Copyright: Copyright (c) 1994 Nick Payne


Introduction

For information on the main window controls, click on the relevant area of the graphic below.

 WSetPass is a program for maintaining passwords across multiple Netware file servers.
The main window displays a list of all known file servers. To change a password on a single server, double-click on the server name. To change a password on multiple servers, select the servers, then either click on the Change Password button or press the Enter key. You then fill in the userid and password details in a dialog box. WSetPass then attempts to change the password for that userid on the selected server(s).
There is no limit on the number of servers on which you can change a password, as WSetPass will log in to each server, make the change, and then log out from the server before attempting to log in to the next server.
You can access this help file by either pressing F1, by selecting Help from the Control Menu, or by clicking any Help button.

See also

Modes of operation

Userid and Password Dialog

User Manager Dialog

Netware Error Codes

Convenience versus Security

Intruder Detection Lockout

Notes and Restrictions

Registration Information


Modes of operation

WSetPass operates in one of four modes. These modes are selected from the system menu (the little box with the minus sign in the top left of the program window), and are:

1	Administrator. The user is assumed to be a supervisor or workgroup manager, and all servers on the network appear in the WSetPass list box regardless of the INI file settings.

2	Manager. The user is assumed to be a supervisor or workgroup manager, but if there are settings in the INI file restricting the servers to be displayed, then only those servers will be shown in the list box.

3	User. The user is assumed to be an ordinary user with no supervisor or workgroup manager privileges, and if there are settings in the INI file restricting the servers to be displayed, then only those servers will be shown in the list box.

4	Admin User. The user is assumed to be an ordinary user with no supervisor or workgroup manager privileges, but all servers on the network appear in the WSetPass list box regardless of the INI file settings.

Notes

Your LAN administrator may have configured WSetPass so that you can only use it as an ordinary user. If this has been done, you will not be able to change modes and will not see the menu items discussed above.

In Administrator or Manager mode, you specify a manager userid and password and the id and new password for the userid you wish to manage. WSetPass will attempt to log you on to each selected server as the manager and change the password for the managed user. The manager userid must be either a Supervisor equivalent or a Workgroup Manager for the user.

In User or Admin User mode, you specify the userid, existing password, and new password. WSetPass will attempt to log you on to each selected server as the user and change the password for that user.

The mode in which you operate will be remembered across sessions. When you start WSetPass, it will start up in the mode you were last using.

See also

Introduction

Userid and Password Dialog

User Manager Dialog

Netware Error Codes

Convenience versus Security

Intruder Detection Lockout

Notes and Restrictions

Registration Information


File Server Listbox

This is a multiple-select listbox, containing all the known file servers on your network. A file server which is down at the time the program runs will not appear.

To change a password on a single server, double-click on the server name.

For multiple servers, select all the servers on which you want to change the password for a userid, and then either click on the Change Password button or press the Enter key. If you are unfamiliar with the techniques for making multiple selections in a list box, see pp. 36–37 of the Windows 3.1 User's Guide, or consult a third party Windows guide.


Change Password Button

Click on this button once you have selected your servers, to specify the userid and old and new passwords. Pressing the Enter key is the equivalent of clicking on this button.


Userid and Password Dialog

This is the dialog box used when you are operating in user mode, logging on to each server as the user whose password is to be changed.

For information on any of the dialog controls, click on the relevant area of the graphic below.

See also

Introduction

Modes of operation

User Manager Dialog

Netware Error Codes

Convenience versus Security

Intruder Detection Lockout

Notes and Restrictions

Registration Information


User Manager Dialog

This is the dialog box used when you are operating in manager mode, logging on to each server as either Supervisor or as a Workgroup Manager for the user whose password is to be changed.

For information on any of the dialog controls, click on the relevant area of the graphic below.

See also

Introduction

Modes of operation

Userid and Password Dialog

Netware Error Codes

Convenience versus Security

Intruder Detection Lockout

Notes and Restrictions

Registration Information


Manager's Userid

Enter the id of the manager for the userid whose password you want to change. This id must either be Supervisor or equivalent or be a Workgroup Manager for the user whose password is being changed.

This manager must have the same password on every server where you want to change the user's password.


Manager's Password

This is the password for the manager on the file servers on which you wish to change the password for the user. What you type in this field does not appear on the screen.


Userid

Enter the userid whose password you want to change. This userid must have the same password on every server where you want to change it.


Old Password

This is the existing password for the userid. What you type in this field does not appear on the screen.


New Password

This is the new value for the user's password. What you type in this field does not appear on the screen. You must enter this value twice, to guard against typing mistakes. It will not be accepted unless both new password entries are identical. The comparison is not case-sensitive


Pause after each password change

WSetPass informs you of the progress (logging in, logging out, etc.) as it is changing passwords. If all your file servers are on a local LAN, and not being accessed across a WAN, this can happen so quickly that you cannot see what is happening. If you check this box, the program will pause after it has changed the password on each server, with a message box informing you that the password has been changed.

