures that locks acquired through NFS are visible through the server message block (SMB) protocol and to applications accessing the files locally. Mandatory locks are enforced by the operating system.


This content might have been updated. For the most recent version, see the Windows Server 2003 R2 TechCenter Web site

Starting and stopping Server for NFS

Starting Server for NFS

Stopping Server for NFS


Starting Server for NFS

To start Server for NFS from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Start.
To start Server for NFS from the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsadmin server [ComputerName] start

Argument | Description
ComputerName | The name of the computer on which you want to start Server for NFS.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?


Stopping Server for NFS

To stop Server for NFS from the Windows interface

  1. Open Microsoft Services for Network File System: To open Microsoft Services for NFS, click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Stop.

Note

Before attempting to stop Server for NFS running on a node in a server cluster, either move all groups containing Network File System (NFS) file shares to another node or take all NFS file shares offline.

To stop Server for NFS from the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsadmin server [ComputerName] stop

Argument | Description
ComputerName | The name of the computer on which you want to stop Server for NFS.
Notes
  • Before attempting to stop Server for NFS running on a node in a server cluster, either move all groups containing Network File System (NFS) file shares to another node or take all NFS file shares offline.
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?


Configuring Server for NFS

Specifying how Server for NFS obtains Windows user and group information

Setting the lock grace period

Releasing locks

Setting up audit logging

Specifying Server for NFS TCP and UDP settings

Enabling NFS version 3

Configuring file-name character translation

Configuring the authentication renewal period

Configuring case sensitivity for file and folder names

Running Server for NFS on a server cluster


Specifying how Server for NFS obtains Windows user and group information

In a UNIX environment, authentication is the process of providing a user identifier (UID) and group identifier (GID) to a user who presents a valid user name and password. UNIX hosts provide these identifiers when a user logs on to the host. When the user logs on, the user's name and password are compared to those in a password file. If they correspond with a user name and password in the file, the server returns a corresponding UID and GID. The UID and GID identify the user for Network File System (NFS) browsing and mounting operations.

Server for NFS makes it possible for clients to access NFS resources without separately logging on to Server for NFS. Instead, the first time you try to access an NFS resource, Server for NFS looks up your UNIX UID and GID information in either Active Directory or User Name Mapping. If your UNIX UID and GID information is mapped to a Windows user and group accounts, the Windows names are returned to Server for NFS, which then uses the Windows user and group names to grant file access.

If your UNIX UID and GID information is not mapped, then Server for NFS will deny file access.

Specifying how Server for NFS obtains Windows user and group information

You can perform this procedure using the following methods:

  • Using the Windows interface

  • Using a command line

To specify how Server for NFS obtains UID and GID information using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Microsoft Services for NFS, and then click Properties.

  4. Specify how Server for NFS obtains user identifier (UID) and group identifier (GID) information for users:

    • To use Active Directory Lookup, select the Active Directory Lookup check box, type the domain name, and then click Apply.

    • To use User Name Mapping, type the name of the mapping server you want to use for authentication, and then click Apply.
Notes
  • Before using Active Directory Lookup, you must install and populate the Identity Management for UNIX Active Directory schema extension, included in Windows Server 2003 R2, or have an equivalent schema which includes UNIX UID and GID fields. Identity Management for UNIX greatly simplifies this aspect of Windows-to-UNIX user account management in Active Directory.
  • You can specify the Internet Protocol (IP) address of the User Name Mapping server instead of the name of the server.
  • Before using User Name Mapping, the computer running Server for NFS must be listed in the .maphosts file on the computer running User Name Mapping. For more information, see Securing access to the User Name Mapping server
To specify how Server for NFS obtains UID and GID information using the command line

  1. Open the command prompt.

  2. Specify how Server for NFS obtains user identifier (UID) and group identifier (GID) information for users:

    • To use User Name Mapping, at a command prompt, type:

    nfsadmin mapping [ ComputerName ] config adlookup=yes addomain= DomainName

    • To use User Name Mapping, at a command prompt, type:

    • nfsadmin mapping [ ComputerName ] config mapsvr= ServerName

Argument | Description
DomainName | The name of the domain controller you want to use.
ComputerName | The name of the computer you want to manage.
ServerName | The name of the mapping server you want to use.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin mapping /?
  • Before using Active Directory Lookup, you must install and populate the Identity Management for UNIX Active Directory schema extension, included in Windows Server 2003 R2, or have an equivalent schema which includes UNIX UID and GID fields. Identity Management for UNIX simplifies this aspect of Windows-to-UNIX user account management in Active Directory.
  • Before using User Name Mapping, the computer running Server for NFS must be listed in the .maphosts file on the computer running User Name Mapping. For more information, see Securing access to the User Name Mapping server


Setting the lock grace period

To set the lock grace period using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS and then click Properties.

  4. Click the Locking tab.

  5. In Waiting Period, type the number of seconds within which Network File System (NFS) clients can reestablish file locks after a network or server service interruption..

  6. To save this setting, click Apply.

To set the lock grace period using the command line

  1. Open the command prompt.

  2. At a command prompt, type:

    nfsadmin server [Computer Name ] config lockperiod= LockingGracePeriod

Argument | Description
ComputerName | The name of the computer you want to manage.
LockingGracePeriod | The time period (in seconds) within which users can reestablish locks after the server restarts.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?


Releasing locks

To release locks using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Locking tab.

  5. In the list of clients, click the client whose locks you want to release, click Release Locks, and then click Apply.
To release locks using the command line

  1. Open the command prompt.

  2. To list all locks, type:

    nfsadmin server [Computer Name ] –l

  3. To release locks, type:

    nfsadmin server [Computer Name ] –r [C lient | all]

Argument | Description
ComputerName | The name of the computer you want to manage.
Client | The client whose locks you want to release.
All | Releases all locks.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?


Setting up audit logging

To set up logging using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Audit Logging tab.

  5. To record audited events in the Event Viewer application log, select Log events to event log.

  6. To record audited events in a file, select Log events to the following text file. In the text box, type the name of the log file, or click Browse to find the file, and then in Maximum file size, increase the maximum size for the log file, if desired (default: 64MB).

  7. In Server for NFS Events, select the events to audit from the following options:

    • Mount and unmount shares.

    • Lock and unlock files.

    • Read files.

    • Write files.

    • Create files.

    • Delete files.

    • All events listed above.

  8. To save the settings, click Apply.
Notes
  • By default, no events are audited. If recording audited events to a text file, the log file must be on your local computer. To stop logging an event, clear its check box. If you choose to record Server for NFS audited events in the event log, the string corresponding to the file name could be truncated due to a system limitation.
  • One solution to this problem is to record audited events to a text file. On a server cluster, it is recommended that you record audited events to the Event Viewer because its data replicates to all the nodes in the cluster. In this scenario, recording audited events to a text file in addition to the event log can help associate complete file names with a particular audit log entry.


Specifying Server for NFS TCP and UDP settings

To specify Server for NFS TCP and UDP settings using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Server Settings tab.

  5. Select the desired transport protocol setting from the Transport protocol drop-down list, and then click Apply.
Important
  • These changes will not take effect until Server for NFS is restarted. For information about how to stop and start Server for NFS, see Starting and stopping Server for NFS.
To specify Server for NFS TCP and UDP settings using the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsadmin server [ ComputerName ] config [ Protocol ]= [ Transport ]

Argument Description

ComputerName

The name of the computer you want to manage.

Protocol

The name of the Network File System (NFS) protocol you want to configure.

Term | Definition
PortmapProtocol | Specifies the Portmap protocol.
MountProtocol | Specifies the Mount protocol.
NLMProtocol | Specifies the Network Lock Manager protocol.
NSMProtocol | Specifies the Network Status Manager protocol.

Transport

The transport or combination of transports to enable for the given NFS protocol.

Term | Definition
TCP | Enables only the TCP transport.
UDP | Enables only the UDP transport.
TCP+UDP | Enables both the TCP and UDP transports.
Important

These changes will not take effect until Server for NFS is restarted. For information about how to stop and start Server for NFS, see Starting and stopping Server for NFS.

Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?


Enabling NFS version 3

To enable NFS Version 3 using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Server Settings tab.

  5. Select the Enable NFS v3 support check box, and then click Apply.
Important

These changes will not take effect until Server for NFS is restarted. For information about how to stop and start Server for NFS, see Starting and stopping Server for NFS.
To enable NFS Version 3 using the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsadmin server [\\ remoteMachineName ] config enablev3={yes | no}

Argument | Description
ComputerName | The name of the computer you want to configure.
Important

These changes will not take effect until Server for NFS is restarted. For information about how to stop and start Server for NFS, see Starting and stopping Server for NFS.

Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?
  • NFS v3 support is enabled by default.

See Also

  • Starting and stopping Server for NFS


Configuring file-name character translation

To configure file-name character translation using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Filename Handling tab.

  5. Select the Translate file names check box.

  6. In the Character translation file box, type the fully qualified path of the file containing the character-translation map, or click Browse to find the file, and then click Apply.
Important

These changes will not take effect until Server for NFS is restarted. For information about how to stop and start Server for NFS, see Starting and stopping Server for NFS.

Important

To prevent unauthorized users from tampering with the file-name character translation file and causing Server for NFS to fail, ensure that the file is protected with a discretionary access control list (DACL) that grants Full Control to the built-in System account and to the Administrators group. The DACL should contain no other entries.
To configure file-name character translation using the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsadmin server [ ComputerMachineName ] config translationfile= file

Argument | Description
remoteMachineName | The name of the computer you want to configure.
file | The fully qualified path and name of the file containing the character-translation map list. If you do not specify a file, character translation will be disabled.
Important
  • These changes will not take effect until Server for NFS is restarted. For information about how to stop and start Server for NFS.
Important

To prevent unauthorized users from tampering with the file-name character translation file and causing Server for NFS to fail, ensure that the file is protected with a discretionary access control list (DACL) that grants Full Control to the built-in System account and to the Administrators group. The DACL should contain no other entries.

Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?

See Also

  • Starting and stopping Server for NFS


Configuring the authentication renewal period

To configure how often authentication is renewed using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Server Settings tab.

  5. Do one of the following:

    • To prevent Server for NFS from periodically renewing authentication, click Do not renew authentication.

    • To configure Server for NFS to renew authentication periodically, click Renew authentication every: and type how many seconds will elapse before authentication will be renewed. The default is 600 seconds.

  6. Click Apply.
To configure how often authentication is renewed using the command line

  1. Open the command prompt.

  2. To configure Server for NFS to renew authentication periodically, type the following at the command prompt:

    nfsadmin server [ ComputerName ] config renewauth=yes

    nfsadmin server [ ComputerName ] config renewauthinterval= seconds

  3. To configure Server for NFS to not renew authentication periodically, type the following at the command prompt:

    nfsadmin server [ ComputerName ] config renewauth=no

Argument | Description
ComputerName | The name of the computer you want to configure.
seconds | The number of seconds that will elapse before authentication is renewed. The default is 600.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?


Configuring case sensitivity for file and folder names

To configure case sensitivity for file and folder names using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Filename Handling tab.

  5. Do one of the following:

    • To enable case-sensitive file and directory name lookups, select the Enable case sensitive lookups check box.

    • To disable case-sensitive file and directory name lookups, clear the Enable case sensitive lookups check box.

  6. Click Apply.
Important
  • These changes will not take effect until Server for NFS is restarted. For information about how to stop and start Server for NFS, see Starting and stopping Server for NFS.
  • You also need to disable Windows kernel case-insensitivity in order for Server for NFS to support case-sensitive file names. You can disable Windows kernel case-insensitivity by clearing the following registry key to 0:
  • HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel
  • DWORD “obcaseinsensitive”
To configure case sensitivity for file and folder names using the command line

  1. Open the command prompt.

  2. To enable case sensitivity, type the following:

    nfsadmin server [ ComputerName ] config casesensitivelookups=yes

  3. To disable case sensitivity and optionally specify the case of file names returned by Server for NFS, at a command prompt, type the following:

    nfsadmin server [ ComputerName ] config casesensitivelookups=no [ntfscase={upper | lower | preserve}]

Argument | Description
ComputerName | The name of the computer you want to configure.
Important

These changes will not take effect until Server for NFS is restarted. For information about how to stop and start Server for NFS, see Starting and stopping Server for NFS.

Notes
  • The ntfscase option sets the case sensitivity for the NTFS file system. The default case sensitivity is preserve (preserve case).
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?

See Also

  • Starting and stopping Server for NFS


Running Server for NFS on a server cluster

Sharing directories as cluster resources

Modifying shared directory cluster resources

Deleting shared directory cluster resources


Sharing directories as cluster resources

To share a directory as a cluster resource using the Windows interface

  1. Open Cluster Administrator: click Start, point to Programs, point to Administrative Tools, and then click Cluster Administrator.

  2. In the console tree (usually the left pane), double-click the Groups folder.

  3. In the details pane (usually the right pane), click the group to which you want the resource to belong.

  4. On the File menu, point to New, and then click Resource.

  5. In the New Resource Wizard, type the appropriate information in Name and Description. In Resource type, click NFS Sharing. Click Next.

  6. Add or remove possible owners of the resource, and then click Next.

  7. To add or remove dependencies, do one of the following:

    • To add dependencies, under Available resources, click a resource, and then click Add.

    • To remove dependencies, under Resource dependencies, click a resource, and then click Remove.

  8. In Share Name, type the name of the shared folder.

  9. In Share Path, type the fully qualified path of the folder to be shared.

  10. Do one of the following:

    • To share the folder and its contents as a single shared folder, click Share Root Only.

    • To share all folders (except hidden folders) in the folder specified in the previous step as separate shared folders, click Share Subdirectories Only.

  11. To allow access by users who have not been authenticated, click Allow anonymous access.

  12. To change the user identifier (UID) and group identifier (GID) values assigned to anonymous users, type the new values in the Anonymous UID and Anonymous GID boxes.

  13. In the Encoding list, select the type of encoding to be used for file and directory names in the shared directory. In addition to the default American National Standards Institute (ANSI) encoding, the following encoding is available:

    • BIG5 (Chinese)

    • EUC-JP (Japanese)

    • EUC-KR (Korean)

    • EUC-TW (Chinese)

    • GB2312-80 (Simplified Chinese)

    • KSC5601 (Korean)

    • SHIFT-JIS (Japanese)

    If this option is set to ANSI on systems configured for non-English locales, the encoding scheme is set to the default encoding scheme for the locale. The following are the default encoding schemes for the indicated locales:

    • Japanese: SHIFT-JIS

    • Korean: KS_C_5601-1987

    • Simplified Chinese: GB2312-80

    • Traditional Chinese: BIG5

  14. To specify permissions for the client computers that can access the shared folder, click Permissions.

  15. Click Finish.
Important

Before adding a resource to your cluster, you must verify the following:

  • The NFS Share resource type is available. This resource type was created when you installed Server for NFS on the cluster node.

  • A group already exists within the cluster to which your resource will belong.

  • All dependent resources have been created.

Note

In Windows Server 2003 operating systems, the Everyone group does not include anonymous users by default. For information about providing anonymous access when Server for NFS is running on these operating systems, see Allowing anonymous access to resources by NFS clients.
To share a directory as a cluster resource using the command line

  1. Open the command prompt.

  2. Type the following:

    cluster [ ClusterName ] resource " ResourceName " /create /restype:"NFS Share" /group:" GroupName " /privproperties ShareName=" ShareName ":STRING Path=" SharePath ":STRING ShareSubDirs= ShareType :DWORD GlobalPerm= PermType :DWORD Encoding= EncodingType :DWORD AnonymousAccessAllowed= AccessType :DWORD

  3. Then, type:

    cluster [ ClusterName ] resource " ResourceName " /online /wait[: Timeout ]

Argument Description

ClusterName

The name of the cluster you want to manage.

ResourceName

The name of the cluster resource.

GroupName

The name of the group to which you want to add the resource.

ShareName

The name of the shared directory you want to create. This value is ignored if ShareType is 0x1

SharePath

The fully qualified path of the directory to be shared.

ShareType

0x0 if only the directory specified by SharePath is to be shared. 0x1 if the subdirectories (except hidden subdirectories) in the directory specified by SharePath are to be shared individually.

PermType

Specifies root-access and read-write permission combinations. PermType must be one of the following values:

0x1—No access

0x9—No Access + Root

0x2—Read only

0xa—Read only + Root

0x4—Read/write

0xc—Read/write + Root

EncodingType

Specifies the default encoding used for file and directory names and, if used, must be set to one of the following:

  • 0x7—ANSI

  • 0x5—BIG5 (Chinese)

  • 0x0—EUC-JP (Japanese)

  • 0x1—EUC-KR (Korean)

  • 0x2—EUC-TW (Chinese)

  • 0x6—GB2312-80 (Simplified Chinese)

  • 0x4—KS_C_5601-1987 (Korean)

  • 0x3—SHIFT-JS (Japanese)

If this is option is set to 0x7, the encoding scheme is ANSI or, on systems configured for non-English locales, the default encoding scheme for the locale. The following are the default encoding schemes for the indicated locales:

  • Japanese: SHIFT-JIS

  • Korean: KS_C_5601-1987

  • Simplified Chinese: GB2312-80

  • Traditional Chinese: BIG5

AccessType

0x0 if anonymous access to the shared directory is not allowed. 0x1 if anonymous access is allowed.

Timeout

The number of seconds cluster waits before canceling the command if it does not successfully complete. If /wait is specified without this value, cluster waits indefinitely or until the resource state changes.
Important

Before adding a resource to your cluster, you must verify the following:

  • The NFS Share resource type is available. This resource type was created when you installed Server for NFS on the cluster node.

  • A group already exists within the cluster to which your resource will belong.

  • All dependent resources have been created.

Notes
  • All arguments listed above are required. Using default values might produce unexpected results.
  • You must use the Windows interface to set permissions on shared directories.
  • If the attempt to share the directory fails, cluster displays an error message, and detailed information about the failure is recorded in the cluster log.
  • You cannot set the user identifier (UID) and group identifier (GID) values assigned to anonymous users using the command line.
  • In Windows Server 2003 operating systems, the Everyone group does not include anonymous users by default. For information about providing anonymous access when Server for NFS is running on these operating systems, see Allowing anonymous access to resources by NFS clients.
  • To view the complete syntax for this command, at a command prompt, type:
  • cluster /?


Modifying shared directory cluster resources

To modify a shared directory cluster resource using the Windows interface

  1. Open Cluster Administrator: click Start, point to Programs, point to Administrative Tools, and then click Cluster Administrator.

  2. In the console tree (usually the left pane), double-click the Groups folder.

  3. In the details pane (usually the right pane), double-click the group that contains the resource you want to modify, and then click the resource.

  4. On the File menu, click Take Offline.

  5. When the resource is offline, on the File menu, click Properties.

  6. Change the properties you want to modify, and then click OK.

  7. On the File menu, click Bring Online.
To modify a shared directory cluster resource using the command line

  1. Open the command prompt.

  2. Type the following:

    cluster [ ClusterName ] resource " ResourceName " /offline /wait[: Timeout ]

  3. Then, type:

    cluster [ ClusterName ] resource " ResourceName " / Option

  4. Then, type:

    cluster [ ClusterName ] resource " ResourceName " /online /wait[: Timeout ]

Argument | Description
ClusterName | The name of the cluster you want to manage.
ResourceName | The name of the cluster resource.
Timeout | The number of seconds cluster waits before canceling the command if it does not successfully complete. If /wait is specified without this value, cluster waits indefinitely or until the resource state changes.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • cluster /?

Cluster Resource Options

The following table describes the available cluster resource options:

Option | Use to…
/status | Display the status of a cluster resource (Online, Offline, or Failed). The resource name is optional. If you do not provide a resource name, the status of all cluster resources is displayed.
/create /group: group name /type: resource type [/separate] | Create a new resource in a specified group. Use /separate to specify that the resource should run in a separate Resource Monitor.
/delete | Delete a resource.
/rename: new resource name | Rename a resource.
/addowner: node name | Add a node name to the list of possible owners.
/removeowner:node name | Remove a node name from the list of possible owners.
/listowners | Display a list of possible owners.
/moveto: group | Move the resource to a different group.
/properties [ property list ] | View or set the resource common properties. The resource name is optional. If you do not provide a resource name, properties for all resources are displayed.
/privproperties [ property list ] | View or set the resource private properties. Resource name is optional. If you do not provide a resource name, private properties for all resources are displayed.
/fail | Initiate resource failure.
/online [/wait[: timeout in seconds ]] | Bring the resource online.
/offline [/wait[: timeout in seconds ]] | Take the resource offline.
/listdependencies | List the dependencies for a resource.
/adddependency: resource | Add a dependency for a resource.
/removedependency: resource | Remove a dependency for a resource.
/addcheckpoints: key [\ subkey ...][, key [\ subkey ...]...] | Add a registry checkpoint for a resource.
/removecheckpoints: key [\ subkey ...][, key [\ subkey ...]...] | Remove a registry checkpoint for a resource.
/checkpoints | List registry checkpoints for a resource. The resource name is optional. Checkpoints for all cluster resources are displayed if you do not provide a resource name.
/addcryptocheckpoints: key [\ subkey ...][, key [\ subkey ...]...] | Add a cryptographic key checkpoint for a resource.
/removecryptocheckpoints: key [\ subkey ...][, key [\ subkey ...]...] | Remove a cryptographic key checkpoint for a resource.
/cryptocheckpoints | List cryptographic key checkpoints for a resource. The resource name is optional. If you do not provide a resource name, checkpoints for all cluster resources are displayed.
/? or /help | Display cluster resource syntax.

Cluster resource common property names

The following table describes the common cluster resource property names, their uses, and valid settings:

Common property names Use

Description

Describes a resource.

Type

Specifies the resource type.

DebugPrefix

Specifies the appropriate debugger for the resource. For more information, see the Microsoft Platform Software Development Kit.

SeparateMonitor

Indicates whether a resource shares a Resource Monitor. Valid values are True (1) and False (0).

PersistentState

Describes the last known persistent state of a resource. In order to save the resource's PersistentState property, the resource must be offline.

LooksAlivePollInterval

Recommended interval (in milliseconds) that the Cluster service polls a resource to determine whether it appears to be operational. If a value is not specified, a default value is taken from the LooksAlivePollInterval property for the resource type.

IsAlivePollInterval

Interval (in milliseconds) that the Cluster service polls a resource to determine whether it is operational. If a value is not specified, a default value is taken from the IsAlivePollInterval property for the specific resource type. IsAlivePollInterval cannot be zero.

RestartAction

Describes the action to perform if the resource fails. The choices are as follows:

ClusterResourceDontRestart (0): Do not restart following a failure.

ClusterResourceRestartNoNotify (1): If the resource exceeds its restart threshold within its restart period, the Cluster service does not attempt to failover the group to another node.

ClusterResourceRestartNotify (2): If the resource exceeds its restart threshold within its restart period, the Cluster service attempts to failover the group to another node.

If you do not enter a value, the default allows the resource to affect the group, which can cause the group to failover to another system.

RestartThreshold

Specifies how many times the Cluster service attempts to restart the resource in the RestartPeriod before failing over the group.

RestartPeriod

Specifies the amount of time allowed for the restart attempts to reach the RestartThreshold before the Cluster service fails over the group.

PendingTimeout

Specifies the amount of time that a Pending Online or Pending Offline resource has to resolve its status before the Cluster service puts the resource in Offline or Failed status.

The default value is three minutes.


