Novell Client Install

This article will tell you how you can create a custom Novell client setup, and will tell you how you can adjust the environment to support that new setup. This is including:

• Contextless login
• Using DHCP to get the tree and server information
• Using the Novell Client Installation Manager to create the final custom install
• Rollout

At the end of the article there will be some extra remarks about the use of a dynamic local user, SLP settings and extra login information you might find useful to fully understand the login process.
All these steps are tested on netware 6.5.5, eDirectory 8.7.3.7 and the Novell client 4.91.4.

Is to get the latest Novell client software from the Novell website: http://download.novell.com/ . Extract the software and install it. Don't delete the extracted files, you'll need them later on.

Novell documentation: http://www.novell.com/documentation/noclienu/noclienu/index.html?page=/documentation/noclienu/noclienu/data/ahpxzr7.html

In order to be able to login contextless you need to be able to search the tree for your user account. Although this can be accomplished by using the [PUBLIC] object this has the disadvantage that the rights flow through to all users. It's better to use a proxy account which can be used in the same way but without the mentioned disadvantage. An anonymous proxy user gives you a few extra key features:

• All LDAP client access through anonymous binds is assigned through the proxy user object.
• The proxy user must have a null password and must not have any password restrictions (such as password change intervals). Do not force the password to expire or allow the proxy user to change passwords.
• You can limit the locations that the proxy user can log in from by setting address restrictions for the proxy user object.
• The proxy user object must be created in eDirectory and assigned rights to the eDirectory objects you want to publish. The default user rights provide read access to a limited set of objects and attributes. Assign the proxy user read and search rights to all objects and attributes in each subtree where access is needed.
• The proxy user object must be enabled on the general page of the LDAP group object that configures LDAP services for eDirectory. Because of this, there is only one proxy user object for all servers in an LDAP group.
• You can grant a proxy user object rights to 'All Properties (default)' or 'Selected Properties'. In order for contextless login or treeless login to work, the read right must be granted so that LDAP can search the container or tree for the User object. Typically, you assign the proxy user rights to the [ROOT] of the tree so that LDAP can view the attributes of the user objects throughout the tree. However, you might want to restrict access by assigning the read right only to individual organizational units that you want LDAP to search.

So, these steps include:

1. Create a proxy user
2. Assign rights to [ROOT] for that proxy user
3. Setup the LDAP group object

Don't forget to assign an empty (null) password:
Setup your password policy for the proxy user like this:

Assign the correct rights for the proxy user:

Modify the LDAP Group to use the ldap proxy user:

In the steps to come you'll have to tell the Novell client to use a LDAP server to perform your contextless login. To prepare for future server replacements we won't do that on IP address but with a nice DNS name. We won't go into detail about how to create a DNS record, you should know that and it depends on your DNS server.
You need two records if possible, in that case the novell client will continue with the second server if the first one is not available. Name your records like:

contextless1.domain.local
contextless2.domain.local

You could use both A records or CNAME records to do the job. CNAME should have your preference.

Setup the Novell client to use LDAP contextless login by going to the properties of your installed Novell client (right click on the red N on your taskbar and select 'Novell Client Properties'). Go to the 'LDAP Contextless Login' tab:
Check 'Enable LDAP Contextless Login' and 'Enable LDAP Context Search Scope' and add a tree:
You'll immediately receive a new screen to define your search scope. Notice that you'll need LDAP syntax:
Then add a server. I only have one:
And you'll immediately receive a new screen regarding the properties of the server. In most environments the defaults will do just fine:
Finally you'll have to set the LDAP search settings. ONe you'll like is to allow wildcards, but the display and search options will vary in every environment and you'll have to edit them to your own needs:

Because we're doing a contextless login and not a treeless login it would be nice if we wouldn't have to fill in the tree name. DHCP has some options to do that for you. You have to add option 85 and 86 to your dhcp options:
Depending on your version of netware and DHCP the server only reads the necessary information from eDirectory on startup. To be sure stop and start the DHCP service:

• unload dhcpsrvr
• load dhcpsrvr

The option

• load dhcpsrvr -d1

turns on a background screen log of DHCP packets.

Setup the Novell client to use these settings by going to the properties of your installed Novell client (right click on the red N on your taskbar and select 'Novell Client Properties'). Go to the 'DHCP Settings' tab and check these items:
[img[Novell Client DHCP Settings| blogs/NovellClientInstall/DHCPSettings.jpg]]
The binary data check tells the client that the server info delivered is an IP address. This will prevent some errors (http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=10088647&sliceId=&docTypeID=DT_TID_1_1&dialogID=59769603&stateId=0%200%2059771633 ).

After you have downloaded (http://download.novell.com/ ) and installed the Novell Client and setup the previous settings it's finally time to create an unattend file to automate the setup on other workstations. To do so return to the extracted software you created in step one. Go to the admin folder and doubleclick the 'nciman.exe' utility:
To import the settings you created during the previous steps click the 'Import Registry' button. After that you can further enhance your installation. My recommendation would be to adjust at least these settings:

• Installation Setup
  • Don't Display initial screen
  • Accept license agreement
  • Don't Create Windows System Restore Point
  • Protocol IP only and remove IPX if present
  • Install the NDPS Component
• Client
  • Location Profiles → Default → Properties → Properties
    • Adjust here which tabs should be shown and their default values

Of course there's more to adjust but that depends on your own preferences and your environment.
There is one more setting you can look into, the acu version. In case you change something in the settings of the Novell client but not in the software itself, you could change the acu version so the new settings get distributed as well:

