doc/xml/ReleaseNotesWindows/relnotes.xml

   1 <?xml version="1.0" encoding="utf-8"?>
   2 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook V4.3//EN" "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd"[
   3 <!ENTITY version SYSTEM "version.xml">
   4 ]>
   5 <book>
   6   <bookinfo>
   7     <title>OpenAFS for Windows Release Notes</title>
   8     <copyright>
   9       <year>2003-2013</year>
  10       <holder>Secure Endpoints Inc. and Your File System Inc.</holder>
  11     </copyright>
  12     <legalnotice>
  13       <para>This documentation is covered by the MIT License.</para>
  14     </legalnotice>
  15     <revhistory>
  16     &version;
  17     </revhistory>
  18     <abstract>
  19       <para>This document provides a series of usage notes regarding the OpenAFS for Windows
  20       client, supported platforms, contribution information, debugging techniques, and
  21       a reference to supported Windows registry values.
  22      </para>
  23     </abstract>
  24   </bookinfo>
  25   <preface>
  26     <title id="Preface">Preface</title>
  27     <para>The Andrew File System (AFS) is a globally-accessible location-independent file system
  28       that uses local caching to increase its performance. An AFS client accesses files anonymously
  29       or authenticated via Kerberos. The global AFS is partitioned into cells. Each AFS cell is a
  30       collection of AFS volumes that are administered by a common entity. AFS cells can be
  31       administered by a department even when the associated Kerberos authentication realms are
  32       managed by a much larger organization. AFS clients and servers take advantage of Kerberos
  33       cross-realm authentication to permit authenticated access by entities located outside the
  34       local realm. Authorization is enforced by the use of directory level access control lists of
  35       individual or group identities. </para>
  36     <para>The AFS volume is a tree of files and sub-directories. AFS volumes are created by administrators and are joined to an AFS cell via the use of a mount point. Once a volume is created, users can create files and directories as well as mount points and symlinks within the volume without regard for the physical location of the volume. Administrators can move the volume to another server as necessary without the need to notify users. In fact, the volume move can occur while files in the volume are in use. </para>
  37     <para>AFS volumes can be replicated to read-only copies. When accessing files from a read-only replica, clients will read all of the data from a single replica. If that replica becomes unavailable, the clients will failover to any replica that is reachable. Users of the data are unaware of where the replicas are stored or which one is being accessed. The contents of the replicas can be updated at any time by
  38       <emphasis>releasing</emphasis> the current contents of the source volume.
  39     </para>
  40     <para>OpenAFS for Windows (OAFW) provides AFS client access on Microsoft Windows operating
  41       systems. It strives to maintain transparency such that the user is unaware of the distinction
  42       between the use of AFS and Microsoft Windows file shares. OAFW can be part of a single sign-on
  43       solution by allowing credentials for a Kerberos principal to be obtained at logon and for that
  44       principal to be used to obtain AFS tokens for one or more cells. OAFW is implemented as a
  45       native installable file system and maintains the portability of file paths by its use of the
  46       \\AFS UNC server name.</para>
  47     <para>OpenAFS is the product of an open source development effort begun on 1 November 2000.
  48       OpenAFS is maintained and developed by a group of volunteers with the support of the end user
  49       community. When OpenAFS is used as part of your computing infrastructure, please <link linkend="Contributing_to_OpenAFS">contribute</link> to its continued growth. </para>
  50   </preface>
  51   <chapter id="chap_1">
  52     <title id="Installer_Options">Installer Options</title>
  53     <para>OpenAFS can be installed either as a new installation or an upgrade from previous versions of either OpenAFS for Windows or the former IBM AFS 3.6 for Windows.
  54   Installers are provided as <ulink url="http://msdn.microsoft.com/en-us/library/cc185688%28v=vs.85%29.aspx">Windows Installer packages (.msi)</ulink> that are built using the open source
  55   <ulink url="http://wix.sourceforge.net/">WiX Toolkit</ulink>.  The MSI can be customized for organizations via the use of <ulink url="http://msdn.microsoft.com/en-us/library/aa367447%28v=vs.85%29.aspx">MSI Transforms</ulink> (see <link linkend="Introduction_to_MSI_Deployment">MSI Deployment Guide</link>)
  56     </para>
  57   </chapter>
  58   <chapter id="chap_2">
  59     <title id="System_Requirements">System Requirements</title>
  60     <section>
  61       <title id="Supported_Operating_Systems">2.1 Supported Operating Systems</title>
  62       <para>
  63         <indexterm significance="normal">
  64           <primary>operating system versions, supported</primary>
  65         </indexterm>
  66         <indexterm significance="normal">
  67           <primary>system requirements</primary>
  68         </indexterm>
  69         <itemizedlist>
  70           <listitem>
  71             <para>Microsoft Windows XP Home SP2 and SP3</para>
  72           </listitem>
  73           <listitem>
  74             <para>Microsoft Windows XP Professional SP2 and SP3</para>
  75           </listitem>
  76           <listitem>
  77             <para>Microsoft Windows XP 64 SP1 and SP2</para>
  78           </listitem>
  79           <listitem>
  80             <para>Microsoft Windows 2003 Server SP1 and SP2 (32-bit and 64-bit Intel)</para>
  81           </listitem>
  82           <listitem>
  83             <para>Microsoft Windows 2003 R2 Server (32-bit and 64-bit Intel)</para>
  84           </listitem>
  85           <listitem>
  86             <para>Microsoft Windows Vista (32-bit and 64-bit Intel)</para>
  87           </listitem>
  88           <listitem>
  89             <para>Microsoft Windows 2008 Server (32-bit and 64-bit Intel)</para>
  90           </listitem>
  91           <listitem>
  92             <para>Microsoft Windows 7 (32-bit and 64-bit Intel)</para>
  93           </listitem>
  94           <listitem>
  95             <para>Microsoft Windows 2008 Server R2 (64-bit Intel)</para>
  96           </listitem>
  97           <listitem>
  98             <para>Microsoft Windows 8 (32-bit and 64-bit Intel)</para>
  99           </listitem>
 100           <listitem>
 101             <para>Microsoft Windows Server 2012 (64-bit Intel)</para>
 102           </listitem>
 103         </itemizedlist>
 104       </para>
 105     </section>
 106     <section>
 107       <title id="Unsupported_Operating_Systems">2.1.1 Unsupported Operating Systems</title>
 108       <para>
 109         <indexterm significance="normal">
 110           <primary>operating system versions, unsupported</primary>
 111         </indexterm>
 112         <itemizedlist>
 113           <listitem>
 114             <para> Microsoft Windows 95</para>
 115           </listitem>
 116           <listitem>
 117             <para>Microsoft Windows 98</para>
 118           </listitem>
 119           <listitem>
 120             <para>Microsoft Windows 98 OSR2</para>
 121           </listitem>
 122           <listitem>
 123             <para>Microsoft Windows ME</para>
 124           </listitem>
 125           <listitem>
 126             <para>Microsoft NT</para>
 127           </listitem>
 128           <listitem>
 129             <para>Microsoft Windows 2000 Workstation</para>
 130           </listitem>
 131           <listitem>
 132             <para>Microsoft Windows 2000 Server</para>
 133           </listitem>
 134           <listitem>
 135             <para>Microsoft Windows XP Home (pre-SP2)</para>
 136           </listitem>
 137           <listitem>
 138             <para>Microsoft Windows XP Professional (pre-SP2)</para>
 139           </listitem>
 140           <listitem>
 141             <para>Microsoft Windows 8 RT (ARM)</para>
 142           </listitem>
 143         </itemizedlist>
 144       </para>
 145       <para>Older releases of OpenAFS are available for download if unsupported operating systems
 146         must be used. The last version of OpenAFS with support for Win9x is 1.2.2b. The last version
 147         with support for Windows NT 4.0 is 1.2.10. The last version to support Windows 2000 and XP
 148         SP1 is 1.6.1.</para>
 149     </section>
 150     <section>
 151       <title id="Disk_Space">2.2 Disk Space</title>
 152       <para>
 153         <indexterm significance="normal">
 154           <primary>disk space required</primary>
 155         </indexterm> Up to 60mb required for the OpenAFS binaries plus 100MB for the default
 156         AFSCache file. The size of the AFSCache file may be adjusted via <link linkend="Regkey_TransarcAFSDaemon_Parameters_CacheSize">the Registry</link> after
 157         installation. The maximum cache size for 32-bit Windows is approximately 1.2GB. On 64-bit
 158         Windows there is no enforced limit on the cache size. </para>
 159     </section>
 160     <section>
 161       <title id="Additional_Software_Packages">2.3 Additional Software Packages</title>
 162       <indexterm significance="normal">
 163         <primary>kerberos for windows</primary>
 164       </indexterm>
 165       <indexterm significance="normal">
 166         <primary>heimdal</primary>
 167       </indexterm>
 168       <para>
 169         <ulink url="https://www.secure-endpoints.com/heimdal">Heimdal</ulink> or <ulink url="http://web.mit.edu/kerberos/dist/index.html">MIT Kerberos for Windows</ulink> 3.2.x if Kerberos v5 authentication support is desired.  Heimdal is preferred over MIT Kerberos as it will provide OpenAFS the ability to offer enhanced capabilities in future releases.  For 64-bit Windows installations, the 64-bit version of Kerberos for Windows is required.  For 32-bit Windows installations, the 32-bit version of Kerberos for Windows is required.
 170         See <link linkend="Kerberos_v5_Requirements">3.2 Kerberos v5 Requirements</link> for additional details.
 171       </para>
 172     </section>
 173   </chapter>
 174   <chapter id="chap_3">
 175     <title id="Operational_Notes">Operational Notes</title>
 176     <section>
 177       <title id="Unicode_Support">3.1. Unicode Support</title>
 178       <indexterm significance="normal">
 179         <primary>unicode</primary>
 180       </indexterm>
 181       <indexterm significance="normal">
 182         <primary>character sets</primary>
 183       </indexterm>
 184       <indexterm significance="normal">
 185         <primary>roaming profiles</primary>
 186       </indexterm>
 187       <indexterm significance="normal">
 188         <primary>folder redirection</primary>
 189       </indexterm>
 190       <para>Starting with the 1.5.50 release of OpenAFS for Windows, each of the AFS Client Service, the AFS Explorer Shell Extension, and the command-line tools are Unicode enabled.  No longer is OpenAFS restricted to accessing file system objects whose names can be represented in the locale specific OEM code page.  This has significant benefits for end users.  Most importantly it permits non-Western languages to now be used for file system object names in AFS from Microsoft Windows operating systems.  Now that Unicode names are supported,
 191         <ulink url="http://en.wikipedia.org/wiki/Roaming_user_profile">Roaming User Profiles</ulink> and
 192         <ulink url="http://en.wikipedia.org/wiki/Folder_redirection">Folder Redirection</ulink> will no longer fail when a user attempts to store an object with a name that cannot be represented in the OEM code page.
 193       </para>
 194       <para>Unicode names are stored in AFS using UTF-8 encoding.  UTF-8 is supported as a locale on MacOS X, Linux, Solaris, and most other operating systems.  This permits non-Western object names to be exchanged between Microsoft Windows and other operating systems.  The OpenAFS for Windows client also implements
 195         <ulink url="http://en.wikipedia.org/wiki/Unicode_normalization">Unicode Normalization</ulink> as part of the name lookup algorithm.  This is necessary because Unicode does not provide a unique representation for each input string.  The use of normalization permits a file system object name created on MacOS X to be matched with the same string entered on Microsoft Windows even though the operating system's choice of representation may be different.
 196       </para>
 197       <para>It is important to note that AFS file servers are character-set agnostic.  All file system object names are stored as octet strings without any character set tagging.  If a file system object is created using OEM Code Page 858 and then interpreted as UTF-8 it is likely that the object name will appear to be gibberish.  OpenAFS for Windows goes to great lengths to ensure that the object name is converted to a form that will permit the user to rename the object using Unicode.  Accessing UTF-8 names on UNIX systems that have the locale set to one of the ISO Latin character sets will result in the UTF-8 strings appearing to be gibberish.  </para>
 198       <para>UNIX AFS can not perform Unicode Normalization for string comparisons.  Although it is possible to store and read Unicode object names, it is possible that a user may not be able to open an object by typing the name of the object at the keyboard.  GUI point and click operations should permit any object to be accessed.</para>
 199       <section>
 200         <title>3.1.1. Interoperability with MacOS X</title>
 201         <indexterm>
 202           <primary>MacOS X</primary>
 203         </indexterm>
 204         <para>MacOS X uses UTF-8 Normalization Form D (NFD) whereas Microsoft Windows and most other
 205           applications use UTF-8 Normalization Form C (NFC).  The difference is that in NFD Unicode
 206           character sequences containing diacritical marks are decomposed whereas in NFC the Unicode
 207           character sequences use combined characters whenever possible.  Whereas Microsoft Windows
 208           can display and manipulate files stored using NFD, MacOS X Finder does have trouble with
 209           filenames that are NFC encoded.  All file names stored by the OpenAFS Windows client use
 210           NFC.</para>
 211       </section>
 212     </section>
 213     <section id="Kerberos_v5_Requirements">
 214       <title>3.2. Requirements for Kerberos v5 Authentication</title>
 215       <indexterm significance="normal">
 216         <primary>kerberos for windows</primary>
 217       </indexterm>
 218       <indexterm significance="normal">
 219         <primary>heimdal</primary>
 220       </indexterm>
 221       <para>The OpenAFS distribution ships with its own implementation of Kerberos v4 and although
 222         it is Kerberos v5 capable, it relies on third-party Kerberos v5 libraries. The OpenAFS 1.4
 223         series (and later) integrates with <ulink url="https://www.secure-endpoints.com/heimdal">Heimdal</ulink> or <ulink url="http://web.mit.edu/kerberos/">MIT Kerberos for
 224           Windows</ulink> 2.6.5 and above. OpenAFS Kerberos v5 capable functionality includes
 225         integrated logon, the AFS Authentication Tool, the Network Identity Manager AFS provider,
 226         and the aklog command. These tools provide support for Kerberos v5 authentication including
 227         acquisition and automatic renewal of AFS tokens as well as support for single sign-on via
 228         the Microsoft Windows Kerberos Logon Service. </para>
 229       <indexterm significance="normal">
 230         <primary>network identity manager</primary>
 231       </indexterm>
 232       <para>The recommended versions of <ulink url="https://www.secure-endpoints.com/heimdal">Heimdal</ulink> and <ulink url="http://web.mit.edu/kerberos/">MIT Kerberos for
 233           Windows</ulink> are distributed by <ulink url="https://www.secure-endpoints.com/">Secure
 234           Endpoints Inc.</ulink>. As of this writing, the Secure Endpoints Inc. distribution
 235         provides 64-bit Windows support which is unavailable from MIT.  KFW 3.2.2 includes Network
 236         Identity Manager 1.3.1 which integrates with the <link linkend="Network_Identity_Manager_Provider">AFS Provider</link> installed as part of
 237         OpenAFS for Windows. The most recent version of Network Identity Manager is version 2.1
 238         which is available as an independent upgrade to MIT Kerberos for Windows.   Heimdal does not
 239         include a version of Network Identity Manager.</para>
 240       <indexterm significance="normal">
 241         <primary>transarc afs</primary>
 242       </indexterm>
 243       <para>With Heimdal or Kerberos for Windows installed, the OpenAFS for Windows client can
 244         perform authentication to AFS services using Kerberos v5 service tickets as AFS tokens. When
 245         a Kerberos v5 derived AFS token is used, all of the AFS Volume Location and File Servers
 246         within the authenticated cell must support Kerberos v5. If a Kerberos v5 based token is
 247         presented to an AFS server that does not support them, the server will be unable to respond
 248         to the client. Attempts to access AFS volumes stored on such a server will fail with the
 249         Windows STATUS_NO_KERB_KEY (0xC0000322L) error. Kerberos v5 based tokens are supported by
 250         OpenAFS revisions 1.2.8 or later. IBM AFS 3.6 servers do not support Kerberos v5.</para>
 251       <section>
 252         <title id="Active_Directory">3.2.1. Active Directory</title>
 253         <indexterm significance="normal">
 254           <primary>active directory</primary>
 255         </indexterm>
 256         <indexterm significance="normal">
 257           <primary>des-cbc-crc encryption type</primary>
 258         </indexterm>
 259         <para>Microsoft Windows Active Directory can be used as a Kerberos v5 KDC in conjunction
 260           with OpenAFS. <itemizedlist>
 261             <listitem>
 262               <para> There are two things to consider when using an Active Directory as the Kerberos
 263                 realm that issues the AFS service ticket. First, the Kerberos v5 tickets issued by
 264                 Active Directory can be quite large when compared to tickets issued by traditional
 265                 UNIX KDCs due to the inclusion of Windows specific authorization data <ulink url="http://msdn.microsoft.com/en-us/library/cc237917%28v=prot.10%29.aspx">(the
 266                   Microsoft PAC)</ulink>. If the issued tickets are larger than 344 bytes, OpenAFS
 267                 1.2.x servers will be unable to process them and will issue a RXKADBADTICKET error.
 268                 OpenAFS 1.4 (and beyond) servers can support the largest tickets that Active
 269                 Directory can issue. </para>
 270             </listitem>
 271             <listitem>
 272               <para>Second, the Kerberos v5 tickets issued by Windows 2003 Active Directory are
 273                 encrypted with the DES-CBC-MD5 encryption type (enctype). OpenAFS 1.2.x servers only
 274                 support the DES-CBC-CRC enctype. As a result, OpenAFS 1.2.x servers cannot process
 275                 the resulting Kerberos v5 tokens. Windows 2000 Active Directory issues tickets with
 276                 the DES-CBC-CRC enctype. Windows Server 2008 R2 Active Directory domain by default
 277                 disables use of DES-CBC-MD5 and it must be enabled. </para>
 278               <para>Microsoft has documented in <ulink url="http://support.microsoft.com/kb/832572/">Knowledge Base article 832572</ulink> a new NO_AUTH_REQUIRED flag that can be set
 279                 on the account mapped to the AFS service principal. When this flag is set, the PAC
 280                 authorization data will not be included in the ticket. Setting this flag is
 281                 recommended for all accounts that are associated with non-Windows services and that
 282                 do not understand the authorization data stored in the PAC. This flag cannot be used
 283                 if AFS service tickets are obtained via cross-realm using an Active Directory user
 284                 principal. </para>
 285               <para>Note that an Active Directory computer object cannot be used for the afs service
 286                 principal. A user object must be used.</para>
 287             </listitem>
 288             <listitem>
 289               <para>Starting with Windows 7 and Windows Server 2008 R2, Microsoft has disabled the
 290                 single DES encryption types,<ulink url="http://technet.microsoft.com/en-us/library/dd560670(WS.10).aspx">TechNet:
 291                   Changes in Kerberos Authentication</ulink>. DES must be enabled via Group Policy
 292                 in order for Active Directory to be used as a KDC for OpenAFS.  Enable weak
 293                 encryption becuase of AFS... Start &gt; Administrative Tools &gt; Group Policy
 294                 Management Expand Forest &gt; Domains &gt; (domain name) &gt; Group Policy Objects
 295                 &gt; Default Domain Policy Right-click "Default Domain Policy" and select "Edit"
 296                 Expand "Computer Configuration" &gt; "Policies" &gt; "Windows Settings” &gt;
 297                 "Security Settings” &gt; "Local Policies” &gt; "Security Options” Double click
 298                 "Network security: Configure encryption types allowed for Kerberos” Select "Define
 299                 this policy setting", then select "DES_CBC_CRC" and all the others... Press "OK" </para>
 300             </listitem>
 301           </itemizedlist></para>
 302       </section>
 303       <section>
 304         <title id="Using_krb524_Service">3.2.2. The krb524 Service is no longer supported</title>
 305         <indexterm significance="normal">
 306           <primary>krb524</primary>
 307         </indexterm>
 308         <indexterm significance="normal">
 309           <primary>port, 4444/udp</primary>
 310         </indexterm>
 311         <indexterm significance="normal">
 312           <primary>registry value, Use524</primary>
 313         </indexterm>
 314         <para>Before there was native support for Kerberos v5 derived AFS tokens, the krb524 service was used to convert a Kerberos v5 service ticket into a Kerberos v4 service ticket that could in turn be used to construct an AFS authentication token. As of OpenAFS 1.2.8 [14 December 2002], support was added to allow the immediate use of Kerberos v5 tickets as AFS (2b) tokens. This is the first building block necessary to break away from the limitations of Kerberos v4 with AFS. By using Kerberos v5 directly the security holes inherent in Kerberos v4 cross-realm are avoided.  Use of cryptographically stronger algorithms for authentication and encryption become a possibility.</para>
 315         <para>Another reason for using Kerberos v5 directly is because the krb524 service runs on port (4444/udp), which has increasingly been blocked by Internet service providers. The port was used to spread a worm which attacked Microsoft Windows in the Summer of 2003. When the port is blocked users find that they are unable to authenticate.</para>
 316         <para>Replacing the Kerberos v4 ticket with a Kerberos v5 ticket is a win in all situations except when the cell name does not match the realm name and the principal names placed into the ACL's are not the principal names from the Kerberos v5 ticket.  Unfortunately, some organizations have AFS cell names and Kerberos realm names which differ by more then just typographic case and rely the krb524d service to map the Kerberos v5 client principal name from realm FOO to a Kerberos v4 principal in realm BAR. This allows user@FOO to appear to be user@bar for the purposes of accessing the AFS cell.
 317         </para>
 318         <para>To support this mode of operation OpenAFS for Windows versions 1.4.x through 1.6.x supported a registry value,
 319           <link linkend="Value_Use524">Use524</link>, that forced the use of krb524d within the AFS Authentication Tool and during integrated logon. Previous revisions of this documentation advised that this option should only be used by individuals until such time as their organizations transitioned away from the krb524 service.
 320         </para>
 321         <para>Over the last few years all Kerberos distributions have removed support for Kerberos v4.  As a result, OpenAFS can no longer support the krb524d service and the functionality has been removed from the source tree for the 1.7.x release.</para>
 322         <para>As an alternative, sites should be aware that the OpenAFS 1.4.x servers permit the use of a secondary realm name that can be treated as equivalent to the cell name for authentication.  This functionality can be used to avoid the need for the krb524 service if and only if both realms are managed by the same administrative entity.
 323         </para>
 324       </section>
 325       <section id="Network_Identity_Manager_Provider">
 326         <title>3.2.3. Network Identity Manager Provider</title>
 327         <indexterm significance="normal">
 328           <primary>network identity manager</primary>
 329         </indexterm>
 330         <para>As of release 1.5.9, OpenAFS for Windows includes a Network Identity Manager Provider
 331           for obtaining AFS tokens. This plug-in is a contribution from <ulink url="https://www.secure-endpoints.com/">Secure Endpoints Inc.</ulink> Network Identity
 332           Manager is a multiple identity credential management tool that ships with <ulink url="http://web.mit.edu/kerberos/">MIT Kerberos for Windows</ulink> version 3.0 and
 333           above. The OpenAFS plug-in requires <ulink url="https://www.secure-endpoints.com/heimdal">Heimdal</ulink> or <ulink url="http://web.mit.edu/kerberos/">MIT Kerberos for
 334             Windows</ulink> version 3.1 or above. </para>
 335         <para>
 336           <inlinemediaobject>
 337             <imageobject>
 338               <imagedata format="JPG" fileref="relnotes00.jpg"/>
 339             </imageobject>
 340           </inlinemediaobject>
 341         </para>
 342         <para>The Network Identity Manager replaces the former KFW 2.6.x ticket manager, "Leash", and when combined with the OpenAFS Provider it can be used as a replacement for the AFS Authentication Tool (afscreds.exe).  Unlike both Leash and the AFS Authentication Tool, Network Identity Manager with the OpenAFS Provider can easily acquire and renew AFS tokens for multiple cells from one or more Kerberos v5 identities.</para>
 343         <para>
 344           <inlinemediaobject>
 345             <imageobject>
 346               <imagedata format="JPG" fileref="relnotes01.jpg"/>
 347             </imageobject>
 348           </inlinemediaobject>
 349         </para>
 350         <para>The AFS configuration panel for each Kerberos v5 identity is used to configure which cells credentials should be obtained for and how they should be obtained.  If the cell to realm mapping cannot be automatically determined, it can be explicitly specified.  If the cell does not support Kerberos v5 tickets as tokens, then a krb524 service can be configured.</para>
 351         <para>
 352           <inlinemediaobject>
 353             <imageobject>
 354               <imagedata format="JPG" fileref="relnotes02.jpg"/>
 355             </imageobject>
 356           </inlinemediaobject>
 357         </para>
 358         <para>The OpenAFS Provider configuration panel can be used to check the status of the AFS Client Service and its version.  An optional checkbox is provided that will prevent the AFS Authentication Tool from being started by Windows after login.   A shortcut to the OpenAFS Control Panel is also provided.</para>
 359         <para>As of OpenAFS 1.5.66, the Network Identity Manager OpenAFS Provider displays the same AFS Lock notification icon generated by the AFS Authentication Tool.  The AFS Lock can be used to determine if:</para>
 360         <itemizedlist>
 361           <listitem>
 362             <para>one or more AFS tokens are valid</para>
 363           </listitem>
 364           <listitem>
 365             <para>no AFS tokens are present but the AFS service is running</para>
 366           </listitem>
 367           <listitem>
 368             <para>the AFS Service is not running</para>
 369           </listitem>
 370           <listitem>
 371             <para>the AFS Service is running but there is a communication error preventing access to \\AFS</para>
 372           </listitem>
 373         </itemizedlist>
 374       </section>
 375       <section>
 376         <title>3.2.4. Heimdal 1.5, MIT 4.x, and Weak Encryption Types</title>
 377         <para>Just as Microsoft disabled the use of Weak Encryption Types in Windows 7 and Windows
 378           Server 2008 R2, Heimdal and MIT have disabled the use of weak encryption types in their
 379           latest releases. In order to use Heimdal 1.5 or MIT Kerberos 1.9 or later with OpenAFS,
 380           the weak encryption types including DES-CBC-CRC and DES-CBC-MD5 must be enabled. In
 381           Heimdal, this is performed by adding "allow_weak_crypto = true" to the [libdefaults]
 382           section of the %SystemRoot%\ProgramData\Kerberos\krb5.conf file.  In MIT KFW 4.x, this is
 383           performed by adding "allow_weak_crypto = true" to the [libdefaults] section of the
 384           %SystemRoot%\ProgramData\MIT\Kerberos5\krb5.ini file.</para>
 385         <para>Futures versions of OpenAFS will not have this requirement.</para>
 386       </section>
 387     </section>
 388     <section>
 389       <title id="Use_of_Microsoft_Loopback">3.3. The Former use of the Microsoft Loopback Adapter by the OpenAFS Client Service</title>
 390       <indexterm significance="normal">
 391         <primary>microsoft loopback adapter</primary>
 392       </indexterm>
 393       <para> This section is preserved for those sites that may want to manually configure the
 394         OpenAFS Client Service to run as an SMB Gateway to AFS instead of using the native IFS file
 395         system redirector driver. When the IFS driver is active, the Microsoft Loopback Adapter is
 396         ignored. The OpenAFS 1.7.x installer will not install a Microsoft Loopback Adapter by
 397         default nor will it remove one if already present on the machine. </para>
 398       <para>The Microsoft Loopback Adapter (MLA) is installed with a name "AFS" and a pre-assigned IP address of 10.254.254.253. The MLA is bound to the "Client for Microsoft Networks" service and not bound to the "File and Printer Sharing for Microsoft Networks" service. If the MLA is unbound to "Client Microsoft Networks", the OpenAFS Client Service will become inaccessible when the machine is disconnected from the network. If the MLA is bound to "File and Printer Sharing ..." there will be a service type collision between the "AFS" SMB Service and the local machine's File Sharing Service.  This will result in the OpenAFS client service becoming inaccessible and the "NET VIEW \\AFS" command will return a "System Error 52" message. To correct the problem:</para>
 399       <itemizedlist>
 400         <listitem>
 401           <para>stop the AFS Client Service</para>
 402         </listitem>
 403         <listitem>
 404           <para>bind the "Client for Microsoft Networks" to the MLA</para>
 405         </listitem>
 406         <listitem>
 407           <para>unbind "File and Printer Sharing for Microsoft Networks" from the MLA</para>
 408         </listitem>
 409         <listitem>
 410           <para>disable and then re-enable the MLA</para>
 411         </listitem>
 412         <listitem>
 413           <para>start the AFS Client Service</para>
 414         </listitem>
 415       </itemizedlist>
 416       <para>When the MLA is not installed the NETBIOS name published by the OpenAFS SMB server must be unique in order to avoid name conflicts on public network.  The unique name will take the form "<emphasis>MACHINE</emphasis>-AFS". One of the benefits of using the MLA is that the NETBIOS name does not have to be published on any adapter other than the MLA. Therefore the chosen name is no longer required to be globally unique. Instead the NETBIOS name associated with the AFS Client Service is simply "AFS" and portable UNC paths of the form \\AFS\cellname\path can now be used on all machines.
 417       </para>
 418     </section>
 419     <section>
 420       <title id="Using_Freelance_Mode">3.4. Using Freelance (Dynamic Root) Mode to Improve Mobility</title>
 421       <indexterm significance="normal">
 422         <primary>freelance mode</primary>
 423       </indexterm>
 424       <indexterm significance="normal">
 425         <primary>root.afs volume, fake</primary>
 426       </indexterm>
 427       <indexterm significance="normal">
 428         <primary>mount points</primary>
 429       </indexterm>
 430       <indexterm significance="normal">
 431         <primary>symlinks</primary>
 432       </indexterm>
 433       <para>Historically, when the OpenAFS Client Service starts it must mount the "root.afs" volume
 434         of the default cell. The "root.afs" volume contains the set of mount points to the
 435         "root.cell" volumes of various cells the administrator of the default cell believes should
 436         be accessible. If the "root.afs" volume is inaccessible when the client service starts, the
 437         service will terminate unexpectedly. Since many users now use laptops or otherwise operate
 438         in disconnected environments in which a Virtual Private Network (VPN) connection may be
 439         required to access the cell's servers, it is often the case that the "root.afs" volume is
 440         unreachable and the OpenAFS Client Service can not successfully start. </para>
 441       <para>Freelance mode dynamically constructs a fake "root.afs" volume from mount points and
 442         symlinks stored in the local registry.  This permits the OpenAFS Client Service to operate
 443         in these environments.</para>
 444       <para>The content of the fake "root.afs" volume is dynamically generated as cells are accessed. When the fake "root.afs" volume is initially constructed it will only contain two mount points: a
 445         <emphasis>regular path </emphasis>and
 446         <emphasis>read-write path </emphasis>mount point used to access the "root.cell" volume of the default AFS cell. Any attempt to access a valid cell name will result in a new mount point being created in the fake "root.afs" volume. If the cellname begins with a "." the mount point will be a
 447         <emphasis>read-write path</emphasis>; otherwise the mount point will be a
 448         <emphasis>regular path</emphasis>. These mount points are preserved in the registry at key:
 449       </para>
 450       <para>
 451         <link linkend="Regkey_HKLM_SOFTWARE_OpenAFS_Client_Freelance">HKLM\SOFTWARE\OpenAFS\Client\Freelance</link>
 452       </para>
 453       <para>Additional mount points may be manually created using the "fs mkmount" command. Mount points may be removed using the "fs rmmount" command.</para>
 454       <para>&gt;fs mkmount \\AFS\athena.mit.edu root.cell athena.mit.edu</para>
 455       <para>&gt;fs mkmount \\AFS\.athena.mit.edu root.cell athena.mit.edu -rw</para>
 456       <para>&gt;fs rmmount \\AFS\athena.mit.edu</para>
 457       <para>&gt;fs rmmount \\AFS\.athena.mit.edu</para>
 458       <para>Symlinks may also be created within the Freelance "root.afs" volume.</para>
 459       <para>&gt;symlink make \\afs\link \\afs\athena.mit.edu\user\j\a\jaltman</para>
 460       <para> &gt;symlink list \\afs\link</para>
 461       <para> '\\afs\link' is a symlink to 'athena.mit.edu\user\j\a\jaltman'</para>
 462       <para>&gt;symlink rm \\afs\link</para>
 463       <para>The symlinks are stored in the registry at:</para>
 464       <para>
 465         <link linkend="Regkey_HKLM_SOFTWARE_OpenAFS_Client_Freelance_Symlinks">HKLM\SOFTWARE\OpenAFS\Client\Freelance\Symlinks</link>
 466       </para>
 467       <para><emphasis>NET VIEW \\AFS</emphasis> can be used to browse all of the entries from the command line.</para>
 468     </section>
 469     <section>
 470       <title id="Locating_VLDB_via_DNS">3.5. Locating AFS Volume Database Servers via DNS </title>
 471       <indexterm significance="normal">
 472         <primary>dns, vldb lookups</primary>
 473       </indexterm>
 474       <indexterm significance="normal">
 475         <primary>afsdb dns records</primary>
 476       </indexterm>
 477       <para>The OpenAFS for Windows client will use DNS SRV records and DNS AFSDB records to
 478         discover the location of AFS Volume Database servers when entries for the cell are not
 479         present in either the client's CellServDB registry store or file
 480         (\%ALLUSERSPROFILE%\OpenAFS\Client\CellServDB or \%PROGRAMFILES%\OpenAFS\Client\CellServDB).