Deleting shared directory cluster resources

To delete a shared directory cluster resource using the Windows interface

  1. Open Cluster Administrator: click Start, point to Programs, point to Administrative Tools, and then click Cluster Administrator

  2. In the console tree (usually the left pane), double-click the Groups folder.

  3. In the details pane (usually the right pane), double-click the group that contains the resource you want to delete, and then click the resource.

  4. On the File menu, click Take Offline.

  5. When the resource is offline, on the File menu, click Delete.

To delete a shared directory cluster resource using the command line

  1. Open the command prompt.

  2. Type the following:

    cluster [ ClusterName ] resource " ResourceName " /offline /wait[: Timeout ]

  3. Then, type:

    cluster [ ClusterName ] resource " ResourceName " /delete

Argument | Description
ClusterName | The name of the cluster you want to manage.
ResourceName | The name of the cluster resource.
Timeout | The number of seconds cluster waits before canceling the command if it does not successfully complete. If /wait is specified without this value, cluster waits indefinitely or until the resource state changes.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • cluster /?


Securing Server for NFS

Allowing root access to resources by NFS clients

Allowing anonymous access to resources by NFS clients

Using Windows security descriptors with Server for NFS

Using DACLs with Server for NFS

Using setuid, setgid, and sticky bits with Server for NFS


Allowing root access to resources by NFS clients

You can allow UNIX users to have root access to resources. Some of these methods include:

  • Assigning the client computer root access when the share is exported. See Securing access to the User Name Mapping server.

  • Mapping (through either Active Directory Lookup or User Name Mapping) the UNIX user root (UID 0) to the Windows user Administrator. Also, mapping the group to which root belongs to the Windows group Administrators.

For example, consider a situation in which the directory Testdir is owned by Administrators. This directory was created with an account that is a member of the Windows group Administrators. The permissions listed were set after the directory was created. At the UNIX client, the permissions look like this:

ls ld /testdir
drwxrwxr-x 2 root root 64 Nov 3 12:11 /testdir/

When the directory is owned by Administrators, Server for NFS reports a user identifier (UID) and group identifier (GID) pair of 0,0.


Allowing anonymous access to resources by NFS clients

By default, Server for NFS does not allow anonymous users to access a shared directory. When you share a directory, you can allow anonymous access to the directory and you can change the default anonymous UID and GID values to the UID and GID of any valid UNIX user and group accounts. If you change the anonymous UID and anonymous GID for a share, those values will be used when reporting the owner of a file owned by a Windows user which is not mapped to UNIX user, even if anonymous access is not allowed. For more information about configuring anonymous access for a shared directory, see Allowing anonymous access to an NFS share.


Using Windows security descriptors with Server for NFS

Server for NFS uses the Windows security descriptor when implementing Network File System (NFS) access permissions. The security descriptor is the structure that governs security assignments for Windows. The security descriptor contains the following components:

  • File owner

  • File group

  • Discretionary access control list (DACL)

  • System access control list (SACL)

Notes
  • The SACL is used for auditing and does not affect file permissions.

Within the security descriptor, the file owner and group refer to security identifiers (SIDs). A SID can be thought of as the internal representation for an individual user or group. The primary reason for using SIDs is to differentiate among accounts across different domains that share the same account name. Even though the names are the same, they represent different accounts and can be given different permissions to the same file.

For more information, see Using DACLs with Server for NFS.


Using DACLs with Server for NFS

The discretionary access control list (DACL) within the security descriptor provides the core of Windows security. The DACL is a list of entries that grant or deny certain rights to specific users or groups. A list entry is called an access control entry (ACE). Each ACE consists of the following:

  • A security identifier (SID) to identify a particular user or group.

  • An access list that specifies the permissions allowed or denied for the user or group.

The following is an example of a DACL:

  • DACL: Mrjones Full Control (All)

  • ToolGroup:Read(RX)

  • Everyone:Read (RX)

In this DACL, Mrjones has read, write, and execute access to the file. Members of the group ToolGroup have read-and-execute access. Members of the group Everyone (all users) have read-and-execute access.

The following rules govern access to a file:

  • If no DACL is present, everyone is granted full access.

  • If a DACL is present, but contains no entries, everyone is denied access.

  • The file owner always has the ability to change the DACL.

In turn, these rules apply to the DACL:

  • DACL entries are searched sequentially.

  • All permissions are implicitly denied.

  • Once a permission has been denied, it cannot be granted.

  • Once a permission has been granted, it cannot be denied.

For more information, see Using Windows security descriptors with Server for NFS.


Using setuid, setgid, and sticky bits with Server for NFS

Users of client computers can use the chmod utility to set the setuid (set-user-identifier-on-execution), setgid (set-group-identifier-on-execution), and sticky file mode bits on files or directories that are stored on an NTFS file system partition and shared through Server for NFS. When the file or directory is subsequently accessed by a UNIX-based client, the standard semantics for these bits will apply. For example, an executable file that has the setuid bit set will execute under the user ID of the file's owner, not the user ID of the user who is executing the file.

Typically, when the setuid or setgid bit is set on a file, the owner or group of the file is changed to the owner or group under whose ID the file will be executed. Unless a user has the right to restore files or directories, Windows security allows a user to take ownership of a file (if the file's permissions allow it), but not to transfer ownership to a second user. Consequently, to use chown or chgrp to change the owner or group of a file to another user or group, you must have the privilege to restore files and directories. By default, this privilege is assigned to members of the Administrators and Backup Operators groups, although it can be assigned to other groups or to individual users. In addition, the account of the user running chown or chgrp and the user or group to whom ownership is being transferred must be properly mapped through Active Directory Lookup or User Name Mapping.

Some UNIX-based Network File System (NFS) servers apply special interpretations or restrictions for the setuid, setgid, and sticky bits. Some versions of UNIX, for example, enforce mandatory locking on a directory with the setgid bit set but no execute permissions. Server for NFS does not implement special interpretations or restrictions on using these bits.

Security issue

Typical UNIX setuid and setgid behavior present a known security issue in UNIX. An intruder can exploit setuid and setgid behavior by overwriting an executable file with a Trojan horse, and then running the executable file. The executable file runs with the rights of the owner, instead of running as the intruder.

To prevent this known security issue, by default, setuid and setgid are disabled and will not affect the UID or GID settings if the file or directory has both of the following characteristics:

  • One or both of the following bits is set: setgid or setuid.

  • The file or directory is group writable, group executable, world writable, or world executable.

Some customers may find this security measure problematic because it is different from the typical behavior of UNIX, although the typical behavior of UNIX setuid and setgid is not specified as part of the Network File System (NFS) protocol.

Procedures

To change setuid and setgid behavior

  1. Open the Registry Editor.

  2. Set the following registry key:

    HKEY_Local_Machine\System\CurrentControlSet\Services\NfsSvr\Parameters\SafeSetUidGidBits = (DWORD)

    • A value of 1 causes the bits the safer setuid and setgid behavior.

    • A value of 0 causes the standard UNIX behavior.


Optimizing Server for NFS performance

Adding performance counters

Monitoring and tuning performance

Changing the directory cache memory setting


Adding performance counters

To add performance counters

  1. Open Performance: click Start, point to Programs or All Programs, point to Control Panel, point to Administrative Tools, and then click Performance.

  2. Click the plus-sign (+) button.

  3. In the Performance object list, click Server for NFS, and then do one of the following:

    • Click All counters, and then click Add.

    • Or, click Select counters from list, click the counters you want to add, and then click Add.
Note

There is no command-line method for this procedure.


Monitoring and tuning performance

Server for NFS includes several tools for monitoring Network File System (NFS) use and for probing the network for other NFS servers and resources. These tools include Windows System Monitor, rpcinfo, showmount, and nfsstat.

You can use Windows System Monitor to display NFS statistics, including the number and type of requests received and the number of bytes read and written.

You can use the rpcinfo utility to:

  • List all programs registered with the port mapper on a local or remote host (rpcinfo -p).

  • Find all network nodes that have a specified program and version registered with the port mapper (rpcinfo -b). You must specify a program name and number and version.

  • Use the Transmission Control Protocol (TCP) to call the specified program (rpcinfo -t). You must specify a node name and program name. If a version is not specified, the program calls all versions.

  • Use the User Datagram Protocol (UDP) to call the specified program (rpcinfo -u). You must specify a node name and program name. If a version is not specified, the program calls all versions.

You can use the showmount utility to:

  • List all file systems exported on the specified NFS server (showmount -e).

  • List all remotely mounted clients and the directories each has mounted on the specified NFS server (showmount -a).

  • List all directories remotely mounted on the specified NFS server (showmount -d).

You can use the nfsstat utility to display the number of NFS v2, NFS v3, and Mount v3 calls made to the server since the counters were set to 0, either when the service started or when the counters were reset using nfsstat –z.


Changing the directory cache memory setting

To improve performance when resolving path names, Server for NFS maintains a cache of directory information that it can search instead of directories on the physical disk. By default, this cache is configured to use 128 kilobytes (KB) of memory. However, you can reduce the amount of memory the directory cache uses. For more information, see Setting the folder cache size.


This content might have been updated. For the most recent version, see the Windows Server 2003 R2 TechCenter Web site

Using file systems with NFS

Understanding NFS and file names

Using CDFS with NFS

Using NTFS file systems with NFS


Understanding NFS and file names

Because Network File System (NFS) has its origins on UNIX-based computers, the conventions used for naming files and directories on NFS file systems differ in several respects from those used by Windows. This topic covers three of these differences and describes how you can configure Server for NFS to deal appropriately with them. These differences are:

  • Special characters

  • Case sensitivity

  • Hidden files

In addition, this topic also discusses directory- and file-name encoding for client computers localized for East Asian languages.

Special characters

Every file system has characters that cannot be used in directory and file names, usually because those characters are reserved for use in path and command syntax. For example, a file stored on the NTFS file system cannot contain a colon (:) character because that character is used to separate the drive letter from the rest of the path in a fully qualified path name. UNIX file systems do not use letters to identify drives, so this syntax is not used, and consequently, colon characters can appear in UNIX file names.

Server for NFS stores files on Windows-based file systems on behalf of NFS clients, which assume UNIX file system conventions. Because of this, you can use Server for NFS to specify how characters in directory and file names will be converted (mapped) when files are moved between Server for NFS and client computers. To accomplish this, you must create a file that defines how these characters are to be mapped, and then specify where Server for NFS can find the file containing these character maps. For information about creating the character map file, see Overview of file-name character translation. To learn how to configure Server for NFS to use this file, see Configuring file-name character translation.

Case sensitivity

Windows and UNIX computers typically differ in the way they use the case of letters in directory and file names.

UNIX computers are usually case sensitive when handling directory and file names. That is, a UNIX computer will distinguish between a file named MYFILE and a file named MyFile, allowing both to coexist in the same directory and accessing them only when the case used in the file name matches the stored file name exactly.

Windows-based computers, on the other hand, are case preserving, but not case sensitive. That is, they will allow a file to be named MyFile or MYFILE and will preserve the case difference, but will not allow two files with the same name, differing only in letter case, to be stored in the same directory. Nor do they use case as a criterion when locating files. In other words, either MyFile or MYFILE can exist in the same directory, but not both, and either file can be accessed using the name MYFILE or MyFile.

By default, Server for NFS is case sensitive when matching directory-access and file-access requests to directories and files in its shared directories, and it preserves the case of the names of directories and files when creating files on behalf of NFS client computers. You can instruct Server for NFS not to be case sensitive when returning directory and file names. For more information, see Configuring case sensitivity for file and folder names.

Hidden files

Files can be hidden (that is, not displayed when the directory they are store in is listed) on both Windows and UNIX computers. In the case of Windows-based computers, files are hidden by setting a special attribute for the file. UNIX file systems simply do not list files whose names begin with a period (.) character. By default, Server for NFS does not create files with names beginning with a period as hidden files in the Windows file system.

Directory- and file-name encoding

Client computers that are localized for an East Asian language require special support by NFS servers to be able to use characters in that language when creating directory and file names. This support, called encoding, determines how two-byte character codes exchanged between the server and a client computer will be interpreted. You can configure an NFS share to provide a default language-specific encoding scheme for all clients that access the share; you can also specify an encoding scheme for each client in the permissions list of the share. For more information, see Setting default encoding for an NFS share and Creating an NFS share.


Using CDFS with NFS

Unlike the NTFS file system, the CD-ROM file system (CDFS) does not provide any type of access control. The mount permissions granted by the Network File System (NFS) server administrator govern all access control. The CDFS file system always shares data as a read-only resource, regardless of the type of share permission you give it.

The characteristics of the CDFS file system include the following:

  • Because this file system was designed around single-user computers, there is no such thing as a file owner.

  • Just as no file owner exists, neither does a file group.

  • There is no support for file links. This file system uses a single-name/single-file format with no support for multiple directory entries referring to the same file.

Because of these limitations, the following conventions are a part of the Server for NFS implementation:

  • The file owner and group are always returned as the owner and group given in the UNIX verification of the request. This means that every individual user is reported as the owner of all files. Having different users of the same file both reported as owners can seem confusing at first, but it is in keeping with the concept that anyone with access to the file system owns it. Any attempt to modify the owner or group of a file fails. If no UNIX verification is passed, the anonymous user identifier (UID) and the anonymous group identifier (GID) are reported. By default, the anonymous UID and anonymous GID are both –2 (65534 when used as an unsigned 2-byte integer), although these values can be changed for a share.

  • Permissions are reported as read-and-execute for owner, group, and other (in UNIX notation:

    -r-xr-xr-x

Any attempt to modify data or attributes on the shared resource fails.


Using NTFS file systems with NFS

Under UNIX, a file has a single owner and a single group, with certain permissions (read, write, and/or execute) granted to each. Separate permissions are also granted for others, meaning any other users who are not members of the group that owns the file.

The NTFS file system, however, allows permissions to be assigned to many users or groups independently. For example, an NTFS file can specify that User A is to have read-and-write access, while User B is to have only read access. The same file can also have certain permissions for one or more groups. The objective of Server for NFS is to provide a consistent, intuitive mapping of file permissions that UNIX clients can work with, and that users can understand.


Managing NFS shares

Accessing a Windows NFS share from a UNIX client

Overview of file-name character translation

Specifying the NFS protocol to use

Creating an NFS share

Setting default encoding for an NFS share

Adding clients and groups to the NFS share permissions list

Configuring access to an NFS share for a client computer or group

Allowing anonymous access to an NFS share

Configuring DFS shares for NFS

Configuring shared folders on a server cluster

Resolving file permission conflicts

Enabling advisory file locking


Accessing a Windows NFS share from a UNIX client

To access a Windows NFS share from a UNIX client

  1. Open the UNIX command prompt.

  2. Create a directory that will act as the mount point for the Windows Network File System (NFS) share.

  3. Type the following command:

    mount [-f nfs] [-o options] remote_host_name:/directory mount_point

Argument | Description
options | Options include hard for hard mounts, soft for soft mounts, and more. For more information, refer to the UNIX man pages.
remote_host_name :/ directory | The name of the computer and directory to mount.
mount_point | The local directory that you created which will act as a mount point.
Notes
  • To view the complete syntax for this command, at the UNIX command prompt, type:
  • man mount


Overview of file-name character translation

Although Windows and UNIX file systems do not allow certain characters in file names, the characters that are prohibited by each operating system are not the same. For example, a valid Windows file name cannot contain a colon (:), but a valid UNIX file name can. If a UNIX user attempts to create a file in a Network File System (NFS) share on Server for NFS, and that file contains an illegal character in its name, the attempt will fail.

To prevent this problem, use file-name character mapping to replace characters that are not allowed in a file system. To enable file-name character translation, create a text file that maps Windows to UNIX characters, and then configure Server for NFS to specify the path and name of the translation file.

A file-name character translation file is simply a list of mapped characters in the format:

0x nn 0x nn : 0x nn 0x nn [ ; comment]

where nn is the hexadecimal value of one byte of a two-byte Unicode character, and comment is an optional comment, which is preceded by a semicolon (;). Everything from the semicolon to the end of the line is ignored. The first character in the entry is the character on the client (UNIX) computer, while the second is the character used on the Windows-based Server for NFS computer.

For example, the following maps the UNIX colon (:) to a Windows dash (-):

0x00 0x3a : 0x00 0x2d ; replace client : with - on server

If this entry appears in the file-name character translation file on a Server for NFS computer, when an NFS client creates a file named re:salesquotas on a Server for NFS share, Server for NFS names the file re-salesquotas. This is the name that appears in Windows Explorer when local or remote Windows users display the contents of the shared folder. NFS clients that list the contents of the shared directory, however, see the file name as re:salesquotas. Character translation takes place for all files shared by the server, regardless of whether they were created by an NFS client.

Do not map a given character to more than one character. Mapping a character to two or more different characters, as shown in the following example, will produce unexpected results:

0x00 0x11 : 0x00 0x22

0x00 0x11 : 0x00 0x33

Do not map a period (.) because it is used in the file-name syntax of both Windows and UNIX file systems.

After you have created the file-name character translation file, you must specify its location.

Important

To prevent unauthorized users from tampering with the file-name character translation file and causing Server for NFS to fail, ensure that the file is protected with a discretionary access control list (DACL) that grants Full Control to the built-in System account and to the Administrators group. The DACL should contain no other entries.


Specifying the NFS protocol to use

Network File System (NFS) is a network protocol that, in its most widely adopted forms, is defined in RFC 1094 for NFS version 2 and in RFC 1813 for NFS version 3. By default, Server for NFS supports clients using either version. You can override this, however, and configure Server for NFS to allow access only by version 2 client computers. See Enabling NFS version 3.

NFS relies on two transport protocols: Transmission Control Protocol (TCP) and User Datagram Protocol (UDP). Server for NFS supports both protocols. You can specify the transport protocol supported by Server for NFS. For more information about this,

see Specifying Server for NFS TCP and UDP settings.


Creating an NFS share

To create a share using the Windows interface

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. In the details pane, right-click the shared directory you want to manage.

  3. Click NFS Sharing.

  4. Select Share this Folder.

  5. Type a name for the share in the Share Name text box.

  6. Click Apply.
To create a share using the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsshare ShareName= drive:path

Argument | Description
sharename | The name of the directory to share.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsshare /?
  • This command only works with Windows Server 2003 operating systems.


Setting default encoding for an NFS share

To set default encoding for a shared directory using the Windows interface

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. In the details pane, right-click the shared directory you want to manage.

  3. Click Sharing.

  4. Click NFS Sharing.

  5. In the Encoding list, select the type of encoding to be used for file and directory names in the shared directory. In addition to the default American National Standards Institute (ANSI) encoding, the following encoding is available:

    • BIG5 (Chinese)

    • EUC-JP (Japanese)

    • EUC-KR (Korean)

    • EUC-TW (Chinese)

    • GB2312-80 (Simplified Chinese)

    • KSC5601 (Korean)

    • SHIFT-JIS (Japanese)

  6. If this option is set to ANSI on systems configured for non-English locales, the encoding scheme is set to the default encoding scheme for the locale. The following are the default encoding schemes for the indicated locales:

    • Japanese: SHIFT-JIS

    • Korean: KS_C_5601-1987

    • Simplified Chinese: GB

    • Traditional Chinese: BIG5
To set default encoding for a shared directory using the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsshare -o encoding={big5|euc-jp|euc-kr|euc-tw|gb2312-80|ksc5601|shift-jis} sharename

Argument Description

sharename

The name of the directory to share.

-o encoding= type

Specifies the default encoding. You must specify one of the following types:

  • big5 (Chinese)

  • euc-jp (Japanese)

  • euc-kr (Korean)

  • euc-tw (Chinese)

  • gb2312-80 (Simplified Chinese)

  • ksc5601 (Korean)

  • shift-jis (Japanese)

If you do not specify an encoding type, the default encoding scheme is ANSI or, on systems configured for non-English locales, the default encoding scheme for the locale. The following are the default encoding schemes for the indicated locales:

  • Japanese: SHIFT-JIS

  • Korean: KS_C_5601-1987

  • Simplified Chinese: GB2312-80

  • Traditional Chinese: BIG5

Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsshare /?


Adding clients and groups to the NFS share permissions list

To add clients and groups to the NFS share permissions list using the Windows interface

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. In the details pane, right-click the shared directory you want to manage.

  3. Click Sharing.

  4. Click NFS Sharing.

  5. If the directory is not already shared, click Share this folder, and then, in the Share name box, type a name for the share.

  6. Click Permissions, click Add, and then do one of the following:

  7. Do either of the following:

    • In the Names list, click the clients and groups you want to add, and then click Add.

    • Or, in the Add Names box, type the names of clients or groups you want to add, separating names in the list with a semicolon (;).

  8. To see a list of the members of a group, in the Names list, click a group, click Members.

  9. In the Type of Access list, click the type of access you want to allow the selected clients and groups.

  10. Select Allow Root Access if you want a user identified as root to have access other than as an anonymous user. By default, the user identifier (UID) root user is coerced to the anonymous UID.

  11. In the Encoding list, click the type of directory- and file-name encoding to be provided to the selected clients and groups. In addition to the default American National Standards Institute (ANSI) encoding, the following encoding is available:

    • BIG5 (Chinese)

    • EUC-JP (Japanese)

    • EUC-KR (Korean)

    • EUC-TW (Chinese)

    • GB2312-80 (Simplified Chinese)

    • KSC5601 (Korean)

    • SHIFT-JIS (Japanese)

    Note

    If this option is set to ANSI on systems configured for non-English locales, the encoding scheme is set to the default encoding scheme for the locale. The following are the default encoding schemes for the indicated locales:

    • Japanese: SHIFT-JIS

    • Korean: KS_C_5601-1987

    • Simplified Chinese: GB

    • Traditional Chinese: BIG5

  12. To close the dialog box, click OK.

To add clients and groups to the NFS share permissions list using the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsshare -o option [= host [: host ]...] sharename

Argument Description

sharename

The name of the shared directory.

-o option

Specifies one or more options to set and must be set to at least one of the following:

  • big5 (Chinese)

  • euc-jp (Japanese)

  • euc-kr (Korean)

  • euc-tw (Chinese)

  • gb2312-80 (Simplified Chinese)

  • ksc5601 (Korean)

  • shift-jis (Japanese)

If this option is not set, the default encoding scheme is used.

noroot[= host [: host ]...]

Denies root access to the shared directory by the clients or client groups specified by host. Separate client and group names with a colon (:). If you do not specify a host, root access is denied to all clients and groups for which root access is not explicitly granted.

ro[= host [: host ]...]

Provides read-only access to the shared directory by the clients or client groups specified by host. Separate client and group names with a colon (:). If you do not specify a host, read-only access is granted to all clients and groups for which access is not explicitly granted or denied.

root[= host [: host ]...]

Provides root access to the shared directory by the clients or client groups specified by host. Separate client and group names with a colon (:). If you do not specify a host, root access is granted to all clients and groups for which root access is not explicitly denied.

rw[= host [: host ]...]

Provides read/write access to the shared directory by the clients or client groups specified by host. Separate client and group names with a colon (:). If you do not specify a host, read/write access is granted to all clients and groups for which access is not explicitly granted or denied.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsshare /?
  • By default, when a directory is shared, all client computers are granted read-only access, and anonymous access is not allowed.


Configuring access to an NFS share for a client computer or group

To configure access to an NFS share for a client or group using the Windows interface

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. In the details pane, right-click the shared directory you want to manage.

