Client for Open Enterprise Server Release Notes

2.1 What’s New in Client for Open Enterprise Server 2 SP5

Platform Support

Client for Open Enterprise Server 2 SP5 (IR2) and later supports Windows 10 update (version 20H2).

NCP Encryption Support

The feature NCP Encryption on OES is a security feature that increases the security of data transmitted across networks between the NCP server and clients.

The Client for Open Enterprise Server 2 SP5 and later provides support for NCP Encryption capability on the OES 2018 SP2 or later server. The following are the new parameters introduced in the Client Properties to support this functionality:

For more information on the parameters, see Advanced Settings in the Client for Open Enterprise Server Administration Guide.

For information on the NCP server side configuration for NCP Encryption, see Managing NCP Security Configurations in the OES 2018 SP2: NCP Server for Linux Administration Guide.

Multi Factor Authentication Enhancement

The Advanced Authentication capability on the Client for Open Enterprise Server 2 SP5 is enhanced to support the Multi Factor Authentication (MFA) on the OES 2018 SP2 server. For more information on the NCP server side configuration for MFA, see Managing NCP Security Configurations in the OES 2018 SP2: NCP Server for Linux Administration Guide.

Server Platform Support

The Client for Open Enterprise Server 2 SP5 supports the Open Enterprise Server (OES) 2018 SP2 release.

Enhanced eDirectory Password Expiration Handling

Previously, the eDirectory password expiry was handled after the execution of the eDirectory login scripts on the user’s desktop. Now, the eDirectory password expiration is handled during the login of the user and changing the passwords during the grace login period.

In cases where the eDirectory account also defines the Windows account, updating the eDirectory password prior to the Windows account improves Domain Services for Windows and other domain account synchronization scenarios.

2.2 What’s New in Client for Open Enterprise Server 2 SP4

2.3 Client Integration with Advanced Authentication

Client for Open Enterprise Server 2 SP4 (IR6) and later provides optional installation-time integration with the Advanced Authentication Client for Windows, and also optional functionality to require that the Advanced Authentication Client must be used when initiating an eDirectory login. This enables you to perform multi-factor authentication to Windows using Advanced Authentication Client followed by seamless eDirectory login through the Client. For more information on Installing and Configuring Advanced Authentication Client, see Client for Open Enterprise Server Administration Guide.

Further integration capabilities for Client for Open Enterprise Server and Advanced Authentication are being explored and planned to be delivered in the upcoming releases of Client for Open Enterprise Server.

For more information on Advanced Authentication, see Advanced Authentication documentation site.

2.4 Client Updated With SHA-2 Certificates

Client for Open Enterprise Sever 2 SP4 (IR3) and later is signed using a new Micro Focus SHA-2 certificate, due to Windows’ deprecation of SHA-1 certificates.

For successful installation of Client on Windows 7 and Windows Server 2008 R2, ensure to install the Microsoft Security Update KB3033929 to add support for SHA-2 certification.

2.5 Rebranding Changes

Novell is now part of Micro Focus. Products across the portfolio are now being rebranded to reflect Micro Focus or a more appropriate name. This corporate change impacts the name of products and components, user interfaces, logos, and so on. As a result of this corporate change, the new name for Novell Client is Client for Open Enterprise Server.

The documentation update to reflect these changes (such as names and screenshots) is being done in a phased manner. Until all the guides in the documentation library are modified, Novell Client and Client for Open Enterprise Server are used interchangeably.

The screenshot provides an overview of the change to the user interfaces, logos, and so on. However, all the client functionality remains the same.

Figure 1 Overview of Client for Open Enterprise Server

For more information, see Rebranding Changes in the Client for Open Enterprise Server Administration Guide.

3.1 Supported Windows Platforms

The Client for Open Enterprise Server is supported on the following platforms:

The Client for Open Enterprise Server is also supported in Remote Desktop Services and Desktop Virtualization environments.

3.2 Supported Server Platforms

The Client for Open Enterprise Server supports Open Enterprise Server (OES) 2018 SP2, OES 2018 SP1, OES 2018, OES 2015 SP1, OES 2015, OES 11 SP2, OES 11 SP1, OES 11, OES 2, and NetWare 6.5.

On Windows Server platforms, the Client for Open Enterprise Server might run but is not supported on Datacenter Edition, Web Server Edition, or on Server Core installations using any edition.