 481         Also see <link linkend="Registry_VLDB_Configuration">Registry Configuration for AFS Volume
 482           Database Servers</link>.</para>
 483     </section>
 484     <section>
 485       <title id="Integrated_Logon">3.6. Obtaining AFS Tokens as a Integrated Part of Windows Logon</title>
 486       <indexterm significance="normal">
 487         <primary>integrated logon</primary>
 488       </indexterm>
 489       <indexterm significance="normal">
 490         <primary>single sign-on</primary>
 491       </indexterm>
 492       <indexterm significance="normal">
 493         <primary>kerberos for windows</primary>
 494       </indexterm>
 495       <indexterm significance="normal">
 496         <primary>afslogon.dll</primary>
 497       </indexterm>
 498       <indexterm significance="normal">
 499         <primary>EnableKFW</primary>
 500       </indexterm>
 501       <indexterm significance="normal">
 502         <primary>Use524</primary>
 503       </indexterm>
 504       <indexterm significance="normal">
 505         <primary>tokens</primary>
 506       </indexterm>
 507       <para>OpenAFS for Windows installs a WinLogon Authentication Provider to provide Single
 508         Sign-On functionality (aka Integrated Logon.) Integrated Logon can be used to obtain AFS
 509         tokens when the Windows username and password match the username and password associated
 510         with the default cell's Kerberos realm. For example, if the Windows username is "jaltman"
 511         and the default cell is "your-file-system.com", then Integrated Logon can be successfully
 512         used if the windows password matches the password assigned to the Kerberos principal
 513         "jaltman@YOUR-FILE-SYSTEM.COM". The realm "YOUR-FILE-SYSTEM.COM" is obtained by performing a
 514         domain name to realm mapping on the hostname of one of the cell's Volume Database
 515         servers.</para>
 516       <para>Integrated Logon is required if roaming user profiles are stored within the AFS file
 517         system. OpenAFS does not provide tools for synchronizing the Windows and Kerberos user
 518         accounts and passwords.  Integrated Logon can be enabled or disabled via the <link linkend="Value_LogonOptions">LogonOptions</link> registry value.</para>
 519       <para>When Heimdal or KFW is installed, Integrated Logon will use it to obtain tokens using
 520         Kerberos v5. If you must use the <emphasis role="italic">deprecated</emphasis> kaserver for
 521         authentication instead of Kerberos v5, the use of KFW can be disabled via the <link linkend="Value_EnableKFW">EnableKFW</link> registry value. </para>
 522       <para>Integrated Logon will not transfer Kerberos v5 tickets into the user's logon session credential cache.  This is no longer possible on Vista and Windows 7.</para>
 523       <para>Integrated Logon does not have the ability to cache the username and password for the
 524         purpose of obtaining tokens if the Kerberos KDC is inaccessible at logon time.</para>
 525       <para>Integrated Logon supports the ability to obtain tokens for multiple cells.  For further
 526         information on how to configure this feature, read about the <link linkend="Value_TheseCells">TheseCells</link> registry value. </para>
 527       <para>Depending on the configuration of the local machine, it is possible for logon
 528         authentication to complete with one of the following user account types:</para>
 529       <para>
 530         <itemizedlist>
 531           <listitem>
 532             <para>Local Machine Account (<emphasis role="italic">LOCALHOST</emphasis> domain)</para>
 533           </listitem>
 534           <listitem>
 535             <para>Domain or Forest Account</para>
 536           </listitem>
 537           <listitem>
 538             <para>Domain or Forest Account NETBIOS-compatible name</para>
 539           </listitem>
 540           <listitem>
 541             <para>Kerberos Principal mapped to a local or domain or forest account</para>
 542           </listitem>
 543         </itemizedlist>
 544       </para>
 545       <para>For each "domain" context, the following properties are configurable:</para>
 546       <itemizedlist>
 547         <listitem>
 548           <para>Obtain AFS Tokens at Logon</para>
 549             <itemizedlist>
 550               <listitem>
 551                 <para>Yes</para>
 552               </listitem>
 553               <listitem>
 554                 <para>No</para>
 555               </listitem>
 556             </itemizedlist>
 557         </listitem>
 558         <listitem>
 559           <para>Alternate Kerberos Realm Name - combined with the username to construct a Kerberos
 560             principal</para>
 561         </listitem>
 562         <listitem>
 563           <para>TheseCells - A list of cell names other than the workstation cell for which tokens
 564             should be obtained</para>
 565         </listitem>
 566         <listitem>
 567           <para>Fail Logons Silently</para>
 568             <itemizedlist>
 569               <listitem>
 570                 <para>Yes</para>
 571               </listitem>
 572               <listitem>
 573                 <para>No</para>
 574               </listitem>
 575             </itemizedlist>
 576
 577         </listitem>
 578         <listitem>
 579           <para>Logon Script to Execute</para>
 580         </listitem>
 581         <listitem>
 582           <para>Logon Retry Interval</para>
 583         </listitem>
 584         <listitem>
 585           <para>Logon Sleep between Failure Interval</para>
 586         </listitem>
 587       </itemizedlist>
 588       <para>Within a "domain" context it is often desireable to apply alternate rules for a
 589         particular user.  The rules can include a username substitution.</para>
 590       <para>
 591         <itemizedlist>
 592           <listitem>
 593             <para>Obtain AFS Tokens at Logon</para>
 594             <itemizedlist>
 595               <listitem>
 596                 <para>Yes</para>
 597               </listitem>
 598               <listitem>
 599                 <para>No</para>
 600               </listitem>
 601             </itemizedlist>
 602           </listitem>
 603           <listitem>
 604             <para>Alternate User Name</para>
 605           </listitem>
 606           <listitem>
 607             <para>Alternate Kerberos Realm Name - combined with the username to construct a Kerberos
 608               principal</para>
 609           </listitem>
 610           <listitem>
 611             <para>TheseCells - A list of cell names other than the workstation cell for which tokens
 612               should be obtained</para>
 613           </listitem>
 614           <listitem>
 615             <para>Fail Logons Silently</para>
 616             <itemizedlist>
 617               <listitem>
 618                 <para>Yes</para>
 619               </listitem>
 620               <listitem>
 621                 <para>No</para>
 622               </listitem>
 623             </itemizedlist>
 624           </listitem>
 625           <listitem>
 626             <para>Logon Script to Execute</para>
 627           </listitem>
 628           <listitem>
 629             <para>Logon Retry Interval</para>
 630           </listitem>
 631           <listitem>
 632             <para>Logon Sleep between Failure Interval</para>
 633           </listitem>
 634         </itemizedlist>
 635       </para>
 636       <para>The  configuration hierarchy is specified in the registry under the
 637         HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain key.   For
 638         example:</para>
 639       <para>
 640         <itemizedlist>
 641           <listitem>
 642             <para>...\NetworkProvider\Domain\LOCALHOST\</para>
 643           </listitem>
 644           <listitem>
 645             <para>...\NetworkProvider\Domain\LOCALHOST\Administrator\</para>
 646           </listitem>
 647           <listitem>
 648             <para>...\NetworkProvider\Domain\AD\</para>
 649           </listitem>
 650           <listitem>
 651             <para>...\NetworkProvider\Domain\AD.EXAMPLE.ORG\</para>
 652           </listitem>
 653         </itemizedlist>
 654       </para>
 655       <para> From the perspective of configuration, the Full domain name and the
 656         NETBIOS-compatibility name are separate entities.  </para>
 657     </section>
 658     <section>
 659       <title id="AFS_System_Tray">3.7. AFS Authentication Tool Command Line Options</title>
 660       <indexterm significance="normal">
 661         <primary>afscreds.exe</primary>
 662       </indexterm>
 663       <indexterm significance="normal">
 664         <primary>system tray tool</primary>
 665       </indexterm>
 666       <indexterm significance="normal">
 667         <primary>network identity manager</primary>
 668       </indexterm>
 669       <para><emphasis role="italic">The AFS Authentication Tool (afscreds.exe) has been deprecated
 670           in favor of Network Identity Manager. afscreds.exe is no longer installed by default in
 671           the OpenAFS 1.7 release series. The following information is for historical
 672           reference.</emphasis></para>
 673       <para>The AFS Authentication Tool (afscreds.exe) supports several command line options: </para>
 674       <itemizedlist>
 675         <listitem>
 676           <para>-A = autoinit </para>
 677         </listitem>
 678         <listitem>
 679           <para>-E = force existing afscreds to exit</para>
 680         </listitem>
 681         <listitem>
 682           <para>-I = install startup shortcut</para>
 683         </listitem>
 684         <listitem>
 685           <para>-M = renew drive maps (deprecated)</para>
 686         </listitem>
 687         <listitem>
 688           <para>-N = IP address change detection </para>
 689         </listitem>
 690         <listitem>
 691           <para>-Q = quiet mode.  do not display start service dialog if afsd_service is not already running</para>
 692         </listitem>
 693         <listitem>
 694           <para>-S = show tokens dialog on startup</para>
 695         </listitem>
 696         <listitem>
 697           <para>-U = uninstall startup shortcut</para>
 698         </listitem>
 699         <listitem>
 700           <para>-X = test and do map share (deprecated)</para>
 701         </listitem>
 702         <listitem>
 703           <para> -Z = unmap drives (deprecated)</para>
 704         </listitem>
 705       </itemizedlist>
 706       <para>autoinit will result in automated attempts to acquire AFS tokens when afscreds.exe is started. afscreds.exe will attempt to utilize tickets stored in the MSLSA credentials cache; any existing CCAPI credentials cache; and finally display an Obtain Tokens dialog to the user. When used in combination with IP address change detection, afscreds.exe will attempt to acquire AFS tokens whenever the IP address list changes and the Kerberos KDC is accessible.</para>
 707       <para>The renew drive maps option is used to ensure that the user drive maps constructed via the OpenAFS tools (not NET USE) are re-constructed each time afscreds.exe is started.</para>
 708       <para>By default afscreds.exe is configured by the OpenAFS.org installers to use "-A -N -M -Q" as startup options. Currently, there is no user interface to change this selection after install time although these options may be altered via the registry on either per machine or per user basis. See
 709         <link linkend="Value_AfscredsShortcutParams">AfscredsShortcutParams</link> in
 710         <link linkend="appendix_a">Appendix A</link>.
 711       </para>
 712       <para>
 713       Due to conflicts with Vista and Windows 7 User Account Control, the Drive Letter Mount and Advanced tabs of the AFS Authentication Tool were disabled beginning with the 1.5.66 release.
 714       </para>
 715     </section>
 716     <section>
 717       <title id="AFS_Client_Admin_Group">3.8. The "AFS Client Admins" Authorization Group</title>
 718       <indexterm significance="normal">
 719         <primary>AFS client administrator authorization group</primary>
 720       </indexterm>
 721       <indexterm significance="normal">
 722         <primary>AFS Client Admins</primary>
 723       </indexterm>
 724       <indexterm significance="normal">
 725         <primary>fs checkservers</primary>
 726       </indexterm>
 727       <indexterm significance="normal">
 728         <primary>fs setcachesize</primary>
 729       </indexterm>
 730       <indexterm significance="normal">
 731         <primary>fs newcell</primary>
 732       </indexterm>
 733       <indexterm significance="normal">
 734         <primary>fs sysname</primary>
 735       </indexterm>
 736       <indexterm significance="normal">
 737         <primary>fs exportafs</primary>
 738       </indexterm>
 739       <indexterm significance="normal">
 740         <primary>fs setcell</primary>
 741       </indexterm>
 742       <indexterm significance="normal">
 743         <primary>fs setserverprefs</primary>
 744       </indexterm>
 745       <indexterm significance="normal">
 746         <primary>fs storebehind</primary>
 747       </indexterm>
 748       <indexterm significance="normal">
 749         <primary>fs setcrypt</primary>
 750       </indexterm>
 751       <indexterm significance="normal">
 752         <primary>fs cscpolicy</primary>
 753       </indexterm>
 754       <indexterm significance="normal">
 755         <primary>fs trace</primary>
 756       </indexterm>
 757       <indexterm significance="normal">
 758         <primary>fs minidump</primary>
 759       </indexterm>
 760       <indexterm significance="normal">
 761         <primary>symlink make</primary>
 762       </indexterm>
 763       <indexterm significance="normal">
 764         <primary>fs makemount</primary>
 765       </indexterm>
 766       <indexterm significance="normal">
 767         <primary>Freelance root.afs volume</primary>
 768       </indexterm>
 769       <para>The OpenAFS for Windows client supports a local Windows authorization group named "AFS Client Admins". This group is used in place of the "Administrators" group to determine which users are allowed to modify the AFS Client Service configuration via the AFS Control Panel (afs_config.exe) or fs.exe command line tool. The following fs.exe commands are now restricted to members of the "AFS Client Admins" group:</para>
 770       <itemizedlist>
 771         <listitem>
 772           <para>checkservers with a non-zero timer value</para>
 773         </listitem>
 774         <listitem>
 775           <para>setcachesize</para>
 776         </listitem>
 777         <listitem>
 778           <para>newcell</para>
 779         </listitem>
 780         <listitem>
 781           <para>sysname with a new sysname list</para>
 782         </listitem>
 783         <listitem>
 784           <para>exportafs</para>
 785         </listitem>
 786         <listitem>
 787           <para>setcell</para>
 788         </listitem>
 789         <listitem>
 790           <para>setserverprefs</para>
 791         </listitem>
 792         <listitem>
 793           <para>storebehind</para>
 794         </listitem>
 795         <listitem>
 796           <para>setcrypt</para>
 797         </listitem>
 798         <listitem>
 799           <para>cscpolicy</para>
 800         </listitem>
 801         <listitem>
 802           <para>trace</para>
 803         </listitem>
 804         <listitem>
 805           <para>minidump</para>
 806         </listitem>
 807       </itemizedlist>
 808       <para>The creation or removal of mount points and symlinks in the Freelance "root.afs" volume are also restricted to members of the "AFS Client Admins" group.</para>
 809       <para>The initial membership of the "AFS Client Admins" group when created by the installer is equivalent to the local "Administrators" group. If a user is added to the "Administrators" group after the creation of the "AFS Client Admin" group, that user will not be an AFS Client Administrator. Only users that are members of the "AFS Client Admins" group are AFS Client Administrators. The local "SYSTEM" account is an implicit member of the "AFS Client Admins" group.</para>
 810       <para>Setting the default sysname for a machine should be done via the
 811         <link linkend="Value_SysName">SysName registry value</link> and not via "fs sysname".
 812       </para>
 813     </section>
 814     <section>
 815       <title id="Support_for_UNC_Paths">3.9. OpenAFS Support for UNC Paths </title>
 816       <indexterm significance="normal">
 817         <primary>UNC paths</primary>
 818       </indexterm>
 819       <indexterm significance="normal">
 820         <primary>JP Software</primary>
 821         <secondary>4NT</secondary>
 822       </indexterm>
 823       <indexterm significance="normal">
 824         <primary>JP Software</primary>
 825         <secondary>Take Commands</secondary>
 826       </indexterm>
 827       <indexterm significance="normal">
 828         <primary>PowerShell</primary>
 829       </indexterm>
 830       <para>The OpenAFS client supports UNC paths everywhere. UNC paths provide a canonical name for resources stored within AFS. UNC paths should be used instead of drive letter mappings whenever possible. This is especially true when specifying the location of roaming profiles and redirected folders.</para>
 831       <para>Power users that make extensive use of the command line shell, cmd.exe, should consider
 832         using JP Software's Take Command command processor. Unlike cmd.exe, the JPSoftware shells
 833         fully support UNC paths as the current directory. JPSoftware added special recognition for
 834         OpenAFS to its command shells starting in version 7.0. AFS paths can be entered in UNIX
 835         notation (e.g., /afs/openafs.org/software), space utilization reports the output of the
 836         volume status for the specified path, and many AFS specific functions and variables have
 837         been added to the command language. Take Command 14.03 includes support for OpenAFS IFS
 838         Reparse Points and Hard Links.</para>
 839       <para>JPSoftware's web site is
 840         <ulink url="http://www.jpsoft.com/">http://www.jpsoft.com</ulink>.
 841       </para>
 842       <para>Microsoft PowerShell 1.0, 2.0 and 3.0 also support UNC paths as the current directory. </para>
 843       <para>The Cygwin environment also supports UNC paths as the current directory. Enter AFS paths
 844         with two leading forward slashes: //afs/grand.central.org/software/openafs/.  As of Cygwin
 845         1.7.18-1, AFS Symbolic Links are supported natively by the Cygwin environment.</para>
 846     </section>
 847     <section>
 848       <title id="aklog.exe">3.10. aklog.exe</title>
 849       <indexterm significance="normal">
 850         <primary>aklog.exe</primary>
 851       </indexterm>
 852       <para>The OpenAFS Client ships with its own version of aklog.exe which should be used in preference to those obtained by other sources. The OpenAFS aklog.exe supports Kerberos v5 as well as the ability to auto-generate AFS IDs within foreign PTS databases.</para>
 853       <para>
 854         <programlisting format="linespecific">
 855     Usage: aklog [-d] [[-cell | -c] cell [-k krb_realm]]
 856                  [[-p | -path] pathname]
 857                  [-noprdb] [-force]
 858                  [-5]
 859
 860                  -d = output debugging information.
 861                  cell = zero or more cells for which tokens will be obtained
 862                  krb_realm = the kerberos realm of the cell.
 863                  pathname = the directory for which authentication is required
 864                  -noprdb = don't try to determine AFS ID.
 865                  -5 = use Kerberos v5.
 866                       (only Kerberos v5 is available)
 867                  No commandline arguments means authenticate to the local cell.
 868       </programlisting>
 869       </para>
 870     </section>
 871     <section>
 872       <title id="OpenAFS_Servers_on_Windows">3.11. OpenAFS Servers on Windows are Unsupported</title>
 873       <indexterm significance="normal">
 874         <primary>OpenAFS Servers on Windows</primary>
 875       </indexterm>
 876       <indexterm significance="normal">
 877         <primary>Freelance mode</primary>
 878       </indexterm>
 879       <indexterm significance="normal">
 880         <primary>EnableKFW</primary>
 881       </indexterm>
 882       <indexterm significance="normal">
 883         <primary>power management</primary>
 884       </indexterm>
 885       <indexterm significance="normal">
 886         <primary>kaserver</primary>
 887       </indexterm>
 888       <para>The AFS Server functionality provided as part of the OpenAFS install package might work but should be considered highly experimental. It has not been thoroughly tested. Any data which would cause pain if lost should not be stored in an OpenAFS Server on Windows.</para>
 889       <para>Known issues include lack of support for power management and dynamic network configuration.  Salvager is also known to crash.</para>
 890       <section>
 891         <title id="OpenAFS_Server_Installation">3.11.1. OpenAFS Server Installation</title>
 892         <para>When the OpenAFS Server is installed, the TransarcAFSServer service (bosctlsvc.exe) will be installed and configured.  The TransarcAFSServer service will auto-start the traditional AFS bos server.  The former AFS Server Configuration wizard makes assumptions that no longer hold true and it has therefore been disabled.  However, following the instructions for installing the AFS Servers on UNIX it is possible to properly configure the AFS Servers on Microsoft Windows.  The AFS Server binaries, configuration files, and log files are installed under %Program Files%\OpenAFS\Server.
 893           <ulink url="http://www.openafs.org/no-more-des.html">kaserver has been deprecated and its use is strongly discouraged.</ulink>  Instead, Active Directory or some other Kerberos v5 KDC should be used in its place.
 894         </para>
 895       </section>
 896       <section>
 897         <title id="Using_the_AFS_Client_Service_with_OpenAFS_Server">3.11.2. Using the AFS Client Service when the Server is installed</title>
 898         <para>A few notes on the usage of the AFS Client Service if it is going to be used with the OpenAFS AFS Server:</para>
 899         <itemizedlist>
 900           <listitem>
 901             <para>Freelance mode should be disabled when the AFS Client Service is installed on the same machine as the AFS Server,. Otherwise, it will be impossible to manipulate the contents of the root.afs volume for the hosted cell without constructing an explicit mountpoint to the root.afs volume from another volume.</para>
 902           </listitem>
 903           <listitem>
 904             <para>The AFS Server and related tools only support the built in kaserver (Kerberos IV). If kaserver is being used,
 905               <ulink url="http://web.mit.edu/kerberos/">MIT Kerberos for Windows</ulink> should not be installed or must be disabled via the
 906               <link linkend="Value_EnableKFW">EnableKFW</link> registry value.
 907             </para>
 908           </listitem>
 909           <listitem>
 910             <para>The AFS Servers are not aware of power management events nor are they aware of network configuration changes.  It is strongly advised that the AFS servers be installed only on systems that will not be shutdown or suspended unexpectedly.   An inadvertent shutdown will corrupt volume data.</para>
 911           </listitem>
 912         </itemizedlist>
 913       </section>
 914     </section>
 915     <section>
 916       <title id="OpenAFS_Debug_Symbols">3.12. OpenAFS Debugging Symbols and Checked Builds</title>
 917       <indexterm significance="normal">
 918         <primary>debug symbols</primary>
 919       </indexterm>
 920       <indexterm significance="normal">
 921         <primary>checked builds</primary>
 922       </indexterm>
 923       <para>The OpenAFS for Windows installers include Debugging Symbol files which should be
 924         installed if you are experiencing problems and need to send crash reports or view OpenAFS
 925         stack traces within Process Explorer or Debug View. This is true for both the release and
 926         the debug versions of the installers. The difference between the release and debug versions
 927         are:</para>
 928       <itemizedlist>
 929         <listitem>
 930           <para>whether or not the binaries were compiled with optimization (release: yes, debug: no)</para>
 931         </listitem>
 932         <listitem>
 933           <para>whether or not the debug symbols are installed by default (release: no, debug: yes)</para>
 934         </listitem>
 935         <listitem>
 936           <para>whether or not
 937             <emphasis>fs trace</emphasis> logging is turned on by default (release: no, debug: yes)
 938           </para>
 939         </listitem>
 940         <listitem>
 941           <para>whether or not additional debug statements were compiled into the binaries (release: no, debug: yes)</para>
 942         </listitem>
 943       </itemizedlist>
 944     </section>
 945     <section>
 946       <title id="Large_File_Support">3.13. Large File (64-bit) Support</title>
 947       <indexterm significance="normal">
 948         <primary>large file support</primary>
 949       </indexterm>
 950       <indexterm significance="normal">
 951         <primary>64-bit file sizes</primary>
 952       </indexterm>
 953       <para>As of release 1.5.3, OpenAFS for Windows supports files larger than 2GB. The maximum
 954         file size is now 16777216 terabytes when the AFS File Server supports large files. If the
 955         AFS File Server does not support 64-bit file sizes, then the maximum size of files stored on
 956         that server remains 2GB.  </para>
 957     </section>
 958     <section>
 959       <title id="Encrypted_AFS_Network_Communication">3.14. Encrypted AFS Network Communication</title>
 960       <indexterm significance="normal">
 961         <primary>encryption</primary>
 962       </indexterm>
 963       <indexterm significance="normal">
 964         <primary>fs setcrypt</primary>
 965       </indexterm>
 966       <para>The OpenAFS for Windows installer by default activates a weak form of encrypted data transfer between the AFS client and the AFS servers. This is often referred to as "fcrypt" mode. Encrypted data transfer can be turned on or off with the "fs setcrypt" command. Transitions between "crypt" and "non-crypt" modes are logged to the Windows Application Event Log. </para>
 967     </section>
 968     <section>
 969       <title id="Authenticated_SMB_Access_to_Client_Service">3.15. Authenticated SMB Access to the OpenAFS Client Service</title>
 970       <indexterm significance="normal">
 971         <primary>SMB authentication</primary>
 972       </indexterm>
 973       <indexterm significance="normal">
 974         <primary>NTLM</primary>
 975       </indexterm>
 976       <indexterm significance="normal">
 977         <primary>GSS SPNEGO</primary>
 978       </indexterm>
 979       <para><emphasis>This section is maintained for historical reference and those sites that are manually configuring the OpenAFS Service to act as an SMB gateway.  This section does not apply when the OpenAFS IFS redirector driver is in use.</emphasis></para>
 980       <para>OpenAFS authenticates SMB connections using either NTLM or GSS SPNEGO (NTLM). In previous versions of OpenAFS, the SMB connections were unauthenticated which opened the door for several attacks which could be used to obtain access to another user's tokens on shared machines. </para>
 981       <para>When GSS SPNEGO attempts a Kerberos v5 authentication, the Windows SMB client will attempt to retrieve service tickets for "cifs/afs@REALM" (if the loopback adapter is in use) or "cifs/machine-afs@REALM" (if the loopback adapter is not being used). It is extremely important that this service principal not exist in the KDC database as the Kerberos authentication must fail allowing automatic fallback to NTLM. When NTLM is used a special local authentication mode will be used that does not require access to the user's password. Instead, Windows will internally recognize the request as coming from a local logon session.</para>
 982       <para>It should also be noted that because Kerberos v5 authentication cannot be used, it is not possible to digitally sign the SMB communications.   On systems that require Digital Signing of SMB Client connections, access to \\AFS will fail with a connection error.</para>
 983     </section>
 984     <section>
 985       <title id="No_More_INI_Files">3.16. IBM AFS INI Files Replaced By Windows Registry Keys</title>
 986       <indexterm significance="normal">
 987         <primary>INI files</primary>
 988       </indexterm>
 989       <indexterm significance="normal">
 990         <primary>CellServDB</primary>
 991       </indexterm>
 992       <indexterm significance="normal">
 993         <primary>AFSCONF</primary>
 994       </indexterm>
 995       <para>IBM AFS and OpenAFS 1.2 Windows clients stored configuration data in Windows .INI files. This OpenAFS client does not use Windows .INI files for the storage of configuration data. All settings are stored in the registry (see
 996         <link linkend="appendix_a">Appendix A</link>). The CellServDB file is now stored in either the %ALLUSERSPROFILE%\Application Data\OpenAFS\Client directory (aka \ProgramData\OpenAFS\Client on Vista\Win7\2008) or the %PROGRAMFILES%\OpenAFS\Client directory. The
 997         <link linkend="Value_CellServDBDir">CellServDBDir</link> registry value or the AFSCONF environment variable can be used to specify an alternative location.
 998       </para>
 999       <para>For users converting from IBM AFS clients, during installation OpenAFS will relocate the contents of the "afsdcell.ini" file to the new CellServDB file. OpenAFS will also import the contents of the "afs_freelance.ini" file to the Windows registry. OpenAFS will not process the contents of the "afsddbmt.ini".</para>
1000     </section>
1001     <section>
1002       <title id="Windows_Internet_Connection_Firewall">3.17. Microsoft Windows Internet Connection Firewall</title>
1003       <indexterm significance="normal">
1004         <primary>Windows Internet Connection Firewall</primary>
1005       </indexterm>
1006       <indexterm significance="normal">
1007         <primary>firewall</primary>
1008       </indexterm>
1009       <indexterm significance="normal">
1010         <primary>Back Connection</primary>
1011       </indexterm>
1012       <para>The OpenAFS Client is compatible with the Internet Connection Firewall that debuted with
1013         Windows XP SP2 and Windows 2003 SP1 and the Advanced Firewall that was introduced with
1014         Windows Vista. The Internet Connection Firewall will be automatically configured to allow
1015         the receipt of incoming callback messages from the AFS file server. In addition, if the
1016         OpenAFS Service is manually configured to behave as an SMB Gateway, the appropriate
1017           <emphasis>Back Connection</emphasis> registry entries are added to allow SMB
1018         authentication to be performed across the Microsoft Loopback Adapter. </para>
1019     </section>
1020     <section>
1021       <title id="Browsing_AFS_from_Explorer_Shell">3.18. Browsing AFS from the Explorer Shell and Office</title>
1022       <indexterm significance="normal">
1023         <primary>Explorer Shell</primary>
1024       </indexterm>
1025       <indexterm significance="normal">
1026         <primary>Microsoft Office</primary>
1027       </indexterm>
1028       <para>The OpenAFS Client Service implements the CIFS Remote Admin Protocol and the Microsoft RPC SVRSVC and WKSSVC services which allows Explorer to browse server and share information. This significantly enhances the interoperability of AFS volumes within the Explorer Shell and Microsoft Office applications.</para>
1029     </section>
1030     <section>
1031       <title id="Byte_Range_Locking">3.19. Byte Range Locking</title>
1032       <indexterm significance="normal">
1033         <primary>byte range locking</primary>
1034       </indexterm>
1035       <indexterm significance="normal">
1036         <primary>Microsoft Office</primary>
1037       </indexterm>
1038       <indexterm significance="normal">
1039         <primary>EnableServerLocks</primary>
1040       </indexterm>
1041       <para>Many applications on Windows (e.g. Microsoft Office) require the use of byte range locks applied to a file either to protect against simultaneous file access or as a signaling mechanism. OpenAFS for Windows release 1.5 (or greater) implements byte range locking within the CIFS-AFS gateway server. This support for byte range locking obtains AFS' advisory file server locks to simulate Microsoft Windows mandatory locks. When an application opens a file, a lock will be obtained from AFS indicating that the file is in use. If the lock is a write lock, access to the file will be restricted to other applications running on the same machine as the first application to request the lock. Applications running on other machines will see the AFS full file lock and will be unable to access the file.</para>
1042       <para>Most Windows applications and Windows itself opens files in shared read mode. When this is done, a read lock is applied to the file. This does not prevent shared read access across multiple machines but is used to ensure that no one writes to the file while it is in use.</para>
1043       <para>As the CIFS-AFS gateway server attempts to implement Windows lock semantics on top of AFS lock semantics it is important to understand how AFS file locks work. In Windows there are no special privileges associated with obtaining file locks. If you can read or execute a file, then you can obtain shared and exclusive locks. In general, a Windows shared lock equates to an AFS read lock and a Windows exclusive lock equates to an AFS write lock. In AFS if you can write to a file, then you can obtain a write lock. However, in AFS if you can read a file it does not mean that you can obtain a read lock on it. The ability to obtain read locks is granted only if you have the lock (or ‘k') privilege. This behavior is required in order to allow anonymous users to read files while preventing them from being able to deny access to the files to other users.
1044         <emphasis>OpenAFS 1.4.0 and earlier as well as all IBM AFS file servers have an implementation bug that prevents users with write privileges from being able to obtain locks without the lock privilege.</emphasis> When AFS serves data out of read-only volumes the file server will deny all requests for read and write locks because the contents of the volume cannot be changed by the client.
1045       </para>
1046       <para>Since Microsoft Windows applications almost always attempt to obtain a temporary exclusive lock when accessing files the OpenAFS Client's CIFS-AFS gateway implements the following semantics in order to reduce the inconvenience on end users. </para>
1047       <itemizedlist mark="bullet">
1048         <listitem>
1049           <para>If the file is located on a read-only volume and the application requests a shared lock, the CIFS-AFS server will grant the lock request without asking the AFS file server.</para>
1050         </listitem>
1051         <listitem>
1052           <para>If the file is located on a read-only volume and the application opens the file with write access and requests an exclusive lock, the CIFS-AFS server will refuse the lock request and return a read only error.</para>
1053         </listitem>
1054         <listitem>
1055           <para>If the file is located on a read-only volume and the application opens the file with only read access and requests an exclusive lock, the CIFS-AFS server will fulfill the lock request with a read lock.</para>
1056         </listitem>
1057         <listitem>
1058           <para>If the file is located on a read-write volume and the application requests an exclusive lock, the CIFS-AFS server will request a write lock from the AFS file server. If granted by the file server, then the CIFS-AFS server will grant the lock request. If the request is denied due to an access denied error and the user has the lookup, read and lock privileges and the file was opened for read only access, then the CIFS-AFS server will request a read lock from the file server. If the request is denied due to an access denied error and the user has the lookup and read privileges but not the lock privilege, then the CIFS-AFS server will grant the request even though the AFS file server said ‘no'. If the user does not have at least those permissions, the CIFS-AFS server will deny the request.</para>
1059         </listitem>
1060         <listitem>
1061           <para>If the file is located on a read-write volume and the application requests a shared lock, the CIFS-AFS server will request a read lock from the AFS file server. If granted by the file server, then the CIFS-AFS server grants the lock request. If the request is denied due to an access denied error and the user has the lookup and read privileges but not the lock privilege, then the CIFS-AFS server will grant the request even though the AFS file server said ‘no'. If the user does not have at least those permissions, the CIFS-AFS server will deny the request.</para>
1062         </listitem>
1063         <listitem>
1064           <para>If multiple processes on the same machine attempt to access the same file simultaneously, the CIFS-AFS server will locally manage the granted locks and all processes will share a single lock on the AFS file server.</para>
1065         </listitem>
1066         <listitem>
1067           <para>If the CIFS-AFS server is unable to renew the AFS file server locks, then it will invalidate the associated file handles. This is the same behavior that an application will experience if it was using a Windows File Share and the connection was broken. Invalidating the file handles prevents subsequent data corruption from taking place.</para>
1068         </listitem>
1069       </itemizedlist>
1070       <para>If you wish to disable the acquisition of locks from the file server, this can be performed using the
1071         <link linkend="Value_EnableServerLocks">EnableServerLocks</link> registry value.
1072       </para>
1073     </section>
1074     <section>
1075       <title id="Automatic_Discarding_of_Tokens_at_Logoff">3.20. Automatic Discarding of AFS Tokens at Logoff</title>
1076       <indexterm significance="normal">
1077         <primary>tokens</primary>
1078       </indexterm>
1079       <indexterm significance="normal">
1080         <primary>LogoffPreserveTokens</primary>
1081       </indexterm>
1082       <para><emphasis>This section does not apply unless the OpenAFS Service is manually configured as an SMB Gateway.</emphasis></para>
1083       <para>The OpenAFS Client will automatically forget a user's tokens upon Logoff unless the user's profile was loaded from an AFS volume. In this situation there is no mechanism to determine when the profile has been successfully written back to the network. It is therefore unsafe to release the user's tokens. Whether or not the profile has been loaded from the registry can be determined for Local Accounts, Active Directory accounts and NT4 accounts.</para>
1084       <para>If there is a need to disable this functionality, the
1085         <link linkend="Value_LogoffPreserveTokens">LogoffPreserveTokens</link> registry value can be used. (see
1086         <link linkend="appendix_a">Appendix A</link>.)
1087       </para>
1088     </section>
1089     <section>
1090       <title id="Windows_Terminal_Server_Installs">3.21. Windows Terminal Server installations</title>
1091       <indexterm significance="normal">
1092         <primary>Terminal Server</primary>
1093       </indexterm>
1094       <indexterm significance="normal">
1095         <primary>Installation</primary>
1096       </indexterm>
1097       <para>The OpenAFS Servers should not be installed on a machine with Terminal Server installed.
1098         The OpenAFS Client is fully compatible with Terminal Services.</para>
1099     </section>
1100     <section>
1101       <title id="Hidden_Dot_Files">3.22. Hidden Dot Files</title>
1102       <indexterm significance="normal">
1103         <primary>HideDotFiles</primary>
1104       </indexterm>
1105       <para>AFS is a UNIX native file system. The OpenAFS client attempts to treat the files stored in AFS as they would be on UNIX. File and directory names beginning with a "." are automatically given the Hidden attribute so they will not normally be displayed.  This behavior can be altered via the
1106         <link linkend="Value_HideDotFiles">HideDotFiles</link> registry value.
1107       </para>
1108     </section>
1109     <section>
1110       <title id="Status_Cache_Limits">3.23. Status Cache Limits</title>
1111       <indexterm significance="normal">
1112         <primary>afs_config.exe</primary>
1113       </indexterm>
1114       <indexterm significance="normal">
1115         <primary>AFS Configuration Control Panel</primary>
1116       </indexterm>
1117       <indexterm significance="normal">
1118         <primary>cache limits</primary>
1119       </indexterm>
1120       <indexterm significance="normal">
1121         <primary>Stats</primary>
1122       </indexterm>
1123       <para>The Status Cache (AFS Configuration Control Panel: Advanced Page) is defined to have a maximum number of entries. Each entry represents a single file or directory entry accessed within the AFS file system. When the maximum number of entries are allocated, entries will begin to be reused according to a least recently used (LRU) algorithm. If the number of files or directories being accessed repeatedly by your applications is greater then the maximum number of entries, your host will begin to experience thrashing of the Status Cache and all requests will result in network operations.</para>
1124       <para>If you are experiencing poor performance try increasing the maximum number of Status Cache entries. Each entry requires approximately 1.2K. The default number of Status Cache entries is 10,000.  This can be adjusted using the
1125         <link linkend="Value_Stats">Stats</link> registry value.
1126       </para>
1127     </section>
1128     <section>
1129       <title id="NETBIOS_over_TCP">3.24. NETBIOS over TCP/IP must be enabled</title>
1130       <indexterm significance="normal">
1131         <primary>NETBIOS over TCP</primary>
1132       </indexterm>
1133       <para><emphasis role="italic">This section only applies when the IFS client mode is
1134           disabled.</emphasis></para>
1135       <para>"Netbios over TCP/IP" must be active on the machine in order for communication with the AFS Client Service to succeed. If "Netbios over TCP/IP" is disabled on the machine, then communication with the AFS Client Service will be impossible.  If you are using the Microsoft Loopback Adapter, configure the "Netbios over TCP/IP" setting for the adapter.</para>
1136     </section>
1137     <section>
1138       <title id="OpenAFS_binaries_digital_signatures">3.25. OpenAFS binaries are digitally signed</title>
1139       <indexterm significance="normal">
1140         <primary>digital signatures</primary>
1141       </indexterm>
1142       <indexterm significance="normal">
1143         <primary>Your File System Inc.</primary>
1144       </indexterm>
1145       <indexterm significance="normal">
1146         <primary>Secure Endpoints Inc.</primary>
1147       </indexterm>
1148       <indexterm significance="normal">
1149         <primary>VerifyServiceSignature</primary>
1150       </indexterm>
1151       <para>The OpenAFS Client Service and related binaries distributed by OpenAFS.org are digitally signed by "Secure Endpoints Inc." or "Your File System Inc.". The OpenAFS Client Service will perform a run-time verification check to ensure that all OpenAFS related DLLs loaded by the service match the same file version number and were signed by the same entity. This check has been added to prevent the stability problems caused when more than one AFS installation is present on a machine simultaneously. Many hours of support time have been wasted tracking down problems caused by the mixture of files from different releases. </para>
1152       <para>
1153         <link linkend="appendix_a">Appendix A</link> documents the "
1154         <link linkend="Value_VerifyServiceSignature">VerifyServiceSignature</link>" registry value which can be used to disable the signature check. The file version check cannot be disabled.