Regardless of the setting of this checkbox, WSetPass will pause with a message box if it encounters any errors while changing a password.


Verify full user name

Select this if you want to verify the full name for the userid whose password you are changing before making the change.


Netware error codes

The following listings give text descriptions of the error codes that may be returned by the various Netware functions that WSetPass calls. If WSetPass returns a message box of the form "NW<function> failed: error NxNNNN", you can search on the error code in the help file to find the text description of the error (enter the error code in the search dialog without the leading '0x'). Some error codes can have different meanings depending on the function that was being called. If there is more than one entry for a particular error code, look at the name of the function to see what it does, and look at the descriptions of the errors with that code to determine the actual error.

For instance, the error 0x89FF can mean either "No response from server" or "No such object or bad password". If you got this error from the function NWAttachToFileServer, it obviously means "No response from server". If you got this error from NWChangeObjectPassword then the second meaning is the correct interpretation.

Network errors

Error Code	Description

0x8800	Already attempted to server with valid existing connection.

0x8801	Request attempted with invalid or non-attached connection handle.

0x8805	Attempt to receive from the selected transport failed.

0x8806	Network send attempted with a non-specific network error.

0x8807	Server request attempted with invalid server connection slot.

0x8808	Attach attempted to server with no connection slots available.

0x8809	Attempt to send on the selected transport failed.

0x880A	Attempted to find route to server where no route exists.

0x880C	Attempted request with too many request fragments specified.

0x880D	Too many connections to fit in the list size specified.

0x880E	Attempt to receive more data than the reply buffer had room for.

0x880F	Attempt to get connection for a server not connected.

0x8811	Attempted function call to non-existent or illegal function.

0x8830	Internal server request attempted across different server connections.

0x8831	Attempt to retrieve default connection with no primary connection set.

0x8834	No user name.

0x8836	Attempted function with an invalid function parameter specified.

0x883C	Attempted request made with a parameter using foreign resource.

0x883F	Attempted to allocate a connection handle with no more local connection table entries.

0x8841	Attempted function on a connection with an invalid transport selected.

0x8846	Attempted request made to partially asynchronous function in busy state.

0x8847	Attempted connect failed to find any servers responding.

0x8848	Attempted function call to non-existent or not-loaded overlay.

0x884F	Attempted re-use of already in use connection entry.

0x8850	Attempted request with too many reply fragments specified.

0x8851	Attempted to add a name into the name table after it was full.

0x8853	Attempted enhanced memory operation failed.

0x8854	An SFT3 switch occurred mid-transfer.

0x8855	The preferred directory server was not established but another directory server was returned.

0x8856	Determine if the device is not used by VLM; pass it on to the next redirector, if any.

0x8857	The network type (Bindery or Directory Services) does not match the server version.

0x8858	Generic open failure error, invalid path, access denied, etc.

0x8859	No preferred name specified.

0x88FF	Shell or VLM failure. Either an unknown error, or the shell or VLM is not present.

Server errors

Error Code	Description

0X8900	Unknown error.

0x8979	No items found.

0x897A	Connection is already temporary.

0x897B	Already logged in.

0x897C	Connection not authenticated.

0x897D	Connection not logged in.

0x8996	Attempt to write to a file server which does not currently have enough dynamic memory to process this request.

0x899D	No more directory handles available; the directory handle table is full. Each user may have up to 255 directory handles.

0x89A2	Attempt to read a file where data is physically locked.

0x89A3	Transaction restarted.

0x89C0	No accounting privileges.

0x89C1	Attempt to log in by a bindery object with an accounting balance, and accounting is enabled.

0x89C2	Attempt to log in to account with no credit available.

0x89C3	Too many holds.

0x89C4	Accounting disabled.

0x89C5	Attempt to log in after the system had locked the account because of intruder detection.

0x89D7	Attempt to change password to a previously used password when the unique requirement is specified for the account.

0x89D8	Attempt to change password to a password with fewer characters than the required minimum specified for the account.

0x89D9	Attempt to log in using an account which has limits on the number of concurrent connections and that number has been reached.

0x89DA	Unauthorized login time.

0x89DB	Attempt to log in from an unauthorized station using an account with limits to a specific network and / or station.

0x89DC	Attempt to log in using an account which has expired or has been disabled by the Supervisor.

0x89DE	Attempt to log in using an account password which has expired and all grace logins have also expired.

0x89DF	Attempt to log in using an expired account password but the login was allowed because the account had a grace login.

0x89E7	No more users.

0x89E8	Attempt to use an item not associated with this property group or an item which has been deleted from this group.

