Windows NT Logon Takes Very Long with Systems Management Server and intraNetware (181561)

SYMPTOMS

Logging on to a local Windows NT domain takes very long, about an hour. In a network monitor trace, you will see many calls like lsarpc: LsarLookupNames with names like administrators, administrateurs, and beheerders in the hex part of these calls.

MORE INFORMATION

The symptom above can be observed with the following configuration:

Systems Management Server Remote Control software installed on the clients
Novell intraNetWare software (which includes a third-party GINA) installed on the clients
The logon domain has +/- 15 bi-directional trusts

The default configuration of Systems Management Server Remote Control client sets up workstations in a way that allows many international administrator groups access to the Systems Management Server Remote Control clients. Examples of international administrator groups are administrators (English), beheerders (Dutch), and administrateurs (French). The complete list contains about 10 different groups and LsarLookupNames is called for each group separately to determine the corresponding security descriptor. If the group name is not found locally, all trusts are queried to find a specific group.

If Microsoft Client Services for NetWare (CSNW) is used for NetWare Connectivity, the problem does not occur.

RESOLUTION

One of the following workarounds can be used if Systems Management Server Remote Control Software and Novell Connectivity are needed:

Use Microsoft CSNW.
Change Systems Management Server Remote Control client configuration to allow only specific international administrator groups access to the Systems Management Server Remote Control clients.
Do not use a high number of trusts in the logon domain of the Systems Management Server Remote Control clients.

The third party products discussed here are manufactured by a vendor independent of Microsoft; we make no warranty, implied or otherwise, regarding these products' performance or reliability.