1155       </para>
1156     </section>
1157     <section>
1158       <title id="Maximum_Cache_Size">3.26. Maximum Size of the AFSCache File</title>
1159       <indexterm significance="normal">
1160         <primary>cache size</primary>
1161       </indexterm>
1162       <para>The maximum cache size on 32-bit Windows is approximately 1.2GB. This is the largest contiguous block of memory in the 2GB process address space which can be used for constructing a memory mapped file. Due to fragmentation of the process space caused by the loading of libraries required by the digital signature verification code, any attempt to specify a cache size greater then 700MB will result in the automatic disabling of the signature check.  Significantly larger cache sizes can be used on 64-bit Windows.</para>
1163       <para>On 32-bit systems that have Apple Bonjour 1.0.6 installed, the maximum cache size is further constrained due design flaw in the Apple mdnsNSP.dll which is injected into all processes that use network services.  On these systems the maximum is approximately 512MB.</para>
1164     </section>
1165     <section>
1166       <title id="Filename_Character_Sets">3.27. Filename Character Sets</title>
1167       <indexterm significance="normal">
1168         <primary>character sets</primary>
1169       </indexterm>
1170       <indexterm significance="normal">
1171         <primary>StoreAnsiFilenames</primary>
1172       </indexterm>
1173       <para><emphasis>This section describes functionality and concerns related to pre-1.5.50 releases of OpenAFS for Windows.   This release stores all file names on the file servers as Unicode encoded using UTF-8.</emphasis></para>
1174       <para>OpenAFS for Windows implements an SMB server which is used as a gateway to the AFS filesystem. Because of limitations of the SMB implementation in pre-1.5.50 releases, Windows stored all files into AFS using OEM code pages such as CP437 (United States) or CP850 (Western Europe). These code pages are incompatible with the ISO Latin-1 or Unicode (UTF-8) character sets typically used as the default on UNIX systems in both the United States and Western Europe. Filenames stored by OpenAFS for Windows were therefore unreadable on UNIX systems if they include any of the following characters:</para>
1175       <informaltable frame="all">
1176         <tgroup rowsep="1" align="left" colsep="1" cols="1">
1177           <colspec colwidth="442pt" colname="c1"/>
1178           <tbody>
1179             <row>
1180               <entry>
1181                 <para> [Ç] 128 08/00 200 80 C cedilla</para>
1182                 <para> [ü] 129 08/01 201 81 u diaeresis</para>
1183                 <para> [é] 130 08/02 202 82 e acute</para>
1184                 <para> [â] 131 08/03 203 83 a circumflex</para>
1185                 <para> [ä] 132 08/04 204 84 a diaeresis</para>
1186                 <para> [à] 133 08/05 205 85 a grave</para>
1187                 <para> [å] 134 08/06 206 86 a ring</para>
1188                 <para> [ç] 135 08/07 207 87 c cedilla</para>
1189                 <para> [ê] 136 08/08 210 88 e circumflex</para>
1190                 <para> [ë] 137 08/09 211 89 e diaeresis</para>
1191                 <para> [è] 138 08/10 212 8A e grave</para>
1192                 <para> [ï] 139 08/11 213 8B i diaeresis</para>
1193                 <para> [î] 140 08/12 214 8C i circumflex</para>
1194                 <para> [ì] 141 08/13 215 8D i grave</para>
1195                 <para> [Ä] 142 08/14 216 8E A diaeresis</para>
1196                 <para> [Å] 143 08/15 217 8F A ring</para>
1197                 <para> [É] 144 09/00 220 90 E acute</para>
1198                 <para> [æ] 145 09/01 221 91 ae diphthong</para>
1199                 <para> [Æ] 146 09/02 222 92 AE diphthong</para>
1200                 <para> [ô] 147 09/03 223 93 o circumflex</para>
1201                 <para> [ö] 148 09/04 224 94 o diaeresis</para>
1202                 <para> [ò] 149 09/05 225 95 o grave</para>
1203                 <para> [û] 150 09/06 226 96 u circumflex</para>
1204                 <para> [ù] 151 09/07 227 97 u grave</para>
1205                 <para> [ÿ] 152 09/08 230 98 y diaeresis</para>
1206                 <para> [Ö] 153 09/09 231 99 O diaeresis</para>
1207                 <para> [Ü] 154 09/10 232 9A U diaeresis</para>
1208                 <para> [ø] 155 09/11 233 9B o slash</para>
1209                 <para> [£] 156 09/12 234 9C Pound sterling sign</para>
1210                 <para> [Ø] 157 09/13 235 9D O slash</para>
1211                 <para> [×] 158 09/14 236 9E Multiplication sign</para>
1212                 <para> [ƒ] 159 09/15 237 9F Florin sign</para>
1213               </entry>
1214             </row>
1215           </tbody>
1216         </tgroup>
1217       </informaltable>
1218       <para>The pre-1.5.50 OpenAFS Client provided an optional registry value,
1219         <link linkend="Value_StoreAnsiFilenames">StoreAnsiFilenames</link>, that could be set to instruct OpenAFS to store filenames using the ANSI Code Page instead of the OEM Code Page. The ANSI Code Page is a compatible superset of Latin-1. This setting is not the default setting because making this change would prevent OpenAFS for Windows from being able to access filenames containing the above characters which were created without this setting.
1220       </para>
1221       <para>All versions of OpenAFS for Windows 1.5.50 and above exchange file names with Microsoft Windows using the Unicode character set. All file names are read from and stored to AFS file servers using the UTF-8 encoding of Unicode. As a result the
1222         <link linkend="Value_StoreAnsiFilenames">StoreAnsiFilenames</link> option is no longer supported.
1223       </para>
1224     </section>
1225     <section>
1226       <title id="Character_Set_Issues_Roaming_Profiles">3.28. Character Set Issues with Roaming Profiles</title>
1227       <indexterm significance="normal">
1228         <primary>character sets</primary>
1229       </indexterm>
1230       <indexterm significance="normal">
1231         <primary>roaming profiles</primary>
1232       </indexterm>
1233       <para><emphasis>This section describes functionality and concerns related to pre-1.5.50 releases of OpenAFS for Windows.   This release stores all file names on the file servers as Unicode encoded using UTF-8.</emphasis></para>
1234       <para>There is a known issue with storing Windows Roaming Profiles when the profile contains either directories or files with names which cannot be represented in the local OEM character set. In this case, attempts to write the profile back to AFS will fail during the character set conversion. The pre-1.5.50 OpenAFS Client's CIFS gateway did not support UNICODE. To avoid this problem some sites run custom logoff scripts (assigned by group policy) which rename all files to use only the supported characters for the locale.</para>
1235       <para>Versions of OpenAFS for Windows 1.5.50 and above do not suffer from these issues.</para>
1236     </section>
1237     <section>
1238       <title id="AFSCache_File">3.29. The AFSCache File</title>
1239       <indexterm significance="normal">
1240         <primary>AFSCache</primary>
1241       </indexterm>
1242       <indexterm significance="normal">
1243         <primary>cache file</primary>
1244       </indexterm>
1245       <indexterm significance="normal">
1246         <primary>SysInternals</primary>
1247       </indexterm>
1248       <para>The AFS Cache file is stored by default at %TEMP%\AFSCache in a persistent file marked with the Hidden and System attributes. The persistent nature of the data stored in the cache file improves the performance of OpenAFS by reducing the number of times data must be read from the AFS file servers. </para>
1249       <para>The performance of the AFS Client Service is significantly affected by the access times associated with the AFSCache paging file. When given the choice, the AFSCache file should be placed on a fast disk, preferably formatted NTFS and using a Solid State Disk, the file should not be compressed and should consist of as few fragments as possible. Significant performance gains can be achieved by defragmenting the AFSCache file with SysInternal's Contig utility while the AFS Client Service is stopped.</para>
1250     </section>
1251     <section>
1252       <title id="Restricting_OpenAFS_Service_Start_and_Stop">3.30. Restricting OpenAFS Client Service Start and Stop</title>
1253       <indexterm significance="normal">
1254         <primary>service start restrictions</primary>
1255       </indexterm>
1256       <indexterm significance="normal">
1257         <primary>TransarcAFSDaemon</primary>
1258       </indexterm>
1259       <indexterm significance="normal">
1260         <primary>afsdacl.exe</primary>
1261       </indexterm>
1262       <para>A command line tool, afsdacl.exe, can be used to restrict the ability to start and stop the OpenAFS Client Service.</para>
1263       <para>
1264         <programlisting format="linespecific">
1265     afsdacl : Set or reset the DACL to allow starting or stopping
1266               the afsd service by any ordinary user.
1267
1268     Usage: afsdacl [-set | -reset] [-show]
1269            -set   : Sets the DACL
1270            -reset : Reset the DACL
1271            -show  : Show current DACL (SDSF)
1272     </programlisting>
1273       </para>
1274     </section>
1275     <section>
1276       <title id="SysName_List">3.31. The @sys Name List</title>
1277       <indexterm significance="normal">
1278         <primary>@sys</primary>
1279       </indexterm>
1280       <indexterm significance="normal">
1281         <primary>fs sysname</primary>
1282       </indexterm>
1283       <indexterm significance="normal">
1284         <primary>SysName</primary>
1285       </indexterm>
1286       <para>The default @sys name list in the OpenAFS Client is set to "x86_win32 i386_w2k i386_nt40" for 32-bit x86 systems. The default is "amd64_win64" for amd 64-bit versions of Windows.</para>
1287       <para>The IFS redirector driver is aware of the process type. On 64-bit systems, there are two
1288         @sys name lists "SysName" which is used for the WOW64 environment and "SysName64" which is
1289         used for the 64-bit environment.  If "SysName64" is not provided, "SysName" is used for all
1290         processes.</para>
1291     </section>
1292     <section>
1293       <title id="Symlinks_to_AFS_UNC_Paths">3.32. Symlinks to AFS UNC Paths</title>
1294       <indexterm significance="normal">
1295         <primary>UNC paths</primary>
1296       </indexterm>
1297       <indexterm significance="normal">
1298         <primary>symlinks</primary>
1299       </indexterm>
1300       <indexterm significance="normal">
1301         <primary>path separators</primary>
1302       </indexterm>
1303       <indexterm significance="normal">
1304         <primary>symlink.exe</primary>
1305       </indexterm>
1306       <indexterm significance="normal">
1307         <primary>symlink make</primary>
1308       </indexterm>
1309       <para>In OpenAFS, symlinks to AFS UNC paths, \\AFS[\all]\..., are treated the same as symlinks to /afs/... However, please use /afs/... as the Windows UNC form will not work on UNIX client.</para>
1310       <para>The <emphasis>symlink make</emphasis> command will automatically translate \\AFS\... to /afs/... for you.</para>
1311     </section>
1312     <section>
1313       <title id="Cache_Manager_Debugging">3.33. Cache Manager Debugging</title>
1314       <indexterm significance="normal">
1315         <primary>debugging the cache manager</primary>
1316       </indexterm>
1317       <indexterm significance="normal">
1318         <primary>cmdebug.exe</primary>
1319       </indexterm>
1320       <para>The OpenAFS Client implements the Cache Manager Debugging RPC Interface. The CM debugger can be queried with <ulink url="http://docs.openafs.org/Reference/1/cmdebug.html">cmdebug.exe</ulink>.  </para>
1321       <para>
1322         <programlisting format="linespecific">
1323     Usage: cmdebug -servers &lt;server machine&gt; [-port &lt;IP port&gt;] [-long] [-refcounts]
1324                     [-callbacks] [-ctime] [-addrs] [-cache] [-cellservdb] [-help]
1325     Where: -long        print all info
1326            -refcounts   print only cache entries with positive reference counts
1327            -callbacks   print only cache entries with callbacks
1328            -ctime       print human readable expiration time
1329            -addrs       print only host interfaces
1330            -cache       print only cache configuration
1331            -cellservdb  print only cellservdb info
1332     </programlisting>
1333       </para>
1334     </section>
1335     <section>
1336       <title id="Windows_Logon_Caching_vs_Kerberos_Logons">3.34. Windows Logon Caching vs. Kerberos Logons</title>
1337       <indexterm significance="normal">
1338         <primary>windows logon caching</primary>
1339       </indexterm>
1340       <indexterm significance="normal">
1341         <primary>kerberos</primary>
1342       </indexterm>
1343       <para>If you are a site which utilizes MIT/Heimdal Kerberos principals to logon to Windows via a cross-realm relationship with a multi-domain Windows forest, you must enable Windows logon caching unless the workstation is Windows Vista or Windows 7.</para>
1344     </section>
1345     <section>
1346       <title id="Initial_Server_Preferences">3.35. Initial Server Preferences</title>
1347       <indexterm significance="normal">
1348         <primary>server preferences</primary>
1349       </indexterm>
1350       <indexterm significance="normal">
1351         <primary>fs setserverprefs</primary>
1352       </indexterm>
1353       <indexterm significance="normal">
1354         <primary>setting server preferences</primary>
1355       </indexterm>
1356       <para>VLDB and File Server Preferences can now be provided initial values using registry keys. This is useful for managed machines in a Windows domain which are centrally located (e.g., in a computing lab.) See
1357         <link linkend="appendix_a">Appendix A</link> for details on the "
1358         <link linkend="Regkey_HKLM_SOFTWARE_OpenAFS_Client_ServerPreferences_VLDB">Server Preferences</link>" keys.
1359       </para>
1360     </section>
1361     <section>
1362       <title id="File_Timestamps_and_DST">3.36. File Timestamps and Daylight Saving Time</title>
1363       <indexterm significance="normal">
1364         <primary>timestamps</primary>
1365       </indexterm>
1366       <indexterm significance="normal">
1367         <primary>DST</primary>
1368       </indexterm>
1369       <indexterm significance="normal">
1370         <primary>UTC</primary>
1371       </indexterm>
1372       <para>The OpenAFS Client reports timestamps on files stored in AFS in UTC all year round. In locales with daylight savings time, previous versions of AFS for Windows reported the time when DST is active as UTC+1. This was done to preserve the relative local time for the user. A file stored at 11:00am EST in January would be reported as having been stored at 11:00am EDT in June. Unfortunately, this has the negative side effect of changing the reported timestamp from 16:00UTC to 15:00UTC. Since Windows treats all file times in UTC, data synchronization applications which rely on the timestamp would believe that all files stored in AFS had changed.</para>
1373       <para>It should be noted that UNIX based operating systems (such as Solaris) do not appear to report file times to applications in UTC. They do preserve the relative local time. This may confuse some users who are used to being able to compare the timestamp in an UNIX shell with the timestamp from the Windows explorer. During DST, these two times will no longer agree even though they are in fact representing the same moment in time.</para>
1374     </section>
1375     <section>
1376       <title id="Windows_RPC_client_support">3.37. Windows RPC client support must be installed </title>
1377       <indexterm significance="normal">
1378         <primary>RPC client support</primary>
1379       </indexterm>
1380       <para>If the installer refuses to install and complains about an RPC configuration error, check to ensure that the following registry entries are present and that they refer to the dll "rpcrt4.dll":</para>
1381       <para> HKLM "SOFTWARE\Microsoft\RPC\ClientProtocols" "ncacn_np"</para>
1382       <para> HKLM "SOFTWARE\Microsoft\RPC\ClientProtocols" "ncacn_ip_tcp"</para>
1383       <para> HKLM "SOFTWARE\Microsoft\RPC\ClientProtocols" "ncadg_ip_udp"</para>
1384       <para> HKLM "SOFTWARE\Microsoft\RPC\ClientProtocols" "ncacn_http"</para>
1385     </section>
1386     <section>
1387       <title id="Generating_Minidumps">3.38. Generating Minidumps of the OpenAFS Client Service</title>
1388       <indexterm significance="normal">
1389         <primary>minidumps</primary>
1390       </indexterm>
1391       <indexterm significance="normal">
1392         <primary>fs minidump</primary>
1393       </indexterm>
1394       <para>OpenAFS 1.4 added a new command, "fs minidump". This command can be used at any time to generate a mini dump file containing the current stack of the afsd_service.exe process. This output can be very helpful when debugging the AFS Client Service when it is unresponsive to SMB/CIFS requests.</para>
1395     </section>
1396     <section>
1397       <title id="AFS_UUIDs_vs_System_Cloning">3.39. AFS Client Universally Unique Identifiers (UUIDs) vs. System Cloning or Virtual Machine Cloning</title>
1398       <indexterm significance="normal">
1399         <primary>UUIDs</primary>
1400       </indexterm>
1401       <indexterm significance="normal">
1402         <primary>system cloning</primary>
1403       </indexterm>
1404       <indexterm significance="normal">
1405         <primary>vm cloning</primary>
1406       </indexterm>
1407       <indexterm significance="normal">
1408         <primary>NonPersistentCaching</primary>
1409       </indexterm>
1410       <indexterm significance="normal">
1411         <primary>instloop.exe</primary>
1412       </indexterm>
1413       <indexterm significance="normal">
1414         <primary>msiexec.exe</primary>
1415       </indexterm>
1416       <para>The OpenAFS Client implements Universally Unique Identifiers (UUIDs). They are used to provide the AFS file server with a method of identifying the client that is independent of IP address. This permits the AFS file server to track mobile clients or those behind Network Address Translators when they move from address to address or port to port. Tracking the client improves client performance by permitting callback state to be maintained across location changes. The UUID is generated when the AFSCache file is created and is maintained as long as the contents of the AFSCache file are valid. The UUID is stored in the AFSCache file.</para>
1417       <para>When cloning machines that have Windows AFS client installed it is necessary to generate a new UUID for each client. This will be done automatically if the Windows Machine SID is re-generated using Microsoft SysPrep. If the SID is not being re-generated either the AFSCache file should be deleted or the command
1418         <emphasis>fs uuid -generate</emphasis> must be executed after the the clone is created.
1419         <emphasis role="bold">Multiple AFS clients reporting the same UUID will not only result in horrible AFS client performance and cache inconsistencies, but they will also put a tremendous strain on the AFS file servers.</emphasis></para>
1420       <para>For lab environments that wish to erase all cached data on each restart, the
1421         <link linkend="Value_NonPersistentCaching">NonPersistentCaching</link> option will disable the use of the persistent cache file. As a side effect, a new UUID will be generated for the AFS client service on each restart.
1422       </para>
1423       <para><emphasis role="italic">[SMB only]</emphasis> When a Windows system is cloned, the
1424         Microsoft Loopback Adapter will be disabled in the cloned system. Administrators must
1425         re-install the Microsoft Loopback Adapter within the cloned environment. This can be
1426         automated by using the OpenAFS " <emphasis>instloop.exe</emphasis> – <emphasis>i</emphasis>"
1427         command. Instloop.exe can be extracted from the MSI installer by performing an
1428         administrative install via <emphasis>msiexec.exe /a</emphasis>. </para>
1429     </section>
1430     <section>
1431       <title id="Delayed_Write_Errors">3.40. Delayed Write Errors with Microsoft Office Applications</title>
1432       <indexterm significance="normal">
1433         <primary>delayed write errors</primary>
1434       </indexterm>
1435       <indexterm significance="normal">
1436         <primary>ConnDeadTimeout</primary>
1437       </indexterm>
1438       <indexterm significance="normal">
1439         <primary>SMBAsyncStoreSize</primary>
1440       </indexterm>
1441       <indexterm significance="normal">
1442         <primary>EnableSMBAsyncStore</primary>
1443       </indexterm>
1444       <indexterm significance="normal">
1445         <primary>SMB timeouts</primary>
1446       </indexterm>
1447       <para><emphasis>This section does not apply unless the OpenAFS Service is manually configured as an SMB Gateway.</emphasis></para>
1448       <para>Microsoft Office makes heavy use of asynchronous input/output methods for reading and writing to file streams. This can result in hundreds of requests being simultaneously queued for service by the CIFS client with a fixed timeout period. As the AFS CIFS server is local to the machine the Windows CIFS client believes that it can respond almost instantaneously to write requests as the actual writing to the AFS file server is performed by a background daemon thread. When the actual network bandwidth to the AFS file server is slow and the file size is large it is possible for the CIFS client to time out the connection. When this happens a "delayed write error" will be reported to the user and the application may crash. The only workaround at the current time is to save first to a local disk and subsequently copy the file to AFS as copying a file with the explorer shell does not use asynchronous i/o. </para>
1449       <para>The CIFS session timeout defaults to 45 seconds and can be increased by modifying the
1450         <link linkend="Value_ConnDeadTimeout">ConnDeadTimeout registry value</link>.
1451       </para>
1452       <para>Beginning with the 1.5.33 release, the performance characteristics of SMB Write Data operations can be adjusted.  In prior releases all writes were performed using a restricted asynchronous store model in which only one asynchronous store operation per file can be performed at a time.  The reason for this restriction is limit the amount of data the cache manager will accept without it having been written to the file server.  If too much unwritten data is accepted, the file close operation will block until all of the unwritten data is output and this could trigger a CIFS client disconnect.  </para>
1453       <para>Prior to 1.5.33 the size of the asynchronous store was always equal to the chunk size which was often too large for low bandwidth connections.  The asynchronous store size now defaults to 32KB and is configurable using the
1454         <link linkend="Value_SMBAsyncStoreSize">SMBAsyncStoreSize</link> registry value.  Asynchronous store operations can also be disabled using the
1455         <link linkend="Value_EnableSMBAsyncStore">EnableSMBAsyncStore</link> registry value in which case all writes received by the cache manager block until the Rx StoreData operation completes.
1456       </para>
1457       <para>During the first quarter of 2009 Microsoft added new functionality to the SMB Redirector which permits an extended timeout period to be used
1458             for an enumerated list of Netbios server names.  This functionality was distributed in Service Pack 2 for Vista and 2008 and is incorporated
1459             into the RTM releases of Windows 7 and Server 2008 R2.  Updates to Windows XP (KB916204), XP64 (KB969289), and Server 2003 (KB969289) were
1460             made available as hot fixes.  When this support is available, the OpenAFS for Windows client 1.5.61 and above will raise the timeout period
1461             from 45 seconds to 10 minutes.</para>
1462     </section>
1463     <section>
1464       <title id="Global_Drives">3.41. Global Drives (aka Service Drive Letters) are no longer supported by Microsoft</title>
1465       <indexterm significance="normal">
1466         <primary>global drives</primary>
1467       </indexterm>
1468       <indexterm significance="normal">
1469         <primary>service drive letters</primary>
1470       </indexterm>
1471       <indexterm significance="normal">
1472         <primary>path ioctl failures</primary>
1473       </indexterm>
1474       <para>The Global Drive auto-mount feature has been deprecated due to the following Microsoft
1475         KB article.</para>
1476       <para>
1477         <ulink url="http://msdn.microsoft.com/library/en-us/dllproc/base/services_and_redirected_drives.asp">http://msdn.microsoft.com/library/en-us/dllproc/base/services_and_redirected_drives.asp</ulink>
1478       </para>
1479       <para>The article says that services mounting drive letters are no longer supported by Microsoft and may act unpredictably.
1480             The experience other users have had is that if the connection to the OpenAFS CIFS/SMB server is terminated by the
1481             Windows CIFS client, the drive mapping may not be re-established until the machine is rebooted.</para>
1482       <para>OpenAFS supports UNC paths and whenever possible applications should be modified to use UNC form
1483             \\AFS\&lt;cellname&gt;\&lt;path&gt; instead of drive letters.</para>
1484       <para>Another problem with service mounted drive letters is that the drives are reported as local disk devices
1485             and cannot be resolved as being mapped to the \\AFS name space.  As a result, AFS path ioctl operations will
1486             fail.  The fs.exe and symlink.exe command line tools and the AFS Explorer Shell extension will not operate
1487             on service mounted drive letters.</para>
1488     </section>
1489     <section>
1490       <title id="SixtyFour-bit_Windows">3.42. 64-bit Microsoft Windows Installations</title>
1491       <indexterm significance="normal">
1492         <primary>64-bit Windows</primary>
1493       </indexterm>
1494       <para>Although 64-bit Windows platforms support both 64-bit and 32-bit applications, the OpenAFS Service installed on the machine must be 64-bit. The 64-bit installer contains only 64-bit executables. In order to support 32-bit applications it is required that a separate 32-bit OpenAFS Tools set be installed.  This is especially true when the IFS redirector is in use as the 32-bit Network Provider DLL must be installed in order for 32-bit applications to access drive letters mapped to \\AFS.</para>
1495       <para>OpenAFS on 64-bit Windows benefits from the lifting of the 2GB process memory restriction that is present in 32-bit Windows. Without this restriction the AFS Cache File can become arbitrarily large limited only by available disk space.</para>
1496     </section>
1497     <section>
1498       <title id="Windows_Vista_Known_Issues">3.43. Known Issues with Microsoft Windows Vista,
1499         Windows 7, Server 2008 [R2], Windows 8 and Server 2012</title>
1500       <indexterm significance="normal">
1501         <primary>windows vista</primary>
1502       </indexterm>
1503       <indexterm significance="normal">
1504         <primary>windows 2008</primary>
1505       </indexterm>
1506       <indexterm significance="normal">
1507         <primary>windows 7</primary>
1508       </indexterm>
1509       <para>Windows Vista, Windows 7, and Server 2008 [R2] implement
1510         <ulink url="http://www.microsoft.com/technet/windowsvista/library/0d75f774-8514-4c9e-ac08-4c21f5c6c2d9.mspx">User Account Control</ulink> (UAC), a new security feature that implements least user privilege.  With UAC, applications only run with the minimum required privileges.  Even Administrator accounts run applications without the "Administrator" access control credentials.  One side effect of this is that existing applications that mix user and system configuration capabilities must be re-written to separate those functions that require "Administrator" privileges into a separate process space.  Future updates to OpenAFS will incorporate the necessary privilege separation, until that time some functions such as the Start and Stop Service features of the AFS Authentication Tool and the AFS Control Panel will not work unless they are "Run as Administrator".  When a Vista user account that is a member of the "Administrators" group is used to access the AFS Control Panel (afs_config.exe), the process must be "Run as Administrator".   Otherwise, attempts to modify the OpenAFS configuration will appear to succeed but in reality will have failed due to Vista's system file and registry virtualization feature.
1511       </para>
1512       <para>The help files provided with OpenAFS are in .HLP format. <ulink
1513           url="http://support.microsoft.com/kb/917607">Windows Vista, Windows 7, Server 2008 [R2],
1514           Windows 8 and Server 2012 do not include a help engine for this format.</ulink>
1515       </para>
1516       <para><emphasis>The following items only apply when the OpenAFS Service is manually configured as an SMB Gateway.</emphasis></para>
1517       <para>OpenAFS for Windows works with Microsoft Windows Vista, Windows 7 and Server 2008 [R2] from both the command prompt and the Explorer Shell.
1518             When performing an upgrade from earlier versions of Microsoft Windows the Microsoft Loopback Adapter (MSLA) will be uninstalled.
1519             OpenAFS should be re-installed after the Windows Upgrade installation to restore the MSLA configuration.</para>
1520       <para>Due to a feature change in Windows Vista's Plug-n-Play network stack, during a standby/hibernate operation the
1521             MSLA is disabled just as any other hardware device would be.  This causes the OpenAFS Client's network binding to be lost.
1522             As a result, it takes anywhere from 30 to 90 seconds after the operating system is resumed for access to the OpenAFS Client
1523             and the AFS file name space to be restored.  Until the network bindings have been re-established, ticket managers and other
1524             tools will report that the "AFS Client Service may not have been started".</para>
1525     </section>
1526     <section>
1527       <title id="AFS_Share_Direct_Access_to_Volumes">3.44. AFS Share Name Syntax Provides Direct Access to Volumes</title>
1528       <indexterm significance="normal">
1529         <primary>share names</primary>
1530       </indexterm>
1531       <indexterm significance="normal">
1532         <primary>afs volumes - direct access</primary>
1533       </indexterm>
1534       <para>Starting with the 1.5.21 release of OpenAFS for Windows, the following syntax can be used to access any volume in any cell without requiring the creation of a mount point.</para>
1535       <para>\\AFS\&lt;cell&gt;&lt;mount point type&gt;&lt;volume&gt;\</para>
1536       <para>Where &lt;cell&gt; can be either a full cell name or an unambiguous prefix, the &lt;mount point type&gt; is '#' for a normal mount point or '%' to force the use of a read-write volume, and &lt;volume&gt; is either a volume name or its ID number.</para>
1537       <para>Examples include:</para>
1538       <para>    \\AFS\athena.mit.edu#user.jaltman\</para>
1539       <para>    \\AFS\athena%user.jaltman\</para>
1540       <para>    \\AFS\athena.mit.edu# 537235559\</para>
1541     </section>
1542     <section>
1543       <title id="Differences_between_Windows_and_Unix">3.45. Differences between Windows and UNIX <emphasis>fs examine</emphasis></title>
1544       <indexterm significance="normal">
1545         <primary>fs examine</primary>
1546       </indexterm>
1547       <indexterm significance="normal">
1548         <primary>fs chown</primary>
1549       </indexterm>
1550       <indexterm significance="normal">
1551         <primary>fs chgrp</primary>
1552       </indexterm>
1553       <indexterm significance="normal">
1554         <primary>fs chmod</primary>
1555       </indexterm>
1556       <indexterm significance="normal">
1557         <primary>owner information</primary>
1558       </indexterm>
1559       <indexterm significance="normal">
1560         <primary>group information</primary>
1561       </indexterm>
1562       <para>The OpenAFS for Windows version of "fs examine" provide two additional lines of output when compared to the
1563         UNIX implementation.  These lines include the owner and group information for the file as well as the volume status.
1564         The Windows output will also indicate the type of object {File, Directory, Mountpoint, Symlink, ...} that was examined.</para>
1565       <para>[C:\]fs examine \\afs\athena#user.jaltman</para>
1566       <para>Directory \\afs\athena#user.jaltman (537235559.1.1) contained in cell athena.mit.edu</para>
1567       <para>
1568         <emphasis role="bold">Owner jaltman (28180) Group jaltman (28180)</emphasis>
1569       </para>
1570       <para>Volume status for vid = 537235559 named user.jaltman is</para>
1571       <para>Current disk quota is 1500000</para>
1572       <para>Current blocks used are 1244184</para>
1573       <para>The partition has 151945877 blocks available out of 511163724</para>
1574       <para>
1575         <emphasis role="bold">Volume is online</emphasis>
1576       </para>
1577       <para>
1578       </para>
1579       <para>The object owner and group and UNIX mode information is not available on Microsoft Windows via any other method.</para>
1580       <para>To set the owner use <emphasis>fs chown -owner &lt;user name or id&gt; [-path &lt;dir/file path&gt;+] [-literal]</emphasis></para>
1581       <para>To set the group use <emphasis>fs chgrp -group &lt;user name or id&gt; [-path &lt;dir/file path&gt;+] [-literal]</emphasis></para>
1582       <para>To set the UNIX mode use <emphasis>fs chmod -mode &lt;UNIX mode bits&gt; [-path &lt;dir/file path&gt;+] [-literal]</emphasis></para>
1583     </section>
1584     <section>
1585       <title id="fs_Command_Literal_Option">3.46. Literal evaluation of AFS Symlink and MountPoint objects via fs commands</title>
1586       <indexterm significance="normal">
1587         <primary>-literal</primary>
1588       </indexterm>
1589       <indexterm significance="normal">
1590         <primary>fs examine</primary>
1591       </indexterm>
1592       <indexterm significance="normal">
1593         <primary>fs flush</primary>
1594       </indexterm>
1595       <indexterm significance="normal">
1596         <primary>fs whereis</primary>
1597       </indexterm>
1598       <indexterm significance="normal">
1599         <primary>fs whichcell</primary>
1600       </indexterm>
1601       <para>Beginning with the 1.5.31 release, the fs commands <emphasis>examine</emphasis>,
1602           <emphasis>flush</emphasis>, <emphasis>getuseraccess</emphasis>, <emphasis>whereis</emphasis>, and
1603           <emphasis>whichcell</emphasis> provide a new command-line parameter,
1604           <emphasis>-literal</emphasis>. When specified, if the evaluated object is a symlink or a
1605         mountpoint the resulting output will describe the specified object and not the target of the
1606         symlink or mountpoint. </para>
1607     </section>
1608     <section>
1609       <title id="Out_of_Quota_Errors">3.47. Out of Quota errors</title>
1610       <indexterm significance="normal">
1611         <primary>out of quota</primary>
1612       </indexterm>
1613       <indexterm significance="normal">
1614         <primary>quotas</primary>
1615       </indexterm>
1616       <para>Prior to the 1.5.31 release, out of quota errors were reported to the calling application as an out of space error.  As of 1.5.31, an out of space error will indicate that the partition on which the volume is located is in fact out of space.  Whereas an out of quota error indicates that the user does not have permission to allocate additional space.</para>
1617     </section>
1618     <section id="Linked_Cells">
1619       <title>3.48. Linked Cells</title>
1620       <indexterm significance="normal">
1621         <primary>linked cells</primary>
1622       </indexterm>
1623       <indexterm significance="normal">
1624         <primary>cell renaming</primary>
1625       </indexterm>
1626       <indexterm significance="normal">
1627         <primary>cell splitting</primary>
1628       </indexterm>
1629       <indexterm significance="normal">
1630         <primary>cell merging</primary>
1631       </indexterm>
1632       <indexterm significance="normal">
1633         <primary>CellServDB</primary>
1634       </indexterm>
1635       <para>The 1.5.55 release adds support for linked cells as implemented in the Unix OpenAFS client.  When two cells are linked, a volume lookup in one cell that fails is retried in the linked cell.  This functionality can be used to implement:</para>
1636       <itemizedlist mark="bullet">
1637         <listitem>
1638           <para>a test cell which provides substitutes for a subset of the volumes in the linked production cell</para>
1639         </listitem>
1640         <listitem>
1641           <para>a cell renaming</para>
1642         </listitem>
1643         <listitem>
1644           <para>a cell splitting</para>
1645         </listitem>
1646         <listitem>
1647           <para>a cell merger</para>
1648         </listitem>
1649       </itemizedlist>
1650       <para>Two cells are linked in the CellServDB file:</para>
1651       <para>
1652         <programlisting format="linespecific">
1653        &gt;cell-one     cell-two        #Description
1654        ...
1655        &gt;cell-two     cell-one        #Description
1656        ...
1657        </programlisting>
1658       </para>
1659       <para>aklog and Network Identity Manager will automatically obtain tokens for the linked cell when tokens for the other cell is specified.
1660       </para>
1661     </section>
1662     <section id="Registry_VLDB_Configuration">
1663       <title>3.49 Registry Alternative to CellServDB File</title>
1664       <indexterm significance="normal">
1665         <primary>vldb server locations</primary>
1666       </indexterm>
1667       <indexterm significance="normal">
1668         <primary>CellServDB</primary>
1669       </indexterm>
1670       <para>Beginning with the 1.5.60 release, the <link linkend="Regkey_HKLM_SOFTWARE_OpenAFS_Client_CellServDB">[HKLM\SOFTWARE\OpenAFS\Client\CellServDB]</link>
1671     registry key can be used to distribute Volume Database Server location information either as a supplement to the <emphasis>CellServDB file</emphasis> or
1672     as a substitute for it.  The precedence order for lookups is: Registry, File, and then DNS.</para>
1673     </section>
1674     <section>
1675       <title id="HTMLHelp_Documentation">3.50 Release Notes Converted to Windows HTML Help</title>
1676       <indexterm significance="normal">
1677         <primary>HTMLHelp</primary>
1678       </indexterm>
1679       <para>Starting with the 1.5.60 release, this document, the OpenAFS Administrator Guide and the OpenAFS User Guide are provided in HTML Help format instead
1680     of raw HTML pages.</para>
1681     </section>
1682     <section>
1683       <title id="MSRPC_Services">3.51. Support for Microsoft RPC Services: WKSSVC and SRVSVC</title>
1684       <indexterm significance="normal">
1685         <primary>Explorer Shell</primary>
1686       </indexterm>
1687       <indexterm significance="normal">
1688         <primary>Microsoft Office</primary>
1689       </indexterm>
1690       <para>Beginning with the 1.5.62 release, the OpenAFS client supports named pipes and the
1691         Microsoft RPC Services WKSSVC and SRVSVC. This permits a significantly improved Netbios
1692         Server browsing experience with both the <emphasis>NET VIEW \\AFS</emphasis> command and the
1693         Explorer Shell. No longer will Windows display truncated cell names as available network
1694         shares. The network share properties will also include the object type and and the target of
1695         symlinks and mount points.</para>
1696     </section>
1697     <section>
1698       <title id="fs_newcell_differences">3.52. Differences between Windows and UNIX <emphasis>fs newcell</emphasis></title>
1699       <indexterm significance="normal">
1700         <primary>fs newcell</primary>
1701       </indexterm>
1702       <para>
1703         The OpenAFS for Windows version of "fs newcell" prior to 1.5.74 behaved quite differently than its UNIX counterpart.
1704         Instead of adding cell server information for a new cell, the command simply caused the cache manager to destroy all of its
1705         cell server information and then reload it the next time the server list for a cell is needed.  The UNIX version explicitly
1706         replaces the server list for a cell with a new list.