[Novell_Client_Install_Manager]
Novell_Client=2000/XP
Version=4.91.4
[NovellNetWareClientParameters]
!Protocol=IPNOCM
!RemoveIPXIfPresent=YES
!DoInstall=YES
!First_Network_Drive=G
!First_Network_Drive_Distribute=Always
!Tree_List1=
!Tree_List_Distribute=Replace
!Default_Context_List1=
!Default_Context_List_Distribute=Replace
!Show_Location_List=NO
!Show_Location_List_Distribute=Always
!Preferred_Network_Protocol=IP
!Preferred_Network_Protocol_Distribute=Always
!LDAP_Contextless_Login_Tree_List_1=N-TREE
!LDAP_Contextless_Login_Tree_List__Distribute=Replace
!LDAP_Contextless_Login_Server_List_1=contextless1.n-team.local
!LDAP_Contextless_Login_Server_List__Distribute=Replace
!LDAP_Contextless_Login_Context_List_0_1=o=N-TEAM
!LDAP_Contextless_Login_Context_List_0__Distribute=Replace
!LDAP_Contextless_Login_Enabled=YES
!LDAP_Contextless_Login_Enabled_Distribute=Always
!LDAP_Contextless_Login_Context_Search_Scope_Enabled=YES
!LDAP_Contextless_Login_Context_Search_Scope_Enabled_Distribute=Always
!LDAP_Contextless_Login_Wildcard_Search_Allowed=ON
!LDAP_Contextless_Login_Wildcard_Search_Allowed_Distribute=Always
!LDAP_Contextless_Login_Search_Timeout_Temp=5
!LDAP_Contextless_Login_Search_Timeout_Temp_Distribute=Always
!LDAP_Contextless_Login_Connection_Timeout_Temp=10
!LDAP_Contextless_Login_Connection_Timeout_Temp_Distribute=Always
!IP_NDS=ON
!IP_HOSTFILE=ON
!IP_DNS=ON
!IP_SLP=ON
!IP_Naming_Distribute=Always
!Enable_Scheduler_Icon=OFF
!Enable_Scheduler_Icon_Distribute=Always
!ServiceInstances_Distribute=Always
!AcceptLicenseAgreement=YES
!DHCP_Server=YES
!DHCP_Server_Distribute=Always
!Server_RegLocation="Default"
!Server_RegLocation_Distribute=Always
!DHCP_TREE=YES
!DHCP_TREE_Distribute=Always
!Tree_RegLocation="Default"
!Tree_RegLocation_Distribute=Always
!DHCP_Server_BinaryData=YES
!DHCP_Server_BinaryData_Distribute=Always
[NDPSParameters]
!DoInstall=YES
!IsOptional=NO
[NovellNetwareLocationProfiles]
!Profile_List1=Default
!Profile_List_Distribute=Replace
!ProfilesListSZ0="Default","Default"
!ProfilesCount=1
!LoginServiceDWOn0="Default","Save On Exit"
!LoginServiceSZ0="Default","Tab","Credentials"
!LoginServiceDWOn1="Default","Password Enable"
!LoginServiceSZ1="Default\Tab1","Tab","NDS"
!LoginServiceDWOff0="Default\Tab1","Clear Connections"
!LoginServiceSZ2="Default\Tab2","Tab","Script"
!LoginServiceDWOn2="Default\Tab2","Login Script"
!LoginServiceDWOff1="Default\Tab2","Display Results"
!LoginServiceDWOn3="Default\Tab2","Close Results"
!LoginServiceSZ3="Default\Tab3","Tab","NT Credentials"
!LoginServiceCount=4,4,2
[]
_Distribute=Never
[Network_2000]
Install2000Services=Services2000List
[Services2000List]
NW_NWFS=NovellNetwareClientParameters, \$OEM$\NET\NTCLIENT\I386
NW_NDPS=NDPSParameters, \$OEM$\NET\NTCLIENT\I386
[SetupNWInstallOptions]
!DisplayInitialScreen=NO
!Create_System_Restore_Point=NO

You can rollout the custom install by editing the acu.ini file and then starting the acu.exe.
Acu.ini, adjust the first three settings:

; Novell ACU for Windows 2000/XP File
; Novell ACU INI File
;
;VeRsIoN=v2.7 Novell ACU - Configuration INI
;CoPyRiGhT=copyright 1999-2006,  by Novell, Inc. All rights reserved.


[LaunchInstall]
;
; Launch=Yes
; Specifies whether Setup is launched after acu.exe
; determines that the installation is necessary.
;
Launch=Yes


[DisplayDialog]
;
; Display=Yes
; Specifies whether users are prompted to begin the upgrade.
;
Display=No


[UnattendFile]
;
; Specifies whether a configuration (unattend) file is used
; and where it is located.
;
Use=Yes
File=unattend.txt

<<<cut>>>

• Novell Client Documentation: http://www.novell.com/documentation/noclienu/index.html
• An other service which could be useful to adjust your login expercience - and your entire login experience - is SLP. SLP is too big to be included in this article, that's why I wrote a article specifically about it: SLP eDirectory
• If you login on a windows workstation using the Novell client you are only logged into eDirectory. Not into the workstation itself. That's why you get a second login window, to login into windows. To prevent that from happening (the double login, that is) you could enable dynamic local user services. That is a ZENworks feature and is covered in this article: Dynamic Local User