Problems with ghost imaging

[jayrock]

Hey guys

 

I use ghost to image machines within school but we recently moved ghost and all the images from a 2003 server to a 2008 one. Since then i cant bring up the ghost GUI when using the universal TCPIP cd, errors relate to security and permissions even though the ghost folder is properly shared and all permissions are correct.

 

Does anybody have a clue what it could be??

 

many thanks!

[plexer]

Probably something to do with secure communications/kerberos etc...?

 

Ben

[Guest TheLibrarian]

Can you provide more detail about what you are doing and what is failing?

 

I cannot picture what you are attempting and therefore can't suggest anything useful.

[SpuffMonkey]

Probably something to do with secure communications/kerberos etc...?

 

Ben

 

Seconded

[Michael]

Try authenticating with domainname\username, then your password.

[ranj]

Just to clarify what he means

 

We used to have our ghost images on a share which was on a 2003 server. We use the universal TCPIP boot disk (NetBootDisk.com - The Universal TCP/IP Network Bootdisk for M$ Networks) to boot up a machine in dos mode so we could map the drive and then reimage the machine.

 

we would use the boot disk and then run the following command:

 

net use t: \\servername\ghostshare

 

This would then normally mount the share successfully. we would then go to the drive letter, there would be the ghost executable in there, run that and then go through the process of reimaging the machine. happy days.

 

The problem now is since we have moved all the images to a windows 2008 server when we try to run the net use command in dos it doesnt work. It doesnt authenticate successfully.

 

So we will run net use t: \\new2008servername\ghostshare.

 

and we are returned with a message to say

 

error 5: access is denied.

 

This problem is likely to do with security permission on a 2008 server.

 

Has anyone seen this sort of problem before. We also tryed to copy the ghost image to a windows 7 machine and share it that way and had the same problem.

 

if we try to do this on a server 2003 it works fine.

 

Any help on this would be appreciated.

[Guest TheLibrarian]

Can you use the server IP rather than the NetBIOS name?

 

This is a guess based on what I would try, I work with any 2K8 servers yet so I can't try it here.

 

Can you connect to the share successfully if you use WinPE / BartPE?

[DMcCoy]

Why not use the console or the ghostcast server?

 

I suspect you will have to turn off quite a lot of the signing requirements for the domain controller policies to get it to work.

[SYNACK]

Why not use the console or the ghostcast server?

 

I suspect you will have to turn off quite a lot of the signing requirements for the domain controller policies to get it to work.

 

Yeap 2008 server has higher security requirements which is why dos won't connect to it. Your best bet may be booting Windows PE/Window AIK and then running ghost through there which should work fine or using the above options.

[ranj]

Yeap 2008 server has higher security requirements which is why dos won't connect to it. Your best bet may be booting Windows PE/Window AIK and then running ghost through there which should work fine or using the above options.

 

Thanks for the replies.

 

I looked at group policy and didn't know which security policies would affect this.

 

Does anyone have any ideas which policies I would need to look at?

 

thanks

[SYNACK]

Thanks for the replies.

 

I looked at group policy and didn't know which security policies would affect this.

 

Does anyone have any ideas which policies I would need to look at?

 

thanks

 

Its not a policy as it is unsuported and opens you up to all sorts of vunrabilities that are present in the older protocol. I totally do not recommend it but you can do it in the registry like so:

 

Run "regedit" on Windows Server 2008 based computer.

 

Expand and locate the sub tree as follows. HKLM'System'CurrentControlSet'Services'LanmanServer'Parameters

 

Add a new REG_DWORD key with the name of "Smb2" (without quotation mark) Value name: Smb2

 

Value type: REG_DWORD

0 = disabled

1 = enabledSet the value to 0 to disable SMB 2.0, or set it to 1 to re-enable SMB 2.0.

 

Reboot the server.

 

Windows - SMB Signing (Little Pud)

 

and this will disable signing on the version 1 protocol:

To define SMB Signing Disabled Policy.

Instead of making changes to the Default Domain Policy to disable SMB signing, create a new Group Policy Object with the appropriate policy settings.

At the server, open Start, All Programs, Administrator Tools.

Open Group Policy Management.

Expand the forest.

Expand Domains.

Select the local domain. The group policy objects will display in the right-hand pane along with the Default Domain Policy.

Right-click the domain icon (domainname.local) in the console tree and select Create and Link a GPO Here.

Enter "SMB Signing Disabled" (without the quotations marks) for the GPO Name and click OK.

Right-click on the new GPO in the right-hand pane and select Edit to open the Group Policy Object Editor.

Under Computer Configuration, expand Windows Settings.

Expand Security Settings.

Expand Local Policies.

Select Security Options.

In the right-hand pane, scroll down to Microsoft network server: Digitally sign communications (always) and double-click on the policy object.

Select the Disabled radio button and make sure the checkbox is enabled for Define this policy setting.

Click OK.

 

Windows - SMB Signing (Little Pud)

 

Use at own risk.

[Bestbett]

Or just use RIS/WDS provided with 2003 and 2008 to image the machines instead of paying to use ghost.

 

There are some sharing changes in 2008 especially dealing with NETBIOS and UAC shares being turned off by default. You may need to enable NETBIOS to do what you are wanting. Enabling UAC shares is done through a registry change:

 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Pol icies\system\LocalAccountTokenFilterPolicy

 

0 - build filtered token (Remote UAC enabled)

1 - build elevated token (Remote UAC disabled)

 

By setting the DWORD entry to 1, you will be able to access the administrative shares since the remote logon token will not be filtered.

 

This is discussed in this KB article, Error message when you try to access an administrative share on a Windows Vista-based computer from another Windows Vista-based computer that is a member of a workgroup: "Logon unsuccessful: Windows is unable to log you on". (It's for Vista but it applies.)

[AndyR]

Or just use RIS/WDS provided with 2003 and 2008 to image the machines instead of paying to use ghost.

 

Or use it with Ghost. PXE booting makes life much easier.

[SpuffMonkey]

I think its this (which we had to do on 2003 as well (though can't say I endorse it)

 

On server 2008 one way to get there is the following:

Administrative Tools

Server Manager

Features

Group Policy Manager

Forest: ...

Default Domain Policy

Computer configuration

Policies

Windows Settings

Security Settings

Local Policies

Security Options

Microsoft Network Server: Digitally Sign Communications (Always)

- Define This Policy

- Disabled

 

Execute Gpupdate /force or reboot to apply policy

[ranj]

Hi

 

I have tried all the above solutions but still get the

 

error 5: access is denied when using the net use command.

 

The Microsoft Network Server: Digitally Sign Communications (Always) policy is disabled both on the top level domain policy as well as on the OU the server is placed in.

 

We are looking at alternative solutions such as MDT2010 and Novell Zenworks to deploy images but have other priorities so to load our ghost images from a 2008 server is just a temp solution. Any help would be appreciated.

[sted]

instead of boot floppy use win7pe (google it atm site appears iffy) and crate a wim image containing ghost shove that as a boot image in wds and boot into ghost from the network pxe boot