1707       </para>
1708       <para>
1709         Beginning with the 1.5.75 release, the Windows version will continue to behave as prior versions did when no parameters
1710         are specified but will accept an extended UNIX command-line syntax as well.  In addition to the UNIX parameters,
1711         the Windows "fs newcell" command accepts four new ones:
1712       </para>
1713       <itemizedlist>
1714         <listitem>
1715           <para>[-fsport &lt;cell's fileserver port&gt;]</para>
1716           <para>Specifies an alternate port number at which the cell's file servers are listening</para>
1717         </listitem>
1718         <listitem>
1719           <para>[-vlport &lt;cell's vldb server port&gt;]</para>
1720           <para>Specifies an alternate port number at which the cell's volume location database servers are listening</para>
1721         </listitem>
1722         <listitem>
1723           <para>[-registry]</para>
1724           <para>Instructs the cache manager to save the cell server information to the registry database</para>
1725         </listitem>
1726         <listitem>
1727           <para>[-dns]</para>
1728           <para>Indicates that the cell server information should be obtained via DNS SRV or DNS AFSDB records</para>
1729         </listitem>
1730       </itemizedlist>
1731     </section>
1732
1733     <section>
1734       <title id="openafs_reparse_points">3.53. AFS Mount Points and Symlinks are Reparse Points</title>
1735       <indexterm significance="normal">
1736         <primary>reparse points</primary>
1737       </indexterm>
1738       <indexterm significance="normal">
1739         <primary>mount points</primary>
1740       </indexterm>
1741       <indexterm significance="normal">
1742         <primary>symlinks</primary>
1743       </indexterm>
1744       <para> The AFS redirector driver represents all AFS mount points and AFS symlinks as reparse
1745         points within the file system name space using a Microsoft assigned tag value. Tools that
1746         are OpenAFS reparse point aware can create, query and remove AFS symlinks and mount points
1747         without requiring knowledge of AFS pioctls. The explorer shell will be able to delete a
1748         mount point or symlink as part of a recursive directory tree removal without crossing into
1749         the reparse point target. </para>
1750       <para>The Explorer Shell displays Symlinks and Mount Points using overlay icons.</para>
1751       <para><inlinegraphic fileref="relnotes03.jpg" align="center" arch=""/></para>
1752       <para>Beginning with 1.7.22, AFS Symlinks are represented as Microsoft Symlink reparse points
1753         instead of an OpenAFS specific reparse point.  Symlinks can now be created using the Win32
1754           <ulink
1755           url="http://msdn.microsoft.com/en-us/library/windows/desktop/aa363866%28v=vs.85%29.aspx"
1756           >CreateSymbolicLink</ulink> API and follow all of the behaviors of Microsoft Windows'
1757           <ulink
1758           url="http://msdn.microsoft.com/en-us/library/windows/desktop/aa365680%28v=vs.85%29.aspx"
1759           >Symbolic Links</ulink>.  Any tool capable of creating symbolic links on NTFS can now do
1760         so within AFS.</para>
1761       <para>Symbolic Links to Files are not supported by all Microsoft Windows applications because
1762         directory enumerations, GetFileAttributes and GetFileAttributesEx return the attributes and
1763         size of the Symbolic Link and not that of the target file.   Applications that treat the
1764         size of the Symbolic Link as the size of the target file will misbehave.  All Java releases
1765         1.6.x and earlier and all .NET applications as of this writing use the Symbolic Link size as
1766         the size of the target file.  Java 1.7 correctly processes Symbolic Links.</para>
1767     </section>
1768
1769     <section>
1770       <title id="authentication_groups">3.54. AFS Authentication Groups</title>
1771       <indexterm significance="normal">
1772         <primary>authentication groups</primary>
1773       </indexterm>
1774       <indexterm significance="normal">
1775         <primary>PAG</primary>
1776       </indexterm>
1777       <indexterm significance="normal">
1778         <primary>tokens</primary>
1779       </indexterm>
1780       <para>
1781                 When the OpenAFS Service is configured as an SMB Gateway, all AFS Tokens are associated with Windows user names.
1782                 With the IFS redirector driver, tokens are associated with Authentication Groups.
1783                 By default, an authentication group is allocated for each User SID
1784                 and Logon Session Id combination.  In addition, it is possible for
1785                 processes to create additional Authentication Groups.  Each thread in
1786                 a process can select an Authentication Group within the process as the
1787                 active Authentication Group.
1788                 </para>
1789           <para>
1790                 One of the significant benefits of Authentication Groups within the
1791                 Windows environment is that Windows services (svchost.exe, csrss.exe,
1792                 etc.) which impersonate user processes will seamlessly gain access
1793                 to the user's AFS credentials for the lifetime of the impersonation.
1794       </para>
1795     </section>
1796
1797     <section>
1798       <title id="ifs_known_issues">3.55. Known IFS redirector driver limitations</title>
1799       <indexterm significance="normal">
1800         <primary>IFS redirector</primary>
1801       </indexterm>
1802       <indexterm significance="normal">
1803         <primary>known issues</primary>
1804       </indexterm>
1805       <para>
1806       The following is a list of known issues when using the IFS redirector driver:
1807       <itemizedlist>
1808       <listitem>
1809             <para>Adobe Reader Protected Mode prevents saving PDF documents to AFS. </para>
1810             <para>
1811               In Acrobat Reader 9.3.2 Adobe added a new security feature "Protected
1812 Mode" which is enabled by default.  Protected mode runs AcroRd32.exe in
1813 a sandbox and prevents undesirable network access.  The release notes
1814 with all versions of Reader since 9.3.2 indicate that DFS and NFS
1815 network paths are inaccessible when Protected Mode is on.
1816             </para>
1817           </listitem>
1818           <listitem>
1819             <para>Command Prompt .LNK files do not behave properly when stored within AFS <itemizedlist>
1820                 <listitem>
1821                   <para>Custom properties will be ignored.</para>
1822                 </listitem>
1823                 <listitem>
1824                   <para>It is not possible to make changes to the LNK properties.</para>
1825                 </listitem>
1826               </itemizedlist> These issues are the result of the <emphasis role="italic">Console
1827                 Window Host</emphasis> process (conhost.exe) running outside the logon session's
1828               authentication group. While conhost.exe impersonates the Windows user, it does not
1829               impersonate a logon session process. As a result, it has no tokens and cannot access
1830               the LNK file.</para>
1831           </listitem>
1832       <listitem>
1833       <para>The Windows File System <ulink url="http://msdn.microsoft.com/en-us/library/ff549293%28v=vs.85%29.aspx">Volume Query Quota Interface</ulink> is not implemented.  As a result, AFS quota information is not available to application processes or end users via Windows dialogs.</para>
1834       </listitem>
1835       <listitem>
1836       <para>The Windows <ulink url="https://secure.wikimedia.org/wikipedia/en/wiki/Shadow_Copy">Volume Shadow Copy Service</ulink> is not implemented.  As a result, AFS backup volumes are not accessible via the Explorer Shell.</para>
1837       </listitem>
1838       <listitem>
1839       <para>There is no support for storing DOS attributes such as Hidden, System, or Archive. </para>
1840       </listitem>
1841       <listitem>
1842       <para>There is no support for Alternate Data Streams as required by Windows User Account
1843               Control to store Zone Identity data. </para>
1844       </listitem>
1845       <listitem>
1846       <para>There is no support for Extended Attributes. </para>
1847       </listitem>
1848       <listitem>
1849       <para>There is no support for <ulink
1850                 url="https://blogs.technet.com/b/hugofe/archive/2010/06/21/windows-2008-access-based-enumeration-abe.aspx"
1851                 >Access Based Enumeration</ulink>. </para>
1852       </listitem>
1853       <listitem>
1854       <para>There is no support for <ulink
1855                 url="https://secure.wikimedia.org/wikipedia/en/wiki/Windows_Management_Instrumentation"
1856                 >Windows Management Instrumentation</ulink>
1857             </para>
1858       </listitem>
1859       <listitem>
1860       <para>There is no support for <ulink
1861                 url="http://msdn.microsoft.com/en-us/library/aa363997%28v=vs.85%29.aspx">Distributed
1862                 Link Tracking and Object Identifiers</ulink>
1863             </para>
1864       </listitem>
1865       <listitem>
1866             <para>There is no support for storing <ulink
1867                 url="http://msdn.microsoft.com/en-us/magazine/cc982153.aspx">Windows Access Control
1868                 Lists</ulink>. Only the AFS ACLs are enforced. </para>
1869           </listitem>
1870           <listitem>
1871             <para>There is a bug in the Explorer Shell which can result in the Shell responding to a
1872               Ctrl-V (Paste) operation with an out of space error.  The bug is that the Shell
1873               queries the root directory of the UNC Path or Drive Letter for free space instead of
1874               the path in which the Paste is being performed.  To work around the bug, select a
1875               directory in another volume under the same root and then return to the target
1876               directory before initiating the Paste.  Performing the Paste using the Context Menu
1877               instead of Ctrl-V will avoid triggering the bug.</para>
1878           </listitem>
1879           <listitem>
1880             <para>Windows file systems support a maximum of 31 reparse points (mount points or
1881               symbolic links) within a path.</para>
1882           </listitem>
1883       </itemizedlist>
1884       </para>
1885     </section>
1886     <section>
1887       <title id="windows8_changes">3.56. Changes for Windows 8 and Server 2012</title>
1888       <indexterm significance="normal">
1889         <primary>Windows 8</primary>
1890       </indexterm>
1891       <indexterm significance="normal">
1892         <primary>Server 2012</primary>
1893       </indexterm>
1894       <para>
1895       In Windows 8 and Server 2012 Microsoft has introduced a new file system, ReFS, and has begun the process of transitioning away from several legacy file system properties including 8.3 compatible short names for all file system objects.
1896       The OpenAFS file system has followed suit and is disabling automatic generation of 8.3 compatible names on Windows 8 and Server 2012.
1897       </para>
1898     </section>
1899     <section>
1900       <title id="explorer_read_only_volume_bug">3.57. The Explorer Shell, Drive Letter Mappings, and Read Only Volumes</title>
1901       <indexterm significance="normal">
1902         <primary>explorer shell</primary>
1903       </indexterm>
1904       <indexterm significance="normal">
1905         <primary>drive letter mappings</primary>
1906       </indexterm>
1907       <indexterm significance="normal">
1908         <primary>.readonly volumes</primary>
1909       </indexterm>
1910       <para>File systems can expose a variety of information about the underlying volumes they serve
1911         to applications.  All AFS volumes are described as supporting Case Preservation, Hard Links,
1912         Reparse Points and Unicode characters.  For .readonly volumes the file system can indicate
1913         that the volume is a Read Only Volume.  The benefit of doing so is that applications such as
1914         the Explorer Shell can alter their behavior to improve the user experience.  For example,
1915         when the volume is reported as read-only the Explorer Shell can remove the Rename, Delete,
1916         and other file modifying operations from the user interface.  Unfortunately, the Windows 7
1917         Explorer Shell is broken with regards to Volume Information queries when issued on Network
1918         Mapped Drive Letters.  Instead of performing a volume information query on the current
1919         directory, the Explorer Shell only queries the root directory of the mapped drive letter.
1920         As a result, if the drive letter is mapped to a .readonly volume, all paths accessed via the
1921         drive letter are considered to be read-only even when they are not.  This behavior is fixed
1922         in Windows 8 and Server 2012.</para>
1923       <para>Due to this bug, OpenAFS on Windows 7 and below does not report the
1924         <ulink url="http://msdn.microsoft.com/en-us/library/windows/desktop/aa964920%28v=vs.85%29.aspx">FILE_READ_ONLY_VOLUME</ulink>
1925         flag as part of the volume information.  The Explorer Shell properly
1926         queries the volume information for UNC paths.  If network mapped drive letters are not used,
1927         it is often convenient if the FILE_READ_ONLY_VOLUME flag is reported.  This can be
1928         configured using the <link linkend="Regkey_TransarcAFSDaemon_Parameters_VolumeInfoReadOnlyFlag">VolumeInfoReadOnlyFlag</link> registry value.</para>
1929     </section>
1930
1931   </chapter>
1932   <chapter id="chap_4">
1933     <title id="How_to_Debug_Problems">How to Troubleshoot Problems with OpenAFS for Windows</title>
1934     <para>
1935     <indexterm significance="normal">
1936       <primary>debugging</primary>
1937     </indexterm>
1938     <indexterm significance="normal">
1939       <primary>troubleshooting</primary>
1940     </indexterm>
1941     OpenAFS for Windows provides a wide range of tools to assist you in debugging problems. The techniques available to you are varied because of the wide range of issues that have been discovered over the years.</para>
1942     <section>
1943       <title id="pioctl_debugging">4.1. pioctl debugging (
1944         <link linkend="Value_IoctlDebug">IoctlDebug</link> registry key)
1945       </title>
1946       <indexterm significance="normal">
1947         <primary>IoctlDebug</primary>
1948       </indexterm>
1949       <indexterm significance="normal">
1950         <primary>tokens.exe</primary>
1951       </indexterm>
1952       <indexterm significance="normal">
1953         <primary>aklog.exe</primary>
1954       </indexterm>
1955       <indexterm significance="normal">
1956         <primary>afscreds.exe</primary>
1957       </indexterm>
1958       <para>pioctl (path-based ioctl) calls are used by various tools to communicate with the AFS Client Service. Some of the operations performed include:</para>
1959       <itemizedlist>
1960         <listitem>
1961           <para>setting/querying tokens (tokens.exe, aklog.exe, afscreds.exe)</para>
1962         </listitem>
1963         <listitem>
1964           <para>setting/querying ACLs </para>
1965         </listitem>
1966         <listitem>
1967           <para>setting/querying cache parameters</para>
1968         </listitem>
1969         <listitem>
1970           <para>flushing files or volumes</para>
1971         </listitem>
1972         <listitem>
1973           <para>setting/querying server preferences</para>
1974         </listitem>
1975         <listitem>
1976           <para>querying path location</para>
1977         </listitem>
1978         <listitem>
1979           <para>checking the status of servers and volumes</para>
1980         </listitem>
1981         <listitem>
1982           <para>setting/querying the sysname list</para>
1983         </listitem>
1984       </itemizedlist>
1985       <para>pioctl calls are implemented by writing to a special UNC path that is processed by the AFS Client Service. If there is a failure to communicate with the AFS Client Service via SMB/CIFS, it will be impossible to perform any of the above operations. </para>
1986       <para>To assist in debugging these problems, the registry value:</para>
1987       <para> [HKLM\SOFTWARE\OpenAFS\Client]</para>
1988       <para> REG_DWORD: IoctlDebug = 0x01</para>
1989       <para>should be set. Then any of the commands that perform pioctl calls should be executed from the command prompt. With this key set the pioctl library will generate debugging output to stderr. The output will contain the Win32 API calls executed along with their most important parameters and their return code. The MSDN Library and the Microsoft KnowledgeBase can be used as a reference to help you determine the configuration probem with your system.</para>
1990     </section>
1991     <section>
1992       <title id="afsd_service_init_log">4.2. afsd_service initialization log (%WinDir%\TEMP\afsd_init.log)</title>
1993       <indexterm significance="normal">
1994         <primary>afsd_init.log</primary>
1995       </indexterm>
1996       <indexterm significance="normal">
1997         <primary>MaxLogSize</primary>
1998       </indexterm>
1999       <para>Every time the AFS Client Service starts it appends data about its progress and configuration to a file. This file provides information crucial to determining why the service cannot start when there are problems. When the process terminates due to a panic condition it will write to this file the source code file and line number of the error. In many cases the panic condition is due to a misconfiguration of the machine. In other cases it might be due to a programming error in the software. A quick review of the location in the source code will quickly reveal the reason for the termination.</para>
2000       <para>The
2001         <link linkend="Value_MaxLogSize">MaxLogSize</link> registry value determines the maximum size of the %WINDIR%\TEMP\afsd_init.log file. If the file is larger than this value when OpenAFS Client Service starts, the file will be reset to 0 bytes. If value is set to 0, the file will be allowed to grow indefinitely.
2002       </para>
2003     </section>
2004     <section>
2005       <title id="afsd_service_debug_log">4.3. afsd_service debug logs (fs trace {-on, -off, -dump} -&gt;%WinDir%\TEMP\afsd.log)</title>
2006       <indexterm significance="normal">
2007         <primary>afsd.log</primary>
2008       </indexterm>
2009       <indexterm significance="normal">
2010         <primary>fs trace</primary>
2011       </indexterm>
2012       <indexterm significance="normal">
2013         <primary>TraceBufferSize</primary>
2014       </indexterm>
2015       <para>When attempting to debug the behavior of the SMB/CIFS Server and the Cache Manager it is often useful to examine a log of the operations being performed. While running the AFS Client Service keeps an in memory log of many of its actions. The default number of actions preserved at any one time is 5000. This can be adjusted with the
2016         <link linkend="Value_TraceBufferSize">TraceBufferSize registry value</link>:
2017       </para>
2018       <para> [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
2019       <para> REG_DWORD TraceBufferSize </para>
2020       <para>A restart of the service is necessary when adjusting this value. Execute "fs trace -on -reset" to begin the logging and "fs trace -dump" to output the contents of the log to the file.</para>
2021     </section>
2022     <section>
2023       <title id="Using_Sysinternals_Tools">4.4. Using SysInternal's Debug Viewer, Process Monitor,
2024         Process Explorer and Process Dump Tools</title>
2025       <indexterm significance="normal">
2026         <primary>SysInternals</primary>
2027       </indexterm>
2028       <indexterm significance="normal">
2029         <primary>dbgview.exe</primary>
2030       </indexterm>
2031       <indexterm significance="normal">
2032         <primary>procmon.exe</primary>
2033       </indexterm>
2034       <indexterm significance="normal">
2035         <primary>TraceOption</primary>
2036       </indexterm>
2037       <para>An alternatve option to the use of "fs trace -dump" to capture internal OpenAFS Client Service events is to use a tool such as Sysinternal's
2038         <ulink url="http://technet.microsoft.com/en-us/sysinternals/bb896647.aspx">Debug Viewer</ulink> to capture real-time debugging output. When the OpenAFS Client Service starts and Bit 2 of the
2039         <link linkend="Value_TraceOption">TraceOption</link> value in the registry is set, all trace log events are output using the Windows Debug Monitor interface (OutputDebugString).
2040       </para>
2041       <para> [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
2042       <para>REG_DWORD TraceOption = 0x04</para>
2043       <para>Use "fs trace –on" and "fs trace –off" to toggle the generation of log messages. </para>
2044       <para>Sysinternal's
2045         <ulink url="http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx">Process Monitor</ulink> can be use to monitor the file operations requested by applications and their success or failure.
2046       </para>
2047       <para>In Process Monitor, set a filter to include only events on file paths that refer to the AFS name space. Be sure to include both the UNC path as well as any drive letters mapped to AFS. </para>
2048       <para>Turn on the
2049         <emphasis>Clock Time</emphasis> and
2050         <emphasis>Show Milliseconds</emphasis> options in both tools to make it easier to synchronize the application requests and the resulting OpenAFS Client Service operations. The captured data can be stored to files for inclusion in
2051         <link linkend="Reporting_Bugs">bug reports</link>.
2052       </para>
2053       <para>Sysinternal's
2054         <ulink url="http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx">Process Explorer</ulink> is a replacement for the Windows Task Manager and so much more. Process Explorer can be configured to use the DbgHelp.dll from "
2055         <ulink url="http://www.microsoft.com/whdc/devtools/debugging/default.mspx">Microsoft Debugging Tools for Windows</ulink>" as well as the debug symbols shipped as an optional component of the OpenAFS for Windows installer. (Options-&gt;Configure Symbols) Once configured the "Threads" tab of the process properties dialog will permit the viewing of a fully documented stack for each displayed thread. Hint: If there is a deadlock in the cache manager, two or more of the threads will be stuck in a call to osi_TWait().
2056       </para>
2057     </section>
2058     <section>
2059       <title id="Creating_Microsoft_Minidumps">4.5. Creating Microsoft MiniDumps
2060 (fs minidump -&gt; %WinDir%\TEMP\afsd.dmp)</title>
2061       <indexterm significance="normal">
2062         <primary>minidumps</primary>
2063       </indexterm>
2064       <indexterm significance="normal">
2065         <primary>fs minidump</primary>
2066       </indexterm>
2067       <indexterm significance="normal">
2068         <primary>MiniDumpType</primary>
2069       </indexterm>
2070       <indexterm significance="normal">
2071         <primary>afsd.dmp</primary>
2072       </indexterm>
2073       <para>If the AFS Client Service become unresponsive to any form of communication there may be a serious error that can only be debugged by someone with access to the source code and a debugger. The "fs minidump" command can be used to force the generation of a MiniDump file containing the state of all of the threads in the AFS Client Service process. The most accurate MiniDump files will be produced after installing "
2074         <ulink url="http://www.microsoft.com/whdc/devtools/debugging/default.mspx">Microsoft Debugging Tools for Windows</ulink>".
2075       </para>
2076       <para>The
2077         <link linkend="Value_MiniDumpType">MiniDumpType</link> registry value can be used to adjust the scope of the process information included within the dump file. By default the MiniDump only contains the stacks of all threads and the values of all global variables. A much more useful MiniDump is one that contains the contents of the heap. Be warned, a MiniDump with heap will be as large as the cache file. In addition, it will include all of the data stored within the cache. If there are privacy concerns, do not produce a MiniDump with heap.
2078       </para>
2079     </section>
2080     <section>
2081       <title id="Integrated_Logon_Debugging">4.6. Single Sign-on (Integrated Logon) debugging</title>
2082       <indexterm significance="normal">
2083         <primary>integrated logon</primary>
2084       </indexterm>
2085       <indexterm significance="normal">
2086         <primary>TraceOption</primary>
2087       </indexterm>
2088       <para>If you are having trouble with the Integrated Logon operations it is often useful to be
2089         able to obtain a log of what it is attempting to do. Setting the <link linkend="Value_AFSLogon_Debug">Debug</link> registry value: </para>
2090       <para> [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider]</para>
2091       <para> REG_DWORD Debug = 0x01</para>
2092       <para>will instruct the Integrated Logon Network Provider and Event Handlers to log information to the Windows Event Log: Application under the name "AFS Logon".</para>
2093     </section>
2094     <section>
2095       <title id="rxdebug_usage">4.7. RX (AFS RPC) debugging (rxdebug)</title>
2096       <indexterm significance="normal">
2097         <primary>rxdebug.exe</primary>
2098       </indexterm>
2099       <para>The rxdebug.exe tool can be used to query a variety of information about the AFS services installed on a given machine. The port for the AFS Cache Manager is 7001. </para>
2100       <para>
2101         <programlisting format="linespecific">
2102     Usage: rxdebug -servers &lt;server machine&gt; [-port &lt;IP port&gt;] [-nodally]
2103            [-allconnections] [-rxstats] [-onlyserver] [-onlyclient]
2104            [-onlyport &lt;show only &lt;port&gt;&gt;]
2105            [-onlyhost &lt;show only &lt;host&gt;&gt;]
2106            [-onlyauth &lt;show only &lt;auth level&gt;&gt;] [-version]
2107            [-noconns] [-peers] [-help]
2108     Where: -nodally         don't show dallying conns
2109            -allconnections  don't filter out uninteresting connections
2110            -rxstats         show Rx statistics
2111            -onlyserver      only show server conns
2112            -onlyclient      only show client conns
2113            -version         show AFS version id
2114            -noconns         show no connections
2115            -peers           show peers
2116       </programlisting>
2117       </para>
2118     </section>
2119     <section>
2120       <title id="cmdebug_usage">4.8. Cache Manager RPC debugging (cmdebug)</title>
2121       <indexterm significance="normal">
2122         <primary>cmdebug.exe</primary>
2123       </indexterm>
2124       <para>The cmdebug.exe tool can be used to query the state of the AFS Cache Manager over the network.</para>
2125       <para>
2126         <programlisting format="linespecific">
2127     Usage: cmdebug -servers &lt;server machine&gt; [-port &lt;IP port&gt;] [-long] [-refcounts]
2128            [-callbacks] [-ctime] [-addrs] [-cache] [-cellservdb] [-help]
2129     Where: -long        print all info
2130            -refcounts   print only cache entries with positive reference counts
2131            -callbacks   print only cache entries with callbacks
2132            -ctime       print human readable expiration time
2133            -addrs       print only host interfaces
2134            -cache       print only cache configuration
2135            -cellservdb  print only cellservdb info
2136       </programlisting>
2137       </para>
2138     </section>
2139     <section>
2140       <title id="Persistent_Cache_Consistency_Check">4.9. Persistent Cache consistency check</title>
2141       <indexterm significance="normal">
2142         <primary>AFSCache</primary>
2143       </indexterm>
2144       <indexterm significance="normal">
2145         <primary>validate cache file</primary>
2146       </indexterm>
2147       <para>The persistent cache is stored in a Hidden System file at %WinDir%\TEMP\AFSCache. If there is a problem with the persistent cache that prevent the AFS Client Service from being able to start a validation check on the file can be performed.</para>
2148       <para> afsd_service.exe --validate-cache &lt;cache-path&gt;</para>
2149     </section>
2150     <section>
2151       <title id="Token_Acquisition_Debugging">4.10. Token Acquisition Debugging</title>
2152       <indexterm significance="normal">
2153         <primary>tokens</primary>
2154       </indexterm>
2155       <indexterm significance="normal">
2156         <primary>klog.exe</primary>
2157       </indexterm>
2158       <indexterm significance="normal">
2159         <primary>kinit.exe</primary>
2160       </indexterm>
2161       <indexterm significance="normal">
2162         <primary>aklog.exe</primary>
2163       </indexterm>
2164       <para>If you are having trouble obtaining tokens with the Network Identity Manager AFS credential provider, it is recommended that you verify your ability to obtain tokens using the command-line tools
2165         <emphasis>klog.exe</emphasis> (if you are using kaserver) or
2166         <emphasis>kinit.exe</emphasis> and
2167         <emphasis>aklog.exe</emphasis> (if you are using Kerberos v5.)  The aklog.exe
2168         <emphasis>–d</emphasis> option will be quite helpful in diagnosing Kerberos v5 related problems.
2169       </para>
2170     </section>
2171   </chapter>
2172   <chapter id="Reporting_Bugs">
2173     <title>Reporting Bugs</title>
2174     <para>
2175     <indexterm significance="normal">
2176       <primary>bug reports</primary>
2177     </indexterm>
2178     Bug reports should be sent to
2179       <ulink url="mailto:openafs-bugs@openafs.org?subject=Bug%20Report">openafs-bugs@openafs.org</ulink>. Please include as much information as possible about the issue. If you are reporting a crash, please install the debugging symbols by re-running the installer. If a dump file is available for the problem, %WINDIR%\TEMP\afsd.dmp, include it along with the AFS Client Trace file %WINDIR%\TEMP\afsd.log. The AFS Client startup log is %WINDIR%\TEMP\afsd_init.log. Send the last continuous block of log information from this file.
2180     </para>
2181     <para>Configuring DrWatson to generate dump files for crashes:</para>
2182     <orderedlist inheritnum="ignore" continuation="restarts">
2183       <listitem>
2184         <para>Run drwtsn32.exe to configure or to identify where the log and the crash dump files are created: </para>
2185       </listitem>
2186       <listitem>
2187         <para>click Start &gt; Run... </para>
2188       </listitem>
2189       <listitem>
2190         <para>type drwtsn32 &lt;enter&gt;. </para>
2191       </listitem>
2192       <listitem>
2193         <para>Select either a Crash Dump Type: Mini or Full. </para>
2194       </listitem>
2195       <listitem>
2196         <para>Clear Dump Symbol Table</para>
2197       </listitem>
2198       <listitem>
2199         <para>Clear Append to Existing Log file. </para>
2200       </listitem>
2201       <listitem>
2202         <para>Check Dump All Thread Contexts.</para>
2203       </listitem>
2204       <listitem>
2205         <para>Check Create Crash Dump File</para>
2206       </listitem>
2207       <listitem>
2208         <para>Next run the monitoring module of Dr. Watson: </para>
2209       </listitem>
2210       <listitem>
2211         <para>click Start &gt; Run...</para>
2212       </listitem>
2213       <listitem>
2214         <para>type drwatson &lt;enter&gt;. </para>
2215       </listitem>
2216       <listitem>
2217         <para>Once a crash happens, Dr. Watson generates a dump file and a report in the log file, including the address of the crash and the stack dump.</para>
2218       </listitem>
2219     </orderedlist>
2220     <para>Once you have the Dr. Watson's logfile and minidump, zip them and attach them to your e-mail.</para>
2221     <para>When reporting a error, please be sure to include the version of OpenAFS.
2222     </para>
2223   </chapter>
2224   <chapter id="chap_6">
2225     <title id="Contributing_to_OpenAFS">How to Contribute to the Development of OpenAFS for Windows</title>
2226     <para>
2227     <indexterm significance="normal">
2228       <primary>contributing to OpenAFS</primary>
2229     </indexterm>
2230     Contributions to the development of OpenAFS for Windows are continuously needed. Contributions may take many forms including cash donations, support contracts, donated developer time, and even donated tech writer time.</para>
2231     <section>
2232       <title id="USENIX_OpenAFS_Fund">6.1. The USENIX OpenAFS Fund </title>
2233       <para>
2234       <indexterm significance="normal">
2235         <primary>USENIX OpenAFS Fund</primary>
2236       </indexterm>
2237         <ulink url="http://www.usenix.org/">USENIX</ulink>, a 501c3 non-profit corporation, has formed the USENIX OpenAFS Fund in order to accept tax deductible donations on behalf of the OpenAFS Elders. The donated funds will be allocated by the OpenAFS Elders to fund OpenAFS development, documentation, project management, and maintaining openafs.org.
2238       </para>
2239       <informaltable frame="none">
2240         <tgroup rowsep="1" align="left" colsep="1" cols="1">
2241           <colspec colwidth="405pt" colname="c1"/>
2242           <tbody>
2243             <row>
2244               <entry>
2245                 <para>
2246                   <programlisting format="linespecific">
2247     USENIX OpenAFS Fund
2248     USENIX Association
2249     2560 Ninth St., Suite 215
2250     Berkeley, CA 94710
2251                   </programlisting>
2252                 </para>
2253               </entry>
2254             </row>
2255           </tbody>
2256         </tgroup>
2257       </informaltable>
2258       <para>Donations can be made by sending a check, drawn on a U.S. bank, made out to the USENIX OpenAFS Fund or by making a
2259         <ulink url="https://db.usenix.org/cgi-bin/openafs/openafs.cgi">donation online</ulink>.
2260       </para>
2261     </section>
2262     <section>
2263       <title id="Secure_Endpoints_Inc">6.2. Secure Endpoints Inc. </title>
2264       <para>
2265       <indexterm significance="normal">
2266         <primary>Secure Endpoints Inc.</primary>
2267       </indexterm>
2268         <ulink url="http://www.secure-endpoints.com/">Secure Endpoints Inc.</ulink> provides development and support services for OpenAFS for Windows and
2269         <ulink url="http://web.mit.edu/kerberos/">MIT Kerberos for Windows</ulink>. Donations provided to Secure Endpoints Inc. for the development of OpenAFS are used to cover the OpenAFS gatekeeper responsibilities; providing support to the OpenAFS community via the OpenAFS mailing lists; and furthering development of desired features that are either too small to be financed by development contracts.
2270       </para>
2271       <para>Secure Endpoints Inc. accepts software development agreements from organizations who wish to fund a well-defined set of bug fixes or new features. </para>
2272       <para>Secure Endpoints Inc. provides contract based support for the OpenAFS for Windows and the
2273         <ulink url="http://web.mit.edu/kerberos/">MIT Kerberos for Windows</ulink> products.
2274       </para>
2275     </section>
2276     <section>
2277       <title id="Your_File_System_Inc">6.3. Your File System Inc. </title>
2278       <para>
2279       <indexterm significance="normal">
2280         <primary>Your File System Inc.</primary>
2281       </indexterm>
2282         <ulink url="http://www.your-file-system.com/">Your File System Inc.</ulink> provides development and support services for OpenAFS for Windows.
2283         Donations provided to Your File System Inc. for the development of OpenAFS are used to cover the OpenAFS gatekeeper responsibilities;
2284         providing support to the OpenAFS community via the OpenAFS mailing lists;
2285         and furthering development of desired features that are either too small to be financed by development contracts.
2286       </para>
2287       <para>Your File System Inc. accepts software development agreements from organizations who wish to fund a well-defined set of bug fixes or new features. </para>
2288       <para>Your File System Inc. provides contract based support for OpenAFS on all platforms.
2289       </para>
2290     </section>
2291     <section>
2292       <title id="Direct_Code_Contributions">6.4. Direct contributions of code and/or documentation </title>
2293       <para>Organizations that use OpenAFS in house and have development staffs are encouraged to
2294         contribute code and documentation modifications to OpenAFS.org via
2295           <emphasis>>http://gerrit.openafs.org/</emphasis>.</para>
2296     </section>
2297     <section>
2298       <title id="OAFW_Mailing_Lists">6.5. OpenAFS for Windows Mailing Lists</title>
2299       <indexterm significance="normal">
2300         <primary>mailing lists</primary>
2301       </indexterm>
2302       <indexterm significance="normal">
2303         <primary>openafs-win32-devel</primary>
2304       </indexterm>
2305       <indexterm significance="normal">
2306         <primary>openafs-info</primary>
2307       </indexterm>
2308       <para>If you wish to participate in OpenAFS for Windows development, please join the <ulink url="mailto:openafs-win32-devel@openafs.org?subject=OpenAFS%20for%20Windows%20Development%20Contribution">openafs-win32-devel@openafs.org</ulink> mailing list. </para>
2309       <para>
2310         <emphasis role="bold">https://lists.openafs.org/mailman/listinfo/openafs-win32-devel</emphasis>
2311       </para>
2312       <para>User questions should be sent to the
2313         <ulink url="mailto:openafs-info@openafs.org?subject=OpenAFS%20for%20Windows%20User%20Question">openafs-info@openafs.org</ulink> mailing list.
2314       </para>
2315       <para>
2316         <emphasis role="bold">https://lists.openafs.org/mailman/listinfo/openafs-info</emphasis>
2317       </para>
2318       <para>You must join the mailing lists if you wish to post to the list without incurring a moderation delay.</para>
2319     </section>
2320   </chapter>
2321   <chapter id="chap_7">
2322     <title id="MSI_Deployment_Guide">MSI Deployment Guide</title>
2323     <section>
2324       <title>7.1. Introduction</title>
2325       <indexterm significance="normal">
2326         <primary>msi deployment</primary>
2327       </indexterm>
2328       <indexterm significance="normal">
2329         <primary>msi transforms</primary>
2330       </indexterm>
2331       <para id="Introduction_to_MSI_Deployment">A MSI installer option is available for those who wish to use Windows Installer for installing OpenAFS and for organizations that wish to deploy OpenAFS through Group Policy. The first version of OpenAFS for Windows available as an MSI was 1.3.65.</para>
2332       <para>This document provides a guide for authoring transforms used to customize the MSI package for a particular organization. Although many settings can be deployed via transforms, in an Active Directory environment it is advisable to deploy registry settings and configuration files through group policy and/or startup scripts so that machines where OpenAFS for Windows is already installed will pick up these customizations.</para>
2333       <section>
2334         <title id="MSI_Deployment_Requirements">7.1.1 Requirements</title>
2335         <para>The information in this document applies to MSI packages distributed with OpenAFS for Windows releases from 1.3.65 and onwards or MSI packages built from corresponding source releases. Not all releases support all the configuration options documented here.</para>
2336         <para>Authoring a "Windows Installer" transform requires additional software for editing the MSI database tables and generating the transform from the modified MSI package. ORCA.EXE and MSITRAN.EXE which are included in the Windows Platform SDK ("Windows Installer" SDK) can be used for this purpose.</para>
2337         <para>For reference, the schema for the MSI package is based on SCHEMA.MSI distributed with the Platform SDK.</para>
2338         <para>For general information about "Windows Installer", refer to:</para>
2339         <para>
2340           <ulink url="http://msdn.microsoft.com/library/en-us/msi/setup/windows_installer_start_page.asp">http://msdn.microsoft.com/library/en-us/msi/setup/windows_installer_start_page.asp</ulink></para>
2341         <para>For general information about authoring MSI transforms, refer to:</para>
2342         <para>
2343           <ulink url="http://msdn.microsoft.com/library/en-us/msi/setup/transforms.asp">http://msdn.microsoft.com/library/en-us/msi/setup/transforms.asp</ulink></para>
2344         <para>The remainder of this document assumes some familiarity with authoring transforms. While the MSDN documentation for Windows Installer is a bit dense, the guide on MSI transforms found at the second link above is recommended reading. MSDN also includes a step-by-step example for creating a transform at:</para>
2345         <para>
2346           <ulink url="http://msdn.microsoft.com/library/en-us/msi/setup/a_customization_transform_example.asp">http://msdn.microsoft.com/library/en-us/msi/setup/a_customization_transform_example.asp</ulink></para>
2347       </section>
2348       <section>
2349         <title id="MSI_Authoring_Transforms">7.1.2 Authoring a Transform</title>
2350         <para>Transforms describe a set of modifications to be performed on an existing MSI for the purpose of customizing it. This is ordinarily done by making a copy of the MSI to be customized, modifying the copy and then using the old and the new MSI to generate a transform. For example:</para>
2351         <orderedlist inheritnum="ignore" continuation="restarts">
2352           <listitem>
2353             <para>copy openafs.msi openafs-modified.msi</para>
2354           </listitem>
2355           <listitem>
2356             <para>(edit the openafs-modified.msi to include the necessary changes)</para>
2357           </listitem>
2358           <listitem>
2359             <para>msitran -g openafs.msi openafs-modified.msi openafs-transform.mst</para>
2360           </listitem>
2361           <listitem>
2362             <para>(generates openafs-transform.mst, which is the transform)</para>
2363           </listitem>
2364         </orderedlist>
2365         <para>Transforms have an extension of .mst. 'msitran' is a tool distributed as part of the "Windows Installer" SDK (part of the Windows Platform SDK).</para>
2366         <para>You can test a transform by:</para>
2367         <orderedlist inheritnum="ignore" continuation="restarts">
2368           <listitem>
2369             <para>copy openafs.msi openafs-test.msi</para>
2370           </listitem>
2371           <listitem>
2372             <para>msitran -a openafs-transform.mst openafs-test.msi</para>
2373           </listitem>
2374         </orderedlist>
2375         <para>and then checking the resulting openafs-test.msi to see if all changes you have made above to openafs-modified.msi is present in openafs-test.msi. 'msitran' will complain if some modification in the transform can not be successfully applied.</para>
2376         <para>As mentioned above, you can use a tool like ORCA.EXE to edit the MSI databases directly when editing openafs-modified.msi. More details are given below.</para>
2377       </section>
2378     </section>
2379     <section>
2380       <title id="MSI_Configuration_Options">7.2. Configuration Options</title>
2381       <para>The logic necessary to implement many of the settings described in
2382         <link linkend="appendix_a">Appendix A</link> are present in the MSI. Most of these can be controlled by setting the corresponding properties to the desired value. Some settings may require modifying existing registry entries (though not recommended) or adding new resources (like files or registry keys). Instructions for performing these tasks are below.
