TestStand remote security IDs

[pwaszkewitz]

I have 2 Windows XP SP2 machines (with multilanguage user interface) in an isolated network, no domain server or anything. I have identical users with administrative rights on both machines and, as far as I can see, have configured Remote Execution and DCOM "by the book".

Trying to call a sequence remotely from one of the machines to the other I get the following error message on the remote machine: "No mapping between account names and security IDs was done". There is a lot of information about this error, but nothing conclusive. Is there any idea how to resolve this?

Peter

[Dippi]

Hi Peter,

I googled through the internet and found a possible solution for your problem on the microsoft homepage.

English:
http://support.microsoft.com/?scid=kb%3Ben-us%3B890737&x=18&y=10

German:
http://support.microsoft.com/kb/890737

Please check this.

Best regards
Dippi

[pwaszkewitz]

Hi Dippi,

thank you very much. Just a few minutes ago, we found a solution. It does have to do with the link you send, we didn't need the (inofficial) hotfix, though.

It turned out that in Windows XP SP2 there are two new entries in "Control Panel > Administrative Tools > Local Security Policy" in the "Local Policies > Security Options" branch concerning DCOM. Their standard setting is "Not defined" which apparently prevents most DCOM access.

We set the "DCOM Machine Access Restrictions" entry to allow Local and Remote access for "Anonymous" and set the "DCOM Machine Launch Restrictions" entry to allow Local and Remote Launch and Activation for "Anonymous". This solved our problem. We have the default COM Security access permission set for "Anonymous".

We have not yet explored all the interactions between the various DCOM settings in the operating system and TestStand, however. When we have a reliable procedure how to set these, is there someone we can report it to so that TestStand documentation can be revised if necessary?

Thanks again

Peter

[Dippi]

Hi Peter,

I'm glad to hear that you solved the problem.
You can send an eMail to NI, if you have a reliable procedure how to set these.

info.germany@ni.com

Please refer to the post in the discussion forum, so that the Applications Engineer knows about this issue.


Best regards
Dippi

[tempe]

Any updates on this procedure? Thanks a lot regards

[pwaszkewitz]

Well, not quite. We did not have the problem anymore and I am not quite sure why.

But I can say that we now always configure DCOM in the same way and that works fine for XP and Windows 7. It is practically identical to the hint by Eric Crank in the forum at http://forums.ni.com/t5/NI-TestStand/Sharing-a-string-by-a-queue-from-Execution-to-execution-on/m-p/... with a single addition by us. I quote the entire procedure here for convenience:

beginquote

Setting up DCOM can be difficult and frustrating. Make sure you kill the TSAutoMgr.exe process after changing settings. Here are my recommendations for configuring computers to share synchronization objects.

1. Windows Firewall Settings. You must either disable the firewall on both computers or add the following exceptions:
   • On the computer that created the queue: Add a Program exception for the TSAutoMgr.exe application.
   • On the computers that use the queue remotely: Add a Program exception for the user interface application you are using (e.g. SeqEdit.exe)
   • On all computers add a Port exception for DCOM (TCP Port 135).
2. DCOM Settings. On the computer that creates the queue use dcomcnfg to make the following settings.
   • Computer-wide settings: On the COM Security tab of My Computer, use Edit Limits buttons to grant Remote Launch, Remote Activation and Remote Access permissions to ANONYMOUS LOGON
   • Application setting: On the Security tab of the NI TestStand AutoMgr item, grant Remote Launch, Remote Activation and Remote Access permissions to ANONYMOUS LOGON
   • Application setting: On the General tab of NI TestStand AutoMgr item, set the Authentication Level to None.
   • Same holds for the NI TestStand Remote Engine item.
3. Disable COM authentication on your application. If your application on the computer that accesses the remote queue is not called SeqEdit.exe or TestExec.exe, you need this extra step. Add a registry setting that will disable COM authentication for your application (where APPLICATION.EXE is the name of your application, not a path):
   [HKEY_CLASSES_ROOT\AppID\APPLICATION.EXE]

           "AppID"="{C31FD07F-DEAC-4962-9BBF-092F0F3BFF3C}"

   endquote

4. And an additional find by Thomas Seiffert: Simple network sharing must not be activated. (Windows Explorer setting, in XP under "Tools > Folder Options", View tab, is called "Use simple file sharing (recommended)"; in Windows 7 under "Organize > Folder and Search Options", View tab, there it is called "Use Sharing Wizard")