  3. Click Sharing.

  4. Click NFS Sharing, and then, if the folder has not already been shared, click Share this folder.

  5. Click Permissions.

  6. Click the client or group for which you want to set permissions.

  7. In the Type of Access list, click the type of access you want to allow the client or group.

  8. Select Allow Root Access if you want a user identified as root to have access other than as an anonymous user. By default, the user identifier (UID) root user is coerced to the anonymous UID.

  9. In the Encoding list, click the type of directory- and file-name encoding to be provided to the client or group. In addition to the default American National Standards Institute (ANSI) encoding, the following encoding is available:

    • BIG5 (Chinese)

    • EUC-JP (Japanese)

    • EUC-KR (Korean)

    • EUC-TW (Chinese)

    • GB2312-80 (Simplified Chinese)

    • KSC5601 (Korean)

    • SHIFT-JIS (Japanese)

    Note

    If this option is set to ANSI on systems configured for non-English locales, the encoding scheme is set to the default encoding scheme for the locale. The following are the default encoding schemes for the indicated locales:

    • Japanese: SHIFT-JIS

    • Korean: KS_C_5601-1987

    • Simplified Chinese: GB

    • Traditional Chinese: BIG5

  10. Click OK twice.
To configure access to an NFS share for a client or group using the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsshare -o option [= host [: host ]...] sharename

Argument Description

sharename

The name of the shared directory.

-o

Specifies one or more options to set and must be set to at least one of the following:

{big5|euc-jp|euc-kr|euc-tw|gb2312-80|ksc5601|shift-jis}= host [: host ]...

Specifies the file- and directory-name encoding for individual client computers or client groups. The following encoding schemes are available:

  • big5 (Chinese)

  • euc-jp (Japanese)

  • euc-kr (Korean)

  • euc-tw (Chinese)

  • gb2312-80 (Simplified Chinese)

  • ksc5601 (Korean)

  • shift-jis (Japanese)

If this option is not set, the default encoding scheme is used.

na

Specifies that no client or group is granted access to the NFS share unless you explicitly grant it access.

noroot[= host [: host ]...]

Denies root access to the shared directory by the clients or client groups specified by host. Separate client and group names with a colon (:). If host is not specified, root access is denied to all clients and groups for which root access is not explicitly granted.

removeclient[= host [: host ]...]

Removes the specified clients from the list of permissions of the shared directory. Separate client and group names with a colon (:).

ro[= host [: host ]...]

Provides read-only access to the shared directory by the clients or client groups specified by host. Separate client and group names with a colon (:). If host is not specified, read-only access is granted to all clients and groups for which access is not explicitly granted or denied.

root[= host [: host ]...]

Provides root access to the shared directory by the clients or client groups specified by host. Separate client and group names with a colon (:). If host is not specified, root access is granted to all clients and groups for which root access is not explicitly denied.

rw[= host [: host ]...]

Provides read/write access to the shared directory by the clients or client groups specified by host. Separate client and group names with a colon (:). If host is not specified, read/write access is granted to all clients and groups for which access is not explicitly granted or denied.

Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsshare /?
  • By default, when a directory is shared, all client computers are granted read-only access, and anonymous access is not allowed.


Allowing anonymous access to an NFS share

To allow anonymous access to an NFS share using the Windows interface

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. In the details pane, right-click the shared directory you want to manage.

  3. Click Sharing.

  4. Click NFS Sharing.

  5. Select Allow anonymous access.

  6. To specify a nondefault value for the anonymous user identifier (UID) or anonymous group identifier (GID), type the value in the Anonymous UID or Anonymous GID box.

  7. Click Apply.
Notes
  • The anonymous UID and anonymous GID values for a share will be used when reporting the owner of a file owned by an unmapped user, even if Allow Anonymous Access is disabled.
  • In Windows Server 2003 operating systems, the Everyone group does not include anonymous users by default. For information about providing anonymous access, see Allowing anonymous access to resources by NFS clients.
To allow anonymous access to an NFS share using the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsshare -o option = value ... sharename

Argument Description

sharename

The name of the shared directory.

-o

Specifies one or more options to be set and must be set to at least one of the following:

anon={yes | no}

Specifies whether anonymous (unmapped) users can access the shared directory. The default is no.

anonuid= uid

Specifies that anonymous (unmapped) users will access the share directory using uid as their user identifier (UID). The default is -2. The anonymous UID will be used when reporting the owner of a file owned by an unmapped user, even if anonymous access is disabled.

anongid= gid

Specifies that anonymous (unmapped) users will access the share directory using gid as their group identifier (GID). The default is -2. The anonymous GID will be used when reporting the owner of a file owned by an unmapped user, even if anonymous access is disabled.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsshare /?
  • In Windows Server 2003 operating systems, the Everyone group does not include anonymous users by default. For information about providing anonymous access, see Allowing anonymous access to resources by NFS clients.


Configuring DFS shares for NFS

You can use Distributed File System (DFS) to connect to a Network File System (NFS) share.

To configure DFS shares for NFS

  1. Set up an NFS server and create an NFS share.

  2. Install Client for NFS on the computer that is running DFS.

  3. On the DFS server, add a link in DFS that points to the share on the NFS server.

  4. To access the NFS share from any computer, connect to the DFS server as you would normally connect to any Windows file server.

  5. Browse to the link you created.


Configuring shared folders on a server cluster

Configuring an NFS share as a cluster resource

Modifying an NFS shared cluster resource

Deleting an NFS shared cluster resource


Configuring an NFS share as a cluster resource

To share a directory as a cluster resource using the Windows interface

  1. Open Cluster Administrator: click Start, point to Programs, point to Administrative Tools, and then click Cluster Administrator.

  2. In the console tree (usually the left pane), double-click the Groups folder.

  3. In the details pane (usually the right pane), click the group to which you want the resource to belong.

  4. On the File menu, point to New, and then click Resource.

  5. In the New Resource wizard, type the appropriate information in Name and Description, and in Resource type, click NFS Sharing. Click Next.

  6. Add or remove possible owners of the resource, and then click Next.

  7. To add or remove dependencies, do one of the following:

    • To add dependencies, under Available resources, click a resource, and then click Add.

    • To remove dependencies, under Resource dependencies, click a resource, and then click Remove.

  8. In Share Name, type the name of the shared folder.

  9. In Share Path, type the fully qualified path of the folder to be shared.

  10. Do one of the following:

    • To share the folder and its contents as a single shared folder, click Share Root Only.

    • To share all folders (except hidden folders) in the folder specified in the previous step as separate shared folders, click Share Subdirectories Only.

  11. To allow access by users who have not been authenticated, click Allow anonymous access.

  12. To change the user identifier (UID) and group identifier (GID) values assigned to anonymous users, type the new values in the Anonymous UID and Anonymous GID boxes.

  13. In the Encoding list, select the type of encoding to be used for file and directory names in the shared directory. In addition to the default American National Standards Institute (ANSI) encoding, the following encoding is available:

    • BIG5 (Chinese)

    • EUC-JP (Japanese)

    • EUC-KR (Korean)

    • EUC-TW (Chinese)

    • GB2312-80 (Simplified Chinese)

    • KSC5601 (Korean)

    • SHIFT-JIS (Japanese)

    Note

    If this option is set to ANSI on systems configured for non-English locales, the encoding scheme is set to the default encoding scheme for the locale. The following are the default encoding schemes for the indicated locales:

    • Japanese: SHIFT-JIS

    • Korean: KS_C_5601-1987

    • Simplified Chinese: GB2312-80

    • Traditional Chinese: BIG5

  14. To specify permissions for the client computers that can access the shared folder, click Permissions.

  15. Click Finish.
Important

Before adding a resource to your cluster, you must verify the following:

  • The NFS Share resource type is available. This resource type was created when you installed Server for NFS on the cluster node.

  • A group already exists within the cluster to which your resource will belong.

  • All dependent resources have been created.

Note

In Windows Server 2003 operating systems, the Everyone group does not include anonymous users by default. For information about providing anonymous access when Server for NFS is running on these operating systems, see Allowing anonymous access to resources by NFS clients.
To share a directory as a cluster resource using the command line

  1. Open the command prompt.

  2. Type the following:

    cluster [ ClusterName ] resource " ResourceName " /create /restype:"NFS Share" /group:" GroupName " /privproperties ShareName=" ShareName ":STRING Path=" SharePath ":STRING ShareSubDirs= ShareType :DWORD GlobalPerm= PermType :DWORD Encoding= EncodingType :DWORD AnonymousAccessAllowed= AccessType :DWORD

  3. Then, type:

    cluster [ ClusterName ] resource " ResourceName " /online /wait[: Timeout ]

Argument Description

ClusterName

The name of the cluster you want to manage.

ResourceName

The name of the cluster resource.

GroupName

The name of the group to which you want to add the resource.

ShareName

The name of the shared directory you want to create. This value is ignored if ShareType is 0x1

SharePath

The fully qualified path of the directory to be shared.

ShareType

0x0 if only the directory specified by SharePath is to be shared. 0x1 if the subdirectories (except hidden subdirectories) in the directory specified by SharePath are to be shared individually.

PermType

Specifies root-access and read-write permission combinations. PermType must be one of the following values:

0x1—No access

0x9—No Access + Root

0x2—Read only

0xa—Read only + Root

0x4—Read/write

0xc—Read/write + Root

EncodingType

Specifies the default encoding used for file and directory names and, if used, must be set to one of the following:

  • 0x7—ANSI

  • 0x5—BIG5 (Chinese)

  • 0x0—EUC-JP (Japanese)

  • 0x1—EUC-KR (Korean)

  • 0x2—EUC-TW (Chinese)

  • 0x6—GB2312-80 (Simplified Chinese)

  • 0x4—KS_C_5601-1987 (Korean)

  • 0x3—SHIFT-JS (Japanese)

If this is option is set to 0x7, the encoding scheme is ANSI or, on systems configured for non-English locales, the default encoding scheme for the locale. The following are the default encoding schemes for the indicated locales:

  • Japanese: SHIFT-JIS

  • Korean: KS_C_5601-1987

  • Simplified Chinese: GB2312-80

  • Traditional Chinese: BIG5

AccessType

0x0 if anonymous access to the shared directory is not allowed. 0x1 if anonymous access is allowed.

Timeout

The number of seconds cluster waits before canceling the command if it does not successfully complete. If /wait is specified without this value, cluster waits indefinitely or until the resource state changes.
Important

Before adding a resource to your cluster, you must verify the following:

  • The NFS Share resource type is available. This resource type was created when you installed Server for NFS on the cluster node.

  • A group already exists within the cluster to which your resource will belong.

  • All dependent resources have been created.

Notes
  • In Windows Server 2003 operating systems, the Everyone group does not include anonymous users by default. For information about providing anonymous access when Server for NFS is running on these operating systems, see Allowing anonymous access to resources by NFS clients.
  • To view the complete syntax for this command, at a command prompt, type:
  • cluster /?
  • All arguments listed above are required. Using default values might produce unexpected results.
  • You must use the Windows interface to set permissions on shared directories.
  • If the attempt to share the directory fails, cluster displays an error message, and detailed information about the failure is recorded in the cluster log.
  • You cannot set the user identifier (UID) and group identifier (GID) values assigned to anonymous users using the command line.


Modifying an NFS shared cluster resource

To modify a shared directory cluster resource using the Windows interface

  1. Open Cluster Administrator: click Start, point to Programs, point to Administrative Tools, and then click Cluster Administrator.

  2. In the console tree (usually the left pane), double-click the Groups folder.

  3. In the details pane (usually the right pane), double-click the group that contains the resource you want to modify, and then click the resource.

  4. On the File menu, click Take Offline.

  5. When the resource is offline, on the File menu, click Properties.

  6. Change the properties you want to modify, and then click OK.

  7. On the File menu, click Bring Online.
To modify a shared directory cluster resource using the command line

  1. Open the command prompt.

  2. Type the following:

    cluster [ ClusterName ] resource " ResourceName " /offline /wait[: Timeout ]

  3. Then, type:

    cluster [ ClusterName ] resource " ResourceName " / Option

  4. Then, type:

    cluster [ ClusterName ] resource " ResourceName " /online /wait[: Timeout ]

Argument | Description
ClusterName | The name of the cluster you want to manage.
ResourceName | The name of the cluster resource.
Timeout | The number of seconds cluster waits before canceling the command if it does not successfully complete. If /wait is specified without this value, cluster waits indefinitely or until the resource state changes.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • cluster /?


Deleting an NFS shared cluster resource

To delete a shared directory cluster resource using the Windows interface

  1. Open Cluster Administrator: click Start, point to Programs, point to Administrative Tools, and then click Cluster Administrator.

  2. In the console tree, double-click the Groups folder.

  3. In the details pane, double-click the group that contains the resource you want to delete, and then click the resource.

  4. On the File menu, click Take Offline.

  5. When the resource is offline, on the File menu, click Delete.

To delete a shared directory cluster resource using the command line

  1. Open the command prompt.

  2. Type the following:

    cluster [ ClusterName ] resource " ResourceName " /offline /wait[: Timeout ]

  3. Then, type:

    cluster [ ClusterName ] resource " ResourceName " /delete

Argument | Description
ClusterName | The name of the cluster you want to manage.
ResourceName | The name of the cluster resource.
Timeout | The number of seconds cluster waits before canceling the command if it does not successfully complete. If /wait is specified without this value, cluster waits indefinitely or until the resource state changes.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • cluster /?


Resolving file permission conflicts

UNIX uses three levels of file permission settings: user permissions, group permissions, and permissions for everyone else. Additionally, root has full permissions to all files, regardless of the file settings.

In Windows, the administrator can access all files, but cannot modify the files without first modifying the permissions. Consequentially, automated activities such as virus checking can change the UNIX permissions and potentially cause problems for UNIX clients.

To resolve this problem, you must modify the KeepInheritance registry value, add the Windows group to the share, and configure Access Control Entries (ACEs) to apply to newly created directories.

To modify the KeepInheritance registry value

  1. Open the Registry Editor: click Start, and then click Run. Then, enter regedit and click OK.

  2. Set the following registry key to 1:

    HKLM\Software\Microsoft\Server for NFS\CurrentVersion\Mapping\KeepInheritance

Note

Setting this registry key can affect how permissions appear in UNIX.
To configure ACEs to apply to newly created directories

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. Right-click a folder and select Properties.

  3. Click the Security tab.

  4. Click Advanced.

  5. Select the Allow inheritable permissions check box.

  6. Click OK.


Enabling advisory file locking

In Windows, file locking is mandatory. In UNIX, file locking is advisory.

By default, Server for NFS file shares use mandatory file locking. This is generally not a problem, but can affect some UNIX applications.

To configure Windows to use advisory file locking, you must clear the EnableSMBLocking registry key.

To modify the Advisory Locking registry value

  1. Open the Registry Editor.

  2. Set the following registry key to 0:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NfsSvr\NlmNsm\EnableSMBLocking

Caution

Setting this registry value turns off mandatory locks only for Network File System (NFS) lock requests. Windows applications continue to use mandatory locks. As a result, if one NFS client obtains a read/write lock on a file, then other NFS clients that are also using NLM locks before accessing a file for read/write will honor that lock. However, any Windows application can still modify the file, either through a server message block (SMB) share, or when running on the computer where the file is located, because advisory locks do not actually lock the file on the server. Additionally, although an NFS client may have obtained a lock on a file, a Windows application (either running locally or accessing the file through a CIFS share) can get a mandatory lock on the file, thereby preventing the NFS client from accessing the file, even though the NFS client has a read/write lock on the file.


Managing NFS client groups

Creating an NFS client group

Renaming an NFS client group

Deleting an NFS client group

Adding an NFS client computer to an NFS client group

Deleting an NFS client computer from an NFS client group


Creating an NFS client group

To create an NFS client group using the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsadmin server [ ComputerName ] creategroup GroupName

Argument | Description
ComputerName | The name of the computer you want to manage.
GroupName | The name of the group to create.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?
  • You cannot give a group the same name as a client in the group.


Renaming an NFS client group

To rename an NFS client group using the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsadmin server [ ComputerName ] renamegroup OldName NewName

Argument | Description
ComputerName | The name of the computer you want to manage.
OldName | The current name of the group you want to change.
NewName | The new name for the group.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?
  • You cannot give a group the same name as a client in the group.


Deleting an NFS client group

To delete an NFS client group using the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsadmin server [ ComputerName ] deletegroup GroupName

Argument | Description
ComputerName | The name of the computer you want to manage.
GroupName | The name of the group to delete.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?


Adding an NFS client computer to an NFS client group

To add an NFS client computer to an NFS client group using the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsadmin server [ ComputerName ] addmembers GroupName Member [, Member ...]

Argument | Description
ComputerName | The name of the computer you want to manage.
GroupName | The name of the group to which you want to add members.
Member | The host name or IP address of the member you want to add.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?
  • You cannot give a group the same name as a client in the group.
  • You can add a range of IP addresses as a group member, for example, 127.0.0.*. However, you cannot remove a single computer in the range specified in this manner. You must remove the entire range.


Deleting an NFS client computer from an NFS client group

To delete an NFS client computer from an NFS client group using the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsadmin server [ ComputerName ] deletemembers GroupName Member [, Member ...]

Argument | Description
ComputerName | The name of the computer you want to manage.
GroupName | The name of the group from which you want to delete members.
Member | The host name or IP address of the member you want to delete.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?


Using Microsoft Services for NFS with server clusters

Understanding how Server for NFS works with server clusters

Using Server for NFS on a server cluster


Understanding how Server for NFS works with server clusters

A server cluster is a group of independent computer systems, known as nodes, that work together as a single system to ensure that mission-critical applications and resources remain available to clients. Every node is attached to one or more cluster storage devices. Clustering allows users and administrators to access and manage the nodes as a single system rather than as separate computers.

Server for NFS is specifically designed to make use of the server cluster. Because of this, when Server for NFS is installed on a server cluster, you can share a directory as a cluster resource. This ensures that if the node sharing the directory fails, another node in the cluster will resume sharing the directory until the failed node is restored. Running Server for NFS on a server cluster also allows you to provide static load balancing by distributing file shares among two or more nodes in the cluster. For more information about Windows clustering, see "Server Clusters" in Windows Help.


Using Server for NFS on a server cluster

Because Server for NFS is specifically designed to make use of server clusters, you can use Cluster Administrator to configure Network File System (NFS) shared directories as cluster resources. This provides for high availability of those shared directories. This ensures that if the cluster node sharing the directory should be shut down or fail, another node in the cluster will assume sharing the NFS shared directory until the first node restarts. In addition to enhancing availability, distributing NFS shares among nodes in the cluster can provide for static load balancing among several servers. For more information about sharing NFS directories on a server cluster, see Configuring shared folders on a server cluster.

Because the NFS shared directory is the cluster resource (instead of the Server for NFS service itself), ownership of individual NFS shares can move easily from one node to the other, as circumstances require. However, configuration changes to Server for NFS (such as the name of the User Name Mapping server) on one node are automatically replicated to instances of Server for NFS running on other cluster nodes. This simplifies administration of multiple servers because you only have to configure Server for NFS on one computer.

Note

To ensure proper operation of Server for NFS in a server cluster, when stopping the server cluster, first stop Server for NFS, then stop the server cluster.


Server for NFS Authentication

When a UNIX user attempts to access a file shared by Server for NFS, Server for NFS uses either Active Directory Lookup or User Name Mapping to obtain the corresponding Windows user name of that UNIX user. When the Windows user name is obtained, Server for NFS then passes this information to either a domain controller or the security authority of the local server, depending on the type of account (domain or local):

  • If the Windows user name is a domain account, then the domain controller authenticates the user with Kerberos extensions called Services-For-User (S4U).

  • If the Windows user name is a local account, then the local security authority needs the assistance of Server for NFS Authentication. Without Server for NFS Authentication, the local security authority cannot authenticate the user and access will be denied.

Note

Active Directory Lookup always associates UNIX users to Windows domain user accounts. If Server for NFS is configured to only use Active Directory Lookup, then you will not need to install Server for NFS Authentication on the local computer. If you want to associate UNIX users with Windows user accounts, you must use User Name Mapping.

Important

Domain controllers running Windows 2000 and earlier operating systems do not support S4U authentication. UNIX users associated with Windows domain accounts on Windows 2000 and earlier domain controllers will be denied access unless you download and install a prior version of Server for NFS Authentication. For more information, see the Microsoft Web site.

To install Server for NFS Authentication

  1. In Control Panel, click Add or Remove Programs. Then click Add/Remove Windows Components.

  2. From the list of components, in the Windows Components Wizard dialog box, select Other Network File and Print Services, and click Details.

  3. From the list of subcomponents, select Microsoft Services for NFS, and click Details again.

  4. Select Server For NFS Authentication, and click OK.

  5. Click OK again and then Next, and after the configuration of the new component has completed, click Finish.


User Name Mapping administration

User Name Mapping associates Windows and UNIX user names for Client for NFS and Server for NFS. This allows users to connect to Network File System (NFS) resources without having to log on to UNIX and Windows systems separately.

Note

Most of the functionality of User Name Mapping has been replaced by Active Directory Lookup. Active Directory Lookup enables Client for NFS and Server for NFS to obtain user identifier (UID) and group identifier (GID) information directly from Active Directory. For information about storing UNIX user data in Active Directory, refer to the accompanying Identity Management for UNIX documentation. For information about enabling Active Directory Lookup, see Specifying how Server for NFS obtains Windows user and group information or Specifying how Client for NFS obtains UNIX UID and GID information.

This section includes the following topics:

Understanding the User Name Mapping component

Starting and stopping User Name Mapping

Configuring User Name Mapping

Securing access to the User Name Mapping server

Managing maps

Mapping groups


Understanding the User Name Mapping component

User Name Mapping acts as a single clearinghouse that provides centralized user mapping services for Client for NFS and Server for NFS.

User Name Mapping lets you create maps between Windows and UNIX user and group accounts even though the user and group names in both environments may not be identical. Perhaps most importantly, User Name Mapping lets you maintain a single mapping database for the entire enterprise. This makes it easy to configure account mapping for multiple computers running Microsoft Services for Network File System (NFS).

In addition to one-to-one mapping between Windows and UNIX user and group accounts, User Name Mapping permits one-to-many mapping. This lets you associate multiple Windows accounts with a single UNIX account. This can be useful, for example, when you do not need to maintain separate UNIX accounts for individuals and would rather use a few accounts to provide different classes of access permission.

You can use simple maps, which map Windows and UNIX accounts with identical names. You can also create advanced maps to associate Windows and UNIX accounts with different names, which you can use in conjunction with simple maps. For information about simple and advanced maps, see Understanding user maps.

User Name Mapping can obtain UNIX user, password, and group information from one or more Network Information Service (NIS) servers or from password and group files located on a local hard drive. The password and group files can be copied from a UNIX host or from a NIS server. See Configuring User Name Mapping for more information about specifying the source for UNIX user information.

User Name Mapping periodically refreshes its mapping database from the source databases, ensuring that it is always kept up-to-date as changes occur in the Windows and UNIX name spaces. You can also refresh the database anytime you know the source databases have changed. For information about how to refresh the database automatically and manually, see Configuring the refresh interval for maps and Refreshing maps.

You can back up and restore User Name Mapping data at any time. Because the database is backed up to a file, you can use that file to copy the mapping database to another server. This provides redundancy for the sake of fault tolerance. To learn how to back up and restore the mapping database, see Backing up and restoring maps.