2383       </para>
2384       <section>
2385         <title id="MSI_Configurable_Properties">7.2.1 Configurable Properties</title>
2386         <para>Most configurable properties correspond to registry keys or values. Due to the logic invoked based on the existence of these registry keys or values, they are only set if the associated property is defined to have a non null value. If the associated property is not defined in the MSI, the registry key or value will not be touched. By default, the MSI does not contain these properties and hence will not set the registry keys. You will need to add properties as needed to the MSI.</para>
2387         <para>When one of the configurable properties is set, the installer will use the property value to set the corresponding setting in the HKEY_LOCAL_MACHINE registry hive. The HKEY_CURRENT_USER hive is not touched by the installer.</para>
2388         <para>For each property, the associated registry setting is referenced by the same text used in
2389           <link linkend="appendix_a">Appendix A</link>.
2390         </para>
2391         <para>Strings are quoted using single quotes (e.g. 'a string'). An empty string is denoted as ''. Note that you can't author null values into the 'Property' table.</para>
2392         <para>Numeric values should be authored as decimal strings.</para>
2393         <section>
2394           <title id="MSI_Setting_Properties">7.2.1.1 Setting Properties</title>
2395           <para>In order to set a property,</para>
2396           <orderedlist inheritnum="ignore" continuation="restarts">
2397             <listitem>
2398               <para>Open the MSI in ORCA.EXE</para>
2399             </listitem>
2400             <listitem>
2401               <para>Select the 'Property' table from the list of tables on the left.</para>
2402             </listitem>
2403             <listitem>
2404               <para>Find the property in the list of properties on the right, double click the value and type the new value.</para>
2405             </listitem>
2406             <listitem>
2407               <para>If the property does not exist in the property list, right click the list and select 'Add Row', type the property name and the desired value.</para>
2408             </listitem>
2409           </orderedlist>
2410         </section>
2411         <section>
2412           <title id="MSI_OAFW_Properties">7.2.1.2 OpenAFS for Windows Properties</title>
2413           <informaltable frame="all">
2414             <tgroup rowsep="1" align="left" colsep="1" cols="1">
2415               <colspec colwidth="447pt" colname="c1"/>
2416               <tbody>
2417                 <row>
2418                   <entry>
2419                     <para>
2420                       <emphasis>(Service parameters):</emphasis>
2421                     </para>
2422                     <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
2423                   </entry>
2424                 </row>
2425                 <row>
2426                   <entry>
2427                     <para>
2428                       <emphasis>(Network provider):</emphasis>
2429                     </para>
2430                     <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider]</para>
2431                   </entry>
2432                 </row>
2433                 <row>
2434                   <entry>
2435                     <para>
2436                       <emphasis>(OpenAFS Client):</emphasis>
2437                     </para>
2438                     <para>[HKLM\SOFTWARE\OpenAFS\Client]</para>
2439                   </entry>
2440                 </row>
2441               </tbody>
2442             </tgroup>
2443           </informaltable>
2444           <section>
2445             <title id="MSI_OAFW_Registry_Properties">7.2.1.2.1 Registry Properties</title>
2446             <para>These properties are used to set the values of registry entries associated with OpenAFS for Windows.</para>
2447             <informaltable frame="all">
2448               <tgroup rowsep="1" align="left" colsep="1" cols="1">
2449                 <colspec colwidth="447pt" colname="c1"/>
2450                 <tbody>
2451                   <row>
2452                     <entry>
2453                       <para>
2454                         <emphasis role="bold">AFSCACHEPATH</emphasis>
2455                       </para>
2456                       <para>Registry key :
2457                         <link linkend="Service_Parameters">(Service Parameters)</link></para>
2458                       <para>Registry value :
2459                         <link linkend="Value_CachePath">CachePath</link></para>
2460                       <para>Valid values : string .</para>
2461                     </entry>
2462                   </row>
2463                   <row>
2464                     <entry>
2465                       <para>
2466                         <emphasis role="bold">AFSCACHESIZE</emphasis>
2467                       </para>
2468                       <para>Registry key :
2469                         <link linkend="Service_Parameters">(Service Parameters)</link></para>
2470                       <para>Registry value :
2471                         <link linkend="Value_CacheSize">CacheSize</link></para>
2472                       <para>Valid values : numeric</para>
2473                     </entry>
2474                   </row>
2475                   <row>
2476                     <entry>
2477                       <para>
2478                         <emphasis role="bold">AFSCELLNAME</emphasis>
2479                       </para>
2480                       <para>Registry key :
2481                         <link linkend="Service_Parameters">(Service Parameters)</link></para>
2482                       <para>Registry value :
2483                         <link linkend="Value_Cell">Cell</link></para>
2484                       <para>Valid values : string</para>
2485                     </entry>
2486                   </row>
2487                   <row>
2488                     <entry>
2489                       <para>
2490                         <emphasis role="bold">FREELANCEMODE</emphasis>
2491                       </para>
2492                       <para>Registry key :
2493                         <link linkend="Service_Parameters">(Service Parameters)</link></para>
2494                       <para>Registry value :
2495                         <link linkend="Value_FreelanceClient">FreelanceClient</link></para>
2496                       <para>Valid values : '1' or '0'</para>
2497                     </entry>
2498                   </row>
2499                   <row>
2500                     <entry>
2501                       <para>
2502                         <emphasis role="bold">HIDEDOTFILES</emphasis>
2503                       </para>
2504                       <para>Registry key :
2505                         <link linkend="Service_Parameters">(Service Parameters)</link></para>
2506                       <para>Registry value :
2507                         <link linkend="Value_HideDotFiles">HideDotFiles</link></para>
2508                       <para>Valid values : '1' or '0'</para>
2509                     </entry>
2510                   </row>
2511                   <row>
2512                     <entry>
2513                       <para>
2514                         <emphasis role="bold">LOGONOPTIONS</emphasis>
2515                       </para>
2516                       <para>Registry key :
2517                         <link linkend="Domain_Specific_Regkeys">(Network Provider)</link></para>
2518                       <para>Registry value :
2519                         <link linkend="Value_LogonOptions">LogonOptions</link></para>
2520                       <para>Valid values : '0', '1' or '3'</para>
2521                       <para>See
2522                         <link linkend="appendix_a">Appendix A</link><link linkend="Domain_Specific_Configuration">section 2.1 (Domain Specific Configuration keys for Network Provider)</link> for more details.
2523
2524
2525
2526                       </para>
2527                     </entry>
2528                   </row>
2529                   <row>
2530                     <entry>
2531                       <para>
2532                         <emphasis role="bold">MOUNTROOT</emphasis>
2533                       </para>
2534                       <para>Registry key :
2535                         <link linkend="Service_Parameters">(Service Parameters)</link></para>
2536                       <para>Registry value :
2537                         <link linkend="Value_Mountroot">Mountroot</link></para>
2538                       <para>Valid values : string</para>
2539                     </entry>
2540                   </row>
2541                   <row>
2542                     <entry>
2543                       <para>
2544                         <emphasis role="bold">NETBIOSNAME</emphasis>
2545                       </para>
2546                       <para>Registry key :
2547                         <link linkend="Service_Parameters">(Service Parameters)</link></para>
2548                       <para>Registry value :
2549                         <link linkend="Value_NetbiosName">NetbiosName</link></para>
2550                       <para>Valid values : string (at most 15 characters)</para>
2551                     </entry>
2552                   </row>
2553                   <row>
2554                     <entry>
2555                       <para>
2556                         <emphasis role="bold">NOFINDLANABYNAME</emphasis>
2557                       </para>
2558                       <para>Registry key :
2559                         <link linkend="Service_Parameters">(Service Parameters)</link></para>
2560                       <para>Registry value :
2561                         <link linkend="Value_NoFindLanaByName">NoFindLanaByName</link></para>
2562                       <para>Valid values : '1' or '0'</para>
2563                     </entry>
2564                   </row>
2565                   <row>
2566                     <entry>
2567                       <para>
2568                         <emphasis role="bold">RXMAXMTU</emphasis>
2569                       </para>
2570                       <para>Registry key :
2571                         <link linkend="Service_Parameters">(Service Parameters)</link></para>
2572                       <para>Registry value :
2573                         <link linkend="Value_RxMaxMTU">RxMaxMTU</link></para>
2574                       <para>Valid values : numeric</para>
2575                     </entry>
2576                   </row>
2577                   <row>
2578                     <entry>
2579                       <para>
2580                         <emphasis role="bold">SECURITYLEVEL</emphasis>
2581                       </para>
2582                       <para>Registry key :
2583                         <link linkend="Service_Parameters">(Service Parameters)</link></para>
2584                       <para>Registry value :
2585                         <link linkend="Value_SecurityLevel">SecurityLevel</link></para>
2586                       <para>Valid values : '1' or '0'</para>
2587                     </entry>
2588                   </row>
2589                   <row>
2590                     <entry>
2591                       <para>
2592                         <emphasis role="bold">SMBAUTHTYPE</emphasis>
2593                       </para>
2594                       <para>Registry key :
2595                         <link linkend="Service_Parameters">(Service Parameters)</link></para>
2596                       <para>Registry value :
2597                         <link linkend="Value_smbAuthType">SMBAuthType</link></para>
2598                       <para>Valid values : '0','1' or '2'</para>
2599                     </entry>
2600                   </row>
2601                   <row>
2602                     <entry>
2603                       <para>
2604                         <emphasis role="bold">STOREANSIFILENAMES</emphasis>
2605                       </para>
2606                       <para>Registry key :
2607                         <link linkend="Regkey_HKLM_SOFTWARE_OpenAFS_Client">(OpenAFS Client)</link></para>
2608                       <para>Registry value :
2609                         <link linkend="Value_StoreAnsiFilenames">StoreAnsiFilenames</link></para>
2610                       <para>Valid values : '0' or '1'</para>
2611                       <para>This option is no longer supported as of 1.5.50 now that all file names are stored to AFS file servers using the UTF-8 encoding of Unicode.</para>
2612                     </entry>
2613                   </row>
2614                   <row>
2615                     <entry>
2616                       <para>
2617                         <emphasis role="bold">USEDNS</emphasis>
2618                       </para>
2619                       <para>Registry key :
2620                         <link linkend="Service_Parameters">(Service Parameters)</link></para>
2621                       <para>Registry value :
2622                         <link linkend="Value_UseDNS">UseDNS</link></para>
2623                       <para>Valid values : '1' or '0'</para>
2624                     </entry>
2625                   </row>
2626                 </tbody>
2627               </tgroup>
2628             </informaltable>
2629           </section>
2630           <section>
2631             <title id="MSI_OAFW_AFSCreds_Properties">
2632                7.2.1.2.2 AFSCreds.exe Properties
2633             </title>
2634             <para>These properties are combined to add a command line option to the shortcut that will be created in the Start:Programs:OpenAFS and Start:Programs:Startup folders (see CREDSSTARTUP). The method of specifying the option was chosen for easy integration with the Windows Installer user interface. Although other methods can be used to specify options to AFSCREDS.EXE, it is advised that they be avoided as transforms including such options may not apply to future releases of OpenAFS.</para>
2635             <informaltable frame="all">
2636               <tgroup rowsep="1" align="left" colsep="1" cols="1">
2637                 <colspec colwidth="447pt" colname="c1"/>
2638                 <tbody>
2639                   <row>
2640                     <entry>
2641                       <para>
2642                         <emphasis role="bold">CREDSSTARTUP</emphasis>
2643                       </para>
2644                       <para>Valid values : '1' or '0'</para>
2645                       <para>Controls whether AFSCreds.exe starts up automatically when the user logs on. When CREDSSTARTUP is '1' a shortcut is added to the 'Startup' folder in the 'Program menu' which starts AFSCREDS.EXE with the options that are determined by the other CREDS* properties.</para>
2646                     </entry>
2647                   </row>
2648                   <row>
2649                     <entry>
2650                       <para>
2651                         <emphasis role="bold">CREDSAUTOINIT</emphasis>
2652                       </para>
2653                       <para>Valid values : '-a' or ''</para>
2654                       <para>Enables automatic initialization.</para>
2655                     </entry>
2656                   </row>
2657                   <row>
2658                     <entry>
2659                       <para>
2660                         <emphasis role="bold">CREDSIPCHDET</emphasis>
2661                       </para>
2662                       <para>Valid values : '-n' or ''</para>
2663                       <para>Enables IP address change detection.</para>
2664                     </entry>
2665                   </row>
2666                   <row>
2667                     <entry>
2668                       <para>
2669                         <emphasis role="bold">CREDSQUIET</emphasis>
2670                       </para>
2671                       <para>Valid values : '-q' or ''</para>
2672                       <para>Enables quiet mode.</para>
2673                     </entry>
2674                   </row>
2675                   <row>
2676                     <entry>
2677                       <para>
2678                         <emphasis role="bold">CREDSRENEWDRMAP</emphasis>
2679                       </para>
2680                       <para>Valid values : '-m' or ''</para>
2681                       <para>Enables renewing drive map at startup.</para>
2682                     </entry>
2683                   </row>
2684                   <row>
2685                     <entry>
2686                       <para>
2687                         <emphasis role="bold">CREDSSHOW</emphasis>
2688                       </para>
2689                       <para>Valid values : '-s' or ''</para>
2690                       <para>Enables displaying the credential manager window when AFSCREDS starts up.</para>
2691                     </entry>
2692                   </row>
2693                 </tbody>
2694               </tgroup>
2695             </informaltable>
2696           </section>
2697         </section>
2698       </section>
2699       <section>
2700         <title id="MSI_Existing_Registry_Entries">7.2.2 Existing Registry Entries</title>
2701         <para>You can change existing registry values subject to the restrictions mentioned in the Windows Platform SDK. Pay special attention to component key paths and try to only change the 'Value' column in the 'Registry' table. If you want to add additional registry keys please refer to section 3 (Additional resources).</para>
2702       </section>
2703       <section>
2704         <title id="MSI_Replacing_Configuration_Files">7.2.3 Replacing Configuration Files</title>
2705         <para>The OpenAFS configuration files (CellServDB) can be replaced by your own configuration files. These files are contained in separate MSI components so that you can disable them individually.</para>
2706         <para>The recommended method for replacing these files is to first disable the components containing the configuration files that you want to replace, and then add new components for the replacement files. This is outlined below (assuming you are using ORCA.EXE to author the transform).</para>
2707         <para>Note that transforms are not a good way to add a new file as an embedded stream. The method outlined here places the file in the same directory as the MSI for deployment.</para>
2708         <para>The walkthrough below is to add a custom 'CellServDB' file.</para>
2709         <orderedlist inheritnum="ignore" continuation="restarts">
2710           <listitem>
2711             <para>Disable the component that contains the configuration file that you want to replace.</para>
2712             <orderedlist inheritnum="ignore" continuation="restarts">
2713               <listitem>
2714                 <para>Locate and select the 'Component' table in the 'Tables' list.</para>
2715               </listitem>
2716               <listitem>
2717                 <para>In the Component table, locate the component you need to change ( Ctrl-F invokes the 'Find' dialog). The component names are listed below in section
2718                   <link linkend="MSI_Configuration_File_Components">7.2.3.1</link>. For this example, the component name is 'elf_CellServDB'.
2719                 </para>
2720               </listitem>
2721               <listitem>
2722                 <para>Go to the 'Condition' column of the component.</para>
2723               </listitem>
2724               <listitem>
2725                 <para>Enter a condition that evaluates to false. I.e. 'DONOTINSTALL'. (Note that an undefined property always evaluates to false).</para>
2726                 <para>Note that you can also use this step to disable other configuration files without providing replacements.</para>
2727               </listitem>
2728             </orderedlist>
2729           </listitem>
2730           <listitem>
2731             <para>Add a new component containing the new configuration file.</para>
2732             <orderedlist inheritnum="ignore" continuation="restarts">
2733               <listitem>
2734                 <para>Select the 'Component' table in the 'Tables' list.</para>
2735               </listitem>
2736               <listitem>
2737                 <para>Select 'Tables'-&gt;'Add Row' (Ctrl-R).</para>
2738               </listitem>
2739               <listitem>
2740                 <para>Enter the following :</para>
2741                 <informaltable frame="all">
2742                   <tgroup rowsep="1" align="left" colsep="1" cols="2">
2743                     <colspec colwidth="84pt" colname="c1"/>
2744                     <colspec colwidth="318pt" colname="c2"/>
2745                     <tbody>
2746                       <row>
2747                         <entry>
2748                           <para>Component</para>
2749                         </entry>
2750                         <entry>
2751                           <para>cmf_my_CellServDB</para>
2752                         </entry>
2753                       </row>
2754                       <row>
2755                         <entry>
2756                           <para>ComponentID</para>
2757                         </entry>
2758                         <entry>
2759                           <para>{7019836F-BB2C-4AF6-9463-0D6EC9035CF1}</para>
2760                         </entry>
2761                       </row>
2762                       <row>
2763                         <entry>
2764                           <para>Directory_</para>
2765                         </entry>
2766                         <entry>
2767                           <para>dirClient</para>
2768                         </entry>
2769                       </row>
2770                       <row>
2771                         <entry>
2772                           <para>Attributes</para>
2773                         </entry>
2774                         <entry>
2775                           <para>144</para>
2776                         </entry>
2777                       </row>
2778                       <row>
2779                         <entry>
2780                           <para>Condition</para>
2781                         </entry>
2782                         <entry>
2783                           <para/>
2784                         </entry>
2785                       </row>
2786                       <row>
2787                         <entry>
2788                           <para>KeyPath</para>
2789                         </entry>
2790                         <entry>
2791                           <para>fil_my_CellServDB</para>
2792                         </entry>
2793                       </row>
2794                     </tbody>
2795                   </tgroup>
2796                 </informaltable>
2797                 <para>Note that the ComponentId is an uppercase GUID. You can generate one using GUIDGEN.EXE or UUIDGEN.EXE, both of which are included in the Platform SDK.</para>
2798                 <para>The Attributes value of 144 is a sum of msidbComponentAttributesPermanent (16) and msidbComponentAttributesNeverOverwrite (128). This ensures that local modifications are not overwritten or lost during an installation or uninstallation. These are the same settings used on the default configuration files.</para>
2799                 <para> 'fil_my_CellServDB' is a key into the 'File' table which we will fill later.</para>
2800               </listitem>
2801             </orderedlist>
2802           </listitem>
2803           <listitem>
2804             <para>Add a new feature to hold the new component.</para>
2805             <orderedlist inheritnum="ignore" continuation="restarts">
2806               <listitem>
2807                 <para>Select the 'Feature' table.</para>
2808               </listitem>
2809               <listitem>
2810                 <para>Add a new row (Ctrl-R or 'Tables'-&gt;'Add Row') with the following values:</para>
2811                 <informaltable frame="all">
2812                   <tgroup rowsep="1" align="left" colsep="1" cols="2">
2813                     <colspec colwidth="94pt" colname="c1"/>
2814                     <colspec colwidth="307pt" colname="c2"/>
2815                     <tbody>
2816                       <row>
2817                         <entry>
2818                           <para>Feature</para>
2819                         </entry>
2820                         <entry>
2821                           <para>fea_my_CellServDB</para>
2822                         </entry>
2823                       </row>
2824                       <row>
2825                         <entry>
2826                           <para>Feature_Parent</para>
2827                         </entry>
2828                         <entry>
2829                           <para>feaClient</para>
2830                         </entry>
2831                       </row>
2832                       <row>
2833                         <entry>
2834                           <para>Title</para>
2835                         </entry>
2836                         <entry>
2837                           <para/>
2838                         </entry>
2839                       </row>
2840                       <row>
2841                         <entry>
2842                           <para>Description</para>
2843                         </entry>
2844                         <entry>
2845                           <para/>
2846                         </entry>
2847                       </row>
2848                       <row>
2849                         <entry>
2850                           <para>Display</para>
2851                         </entry>
2852                         <entry>
2853                           <para>0</para>
2854                         </entry>
2855                       </row>
2856                       <row>
2857                         <entry>
2858                           <para>Level</para>
2859                         </entry>
2860                         <entry>
2861                           <para>30</para>
2862                         </entry>
2863                       </row>
2864                       <row>
2865                         <entry>
2866                           <para>Directory_</para>
2867                         </entry>
2868                         <entry>
2869                           <para/>
2870                         </entry>
2871                       </row>
2872                       <row>
2873                         <entry>
2874                           <para>Attributes</para>
2875                         </entry>
2876                         <entry>
2877                           <para>8</para>
2878                         </entry>
2879                       </row>
2880                     </tbody>
2881                   </tgroup>
2882                 </informaltable>
2883                 <para>It is important to create the new feature under the 'feaClient' feature, which will ensure that the configuration file will be installed when the client binaries are installed.</para>
2884                 <para>Setting 'Display' to 0 will hide this feature from the feature selection dialog during an interactive installation. A value of 30 for 'Level' allows this feature to be installed by default (on a 'Typical' installation).</para>
2885                 <para>The 'Attributes' value is msidbFeatureAttributesDisallowAdvertise (8), which is set on all features in the OpenAFS MSI. The OpenAFS MSI is not designed for an advertised installation.</para>
2886               </listitem>
2887             </orderedlist>
2888           </listitem>
2889           <listitem>
2890             <para>Join the component and the feature.</para>
2891             <orderedlist inheritnum="ignore" continuation="restarts">
2892               <listitem>
2893                 <para>Select the 'FeatureComponents' table.</para>
2894               </listitem>
2895               <listitem>
2896                 <para>Add a new row with the following values:</para>
2897                 <informaltable frame="all">
2898                   <tgroup rowsep="1" align="left" colsep="1" cols="2">
2899                     <colspec colwidth="90pt" colname="c1"/>
2900                     <colspec colwidth="312pt" colname="c2"/>
2901                     <tbody>
2902                       <row>
2903                         <entry>
2904                           <para>Feature</para>
2905                         </entry>
2906                         <entry>
2907                           <para>fea_my_CellServDB</para>
2908                         </entry>
2909                       </row>
2910                       <row>
2911                         <entry>
2912                           <para>Component</para>
2913                         </entry>
2914                         <entry>
2915                           <para>cmf_my_CellServDB</para>
2916                         </entry>
2917                       </row>
2918                     </tbody>
2919                   </tgroup>
2920                 </informaltable>
2921               </listitem>
2922             </orderedlist>
2923           </listitem>
2924           <listitem>
2925             <para>Add an entry to the 'File' table.</para>
2926             <orderedlist inheritnum="ignore" continuation="restarts">
2927               <listitem>
2928                 <para>Select the 'File' table.</para>
2929               </listitem>
2930               <listitem>
2931                 <para>Add a new row with the following values:</para>
2932                 <informaltable frame="all">
2933                   <tgroup rowsep="1" align="left" colsep="1" cols="2">
2934                     <colspec colwidth="91pt" colname="c1"/>
2935                     <colspec colwidth="311pt" colname="c2"/>
2936                     <tbody>
2937                       <row>
2938                         <entry>
2939                           <para>File</para>
2940                         </entry>
2941                         <entry>
2942                           <para>fil_my_CellServDB</para>
2943                         </entry>
2944                       </row>
2945                       <row>
2946                         <entry>
2947                           <para>Component_</para>
2948                         </entry>
2949                         <entry>
2950                           <para>cmf_my_CellServDB</para>
2951                         </entry>
2952                       </row>
2953                       <row>
2954                         <entry>
2955                           <para>FileName</para>
2956                         </entry>
2957                         <entry>
2958                           <para>CellServDB</para>
2959                         </entry>
2960                       </row>
2961                       <row>
2962                         <entry>
2963                           <para>FileSize</para>
2964                         </entry>
2965                         <entry>
2966                           <para>(enter file size here)</para>
2967                         </entry>
2968                       </row>
2969                       <row>
2970                         <entry>
2971                           <para>Attributes</para>
2972                         </entry>
2973                         <entry>
2974                           <para>8192</para>
2975                         </entry>
2976                       </row>
2977                       <row>
2978                         <entry>
2979                           <para>Sequence</para>
2980                         </entry>
2981                         <entry>
2982                           <para>1000</para>
2983                         </entry>
2984                       </row>
2985                     </tbody>
2986                   </tgroup>
2987                 </informaltable>
2988                 <para>  (leave other fields blank)</para>
2989                 <para>The 'Attributes' value is msidbFileAttributesNonCompressed (8192). This is because we will be placing this file in the same directory as the MSI instead of embedding the file in it. Transforms do not support updating compressed sources or adding new cabinet streams.</para>
2990                 <para>Finally, the 'Sequence' value of 1000 will be used later to distinguish the file as being in a separate source location than the other files in the MSI.</para>
2991               </listitem>
2992             </orderedlist>
2993           </listitem>
2994           <listitem>
2995             <para>Set a media source for the file.</para>
2996             <orderedlist inheritnum="ignore" continuation="restarts">
2997               <listitem>
2998                 <para>Select the 'Media' table.</para>
2999               </listitem>
3000               <listitem>
3001                 <para>Add a row with the following values :</para>
3002                 <informaltable frame="all">
3003                   <tgroup rowsep="1" align="left" colsep="1" cols="2">
3004                     <colspec colwidth="93pt" colname="c1"/>
3005                     <colspec colwidth="309pt" colname="c2"/>
3006                     <tbody>
3007                       <row>
3008                         <entry>
3009                           <para>DiskId</para>
3010                         </entry>
3011                         <entry>
3012                           <para>2</para>
3013                         </entry>
3014                       </row>
3015                       <row>
3016                         <entry>
3017                           <para>LastSequence</para>
3018                         </entry>
3019                         <entry>
3020                           <para>1000</para>
3021                         </entry>
3022                       </row>
3023                     </tbody>
3024                   </tgroup>
3025                 </informaltable>
3026                 <para>  (leave other fields blank)</para>
3027                 <para>The sequence number of 1000 designates this as the media source for the newly added file.
3028         </para>
3029               </listitem>
3030             </orderedlist>
3031           </listitem>
3032         </orderedlist>
3033         <section id="MSI_Configuration_File_Components">
3034           <title>7.2.3.1 Components for Configuration Files</title>
3035           <para>CellServDB: 'cpf_CellServDB' (ID {D5BA4C15-DBEC-4292-91FC-B54C30F24F2A})</para>
3036         </section>
3037       </section>
3038       <section>
3039         <title id="MSI_Adding_Domain_Specific_Registry_Keys">7.2.4 Adding Domain Specific Registry Keys</title>
3040         <para>Following is an example for adding domain specific registry keys.</para>
3041         <para> Refer to
3042           <link linkend="appendix_a">Appendix A</link> section 2.1 for more information.
3043
3044
3045
3046         </para>
3047         <para> Columns that are unspecified should be left empty.</para>
3048         <para> We create a new feature and component to hold the new registry keys.</para>
3049         <informaltable frame="all">
3050           <tgroup rowsep="1" align="left" colsep="1" cols="1">
3051             <colspec colwidth="448pt" colname="c1"/>
3052             <tbody>
3053               <row>
3054                 <entry>
3055                   <para> 'Feature' table:</para>
3056                 </entry>
3057               </row>
3058               <row>
3059                 <entry>
3060                   <para>  (new row)
3061  Feature : 'feaDomainKeys'
3062  Feature Parent : 'feaClient'
3063  Display : 0
3064  Level : 30
3065  Attributes : 10</para>
3066                 </entry>
3067               </row>
3068               <row>
3069                 <entry>
3070                   <para> 'Component' table:</para>
3071                 </entry>
3072               </row>
3073               <row>
3074                 <entry>
3075                   <para>  (new row)
3076   Component : 'rcm_DomainKeys'
3077  ComponentId : '{4E3FCBF4-8BE7-40B2-A108-C47CF743C627}'
3078  Directory : 'TARGETDIR'
3079  Attributes : 4
3080  KeyPath : 'reg_domkey0'</para>
3081                 </entry>
3082               </row>
3083               <row>
3084                 <entry>
3085                   <para> 'FeatureComponents' table:</para>
3086                 </entry>
3087               </row>
3088               <row>
3089                 <entry>
3090                   <para>  (new row)
3091  Feature : 'feaDomainKeys'
3092  Component : 'rcm_DomainKeys'</para>
3093                 </entry>
3094               </row>
3095               <row>
3096                 <entry>
3097                   <para> 'Registry' table:</para>
3098                 </entry>
3099               </row>
3100               <row>
3101                 <entry>
3102                   <para> (new row)
3103  Registry : 'reg_domkey0'
3104  Root : 2
3105  Key : 'SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain'
3106  Component : 'rcm_DomainKeys'</para>
3107                 </entry>
3108               </row>
3109               <row>
3110                 <entry>
3111                   <para> (new row)
3112  Registry : 'reg_domkey1'
3113  Root : 2
3114  Key : 'SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain'
3115  Name : '*'
3116  Component : 'rcm_DomainKeys'</para>
3117                 </entry>
3118               </row>
3119               <row>
3120                 <entry>
3121                   <para> (new row)
3122  Registry : 'reg_domkey2'
3123  Root : 2
3124  Key : 'SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\ATHENA.MIT.EDU'
3125  Name : '*'
3126  Component : 'rcm_DomainKeys'</para>
3127                 </entry>
3128               </row>
3129               <row>
3130                 <entry>
3131                   <para> (new row)
3132  Registry : 'reg_domkey3'
3133  Root : 2
3134  Key : 'SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\ATHENA.MIT.EDU'
3135  Name : 'LogonOptions'
3136  Value : 1
3137  Component : 'rcm_DomainKeys'</para>
3138                 </entry>
3139               </row>
3140               <row>
3141                 <entry>
3142                   <para> (new row)
3143  Registry : 'reg_domkey4'
3144  Root : 2
3145  Key : SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST'
3146  Name : '*'
3147  Component : 'rcm_DomainKeys'</para>
3148                 </entry>
3149               </row>
3150               <row>
3151                 <entry>
3152                   <para> (new row)
3153  Registry : 'reg_domkey5'
3154  Root : 2
3155  Key : 'SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST'
3156  Name : 'LogonOptions'
3157  Value : 0
3158  Component : 'rcm_DomainKeys'</para>
3159                 </entry>
3160               </row>
3161               <row>
3162                 <entry>
3163                   <para> (new row)
3164  Registry : 'reg_domkey6'
3165  Root : 2
3166  Key : 'SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST'
3167  Name : 'FailLoginsSilently'
3168  Value : 1
3169  Component : 'rcm_DomainKeys'</para>
3170                 </entry>
3171               </row>
3172             </tbody>
3173           </tgroup>
3174         </informaltable>
3175         <para>The example adds domain specific keys for 'ATHENA.MIT.EDU' (enable integrated logon) and 'LOCALHOST' (disable integrated logon and fail logins silently).</para>
3176       </section>
3177       <section>
3178         <title id="MSI_Adding_Site_Specific_Freelance_Registry_Keys">7.2.5 Adding Site Specific Freelance Registry Keys</title>
3179         <para>Following is an example for adding site specific Freelance registry keys to pre-populate the Mountpoints and Symlinks in the fake root.afs volume.</para>
3180         <para> Columns that are unspecified should be left empty.</para>
3181         <para> We create a new feature and component to hold the new registry keys.</para>
3182         <informaltable frame="all">
3183           <tgroup rowsep="1" align="left" colsep="1" cols="1">
3184             <colspec colwidth="447pt" colname="c1"/>
3185             <tbody>
3186               <row>
3187                 <entry>
3188                   <para> 'Feature' table:</para>
3189                 </entry>
3190               </row>
3191               <row>
3192                 <entry>
3193                   <para>  (new row)
3194  Feature : 'feaFreelanceKeys'
3195  Feature Parent : 'feaClient'
3196  Display : 0
3197  Level : 30
3198  Attributes : 10</para>
3199                 </entry>
3200               </row>
3201               <row>
3202                 <entry>
3203                   <para> 'Component' table:</para>
3204                 </entry>
3205               </row>
3206               <row>
3207                 <entry>
3208                   <para>  (new row)
3209   Component : 'rcm_FreelanceKeys'
3210  ComponentId : '{4E3B3CBF4-9AE7-40C3-7B09-C48CF842C583}'
3211  Directory : 'TARGETDIR'
3212  Attributes : 4
3213  KeyPath : 'reg_freekey0'</para>
3214                 </entry>
3215               </row>
3216               <row>
3217                 <entry>
3218                   <para> 'FeatureComponents' table:</para>
3219                 </entry>
3220               </row>
3221               <row>
3222                 <entry>
3223                   <para>  (new row)
3224  Feature : 'feaFreelanceKeys'
3225  Component : 'rcm_FreelanceKeys'</para>
3226                 </entry>
3227               </row>
3228               <row>
3229                 <entry>
3230                   <para> 'Registry' table:</para>
3231                 </entry>
3232               </row>
3233               <row>
3234                 <entry>
3235                   <para> (new row)
3236  Registry : 'reg_freekey0'
3237  Root : 2
3238  Key : 'SOFTWARE\OpenAFS\Client\Freelance'
3239  Component : 'rcm_FreelanceKeys'</para>
3240                 </entry>
3241               </row>
3242               <row>
3243                 <entry>
3244                   <para> (new row)
3245  Registry : 'reg_freekey1'
3246  Root : 2
3247  Key : 'SOFTWARE\OpenAFS\Client\Freelance'
3248  Name : '0'
3249   Value  : 'athena.mit.edu#athena.mit.edu:root.cell.'
3250  Component : 'rcm_FreelanceKeys'</para>
3251                 </entry>
3252               </row>
3253               <row>
3254                 <entry>
3255                   <para> (new row)
3256  Registry : 'reg_freekey2'
3257  Root : 2
3258  Key : 'SOFTWARE\OpenAFS\Client\Freelance'
3259  Name : '1'
3260   Value  : '.athena.mit.edu%athena.mit.edu:root.cell.'
3261  Component : 'rcm_FreelanceKeys'</para>
3262                 </entry>
3263               </row>
3264               <row>
3265                 <entry>
3266                   <para> (new row)
3267  Registry : 'reg_freekey3'
3268  Root : 2
3269  Key : 'SOFTWARE\OpenAFS\Client\Freelance\Symlinks'
3270  Component : 'rcm_FreelanceKeys'</para>
3271                 </entry>
3272               </row>
3273               <row>
3274                 <entry>
3275                   <para> (new row)
3276  Registry : 'reg_freekey4'
3277  Root : 2
3278  Key : 'SOFTWARE\OpenAFS\Client\Freelance\Symlinks'
3279  Name : '0'
3280  Value  : 'athena:athena.mit.edu.'
3281  Component : 'rcm_FreelanceKeys'</para>
3282                 </entry>
3283               </row>
3284               <row>
3285                 <entry>
3286                   <para> (new row)
3287  Registry : 'reg_freekey5'
3288  Root : 2
3289  Key : 'SOFTWARE\OpenAFS\Client\Freelance\Symlinks'
3290  Name : '1'
3291   Value  : '.athena:.athena.mit.edu.'
3292  Component : 'rcm_FreelanceKeys'</para>
3293                 </entry>
3294               </row>
3295             </tbody>
3296           </tgroup>
3297         </informaltable>
3298         <para>The example adds a read-only mountpoint to the athena.mit.edu cell's root.afs volume as well as a read-write mountpoint. Aliases are also provided using symlinks.