0x89E8	Attempt to write a data segment to a group property using the call to write a property value.

0x89E9	Attempt to redundantly add an object to a group property.

0x89EA	No such member.

0x89EB	Attempt to use a non-group property.

0x89EC	Attempt to use a non-existing segment. Note that segments must be written sequentially when a property is first created, but may be read and written in any order after they already exist.

0x89ED	Property already exists.

0x89EE	Object already exists.

0x89EF	Request made with an object or property name containing illegal characters. Illegal characters in names are control characters, the comma, colon, semicolon, slash, backslash, question mark, asterisk, and tilde.

0x89F0	Attempt to use a wildcard character or wild object type in a call where wildcards are not allowed.

0x89F1	Attempt to assign a security level of a bindery object or property to be higher than the user's security level. This would make the object or property inaccessible to the user.

0x89F2	Attempt to access object information or scan the object's properties by a station without the necessary security to access this information.

0x89F3	Attempt to rename an object without the necessary security. Only the Supervisor can rename objects. Note that if the station does not have the proper security to see that the object exists, then NCP_NO_SUCH_OBJECT is returned.

0x89F4	Attempt to delete an object by a station without the necessary security to delete the object. Only the Supervisor can delete objects. Note that if the station does not have the proper security to see that the object exists, then NCP_NO_SUCH_OBJECT is returned.

0x89F5	Attempt to create an object by a station without the necessary security to create the object. Only the Supervisor can create objects.

0x89F6	Attempt to delete a property by a station without the necessary security to delete the property. Only the Supervisor can delete objects. Note that if the station does not have the proper security to see that the property exists, then NCP_NO_SUCH_PROPERTY is returned.

0x89F7	Attempt to create an property by a station without the necessary security to create or change a property for the object.

0x89F8	Attempt to write by a station without the necessary write security to change the property data.

0x89F9	No free connection slots.

0x89F9	Attempt to read by a station without the necessary read security to access the property data.

0x89FA	No more server slots.

0x89FB	No such property.

0x89FC	Attempt to attach to a server using an invalid server name.

0x89FC	Attempt to use an object which doesn't exist, or the calling station doesn't have the proper security to access the object. Note that the object name and type must both match for the object to be found.

0x89FD	Attempt to use a bad (undefined, unavailable, etc.) station number.

0x89FD	The requesting packet did not have a 30 byte packet header as the first fragment, or its total length exceeded 576 characters.

0x89FE	Attempt to use a bindery which is temporarily locked by the Supervisor.

0x89FE	Attempt to log in when the Supervisor has disabled logins from the console or the bindery was locked.

0x89FE	Failure caused by the time-out limit expiring before the request was fulfilled.

0x89FF	No response from server.

0x89FF	Attempt to use an unfound object, or attempt to use a bad (undefined, unavailable, etc.) password. On a login call, this indicates the password was correct, but it has expired and all grace logins have been used up. On a change password call, it indicates that the old password given was correct, but the account is not allowed to change the password.


Convenience versus Security

By default, when run in Manager mode, WSetPass will save the manager's userid at the end of each program execution and retrieve it the next time it is started. If you are willing to compromise security for convenience, you can tell WSetPass to also save the manager's password in the WSETPASS.INI file (in encrypted form). To activate this feature, add the following entry to the [WSetPass] section of the WSETPASS.INI file.

SavePassword=1

Each site should evaluate their security requirements to decide if this is acceptable. Even though WSetPass encrypts the saved password in the INI file, you may still feel that the convenience of not having to type in a password is outweighed by the security considerations.

Security risks of saving the password

Although the password is encrypted, if:

(a)	someone gets hold of a copy of the INI file containing the encrypted password, and

(b)	has access to a copy of WSetPass

then although they cannot recover the plaintext password (which is still hidden) by starting the program, they will, by starting WSetPass using the INI file, have the same rights to change passwords as the valid user of the file.

This means they could change the password for another user (possibly SUPERVISOR or equivalent) and thereby be able to log in as that user.

See also

Introduction

Modes of operation

Userid and Password Dialog

User Manager Dialog

Netware Error Codes

Intruder Detection Lockout

Notes and Restrictions

Registration Information


Intruder Detection Lockout

If intruder lockout is enabled on the server, and a user exceeds the allowed number of incorrect login attempts, their account will be locked. When you reset a user's password, WSetPass checks the intruder lockout and clears it if it is set.

You will be informed by a message box if it was necessary to reset intruder lockout.

See also

Introduction

Modes of operation

Userid and Password Dialog

User Manager Dialog

Netware Error Codes

Convenience versus Security

Notes and Restrictions

Registration Information


Notes and Restrictions

Running Windows in standard mode

The Netware support for Windows does not appear to support all calls correctly when running Windows in standard mode. If WSetPass is reporting what seem to be invalid errors on Netware calls (i.e. they shouldn't be happening) and you are running Windows in standard mode, try switching to enhanced mode to see if the errors disappear.