3.3 Installing the Client for Open Enterprise Server

To install the Client, run the setup.exe file located in the C:\Micro Focus\Client for Open Enterprise Server 2 SP4 (IRx) directory.

3.4 Uninstalling a Later Version of Client for Open Enterprise Server to Reinstall a Previous Client Version

The NMAS client installed with Client for Open Enterprise Server includes NICI as a required dependency. Uninstalling the Client automatically uninstalls the NMAS client, but intentionally does not uninstall NICI because other applications on the workstation besides NMAS or the Client may still be using NICI services.

If you uninstall the Client for Open Enterprise Server with the intention of installing a previous version of the Client, it is recommended that you also uninstall NICI (and NICI for Windows x64, if running Windows x64) before re-installing the previous Client.

Attempting to install the initial an earlier Client without first removing NICI can result in one or more of the following issues:

If you fail to follow these guidelines, features that require NMAS will not function, due to one or all of the above conditions.

These guidelines and issues also apply to installing the Client on a Windows Server 2012 machine where eDirectory 8.8 SP5 or later has already been installed. eDirectory on Windows Server 2008 includes NICI 2.7.6 or later, and installing previous versions of the Client which include NICI 2.7.4 or earlier can cause the NICI installation to become damaged.

3.5 The Total Path to the Installation Set Must Not Exceed 214 Characters.

The path to any and all files within a Client for Open Enterprise Server installation set must not exceed 256 characters.

Currently this means the directory path into which you extract the installation set must not exceed 214 characters. This limit is relative to the traditional MAX_PATH or 256-character limit in Windows applications, but also takes into account additional path space that is needed for running the installation.

If the installation set is being accessed from a remote network location, for example \\servername\volumename, the length of the network server and volume name also counts against the maximum depth, due to underlying processing that makes use of the real path to the installation set. Even if a mapped drive letter and/or the map root feature is used for accessing the installation set, the limit is measured as if a UNC path had been used.

6.1 The Client on Microsoft Surface Pro 4 or Later Does Not Reconnect After the Workstation Wakes Up

After the Microsoft Surface Pro 4 or later wakes up from sleep mode, the Client for Open Enterprise Server on it does not reconnect and reports an error. To resolve this issue, create a registry key NetworkAdapterPowerEventHandling of type DWORD under [HKLM\SOFTWARE\Novell\Client\Parameters\NetworkAdapterPowerEventHandling] and set the value to 0.

6.2 Additional Advanced Authentication Login is not Prompted for Additional eDirectory Login Attempts Through Login Script

Additional eDirectory logins created during eDirectory login script processing does not prompt for additional Advanced Authentication logins. The password of the primary eDirectory login performed with Advanced Authentication is used for the additional eDirectory login attempts as well.

6.3 Client for Open Enterprise Server 2 SP4 (IR11) Does Not Support Authentication Chain

The Advanced Authentication feature of creating authentication chain used during login is currently not supported in Client for Open Enterprise Server.

6.4 Deferred Write or Time Stamp Changes Might Not Reflect in Directory Listings

With File Caching configured for Read and Write, if an application performs a directory enumeration before one or more deferred writes or time stamp changes have been committed to the server, the enumerated file information received from the server might not reflect the written file size or time stamp information. This is because the Read and Write caching is still being processed. However, the information is not lost and it will reflect in future directory enumerations after the background writer commits all pending changes.

6.5 eDirectory Login Fails After Windows Upgrade to Windows 10 RS3

When you upgrade a device to Windows 10 RS3 (Fall Creators Update) with Client for Open Enterprise Server 2 SP4 (IR6) or earlier already installed, the eDirectory login scripts fail to run and NCP connections fail to establish after Windows logon.

When you upgrade a device to Windows 10 RS3 without Client for Open Enterprise Server, the first login after installing Client for Open Enterprise Server on the upgraded device logs into both eDirectory and Windows successfully. But the issue of eDirectory login scripts failing to run and missing NCP connections is observed on the second and subsequent logins with the same credentials used for first login.

This is because of a new feature introduced in Windows 10 RS3 to automatically reboot the device using the logon information of the user who had logged in last on the device. This feature creates a Windows-only logon session automatically on behalf of previously logged-on user and you are reconnected to this Windows-only logon session even after you provide your credentials to login to eDirectory and Windows again through the interactive credential provider.