Note

If you obtain information from multiple NIS domains, it is assumed that each domain has unique users and user identifiers (UIDs). User Name Mapping does not perform any checks.


This content might have been updated. For the most recent version, see the Windows Server 2003 R2 TechCenter Web site

Starting and stopping User Name Mapping

Starting User Name Mapping

Stopping User Name Mapping


Starting User Name Mapping

To start User Name Mapping from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click User Name Mapping, and then click Start Service.

To start User Name Mapping from the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    mapadmin [ ComputerName ] [–u User ] [–p Password] start

Argument | Description
ComputerName | The name of the computer on which you want to start User Name Mapping.
User | The name of the user who has administrative privileges on the computer, if different from the current user.
Password | The password for the person who has administrative privileges on the computer, if different from the current user.

Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • mapadmin /?


Stopping User Name Mapping

To stop User Name Mapping from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click User Name Mapping, and then click Stop Service.

To stop User Name Mapping from the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    mapadmin [ ComputerName ] [–u User ] [–p Password ] stop

Argument | Description
ComputerName | The name of the computer on which you want to stop User Name Mapping.
User | The name of the user who has administrative privileges on the computer, if different from the current user.
Password | The password for the person who has administrative privileges on the computer, if different from the current user.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • mapadmin /?


Configuring User Name Mapping

Selecting the UNIX user name source

Configuring the refresh interval for maps

Creating a User Name Mapping pool

Configuring User Name Mapping on a server cluster


Selecting the UNIX user name source

To specify the UNIX user name source using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click User Name Mapping, and then click Properties.

  4. Do one of the following:

    • Select Use Network Information Service (NIS), or

    • Select Use Password and Group files, and in the Password file path and name and the Group file path and name boxes type or browse to the password and group files.

  5. You can use the default refresh interval provided or change it by typing a new day, hour and minute interval.

  6. To save the settings, click Apply.
Notes
  • If you use password and group files, the files must be stored on the local computer that is running User Name Mapping. Typically, these files are the /etc/passwd and /etc/group files that are copied from a UNIX server and then periodically updated by the administrator of the computer that is running User Name Mapping.
  • If you are using password and group files and need to map users from multiple UNIX servers, you must combine the multiple password files so that each user is assigned a unique user identifier (UID) and combine the multiple group files so that each group is assigned a unique group identifier (GID).
  • You should not set up User Name Mapping to use password and group files which are using Microsoft Services for Network File System (NFS) to set up maps that use password and group files that are stored on a remote computer.
  • The refresh interval determines how often User Name Mapping refreshes password and group information from the NIS server or the password and group files.
To specify the UNIX user name source using the command line

  1. Open the command prompt.

  2. To select the UNIX user name source, do one of the following:

    • To use Network Information Service (NIS), at a command prompt, type:

    mapadmin [ ComputerName ] [–u User] [–p Password] config –d ntDomain –y nisDomain [–n nisServer]

    • To use password and group files, at a command prompt, type:

    mapadmin [ ComputerName ] [–u User] [–p Password] config –d ntDomain –f Password/GroupDirectory

  3. To select simple or advanced maps, at a command prompt, type:

    mapadmin [ ComputerName ] [–u User] [–p Password] config –i {yes|no}

  4. To specify the refresh interval for password and group information, at a command prompt, type:

    mapadmin [ ComputerName ] [–u User] [–p Password] config –r dddd:hh:mm

Argument | Description
ComputerName | The name of the computer you want to manage.
User | The name of the user who has administrative privileges on the computer, if different from the current user.
Password | The password for the person who has administrative privileges on the computer, if different from the current user.
ntDomain | The name of the Windows domain.
Password/GroupDirectory | The fully qualified path of the directory where the password and group files are located on the computer that is running User Name Mapping.
nisDomain | The name of the NIS domain.
nisServer | The name of the NIS server (optional).
dddd:hh:mm | How often, in days, hours, and minutes, User Name Mapping will refresh password and group information from the NIS server or the password and group files.
Notes
  • If you use password and group files, the files must be stored on the local computer that is running User Name Mapping. Typically, these files are the /etc/passwd and /etc/group files that are copied from a UNIX server and then periodically updated by the administrator of the computer that is running User Name Mapping.
  • If you are using password and group files and need to map users from multiple UNIX servers, you must combine the multiple password files so that each user is assigned a unique user identifier (UID) and combine the multiple group files so that each group is assigned a unique group identifier (GID).
  • You cannot use the mapadmin command to set up mappings that use password and group files on a remote computer.
  • The refresh interval determines how often User Name Mapping refreshes password and group information from the NIS server or from the password and group files.


Configuring the refresh interval for maps

To configure the refresh interval from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click User Name Mapping and click Properties.

  4. Click the Configuration tab.

  5. In Days, Hours, and Minutes, type the refresh interval. The minimum interval is five minutes.

  6. To save the settings, click Apply.

To configure the refresh interval from the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    mapadmin [ ComputerName ] [–u User ] [–p Password ] config –r [[ days :] hh :] mm

Argument | Description
ComputerName | The name of the computer you want to manage.
User | The name of the user who has administrative privileges on the computer, if different from the current user.
Password | The password for the person who has administrative privileges on the computer, if different from the current user.
days:hh:mm | The refresh interval for updating from the Windows and Network Information Service (NIS) databases in days, hours, and minutes. The minimum interval is five minutes.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • mapadmin /?


Creating a User Name Mapping pool

In larger networks, especially networks that extend across a wide area network (WAN), it is often desirable to run User Name Mapping on multiple computers. In the case of a WAN, running User Name Mapping on computers on the local area networks (LANs) as other computers running Microsoft Services for Network File System (NFS) can help ensure a high level of performance. Even if your network is not geographically dispersed, you might want to run User Name Mapping on more than one computer to improve performance and availability.

When you run User Name Mapping on multiple computers, you can create a pool of servers using Domain Name System (DNS) round robin. Doing this provides a number of benefits:

  • You can enhance performance by locating computers running User Name Mapping near other computers running Microsoft Services for NFS.

  • You can achieve load balancing by alternating which servers respond to mapping requests.

  • High availability can be ensured by providing redundant servers so that if one fails, other servers in the pool can continue to respond to mapping requests.

The first step in creating a User Name Mapping server pool is to install User Name Mapping on two or more servers. These servers must be configured and maintained identically to ensure that they provide consistent responses to mapping requests. The easiest way to do this is to use batch (.cmd) files that repeat the same mapadmin command for each server in the pool.

For example, you could install User Name Mapping on three servers named UNM1, UNM2, and UNM3. You would then create a batch file that would apply the same mapadmin command and arguments to all three servers:

REM POOLADMIN.CMD

REM Used to administer three User Name Mapping servers: UNM1, UNM2, and UNM3

REM Syntax: POOLADMIN mapadmin_argument[...]

mapadmin UNM1 %0 %1 %2 %3 %4 %5 %6 %7 %8 %9 -u UNM1\administrator -p admUNM1pwd

mapadmin UNM2 %0 %1 %2 %3 %4 %5 %6 %7 %8 %9 -u UNM2\administrator -p admUNM2pwd

mapadmin UNM3 %0 %1 %2 %3 %4 %5 %6 %7 %8 %9 -u UNM3\administrator -p admUNM3pwd

Use a file like this, or a similar technique, to configure and administer all the User Name Mapping servers in the pool, both before and after the pool has been created.

Once you have set up and configured the servers that will belong to the pool, the next step is to create the pool itself. You do this by configuring a DNS server to map a single name to the Internet Protocol (IP) addresses of all three User Name Mapping servers. For example, you could map the name UNMpool to the IP addresses for UNM1, UNM2, and UNM3. Whenever a client computer asks the DNS server to resolve the name UNMpool, the DNS server will return all three IP addresses, the first of which is the one most clients will use. Because the DNS server rotates (in a round-robin fashion) the order in which it returns the three IP addresses, this automatically provides for load balancing.

The final step in setting up a User Name Mapping pool is to configure computers on the network running Client for NFS or Server for NFS to use the virtual server name of the pool (UNMpool in the example). Because the DNS server rotates the order of the IP addresses it returns when it resolves this name, each of these User Name Mapping clients will receive a different primary IP address than the one given to the previous client, thereby automatically providing load balancing among the three User Name Mapping servers. In addition, these Microsoft Services for NFS components are designed to send mapping requests to each IP address it receives if requests to the previous IP address times out. This provides for automatic failover if one of the servers in the pool should fail.

As noted earlier, it is essential that all servers that belong to a pool are configured and maintained identically. If password and group files are used to provide UNIX account information for mapping users, for example, identical password and group files must be copied to and maintained on all servers in the pool. Similarly, if you use .maphosts files to control access to servers in the pool, you must maintain identical .maphosts files on all servers in the pool.


Configuring User Name Mapping on a server cluster

A server cluster is a group of independent computer systems, known as nodes, working together as a single system to ensure that mission-critical applications and resources remain available to clients. Every node is attached to one or more cluster storage devices. Clustering allows users and administrators to access and manage the nodes as a single system rather than as separate computers.

User Name Mapping is specifically designed to make use of the server cluster and the server cluster's ability to replicate configuration settings among its nodes. This means that when User Name Mapping is installed on the nodes of a cluster, all changes to the configuration of User Name Mapping on one node are automatically replicated to User Name Mapping on all other nodes of the cluster. Consequently, you can manage User Name Mapping on all the nodes in the cluster simply by administering User Name Mapping on any one node. This ensures that user and group mappings and other settings will be identical on all servers in the cluster, thereby allowing you to easily achieve static load balancing by distributing User Name Mapping clients among the nodes of the cluster.

To install User Name Mapping on a cluster

  1. Create one cluster group for each node with its own Internet Protocol (IP) address and network name resource, and assign the preferred owner for each group so that it is primarily owned by a different node. This allows you to achieve static load balancing.

  2. Install User Name Mapping on the nodes of the cluster one at a time. Before installing User Name Mapping on a node, move all groups away from the node.

  3. When User Name Mapping has been installed on all nodes, return all groups to their primary owners.

  4. Configure User Name Mapping on any node. Settings changed on one node are automatically replicated to all other nodes in the cluster.

  5. Configure each client computer to use the virtual server name from one of the cluster groups as its User Name Mapping server. This will ensure that client computers will continue to be served by User Name Mapping in case of node failure. To provide static load balancing, evenly distribute clients among the virtual servers of the cluster.
Notes
  • To ensure proper operation of User Name Mapping on a server cluster, when stopping the server cluster, first stop User Name Mapping, then stop the server cluster.
  • To run User Name Mapping on a server cluster, you must install User Name Mapping on the nodes of an existing cluster. Adding a stand-alone computer that is already running User Name Mapping as a new node in an existing cluster is not supported.
  • When running User Name Mapping on a server cluster, do not create maps using local Windows user and group accounts. Because the security identifiers (SIDs) of local accounts are recognized only by the server where those accounts were created, other nodes in the cluster will not be able to resolve those accounts when the server fails. Instead, you should create maps using domain accounts only.
  • If the cluster service is restarted on a node, you must also restart the User Name Mapping service. Until you do, configuration changes will not be replicated to and from User Name Mapping on the node.
  • User Name Mapping configuration changes are not properly replicated among nodes in a cluster if you run Microsoft Services for Network File System (NFS) or mapadmin on a computer that belongs to a domain that is not trusted by the domain of the cluster. To ensure that User Name Mapping configuration changes are properly replicated, always administer User Name Mapping running on a cluster using a computer that belongs to a trusted domain.
  • You must maintain identical .maphosts files on all servers in the pool. For more information about the .maphosts file, see Securing access to the User Name Mapping server.
  • If you use password and group files to provide user and group information for User Name Mapping running on a cluster, you must store the password and group files on local disk drives on each node, and the system administrator must update these files as required. In addition, if you restore mapping settings from a backup file, you must also copy the restored password and group files to the appropriate location on all of the nodes in the server cluster and ensure that all nodes in the cluster are configured to use password and group files located in the same local path. For more information about backing up and restoring User Name Mapping data, see Backing up and restoring maps.
  • If you are running User Name Mapping as well as Server for NFS on a server cluster, configure each node of the cluster to use localhost as its User Name Mapping server.


Securing access to the User Name Mapping server

The authentication mechanism used by the Network File System (NFS) protocol is based on trust relationships between host computers. That is, an NFS server accepts the user identifiers (UIDs) and group identifiers (GIDs) from a given client computer because the server is configured to recognize the client computer as trustworthy.

User Name Mapping acts as an intermediary between NFS servers and NFS clients on a network containing UNIX hosts and Windows-based computers. To maintain the implicit trust relationship between NFS client and host computers, it is essential that you control which computers can access User Name Mapping and hence act as a trusted host on the NFS network.

You control which computers can access User Name Mapping by editing a file named .maphosts in the %windir%\msnfs directory of the computer User Name Mapping. By adding entries in this file, you can easily permit or deny access by any other computer to User Name Mapping. If the .maphosts file is present but not empty, then only those computers allowed access by entries in the file can access User Name mapping. If the .maphosts file is present but empty (the default), no computers except the computer running User Name Mapping itself can access User Name Mapping. If the .maphosts file is not present, no computers (including the computer running User Name Mapping) can access User Name Mapping.

The .maphosts file consists of a list of one or more of the elements described in the following table, each on a separate line. When matching a computer making a request against the elements in the list, User Name Mapping searches from the top down until it finds a match. Consequently, order is essential.

Element | Description
host | Specifies one or more computers that can access User Name Mapping. The host can be specified as an Internet Protocol (IP) address (IP version 4), or as a host name that resolves to one or more IP addresses.
host – | Specifies one or more computers that are denied access to User Name Mapping. The host can be specified as an IP address (IP version 4), or as a host name that resolves to one or more IP addresses. Note that there must be at least one blank space between host and the dash (–).
+ | Specifies that all computers can access User Name Mapping unless disallowed by an earlier entry in the list. All entries in the list following this element are ignored.
- | Specifies that all computers are disallowed access to User Name Mapping unless allowed by an earlier entry in the list. All entries in the list following this element are ignored.

The # character can be used to add comments to the file; everything on a line following the # character is ignored.

Access by the computer running User Name Mapping (the local host) is always allowed unless specifically denied in the .maphosts file, or the .maphosts file is not present. In case of a multihomed User Name Mapping server, access to the service running on other nodes from any of the nodes is also allowed, unless explicitly denied.

Examples

The following example file allows access only by computers named mktg_nfs and sales_nfs:

mktg_nfs

sales_nfs

-

The following example file allows access by all computers except computers named rogue_host and malicious_host:

rogue_host -

malicious_host -

+

In the next example, rogue_host is denied access even though it appears in the list without a minus sign (–) because it follows a minus sign on its own line:

mktg_nfs

sales_nfs

-

rogue_host


This content might have been updated. For the most recent version, see the Windows Server 2003 R2 TechCenter Web site

Managing maps

Refreshing maps

Backing up and restoring maps

Mapping users


Refreshing maps

To refresh user data from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click User Name Mapping and select Properties.

  4. In Days, Hours, and Minutes, type the refresh interval. The minimum interval is five minutes.

  5. To refresh the user data now, click Synchronize Now.

  6. To save the settings, click Apply.

To refresh user data from the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    mapadmin [ ComputerName ] [–u User ] [–p Password ] config –r [[ days :] hh :] mm

Argument | Description
ComputerName | The name of the computer you want to manage.
User | The name of the user who has administrative privileges on the computer, if different from the current user.
Password | The password for the person who has administrative privileges on the computer, if different from the current user.
days:hh:mm | The refresh interval for updating from the Windows and Network Information Service (NIS) databases in days, hours, and minutes. The minimum interval is five minutes.
Notes
  • There is no command-line method for immediately refreshing maps.
  • To view the complete syntax for this command, at a command prompt, type:
  • mapadmin /?


Backing up and restoring maps

To backup and restore data from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. To back up maps, right-click User Name Mapping and select Backup Maps.

    Type the fully qualified path and name of the file to which you want to back up the maps, or click Browse to find the file. When you have identified or found the file, click Backup.

  4. To restore maps, right-click User Name Mapping and select Restore Maps.

    Type the fully qualified path and name of the file from which you want to restore maps, or click Browse to find the file. When you have identified or found the file, click Restore.

The following settings and maps are backed up and restored:

  • Configuration type (either Network Information Service [NIS], or password and group files)

  • Domain maps

  • Advanced user and group maps

  • Password and group files, if applicable

Note

If you back up settings and maps on a remote computer that is configured to use password and group files, the password and group maps are not backed up.

If you are using password and group files as the source for UNIX user and group names, and if you are running User Name Mapping in a server cluster or a server pool, you must perform the following tasks after restoring maps:

  • You must copy the restored password and group files to the appropriate directories on all nodes in the server cluster or pool. On a server cluster, the files must be copied to directories with identical path names on each node in the cluster.

  • After copying the files on a server pool, you must configure each node in the pool to use the files in the directories where you copied the files.

  • After copying the files on a server cluster, you must configure User Name Mapping on one node to use the files in the directory where you copied the files, and then click Apply. This will cause the updated settings to be replicated to other nodes in the cluster.
To backup and restore data from the command line

  1. Open the command prompt.

  2. At the command prompt, type one of the following:

    • To create a backup file and perform the backup, type:

    mapadmin [ ComputerName ] [–u User] [–p Password] backup file

    • To restore, type:

    mapadmin [ ComputerName ] [–u User] [–p Password] restore file

Argument | Description
ComputerName | The name of the computer you want to manage.
User | The name of the user who has administrative privileges on the computer, if different from the current user.
Password | The password for the person who has administrative privileges on the computer, if different from the current user.
File | The fully qualified path and name of the file to be used for backup.

The following settings and maps are backed up and restored:

  • Configuration type (either Network Information Service (NIS), or password and group files)

  • Domain maps

  • Advanced user and group maps

  • Password and group files, if applicable

Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • mapadmin /?
  • If you back up settings and maps on a computer configured to use password and group files, the password and group maps are not backed up.

If you are using password and group files as the source for UNIX user and group names, and if you are running User Name Mapping in a server cluster or a server pool, you must perform the following tasks after restoring maps:

  • You must copy the restored password and group files to the appropriate directories on all nodes in the server cluster or pool. On a server cluster, the files must be copied to directories with identical path names on each node in the cluster.

  • After copying the files on a server pool, you must configure each node in the pool to use the files in the directories where you copied the files.

  • After copying the files on a server cluster, you must configure User Name Mapping on one node to use the files in the directory where you copied the files, and then click Apply. This will cause the updated settings to be replicated to other nodes in the cluster.


Mapping users

Understanding user maps

Viewing user maps

Creating a simple user map

Creating an advanced user map

Determining the file GID

Determining the file UID

Removing a user map


Understanding user maps

User Name Mapping acts as a single clearinghouse that provides centralized user mapping services for Client for NFS and Server for NFS.

User Name Mapping enables you create maps between Windows and UNIX user and group accounts even though the user and group names in both environments may not be identical. Perhaps most importantly, User Name Mapping lets you maintain a single mapping database for the entire enterprise. This makes it easy to configure authentication for multiple computers running Microsoft Services for NFS.

In addition to one-to-one mapping between Windows and UNIX user and group accounts, User Name Mapping permits one-to-many mapping. This lets you associate multiple Windows accounts with a single UNIX account. This can be useful, for example, when you do not need to maintain separate UNIX accounts for individuals and would rather use a few accounts to provide different classes of access permission.

You can use simple maps, which map Windows and UNIX accounts with identical names. You can also create advanced maps to associate Windows and UNIX accounts with different names, which you can use in conjunction with simple maps. For information about simple and advanced maps, see Understanding user maps.

User Name Mapping can obtain UNIX user, password, and group information from one or more Network Information Service (NIS) servers or from password and group files located on a local hard drive. The password and group files can be copied from a UNIX host or from a Windows-based computer that is running Server for NIS. See Configuring User Name Mapping for more information about specifying the source for UNIX user information.

User Name Mapping periodically refreshes its mapping database from the source databases, ensuring that it is always kept up-to-date as changes occur in the Windows and UNIX name spaces. You can also refresh the database anytime you know the source databases have changed. For information about how to refresh the database automatically and manually, see Configuring the refresh interval for maps and Refreshing maps.

You can back up and restore User Name Mapping data at any time. Because the database is backed up to a file, you can use that file to copy the mapping database to another server. This provides redundancy for the sake of fault tolerance. To learn how to back up and restore the mapping database, see Backing up and restoring maps.

If you obtain information from multiple NIS domains, it is assumed that each domain have unique users and user identifiers (UIDs). User Name Mapping does not perform any checks.


Viewing user maps

To view user maps from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Expand User Name Mapping and select User Maps.
Note

Maps are displayed in the Mapped users and Mapped groups lists in the order in which the maps are evaluated. Primary maps are always listed and evaluated first, followed by secondary maps. To change the order in which maps are evaluated within the list of secondary maps, right-click User Name Mapping and click Properties. Then, click the Simple Maps tab and use the Move up or Move down buttons to reposition the map within the list.
To view user maps from the command line

  1. Open the command prompt.

  2. At the command prompt, type one of the following:

    mapadmin [ ComputerName ] [–u User ] [–p Password ] list {–all|–advanced|–simple}

    mapadmin [ ComputerName ] [–u User ] [–p Password ] list –wu Windows_User_Name

    mapadmin [ ComputerName ] [–u User ] [–p Password ] list –uu unix_User_Name

    mapadmin [ ComputerName ] [–u User ] [–p Password ] list –wg WindowsGroupName

    mapadmin [ ComputerName ] [–u User ] [–p Password ] list –ug unixGroupName

Argument | Description
ComputerName | The name of the computer you want to manage.
User | The name of the user who has administrative credentials on the computer, if different from the current user.
Password | The password for the person who has administrative credentials on the computer, if different from the current user.
–all | View details of both simple and advanced maps.
–advanced | View all advanced maps for users and groups.
–simple | View the simple-mapped domains.
Windows_User_Name | The Windows user for which you want to see details.
Unix_User_Name | The UNIX user for which you want to see details.
WindowsGroupName | The Windows group for which you want to see details.
UnixGroupName | The UNIX group for which you want to see details.
Notes
  • Maps are displayed in the order in which the maps are evaluated. Primary maps are always listed and evaluated first, followed by secondary maps. You can use the Windows interface to change the order in which secondary maps are evaluated. For information about how to do this, see "Using the Windows interface" in this topic.
  • To view the complete syntax for this command, at a command prompt, type:
  • mapadmin /?


Creating a simple user map

To create a simple user map from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click User Name Mapping and select Properties.

  4. Click the Simple Maps tab.

  5. Select Use simple maps.

  6. Click Add.

  7. If you are creating a simple map using Network Information Service (NIS) data, in the NIS domain name box, type the name of the NIS domain. If the master server of the NIS domain is located on a different subnet than the User Name Mapping server, then in the NIS Server name box, type the name of the master server.

  8. Select the Windows domain for which you are creating a simple map.

  9. Click OK.

  10. To add another simple map between a Windows and an NIS domain, repeat the previous step.

  11. To remove a simple map between a Windows and an NIS domain, select the map, and then click Remove.

  12. To reposition a simple map between a Windows and an NIS domain in the list, select the map, and then click Move up or Move down.