3299         </para>
3300       </section>
3301     </section>
3302     <section>
3303       <title id="Additional_Resources">7.3 Additional Resources</title>
3304       <para>If you want to add registry keys or files you need to create new components and features for those. Refer to the Windows Platform SDK for details.</para>
3305       <para>It is beyond the scope of this document to provide a comprehensive overview of how to add new resources through a transform. Please refer to the "Windows Installer" documentation for details. The relevant section is at :</para>
3306       <para>http://msdn.microsoft.com/library/en-us/msi/setup/using_transforms_to_add_resources.asp</para>
3307       <para>A sample walkthrough of adding a new configuration file is in section 2.3.</para>
3308       <para>Add new features under the 'feaClient' or 'feaServer' as appropriate and set the 'Level' column for those features to equal the 'Level' for their parent features for consistency. Note that none of the features in the OpenAFS for Windows MSI package are designed to be installed to run from 'source' or 'advertised'. It is recommended that you set 'msidbFeatureAttributesFavorLocal' (0), 'msidbFeatureAttributesFollowParent' (2) and 'msidbFeatureAttributesDisallowAdvertise' (8) attributes for new features.</para>
3309       <para>If you are creating new components, retain the same component GUID when creating new transforms against new releases of the OpenAFS MSI package.</para>
3310       <para>After making the adjustments to the MSI database using ORCA.EXE you can generate a transform with MSITRAN.EXE as follows :</para>
3311       <para>(Modified MSI package is 'openafs-en_US_new.msi' and the original MSI package is 'openafs-en_US.msi'. Generates transform 'openafs-transform.mst')</para>
3312       <para> &gt; msitran.exe -g openafs-en_US.msi openafs-en_US_new.msi openafs-transform.mst</para>
3313       <para>See the Platform SDK documentation for information on command line options for MSITRAN.EXE.</para>
3314     </section>
3315     <section>
3316       <title id="Upgrades">7.4. Upgrades</title>
3317       <para>The MSI package is designed to uninstall previous versions of OpenAFS for Windows during installation. Note that it doesn't directly upgrade an existing installation. This is intentional and ensures that development releases which do not have strictly increasing version numbers are properly upgraded.</para>
3318       <para>Versions of OpenAFS that are upgraded by the MSI package are:</para>
3319       <orderedlist inheritnum="ignore" continuation="restarts">
3320         <listitem>
3321           <para>OpenAFS MSI package</para>
3322           <para>Upgrade code {6823EEDD-84FC-4204-ABB3-A80D25779833}</para>
3323           <para>Up to current release</para>
3324         </listitem>
3325         <listitem>
3326           <para>MIT's Transarc AFS MSI package</para>
3327           <para>Upgrade code {5332B94F-DE38-4927-9EAB-51F4A64193A7}</para>
3328           <para>Up to version 3.6.2</para>
3329         </listitem>
3330         <listitem>
3331           <para>OpenAFS NSIS package</para>
3332           <para>All versions</para>
3333         </listitem>
3334       </orderedlist>
3335       <para>Note that versions of the OpenAFS NSIS package prior to 1.3.65 had a bug where it couldn't be uninstalled properly in unattended mode. Therefore the MSI package will not try to uninstall an OpenAFS NSIS package if running unattended. This means that group policy based deployments will fail on machines that have the OpenAFS NSIS package installed.</para>
3336       <para>If you have used a different MSI package to install OpenAFS and wish to upgrade it you can author rows into the 'Upgrade' table as described in the Platform SDK.</para>
3337       <para>When performing an upgrade with msiexec.exe execute the MSI with the repair options "vomus".</para>
3338     </section>
3339   </chapter>
3340   <chapter id="appendix_a" label="Appendix A">
3341     <title id="Registry_Values">Registry Values</title>
3342     <section id="Service_Parameters">
3343       <title>A.1. Service parameters</title>
3344       <para>The service parameters primarily affect the behavior of the AFS client service (afsd_service.exe).</para>
3345       <section>
3346         <title id="Regkey_TransarcAFSDaemon_Parameters">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</title>
3347         <section>
3348           <title id="Regkey_TransarcAFSDaemon_Parameters_LanAdapter">Value: LanAdapter</title>
3349           <indexterm significance="normal">
3350             <primary>LANadapter</primary>
3351           </indexterm>
3352           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3353           <para>Type: DWORD</para>
3354           <para>Default: -1</para>
3355           <para>Variable: LANadapter</para>
3356           <para>LAN adapter number to use. This is the lana number of the LAN adapter that the SMB server should bind to. If unspecified or set to -1, a LAN adapter with named 'AFS' or a loopback adapter will be selected. If neither are present, then all available adapters will be bound to. When binding to a non-loopback adapter, the NetBIOS name hostname%-AFS' will be used (where %hostname% is the NetBIOS name of the host truncated to 11 characters). Otherwise, the NetBIOS name will be 'AFS'.</para>
3357           <para>[This parameter is ignored unless SMB mode is active.]</para>
3358         </section>
3359         <section>
3360           <title id="Regkey_TransarcAFSDaemon_Parameters_CacheSize">Value: CacheSize</title>
3361           <indexterm significance="normal">
3362             <primary>CacheSize</primary>
3363           </indexterm>
3364           <para id="Value_CacheSize">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3365           <para>Type: DWORD</para>
3366           <para>Default: 98304 (CM_CONFIGDEFAULT_CACHESIZE)</para>
3367           <para>Variable: cm_initParams.cacheSize</para>
3368           <para>Size of the AFS data cache specified in 1k blocks.</para>
3369         </section>
3370         <section>
3371           <title id="Regkey_TransarcAFSDaemon_Parameters_ChunkSize">Value: ChunkSize</title>
3372           <indexterm significance="normal">
3373             <primary>ChunkSize</primary>
3374           </indexterm>
3375           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3376           <para>Type: DWORD</para>
3377           <para>Default: 20 (CM_CONFIGDEFAULT_CHUNKSIZE)</para>
3378           <para>Variable: cm_logChunkSize (cm_chunkSize = 1 &lt;&lt; cm_logChunkSize)</para>
3379           <para>Maximum size of chunk for reading and writing. Actual chunk size is
3380             2^cm_logChunkSize. The default chunk size is therefore 1 MB.</para>
3381         </section>
3382         <section>
3383           <title id="Regkey_TransarcAFSDaemon_Parameters_BlockSize">Value: BlockSize</title>
3384           <indexterm>
3385             <primary>BlockSize</primary>
3386           </indexterm>
3387           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3388           <para>Type: DWORD</para>
3389           <para>Default: 4096 (CM_CONFIGDEFAULT_BLOCKSIZE)</para>
3390           <para>Size of buffer allocation.  Must be an even multiple of 1024 and (2^cm_logChuckSize
3391             mod BlockSize) must equal zero.</para>
3392         </section>
3393         <section>
3394           <title id="Regkey_TransarcAFSDaemon_Parameters_Daemons">Value: Daemons</title>
3395           <para>
3396             <emphasis>Value: Daemons</emphasis>
3397           </para>
3398           <para>Type: DWORD</para>
3399           <para>Default: 16 (CM_CONFIGDEFAULT_DAEMONS)</para>
3400           <para>Variable: numBkgD</para>
3401           <para>Number of background daemon threads used to fetch data from and store data to the
3402             file servers.</para>
3403         </section>
3404         <section>
3405           <title id="Regkey_TransarcAFSDaemon_Parameters_ServerThreads">Value: ServerThreads</title>
3406           <indexterm significance="normal">
3407             <primary>ServerThreads</primary>
3408           </indexterm>
3409           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3410           <para>Type: DWORD</para>
3411           <para>Default: 25 (CM_CONFIGDEFAULT_SVTHREADS)</para>
3412           <para>Variable: numSvThreads</para>
3413           <para>Number of SMB server or AFS Redirector worker threads used to process application
3414             file system requests..</para>
3415         </section>
3416         <section>
3417           <title id="Regkey_TransarcAFSDaemon_Parameters_Stats">Value: Stats</title>
3418           <indexterm significance="normal">
3419             <primary>Stats</primary>
3420           </indexterm>
3421           <para id="Value_Stats">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3422           <para>Type: DWORD</para>
3423           <para>Default: 10000 (CM_CONFIGDEFAULT_STATS)</para>
3424           <para>Variable: cm_initParams.nStatCaches</para>
3425           <para>The number of file system status objects.  One status object is required for each
3426             directory entry (file, directory, mount point, symlink).</para>
3427         </section>
3428         <section>
3429           <title id="Regkey_TransarcAFSDaemon_Parameters_Volumes">Value: Volumes</title>
3430           <indexterm significance="normal">
3431             <primary>Volumes</primary>
3432           </indexterm>
3433           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3434           <para>Type: DWORD</para>
3435           <para>
3436 Default:  3333 (CM_CONFIGDEFAULT_STATS/3)
3437           </para>
3438           <para>
3439 Variable: cm_initParams.nVolumes</para>
3440           <para> The number of volume group objects.  One volume group object is required for each
3441             set of volume, volume.readonly and volume.backup. </para>
3442         </section>
3443         <section>
3444           <title id="Regkey_TransarcAFSDaemon_Parameters_Cells">Value: Cells</title>
3445           <indexterm significance="normal">
3446             <primary>Cells</primary>
3447           </indexterm>
3448           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3449           <para>Type: DWORD</para>
3450           <para>
3451 Default: 1024 (CM_CONFIGDEFAULT_CELLS)
3452           </para>
3453           <para>
3454 Variable: cm_initParams.nCells</para>
3455           <para> The number of cell objects.  One cell object is required for each cell accessed by
3456             the AFS cache manager.</para>
3457         </section>
3458         <section>
3459           <title id="Regkey_TransarcAFSDaemon_Parameters_LogoffPreserveTokens">Value: LogoffPreserveTokens</title>
3460           <indexterm significance="normal">
3461             <primary>LogoffPreserveTokens</primary>
3462           </indexterm>
3463           <para id="Value_LogoffPreserveTokens">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3464           <para>Type: DWORD {1,0}
3465                   </para>
3466           <para>
3467 Default : 0</para>
3468           <para>If enabled (set to 1), the Logoff Event handler will not attempt to delete the
3469             user's tokens if the user's profile is stored outside of AFS.  This option only applies
3470             when the AFS SMB gateway interface is in use.</para>
3471         </section>
3472         <section>
3473           <title id="Regkey_TransarcAFSDaemon_Parameters_RootVolume">Value: RootVolume</title>
3474           <indexterm significance="normal">
3475             <primary>RootVolume</primary>
3476           </indexterm>
3477           <indexterm significance="normal">
3478             <primary>root.afs</primary>
3479           </indexterm>
3480           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3481           <para>Type: REG_SZ
3482                   </para>
3483           <para>
3484 Default: "root.afs"
3485                   </para>
3486           <para>
3487 Variable: cm_rootVolumeName</para>
3488           <para>Root volume name.</para>
3489         </section>
3490         <section>
3491           <title id="Regkey_TransarcAFSDaemon_Parameters_MountRoot">Value: MountRoot</title>
3492           <indexterm significance="normal">
3493             <primary>MountRoot</primary>
3494           </indexterm>
3495           <indexterm significance="normal">
3496             <primary>/afs</primary>
3497           </indexterm>
3498           <para id="Value_Mountroot">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3499           <para>Type: REG_SZ
3500                   </para>
3501           <para>
3502 Default: "/afs"
3503                   </para>
3504           <para>
3505 Variable: cm_mountRoot</para>
3506           <para>Name of root mount point. In symlinks, if a path starts with cm_mountRoot, it is assumed that the path is absolute (as opposed to relative) and is adjusted accordingly. Eg: if a path is specified as /afs/athena.mit.edu/foo/bar/baz and cm_mountRoot is "/afs", then the path is interpreted as \\afs\all\athena.mit.edu\foo\bar\baz. If a path does not start with with cm_mountRoot, the path is assumed to be relative and suffixed to the reference directory (i.e. directory where the symlink exists)</para>
3507         </section>
3508         <section>
3509           <title id="Regkey_TransarcAFSDaemon_Parameters_CachePath">Value: CachePath</title>
3510           <indexterm significance="normal">
3511             <primary>CachePath</primary>
3512           </indexterm>
3513           <indexterm significance="normal">
3514             <primary>AFSCache</primary>
3515           </indexterm>
3516           <para id="Value_CachePath">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3517           <para>Type: Use REG_SZ if the path contains no expansion variables or REG_EXPAND_SZ if it
3518             does.</para>
3519           <para> Default: "%TEMP%\AFSCache"  (REG_EXPAND_SZ)</para>
3520           <para>
3521 Variable: cm_CachePath</para>
3522           <para>Location of on-disk cache file. The default is the SYSTEM account's TEMP directory. The attributes assigned to the file are HIDDEN and SYSTEM.</para>
3523         </section>
3524         <section>
3525           <title id="Regkey_TransarcAFSDaemon_Parameters_NonPersistentCaching">Value: NonPersistentCaching</title>
3526           <indexterm significance="normal">
3527             <primary>NonPersistentCaching</primary>
3528           </indexterm>
3529           <para id="Value_NonPersistentCaching">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3530           <para>Type: DWORD [0..1]
3531                   </para>
3532           <para>
3533 Default: 0
3534                   </para>
3535           <para>
3536 Variable: buf_CacheType</para>
3537           <para>When this registry value is set to a non-zero value, the CachePath value is ignored and the cache data is stored in the windows paging file. This disables the use of persistent caching and the ability to maintain a single UUID for the AFS client service across restarts.</para>
3538         </section>
3539         <section>
3540           <title id="Regkey_TransarcAFSDaemon_Parameters_ValidateCache">Value: ValidateCache</title>
3541           <indexterm significance="normal">
3542             <primary>ValidateCache</primary>
3543           </indexterm>
3544           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3545           <para>Type: DWORD [0..2]
3546                   </para>
3547           <para>
3548 Default: 1
3549                   </para>
3550           <para>
3551 Variable: buf_CacheType</para>
3552           <para>This value determines if and when persistent cache validation is performed.</para>
3553           <para>
3554             <simplelist type="vert">
3555               <member>0 - Validation is disabled</member>
3556               <member>1 - Validation is performed at startup</member>
3557               <member>2 - Validation is performed at shutdown</member>
3558             </simplelist>
3559           </para>
3560         </section>
3561         <section>
3562           <title id="Regkey_TransarcAFSDaemon_Parameters_TrapOnPanic">Value: TrapOnPanic</title>
3563           <indexterm significance="normal">
3564             <primary>TrapOnPanic</primary>
3565           </indexterm>
3566           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3567           <para>Type: DWORD {1,0}
3568                   </para>
3569           <para>
3570 Default: 0
3571                   </para>
3572           <para>
3573 Variable: traceOnPanic</para>
3574           <para>Issues a breakpoint in the event of a panic. (breakpoint: _asm int 3).</para>
3575         </section>
3576         <section>
3577           <title id="Regkey_TransarcAFSDaemon_Parameters_NetbiosName">Value: NetbiosName</title>
3578           <indexterm significance="normal">
3579             <primary>NetbiosName</primary>
3580           </indexterm>
3581           <indexterm significance="normal">
3582             <primary>SMB Server Name</primary>
3583           </indexterm>
3584           <indexterm significance="normal">
3585             <primary>\\AFS</primary>
3586           </indexterm>
3587           <para id="Value_NetbiosName">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3588           <para>Type: REG_EXPAND_SZ
3589                   </para>
3590           <para>
3591 Default: "AFS"
3592                   </para>
3593           <para>
3594 Variable: cm_NetbiosName</para>
3595           <para>Specifies the NetBIOS name (or SMB Server Name) to be used when binding to a
3596             Loopback adapter. To provide the old behavior specify a value of "%COMPUTERNAME%-AFS".
3597             When the AFS Redirector interface is in use, this value specifies the UNC server name
3598             registered with the Windows Multiple UNC Provider.</para>
3599         </section>
3600         <section>
3601           <title id="Regkey_TransarcAFSDaemon_Parameters_IsGateway">Value: IsGateway</title>
3602           <indexterm significance="normal">
3603             <primary>IsGateway</primary>
3604           </indexterm>
3605           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3606           <para>Type: DWORD {1,0}
3607                   </para>
3608           <para>
3609 Default: 0
3610                   </para>
3611           <para>
3612 Variable: isGateway</para>
3613           <para>Select whether or not this AFS client should act as a gateway. If set and the NetBIOS name hostname-AFS is bound to a physical NIC, other machines in the subnet can access AFS via SMB connections to hostname-AFS.</para>
3614           <para>When IsGateway is non-zero, the LAN adapter detection code will avoid binding to a loopback adapter. This will ensure that the NetBIOS name will be of the form hostname-AFS instead of the value set by the "NetbiosName" registry value.</para>
3615           <para>This setting only applies when the AFS SMB interface is in use.</para>
3616         </section>
3617         <section>
3618           <title id="Regkey_TransarcAFSDaemon_Parameters_ReportSessionStartups">Value: ReportSessionStartups</title>
3619           <indexterm significance="normal">
3620             <primary>ReportSessionStartups</primary>
3621           </indexterm>
3622           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3623           <para>Type: DWORD {1,0}
3624                   </para>
3625           <para>
3626 Default: 0
3627                   </para>
3628           <para>
3629 Variable: reportSessionStartups</para>
3630           <para>If enabled, all SMB sessions created are recorded in the Application event log. This also enables other events such as drive mappings or various error types to be logged.</para>
3631         </section>
3632         <section>
3633           <title id="Regkey_TransarcAFSDaemon_Parameters_TraceBufferSize">Value: TraceBufferSize</title>
3634           <indexterm significance="normal">
3635             <primary>TraceBufferSize</primary>
3636           </indexterm>
3637           <para id="Value_TraceBufferSize">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3638           <para>Type: DWORD
3639                   </para>
3640           <para>
3641 Default: 10000 (CM_CONFIGDEFAULT_TRACEBUFSIZE)
3642                   </para>
3643           <para>
3644 Variable: traceBufSize</para>
3645           <para>Number of entries to store in trace log.</para>
3646         </section>
3647         <section>
3648           <title id="Regkey_TransarcAFSDaemon_Parameters_SysName">Value: SysName</title>
3649           <indexterm significance="normal">
3650             <primary>SysName</primary>
3651           </indexterm>
3652           <para id="Value_SysName">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3653           <para>Type: REG_SZ
3654                   </para>
3655           <para>
3656 Default: "x86_win32 i386_w2k i386_nt40" (X86)
3657                   </para>
3658           <para>
3659 "amd64_win64 x86_win32 i386_w2k" (AMD64)
3660                   </para>
3661           <para>
3662 Variable: cm_sysName</para>
3663           <para>Provides an initial value for "fs sysname". The string can contain one or more replacement values for @sys in order of preference separated by whitespace.</para>
3664         </section>
3665         <section>
3666           <title id="Regkey_TransarcAFSDaemon_Parameters_SecurityLevel">Value: SecurityLevel</title>
3667           <indexterm significance="normal">
3668             <primary>SecurityLevel</primary>
3669           </indexterm>
3670           <indexterm significance="normal">
3671             <primary>fs setcrypt</primary>
3672           </indexterm>
3673           <para id="Value_SecurityLevel">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3674           <para>Type: DWORD {1,0}
3675                   </para>
3676           <para>
3677 Default: 0
3678                   </para>
3679           <para>
3680 Variable: cryptall</para>
3681           <para>Enables encryption on RX calls.</para>
3682         </section>
3683         <section>
3684           <title id="Regkey_TransarcAFSDaemon_Parameters_UseDNS">Value: UseDNS</title>
3685           <indexterm significance="normal">
3686             <primary>UseDNS</primary>
3687           </indexterm>
3688           <indexterm significance="normal">
3689             <primary>AFSDB DNS records</primary>
3690           </indexterm>
3691           <indexterm significance="normal">
3692             <primary>SRV DNS records</primary>
3693           </indexterm>
3694           <para id="Value_UseDNS">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3695           <para>Type: DWORD {1,0}
3696                   </para>
3697           <para>
3698 Default: 1
3699                   </para>
3700           <para>
3701 Variable: cm_dnsEnabled</para>
3702           <para>Enables resolving volservers using AFSDB DNS and SRV DNS queries.</para>
3703         </section>
3704         <section>
3705           <title id="Regkey_TransarcAFSDaemon_Parameters_FreelanceClient">Value: FreelanceClient</title>
3706           <indexterm significance="normal">
3707             <primary>FreelanceClient</primary>
3708           </indexterm>
3709           <indexterm significance="normal">
3710             <primary>dynroot</primary>
3711           </indexterm>
3712           <para id="Value_FreelanceClient">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3713           <para>Type: DWORD {1,0}
3714                   </para>
3715           <para>
3716 Default: 0
3717                   </para>
3718           <para>
3719 Variable: cm_freelanceEnabled</para>
3720           <para>Enables freelance client.</para>
3721         </section>
3722         <section>
3723           <title id="Regkey_TransarcAFSDaemon_Parameters_FreelanceImportCellServDB">Value: FreelanceImportCellServDB</title>
3724           <indexterm significance="normal">
3725             <primary>FreelanceImportCellServDB</primary>
3726           </indexterm>
3727           <indexterm significance="normal">
3728             <primary>dynroot</primary>
3729           </indexterm>
3730           <para id="Value_FreelanceImportCellServDB">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3731           <para>Type: DWORD {1,0}
3732           </para>
3733           <para>
3734             Default: 0
3735           </para>
3736           <para>
3737             Variable: cm_freelanceImportCellServDB</para>
3738           <para>Creates Freelance Mount Points for each cell listed in the CellServDB during startup.</para>
3739         </section>
3740         <section>
3741           <title id="Regkey_TransarcAFSDaemon_Parameters_FreelanceDiscovery">Value: FreelanceDiscovery</title>
3742           <indexterm significance="normal">
3743             <primary>FreelanceDiscovery</primary>
3744           </indexterm>
3745           <indexterm significance="normal">
3746             <primary>dynroot</primary>
3747           </indexterm>
3748           <para id="Value_FreelanceDiscovery">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3749           <para>Type: DWORD {1,0}
3750           </para>
3751           <para>
3752             Default: 1
3753           </para>
3754           <para>
3755             Variable: cm_freelanceDiscovery</para>
3756           <para>Enables automatic discovery of cell mount points within the Freelance root.</para>
3757         </section>
3758         <section>
3759           <title id="Regkey_TransarcAFSDaemon_Parameters_HideDotFiles">Value: HideDotFiles</title>
3760           <indexterm significance="normal">
3761             <primary>HideDotFiles</primary>
3762           </indexterm>
3763           <para id="Value_HideDotFiles">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3764           <para>Type: DWORD {1,0}
3765                   </para>
3766           <para>
3767 Default: 1
3768                   </para>
3769           <para>
3770 Variable: smb_hideDotFiles</para>
3771           <para>Enables marking dotfiles with the hidden attribute. Dot files are files whose name starts with a period (excluding "." and "..").</para>
3772         </section>
3773         <section>
3774           <title id="Regkey_TransarcAFSDaemon_Parameters_MaxMpxRequests">Value: MaxMpxRequests</title>
3775           <indexterm significance="normal">
3776             <primary>MaxMpxRequests</primary>
3777           </indexterm>
3778           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3779           <para>Type: DWORD
3780                   </para>
3781           <para>
3782 Default: 50
3783                   </para>
3784           <para>
3785 Variable: smb_maxMpxRequests</para>
3786           <para>Maximum number of multiplexed SMB requests that can be made.</para>
3787         </section>
3788         <section>
3789           <title id="Regkey_TransarcAFSDaemon_Parameters_MaxVCPerServer">Value: MaxVCPerServer</title>
3790           <indexterm significance="normal">
3791             <primary>MaxVCPerServer</primary>
3792           </indexterm>
3793           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3794           <para>Type: DWORD
3795                   </para>
3796           <para>
3797 Default: 100
3798                   </para>
3799           <para>
3800 Variable: smb_maxVCPerServer</para>
3801           <para>Maximum number of SMB virtual circuits.</para>
3802         </section>
3803         <section>
3804           <title id="Regkey_TransarcAFSDaemon_Parameters_Cell">Value: Cell</title>
3805           <indexterm significance="normal">
3806             <primary>Cell</primary>
3807           </indexterm>
3808           <indexterm significance="normal">
3809             <primary>workstation cell name</primary>
3810           </indexterm>
3811           <para id="Value_Cell">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3812           <para>Type: REG_SZ
3813                   </para>
3814           <para>
3815 Default: &lt;none&gt;
3816                   </para>
3817           <para>
3818 Variable: rootCellName</para>
3819           <para>Name of root cell (the cell from which the RootVolume, root.afs, should be mounted in \\afs\all).</para>
3820         </section>
3821         <section>
3822           <title id="Regkey_TransarcAFSDaemon_Parameters_RxEnablePeerStats">Value: RxEnablePeerStats</title>
3823           <indexterm significance="normal">
3824             <primary>RxEnablePeerStats</primary>
3825           </indexterm>
3826           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3827           <para>Type: DWORD {0, 1}
3828                   </para>
3829           <para>
3830 Default: 1
3831                   </para>
3832           <para>
3833 Variable: rx_enable_peer_stats</para>
3834           <para>When set to 1, the Rx library collects peer statistics.</para>
3835         </section>
3836         <section>
3837           <title id="Regkey_TransarcAFSDaemon_Parameters_RxEnableProcessStats">Value: RxEnableProcessStats</title>
3838           <indexterm significance="normal">
3839             <primary>RxEnableProcessStats</primary>
3840           </indexterm>
3841           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3842           <para>Type: DWORD {0, 1}
3843                   </para>
3844           <para>
3845 Default: 1
3846                   </para>
3847           <para>
3848 Variable: rx_extra_process_stats</para>
3849           <para>When set to 1, the Rx library collects process statistics.</para>
3850         </section>
3851         <section>
3852           <title id="Regkey_TransarcAFSDaemon_Parameters_RxExtraPackets">Value: RxExtraPackets</title>
3853           <indexterm significance="normal">
3854             <primary>RxExtraPackets</primary>
3855           </indexterm>
3856           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3857           <para>Type: DWORD
3858                   </para>
3859           <para>
3860 Default: 120
3861                   </para>
3862           <para>
3863 Variable: rx_extraPackets</para>
3864           <para>When set, this number of extra Rx packets are allocated at startup.</para>
3865         </section>
3866         <section>
3867           <title id="Regkey_TransarcAFSDaemon_Parameters_RxMaxMTU">Value: RxMaxMTU</title>
3868           <indexterm significance="normal">
3869             <primary>RxMaxMTU</primary>
3870           </indexterm>
3871           <para id="Value_RxMaxMTU">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3872           <para>Type: DWORD
3873                   </para>
3874           <para>
3875 Default: 0
3876                   </para>
3877           <para>
3878 Variable: rx_mtu</para>
3879           <para>If set to anything other than 0, that value is used as the maximum send and receive MTU supported by the RX interface.</para>
3880           <para>In order to enable OpenAFS to operate across releases of the Cisco IPSec VPN client prior than 5.0, this value must be set to 1264 or smaller.</para>
3881         </section>
3882         <section>
3883           <title id="Regkey_TransarcAFSDaemon_Parameters_RxNoJumbo">Value: RxNoJumbo</title>
3884           <indexterm significance="normal">
3885             <primary>RxNoJumbo</primary>
3886           </indexterm>
3887           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3888           <para>Type: DWORD {0,1}
3889                   </para>
3890           <para>
3891 Default: 0
3892                   </para>
3893           <para>
3894 Variable: rx_nojumbo</para>
3895           <para>If enabled, does not send or indicate that we are able to send or receive RX jumbograms.</para>
3896         </section>
3897         <section>
3898           <title id="Regkey_TransarcAFSDaemon_Parameters_ConnDeadTimeout">Value: ConnDeadTimeout</title>
3899           <indexterm significance="normal">
3900             <primary>ConnDeadTimeout</primary>
3901           </indexterm>
3902           <para id="Value_ConnDeadTimeout">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3903           <para>
3904                      Type: DWORD
3905                   </para>
3906           <para>
3907                      Default: 0 (seconds)
3908                   </para>
3909           <para>
3910                      Variable: ConnDeadtimeout</para>
3911           <para>When the value is 0, this setting is configured to be one-half the HardDeadTimeout value.</para>
3912         </section>
3913         <section>
3914           <title id="Regkey_TransarcAFSDaemon_Parameters_HardDeadTimeout">Value: HardDeadTimeout</title>
3915           <indexterm significance="normal">
3916             <primary>HardDeadTimeout</primary>
3917           </indexterm>
3918           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3919           <para>
3920                      Type: DWORD
3921                   </para>
3922           <para>
3923                      Default: 0 (seconds)
3924                   </para>
3925           <para>
3926                      Variable: HardDeadtimeout</para>
3927           <para>The Hard Dead Time is enforced to be at least double the ConnDeadTimeout. The provides an opportunity for at least one retry. </para>
3928           <para>The value 0 seconds means that the real timeout should be set to be equal to the minimum SMB timeout which can be configured in the registry at: </para>
3929           <para>
3930           </para>
3931           <para>  [HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters]</para>
3932           <para>    SessTimeout</para>
3933           <para>
3934           </para>
3935           <para>If the minimum SMB timeout is not specified the value is 45 seconds. See
3936                     <ulink url="http://support.microsoft.com/support/kb/articles/Q102/0/67.asp">http://support.microsoft.com:80/support/kb/articles/Q102/0/67.asp</ulink></para>
3937         </section>
3938         <section>
3939           <title id="Regkey_TransarcAFSDaemon_Parameters_IdleDeadTimeout">Value: IdleDeadTimeout</title>
3940           <indexterm significance="normal">
3941             <primary>IdleDeadTimeout</primary>
3942           </indexterm>
3943           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3944           <para>Type: DWORD </para>
3945           <para>Default: 1200 (seconds) </para>
3946           <para>Variable: IdleDeadtimeout </para>
3947           <para>The Idle Dead Time determines how long the cache manager will wait for an RPC on a
3948             non-replicated volume to complete when the service is responding only with keep alive
3949             messages.  When there is no replica available there is no other file server to try.  An
3950             idle dead timeout in this case is fatal.  This option is intended to protect a client
3951             against a file server that never responds.  This value must be larger that the file
3952             server hard dead timeout of 120 seconds.</para>
3953         </section>
3954         <section>
3955           <title>Value: ReplicaIdleDeadTimeout</title>
3956           <indexterm>
3957             <primary>ReplicaIdleDeadTimeout</primary>
3958           </indexterm>
3959           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3960           <para>Type: DWORD</para>
3961           <para>Default: 180 (seconds)</para>
3962           <para>Variable: ReplicaIdleDeadtimeout</para>
3963           <para>The Replica Idle Dead Time determines how long the cache manager will wait for an
3964             RPC on a replicated volume to complete when the service is responding only with keep
3965             alive messages.  When a volume is replicated the cache manager can choose to retry the
3966             request against a file server hosting one of the replicas.  This value must be larger
3967             that the file server hard dead timeout of 120 seconds.</para>
3968         </section>
3969         <section>
3970           <title id="Regkey_TransarcAFSDaemon_Parameters_NATPingInterval">Value: NATPingInterval</title>
3971           <indexterm significance="normal">
3972             <primary>NATPingInterval</primary>
3973           </indexterm>
3974           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
3975           <para>
3976                      Type: DWORD
3977                   </para>
3978           <para>
3979                         Default: 0 (seconds)
3980                   </para>
3981           <para>
3982                         Variable: NatPingInterval
3983                   </para>
3984           <para>
3985                      The NAT Ping Interval determines how frequently a low-level Rx ping packet is sent to
3986                      every file server using an anonymous connection.  The value 0 seconds disables the
3987                      functionality.  A non-zero value activates the NAT ping behavior.  This option can be
3988                      enabled on clients that access AFS file servers from behind a NAT or port mapping
3989                      firewall that maintains a short timeout on UDP port mappings.  In this case the AFS
3990                      cache manager may not receive AFS callbacks from the file server.  This registry value
3991                      should be set to a number of seconds shorter than the port mapping timeout period.
3992                      When there is no other information to go on, a value of 20 seconds can be used.
3993                   </para>
3994         </section>
3995         <section>
3996           <title id="Regkey_TransarcAFSDaemon_Parameters_TraceOption">Value: TraceOption</title>
3997           <indexterm significance="normal">
3998             <primary>TraceOption</primary>
3999           </indexterm>
4000           <para id="Value_TraceOption">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4001           <para>Type: DWORD {0-15}
4002                   </para>
4003           <para>
4004 Default: 0</para>
4005           <para>Enables logging of debug output to the Windows Event Log.</para>
4006           <para>Bit 0 enables logging of "Logon Events" processed by the Network Provider and Winlogon Event Notification Handler. </para>
4007           <para>Bit 1 enables logging of events captured by the AFS Client Service.</para>
4008           <para>Bit 2 enables real-time viewing of "fs trace" logging with DbgView or similar tools.</para>
4009           <para>Bit 3 enables "fs trace" logging on startup.</para>
4010         </section>
4011         <section>
4012           <title id="Regkey_TransarcAFSDaemon_Parameters_AllSubmount">Value: AllSubmount</title>
4013           <indexterm significance="normal">
4014             <primary>AllSubmount</primary>
4015           </indexterm>
4016           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4017           <para>Type: DWORD {0, 1}
4018                   </para>
4019           <para>
4020 Default: 1</para>
4021           <para>Variable: allSubmount (smb.c)</para>
4022           <para>By setting this value to 0, the "\\NetbiosName\all" mount point will not be created. This allows the read-write versions of root.afs to be hidden.</para>
4023         </section>
4024         <section>
4025           <title id="Regkey_TransarcAFSDaemon_Parameters_NoFindLanaByName">Value: NoFindLanaByName</title>
4026           <indexterm significance="normal">
4027             <primary>NoFindLanaByName</primary>
4028           </indexterm>
4029           <para id="Value_NoFindLanaByName">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4030           <para>Type: DWORD {0, 1}
4031                   </para>
4032           <para>
4033 Default: 0</para>
4034           <para>Disables the attempt to identity the network adapter to use by looking for an adapter with a display name of "AFS".</para>
4035         </section>
4036         <section>
4037           <title id="Regkey_TransarcAFSDaemon_Parameters_MaxCPUs">Value: MaxCPUs</title>
4038           <indexterm significance="normal">
4039             <primary>MaxCPUs</primary>
4040           </indexterm>
4041           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4042           <para>Type: DWORD {1..32} or {1..64} depending on the architecture
4043                   </para>
4044           <para> Default: 2</para>
4045           <para>If this value is specified, afsd_service.exe will restrict itself to executing on
4046             the specified number of CPUs if there are a greater number installed in the machine.