To resolve this issue and perform eDirectory login along with Windows logon, disable the existing Windows Update group policy for ‘Automatic Restart Sign On’. The feature can be disabled by creating a registry key DisableAutomaticRestartsSignOn of type DWORD under [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] and set the value to 0x1. Installing or Upgrading to Client for Open Enterprise Server 2 SP4 (IR7) or later by default disables this feature by setting the group policy for Automatic Restart Sign On.

6.6 Loss of Client Configuration Settings After Upgrading to Windows 10 RS2

The Windows 10 Creators Update ("1703" or March 2017 release of Windows 10) has introduced a Windows upgrade issue that causes loss of all Client for Open Enterprise Server configuration settings during the Windows upgrade process. For more information on this issue, see TID 7018786.

6.7 Windows 7 and Windows Server 2008 R2 Displays the Verification Prompt Even if Trusted Software Is Selected

During installations or upgrades of Client for Open Enterprise Server the Microsoft Verification prompt is displayed even if “Always trust software from Micro Focus” is selected or the certificate is installed as a “Trusted Publisher”.

To resolve this issue, apply the Microsoft HotFix KB2921916 in addition to selecting the “Always trust software from Micro Focus” checkbox or pre-installing the Micro Focus SHA-2 certificate as a “Trusted Publisher”.

6.8 The 8.3 File Name Support is Unavailable with the Lazy Close Feature

If the Lazy Close feature is set to "ON", the 8.3 (short file name/DOS name) file name support will be unavailable for Client for Open Enterprise Server. For example, a Dir /x command will display blank characters instead of the DOS/short file names and will display only the long names for the files in a mapped drive. Also, 16-bit applications will not be able to retrieve the 8.3 file names for the files.

6.9 “Login with Third-Party Credential Provider” Feature Not Supported When Microsoft Windows Live ID is Used

"Login with Third-Party Credential Provider" feature is currently not supported when a user tries to login using Microsoft Windows Live ID and Password. Novell plans to fix this in the future release of Novell Client. Also note that "Login with Non-Novell Credential Provider" feature works when PIN-based or Picture Based Login is enabled for the same Microsoft Windows Live ID.

6.10 Novell Products Not Supported with the Client for Open Enterprise Server

The NetWare Administrator utility (nwadmn32.exe) and ConsoleOne are not supported on Windows or with the Novell Client for Windows, except where explicitly declared by the ConsoleOne release notes.

6.11 Welcome Screen Issues

6.12 Authenticating to a OES Server Through a UNC Path

If you log in to a OES server using a UNC path in Windows Explorer and specify more than just the server and volume, the Windows Explorer window will appear in the foreground and the Results page will appear in the background.

If you specify only the server and volume, authenticating with a UNC path works correctly.

6.13 Using Ctrl+Alt+Del to Change Your Password

If you are currently authenticated to eDirectory, after entering your old password and new password, you will see a Change Password dialog box after clicking the Submit button. From the Change Password dialog box, you can choose which resources you want the password change to go to.

If you are not currently authenticated to eDirectory, the password change will only be performed for your Windows account.

6.14 Mapped Drive Icon Doesn’t Update on Re-Authentication

When you detach from a mapped Network drive, the mapped drive icon displayed in Windows Explorer changes to a red X to indicate that the mapped drive is no longer accessible. If you use the Client Tray icon to re-authenticate to the eDirectory tree (and you selected the Check to always map this drive letter when you start Windows option when you originally mapped the drive), the mapped drive icon does not update to show that the drive is accessible again.

6.15 LDAP Contextless Login Differences in the Client for Open Enterprise Server

The LDAP Contextless Login feature in the Client includes the following limitations for those familiar with the Novell Client 4.x for Windows XP/2003.

6.16 Login Profiles

6.17 Using the Force Grace Login Password Change Option

If you set the Force Grace Login Password Change option (available on the Advanced Login tab in the Client Properties dialog box) to On (it is Off by default), the OES Login will require a password change on the next-to-last grace login instead of the last grace login.

To work around this issue, use one of the following options:

6.18 File Caching Settings Ignored

The Client for Open Enterprise Server ignores the SET CLIENT FILE CACHING ENABLED parameter on NetWare servers. Caching is on by default. Setting the parameter to on or off has no effect on the Client behavior. This set parameter does still affect the NCP server’s behavior with regard to granting level 1 oplocks when requested.

To disable caching for a client, do the following:

For information on File Caching, see “Advanced Settings” in the administration guide for the client.