  13. To save the settings, click Apply.

Note

You can create multiple simple maps between Windows and NIS domains. Maps are evaluated from the top of the list of maps to the bottom.
To create a simple user map from the command line

  1. Open the command prompt.

  2. At the command prompt, do one of the following:

    • To supply required information for authentication using password and group files, type:

    mapadmin [ ComputerName ] [–u User ] [–p Password ] adddomainmap –d ntDomain –f Password / GroupDirectory

    • To supply required information for Network Information Service (NIS) authentication, type:

    mapadmin [ ComputerName ] [–u User ] [–p Password ] adddomainmap –d ntDomain –y nisDomain

Argument | Description
ComputerName | The name of the computer you want to manage.
User | The name of the user who has administrative privileges on the computer, if different from the current user.
Password | The password for the person who has administrative privileges on the computer, if different from the current user.
ntDomain | The name of the Windows domain.
Password/GroupDirectory | The fully qualified path of the directory on the User Name Mapping computer where the password and group files are located.
nisDomain | The name of the NIS domain.
Notes
  • Password and group files must be stored on the computer that is running User Name Mapping. Typically, these files are the /etc/passwd and /etc/group files that are copied from a UNIX host and then periodically updated by the administrator of the computer that is running User Name Mapping.
  • To view the complete syntax for this command, at a command prompt, type:
  • mapadmin /?


Creating an advanced user map

To create an advanced map from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Expand User Name Mapping.

  4. Right-click User Maps and select Create Map.

  5. In the Windows domain name list, click the domain for which you want to list users, and then click List Windows Users.

  6. If you are obtaining UNIX user information from a Network Information Service (NIS) domain, in the NIS Domain name box, type the name of the NIS domain from which you are getting account information. If the master server of the NIS domain is located on a different subnet than the User Name Mapping server, then in the NIS Server name box, type the name of the master server.

  7. Click List UNIX Users.

  8. In the Windows Account and UNIX Account lists, click the two accounts you want to map to each other, and then click Add.

  9. To save the settings, click Apply.

Note

As you add maps, new maps are listed below existing maps. This does not reflect the order in which the maps are evaluated, however. To view the actual order, click Apply, press F5 to refresh the User Name Mapping page, and then reopen the list of advanced maps. Primary maps are always listed and evaluated first, followed by secondary maps. To change the order in which maps are evaluated within the list of secondary maps, select a map and then click Move up or Move down to reposition the map within the list.
To create an advanced map from the command line

  1. Open the command prompt.

  2. At the command prompt, to supply required information for authentication using password and group files, type:

    mapadmin [ ComputerName ] [–u User ] [–p Password ] add –wu WindowsDomain \ UserName –uu UserName [–setprimary]

Argument | Description
ComputerName | The name of the computer you want to manage.
User | The name of the user who has administrative privileges on the computer, if different from the current user.
Password | The password for the person who has administrative privileges on the computer, if different from the current user.
WindowsDomain \ UserName | The name of the Windows user.
UserName | The name of the UNIX user, specified as domain\user_name or user_name@domain, where domain is the name of the Network Information Service (NIS) domain or PCNFS, if you are using password and group files.
–setprimary | Make this the primary mapping.
Notes
  • The command-line method maps one pair of users or groups at a time. To map more users or groups, repeat the command.
  • When you use mapadmin to create multiple maps for a UNIX user, use the –setprimary option to specify the primary map. If necessary, you can use the mapadmin setprimary command later to change the primary map.
  • Maps cannot be evaluated in the order in which they are created. Primary maps are always evaluated before secondary maps.
  • To view the complete syntax for this command, at a command prompt, type:
  • mapadmin /?


Determining the file GID

To determine the GID of a file

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. Double-click My Network Places, and then double-click Entire Network.

  3. Double-click NFS Network.

  4. Double-click the local area network (LAN) whose servers you want to view.

  5. Double-click the server whose shared directories you want to view.

  6. Locate and right-click the file or folder and click Properties. The file information and group identifier (GID) are displayed.
Note

When you double-click NFS Network, it might take several seconds for the local area network (LAN) to appear, depending on the broadcast network configuration and the number of computers in the broadcast.


Determining the file UID

To determine the UID of a file

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. Double-click My Network Places, and then double-click Entire Network.

  3. Double-click NFS Network.

  4. Double-click the local area network (LAN) whose servers you want to view.

  5. Double-click the server whose shared directories you want to view.

  6. Locate and right-click the file or folder and click Properties. The file information and user identifier (UID) are displayed.
Note

When you double-click NFS Network, it might take several seconds for the local area network (LAN) to appear, depending on the broadcast network configuration and the number of computers in the broadcast.


Removing a user map

To remove a user map from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click User Name Mapping and click Properties.

  4. Click the Simple Maps tab.

  5. To disable simple maps, clear the Use simple maps box.

  6. To remove a simple map between a Windows and an NIS domain, select the map, and then click Remove.

  7. To save the settings, click Apply.

To remove a user map from the command line

  1. Open the command prompt.

  2. At the command prompt, do one of the following:

    • To remove a specific map between a Windows domain and an NIS domain, type:

    mapadmin [ ComputerName ] [–u User ] [–p Password ] removedomainmap –d WindowsDomain –y nisDomain

    • To remove all simple maps, type:

    mapadmin [ ComputerName ] [–u User ] [–p Password ] removedomainmap -all

Argument | Description
ComputerName | The name of the computer you want to manage.
User | The name of the user who has administrative privileges on the computer, if different from the current user.
Password | The password for the person who has administrative privileges on the computer, if different from the current user.
WindowsDomain | The Windows domain of the map to be deleted.
nisDomain | The NIS domain of the map to be deleted.
-all | Deletes all simple maps.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • mapadmin /?


Mapping groups

Understanding group maps

Viewing group maps

Creating a simple group map

Creating an advanced group map

Removing a group map


Understanding group maps

User Name Mapping acts as a single clearinghouse that provides centralized user mapping services for Client for NFS and Server for NFS.

User Name Mapping enables you to create maps between Windows and UNIX user and group accounts even though the user and group names in both environments may not be identical. Perhaps most important, User Name Mapping lets you maintain a single mapping database for the entire enterprise. This makes it easy to configure authentication for multiple computers running Microsoft Services for Network File System (NFS).

In addition to one-to-one mapping between Windows and UNIX user and group accounts, User Name Mapping permits one-to-many mapping. This lets you associate multiple Windows accounts with a single UNIX account. This can be useful, for example, when you do not need to maintain separate UNIX accounts for individuals and would rather use a few accounts to provide different classes of access permission.

You can use simple maps, which map Windows and UNIX accounts with identical names. You can also create advanced maps to associate Windows and UNIX accounts with different names, which you can use in conjunction with simple maps. For information about simple and advanced maps, see Understanding user maps.

User Name Mapping can obtain UNIX user, password, and group information from one or more Network Information Service (NIS) servers or from password and group files located on a local hard drive. The password and group files can be copied from a UNIX host or from a Windows-based computer that is running Server for NIS. See Configuring User Name Mapping for more information about specifying the source for UNIX user information.

User Name Mapping periodically refreshes its mapping database from the source databases, ensuring that it is always kept up-to-date as changes occur in the Windows and UNIX name spaces. You can also refresh the database anytime you know the source databases have changed. For information about how to refresh the database automatically and manually, see Configuring the refresh interval for maps and Refreshing maps.

You can back up and restore User Name Mapping data at any time. Because the database is backed up to a file, you can use that file to copy the mapping database to another server. This provides redundancy for the sake of fault tolerance. To learn how to back up and restore the mapping database, see Backing up and restoring maps.

If you obtain information from multiple NIS domains, it is assumed that each domain have unique users and user identifiers (UIDs). User Name Mapping does not perform any checks.


Viewing group maps

To view group maps from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Expand Username Mapping Server and select Group Maps.
Note

Maps are displayed in the Mapped users and Mapped groups lists in the order in which the maps are evaluated. Primary maps are always listed and evaluated first, followed by secondary maps. To change the order in which maps are evaluated within the list of secondary maps, right-click Username Mapping Server and click Properties. Then, click the Simple Maps tab and use the Move up or Move down buttons to reposition the map within the list.
To view group maps from the command line

  1. Open the command prompt.

  2. At the command prompt, type one of the following:

    mapadmin [ ComputerName ] [–u User ] [–p Password ] list {–all|–advanced|–simple}

    mapadmin [ ComputerName ] [–u User ] [–p Password ] list –wg WindowsGroupName

    mapadmin [ ComputerName ] [–u User ] [–p Password ] list –ug UnixGroupName

Argument | Description
ComputerName | The name of the computer you want to manage.
User | The name of the user who has administrative credentials on the computer, if different from the current user.
Password | The password for the person who has administrative credentials on the computer, if different from the current user.
–all | View details of both simple and advanced maps.
–advanced | View all advanced maps for users and groups.
–simple | View the simple-mapped domains.
WindowsGroupName | The Windows group for which you want to see details.
UnixGroupName | The UNIX group for which you want to see details.
Notes
  • Maps are displayed in the order in which the maps are evaluated. Primary maps are always listed and evaluated first, followed by secondary maps. You can use the Windows interface to change the order in which secondary maps are evaluated. For information about how to do this, see "Using the Windows interface" in this topic.
  • To view the complete syntax for this command, at a command prompt, type:
  • mapadmin /?


Creating a simple group map

To create a simple group map from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click User Name Mapping and select Properties.

  4. Click the Simple Maps tab.

  5. Select Use simple maps.

  6. Click Add.

  7. If you are creating a simple map using Network Information Service (NIS) data, in the NIS domain name box, type the name of the NIS domain. If the master server of the NIS domain is located on a different subnet than the User Name Mapping server, then in the NIS Server name box, type the name of the master server.

  8. Select the Windows domain for which you are creating a simple map.

  9. Click OK.

  10. To add another simple map between a Windows and an NIS domain, repeat the previous step.

  11. To remove a simple map between a Windows and an NIS domain, select the map, and then click Remove.

  12. To reposition a simple map between a Windows and an NIS domain in the list, select the map, and then click Move up or Move down.

  13. To save the settings, click Apply.

Note

You can create multiple simple maps between Windows and NIS domains. Maps are evaluated from the top of the list of maps to the bottom.
To create a simple group map from the command line

  1. Open the command prompt.

  2. At the command prompt, do one of the following:

    • To supply required information for authentication using password and group files, type:

    mapadmin [ ComputerName ] [–u User ] [–p Password ] adddomainmap –d ntDomain –f Passwd / GroupDirectory

    • To supply required information for Network Information Service (NIS) authentication, type:

    mapadmin [ ComputerName ] [–u User ] [–p Password ] adddomainmap –d ntDomain –y nisDomain

Argument | Description
ComputerName | The name of the computer you want to manage.
User | The name of the user who has administrative credentials on the computer, if different from the current user.
Password | The password for the person who has administrative credentials on the computer, if different from the current user.
ntDomain | The name of the Windows domain.
Password / GroupDirectory | The fully qualified path of the directory on the User Name Mapping computer where the password and group files are located.
nisDomain | The name of the NIS domain.
Notes
  • Password and group files must be stored on the computer that is running User Name Mapping. Typically, these files are the /etc/passwd and /etc/group files that are copied from a UNIX host and then periodically updated by the administrator of the computer that is running User Name Mapping.
  • To view the complete syntax for this command, at a command prompt, type:
  • mapadmin /?


Creating an advanced group map

To create an advanced group map from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Expand User Name Mapping.

  4. Right-click Group Maps and select Create Map.

  5. In the Windows domain list, select the domain for which you want to list users, and then click List Windows Groups.

  6. If you are obtaining UNIX user information from a Network Information Service (NIS) domain, in the NIS Domain name box, type the name of the NIS domain from which you are getting account information. If the master server of the NIS domain is located on a different subnet than the User Name Mapping server, then in the NIS Server name box, type the name of the master server.

  7. Click List UNIX Groups.

  8. In the Windows Group and UNIX Group lists, click the two accounts you want to map to each other and click Add.

  9. To save the settings, click Apply.

Note

As you add maps, new maps are listed below existing maps. This does not reflect the order in which the maps are evaluated, however. To view the actual order, click Apply, press F5 to refresh the User Name Mapping page, and then reopen the list of advanced maps. Primary maps are always listed and evaluated first, followed by secondary maps. To change the order in which maps are evaluated within the list of secondary maps, select a map and then click Move up or Move down to reposition the map within the list.
To create an advanced group map from the command line

  1. Open the command prompt.

  2. At the command prompt, to supply required information for authentication using password and group files, type:

    mapadmin [ ComputerName ] [–u User ] [–p Password ] add –wg WindowsGroup –ug UnixGroup [–setprimary]

Argument | Description
ComputerName | The name of the computer you want to manage.
User | The name of the user who has administrative credentials on the computer, if different from the current user.
Password | The password for the person who has administrative credentials on the computer, if different from the current user.
WindowsGroup | The name of the Windows group.
UnixGroup | The name of the UNIX group.
– setprimary | Make this the primary mapping.
Notes
  • The command-line method maps one pair of groups at a time. To map more groups, repeat the command.
  • When you use mapadmin to create multiple maps for a UNIX user, use the –setprimary option to specify the primary map. If necessary, you can use the mapadmin setprimary command later to change the primary map.
  • Maps cannot be evaluated in the order in which they are created. Primary maps are always evaluated before secondary maps. To view the complete syntax for this command, at a command prompt, type:
  • mapadmin /?


Removing a group map

To remove a group map from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click User Name Mapping and click Properties.

  4. Click the Simple Maps tab.

  5. To disable simple maps, clear the Use simple maps box.

  6. To remove a map between a Windows and an NIS domain, select the map, and then click Remove.

  7. To save the settings, click Apply.

To remove a group map from the command line

  1. Open the command prompt.

  2. At the command prompt, type one of the following:

    • To remove a specific map between a Windows domain and an NIS domain, at a command prompt, type:

    mapadmin [ ComputerName ] [–u User ] [–p Password] removedomainmap –d WindowsDomain –y nisDomain

    • To remove all simple maps, at a command prompt, type:

    mapadmin [ ComputerName ] [–u User ] [–p Password ] removedomainmap -all

Argument | Description
ComputerName | The name of the computer you want to manage.
User | The name of the user who has administrative privileges on the computer, if different from the current user.
Password | The password for the person who has administrative privileges on the computer, if different from the current user.
WindowsDomain | The Windows domain of the map to be deleted.
nisDomain | The NIS domain of the map to be deleted.
-all | Deletes all simple maps.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • mapadmin /?


Client for NFS administration

Client for NFS enables Windows-based computers to access files on UNIX Network File System (NFS) servers. Users can connect to and disconnect from an NFS share as though it were any other shared drive on their network.

Understanding the Client for NFS component

Starting and stopping Client for NFS

Configuring Client for NFS

Opening an NFS file or folder

Browsing the NFS network

Mapping a network drive to use with Client for NFS

Disconnecting a network drive that is used with Client for NFS

Configuring NFS permissions on a file or folder

Viewing NFS mount options and properties

Viewing NFS server properties


Understanding the Client for NFS component

Client for NFS gives a Windows-based computer the ability to act as a client to the Network File System (NFS) server. With Client for NFS, you can access files in a mixed environment of computers, operating systems, and networks.

Once Client for NFS is installed and configured, you can connect to and disconnect from an NFS share as though it were any other shared drive on your network. You can access files on the NFS server by mounting those files to your computer using either the UNIX server:/export format or the Windows \\server\share format. You can also mount shared folders by browsing the NFS LANs in the NFS Network folder located in My Network Places. Files mounted on the NFS server are treated as though they reside on the client computer and are indistinguishable from files on the client computer.

All applications running on the Windows-based computer can use Client for NFS to access files on remote computers.


This content might have been updated. For the most recent version, see the Windows Server 2003 R2 TechCenter Web site

Starting and stopping Client for NFS

Starting Client for NFS

Stopping Client for NFS


Starting Client for NFS

To start Client for NFS from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Client for NFS, and then click Start Service.

To start Client for NFS from the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsadmin client [ ComputerName] start

Argument | Description
ComputerName | The name of the computer on which you want to start Client for NFS.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin client /?


Stopping Client for NFS

To stop Client for NFS from the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Client for NFS, and then click Stop.

To stop Client for NFS from the command line

  1. Open the command prompt.

  2. At the command prompt, type:

    nfsadmin client [ ComputerName ] stop

Argument | Description
ComputerName | The name of the computer on which you want to stop Client for NFS.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin client /?


Configuring Client for NFS

Specifying how Client for NFS obtains UNIX UID and GID information

Selecting the network protocol

Selecting the type of mount

Specifying read and write buffers

Specifying default UNIX permissions for new files

Adding a LAN to the NFS network

Deleting a LAN from the NFS network

Adding a server to the Favorite LAN

Deleting a server from the Favorite LAN


Specifying how Client for NFS obtains UNIX UID and GID information

In a UNIX environment, authentication is the process of providing a user identifier (UID) and group identifier (GID) to a user who presents a valid user name and password. UNIX hosts provide these identifiers when a user logs on to the host. When the user logs on, the user's name and password are compared to those in a password file. If they correspond with a user name and password in the file, the server returns a corresponding UID and GID. The UID and GID identify the user for Network File System (NFS) browsing and mounting operations.

Client for NFS makes it possible for you to access NFS resources without separately logging on to the NFS server. Instead, the first time you try to access an NFS resource, Client for NFS looks up your UNIX UID and GID information in Active Directory or User Name Mapping. If your Windows user name is mapped to a UNIX account, the UNIX UID and GID are returned to Client for NFS, which then sends those identifiers with the file-access request to the NFS server.

If your Windows user and group names are not mapped, then Client for NFS assigns –2 (anonymous) for the UID and –2 (anonymous) for the GID. If the NFS server is configured for anonymous access, you can mount and access files. Anonymous connections are usually limited to read-only operations, however. In addition, you can still provide the user name and password of a UNIX account any time you mount an NFS volume, and you can also mount the volume as an anonymous user (for example, by using the –o anon option with the mount command). For more information about mounting NFS volumes, see Mapping a network drive to use with Client for NFS.

Specifying how Client for NFS obtains Unix UID and GID information

To specify how Client for NFS obtains UID and GID information using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Microsoft Services for NFS, and then click Properties.

  4. Specify how Client for NFS obtains UID and GID information for users:

    • To use Active Directory Lookup, select the Active Directory Lookup check box, type the domain name, and then click Apply.

    • To use User Name Mapping, type the name of the mapping server you want to use for authentication, and then click Apply.
Notes
  • Before using Active Directory Lookup, you must install and populate the Identity Management for UNIX Active Directory schema extension, included in Windows Server 2003 R2, or have an equivalent schema which includes UNIX UID and GID fields. Identity Management for UNIX greatly simplifies this aspect of Windows-to-UNIX user account management in Active Directory.
  • You can specify the Internet Protocol (IP) address of the User Name Mapping server instead of the name of the server.
  • Before using User Name Mapping, the computer running Client for NFS must be listed in the .maphosts file on the computer running User Name Mapping. For more information, see Securing access to the User Name Mapping server.
To specify how Client for NFS obtains UID and GID information using the command line

  1. Open the command prompt.

  2. Specify how Server for NFS obtains UID and GID information for users:

    • To use User Name Mapping, at a command prompt, type:

    nfsadmin mapping [ ComputerName ] config adlookup=yes addomain= DomainName

    • To use User Name Mapping, at a command prompt, type:

    nfsadmin mapping [ ComputerName ] config mapsvr= ServerName

Argument | Description
DomainName | The name of the domain controller you want to use.
ComputerName | The name of the computer you want to manage.
ServerName | The name of the mapping server you want to use.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin mapping /?
  • Before using Active Directory Lookup, you must install and populate the Identity Management for UNIX Active Directory schema extension, included in Windows Server 2003 R2, or have an equivalent schema which includes UNIX UID and GID fields. Identity Management for UNIX greatly simplifies this aspect of Windows-to-UNIX user account management in Active Directory.
  • Before using User Name Mapping, the computer running Client for NFS must be listed in the .maphosts file on the computer running User Name Mapping. For more information, see Securing access to the User Name Mapping server.


Selecting the network protocol

To set the network protocol using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Client for NFS and then click Properties.

  4. Click the Client Settings tab.

  5. From the Transport Protocol list box, select the type of protocol that Client for NFS uses.

  6. To save this setting, click Apply.

To set the network protocol using the command line

  1. Open the command prompt.

  2. At a command prompt, type:

    nfsadmin client [ ComputerName ] config protocol={TCP | UDP | TCP+UDP}

Argument | Description
ComputerName | The name of the computer you want to manage.
protocol={TCP | UDP | TCP+UDP} | Set to TCP for Transmission Control Protocol (TCP), UDP for User Datagram Protocol (UDP), or TCP+UDP for both.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin client /?


Selecting the type of mount

When mapping a drive to a Network File System (NFS) share, you can choose to perform either a hard or soft mount.

If you choose the hard mount option, when an application times out while attempting to access a file on the mapped drive Client for NFS will retry the call indefinitely until it succeeds. While this assumes the NFS server is as available as a local (physical) disk drive, it also means that applications accessing files on the mapped drive will stop responding if the NFS server is not responsive or is not running. For this reason, you should be careful when using the hard mount option. You should consider using the hard mount option only if you are running applications that cannot gracefully handle disk-access failure.

If you choose the soft mount option (the default), when an application times out while attempting to access a file on the mapped drive Client for NFS will retry the call a fixed number of times. Then, if the NFS server still does not return successfully from the call, it returns an error to the calling application. While this allows applications to resume functioning after attempting to access a mapped drive on an unresponsive NFS server, it also introduces the risk of data corruption (either in the application or on the remote drive) to incomplete read or write operations.

When you map a drive to an NFS share, and you choose the soft mount option, you can specify the number of retries that Client for NFS will attempt before failing.

When mapping a network drive, regardless of the mount type, Client for NFS will return if it cannot immediately mount the share.

Setting the type of mount

To set the type of mount using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Client for NFS and then click Properties.

  4. Click the Client Settings tab.

  5. To use soft mounts, select Use soft mounts and specify the number of times Client for NFS will attempt to make a connection from the Number of times to retry a connection list box. To use hard mounts, select Use hard mounts.

  6. Specify the number of retries between connection attempts in the Interval between retries list box.

  7. To save these settings, click Apply.

To set the type of mount using the command line

  1. Open the command prompt.

  2. At a command prompt, specify the mount type by typing:

    nfsadmin client [ ComputerName ] config mtype={hard | soft}

  3. Specify the soft mount retries by typing:

    nfsadmin client [ ComputerName ] config retry= n

Argument | Description
ComputerName | The name of the computer you want to manage.
mtype={hard | soft} | The type of mount.
retry= n | The number of times Client for NFS will attempt to make a connection for a soft mount. This value must be in the range 1–10; the default is 1.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin client /?


Specifying read and write buffers

To set the buffer sizes using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Client for NFS and then click Properties.

  4. Click the Client Settings tab.

  5. From the Read buffer size list box, select the size of the read buffer.

  6. From the Write buffer size list box, select the size of the write buffer.

  7. To save these settings, click Apply.

To set the buffer sizes using the command line

  1. Open the command prompt.

  2. At a command prompt, specify the size of the read buffer by typing:

    nfsadmin client [ ComputerName ] config rsize= n

  3. Specify the size of the write buffer by typing:

    nfsadmin client [ ComputerName ] config wsize= n

Argument | Description
ComputerName | The name of the computer you want to manage.
config rsize= n | The size of the read buffer, in kilobytes. This value must be 1, 2, 4, 8, 16, or 32; the default is 32
config wsize= n | The size of the write buffer, in kilobytes. This value must be 1, 2, 4, 8, 16, or 32; the default is 32.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin client /?