If you already have a connection to a server

If you already have a connection to a server for which you wish to change a user's password, WSetPass will query you whether wish to login as the new user. If you do, you will be logged in as the new user and any existing rights and drive mappings will be lost.

Your primary connection

You cannot change a password on your primary server (the server from which your login script was executed when you logged in) unless the userid you select (in user mode) or the manager's id you select (in manager mode) is the id under which you are already logged in.

Maximum number of connections

WSetPass will fail if you are already attached to the maximum number of servers before you run it. The Netware shell limits you to eight concurrent connections; the VLM requester is configurable to a maximum of 50 connections.

Netware 4 and NDS connections

WSetPass is not an NDS aware application. However, you, as a manager, can use it to change the NDS password for a user provided that:

•	you are logged in as an NDS user

•	you are in the context where the user whose password you are changing is defined

•	the server is running bindery emulation

If you are trying, as a user, to change your own password, WSetPass will not change the password on a server to which you already have an NDS connection. With Netware Directory Services, each userid only has a single password across all servers to which it has rights, so it does not make sense to talk about synchronizing passwords.

User identification

When you are logged in as an NDS user, this version of WSetPass cannot retrieve the full user identification when using the NDS bindery emulation. It appears that the emulation does not support the conversion of the user's NDS details to the bindery equivalent. If the user also exists in the bindery on the same server, you will get the bindery identification for the user, even though you are logged in to NDS.

See also

Introduction

Modes of operation

Userid and Password Dialog

User Manager Dialog

Netware Error Codes

Convenience versus Security

Registration Information


Registration Information

This program is marketed as shareware. You are granted a 30 day trial period, after which you are required to register the product. The cost of a single user license is USD $35. This entitles you to run the program from one workstation and change passwords on any server. If you want to run the program from more than one workstation simultaneously, you can either:

•	purchase additional workstation licenses at USD $35

•	purchase a server license for USD $150, allowing you to run WSetPass on any workstation attached to that server

•	purchase a site license for USD $500, allowing you to use WSetPass on any workstation in your organisation

To register the program, either:

on CompuServe, GO SWREG at any ! prompt and:

quote number 1870 for a workstation license

quote number 2076 for a server license

quote number 2077 for a site license

or print out the registration form included here and post to:

Nick Payne
P.O. Box 4384
Kingston ACT 2604
Australia

Click here for registration form

Registered users will be sent a registration number to disable the reminder box, and will be informed of any upgrades that may become available.

I would be pleased to receive any comments, bug reports or suggestions for future releases. I may be contacted by E-Mail at:

CompuServe: 100033,432

or by post at:

PO Box 4384
Kingston ACT 2604
AUSTRALIA

See also

Shareware registration form

Entering your registration information


Shareware registration form

Select File / Print Topic from the menu bar to print this form.

Please complete order details (at minimum licensee name and/or company, address, and payment details) and:

on CompuServe, GO SWREG at any ! prompt and:

quote number 1870 for a workstation license

quote number 2076 for a server license

quote number 2077 for a site license

or post to:	Nick Payne
P.O. Box 4384
Kingston ACT 2604
Australia

Use a separate order form for each licensee.

Please give an e-Mail address if you have one so I can inform you of your registration code as soon as I receive your order, and to give timely information on upgrades.

-----------------------------------------------------------------------

                             ORDER FORM

      Name:  __________________________________________________________

   Company:  __________________________________________________________

   Address:  __________________________________________________________

             __________________________________________________________

             __________________________________________________________

             __________________________________________________________

     Phone:  __________________________ Fax: __________________________

CompuServe:  __________________________

___ licenses        at USD  $35            ___________

___ server licenses at USD $150            ___________

Site license        at USD $500            ___________

Do you already have a copy of the program? Y/N _______

If so, what version do you have?               _______

(select About from the system menu and click

 on Credits to see the version number)

If not, please add shipping and handling

Shipping & handling (international post orders)

____________________   USD $10

                                Total      ___________

Enclose check/P.O./money order for total (or converted equivalent):


Entering your registration information

To enter your registration information once you have registered WSetPass and received your key:

•	Either click on the Register button in the shareware reminder box that appears when you start WSetPass, or select Register from the system menu.

•	Enter your name, company, and key EXACTLY as you received them. If either name or company is blank, leave that field blank.

•	Click on OK.

The shareware reminder box will no longer be displayed.

Keep your registration information in a safe place. If you change machines or lose your WSETPASS.INI file, you will need to re-enter your name and key.

See also

Shareware registration form

Registration Information