4047             Performance profiling shows that overall system performance degrades when the
4048             afsd_service.exe is permitted to execute on more than two cores.</para>
4049         </section>
4050         <section>
4051           <title id="Regkey_TransarcAFSDaemon_Parameters_SmbAuthType">Value: SmbAuthType</title>
4052           <indexterm significance="normal">
4053             <primary>SMBAuthType</primary>
4054           </indexterm>
4055           <para id="Value_smbAuthType">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4056           <para>Type: DWORD {0..2}
4057                   </para>
4058           <para>
4059 Default: 2</para>
4060           <para>If this value is specified, it defines the type of SMB authentication which must be present in order for the Windows SMB client to connect to the AFS Client Service's SMB server. The values are:</para>
4061           <para>0 = No authentication required
4062                   </para>
4063           <para>
4064             <simplelist type="vert">
4065               <member>
4066 1 = NTLM authentication required
4067 </member>
4068               <member>
4069 2 = Extended (GSS SPNEGO) authentication required
4070 </member>
4071             </simplelist>
4072           </para>
4073           <para> The default is Extended authentication  This value only applies when the SMB server
4074             interface is in use.</para>
4075         </section>
4076         <section>
4077           <title id="Regkey_TransarcAFSDaemon_Parameters_MaxLogSize">Value: MaxLogSize</title>
4078           <indexterm significance="normal">
4079             <primary>MaxLogSize</primary>
4080           </indexterm>
4081           <para id="Value_MaxLogSize">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4082           <para>Type: DWORD {0 .. MAXDWORD}
4083                   </para>
4084           <para>
4085 Default: 100K</para>
4086           <para>This entry determines the maximum size of the %WINDIR%\TEMP\afsd_init.log file. If the file is larger than this value when afsd_service.exe starts the file will be reset to 0 bytes. If this value is 0, it means the file should be allowed to grow indefinitely.</para>
4087         </section>
4088         <section>
4089           <title id="Regkey_TransarcAFSDaemon_Parameters_FlushOnHibernate">Value: FlushOnHibernate</title>
4090           <indexterm significance="normal">
4091             <primary>FlushOnHibernate</primary>
4092           </indexterm>
4093           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4094           <para>Type: DWORD {0,1}
4095                   </para>
4096           <para>
4097 Default: 1</para>
4098           <para>If set, flushes all volumes before the machine goes on hibernate or stand-by.</para>
4099         </section>
4100         <section>
4101           <title id="Regkey_TransarcAFSDaemon_Parameters_DaemonCheckDownInterval">Value: DaemonCheckDownInterval</title>
4102           <indexterm significance="normal">
4103             <primary>DaemonCheckDownInterval</primary>
4104           </indexterm>
4105           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4106           <para>Type: DWORD (seconds)
4107                   </para>
4108           <para>
4109 Default: 180</para>
4110           <para>This value controls how frequently the AFS cache manager probes servers that are marked as "down".</para>
4111         </section>
4112         <section>
4113           <title id="Regkey_TransarcAFSDaemon_Parameters_DaemonCheckUpInterval">Value: DaemonCheckUpInterval</title>
4114           <indexterm significance="normal">
4115             <primary>DaemonCheckUpInterval</primary>
4116           </indexterm>
4117           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4118           <para>Type: DWORD (seconds)
4119                   </para>
4120           <para>
4121 Default: 600</para>
4122           <para>This value controls how frequently the AFS cache manager probes servers that are marked as "up".</para>
4123         </section>
4124         <section>
4125           <title id="Regkey_TransarcAFSDaemon_Parameters_DaemonCheckVolInterval">Value: DaemonCheckVolInterval</title>
4126           <indexterm significance="normal">
4127             <primary>DaemonCheckVolInterval</primary>
4128           </indexterm>
4129           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4130           <para>Type: DWORD (seconds)
4131                   </para>
4132           <para>
4133 Default: 3600</para>
4134           <para>This value controls how frequently the AFS cache manager forces a reset on the existing volume database information.</para>
4135         </section>
4136         <section>
4137           <title id="Regkey_TransarcAFSDaemon_Parameters_DaemonCheckCBInterval">Value: DaemonCheckCBInterval</title>
4138           <indexterm significance="normal">
4139             <primary>DaemonCheckCBInterval</primary>
4140           </indexterm>
4141           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4142           <para>Type: DWORD (seconds)
4143                   </para>
4144           <para>
4145 Default: 60</para>
4146           <para>This value controls how frequently the AFS cache manager checks for callback invalidation.</para>
4147         </section>
4148         <section>
4149           <title id="Regkey_TransarcAFSDaemon_Parameters_DaemonCheckLockInterval">Value: DaemonCheckLockInterval</title>
4150           <indexterm significance="normal">
4151             <primary>DaemonCheckLockInterval</primary>
4152           </indexterm>
4153           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4154           <para>Type: DWORD (seconds)
4155                   </para>
4156           <para>
4157 Default: 60</para>
4158           <para>This value controls how frequently the AFS cache manager checks for invalid file locks.</para>
4159         </section>
4160         <section>
4161           <title id="Regkey_TransarcAFSDaemon_Parameters_DaemonCheckTokenInterval">Value: DaemonCheckTokenInterval</title>
4162           <indexterm significance="normal">
4163             <primary>DaemonCheckTokenInterval</primary>
4164           </indexterm>
4165           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4166           <para>Type: DWORD (seconds)
4167                   </para>
4168           <para>
4169 Default: 180</para>
4170           <para>This value controls how frequently the AFS cache manager checks for expired tokens.</para>
4171         </section>
4172         <section>
4173           <title id="Regkey_TransarcAFSDaemon_Parameters_DaemonCheckOfflineVolInterval">Value: DaemonCheckOfflineVolInterval</title>
4174           <indexterm significance="normal">
4175             <primary>DaemonCheckOfflineVolInterval</primary>
4176           </indexterm>
4177           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4178           <para>Type: DWORD (seconds)
4179                   </para>
4180           <para>
4181 Default: 600</para>
4182           <para>This value controls how frequently the AFS cache manager checks offline volumes to see if they have come back online.  At the same time volumes which were determined to be busy have their state reset to online.</para>
4183         </section>
4184         <section>
4185           <title id="Regkey_TransarcAFSDaemon_Parameters_CallBackPort">Value: CallBackPort</title>
4186           <indexterm significance="normal">
4187             <primary>CallBackPort</primary>
4188           </indexterm>
4189           <indexterm significance="normal">
4190             <primary>port 7001/udp</primary>
4191           </indexterm>
4192           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4193           <para>Type: DWORD
4194                   </para>
4195           <para>
4196 Default: 7001</para>
4197           <para>This value specifies which port number should be used for receiving callbacks from the file server.  The standard AFS Callback port is 7001.  Alternative values can be useful if the client is behind a NAT and a permanent port mapping for the client is being configured.</para>
4198         </section>
4199         <section>
4200           <title id="Regkey_TransarcAFSDaemon_Parameters_EnableServerLocks">Value: EnableServerLocks</title>
4201           <indexterm significance="normal">
4202             <primary>EnableServerLocks</primary>
4203           </indexterm>
4204           <para id="Value_EnableServerLocks">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4205           <para>Type: DWORD {0, 1, 2}
4206                   </para>
4207           <para>
4208 Default: 1</para>
4209           <para>Determines whether or not the AFS file server is contacted for </para>
4210           <para>0: never obtain server locks</para>
4211           <para>1: obtain server locks unless the file server says not to</para>
4212           <para>2: always obtain server locks</para>
4213         </section>
4214         <section>
4215           <title id="Regkey_TransarcAFSDaemon_Parameters_DeleteReadOnly">Value: DeleteReadOnly</title>
4216           <indexterm significance="normal">
4217             <primary>DeleteReadOnly</primary>
4218           </indexterm>
4219           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4220           <para>Type: DWORD {0, 1}
4221                   </para>
4222           <para>
4223 Default: 0</para>
4224           <para>Determines whether or not the AFS Cache Manager will permit files marked with the "Read Only" DOS attribute to be deleted or not.  For compatibility with Explorer, the default is ‘no'.</para>
4225           <para>0: do not permit "Read Only" files to be deleted.</para>
4226           <para>1: delete files that have the "Read Only" attribute set without complaint.</para>
4227         </section>
4228         <section>
4229           <title id="Regkey_TransarcAFSDaemon_Parameters_BPlusTrees">Value: BPlusTrees</title>
4230           <indexterm significance="normal">
4231             <primary>BPlusTrees</primary>
4232           </indexterm>
4233           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4234           <para>Type: DWORD {0, 1}
4235                   </para>
4236           <para>
4237 Default: 1</para>
4238           <para>Determines whether or not the AFS Cache Manager uses locally constructed B+ Trees to speed up the performance of directory searches.  </para>
4239           <para>0: do not use B+ Trees for directory lookups</para>
4240           <para>1: use B+ Trees for directory lookups</para>
4241         </section>
4242         <section>
4243           <title id="Regkey_TransarcAFSDaemon_Parameters_PrefetchExecutableExtensions">Value: PrefetchExecutableExtensions</title>
4244           <indexterm significance="normal">
4245             <primary>PrefetchExecutableExtensions</primary>
4246           </indexterm>
4247           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4248           <para>Type: MULTI_SZ
4249                   </para>
4250           <para>
4251 Default: none specified</para>
4252           <para>The AFS Cache Manager will pre-fetch the entire contents of any file whose name matches ends with one of the specified extensions.  This option is intended for use primarily with executables and dynamic link libraries that should be fully cached prior to a machine losing its connection with the file server.</para>
4253         </section>
4254         <section>
4255           <title id="Regkey_TransarcAFSDaemon_Parameters_OfflineReadOnlyIsValid">Value: OfflineReadOnlyIsValid</title>
4256           <indexterm significance="normal">
4257             <primary>OfflineReadOnlyIsValid</primary>
4258           </indexterm>
4259           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4260           <para>Type: DWORD {0, 1}
4261                   </para>
4262           <para>
4263 Default: 0</para>
4264           <para>Determines whether or not cached data from .readonly volumes is considered valid even if a callback cannot be registered with a file server.  This option is meant to be used by organizations for whom .readonly volume content very rarely changes (if ever.)</para>
4265           <para>0: do not treat offline .readonly content as valid</para>
4266           <para>1: treat offline .readonly content as valid</para>
4267         </section>
4268         <section>
4269           <title id="Regkey_TransarcAFSDaemon_Parameters_GiveUpAllCallBacks">Value: GiveUpAllCallBacks</title>
4270           <indexterm significance="normal">
4271             <primary>GiveUpAllCallBacks</primary>
4272           </indexterm>
4273           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4274           <para>Type: DWORD {0, 1}
4275                   </para>
4276           <para> Default: 1</para>
4277           <para>Determines whether or not the AFS Cache Manager will give up all callbacks prior to the service being suspended or shutdown.  Doing so will have significant performance benefits for the file servers.  However, file servers older than 1.4.6 can become unstable if the GiveUpAllCallBacks RPC is executed.</para>
4278           <para>0: do not perform GiveUpAllCallBacks RPCs</para>
4279           <para>1: perform GiveUpAllCallBacks RPCs </para>
4280         </section>
4281         <section>
4282           <title id="Regkey_TransarcAFSDaemon_Parameters_ReadOnlyVolumeVersioning">Value: ReadOnlyVolumeVersioning</title>
4283           <indexterm significance="normal">
4284             <primary>ReadOnlyVolumeVersioning</primary>
4285           </indexterm>
4286           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4287           <para>Type: DWORD {0, 1}
4288                   </para>
4289           <para>Default: 0</para>
4290           <para>Determines whether or not the AFS Cache Manager will will make use of the volume
4291             version information reported by the file server as part of the AFSVolSync data
4292             structure. Use of volume version information can significantly reduce the number of
4293             FetchStatus RPCs issued on objects stored in read-only volumes. This functionality is
4294             disabled by default because all OpenAFS file servers older than OpenAFS 1.4.10 failed to
4295             include valid volume version information as part of the BulkStatus and InlineBulkStatus
4296             RPCs. </para>
4297           <para>0: do not make use of volume version information</para>
4298           <para>1: make use of volume version information</para>
4299         </section>
4300         <section>
4301           <title id="Regkey_TransarcAFSDaemon_Parameters_FollowBackupPath">Value: FollowBackupPath</title>
4302           <indexterm significance="normal">
4303             <primary>FollowBackupPath</primary>
4304           </indexterm>
4305           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4306           <para>Type: DWORD {0, 1}
4307                   </para>
4308           <para>Default: 0</para>
4309           <para>Determines whether or not the AFS Cache Manager will give preference to .backup volumes when following mount points that originate in a .backup volume.</para>
4310           <para>0: do not prefer .backup volumes when the mount point originates in a .backup volume.</para>
4311           <para>1: prefer .backup volumes when the mount point originates in a .backup volume.</para>
4312         </section>
4313         <section>
4314           <title id="Regkey_TransarcAFSDaemon_Parameters_RxUdpBufSize">Value: RxUdpBufSize</title>
4315           <indexterm significance="normal">
4316             <primary>RxUdpBufSize</primary>
4317           </indexterm>
4318           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4319           <para>Type: DWORD {bytes}
4320                   </para>
4321           <para>Default: 262144</para>
4322           <para>Specifies the UDP socket receive and send buffer sizes..</para>
4323         </section>
4324         <section>
4325           <title>Value: VerifyData</title>
4326           <indexterm>
4327             <primary>VerifyData</primary>
4328           </indexterm>
4329           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4330           <para>Type: DWORD {0, 1}</para>
4331           <para>Default: 0</para>
4332           <para>1: after every RXAFS_StoreData RPC immediately perform an RXAFS_FetchData RPC and
4333             verify that the data was correctly stored on the file server.  If the data does not
4334             match, retry the store operation until it does.</para>
4335           <para>The "fs getverify" and "fs setverify {on, off}" commands can be used to query and
4336             set this value at runtime.</para>
4337         </section>
4338         <section>
4339           <title id="Regkey_TransarcAFSDaemon_Parameters_ShortNames">Value: ShortNames</title>
4340           <indexterm significance="normal">
4341             <primary>ShortNames</primary>
4342           </indexterm>
4343           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4344           <para>Type: DWORD {0, 1}
4345           </para>
4346           <para> Default: 0 on Windows 7, Windows 8, Server 2008 R2 and Server 2012, 1
4347             otherwise</para>
4348           <para>Determines whether or not the AFS Cache Manager will generate 8.3 compatible shortnames for all objects stored in AFS.  Short names are disabled by default on Windows 8 and Server 2012.  All prior operating systems enable short names by default.</para>
4349           <para>0: do not generate 8.3 compatible short names.</para>
4350           <para>1: generate 8.3 compatible short names.</para>
4351         </section>
4352         <section>
4353           <title id="Regkey_TransarcAFSDaemon_Parameters_DirectIO">Value: DirectIO</title>
4354           <indexterm significance="normal">
4355             <primary>DirectIO</primary>
4356           </indexterm>
4357           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4358           <para>Type: DWORD {0, 1}
4359           </para>
4360           <para>
4361             Default: 1</para>
4362           <para>The AFS redirector as of 1.7.22 supports two I/O processing mechanisms. The new
4363             implementation is referred to as Direct I/O.  Direct I/O provides two benefits over the
4364             prior implementation.  First, it is faster.  Second, it provides support for
4365             CreateFile(FILE_FLAG_NO_BUFFERING).  When a file is opened with the
4366             FILE_FLAG_NO_BUFFERING flag set, the AFSCache is bypassed and all I/O operations on the
4367             file are performed directly to and from the file server.</para>
4368           <para>0: use the older I/O processing mechanism.</para>
4369           <para>1: use the new Direct I/O processing mechanism.</para>
4370         </section>
4371         <section>
4372           <title id="Regkey_TransarcAFSDaemon_Parameters_VolumeInfoReadOnlyFlag">Value: VolumeInfoReadOnlyFlag</title>
4373           <indexterm significance="normal">
4374             <primary>VolumeInfoReadOnlyFlag</primary>
4375           </indexterm>
4376           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4377           <para>Type: DWORD {0, 1}
4378           </para>
4379           <para>
4380             Default: 1</para>
4381           <para>The Win32 GetVolumeInformation and GetVolumeInformationByHandle APIs permit
4382             applications to query volume attributes such as Case Preserving, Case Insensitive
4383             lookups, support for hard links, support for reparse points, support for Unicode and
4384             whether or not the volume is read only.  The FILE_READ_ONLY_VOLUME flag when set permits
4385             applications such as the Explorer Shell to disable the "Delete" and "Rename" options and
4386             prevent copying files into the volume without issuing the request to the file system.
4387             Unfortunately, the Windows 7 explorer shell has a bug when a drive letter is mapped to a
4388             UNC path.  If the mapped path refers to a read only volume, then all volumes accessible
4389             via the drive letter are also treated as read only.  This bug is fixed in Windows 8 and
4390             Server 2012.  To improve application compatibility the setting of the
4391             FILE_READ_ONLY_VOLUME flag is disabled by default on Windows 7 and below and enabled on
4392             Windows 8 and above.</para>
4393           <para>0: prevent setting the FILE_READ_ONLY_VOLUME flag. (default on Win7 and below).</para>
4394           <para>1: permit setting the FILE_READ_ONLY_VOLUME flag. (default on Win8 and above)</para>
4395         </section>
4396         <section>
4397           <title id="Regkey_TransarcAFSDaemon_Parameters_ReparsePointPolicy">Value: ReparsePointPolicy</title>
4398           <indexterm significance="normal">
4399             <primary>ReparsePointPolicy</primary>
4400           </indexterm>
4401           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4402           <para>Type: DWORD {0, 1}
4403           </para>
4404           <para>
4405             Default: 0</para>
4406           <para>Windows file systems use <ulink
4407               url="http://msdn.microsoft.com/en-us/library/windows/desktop/aa365503%28v=vs.85%29.aspx"
4408               >reparse points</ulink> to represent special file system objects such as NTFS
4409             Junctions, Symbolic Links and AFS Mount Points.  Windows applications must be designed
4410             to work with <ulink
4411               url="http://msdn.microsoft.com/en-us/library/windows/desktop/aa365680%28v=vs.85%29.aspx"
4412               >Symbolic Links</ulink> because <ulink
4413               url="http://msdn.microsoft.com/en-us/library/windows/desktop/aa365682%28v=vs.85%29.aspx"
4414               >several standard file system functions</ulink> behave differently when the provided
4415             path specifies a reparse point.  Although there is not a significant impact for Symbolic
4416             Links to Directories and Mount Points to volume root directories, Symbolic Links to
4417             Files can result in applications misinterpreting the file size and attributes.</para>
4418           <para>The ReparsePointPolicy value permits alternate behaviors for reparse point objects
4419             on  a global basis.  In this version, there is only one policy option which permits
4420             Symbolic Links to Files to be represented with the target file's size and attributes in
4421             the output of FindFirstFile, GetFileAttributes, and GetFileAttributesEx
4422             operations.</para>
4423           <para>0: All Reparse Points are treated as reparse points.</para>
4424           <para>1: Reparse Points to Files treated as the target File.</para>
4425         </section>
4426       </section>
4427       <section>
4428         <title id="Regkey_TransarcAFSDaemon_Parameters_GlobalAutoMapper">Regkey:
4429 [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters\GlobalAutoMapper]</title>
4430         <indexterm significance="normal">
4431           <primary>GlobalAutoMapper</primary>
4432         </indexterm>
4433         <section>
4434           <title id="Regkey_TransarcAFSDaemon_Parameters_GlobalAutoMapper_DriveLetter">Value: &lt;DriveLetter&gt;</title>
4435           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters\GlobalAutoMapper]</para>
4436           <para>Type: REG_SZ</para>
4437           <para>Specifies the submount name to be mapped by afsd_service.exe at startup to the provided drive letter.</para>
4438           <para>
4439             <emphasis>This option is deprecated.</emphasis>
4440           </para>
4441         </section>
4442       </section>
4443       <section id="Regkey_HKLM_SOFTWARE_OpenAFS_Client">
4444         <title>Regkey: [HKLM\SOFTWARE\OpenAFS\Client]</title>
4445         <section>
4446           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_CellServDBDir">Value: CellServDBDir</title>
4447           <indexterm significance="normal">
4448             <primary>CellServDB</primary>
4449           </indexterm>
4450           <indexterm significance="normal">
4451             <primary>CellServDBDir</primary>
4452           </indexterm>
4453           <para id="Value_CellServDBDir">Regkey: [HKLM\SOFTWARE\OpenAFS\Client]</para>
4454           <para>Type: REG_SZ
4455                   </para>
4456           <para>
4457 Default: &lt;not defined&gt;</para>
4458           <para>Specifies the directory containing the CellServDB file. When this value is not specified, the ProgramData directory is searched and if the CellServDB file is not found, the AFS Client install directory is used.</para>
4459         </section>
4460         <section>
4461           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_VerifyServiceSignature">Value: VerifyServiceSignature</title>
4462           <indexterm significance="normal">
4463             <primary>VerifyServiceSignature</primary>
4464           </indexterm>
4465           <para id="Value_VerifyServiceSignature">Regkey: [HKLM\SOFTWARE\OpenAFS\Client]</para>
4466           <para>Type: REG_DWORD
4467                   </para>
4468           <para>
4469 Default: 0x1</para>
4470           <para>This value can be used to disable the runtime verification of the digital signatures applied to afsd_service.exe and the OpenAFS DLLs it loads. This test is performed to verify that the DLLs which are loaded by afsd_service.exe are from the same distribution as afsd_service.exe. This is to prevent random errors caused when DLLs from one distribution of AFS are loaded by another one. This is not a security test. The reason for disabling this test is to free up additional memory which can be used for a large cache size.</para>
4471         </section>
4472         <section>
4473           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_IoctlDebug">Value: IoctlDebug</title>
4474           <indexterm significance="normal">
4475             <primary>IoctlDebug</primary>
4476           </indexterm>
4477           <indexterm significance="normal">
4478             <primary>path ioctl debugging</primary>
4479           </indexterm>
4480           <para id="Value_IoctlDebug">Regkey: [HKLM\SOFTWARE\OpenAFS\Client]</para>
4481           <para>Type: REG_DWORD
4482                   </para>
4483           <para>
4484 Default: 0x0</para>
4485           <para>This value can be used to debug the cause of pioctl() failures. Set a non-zero value and the pioctl() library will output status information to stdout. Executing command line tools such as tokens.exe, fs.exe, etc can then be used to determine why the pioctl() call is failing. </para>
4486         </section>
4487         <section>
4488           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_MiniDumpType">Value: MiniDumpType</title>
4489           <indexterm significance="normal">
4490             <primary>minidumps</primary>
4491           </indexterm>
4492           <indexterm significance="normal">
4493             <primary>MiniDumpType</primary>
4494           </indexterm>
4495           <para id="Value_MiniDumpType">Regkey: [HKLM\SOFTWARE\OpenAFS\Client]</para>
4496           <para>Type: REG_DWORD
4497                   </para>
4498           <para>
4499 Default: 0x0 (MiniDumpNormal)</para>
4500           <para>This value is used to specify the type of minidump generated by afsd_service.exe either when the process crashes or when a user initiated is dump file is generated with the "fs.exe minidump" command.</para>
4501           <para>Valid values are dependent on the version of DbgHelp.dll installed on the machine. The best version to use is not the version that comes with the operating system but the version that is included in the most recent release of "
4502                     <ulink url="http://www.microsoft.com/whdc/devtools/debugging/default.mspx">Microsoft Debugging Tools for Windows</ulink>". See the Microsoft Developer Library for further information.
4503                   </para>
4504           <simplelist type="vert">
4505             <member>
4506 MiniDumpNormal = 0x00000000
4507       </member>
4508             <member>
4509 MiniDumpWithDataSegs = 0x00000001
4510       </member>
4511             <member>
4512 MiniDumpWithFullMemory = 0x00000002
4513       </member>
4514             <member>
4515 MiniDumpWithHandleData = 0x00000004
4516       </member>
4517             <member>
4518 MiniDumpFilterMemory = 0x00000008
4519       </member>
4520             <member>
4521 MiniDumpScanMemory = 0x00000010
4522       </member>
4523             <member>
4524 MiniDumpWithUnloadedModules = 0x00000020
4525       </member>
4526             <member>
4527 MiniDumpWithIndirectlyReferencedMemory = 0x00000040
4528       </member>
4529             <member>
4530 MiniDumpFilterModulePaths = 0x00000080
4531       </member>
4532             <member>
4533 MiniDumpWithProcessThreadData = 0x00000100
4534       </member>
4535             <member>
4536 MiniDumpWithPrivateReadWriteMemory = 0x00000200
4537       </member>
4538             <member>
4539 MiniDumpWithoutOptionalData = 0x00000400
4540       </member>
4541             <member>
4542 MiniDumpWithFullMemoryInfo = 0x00000800
4543       </member>
4544             <member>
4545 MiniDumpWithThreadInfo = 0x00001000
4546       </member>
4547             <member>
4548 MiniDumpWithCodeSegs = 0x00002000
4549       </member>
4550           </simplelist>
4551         </section>
4552         <section>
4553           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_EnableSMBAsyncStore">Value: EnableSMBAsyncStore</title>
4554           <indexterm significance="normal">
4555             <primary>EnableSMBAsyncStore</primary>
4556           </indexterm>
4557           <para id="Value_EnableSMBAsyncStore">Regkey: [HKLM\SOFTWARE\OpenAFS\Client]</para>
4558           <para>Type: REG_DWORD
4559                   </para>
4560           <para>
4561 Default: 0x1</para>
4562           <para>This value can be used to disable the use of SMB Asynchronous Store operations.</para>
4563         </section>
4564         <section>
4565           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_SMBAsyncStoreSize">Value: SMBAsyncStoreSize</title>
4566           <indexterm significance="normal">
4567             <primary>SMBAsyncStoreSize</primary>
4568           </indexterm>
4569           <para id="Value_SMBAsyncStoreSize">Regkey: [HKLM\SOFTWARE\OpenAFS\Client]</para>
4570           <para>Type: REG_DWORD
4571                   </para>
4572           <para>
4573 Default: 32</para>
4574           <para>This value determines the size of SMB Asynchronous Store operations.This value can be used to increase the write performance on higher speed networks by increasing the value.  The value must be a multiple of the cache buffer block size and cannot be larger than the cache manager chunk size.  The specified value will be adjusted to enforce its compliance with these restrictions.</para>
4575         </section>
4576         <section>
4577           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_StoreAnsiFilenames">Value: StoreAnsiFilenames</title>
4578           <indexterm significance="normal">
4579             <primary>StoreAnsiFilenames</primary>
4580           </indexterm>
4581           <indexterm significance="normal">
4582             <primary>Unicode</primary>
4583           </indexterm>
4584           <indexterm significance="normal">
4585             <primary>character sets</primary>
4586           </indexterm>
4587           <para id="Value_StoreAnsiFilenames">Regkey: [HKLM\SOFTWARE\OpenAFS\Client]</para>
4588           <para>Type: REG_DWORD
4589                   </para>
4590           <para>
4591 Default: 0x0</para>
4592           <para>This value can be used to force the AFS Client Service to store filenames using the Windows system's ANSI character set instead of the OEM Code Page character set which has traditionally been used by SMB file systems. </para>
4593           <para>Note: The use of ANSI characters will render access to files with 8-bit OEM file names inaccessible from Windows. This option is of use primarily when you wish to allow file names produced on Windows to be accessible from Latin-1 UNIX systems and vice versa.</para>
4594           <para>This value is ignored now that all file names are processed as Unicode and stored on the file server as UTF-8.</para>
4595         </section>
4596       </section>
4597       <section>
4598         <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_CSCPolicy">Regkey: [HKLM\SOFTWARE\OpenAFS\Client\CSCPolicy]</title>
4599         <indexterm significance="normal">
4600           <primary>CSCPolicy</primary>
4601         </indexterm>
4602         <section>
4603           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_CSCPolicy_">Value: &lt;smb share name&gt;</title>
4604           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\CSCPolicy]</para>
4605           <para>Type: REG_SZ
4606                   </para>
4607           <para>
4608 Default: &lt;none&gt;</para>
4609           <para>This key is used to map SMB/CIFS shares to Client Side Caching (off-line access) policies. For each share one of the following policies may be used: "manual", "programs", "documents", "disable". </para>
4610           <para>These values used to be stored in afsdsbmt.ini</para>
4611         </section>
4612       </section>
4613       <section id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_CellServDB">
4614         <title>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\CellServDB]</title>
4615         <indexterm significance="normal">
4616           <primary>CellServDB</primary>
4617         </indexterm>
4618         <para>The <emphasis>CellServDB</emphasis> key is an alternative to the <emphasis>CellServDB</emphasis> file that can be used either to supplement
4619               or override its contents.   This registry entry is meant to provide organizations that centrally manage their client configurations using
4620               <emphasis>Active Directory Group Policy</emphasis> a means of updating records for individual cells or servers without pushing out a new file.
4621        </para>
4622         <para>At the present time the <emphasis>CellServDB</emphasis> key contains no values; only subkeys.  Each subkey is the name of a <emphasis>Cell</emphasis>.  For example, <emphasis>grand.central.org</emphasis>.
4623        </para>
4624         <para>Support for registry <emphasis>CellServDB</emphasis> configuration was added in 1.5.60.</para>
4625       </section>
4626       <section>
4627         <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_CellServDB_Cell">Regkey: [HKLM\SOFTWARE\OpenAFS\Client\CellServDB\&lt;cellname&gt;]</title>
4628         <para>The actual name of the <emphasis>&lt;cellname&gt;</emphasis> key is the full name of the cell whose configuration is being specified.  The <emphasis>&lt;cellname&gt;</emphasis> key contains both values and subkeys.  Each subkey represents a single host name or IP address.  When a host is to be known by more than one name or IP address, a separate subkey should be created for each.
4629         Unlike the &lt;cellname&gt; key name, the &lt;server&gt; key names do not have to be actual host names.</para>
4630         <section>
4631           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_CellServDB_Cell_Description">Value: Description</title>
4632           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\CellServDB\&lt;Cell Name&gt;]</para>
4633           <para>Type: REG_SZ
4634                   </para>
4635           <para>Default: &lt;none&gt;</para>
4636           <para>This value is used to store a description of the Cell appropriate for display in end user facing tools.</para>
4637         </section>
4638         <section>
4639           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_CellServDB_Cell_ForceDNS">Value: ForceDNS</title>
4640           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\CellServDB\&lt;Cell Name&gt;]</para>
4641           <para>Type: REG_DWORD</para>
4642           <para>Range: 0 or 1</para>
4643           <para>Default: 0 if &lt;server&gt; subkeys exist; 1 otherwise</para>
4644           <para>When set to 1 all server configuration provided in the registry or the <emphasis>CellServDB file</emphasis> is ignored and DNS AFSDB lookups are used instead.</para>
4645         </section>
4646         <section>
4647           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_CellServDB_Cell_LinkedCell">Value: LinkedCell</title>
4648           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\CellServDB\&lt;Cell Name&gt;]</para>
4649           <para>Type: REG_SZ
4650                   </para>
4651           <para>Default: &lt;none&gt;</para>
4652           <para>This value names an alternative cell to which this cell should be linked.  When two cells are linked by the OpenAFS client, volume lookups that fail in the specified cell will be searched for in the linked cell
4653                   and when tokens are requested for one of the cells they will be obtained for both.
4654                   This functionality can be used for example to develop a test cell that is equivalent to a production cell with the exception that it substitutes test versions of volumes
4655                   for the production versions.  Another use is to assist in the transition from one cell name to another.</para>
4656           <para>See also: <link linkend="Linked_Cells">Linked Cells</link>.</para>
4657         </section>
4658       </section>
4659       <section>
4660         <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_CellServDB_Cell_Server">Regkey: [HKLM\SOFTWARE\OpenAFS\Client\CellServDB\&lt;cellname&gt;\&lt;server&gt;]</title>
4661         <para>The actual name of the <emphasis>&lt;server&gt;</emphasis> key may be a fully qualified domain name of the server whose configuration is being specified.
4662         If a domain name is specified as the key name, all values become optional.
4663         </para>
4664         <section>
4665           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_CellServDB_Cell_Server_HostName">Value: HostName</title>
4666           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\CellServDB\&lt;Cell Name&gt;\&lt;Server&gt;]</para>
4667           <para>Type: REG_SZ</para>
4668           <para>Default: &lt;none&gt;</para>
4669           <para>This value is used to specify a fully qualified domain name appropriate that matches either a DNS A or DNS CNAME record.  If provided, this value supercedes
4670                   the name of the &lt;server&gt; key.  It is recommended that the value of this field be terminated with a period in order to avoid the use of domain substitution
4671                   during the gethostbyname() evaluation.