Specifying default UNIX permissions for new files

When a file is created on a Network File System (NFS) server, a default set of permissions is applied to the file to control access to the file. By default, Client for NFS uses the following default permissions when it creates a file on behalf of a Windows user:

  • User:rwx (read, write, and execute)

  • Group:r–x (read and execute)

  • Others:r–x (read and execute)

You can change the default permissions that Client for NFS applies to new files. For more information, see Specifying default UNIX permissions for new files.

To specify default file permissions using the Windows interface

  1. Open Microsoft Services for Network File System: click Start, point to Programs, point to Administrative Tools, and then click Microsoft Services for Network File System.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Client for NFS and then click Properties.

  4. Click the File Permissions tab.

  5. Select the permissions to use as defaults.

  6. To save these settings, click Apply.
To specify default file permissions using the command line

  1. Open the command prompt.

  2. At a command prompt, type the following:

    nfsadmin client [ ComputerName ] fileaccess= ogw

Argument | Description
ComputerName | The name of the computer you want to manage.
ogw | o = Code for owner permissionsg = Code for group permissionsw = Code for permissions for others

Codes for permissions are shown in the following table.

Code | Description
0 | None
1 | Execute
2 | Write
3 | Execute and write
4 | Read
5 | Read and execute
6 | Read and write
7 | Read, write, and execute
Note

To view the complete syntax for this command, at a command prompt, type nfsadmin client /?


Adding a LAN to the NFS network

To add a LAN to the NFS network

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. Double-click My Network Places, and then double-click Entire Network.

  3. Right-click NFS Network, and then click Add/Remove NFS LANs.

  4. Click Add LAN.

  5. Type the required information, and then click OK.
Notes
  • You must be a member of the Administrators group to add a local area network (LAN) to the Network File System (NFS) network.
  • There is no command-line method for this procedure.
  • If necessary, contact your UNIX network administrator for the information needed to complete this procedure.
  • When you open NFS Network, it might take several seconds for the new LAN to appear, depending on the broadcast network configuration and the number of computers in the broadcast.
  • Do not attempt to create a LAN with the name Default LAN or Favorite LAN.


Deleting a LAN from the NFS network

To delete a LAN from the NFS network

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. Double-click My Network Places, and then double-click Entire Network.

  3. Right-click NFS Network, and then click Add/Remove NFS LANs.

  4. In the list of local area networks (LANs), click the one you want to delete, and then click Delete.
Notes
  • You must be a member of the Administrators group to delete a LAN from the Network File System (NFS) network.
  • There is no command-line method for this procedure.


Adding a server to the Favorite LAN

To add a server to the favorite LAN

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. Double-click My Network Places, and then double-click Entire Network.

  3. Double-click NFS Network.

  4. Right-click Favorite LAN, and then click Add/Remove Hosts.

  5. Click Add Host.

  6. Type the name of the host or the Internet Protocol (IP) address of the server to access.
Notes
  • You must be a member of the Administrators group to delete a local area network (LAN) from the Network File System (NFS) network.
  • There is no command-line method for this procedure.
  • When you double-click NFS Network, it might take several seconds for the LAN to appear, depending on the broadcast network configuration and the number of computers in the broadcast.


Deleting a server from the Favorite LAN

To delete a server from the Favorite LAN

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. Double-click My Network Places, and then double-click Entire Network.

  3. Double-click NFS Network.

  4. Right-click Favorite LAN, and then click Add/Remove Hosts.

  5. Click the name of the host you want to delete, and then click Delete.
Notes
  • You must be a member of the Administrators group to delete a local area network (LAN) from the Network File System (NFS) network.
  • There is no command-line method for this procedure.
  • When you double-click NFS Network, it might take several seconds for the LAN to appear, depending on the broadcast network configuration and the number of computers in the broadcast.


Opening an NFS file or folder

To browse the NFS network

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. Double-click NFS Network.

  3. Double-click the local area network (LAN) whose servers you want to view.

  4. Double-click the server whose shared directories you want to view.

  5. Double-click the shared directory containing the directory or file you want to open.

  6. Double-click the directory or file you want to open.
Note

When you double-click NFS Network, it might take several seconds for the LAN to appear, depending on the broadcast network configuration and the number of computers in the broadcast.


Browsing the NFS network

To browse the NFS network

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. Double-click My Network Places, and then double-click Entire Network.

  3. Double-click NFS Network.

  4. Double-click the local area network (LAN) whose servers you want to view.

  5. Double-click the server whose shared directories you want to view.

  6. Double-click the shared directory containing the directory or file you want to open.

  7. Double-click the directory or file you want to open.
Note

When you double-click NFS Network, it might take several seconds for the LAN to appear, depending on the broadcast network configuration and the number of computers in the broadcast.


Mapping a network drive to use with Client for NFS

To map a network drive using the Windows interface

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. On the Tools menu, click Map Network Drive.

  3. In the Drive list, click the drive letter to use.

  4. To locate the Network File System (NFS) share, click Browse, or, in Folder, type the path to the share. You can specify the path as:

    ServerName:/ShareName

    (for example: Payroll:/Benefits/Dental),

    or as:

    \\ServerName\ShareName

    (for example: \\Payroll\Benefits\Dental).

  5. To connect using a different user name and password, click Connect using a different user name, type the user name and password, and then click OK.

  6. Click Finish, and then, to accept the default login settings, click Yes, or to change the logon settings, click No.
Notes
  • If you type the path to the share, the first format shown above is preferred. It causes look-up operations to time out more quickly, and therefore locates and mounts the NFS resource sooner. The second format searches first for Windows file systems with this name, and then searches for NFS resources.
  • If your Windows user name is properly mapped to a valid UNIX user name, either through Active Directory Lookup or User Name Mapping, you will be able to access NFS shares with proper credentials. Otherwise, Client for NFS will attempt to access NFS shares as an anonymous user. However, you can change Windows user credentials to a mapped account by clicking Connect using a different user name.
To map a network drive using the command line

  1. Open the command prompt.

  2. At a command prompt, type the following:

    mount [–o Options ] [–u: UserName ] [–p:{ Password | *}] ComputerName :/ ShareName { DeviceName | *}

    or

    mount [–o Options ] [–u: UserName ] [–p:{ Password | *}] \\ ComputerName \ ShareName { DeviceName | *}

Argument Description

–o rsize= n

The read buffer size, in kilobytes. Acceptable values are 1, 2, 4, 8, 16, and 32; the default is 32 KB.

–o wsize= n

The write buffer size, in kilobytes. Acceptable values are 1, 2, 4, 8, 16, and 32; the default is 32 KB.

–o timeout= n

The time-out for a remote procedure call (RPC), in seconds. Acceptable values are 0.8, 0.9, and any integer in the range 1-60; the default is 0.8.

–o retry= n

The number of retries for a soft mount. Acceptable values are integers in the range 1-10; the default is 1.

–o mtype={soft | hard}

Soft or hard mount. Regardless of the mount type, mount will return if it cannot immediately mount the share. Once the share has been successfully mounted, however, if the mount type is hard, Client for NFS will continue to try to access the share until it is successful. As a result, if the Network File System (NFS) server is unavailable, the Windows application trying to access the share will appear to stop responding, or "hang," if the mount type is hard.

–o anon

Mounts as anonymous user.

–o nolock

Disables locking. This option might improve performance if you only need to read files.

-o lang={euc-jp|euc-tw|euc-kr|shift-jis|big5|ksc5601|gb2312-80|ansi}

Specifies the default encoding used for file and directory names and, if used, must be set to one of the following:

  • ansi

  • big5 (Chinese)

  • euc-jp (Japanese)

  • euc-kr (Korean)

  • euc-tw (Chinese)

  • gb2312-80 (Simplified Chinese)

  • ksc5601 (Korean)

  • shift-jis (Japanese)

If this option is set to ansi on systems configured for non-English locales, the encoding scheme is set to the default encoding scheme for the locale. The following are the default encoding schemes for the indicated locales:

Japanese: SHIFT-JIS

Korean: KS_C_5601-1987

Simplified Chinese: GB2312-80

Traditional Chinese: BIG5

-o fileaccess= mode

Specifies the default permission mode of new files created on the NFS share. Specify mode as a three-digit number in the form ogw, where o, g, and w are each a digit representing the access granted the file's owner and group and the world, respectively. The digits must be in the range 0–7 with the following meaning:

  • 0: No access

  • 1: x (execute access)

  • 2: w (write access)

  • 3: wx (write and execute access)

  • 4: r (read access)

  • 5: rx (read and execute access)

  • 6: rw (read and write access)

  • 7: rwx (read, write, and execute access)

-o casesensitive

Forces case-sensitive file lookup on the server.

–u: UserName

The user name of the user to use for mounting the share.

–p:{ Password | *}

The password of the user to use for mounting the share. If you use the asterisk (*), you will be prompted for the password.

ComputerName

The name of the server with the share to mount.

ShareName

The name of the shared directory to mount.

DeviceName | *

The drive letter to assign to the mounted share. The asterisk (*) means use the next available letter.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • mount /?
  • To map a network drive using the command line, the first format shown above is preferred. It causes look-up operations to time out more quickly, and therefore locates and mounts the NFS resource sooner. The second format searches for Windows file systems with this name first, and then searches for NFS resources.
  • You can also use the net use command to map a network drive using a Windows user name and password that are mapped by User Name Mapping to a UNIX account for the NFS server. For more information about using the net use command, see Windows Help or type net use /? at the command prompt.


Disconnecting a network drive that is used with Client for NFS

To disconnect a network drive that is used with Client for NFS using Windows Explorer

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. Right-click the drive that is mapped to a remote network drive, and then click Disconnect.

Caution

You can lose data if you disconnect a remote file system while a file or directory that is open on the remote computer is also open on the local computer. If you attempt to disconnect while a resource on the remote file system is open, a confirmation dialog box appears, and you can proceed with or cancel the disconnection. Be sure to close all resources and references to resources on the remote file system before you disconnect.
To disconnect a network drive that is used with Client for NFS using the command line

  1. Open the command prompt.

  2. At a command prompt, type the following:

    umount [–f] {–a | Drive[...] | NetworkMount[...]}

Argument | Description
–f | Forces the deletion of a Network File System (NFS) network drive.
–a | Deletes all NFS network drives.
Drive | The drive that is mapped to a remote network drive.
NetworkMount | The network mount point to be disconnected. This mount must have been created using the net use MS-DOS command without specifying a drive letter.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • umount /?


Configuring NFS permissions on a file or folder

To configure NFS permissions using Windows Explorer

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. Right-click the name of the file or directory.

  3. Click Properties.

  4. Click the NFS Attributes tab.

  5. In the File attributes (mode) box, select or clear the check boxes corresponding to the mode bits you want to set or clear, click Apply, and then click OK. To dismiss the dialog box without making any changes, click Cancel.

Notes
  • Only the owner of a file or a user with appropriate permissions can change the mode of a file.
  • There is no command-line method for this procedure.


Viewing NFS mount options and properties

To view NFS mount options using Windows Explorer

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. Right-click the name of the file or directory.

  3. Right-click the drive assigned to a Network File System (NFS) mount, and then click Properties.

  4. To view the NFS mount options for the drive, click NFS Mount Options.

  5. To view the NFS properties for the mounted directory, click NFS Attributes.

Note

If you are logged on with an account that maps to a UNIX account on the NFS server with appropriate administrative credentials, you can change the UNIX file-mode permissions of the mounted directory when viewing the NFS properties.
To view NFS mount options using the command line

  1. Open the command prompt.

  2. At a command prompt, type the following:

    mount

Notes
  • The mount command without arguments displays all mounted volumes and their options.
  • To view the complete syntax for this command, at a command prompt, type:
  • mount /?


Viewing NFS server properties

To view NFS server properties using Windows Explorer

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. Double-click My Network Places, and then double-click Entire Network.

  3. Double-click NFS Network, and then double-click the local area network (LAN) for which you want to view properties.

  4. Right-click the name of the server whose properties you want to view, and then click Properties.

  5. When you click a directory in the Exported File Systems list, the computers that have access to it appear in the Access List.

To view NFS server properties using the command line

  1. Open the command prompt.

  2. At a command prompt, type the following:

    showmount -e Server

Argument | Description
Server | The name of the computer for which you want to view properties.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • showmount /?


Microsoft Services for NFS troubleshooting

General Issues

I need to modify ports used by Microsoft Services for NFS.

Cause

Port conflicts or security requirements necessitate port changes.

Solution

Log on to servers running Microsoft Services for Network File System (NFS) and change the following ports from the Registry Editor:
NLM and NSM ports

To modify the NLM and NSM ports, change the following registry settings:

HKLM\SYSTEM\CurrentControlSet\Services\NfsSvr\NlmNsm

DWORD "NlmPort"

DWORD "NsmPort"

Mount and NFS ports

To modify the mount protocol port, change the following registry setting:

HKLM\SYSTEM\CurrentControlSet\Services\NfsSvr\Parameters

DWORD "MountPort"

DWORD "NfsPort

Base port

The base port specifies the first of four sequential ports used by the mapping server. To modify the base port and the subsequent mapping server ports, change the following registry setting:

HKLM\SYSTEM\CurrentControlSet\Services\Mapsvc\CurrentVersion

DWORD "BasePort"

Microsoft Services for NFS component troubleshooting

Troubleshooting Server for NFS

Troubleshooting Client for NFS

Troubleshooting User Name Mapping


Troubleshooting Server for NFS

What problem are you having?

Issues

Despite appearing to have appropriate permissions, the user cannot access folder or file.

Cause

The user belongs to one or more groups that are not mapped consistently, Active Directory is not accessible, or User Name Mapping is not running.

Solution

To ensure proper file access, ensure that Windows and UNIX groups that are mapped to each other, in either Active Directory or User Name Mapping, contain the same users, and that the members of the Windows and UNIX groups are properly mapped to each other. Also, ensure that Active Directory is accessible or the User Name Mapping service is running on the designated server.

Authenticated users cannot access Network File System (NFS) resources.

Cause

Active Directory Lookup or User Name Mapping is not properly configured to work with this computer.

Solution

If you are using Active Directory Lookup, ensure that Microsoft Services for Network File System (NFS) is pointing to the proper Active Directory domain.

If you are using User Name Mapping, ensure that the .maphosts file on the computer running User Name Mapping specifies the names or Internet Protocol (IP) addresses of computers that can map user accounts by using User Name Mapping. For more information, see Securing access to the User Name Mapping server. If users cannot access NFS resources intermittently and configuring the .maphosts file does not solve the problem, it might be that too many client computers are trying to access User Name Mapping simultaneously. See "Error message: Unable to perform the requested operation as the mapping service cannot be contacted" in Troubleshooting User Name Mapping.

Users, including properly mapped users, cannot change the current directory to a shared directory or create files in the directory, even though anonymous access to the directory is allowed.

Cause

Either the NFS client does not support NFS version 3, or Server for NFS is not configured to support NFS 3. Also, the discretionary access control list (DACL) protecting the shared directory does not have an entry for Everyone, and so the access mode bit for Other is reported as 0. Because NFS 2 clients rely on directory mode settings rather than performing a separate access check for the shared directory, the client incorrectly fails the attempted access.

Solution

Do one of the following:

  • To the DACL protecting the directory being shared, add an entry that grants Everyone read or read/write access, as appropriate.

  • Ensure that the NFS client supports NFS 3, and enable NFS 3 support by Server for NFS.

  • The shared directory is not accessible even though it is listed as available.

Cause

The directory was moved after it was shared.

Solution

Return the directory to its original location, or stop sharing the directory and then reshare it.

All files created on Server for NFS are owned by Anonymous.

Cause

Authentication is not configured properly.

Solution

Ensure that mappings are set up correctly in Active Directory or in User Name Mapping and that Server for NFS is correctly configured to use either Active Directory Lookup or User Name Mapping. Also, be sure all Windows Server 2000 domain controllers are properly configured. For more information, see Server for NFS Authentication

Files created by a new user are owned by Anonymous.

Cause

If you are using User Name Mapping, then User Name Mapping and Server for NFS have not yet refreshed data from the Network Information Service (NIS) server. Typically, User Name Mapping refreshes data from NIS once an hour, and Server for NFS refreshes data from User Name Mapping once an hour.

Solution

The new user should wait at least two hours before attempting to access or create files on Server for NFS, or the administrator of the computer running User Name Mapping can refresh the mapping database.

A user cannot write to a file.

Cause

File permissions or attributes do not allow write access to the file or its directory.

Solution

If the directory is owned by the Administrators group, make an individual user account the owner of the directory. Ensure that the user's UNIX account is mapped to a valid Windows account and that the NTFS file system permissions of the directory and file allow write access to the Windows user account. Ensure that the read-only attribute is not set on the file or the directory.

Users of Japanese UNIX systems cannot view file names in Japanese.

Cause

Extended UNIX character (EUC) set is not enabled.

Solution

Configure the share to use the appropriate character encoding.

Server for NFS configuration settings are not replicated across nodes in a server cluster.

Cause

The Cluster service is not running, was not running when Server for NFS started, or failed after Server for NFS started.

Solution

Take all NFS shares owned by the node offline, or move the cluster groups containing NFS shares to another node. Stop Server for NFS, start the cluster service if needed, and then restart Server for NFS. Return the NFS shares online or move the cluster groups back to the node.

Server for NFS fails to stop on a server cluster.

Cause

This is by design. When an NFS share is online on a cluster node, the cluster service automatically restarts Server for NFS to keep the shares online.

Solution

Before stopping Server for NFS on a server cluster node, take all NFS shares owned by the node offline, or move the cluster groups containing NFS shares to another node.

An NFS network share on a server cluster node fails to come online.

Cause

An NFS share on that node with the same alias or path already exists on the node.

Solution

Make sure that the shared path and alias are unique across the cluster. Also, avoid having nonclustered NFS shares on a server cluster node.

Cause

The user who installed the cluster service does not have read permission on the directory that is shared, so the path cannot be validated.

Solution

Grant read access to the directory for the user who installed the cluster service.

Cause

The disk resource containing the directory being shared is offline, so the cluster service cannot verify the path of the share.

Solution

Bring the disk resource online, and then bring the NFS share online. We recommend that the NFS share resource be made dependent on the disk resource that contains the shared folder.

Cause

The disk is inaccessible due to hardware error.

Solution

Take the NFS shares on the disk offline. Ensure that the disk is accessible from all cluster nodes, and then bring the NFS shares online.

Cause

There are a large number of subdirectories under a subdirectories-only share, and the resource times out before all the shares are created when the resource is coming online.

Solution

Increase the time-out interval for the resource.

Creating or modifying an NFS share fails with the error: The share path specified does not exist, or you are trying to modify the properties of an online share.

Cause

The specified directory does not exist.

Solution

Make sure that the directory exists and that the path is correct.

Cause

The share is online.

Solution

Take the share offline, make the required modifications, and then bring the share online.

Cause

The disk resource containing the shared directory is offline, so the cluster service cannot verify the path of the share.

Solution

Bring the disk online, make the necessary modifications to the NFS share resource, and then bring the NFS share online.

User Name Mapping is properly configured, but users are not being mapped correctly.

Cause

Server for NFS is not set to use the correct User Name Mapping server.

Solution

Ensure that the specified User Name Mapping server is valid. If the User Name Mapping server is on a server cluster, ensure that the following conditions exist:

  • User Name Mapping is installed on all cluster nodes

  • User Name Mapping data is being replicated to all nodes in the cluster

  • Server for NFS is using the name of a Network Name cluster resource as the User Name Mapping server, not localhost or the name of any of the cluster nodes

Cause

Server for NFS has not received updated maps from the mapping server. If Server for NFS and User Name Mapping are on different computers, this occurs once every 30 minutes.

Solution

Force Server for NFS to refresh the maps by doing one of the following:

  • In Microsoft Services for Network File System, click Server for NFS, and then click Apply.

  • Use the nfsadmin server command to execute an operation, such as by setting a value to its current value.

  • Restart Server for NFS.

Cause

Account changes on the Windows domain controller or the Network Information Service (NIS) server have not been received by User Name Mapping.

Solution

Force Server for NFS to refresh the maps by doing one of the following:

  • In Microsoft Services for Network File System, click Server for NFS, and then click Apply.

  • Use the nfsadmin server command to execute an operation, such as by setting a value to its current value.

  • Restart Server for NFS.

Cause

Local accounts on a cluster node were mapped to UNIX user accounts. Local accounts are not valid on all nodes in a cluster.

Solution

Ensure that all Windows accounts mapped to UNIX accounts on User Name Mapping running on a cluster are Windows domain accounts.

Cause

The passwd and group files are not at the same location on all nodes of the cluster, or on a network drive.

Solution

Ensure that the passwd and group files are identical and at identical locations on local disks of all nodes.

Cause

The Server for NFS server is not on the list of permitted User Name Mapping server clients.

Solution

Ensure that the .maphosts files on all User Name Mapping server cluster nodes are identical to permit the node running Server for NFS to obtain maps from the User Name Mapping server.

Cause

The server running User Name Mapping has failed.

Solution

Correct the cause of failure and then restart User Name Mapping on the server.

Cause

A Windows account mapped to a UNIX account is disabled or no longer exists.

Solution

If the Windows account exists, but is disabled, enable it. If the account does not exist, create a new account and, if necessary, recreate the corresponding advanced map.

Cause

A Windows user account has not been granted the credentials to log on to the network.

Solution

Grant the required credentials to the Windows user account, and then force Server for NFS to refresh the maps by doing one of the following:

  • In Microsoft Services for Network File System, click Server for NFS, and then click Apply.

  • Use the nfsadmin server command to execute an operation, such as by setting a value to its current value.

  • Restart Server for NFS.

Cause

Windows and UNIX groups mapped to each other do not contain the same members.

Solution

Ensure that all Windows users in a group are mapped to UNIX users in the corresponding UNIX group, and that all UNIX users in a group are mapped to users in the corresponding Windows group.

Cause

User Name Mapping settings are not properly replicated on all nodes in a server cluster.

Solution

Ensure that User Name Mapping on a server cluster is configured properly to allow replication on all nodes.

A group containing an NFS share fails to come online on a particular cluster server node.

Cause

Server for NFS is not installed on the node.

Solution

Install Server for NFS on the node.

Cause

The node is not configured as the preferred owner of the group.

Solution

Configure the group's properties to make the node the preferred owner of the group.

Cause

One of the resources in the group does not list the node as a possible owner even though the group specifies the node as a preferred owner.

Solution

Configure the resource's properties to specify the node as a possible owner.

The showmount –e command for a virtual server lists all shares on the node rather than those in the same group as the virtual server.

Cause

This is by design. There is only one instance of Server for NFS running on a node that will enumerate all shares on that node. It does not distinguish between shares in different cluster groups.

Solution

Maintain different groups on different nodes.

The root user is not granted proper permissions.

Cause

The share does not have root access enabled.

Solution

Right-click the shared directory, click Properties, click NFS Sharing, click Permissions, and then click Allow root access.

Cause

The computer from which the root user is accessing the share is not permitted root access.

Solution

Right-click the shared directory, click Properties, click Permissions, and then do one of the following:

  • Grant root access to ALL MACHINES.

  • Grant root access to a client group containing the computer.

  • Grant root access to the computer itself.

Cause

The root user does not have read/write permission.

