Shared Win98 Printing in 2003 Mixed Domain

[Wes Stewart]

I recently added two W2K3 Domain Controllers to my NT4 domain, thus I
am running in Mixed Mode with the 2 W2K3 DC's and 3 NT4 BDC's. I have
several Windows 98SE clients that have shared printers. After the
upgrade when users are trying to print to the shared W98 printers they
are getting a request for an IPC$ password. I can disable and enable
the sharing and users can sometimes print for up to three hours and
then they are prompted for the password again.

All clients are required to login to the domain, and they can access
all of their mapped drives with no problems. Network browsing is
sporadic.

I have installed the W98 AD Client on both the system sharing the
printer and the pc trying to connect to the printer.

From the W2K3 DC's I cannot connect the the shared printer, getting
the IPC$ password prompt as well.

WINS is setup & running on a third non-DC W2K3 server and the W98 PC's
are showing up in the Active Registrations.

I have now spent over 20 hours trying to figure this problem out, can
anyone help?

Wes Stewart
IT Director
Cruise America

 

[Steven Umbach]

I don't have any experience with a setup like yours, but from what I know there
are a lot of security settings - particularly security options in security
policy that can cause issues with downlevel clients. In particular would be
network access:do not allow anonymous access to sam and sam and shares, network
security:lan manager authentication level, and the four digitally sign
communication options.

In Domain Controller Security Policy try setting network access: do not allow
anonymous access to sam and sam and shares to disabled, network security:lan
manager authentication level to send ntlmv2 responses only, and for the four
digitally sign communications options make sure the two "always" are disabled
and the two "whenever possible" are disabled until the problem is resolved. Also
make sure that the W2003 servers are also wins clients. The other thing I would
try on the W98 machines that you have installed AD client on is to modify the
registry for their lan manager authentication level to the "3" level and enable
them for smb signing [digitally sign communications]. The links below may be of
help. -- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;555038
http://support.microsoft.com/default.aspx?scid=kb;en-us;239869
http://support.microsoft.com/default.aspx?scid=kb;en-us;823659