Excellent. This is now working according to Laura's/????? ????? settings.
Thanks to everyone. I've learnt a lot from this single issue.
One last question, with the whenever possible option. According to ?????
?????, the DCs will now communicate insecurely with my printer, but does
this mean it would communicate insecurely with some 'unknown' machine too.
What I'm trying to work out, I guess, is how does it 'decide' when it should
communicate insecurely--what test does it carry out? Is it treating the
scanner as a member server or a client?
As the whole worry here is MITM's --are there ones which could be utilized
now that I have set the network server to digitally sign always but the
clients and the members to do it whenever possible?
I'm thinking the risk is greatly reduced but is it removed 'completely'?
Murad
-----Original Message-----
From: ?????? ?????? [mailto:morsin@eastbridge.tula.ru]
Sent: Wednesday, May 04, 2005 10:52 PM
To: Murad Talukdar
Subject: Re: To disable SMB packet and secure channel signing enforcement on
Windows Server 2003-based domain controllers
----- Original Message -----
1. From Administrative Tools open Domain Controller Security Policy 2.
Smile
3. Select \Security Settings\Local Policies\Security Options folder. 4. In
the details pane, double-click Microsoft network server: Digitally sign
communications (always), and then click Disabled to prevent SMB packet
signing from being required. 5. Click OK. 6. In the details pane,
double-click Domain member: Digitally encrypt or sign secure channel data
(always), and then click Disabled to prevent secure channel signing from
being required. 7. Click OK.
1. Return back to "Enabled" secure channel ecnryption requirement. SMB file
sharing has nothing to do woth it. Secure Channel is used by domain member
computers to pass user authentication information to DCs.
2. There are companion settings "Digitally sign communications (always)" and
"Digitally sign communications (when possible)" for both servers and
workstations. Set first to "Disabled" and second to "Enabled" and your DCs
will communicate securely with users and insecurely with your printer.
---------------------------------------------------------------------------
---------------------------------------------------------------------------