Solution

Grant the appropriate permissions to the Windows user mapped to the root user. Right-click the shared directory, click Properties, click Permissions, and then click Root access allowed.

Cause

The root user account is not properly mapped to a Windows user account.

Solution

Map the root user to a Windows account in the Administrators or Domain Admins group, and map the root user's group to the same Windows group.

Cause

Server for NFS has not received updated maps from User Name Mapping.

Solution

Force Server for NFS to refresh the maps by doing one of the following:

  • In Microsoft Services for Network File System, click Server for NFS, and then click Apply.

  • Use the nfsadmin server command to execute an operation, such as by setting a value to its current value.

  • Restart Server for NFS.

Cause

The root user's user identifier (UID) is not 0. Server for NFS grants root access only to a UNIX user with a UID of 0.

Solution

Change the root user's UID to 0.

Anonymous access fails on Windows Server 2003 operating systems.

Cause

Local security policy is not set to enable Everyone permissions to apply to anonymous users (the default).

Solution

Use the Local Security Policy manager to enable Network Access: Let Everyone permissions to apply to anonymous users in Security Options in Local Policies.


Troubleshooting Client for NFS

What problem are you having?

Issues

I need Client for NFS to only use “privileged” ports.

Cause

Some Network File System (NFS) servers have a concept of “privileged” ports (meaning ports numbered lower than 1024), and will not accept client connections from ports above that range.

Solution

Log onto computers running Client for NFS and set the following registry key to 1 and restart Client for NFS:

HKLM\Software\Microsoft\Client for NFS\CurrentVersion\default

DWORD “UseReservedPorts”

An error occurred while trying to communicate with the Client for NFS service.

Cause

The Client for NFS service is not started, cannot contact Active Directory or the User Name Mapping server, or is running with credentials that are mapped incorrectly.

Solution

In Microsoft Services for Network File System, you can ensure that the service is started by right-clicking Client for NFS, and then clicking Start. In Microsoft Services for Network File System, ensure that the name of the correct Active Directory domain or User Name Mapping server is specified. Check with the administrator of the Active Directory or the User Name Mapping server to ensure that your Windows user account is properly mapped to your UNIX user account.

System error 1722 has occurred. The remote procedure call (RPC) server is unavailable.

Cause

The Client for NFS service is not started.

Solution

In Microsoft Services for Network File System, right-click Client for NFS, and then click Start.

An attempt to mount a shared directory produces a network error 67, the network name was not found.

Cause

The directory is not shared, or the server is unable to resolve the client name.

Solution

Use showmount –e server to display the names of shared directories on the server. If this fails with a remote procedure call (RPC) time-out, contact the administrator of the Network File System (NFS) server to ensure that the NFS and portmap services are started on the server. Ensure that the Internet Protocol (IP) address of the client is specified in either the server /etc/hosts file, or in the DNS database, as appropriate.

I received the message RPC: Timed out or RPC: Port mapper failure – RPC: Timed out.

Cause

Either the port mapper or Network File System (NFS) server daemons are not running on the server, or Client for NFS performance settings need to be adjusted.

Solution

Ensure that the services are started. If the port mapper and NFS server daemons are running on the server, in Microsoft Services for Network File System, click Client for NFS, and then increase the maximum number of retries and the interval between retries.

A file I created on a mounted Network File System (NFS) drive is shown as having been created by nobody:nogroup or by –2:–1, or the user identifier (UID) is a very large number (2**32-2).

Cause

Your Windows user name is not properly mapped in Active Directory or User Name Mapping.

Solution

Use the server running User Name Mapping for your Windows user account that is not properly mapped. In Microsoft Services for NFS, check to ensure that the name of the correct Active Directory domain or User Name Mapping server is specified. Check with the administrator of the Active Directory or User Name Mapping server to ensure that your Windows user account is properly mapped to your UNIX user account.

When I attempt to map a network drive, I am asked for a user name and password, and then the attempt to map the drive fails even though I supply valid credentials.

Cause

Either an Active Directory domain or a User Name Mapping server has not been designated for use by Microsoft Services for NFS.

Solution

Specify the correct Active Directory domain or User Name Mapping server. For more information, see Specifying how Client for NFS obtains UNIX UID and GID information.

I cannot access files on a mapped network drive.

Cause

Neither an Active Directory domain nor a User Name Mapping server has been designated for use by Microsoft Services for NFS.

Solution

Specify the correct Active Directory domain or User Name Mapping server. For more information, see Specifying how Client for NFS obtains UNIX UID and GID information.

I cannot mount a shared root directory (/) on a UNIX computer.

Cause

When a root directory (/) on a UNIX computer is shared, Client for NFS cannot mount it by using the standard path syntax (net use * \\server\ or net use server:/).

Solution

To mount the root directory, enter this command:

net use * \\ server \!

The share name must be an exclamation mark (!).

MS-DOS-based or earlier Windows-based applications cannot access files on NFS, or a message appears indicating that a 16-bit application cannot be run.

Cause

By default, Client for NFS does not convert UNIX long file names to the MS-DOS–style 8.3 format.

Solution

Use Registry Editor (Regedit.exe) to ensure that the following entry is set to a value of 1 (the default):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Client for NFS\CurrentVersion\Users\Default\Defaults\8.3Format

This causes Client for NFS to convert all UNIX file names to the 8.3 format required by MS-DOS-based applications and by applications designed to run with Windows 3.x and earlier. Setting this entry to a value of 0 improves Client for NFS performance somewhat because Client for NFS does not convert file names.

Caution

Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

I received a delayed write error message.

Cause

Either the NFS server is not responding or the Client for NFS performance options are not properly adjusted.

Solution

Use the showmount –e server command to determine whether the NFS server is running properly.

Attempting to mount with the net use command produces the error message: 1788: The trust relationship between the primary domain and the trusted domain failed.

Cause

You are attempting to access a computer in an untrusted domain, and either Client for NFS has not started on your computer or the share is not available from the NFS server.

Solution

In Microsoft Services for Network File System, right-click Client for NFS, and then click Start. Use showmount –e server to display the names of shared directories on the server. If this fails with an RPC time-out, contact the administrator of the NFS server to ensure that the NFS and portmap services are started on the server and that the shared directory is available.

Even after changing the default permissions for new files, new files on a mount are still created with the previous permissions.

Cause

This is by design. New default permissions are only applied to new mounts.

Solution

Unmount and then remount the shared directory.

After restarting the computer, the mount parameters of a persistent mount are changed.

Cause

You used the net use command to mount the directory.

Solution

Use the mount utility to mount the directory.

Authenticated users cannot access NFS resources, or all NFS shares are accessed as Anonymous.

Cause

User Name Mapping is not properly configured to work with this computer.

Solution

Ensure that the .maphosts file on the computer running User Name Mapping specifies the names or Internet Protocol (IP) addresses of computers that can map user accounts by using User Name Mapping. For more information, see Securing access to the User Name Mapping server. If users cannot access NFS resources intermittently and configuring the .maphosts file does not solve the problem, it could be that too many client computers are trying to access User Name Mapping simultaneously. See "Error message: Unable to perform the requested operation as the mapping service cannot be contacted" in Troubleshooting User Name Mapping.


Troubleshooting User Name Mapping

What problem are you having?

Issues

I cannot download Windows users from a Windows domain.

Cause

You do not have adequate credentials, or the computer running User Name Mapping does not belong to a domain trusted by the Windows user domain.

Solution

Log on as a user in a domain trusted by the domain to which the computer running User Name Mapping belongs and that belongs to the Administrators group on the computer running User Name Mapping.

I cannot download Windows users from an Active Directory domain.

Cause

When installing the Active Directory domain controller, you chose the Permissions compatible with Windows 2000 Server option.

Solution

Do one of the following:

  • If the computer running User Name Mapping is a member of the domain, add the computer to the security group called Pre-Windows 2000 Compatible Access.

  • If the computer running User Name Mapping does not belong to the domain (that is, it belongs to a trusted domain), add the special group Everyone to the Pre-Windows 000 Compatible Access security group of the Active Directory domain.

You must restart the domain controller after adding the computer or group to the security group.

If, for some reason, you cannot add Everyone or the computer that is running User Name Mapping to the Pre-Windows 2000 Compatible Access security group, you can enable User Name Mapping to enumerate users in the domain by running the User Name Mapping service with an account that belongs to the Domain Admins group. This method is less secure than the other two solutions, however, and should be avoided if possible.

I cannot download UNIX users from a Network Information Service (NIS) server.

Cause

You have specified only the domain name, and either the NIS server is on a different subnet, or the NIS server is down.

Solution

Ensure that the NIS server is running. Ensure that the computer running User Name Mapping and the NIS server are on the same subnet, or specify the Internet Protocol (IP) address of the NIS server.

Users of a particular Windows-based computer cannot access Network File System (NFS) shares.

Cause

The Windows-based computer is not granted access in the .maphosts file to User Name Mapping.

Solution

Add the Windows-based computer to the .maphosts file. Make sure it does not appear after any – entry.

Mapped users cannot access Network File System (NFS) resources.

Cause

The .maphosts file has not been modified to specify trusted computers.

Solution

Ensure that the .maphosts file specifies the names or Internet Protocol (IP) addresses of computers that can map user accounts by using User Name Mapping. For more information, see Securing access to the User Name Mapping server.

If users still cannot access NFS resources, see "Error message: Unable to perform the requested operation as the mapping service cannot be contacted" later in this topic.

Error message: Unable to perform the requested operation as the mapping service cannot be contacted.

Cause

The maximum number of concurrent client connections has been exceeded.

Solution

If this message appears frequently when you are attempting to administer User Name Mapping, or if properly mapped users can only access NFS resources intermittently and other troubleshooting steps have failed, you can increase the maximum number of concurrent client connections that are allowed by creating a DWORD registry value named RpcMaxConcurrentConnectionsPerIp in the following location:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft \MSNFS

The value must be between 16 (the default) and 64.

Caution

Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

If the problem persists, or if NFS access performance noticeably degrades, consider establishing a User Name Mapping server pool. For more information, see Creating a User Name Mapping pool.

If you click Reload immediately after creating and saving a map, the new map is not shown.

Cause

Maps are saved to the registry, which notifies User Name Mapping of the new map. Because this process can take a minute or more, if you click Reload during that time, you will not see current data.

Solution

Wait at least a minute, and then click Reload again.

A user is unable to access NFS resources after being added or changed.

Cause

Maps have not been refreshed with new or changed data in the Windows or UNIX user databases.

Solution

After adding or changing a user in the Windows domain, the Network Information Service (NIS) domain, or the password and group files, update User Name Mapping. On the Configuration tab, click Synchronize Now, and then click Apply.

User Name Mapping configuration settings are not replicated across nodes in a server cluster.

Cause

The Cluster service is not running, was not running when User Name Mapping started, or failed after User Name Mapping started.

Solution

Stop User Name Mapping, start the Cluster service if needed, and then restart User Name Mapping.

If replication consistently fails after the computer restarts, it might be because User Name Mapping is starting before the Cluster service completes its startup procedures. In this case, use the Services snap-in to make User Name Mapping dependent on the Cluster service.

Restoring password and group files on a server cluster node does not recreate the files on other nodes.

Cause

User Name Mapping restores password and group files on one node only.

Solution

Copy the password and group files to all other cluster server nodes.

Maps are not updated to reflect changes in Windows user and group accounts or in NIS or password and group files.

Cause

The User Name Mapping server has not received the changes. By default, User Name Mapping refreshes its maps once every 24 hours.

Solution

In Microsoft Services for Network File System, click User Name Mapping, click Map Maintenance, and then click Synchronize Now.


Microsoft Services for NFS command-line tools

The following command-line tools are available for Microsoft Services for Network File System (NFS):

  • mapadmin

  • mount

  • nfsadmin

  • nfsshare

  • nfsstat

  • rpcinfo

  • showmount

  • umount

For more information about a specific command, type the command name followed by /? at the command prompt.


mapadmin

You can use Mapadmin to manage User Name Mapping for Microsoft Services for Network File System.

Syntax

mapadmin [computer] [-u user [-p password]]

mapadmin [computer] [-u user [-p password]] {start | stop}

mapadmin [computer] [-u user [-p password]] config option[...]

mapadmin [computer] [-u user [-p password]] add -wu WindowsUser -uu UNIXUser [-setprimary]

mapadmin [computer] [-u user [-p password]] add -wg WindowsGroup -ug UNIXGroup [-setprimary]

mapadmin [computer] [-u user [-p password]] setprimary -wu WindowsUser [-uu UNIXUser]

mapadmin [computer] [-u user [-p password]] setprimary -wg WindowsGroup [-ug UNIXGroup]

mapadmin [computer] [-u user [-p password]] delete option[...]

mapadmin [computer] [-u user [-p password]] list option[...]

mapadmin [computer] [-u user [-p password]] backup filename

mapadmin [computer] [-u user [-p password]] restore filename

mapadmin [computer] [-u user [-p password]] adddomainmap -d WindowsDomain {-y NISDomain | -f path}

mapadmin [computer] [-u user [-p password]] removedomainmap -d WindowsDomain -y NISDomain

mapadmin [computer] [-u user [-p password]] removedomainmap -all

mapadmin [computer] [-u user [-p password]] listdomainmaps

Description

The mapadmin command-line utility administers User Name Mapping on the local or remote computer running Microsoft Services for Network File System. If you are logged on with an account that does not have administrative credentials, you can specify a user name and password of an account that does.

In addition to specific command arguments, mapadmin accepts the following arguments and options:

computer
Specifies the remote computer running the User Name Mapping service that you want to administer. You can specify the computer using a Windows Internet Name Service (WINS) name or a Domain Name System (DNS) name, or by Internet Protocol (IP) address.
-u user
Specifies the user name of the user whose credentials are to be used. It might be necessary to add the domain name to the user name in the form domain\username.
-p password
Specifies the password of the user. If you specify the -u option but omit the -p option, you are prompted for the user's password.

The specific action that mapadmin performs depends on the command argument you specify:

start
Starts the User Name Mapping service.
stop
Stops the User Name Mapping service.
config
Specifies general settings for User Name Mapping. The following options are available with this command argument:

Term Definition

-r dddd:hh:mm

Specifies the refresh interval for updating from the Windows and NIS databases in days, hours, and minutes. The minimum interval is 5 minutes.

-i yes | no

Turns simple mapping on (yes) or off (no). By default, simple mapping is on.

add

Creates a new mapping for a user or group. The following options are available with this command argument:

Term Definition

-wu name

Specifies the name of the Windows user for which a new mapping is being created.

-uu name

Specifies the name of the UNIX user for which a new mapping is being created.

-wg group

Specifies the name of the Windows group for which a new mapping is being created.

-ug group

Specifies the name of the UNIX group for which a new mapping is being created.

-setprimary

Specifies that the new mapping is the primary mapping.

setprimary

Specifies which mapping is the primary mapping for a UNIX user or group with multiple mappings. The following options are available with this command argument:

Term Definition

-wu name

Specifies the Windows user of the primary mapping. If more than one mapping for the user exists, use the -uu option to specify the primary mapping.

-uu name

Specifies the UNIX user of the primary mapping.

-wg group

Specifies the Windows group of the primary mapping. If more than one mapping for the group exists, use the -ug option to specify the primary mapping.

-ug group

Specifies the UNIX group of the primary mapping.

delete

Removes the mapping for a user or group. The following options are available for this command argument:

Term Definition

-wu user

The Windows user for which the mapping will be deleted, specified as WindowsDomain\UserName. You must specify either the -wu or the -uu option, or both. If you specify both options, the particular mapping identified by the two options will be deleted. If you specify only the -wu option, all mappings for the specified user will be deleted.

-wg group

The Windows group for which the mapping will be deleted, specified as WindowsDomain\GroupName. You must specify either the -wg or the -ug option, or both. If you specify both options, the particular mapping identified by the two options will be deleted. If you specify only the -wg option, all mappings for the specified group will be deleted.

-uu user

The UNIX user for whom the mapping will be deleted, specified as UserName. You must specify either the -wu or the -uu option, or both. If you specify both options, the particular mapping identified by the two options will be deleted. If you specify only the -uu option, all mappings for the specified user will be deleted.

-ug group

The UNIX group for which the mapping will be deleted, specified as GroupName. You must specify either the -wg or the -ug option, or both. If you specify both options, the particular mapping identified by the two options will be deleted. If you specify only the -ug option, all mappings for the specified group will be deleted.

list

Displays information about user and group mappings. The following options are available with this command argument:

Term Definition

-all

Lists both simple and advanced mappings for users and groups.

-simple

Lists all simple mapped users and groups.

-advanced

Lists all advanced mapped users and groups. Maps are listed in the order in which they are evaluated. Primary maps, marked with an asterisk (*), are listed first, followed by secondary maps, which are marked with a carat (^).

-wu name

Lists the mapping for a specified Windows user.

-wg group

Lists the mapping for a Windows group.

-uu name

Lists the mapping for a UNIX user.

-ug group

Lists the mapping for a UNIX group.

backup

Saves User Name Mapping configuration and mapping data to the file specified by filename.

restore

Replaces configuration and mapping data with data from the file (specified by filename) that was created using the backup command argument.

adddomainmap

Adds a simple map between a Windows domain and an NIS domain or password and group files. The following options are available for this command argument:

Term Definition

-d WindowsDomain

Specifies the Windows domain to be mapped.

-y NISDomain

Specifies the NIS domain to be mapped.

-n nisServer
Specifies the NIS server for the NIS domain specified with the -y option.

-f path

Specifies the fully qualified path of directory containing the password and group files to be mapped. The files must be located on the computer being managed, and you cannot use mapadmin to manage a remote computer to set up maps based on password and group files.

removedomainmap

Removes a simple map between a Windows domain and an NIS domain. The following options and argument are available for this command argument:

Term Definition

-d WindowsDomain

Specifies the Windows domain of the map to be removed.

-y NISDomain

Specifies the NIS domain of the map to be removed.

-all

Specifies that all simple maps between Windows and NIS domains are to be removed. This will also remove any simple map between a Windows domain and password and group files.

listdomainmaps

Lists the Windows domains that are mapped to NIS domains or password and group files.

If you do not specify a command argument, mapadmin displays the current settings for User Name Mapping.

For all options that specify a user or group name, the following formats can be used:

For Windows users, use the form domain\username, \\computer\username, \computer\username, or computer\username

For Windows groups, use the form domain\groupname, \\computer\groupname, \computer\groupname, or computer\groupname

For UNIX users, use the form NISdomain\username, username@NISdomain, username@PCNFS, or PCNFS\username

For UNIX groups, use the form NISdomain\groupname, groupname@NISdomain, groupname@PCNFS, or PCNFS\groupname

See Also

  • User Name Mapping administration


mount

You can use mount to mount Network File System (NFS) network shares.

Syntax

mount [ -o Option[...]] [-u:UserName] [-p:Password | *] [{\\ComputerName\ShareName | ComputerName:/ShareName}] [DeviceName | *]

Description

The mount command-line utility mounts the file system identified by ShareName exported by the NFS server identified by ComputerName and associates it with the drive letter specified by DeviceName or, if an asterisk (*) is used, by the first available driver letter. Users can then access the exported file system as though it were a drive on the local computer. When used without options or arguments, mount displays information about all mounted NFS file systems.

The mount utility is available only if Client for NFS is installed.

The following options and arguments can be used with the mount utility.

-u: UserName
Specifies the user name to use for mounting the share. If username is not preceded by a backslash (\), it is treated as a UNIX user name.
-p: Password
The password to use for mounting the share. If you use an asterisk (*), you will be prompted for the password.
-o rsize=[buffersize]
Sets the size in kilobytes of the read buffer. Acceptable values are 1, 2, 4, 8, 16, and 32; the default is 32 KB.
-o wsize=[buffersize]
Sets the size in kilobytes of the write buffer. Acceptable values are 1, 2, 4, 8, 16, and 32; the default is 32 KB.
-o timeout=[seconds]
Sets the time-out value in seconds for a remote procedure call (RPC). Acceptable values are 0.8, 0.9, and any integer in the range 1-60; the default is 0.8.
-o retry=[number]
Sets the number of retries for a soft mount. Acceptable values are integers in the range 1-10; the default is 1.
-o mtype=[soft | hard]
Sets the mount type (default is soft). Regardless of the mount type, mount will return if it cannot immediately mount the share. Once the share has been successfully mounted, however, if the mount type is hard, Client for NFS will continue to try to access the share until it is successful. As a result, if the NFS server is unavailable, any Windows program trying to access the share will appear to stop responding, or "hang," if the mount type is hard.
-o anon
Mounts as an anonymous user.
-o nolock
Disables locking (default is enabled).
-o casesensitive
Forces file lookups on the server to be case sensitive.
-o fileaccess= mode
Specifies the default permission mode of new files created on the NFS share. Specify mode as a three-digit number in the form ogw, where o, g, and w are each a digit representing the access granted the file's owner, group, and the world, respectively. The digits must be in the range 0-7 with the following meaning:
  • 0: No access

  • 1: x (execute access)

  • 2: w (write access)

  • 3: wx

  • 4: r (read access)

  • 5: rx

  • 6: rw

  • 7: rwx

-o lang={euc-jp|euc-tw|euc-kr|shift-jis|big5|ksc5601|gb2312-80|ansi}
Specifies the default encoding used for file and directory names and, if used, must be set to one of the following:
  • ansi

  • big5 (Chinese)

  • euc-jp (Japanese)

  • euc-kr (Korean)

  • euc-tw (Chinese)

  • gb2312-80 (Simplified Chinese)

  • ksc5601 (Korean)

  • shift-jis (Japanese)

If this option is set to ansi on systems configured for non-English locales, the encoding scheme is set to the default encoding scheme for the locale. The following are the default encoding schemes for the indicated locales:
  • Japanese: SHIFT-JIS

  • Korean: KS_C_5601-1987

  • Simplified Chinese: GB2312-80

  • Traditional Chinese: BIG5

Note

If you make a persistent connection with mount, you must use umount to delete the connection. Neither the net use command nor Microsoft Windows Explorer will delete these connections.

See Also

  • umount


nfsadmin

You can use nfsadmin to manage Server for NFS and Client for NFS.

Syntax

nfsadmin server [ ComputerName ] [ -u UserName[-p Password]] -l

nfsadmin server [ ComputerName ] [ -u UserName [-p Password]] -r {client | all}

nfsadmin server [ ComputerName ] [ -u UserName [-p Password]] {start | stop}

nfsadmin server [ ComputerName ] [ -u UserName [-p Password]] config Option[...]

nfsadmin server [ ComputerName ] [ -u UserName [-p Password]] creategroup Name

nfsadmin server [ ComputerName ] [ -u UserName [-p Password]] listgroups

nfsadmin server [ ComputerName ] [ -u UserName [-p Password]] deletegroup Name

nfsadmin server [ ComputerName ] [ -u UserName [-p Password]] renamegroup OldName NewName

nfsadmin server [ ComputerName ] [ -u UserName [-p Password]] addmembers Name Host[...]

nfsadmin server [ ComputerName ] [ -u UserName [-p Password]] listmembers

nfsadmin server [ ComputerName ] [ -u UserName [-p Password]] deletemembers Group Host[...]

nfsadmin client [ ComputerName ] [ -u UserName [-p Password]] {start | stop}

nfsadmin client [ ComputerName ] [ -u UserName [-p Password]] config Option[...]

