0

Environment:

  • A SOHO network under an Active Directory domain controller on a Windows Server 2012 R2.
  • A NAS with access authorization via Kerberos on the domain controller.
  • The DNS server is on the domain controller.
  • Due to hardware problems, I replaced the NAS with a new one, which was a new model of the same manufacturer, BUFFALO.

The new NAS:

  • The IP address: 192.168.120.4 (static DHCP assignment)
  • DNS name: "sunny"
  • The name in the NAS configuration: "sunny"

The old NAS:

  • still on the network
  • The IP address: 192.168.120.4 (static DHCP assignment) --> 192.168.120.*** (DHCP dynamic allocation)
  • DNS name: "sunny" --> "sunshine"
  • The name in the NAS configuration: "sunny" --> "sunshine"

Problems:

After replacing, I can reach the NAS correctly but cannot open any folders which require access authorization via Kerberos. For the folders without access authorization, I can open them. The error message is "Permission denied". I tried to find out any relating log massage on the domain controller but could not. I deleted key caches on client computers by the command "klist purge" on the PowerShell.

Clues:

  • The new NAS does not appear in the section "Active Directory Users and computers > computers" on the domain controller although the old NAS was there.
  • I deleted the old entry "sunny" in the above section and expected two new entries were created automatically, namely "sunny" and "sunshine" for the new and the old NAS, respectively, but they didn't appear at all after a while.
  • I manually added two entries "sunny" and "sunshine" in the section, but they didn't resolve the problem.

Do you know any idea what's wrong in my network and Kerberos authorization?

Taiki Bessho
  • 159
  • 1
  • 1
  • 8

1 Answers1

0

I asked the support center of BUFFALO and got an answer to resolve this problem.

The procedure is as follows:

  1. In the NAS config, change the NAS to a WORKGROUP member once.
  2. Change the NAS's name to an arbitrary one as you like.
  3. Shutdown and Boot the NAS
  4. Make the NAS participate in the AD domain again.
  5. The domain controller recognizes the NAS as a new name and Kerberos authorization goes well with the new name.

The point of this solution is when the domain controller recognizes the name of the NAS and it is only when the NAS participates in the AD domain.

I hope this post helps someone someday.

Taiki Bessho
  • 159
  • 1
  • 1
  • 8