4672                   </para>
4673         </section>
4674         <section>
4675           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_CellServDB_Cell_Server_IPv4Address">Value: IPv4Address</title>
4676           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\CellServDB\&lt;Cell Name&gt;\&lt;Server&gt;]</para>
4677           <para>Type: REG_SZ</para>
4678           <para>Default: &lt;none&gt;</para>
4679           <para>If the DNS host name lookup fails this value will be used as the IPv4 address for the server.</para>
4680         </section>
4681         <section>
4682           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_CellServDB_Cell_Server_Rank">Value: Rank</title>
4683           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\CellServDB\&lt;Cell Name&gt;\&lt;Server&gt;]</para>
4684           <para>Type: REG_DWORD
4685                   </para>
4686           <para>Range: 0..65535</para>
4687           <para>Default: 0</para>
4688           <para>This value specifies the default server preference.  A value of 0 indicates that no preference has been specified.  When non-zero values
4689                   are specified lower values indicate a stronger preference than higher values.</para>
4690         </section>
4691         <section>
4692           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_CellServDB_Cell_Server_Comment">Value: Comment</title>
4693           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\CellServDB\&lt;Cell Name&gt;\&lt;Server&gt;]</para>
4694           <para>Type: REG_SZ</para>
4695           <para>Default: &lt;none&gt;</para>
4696           <para>A text string that can be displayed to end users to describe the server.</para>
4697         </section>
4698       </section>
4699       <section id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_Freelance">
4700         <title>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\Freelance]</title>
4701         <indexterm significance="normal">
4702           <primary>Freelance</primary>
4703         </indexterm>
4704         <indexterm significance="normal">
4705           <primary>Freelance Mount Points</primary>
4706         </indexterm>
4707         <section>
4708           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_Freelance_NumericValue">Value: &lt;numeric value&gt;</title>
4709           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\Freelance]</para>
4710           <para>Type: REG_SZ
4711                   </para>
4712           <para>
4713 Default: &lt;none&gt;</para>
4714           <para>This key is used to store dot terminated mount point strings for use in constructing the fake root.afs volume when Freelance (dynamic roots) mode is activated.</para>
4715           <para>"athena.mit.edu#athena.mit.edu:root.cell."</para>
4716           <para>".athena.mit.edu%athena.mit.edu:root.cell."</para>
4717           <para>These values used to be stored in afs_freelance.ini</para>
4718         </section>
4719       </section>
4720       <section id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_Freelance_Symlinks">
4721         <title>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\Freelance\Symlinks]</title>
4722         <indexterm significance="normal">
4723           <primary>Freelance Symlinks</primary>
4724         </indexterm>
4725         <section>
4726           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_Freelance_Symlinks_NumericValue">Value: &lt;numeric value&gt;</title>
4727           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\Freelance\Symlinks]</para>
4728           <para>Type: REG_SZ
4729                   </para>
4730           <para>
4731 Default: &lt;none&gt;</para>
4732           <para>This key is used to store a dot terminated symlink strings for use in constructing the fake root.afs volume when Freelance (dynamic roots) mode is activated.</para>
4733           <para>"linkname:destination-path."</para>
4734           <para>"athena:athena.mit.edu."</para>
4735           <para>"home:athena.mit.edu\user\j\a\jaltman."</para>
4736           <para>"filename:path\file."</para>
4737         </section>
4738       </section>
4739       <section>
4740         <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_Realms">Regkey: [HKLM\SOFTWARE\OpenAFS\Client\Realms]</title>
4741         <indexterm significance="normal">
4742           <primary>Realms</primary>
4743         </indexterm>
4744         <indexterm significance="normal">
4745           <primary>network identity manager</primary>
4746         </indexterm>
4747         <para>The Realms key is used to provide initialization data to be used when new identities are added to the Network Identity Manager.  The AFS Provider will search for a subkey that matches the realm of the identity.  If such a key exists, its values will be used to populate the AFS configuration for the identity.</para>
4748       </section>
4749       <section>
4750         <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_Realms_RealmName">Regkey: [HKLM\SOFTWARE\OpenAFS\Client\Realms\&lt;Realm Name&gt;]</title>
4751         <para>In addition to the optional values, this key contains one subkey for each cell that is to be added to the AFS Provider configuration.  </para>
4752         <section>
4753           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_Realms_RealmName_AFSEnabled">Value: AFSEnabled</title>
4754           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\Realms\&lt;Realm Name&gt;]</para>
4755           <para>Type: REG_DWORD
4756                   </para>
4757           <para>
4758 Default: 0x01</para>
4759           <para>This key is used to specify whether the new identity should be configured to obtain AFS credentials.  In general, it is only specified when disabling the acquisition of AFS credentials is desired.  The default is to obtain AFS credentials.</para>
4760         </section>
4761       </section>
4762       <section>
4763         <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_Realms_RealmName_CellName">Regkey:
4764 [HKLM\SOFTWARE\OpenAFS\Client\Realms\&lt;Realm Name&gt;\&lt;Cell Name&gt;]</title>
4765         <section>
4766           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_Realms_RealmName_CellName_MethodName">Value: MethodName</title>
4767           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\Realms\&lt;Realm Name&gt;\&lt;Cell Name&gt;]</para>
4768           <para>Type: REG_SZ
4769                   </para>
4770           <para>
4771 Default: &lt;none&gt;</para>
4772           <para>This key is used to specify the token acquisition method to be used.  When unspecified, the AFS provider will automatically try Kerberos v5 and then Kerberos v5 (if available).  As of this writing valid method names include "Auto", "Kerberos5", "Kerberos524", "Kerberos4".</para>
4773           <para>Note: Kerberos524 and Kerberos4 cannot be used with 64-bit Kerberos for Windows.</para>
4774         </section>
4775         <section>
4776           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_Realms_RealmName_CellName_Realm">Value: Realm</title>
4777           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\Realms\&lt;Realm Name&gt;\&lt;Cell Name&gt;]</para>
4778           <para>Type: REG_SZ
4779                   </para>
4780           <para>
4781 Default: &lt;none&gt;</para>
4782           <para>This key is used to specify the realm to be used when acquiring AFS tokens.  If not specified, the realm will be determined by performing a domain to realm mapping on the domain of a random volume location database server for the cell.</para>
4783         </section>
4784       </section>
4785       <section>
4786         <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_Submounts">Regkey:
4787 [HKLM\SOFTWARE\OpenAFS\Client\Submounts]</title>
4788         <indexterm significance="normal">
4789           <primary>Submounts</primary>
4790         </indexterm>
4791         <section>
4792           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_Submounts_SubmountName">Value: &lt;Submount Name&gt;</title>
4793           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\Submounts]</para>
4794           <para>Type: REG_EXPAND_SZ
4795                   </para>
4796           <para>
4797 Default: &lt;none&gt;</para>
4798           <para>This key is used to store mappings of UNIX style AFS paths to submount names which can be referenced as UNC paths. For example the submount string "/athena.mit.edu/user/j/a/jaltman" can be associated with the submount name "jaltman.home". This can then be referenced as the UNC path \\AFS\jaltman.home.</para>
4799           <para>These values used to be stored in afsdsbmt.ini</para>
4800           <para>NOTE: Submounts should no longer be used with OpenAFS. Use the Windows Explorer to create drive mappings to AFS UNC paths instead of using the AFS Submount mechanism.</para>
4801         </section>
4802       </section>
4803       <section id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_ServerPreferences_VLDB">
4804         <title>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\Server Preferences\VLDB]</title>
4805         <indexterm significance="normal">
4806           <primary>Server Preferences</primary>
4807         </indexterm>
4808         <section>
4809           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_ServerPreferences_VLDB_HostName">Value: &lt;hostname or ip address&gt;</title>
4810           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\Server Preferences\VLDB]</para>
4811           <para>Type: REG_DWORD
4812                   </para>
4813           <para>
4814 Default: &lt;none&gt;</para>
4815           <para>This key is used to specify a default set of VLDB server preferences. For each entry the value name will be either the IP address of a server or a fully qualified domain name. The value will be the ranking. The ranking will be adjusted by a random value between 0 and 15 prior to the preference being set.</para>
4816         </section>
4817       </section>
4818       <section>
4819         <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_ServerPreferences_File">Regkey:
4820 [HKLM\SOFTWARE\OpenAFS\Client\Server Preferences\File]</title>
4821         <section>
4822           <title id="Regkey_HKLM_SOFTWARE_OpenAFS_Client_ServerPreferences_File_HostName">Value: &lt;hostname or ip address&gt;</title>
4823           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client\Server Preferences\File]</para>
4824           <para>Type: REG_DWORD
4825                   </para>
4826           <para>
4827 Default: &lt;none&gt;</para>
4828           <para>This key is used to specify a default set of File server preferences. For each entry the value name will be either the IP address of a server or a fully qualified domain name. The value will be the ranking. The ranking will be adjusted by a random value between 0 and 15 prior to the preference being set.</para>
4829         </section>
4830       </section>
4831     </section>
4832     <section>
4833       <title id="Integrated_Logon_Parameters">A.2. Integrated Logon Network Provider Parameters</title>
4834       <indexterm significance="normal">
4835         <primary>integrated logon</primary>
4836       </indexterm>
4837       <para>Affects the network provider (afslogon.dll).</para>
4838       <section>
4839         <title id="NP_Regkey_TransarcAFSDaemon_Parameters">Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</title>
4840         <section>
4841           <title id="NP_Regkey_TransarcAFSDaemon_Parameters_FailLoginsSilently">Value: FailLoginsSilently</title>
4842           <indexterm significance="normal">
4843             <primary>FailLoginsSilently</primary>
4844           </indexterm>
4845           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
4846           <para>Type: DWORD
4847                   </para>
4848           <para>Default: 0</para>
4849           <para>Do not display message boxes if the login fails.</para>
4850         </section>
4851       </section>
4852       <section>
4853         <title id="NP_Regkey_TransarcAFSDaemon_NetworkProvider">Regkey:
4854 [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider]</title>
4855         <section>
4856           <title id="NP_Regkey_TransarcAFSDaemon_NetworkProvider_NoWarnings">Value: NoWarnings</title>
4857           <indexterm significance="normal">
4858             <primary>NoWarnings</primary>
4859           </indexterm>
4860           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider]</para>
4861           <para>Type: DWORD
4862                   </para>
4863           <para>Default: 0</para>
4864           <para>Disables visible warnings during logon.</para>
4865         </section>
4866         <section>
4867           <title id="Value_AFSLogon_Debug">Value: Debug</title>
4868           <para>Regkey:
4869             [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider]</para>
4870           <para>Type: DWORD</para>
4871           <para>Default: 0</para>
4872           <para>Set to 1 to turn on "AFS Logon" event logging to the Windows Event Log.</para>
4873         </section>
4874         <section>
4875           <title id="NP_Regkey_TransarcAFSDaemon_NetworkProvider_AuthentProviderPath">Value: AuthentProviderPath</title>
4876           <indexterm significance="normal">
4877             <primary>AuthentProviderPath</primary>
4878           </indexterm>
4879           <indexterm significance="normal">
4880             <primary>afslogon.dll</primary>
4881           </indexterm>
4882           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider]</para>
4883           <para>Type: REG_SZ
4884                   </para>
4885           <para>
4886 NSIS: %WINDIR%\SYSTEM32\afslogon.dll</para>
4887           <para>Specifies the install location of the authentication provider dll.</para>
4888         </section>
4889         <section>
4890           <title id="NP_Regkey_TransarcAFSDaemon_NetworkProvider_Class">Value: Class</title>
4891           <indexterm significance="normal">
4892             <primary>Class</primary>
4893           </indexterm>
4894           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider]</para>
4895           <para>Type: DWORD
4896                   </para>
4897           <para>
4898 NSIS: 0x02</para>
4899           <para>Specifies the class of network provider</para>
4900         </section>
4901         <section>
4902           <title id="NP_Regkey_TransarcAFSDaemon_NetworkProvider_DependOnGroup">Value: DependOnGroup</title>
4903           <indexterm significance="normal">
4904             <primary>DependOnGroup</primary>
4905           </indexterm>
4906           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider]</para>
4907           <para>Type: REG_MULTI_SZ
4908                   </para>
4909           <para>
4910 NSIS: PNP_TDI</para>
4911           <para>Specifies the service groups upon which the AFS Client Service depends. Windows should not attempt to start the AFS Client Service until all of the services within these groups have successfully started.</para>
4912         </section>
4913         <section>
4914           <title id="NP_Regkey_TransarcAFSDaemon_NetworkProvider_DependOnService">Value: DependOnService</title>
4915           <indexterm significance="normal">
4916             <primary>DependOnService</primary>
4917           </indexterm>
4918           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider]</para>
4919           <para>Type: REG_MULTI_SZ
4920                   </para>
4921           <para>
4922 NSIS: Tcpip NETBIOS RpcSs</para>
4923           <para>Specifies a list of services upon which the AFS Client Service depends. Windows should not attempt to start the AFS Client Service until all of the specified services have successfully started.</para>
4924         </section>
4925         <section>
4926           <title id="NP_Regkey_TransarcAFSDaemon_NetworkProvider_Name">Value: Name</title>
4927           <indexterm significance="normal">
4928             <primary>Name - network provider</primary>
4929           </indexterm>
4930           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider]</para>
4931           <para>Type: REG_SZ
4932                   </para>
4933           <para>
4934 NSIS: "OpenAFSDaemon"</para>
4935           <para>Specifies the display name of the AFS Client Service</para>
4936         </section>
4937         <section>
4938           <title id="NP_Regkey_TransarcAFSDaemon_NetworkProvider_ProviderPath">Value: ProviderPath</title>
4939           <indexterm significance="normal">
4940             <primary>ProviderPath</primary>
4941           </indexterm>
4942           <indexterm significance="normal">
4943             <primary>afslogon.dll</primary>
4944           </indexterm>
4945           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider]</para>
4946           <para>Type: REG_SZ
4947                   </para>
4948           <para>
4949 NSIS: %WINDIR%\SYSTEM32\afslogon.dll</para>
4950           <para>Specifies the DLL to use for the network provider</para>
4951         </section>
4952       </section>
4953       <section id="Domain_Specific_Configuration">
4954         <title>A.2.1 Domain specific configuration keys for the Network Provider</title>
4955         <indexterm significance="normal">
4956           <primary>domain logon configuration</primary>
4957         </indexterm>
4958         <para>The network provider can be configured to have different behavior depending on the
4959           domain that the user logs into. These settings are only relevant when using integrated
4960           login. A domain refers to an Active Directory (AD) domain, a trusted Kerberos (non-AD)
4961           realm or the local machine (i.e. local account logins). The domain name that is used for
4962           selecting the domain would be the domain that is passed into the NPLogonNotify function of
4963           the network provider.</para>
4964         <para>Domain specific registry keys are:</para>
4965         <section>
4966           <title id="Domain_Regkey_TransarcAFSDaemon_NetworkProvider">Regkey:
4967             [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider]</title>
4968           <para> (NP key)</para>
4969         </section>
4970         <section>
4971           <title id="Domain_Regkey_TransarcAFSDaemon_NetworkProvider_Domain">Regkey:
4972             [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain]</title>
4973           <para> (Domains key)</para>
4974         </section>
4975         <section>
4976           <title id="Domain_Regkey_TransarcAFSDaemon_NetworkProvider_Domain_DomainName">Regkey:
4977             [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;Domain
4978             Name&gt;]</title>
4979           <para> (Specific domain key. One per domain.)</para>
4980         </section>
4981         <section>
4982           <title id="Domain_Regkey_TransarcAFSDaemon_NetworkProvider_Domain_LocalHost">Regkey:
4983             [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST]</title>
4984           <para> (Localhost key)</para>
4985         </section>
4986         <section>
4987           <title id="Domain_Example">Domain Specific Example:</title>
4988           <para>HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider</para>
4989           <para> |</para>
4990           <para> +- Domain</para>
4991           <para>      +-AD1.EXAMPLE.COM</para>
4992           <para>      +-AD1</para>
4993           <para>      +-AD2.EXAMPLE.NET</para>
4994           <para>      +-AD2</para>
4995           <para>      +-LOCALHOST</para>
4996           <para>           +-Administrator</para>
4997           <para>           +-Other User</para>
4998           <para>Each of the domain specific keys can have the set of values described in 2.1.1. The
4999             effective values are chosen as described in 2.1.2.</para>
5000         </section>
5001         <section>
5002           <title id="Domain_Specific_Configuration_Values">A.2.1.1 Domain Specific Configuration
5003             Values</title>
5004           <section id="Domain_Specific_Regkeys">
5005             <title>Regkeys:
5006               [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider]
5007               [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain]
5008               [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\"domain
5009               name"]
5010               [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\"domain
5011               name"]["user name"]
5012               [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST]
5013               [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST\"user name"]
5014             </title>
5015             <section>
5016               <title id="Domain_Specific_Regkeys_LogonOptions">Value: LogonOptions</title>
5017               <indexterm significance="normal">
5018                 <primary>LogonOptions</primary>
5019               </indexterm>
5020               <para id="Value_LogonOptions">[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain]</para>
5021               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5022                 name&gt;]</para>
5023               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5024                 name&gt;\&lt;user name&gt;]</para>
5025               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST]</para>
5026               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST\&lt;user name&gt;]</para>
5027               <para>Type: DWORD </para>
5028               <para> Default: 0x01</para>
5029               <para>NSIS/WiX: depends on user configuration</para>
5030               <para>
5031                 <simplelist type="vert">
5032                   <member>0x00 - Integrated Logon is not used </member>
5033                   <member> 0x01 - Integrated Logon is used </member>
5034                 </simplelist>
5035               </para>
5036             </section>
5037             <section>
5038               <title id="Domain_Specific_Regkeys_FailLoginsSilently">Value:
5039                 FailLoginsSilently</title>
5040               <indexterm significance="normal">
5041                 <primary>FailLoginsSilently</primary>
5042               </indexterm>
5043               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain]</para>
5044               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5045                 name&gt;]</para>
5046               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5047                 name&gt;\&lt;user name&gt;]</para>
5048               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST]</para>
5049               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST\&lt;user name&gt;]</para>
5050               <para>Type: DWORD (1|0) </para>
5051               <para> Default: 0 </para>
5052               <para> NSIS/WiX: (not set)</para>
5053               <para>If true, does not display any visible warnings in the event of an error during
5054                 the integrated login process.</para>
5055             </section>
5056             <section>
5057               <title id="Domain_Specific_Regkeys_LogonScript">Value: LogonScript</title>
5058               <indexterm significance="normal">
5059                 <primary>LogonScript</primary>
5060               </indexterm>
5061               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain]</para>
5062               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5063                 name&gt;]</para>
5064               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5065                 name&gt;\&lt;user name&gt;]</para>
5066               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST]</para>
5067               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST\&lt;user name&gt;]</para>
5068               <para>Type: REG_SZ or REG_EXPAND_SZ </para>
5069               <para> Default: (null) </para>
5070               <para> NSIS/WiX: (only value under NP key) &lt;install path&gt;\afscreds.exe -:%s -x
5071                 -a -m -n -q</para>
5072               <para>A logon script that will be scheduled to be run after the profile load is
5073                 complete. If using the REG_EXPAND_SZ type, you can use any system environment
5074                 variable as "%varname%" which would be expanded at the time the network provider is
5075                 run. Optionally using a "%s" in the value would result in it being expanded into the
5076                 AFS SMB username for the session.</para>
5077             </section>
5078             <section>
5079               <title id="Domain_Specific_Regkeys_LoginRetryInterval">Value:
5080                 LoginRetryInterval</title>
5081               <indexterm significance="normal">
5082                 <primary>LoginRetryInterval</primary>
5083               </indexterm>
5084               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain]</para>
5085               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5086                 name&gt;]</para>
5087               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5088                 name&gt;\&lt;user name&gt;]</para>
5089               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST]</para>
5090               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST\&lt;user name&gt;]</para>
5091               <para>Type: DWORD </para>
5092               <para> Default: 30 </para>
5093               <para> NSIS/WiX: (not set)</para>
5094               <para>If the OpenAFS client service has not started yet, the network provider will
5095                 wait for a maximum of "LoginRetryInterval" seconds while retrying every
5096                 "LoginSleepInterval" seconds to check if the service is up.</para>
5097             </section>
5098             <section>
5099               <title id="Domain_Specific_Regkeys_LoginSleepInterval">Value:
5100                 LoginSleepInterval</title>
5101               <indexterm significance="normal">
5102                 <primary>LoginSleepInterval</primary>
5103               </indexterm>
5104               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain]</para>
5105               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5106                 name&gt;]</para>
5107               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5108                 name&gt;\&lt;user name&gt;]</para>
5109               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST]</para>
5110               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST\&lt;user name&gt;]</para>
5111               <para>Type: DWORD </para>
5112               <para> Default: 5 </para>
5113               <para> NSIS/WiX: (not set)</para>
5114               <para>See description of LoginRetryInterval.</para>
5115             </section>
5116             <section>
5117               <title id="Domain_Specific_Regkeys_Realm">Value: Realm</title>
5118               <indexterm significance="normal">
5119                 <primary>Realm</primary>
5120               </indexterm>
5121               <para id="Value_Realm">[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain]</para>
5122               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5123                 name&gt;]</para>
5124               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5125                 name&gt;\&lt;user name&gt;]</para>
5126               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST]</para>
5127               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST\&lt;user name&gt;]</para>
5128               <para>Type: REG_SZ </para>
5129               <para> NSIS: &lt;not set&gt;</para>
5130               <para>When Kerberos v5 is being used, Realm specifies the Kerberos v5 realm that
5131                 should be appended to the first component of the Domain logon username to construct
5132                 the Kerberos v5 principal for which AFS tokens should be obtained.</para>
5133             </section>
5134             <section>
5135               <title id="Domain_Specific_Regkeys_TheseCells">Value: TheseCells</title>
5136               <indexterm significance="normal">
5137                 <primary>TheseCells</primary>
5138               </indexterm>
5139               <para id="Value_TheseCells">[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain]</para>
5140               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5141                 name&gt;]</para>
5142               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5143                 name&gt;\&lt;user name&gt;]</para>
5144               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST]</para>
5145               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST\&lt;user name&gt;]</para>
5146               <para>Type: REG_MULTI_SZ </para>
5147               <para> NSIS: &lt;not set&gt;</para>
5148               <para>When Kerberos v5 is being used, TheseCells provides a list of additional cells
5149                 for which tokens should be obtained with the default Kerberos v5 principal.</para>
5150             </section>
5151             <section>
5152               <title id="Domain_User_Specific_Regkeys_Username">Value: Username</title>
5153               <indexterm significance="normal">
5154                 <primary>Username</primary>
5155               </indexterm>
5156               <para id="Value_Username">[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\&lt;domain
5157                 name&gt;\&lt;user name&gt;]</para>
5158               <para>[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST\&lt;user name&gt;]</para>
5159               <para>Type: REG_SZ </para>
5160               <para> NSIS: &lt;not set&gt;</para>
5161               <para>Username specifies an alternate username to be combined with the Realm when constructing
5162                 the Kerberos v5 principal for which AFS tokens should be obtained.</para>
5163             </section>
5164           </section>
5165         </section>
5166         <section>
5167           <title id="Selection_Effective_Values_for_Domain_Specific_Configuration">A.2.1.2 Selection
5168             of effective values for domain specific configuration</title>
5169           <para>During login to domain X, where X is the domain passed into NPLogonNotify as
5170             lpAuthentInfo-&gt;LogonDomainName or the string 'LOCALHOST' if
5171             lpAuthentInfo-&gt;LogonDomainName equals the name of the computer, the following keys
5172             will be looked up.</para>
5173           <para>1. NP key.
5174             ("HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider")</para>
5175           <para>2. Domains key. (NP key\"Domain")</para>
5176           <para>3. Specific domain key. (Domains key\X)</para>
5177           <para>If the specific domain key does not exist, then the domains key will be ignored. All
5178             the configuration information in this case will come from the NP key.</para>
5179           <para>If the specific domain key exists, then for each of the values metioned in (2), they
5180             will be looked up in the specific domain key, domains key and the NP key successively
5181             until the value is found. The first instance of the value found this way will be the
5182             effective for the login session. If no such instance can be found, the default will be
5183             used. To re-iterate, a value in a more specific key supercedes a value in a less
5184             specific key. The exceptions to this rule are stated below.</para>
5185         </section>
5186         <section>
5187           <title id="Domain_Specific_Configuration_Exceptions">A.2.1.3 Exceptions to A.2.1.2</title>
5188           <para>To retain backwards compatibility, the following exceptions are made to
5189             A.2.1.2.</para>
5190           <section>
5191             <title id="Domain_Specific_Configuration_Exception_FailLoginsSilently">2.1.3.1
5192               'FailLoginsSilently'</title>
5193             <indexterm significance="normal">
5194               <primary>FailLoginsSilently</primary>
5195             </indexterm>
5196             <para>Historically, the 'FailLoginsSilently' value was in
5197               HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters key and not in the
5198               NP key. Therefore, for backwards compatibility, the value in the Parameters key will
5199               supercede all instances of this value in other keys. In the absence of this value in
5200               the Parameters key, normal scope rules apply.</para>
5201           </section>
5202           <section>
5203             <title id="Domain_Specific_Configuration_Exception_LogonScript">2.1.3.2
5204               'LogonScript'</title>
5205             <indexterm significance="normal">
5206               <primary>LogonScript</primary>
5207             </indexterm>
5208             <para>If a 'LogonScript' is not specified in the specific domain key nor in the domains
5209               key, the value in the NP key will only be checked if the effective 'LogonOptions'
5210               specify a high security integrated login. If a logon script is specified in the
5211               specific domain key or the domains key, it will be used regardless of the high
5212               security setting. Please be aware of this when setting this value.</para>
5213           </section>
5214         </section>
5215       </section>
5216     </section>
5217     <section>
5218       <title id="AFSCreds_Parameters">A.3. AFS Credentials System Tray Tool parameters</title>
5219       <indexterm significance="normal">
5220         <primary>afscreds.exe</primary>
5221       </indexterm>
5222       <indexterm significance="normal">
5223         <primary>System Tray Tool</primary>
5224       </indexterm>
5225       <para>Affects the behavior of afscreds.exe</para>
5226       <section>
5227         <title id="AFSCreds_Regkey_TransarcAFSDaemon_Parameters">Regkey:
5228 [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</title>
5229         <section>
5230           <title id="AFSCreds_Regkey_TransarcAFSDaemon_Parameters_Gateway">Value: Gateway</title>
5231           <indexterm significance="normal">
5232             <primary>Gateway</primary>
5233           </indexterm>
5234           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
5235           <para>Type: REG_SZ
5236                   </para>
5237           <para>
5238 Default: ""
5239                   </para>
5240           <para>
5241 Function: GetGatewayName()</para>
5242           <para>If the AFS client is utilizing a gateway to obtain AFS access, the name of the gateway is specified by this value.</para>
5243         </section>
5244         <section>
5245           <title id="AFSCreds_Regkey_TransarcAFSDaemon_Parameters_Cell">Value: Cell</title>
5246           <indexterm significance="normal">
5247             <primary>Cell</primary>
5248           </indexterm>
5249           <para>Regkey: [HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]</para>
5250           <para>Type: REG_SZ
5251                   </para>
5252           <para>
5253 Default: &lt;none&gt;
5254                   </para>
5255           <para>
5256 Variable: IsServiceConfigured()</para>
5257           <para>The value Cell is used to determine if the AFS Client Service has been properly configured or not.</para>
5258         </section>
5259       </section>
5260       <section>
5261         <title id="AFSCreds_Regkey_Software_OpenAFS_Client">Regkey:
5262 [HKLM\SOFTWARE\OpenAFS\Client]
5263 [HKCU\SOFTWARE\OpenAFS\Client]</title>
5264         <section>
5265           <title id="AFSCreds_Regkey_Software_OpenAFS_Client_ShowTrayIcon">Value: ShowTrayIcon</title>
5266           <indexterm significance="normal">
5267             <primary>ShowTrayIcon</primary>
5268           </indexterm>
5269           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client]</para>
5270           <para>Regkey: [HKCU\SOFTWARE\OpenAFS\Client]</para>
5271           <para>Type: DWORD {0, 1}
5272                   </para>
5273           <para>
5274 Default: 1
5275                   </para>
5276           <para>
5277 Function: InitApp(), Main_OnCheckTerminate()</para>
5278           <para>This value is used to determine whether or not a shortcut should be maintained in the user's Start Menu-&gt;Programs-&gt;Startup folder. </para>
5279           <para>This value used to be stored at [HKLM\Software\TransarcCorporation\AFS Client\AfsCreds].</para>
5280           <para>The current user value is checked first; if it does not exist the local machine value is checked.</para>
5281         </section>
5282         <section>
5283           <title id="AFSCreds_Regkey_Software_OpenAFS_Client_EnableKFW">Value: EnableKFW</title>
5284           <indexterm significance="normal">
5285             <primary>EnableKFW</primary>
5286           </indexterm>
5287           <para id="Value_EnableKFW">Regkey: [HKLM\SOFTWARE\OpenAFS\Client]</para>
5288           <para>Regkey: [HKCU\SOFTWARE\OpenAFS\Client]</para>
5289           <para>Type: DWORD {0, 1}
5290                   </para>
5291           <para>
5292 Default: 1
5293                   </para>
5294           <para>
5295 Function: KFW_is_available()</para>
5296           <para>When MIT Kerberos for Windows can be loaded, Kerberos v5 will be used to obtain AFS credentials. By setting this value to 0, the internal Kerberos v4 implementation will be used instead. The current user value is checked first; if it does not exist the local machine value is checked.</para>
5297         </section>
5298         <section>
5299           <title id="AFSCreds_Regkey_Software_OpenAFS_Client_AcceptDottedPrincipalNames">Value: AcceptDottedPrincipalNames</title>
5300           <indexterm significance="normal">
5301             <primary>AcceptDottedPrincipalName</primary>
5302           </indexterm>
5303           <para>Regkey: [HKLM\SOFTWARE\OpenAFS\Client]</para>
5304           <para>Regkey: [HKCU\SOFTWARE\OpenAFS\Client]</para>
5305           <para>Type: DWORD {0, 1}
5306                   </para>
5307           <para>
5308 Default: 1
5309                   </para>
5310           <para>
5311 Function: KFW_accept_dotted_usernames()</para>
5312           <para>Kerberos v5 principal names are traditionally mapped to Kerberos v4 names by the AFS servers before they can be looked up in the Protection database. The mapping algorithm used permits collisions to occur. Both of the Kerberos v5 names, "user.admin@REALM" and "user/admin@REALM" are interpreted as the same user identity within the cell. To enable both names to be sent to the server by AFSCreds or Integrated Logon, set this value to 1.</para>
5313         </section>
5314         <section>
5315           <title id="AFSCreds_Regkey_Software_OpenAFS_Client_Use524">Value: Use524</title>
5316           <indexterm significance="normal">
5317             <primary>Use524</primary>
5318           </indexterm>
5319           <para id="Value_Use524">Regkey: [HKLM\SOFTWARE\OpenAFS\Client]</para>
5320           <para>Regkey: [HKCU\SOFTWARE\OpenAFS\Client]</para>
5321           <para>Type: DWORD {0, 1}
5322                   </para>
5323           <para>
5324 Default: 0
5325                   </para>
5326           <para>
5327 Function: KFW_use_krb524()</para>
5328           <para>When MIT Kerberos for Windows can be loaded, Kerberos v5 will be used to obtain AFS credentials. By setting this value to 1, the Kerberos v5 tickets will be converted to Kerberos v4 tokens via a call to the krb524 daemon. The current user value is checked first; if it does not exist the local machine value is checked.</para>
5329         </section>
5330         <section>
5331           <title id="AFSCreds_Regkey_Software_OpenAFS_Client_AfscredsShortcutParams">Value: AfscredsShortcutParams</title>
5332           <indexterm significance="normal">
5333             <primary>AfscredsShortcutParams</primary>
5334           </indexterm>
5335           <para id="Value_AfscredsShortcutParams">Regkey: [HKLM\SOFTWARE\OpenAFS\Client]</para>
5336           <para>Regkey: [HKCU\SOFTWARE\OpenAFS\Client]</para>
5337           <para>Type: REG_SZ
5338                   </para>
5339           <para>
5340 Default: "-A -M -N -Q"
5341                   </para>
5342           <para>
5343 Function: Shortcut_FixStartup</para>
5344           <para>This value specifies the command line options which should be set as part of the shortcut to afscreds.exe. afscreds.exe rewrites the shortcut each time it exits so as to ensure that the shortcut points to the latest version of the program. This value is used to determine which values should be used for command line parameters. The current user value is checked first; if it does not exist the local machine value is checked.</para>
5345           <para>The following subset of the command line options is appropriate for use in this registry setting:</para>
5346           <para>
5347             <simplelist type="vert">
5348               <member>-A = autoinit
5349 </member>
5350               <member>
5351 -M = renew drive maps
5352 </member>
5353               <member>
5354 -N = ip address change detection
5355 </member>
5356               <member>
5357 -Q = quiet mode. do not display start service dialog if afsd_service is not already running
5358 </member>
5359               <member>
5360 -S = show tokens dialog on startup
5361 </member>
5362               <member>
5363 -Z = unmap drives
5364 </member>
5365             </simplelist>
5366           </para>
5367         </section>
5368       </section>
5369       <section>
5370         <title id="AFSCreds_Regkey_HKCU_Software_OpenAFS_Client">Regkey:
5371 [HKCU\SOFTWARE\OpenAFS\Client]</title>
5372         <section>
5373           <title id="AFSCreds_Regkey_HKCU_Software_OpenAFS_Client_AuthenticationCell">Value: Authentication Cell</title>
5374           <indexterm significance="normal">
5375             <primary>Authentication Cell</primary>
5376           </indexterm>
5377           <para>Regkey: [HKCU\SOFTWARE\OpenAFS\Client]</para>
5378           <para>Type: REG_SZ
5379                   </para>
5380           <para>
5381 Default: &lt;none&gt;
5382                   </para>
5383           <para>
5384 Function: Afscreds.exe GetDefaultCell()</para>
5385           <para>This value allows the user to configure a different cell name to be used as the default cell when acquiring tokens in afscreds.exe.</para>
5386         </section>
5387       </section>
5388       <section>
5389         <title id="AFSCreds_Regkey_HKCU_Software_OpenAFS_Client_Reminders">Regkey:
5390 [HKCU\SOFTWARE\OpenAFS\Client\Reminders]</title>
5391         <indexterm significance="normal">
5392           <primary>Reminders</primary>
5393         </indexterm>
5394         <section>
5395           <title id="AFSCreds_Regkey_HKCU_Software_OpenAFS_Client_Reminders_Cell">Value: &lt;afs cell name&gt;</title>
5396           <para>Regkey: [HKCU\SOFTWARE\OpenAFS\Client\Reminders]</para>
5397           <para>Type: DWORD {0, 1}
5398                   </para>
5399           <para>
5400 Default: &lt;none&gt;
5401                   </para>
5402           <para>
5403 Function: LoadRemind(), SaveRemind()</para>
5404           <para>These values are used to save and restore the state of the reminder flag for each cell for which the user has obtained tokens.</para>
5405           <para>This value used to be stored at [HKLM\Software\TransarcCorporation\AFS Client\AfsCreds].</para>
5406         </section>
5407       </section>
5408       <section>
5409         <title id="AFSCreds_Regkey_HKCU_Software_OpenAFS_Client_ActiveMaps">Regkey:
5410 [HKCU\SOFTWARE\OpenAFS\Client\Active Maps]</title>
5411         <indexterm significance="normal">
5412           <primary>ActiveMaps</primary>
5413         </indexterm>
5414         <section>
5415           <title id="AFSCreds_Regkey_HKCU_Software_OpenAFS_Client_ActiveMaps_DriveLetter">Value: &lt;upper case drive letter&gt;</title>
5416           <para>Regkey: [HKCU\SOFTWARE\OpenAFS\Client\ActiveMaps]</para>
5417           <para>Type: DWORD {0, 1}
5418                   </para>
5419           <para>
5420 Default: &lt;none&gt;</para>
5421           <para>These values are used to store the persistence state of the AFS drive mappings as listed in the [...\Client\Mappings] key.</para>
5422           <para>These values used to be stored in the afsdsbmt.ini file</para>
5423         </section>
5424       </section>
5425       <section>
5426         <title id="AFSCreds_Regkey_HKCU_Software_OpenAFS_Client_Mappings">Regkey:
5427 [HKCU\SOFTWARE\OpenAFS\Client\Mappings]</title>
5428         <section>
5429           <title id="AFSCreds_Regkey_HKCU_Software_OpenAFS_Client_Mappings_DriveLetter">Value: &lt;upper case drive letter&gt;</title>
5430           <para>Regkey: [HKCU\SOFTWARE\OpenAFS\Client\Mappings]</para>
5431           <para>Type: REG_SZ
5432                   </para>
5433           <para>Default: &lt;none&gt;</para>
5434           <para>These values are used to store the AFS path in UNIX notation to which the drive letter is to be mapped.</para>
5435           <para>These values used to be stored in the afsdsbmt.ini file.</para>
5436         </section>
5437       </section>
5438     </section>
5439     <section>
5440       <title id="OpenAFS_Service_Environment_Variables">A.4 OpenAFS Client Service Environment Variables</title>
5441       <section>
5442         <title id="OpenAFS_Service_Environment_Variables_AFS_RPC_ENCRYPT">Value: AFS_RPC_ENCRYPT</title>
5443         <indexterm significance="normal">
5444           <primary>AFS_RPC_ENCRYPT</primary>
5445         </indexterm>
5446         <para>Values:
5447                   <simplelist type="vert"><member> "OFF" disables the use of RPC encryption </member><member>any other value allows RPC encryption to be used</member></simplelist></para>
5448         <para>
5449 Default: RPC encryption is on
5450                 </para>
5451       </section>
5452       <section>
5453         <title id="OpenAFS_Service_Environment_Variables_AFS_RPC_PROTSEQ">Value: AFS_RPC_PROTSEQ</title>
5454         <indexterm significance="normal">
5455           <primary>AFS_RPC_PROTSEQ</primary>
5456         </indexterm>
5457         <para>Values:
5458                   <simplelist type="vert"><member>
5459 "ncalrpc" - local RPC
5460 </member><member>
5461 "ncacn_np" - named pipes
5462 </member><member>
5463 "ncacn_ip_tcp" - tcp/ip
5464 </member></simplelist></para>
5465         <para>
5466 Default: local RPC
5467                 </para>
5468       </section>
5469     </section>
5470     <section>
5471       <title>A.5 AFS Redirector Parameters</title>
5472       <indexterm>
5473         <primary>afsredir.sys</primary>
5474       </indexterm>
5475       <indexterm>
5476         <primary>afsredirlib.sys</primary>
5477       </indexterm>
5478       <para>The AFS Redirector is implemented with three components:
5479         %windir%\system32\drivers\AFSRedir.sys, %windir%\system32\drivers\AFSRedirLib.sys and
5480         %windir%\system32\AFSRDFSProvider.dll.  These components provide the interface between the
5481         Windows Installable File System interface and the WNet application interface and the AFS
5482         file system.  The </para>
5483       <section>
5484         <title>[HKLM\SYSTEM\CurrentControlSet\Services\AFSRedirector\Parameters]</title>
5485         <para/>
5486         <section>
5487           <title>Value: DebugFlags</title>
5488           <para>RegKey: [HKLM\SYSTEM\CurrentControlSet\Services\AFSRedirector\Parameters]</para>
5489           <para>Type: REG_DWORD</para>
5490           <para>Default: 0</para>
5491           <para>Bit 0 (0x1): Trigger Debug Break on AFSRedir.sys start.  Used for kernel
5492             debugging.</para>
5493           <para>Bit 1 (0x2): Output trace logging to Kernel Debugger.  Used for kernel
5494             debugging.</para>
5495           <para>Bit 2 (0x4): Enable Force Crash Ioctl.  Checked builds only.  Used for force a
5496             BSOD.</para>
5497           <para>Bit 3 (0x8): Enable Bug Check on all exceptions.  Normally exceptions are caught by
5498             handlers.  Used during testing.</para>
5499           <para>Bit 4 (0x10): Reserved.</para>
5500           <para>Bit 5 (0x20): Do not start the AFS Redirector if Windows did not perform a clean
5501             shutdown.</para>
5502         </section>
5503         <section>
5504           <title>Value: TraceBufferSize</title>
5505           <para>RegKey: [HKLM\SYSTEM\CurrentControlSet\Services\AFSRedirector\Parameters]</para>
5506           <para>Type: REG_DWORD</para>
5507           <para>Default: 0 {0 .. 10000} (KBs)</para>
5508           <para>Specifies the size of the circular trace log buffer allocated within kernel memory.
5509             0 disables trace logging.</para>
5510         </section>
5511         <section>
5512           <title>Value: TraceLevel</title>
5513           <para>RegKey: [HKLM\SYSTEM\CurrentControlSet\Services\AFSRedirector\Parameters]</para>
5514           <para>Type: REG_DWORD</para>
5515           <para>Default: 0 {0..4}</para>
5516           <para>0: No logging; 1: Error; 2: Warning; 3: Verbose; 4: Maximum Verbosity</para>
5517         </section>
5518         <section>
5519           <title>Value: TraceSubsystem</title>
5520           <para>RegKey: [HKLM\SYSTEM\CurrentControlSet\Services\AFSRedirector\Parameters]</para>
5521           <para>Type: REG_DWORD</para>
5522           <para>Default: 0</para>
5523           <para>Bit 0 (0x1): I/O Subsystem</para>
5524           <para>Bit 1 (0x2): File Control Blocks and Name Processing</para>
5525           <para>Bit 2 (0x4): Lock Processing (requires Verbose or higher level)</para>
5526           <para>Bit 3 (0x8): Extent Processing</para>
5527           <para>Bit 4 (0x10): Worker Thread Processing</para>
5528           <para>Bit 5 (0x20): Reference counting of directory entries</para>
5529           <para>Bit 6 (0x40): Reference counting of objects</para>
5530           <para>Bit 7 (0x80): Reference counting of volumes</para>
5531           <para>Bit 8 (0x100): Reference counting of file control blocks</para>
5532           <para>Bit 9 (0x200): Garbage Collection</para>
5533           <para>Bit 10 (0x400): Pipe and share processing</para>
5534           <para>Bit 11 (0x800): Directory notification interface</para>
5535           <para>Bit 12 (0x1000): Network Provider support processing</para>
5536           <para>Bit 13 (0x2000): Directory node count processing</para>
5537           <para>Bit 14 (0x4000): PIOCTL processing</para>
5538           <para>Bit 15 (0x8000): Authentication Group creation and assignment</para>
5539           <para>Bit 16 (0x10000): Library load and unload, task queuing</para>
5540           <para>Bit 17 (0x20000): Process creation and destruction</para>
5541           <para>Bit 18 (0x40000): Extent Active counting</para>
5542           <para>Bit 19 (0x80000): Redirector initialization</para>
5543           <para>Bit 20 (0x100000): Name Array processing</para>
5544         </section>
5545       </section>
5546       <section>
5547         <title>[HKLM\SYSTEM\CurrentControlSet\Services\AFSRedirector\NetworkProvider]</title>
5548         <para/>
5549         <section>
5550           <title>Value: Debug</title>
5551           <para>RegKey:
5552             [HKLM\SYSTEM\CurrentControlSet\Services\AFSRedirector\NetworkProvider]</para>
5553           <para>Type: REG_DWORD</para>
5554           <para>Default: 0</para>
5555           <para>Set to 1 to log all AFSRDFSProvider Network Provider requests to
5556             C:\TEMP\AFSRDFSProvider.log.  The C:\TEMP directory cannot be changed and must
5557             exist.</para>
5558         </section>
5559         <section>
5560           <title>Value: Name</title>
5561           <para>RegKey:
5562             [HKLM\SYSTEM\CurrentControlSet\Services\AFSRedirector\NetworkProvider]</para>
5563           <para>Type: REG_SZ</para>
5564           <para>Default: "OpenAFS Network"</para>
5565           <para>This value defines the name displayed in the Explorer Shell and to which network
5566             drive mappings are made.</para>
5567         </section>
5568       </section>
5569     </section>
5570   </chapter>
5571   <index>
5572     <para>
5573     </para>
5574   </index>
5575 </book>
5576 <!-- Keep this comment at the end of the file
5577 Local variables:
5578 mode: xml
5579 sgml-omittag:nil
5580 sgml-shorttag:nil
5581 sgml-namecase-general:nil
5582 sgml-general-insert-case:lower
5583 sgml-minimize-attributes:nil
5584 sgml-always-quote-attributes:t
5585 sgml-indent-step:2
5586 sgml-indent-data:nil
5587 sgml-parent-document:nil
5588 sgml-exposed-tags:nil
5589 sgml-local-catalogs:nil
5590 sgml-local-ecat-files:nil
5591 End:
5592   -->