Description

The nfsadmin command-line utility administers Server for NFS or Client for NFS on the local or remote computer running Microsoft Services for Network File System (NFS). If you are logged on with an account that does not have the required privileges, you can specify a user name and password of an account that does. The action performed by nfsadmin depends on the command arguments you supply.

In addition to service-specific command arguments and options, nfsadmin accepts the following:

ComputerName
Specifies the remote computer you want to administer. You can specify the computer using a Windows Internet Name Service (WINS) name or a Domain Name System (DNS) name, or by Internet Protocol (IP) address.
-u UserName
Specifies the user name of the user whose credentials are to be used. It might be necessary to add the domain name to the user name in the form domain\UserName
-p Password
Specifies the password of the user specified using the -u option. If you specify the -u option but omit the -p option, you are prompted for the user's password.

Administering Server for NFS

Use the nfsadmin server command to administer Server for NFS. The specific action that nfsadmin server takes depends on the command option or argument you specify:

-l
Lists all locks held by clients.
-r {client | all}
Releases the locks held by a client or, if all is specified, by all clients.
start
Starts the Server for NFS service.
stop
Stops the Server for NFS service.
config
Specifies general settings for Server for NFS. You must supply at least one of the following options with the config command argument:
mapsvr= server
Sets server as the User Name Mapping server for Server for NFS. Although this option continues to be supported for compatibility with previous versions, you should use the sfuadmin utility instead.
auditlocation={eventlog | file | both | none}
Specifies whether events will be audited and where the events will be recorded. One of the following arguments is required.
eventlog
Specifies that audited events will be recorded only in the Event Viewer application log.
file
Specifies that audited events will be recorded only in the file specified by config fname.
both
Specifies that audited events will be recorded in the Event Viewer application log as well as the file specified by config fname.
none
Specifies that events will not be audited.
fname= file
Sets the file specified by file as the audit file. The default is %sfudir%\log\nfssvr.log
fsize==size
Sets size as the maximum size in megabytes of the audit file. The default maximum size is 7 MB.
audit=[+|-]mount [+|-]read [+|-]write [+|-]create [+|-]delete [+|-]locking [+|-]all
Specifies the events to be logged. To start logging an event, type a plus sign (+) before the event name; to stop logging an event, type a minus sign (-) before the event name. If the sign is omitted, the plus sign is assumed. Do not use all with any other event name.
lockperiod= seconds
Specifies the number of seconds that Server for NFS will wait to reclaim locks after a connection to Server for NFS has been lost and then reestablished or after the Server for NFS service has been restarted.
Portmapprotocol={TCP | UDP | TCP+UDP
Specifies which transport protocols Portmap supports. The default setting is TCP+UDP.
mountprotocol={TCP | UDP | TCP+UDP}
Specifies which transport protocols mount supports. The default setting is TCP+UDP.
nfsprotocol={TCP | UDP | TCP+UDP}
Specifies which transport protocols Network File System (NFS) supports. The default setting is TCP+UDP
nlmprotocol={TCP | UDP | TCP+UDP}
Specifies which transport protocols Network Lock Manager (NLM) supports. The default setting is TCP+UDP.
nsmprotocol={TCP | UDP | TCP+UDP}
Specifies which transport protocols Network Status Manager (NSM) supports. The default setting is TCP+UDP.
enableV3={yes | no}
Specifies whether NFS version 3 protocols will be supported. The default setting is yes.
renewauth={yes | no}
Specifies whether client connections will be required to be reauthenticated after the period specified by config renewauthinterval. The default setting is no.
renewauthinterval= seconds
Specifies the number of seconds that elapse before a client is forced to be reauthenticated if config renewauth is set to yes. The default value is 600 seconds.
dircache= size
Specifies the size in kilobytes of the directory cache. The number specified as size must be a multiple of 4 between 4 and 128. The default directory-cache size is 128 KB.
translationfile=[file]
Specifies a file containing mapping information for replacing characters in the names of files when moving them from Windows-based to UNIX-based file systems. If file is not specified, then file name character translation is disabled. If the value of translationfile is changed, you must restart the server for the change to take effect.
dotfileshidden={yes | no}
Specifies whether files that are created with names beginning with a period (.) will be marked as hidden in the Windows file system and consequently hidden from NFS clients. The default setting is no.
casesensitivelookups={yes | no}
Specifies whether directory lookups will be case sensitive (requiring exact matching of character case). You also need to disable Windows kernel case-insensitivity in order for Server for NFS to support case-sensitive file names. You can disable Windows kernel case-insensitivity by clearing the following registry key to 0: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel DWORD “obcaseinsensitive”
ntfscase={lower | upper | preserve}
Specifies whether the case of characters in the names of files in the NTFS file system will be returned in lowercase, uppercase, or in the form stored in the directory. The default setting is preserve. This setting cannot be changed if casesensitivelookups is set to yes.
creategroup name
Creates a new client group, giving it the specified name.
listgroups
Displays the names of all client groups.
deletegroup name
Removes the client group specified by name.
renamegroup OldName NewName
Changes the name of the client group specified by OldName to NewName
addmembers Name Host[...]
Adds Host to the client group specified by Name.
listmembers Name
Lists the host computers in the client group specified by Name.
deletemembers Group Host[...]
Removes the client specified by Host from the client group specified by Group.

If you do not specify a command option or argument, nfsadmin server displays the current Server for NFS configuration settings.

Administering Client for NFS

Use the nfsadmin client command to administer Client for NFS. The specific action that nfsadmin client takes depends on the command argument you specify:

start
Starts the Client for NFS service.
stop
Stops the Client for NFS service.
config
Specifies general settings for Client for NFS. You must supply at least one of the following options with the config command argument:
fileaccess= mode
  • Specifies the default permission mode for files created on Network File System (NFS) servers. The mode argument consists of a three digits from 0 to 7 (inclusive) representing the default permissions granted the user, group, and others (respectively). The digits translate to UNIX-style permissions as follows: 0=none, 1=x, 2=w, 3=wx, 4=r, 5=rx, 6=rw, and 7=rwx. For example, fileaccess=750 gives rwx permission to the owner, rx permission to the group, and no access permission to others.

mapsvr= server
Sets server as the User Name Mapping server for Client for NFS. Although this option continues to be supported for compatibility with previous versions, you should use the sfuadmin utility instead.
mtype={hard | soft}
Specifies the default mount type. For a hard mount, Client for NFS continues to retry a failed RPC until it succeeds. For a soft mount, Client for NFS returns failure to the calling application after retrying the call the number of times specified by the retry option.
retry= number
Specifies the number of times to try to make a connection for a soft mount. This value must be from 1 to 10, inclusive. The default is 1.
timeout= seconds
Specifies the number of seconds to wait for a connection (remote procedure call). This value must be 0.8, 0.9, or an integer from 1 to 60, inclusive. The default is 0.8.
Protocol={TCP | UDP | TCP+UDP}
Specifies which transport protocols the client supports. The default setting is TCP+UDP
rsize= size
Specifies the size, in kilobytes, of the read buffer. This value can be 0.5, 1, 2, 4, 8, 16, or 32. The default is 32.
wsize= size
Specifies the size, in kilobytes, of the write buffer. This value can be 0.5, 1, 2, 4, 8, 16, or 32. The default is 32.
perf=default
Restores the following performance settings to default values:
  • mtype

  • retry

  • timeout

  • rsize

  • wsize

fileaccess= mode
Specifies the default permission mode for files created on Network File System (NFS) servers. The mode argument consists of a three digits from 0 to 7 (inclusive) representing the default permissions granted the user, group, and others (respectively). The digits translate to UNIX-style permissions as follows: 0=none, 1=x, 2=w, 3=wx, 4=r, 5=rx, 6=rw, and 7=rwx. For example, fileaccess=750 gives rwx permission to the owner, rx permission to the group, and no access permission to others.

If you do not specify a command option or argument, nfsadmin client displays the current Client for NFS configuration settings.


nfsshare

You can use nfsshare to control Network File System (NFS) shares.

Syntax

nfsshare [ShareName]

nfsshare [-o Option=value...] ShareName=Drive:Path

nfsshare {ShareName | Drive:Path | * } /delete

Description

Without arguments, the nfsshare command-line utility lists all Network File System (NFS) shares exported by Server for NFS. With ShareName as the only argument, nfsshare lists the properties of the NFS share identified by ShareName. When ShareName and Drive:Path are provided, nfsshare exports the folder identified by Drive:Path as ShareName. When the /delete option is used, the specified folder is no longer made available to NFS clients.

Options

The nfsshare command accepts the following options and arguments:

-o
Sets Option to value. The Option argument can be one or more of the following:
anon={yes | no}
Specifies whether anonymous (unmapped) users can access the shared directory. The default is no.
anonuid= uid
Specifies that anonymous (unmapped) users will access the share directory using uid as their user identifier (UID). The default is -2. The anonymous UID will be used when reporting the owner of a file owned by an unmapped user, even if anonymous access is disabled.
anongid= gid
Specifies that anonymous (unmapped) users will access the share directory using gid as their group identifier (GID). The default is -2. The anonymous GID will be used when reporting the owner of a file owned by an unmapped user, even if anonymous access is disabled.
encoding={big5|euc-jp|euc-kr|euc-tw|gb2312-80|ksc5601|shift-jis}
Specifies the default encoding used for file and directory names and, if used, must be set to one of the following:
  • big5 (Chinese)

  • euc-jp (Japanese)

  • euc-kr (Korean)

  • euc-tw (Chinese)

  • gb2312-80 (Simplified Chinese)

  • ksc5601 (Korean)

  • shift-jis (Japanese)

If this is option is not set, the default encoding scheme is ANSI or, on systems configured for non-English locales, the default encoding scheme for the locale. The following are the default encoding schemes for the indicated locales:
  • Japanese: SHIFT-JIS

  • Korean: KS_C_5601-1987

  • Simplified Chinese: GB2312-80

  • Traditional Chinese: BIG5

ro[=Host[:Host]...]
Provides read-only access to the shared directory by the hosts or client groups specified by Host. Separate host and group names with a colon (:). If Host is not specified, all clients (except those specified with the rw option) have read-only access. If the ro option is set for one or more clients, but the rw option is not set, only the clients specified with the ro option have access to the shared directory.
rw[=Host[:Host]...]
Provides read-write access to the shared directory by the hosts or client groups specified by Host. Separate host and group names with a colon (:). If Host is not specified, all hosts and client groups (except those specified with the ro option) have read-write access. If neither the ro nor the rw option is set, all clients have read-write access to the shared directory.
root[=Host[:Host]...]
Provides root access to the shared directory by the hosts or client groups specified by Host. Separate host and group names with a colon (:). If Host is not specified, all clients have root access. If the root option is not set, no clients have root access to the shared directory.
/delete
If ShareName or Drive:Path is specified, deletes the specified share. If * is specified, deletes all NFS shares.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsshare /?

See Also

  • Managing NFS shares


nfsstat

You can use nfsstat to display or reset counts of calls made to Server for NFS.

Syntax

nfsstat [-z]

Description

When used without the -z option, the nfsstat command-line utility displays the number of NFS V2, NFS V3, and Mount V3 calls made to the server since the counters were set to 0, either when the service started or when the counters were reset using nfsstat -z.


rpcinfo

You can use rpcinfo to list programs on remote computers.

Syntax

List all programs registered with the port mapper:

rpcinfo -p [Node]

Request a response from network nodes that have a specified program:

rpcinfo -b Program Version

Use Transmission Control Protocol (TCP) to call a program:

rpcinfo -t Node Program [Version]

Use User Datagram Protocol (UDP) to call a program:

rpcinfo -u Node Program [Version]

Description

The rpcinfo command-line utility makes a remote procedure call (RPC) to an RPC server and reports what it finds.

The rpcinfo utility accepts the following options:

-p [Node]
Lists all programs registered with the port mapper on the specified host. If you do not specify a node (computer) name, the program queries the port mapper on the local host.
-b Program Version
Requests a response from all network nodes that have the specified program and version registered with the port mapper. You must specify both a program name or number and a version number.
-t Node Program [Version]
Uses the TCP transport protocol to call the specified program. You must specify both a node (computer) name and a program name. If you do not specify a version, the program calls all versions.
-u Node Program [Version]
Uses the UDP transport protocol to call the specified program. You must specify both a node (computer) name and a program name. If you do not specify a version, the program calls all versions.


showmount

You can use showmount to display mounted directories.

Syntax

showmount { -e | -a | -d} [Server]

Description

The showmount command-line utility displays information about mounted file systems exported by Server for NFS on the computer specified by Server. If Server is not provided, showmount displays information about the computer on which the showmount command is run.

You must provide one of the following options:

-e
Displays all file systems exported on the server.
-a
Displays all Network File System (NFS) clients and the directories on the server each has mounted.
-d
Displays all directories on the server that are currently mounted by NFS clients.

See Also

  • Server for NFS administration


umount

You can use umount to remove Network File System (NFS)–mounted drives.

Syntax

umount [-f] [{-a | DriveLetter:[...] | NetworkMount[...]}]

Description

The umount command-line utility disconnects the specified NFS-mounted drive. You must supply at least one of the following options or arguments.

-f
Forces deletion of Network File System (NFS) network drives.
-a
Deletes all NFS network drives. If there are active connections, umount prompts you for confirmation unless you also use the -f option.
DriveLetter
The letter of the logical drive to be disconnected.
NetworkMount
The network mount point to be disconnected. This mount must have been created using the net use Windows command-line utility without specifying a drive letter.

See Also

  • mount


NFS Client node

The NFS Client node in Microsoft Services for Network File System (NFS) enables you to configure how the client will interact with the NFS resources on the network. To start or stop the Client for NFS service, right-click the Client for NFS node and select the desired action.

See Also

  • Configuring Client for NFS


Server for NFS properties - file name handling

The File Name Handling tab enables you to determine the level of file name conversion support provided by Server for NFS. UNIX clients expect the case of their file names to be preserved. Windows Server 2003 R2 does not require case sensitivity by default, yet case in file names is maintained by the NTFS file system. Server for NFS can be configured to provide case-sensitive search capabilities, as well as translation support for characters that may not be supported on client or server file systems.

Character translation mappings are stored in a text file. File names containing an unsupported character will be translated using the character mappings in the translation file.

Case sensitivity in file name searches is enabled by default in Server for NFS. The default can be overridden to return file names in uppercase or lowercase letters. Additionally, file names with a leading period (.) can be configured to automatically mark the file as hidden on NTFS to provide interoperability for local or network access from Windows clients.

Understanding the character translation file

Although Windows and UNIX file systems do not allow certain characters in file names, the characters that are prohibited by each operating system are not the same. For example, a valid UNIX file name can contain a colon (:), while a valid Windows file name cannot. If a UNIX user attempts to create a file in a NFS shared folder on a computer running Windows Server 2003 R2 with Server for NFS, the file name will then contain an illegal character and the attempt will fail.

You can eliminate this problem by enabling the use of a character translation file, as described in the previous section. Each entry in the character translation file maps a single character from UNIX to a recognized counterpart in Windows. For example, to map a colon (:) in UNIX to a dash (-) in Windows, the translation file would contain the following line:

0x00 0x3a : 0x00 0x2d ; replace client : with - on server

If this entry appears in the file name character translation file on a Server for NFS computer when an NFS client creates a file named re:salesquotas on a Server for NFS share, Server for NFS names the file re-salesquotas. This is the name that appears in Windows Explorer when local or remote Windows users display the contents of the shared folder. NFS clients that list the contents of the shared directory will see the file name as re:salesquotas. Character translation takes place for all files shared through NFS by the server, regardless of whether they were created by an NFS client.

The character translation file is a simple text file containing one or more of the mappings in the format:

0xnn 0xnn : 0xnn 0xnn [ ; comment]

Nn (nn) is the hexadecimal value of one byte of a two-byte Unicode character, and comment is an optional comment, which is preceded by a semicolon (;). Everything from the semicolon to the end of the line is ignored. The first set of hexadecimal values in the entry represents the character on the client (UNIX) computer, while the second set is the character used on the Windows-based computer running Server for NFS.

Notes

  • Do not map a period (.) to a different character because it is used in the file name syntax of both Windows and UNIX file systems.

  • To prevent unauthorized users from tampering with the file name character translation file and causing Server for NFS to fail, you can ensure that the file is protected by using a discretionary access control list (DACL) that grants Full Control to the built-in System account and the Administrators group. The DACL should contain no other entries.

See Also

  • Configuring file-name character translation


NFS sharing

Microsoft Services for Network File System (NFS) enables you to share folders on a computer running Windows Server 2003 R2 for access by UNIX clients or Windows-based computers running Client for NFS. Once you have installed and configured Microsoft Services for NFS, you will be able to share folders to NFS clients.

See Also

  • Configuring access to an NFS share for a client computer or group
  • Allowing anonymous access to an NFS share
  • Managing NFS shares


User Name Mapping component

User Name Mapping associates user names in Windows with their UNIX counterparts. This process enables users to access Network File System (NFS) resources from either the Windows or the UNIX environments. The purpose of User Name Mapping is to simplify the user experience of accessing NFS shared resources.

To configure the properties of User Name Mapping, right-click the Username Mapping Server node in the console tree, and click Properties.

See Also

  • User Maps node
  • Group maps
  • User Name Mapping properties
  • User Name Mapping properties - simple maps


NFS mount options

Client for NFS supports soft and hard mounts when attaching to Network File System (NFS) resources. Both types of mounts provide virtually the same user experience as connecting to a shared resource on a Windows server and may be used for file and application access.

See Also

  • Viewing NFS mount options and properties


Server for NFS properties

The NFS Server properties enable you to configure the general behavior of Server for NFS.

See Also

  • Configuring Server for NFS


Server for NFS node

Server for NFS provides Network File System (NFS) access to files and folders on computers running Windows Server 2003 R2 to UNIX clients and to computers using Client for NFS. Once the server is configured and folders shared through Server for NFS, UNIX clients can use the files as they would on any other NFS server.

The NFS Server node in Microsoft Services for Network File System enables you to configure Server for NFS. The settings include transports, caching, and file encoding.

See Also

  • Server for NFS properties
  • Server for NFS properties - file name handling
  • Server for NFS properties - locking
  • Server for NFS properties - logging


User Name Mapping properties - simple maps

Simple maps assume that the user and group names to be mapped are identical in both the UNIX and Windows environments. Use simple maps when you want to provide automatic mapping between identical names in the UNIX and Windows domains on a one-to-one relationship. If you require one-to-many mappings, you must use advanced mappings.

Simple maps

Setting | Description
Use Simple Maps | Select the check box to enable simple maps. User Name Mapping uses advanced maps by default.
Password and group file configuration | If you have configured password and group files for the UNIX name information, enter the name of the Windows domain that contains the user and group names to be mapped.
Network Information Service (NIS) configuration | If your User Name Mapping server obtains UNIX names through NIS, use this setting to create and manage simple maps. Click Add to create a new map. Provide the NIS domain name and the Windows domain, and then click OK.

See Also

  • Group maps
  • User Maps node


Server for NFS properties - locking

The Locking tab of NFS Server Properties determines how Server for NFS handles file-locking requests. If a Network File System (NFS) client requests a file lock, Server for NFS provides file locking on behalf of the client. If the session is interrupted before the operation is completed, Server for NFS can be configured to wait for a specified number of seconds, which enables the client to reconnect and request to reclaim the lock before clearing the lock.

The Locking tab also provides a way for you to manually clear file locks that may be outstanding.

See Also

  • Setting the lock grace periode
  • Releasing locks


NFS Client properties

The Client for NFS Properties determine how a Windows-based computer running Client for NFS will interact with a Network File System (NFS) resource. The Client Settings tab enables you to configure transport protocol, mount types, and buffer size.

See Also

  • Selecting the network protocol
  • Specifying read and write buffers
  • Configuring Client for NFS


Microsoft Services for NFS properties

User and group name mapping depends on User Name Mapping, which is a component that is included with Microsoft Services for Network File System (NFS). There should be at least one server running User Name Mapping if you choose to provide user and group name mapping. Anonymous access to NFS shares on the Microsoft Services for NFS computer will function normally without User Name Mapping.

You can use the Microsoft Services for NFS properties to define the name of the server running User Name Mapping.

See Also

  • Configuring User Name Mapping


Microsoft Services for NFS snap-in

Microsoft Services for Network File System (NFS) provides access to NFS shares for UNIX clients and Windows-based computers running Client for NFS. It is a Microsoft Management Console (MMC) snap-in that enables you to manage and configure Microsoft Services for NFS.

See Also

  • User Name Mapping component
  • Server for NFS node
  • NFS Client node


User Maps node

The User Maps node stores the logical mappings between Windows user accounts and their UNIX domain counterparts. User maps provide secure access to both Windows and UNIX resources based upon a single user logon.

User Name Mapping supports both simple and advanced mappings for users and groups. Simple mappings should be used when the user names are the same in both environments. Advanced mappings enable you to map a user name in either environment to one or more user names in the other environment. For example, the Windows user account, Administrator, could be mapped to one or more user accounts in the UNIX domain.

See Also

  • Creating an advanced user map
  • Understanding user maps


Server for NFS properties - logging

Server for NFS supports full logging of events to the Event Viewer, a text file, or both locations. Using the Audit Logging tab, you can determine the location and level of logging for Server for NFS.

See Also

  • Setting up audit logging


NFS Client properties - file permissions

The File Permissions tab of NFS Client Properties determines the default configuration of UNIX-style file permissions for any new file or folder created on a Network File System (NFS) resource. The available permissions are read (r), write (w), and execute (x) and are assigned to owner, user, and groups.

See Also

  • Specifying default UNIX permissions for new files


User Name Mapping properties

Use the Unix User Source tab of User Name Mapping Server Properties to determine the source of user and group account information. You must enter the configuration details for the source of mapping information before creating maps.

Unix User Source

Setting | Description
Use Network Information Service (NIS) | Use this setting to obtain UNIX user and group information from an NIS server.
Use password and group files | Use this setting if you prefer to obtain UNIX user and group name information from files available on the computer running Microsoft Services for Network File System.
Password file path and name | If you choose to use files for the UNIX user names, you must configure the location and name of the password file.
Group file path and name | If you choose to use files for the UNIX group names, you must configure the location and name of the group file on the local computer.
Refresh interval to synchronize user and group names with User Name Mapping | This setting determines how often the user and group name information will be synchronized from NIS, or how often the password and group files will be read.

See Also

  • Group maps
  • User Maps node


Group maps

The Group Maps node stores the logical mappings between Windows security groups and their UNIX domain counterparts. The purpose of group maps is to simplify access to both Windows and UNIX file resources.

User Name Mapping supports both simple and advanced mappings for groups. Simple mappings may be used when the group names are the same in both environments. Advanced mappings enable you to map a group name in either environment to one or more group names in the other environment. For example, the Windows group Domain Admins could be mapped to one or more security groups in the UNIX domain.

See Also

  • Mapping groups
  • Viewing group maps


NFS attributes

Network File System (NFS) objects maintain a set of permissions similar to NTFS file system permissions and applies them separately to the Owner (UID), Group (GID), and Other user accounts. The NFS Attributes tab enables you to assign default NFS permissions and ownership for an NFS shared resource. NFS attributes are applied separately for read (r), write (w), and execute (x). These attributes are then assigned to owner, user, and group access.

Note

The default attributes are equivalent to the UNIX permission set of 644.

See Also

  • Configuring NFS permissions on a file or folder
  • Client for NFS administration