6.19 Exceeding Disk Quota Is Reported As Out Of Disk Space Error

When a user or directory quota has been exceeded, the expected error condition will reflect only out of disk space, in whatever manner the application chooses to report this error condition. The error status will not differentiate between the disk is out of total physical space and the current user or directory quota has been exceeded.

6.20 Login Script Execution Starts Before User’s Desktop

When logging in to both eDirectory and Windows through the credential provider of the Client for Open Enterprise Server, the processing of login scripts stored in eDirectory now starts at the same time other login scripts are processed, such as the Windows user login script. This means that eDirectory login script execution will start (but not necessarily finish) before the user's Desktop is built.

In addition, existing Windows policies such as Run logon scripts synchronously now apply to how the Client logon script execution will be handled. This appears to be the default behavior in Windows Server with Terminal Services, but the policy may need to be explicitly set in other Windows configurations.

If you require that logon script processing must finish before the user's desktop is built, you can enable this Windows policy in the Group Policy Editor (GPEDIT.MSC) under Computer Configuration > Administrative Templates > System > Scripts > Run logon scripts synchronously. Note the same policy is also available as a User Configuration policy.

6.21 Roaming User Profile Paths Saved On Non-Windows Servers

In Windows 2000 SP4 and Windows XP SP1 and later, by default Windows will require that the roaming profile directory successfully pass a test for specific Windows-based permissions. This test fails against OES Network paths since permissions are based on eDirectory permissions instead of Windows permissions, and can fail against Windows- or other non-Windows-based servers as well.

Windows defines a Do not check for user ownership of Roaming Profile Folders policy CompatibleRUPSecurity) to allow opting out of this security check where necessary. Enabling this policy is required to successfully store roaming profiles on a OES server or other Windows or non-Windows server where the security check cannot succeed.

In the Novell Client for Windows XP/2003, installation of the Client automatically enabled the CompatibleRUPSecurity policy by default, regardless of whether it was known that user profiles were being saved to OES Network paths. Administrators who did want to allow the new Microsoft security test to be performed had to override and disable the policy.

Installation of the Client on Windows Vista and later does not enable the CompatibleRUPSecurity policy by default. Administrators must enable this policy if they intend to store roaming profiles on OES or non-OES servers that will fail the Microsoft security check.

6.22 Windows Program Compatibility Assistant May Be Invoked After Successfully Running NCIMAN.EXE on Windows 7, 8, 10 or Windows Server 2012

After running the Client Installation Manager (NCIMAN.EXE) application on Windows 7, 8, 10, or Windows Server 2012, Windows may prompt with the Program Compatibility Assistant as though NCIMAN.EXE was an installation program that may not have completed successfully.

NCIMAN.EXE is not actually a program that attempts to install or uninstall any part of Client for Open Enterprise Server software, and is just a tool for creating and editing Client Property Files (NCPF), such as an UNATTEND.TXT file.

This warning can be ignored by simply selecting the This program installed correctly link offered by the Windows Program Compatibility Assistant.

6.23 TSClientAutoAdminLogon May Not Use The Profile Specified In DefaultLoginProfile

As part of establishing a TSClientAutoAdminLogon policy, it is required to create a DefaultLoginProfile value to specify which Client login profile should be used for the eDirectory portion of the login.

For Windows Server configurations where only a single Client login profile exists anyway (for example, Default), there is no issue and the single profile will be successfully used. But it has been observed that when more than one login profile is defined, it is possible for the TSClientAutoAdminLogon attempt to use the last-used Client login profile for a user instead of the login profile explicitly specified in the DefaultLoginProfile configuration.

This represents an unintentional behavior, and is being examined for future versions of the Client for Open Enterprise Server. The workaround if this issue is encountered is to define and use just a single Client login profile, at least on Windows Server machines on which Terminal Services and TSClientAutoAdminLogon are expected to be used.

6.24 A Kernel-Mode Bugcheck May Occur If eDirectory Connections Are Cleared While A File Copy Operation Is In Progress

If a file copy operation is in progress with many and/or large files and the user attempts to either clear their eDirectory connections or change whom they are logged into eDirectory as while the file copy operation is still in progress, it has been observed that instead of the expected file access failure it is possible for the workstation to report a blue screen or kernel-mode bugcheck.

This issue is being examined for future versions of the Client. The workaround is to recommend that users not attempt to clear their existing eDirectory login or NCP connections out from under a file copy operation that is in progress.

6.25 Login From Windows Welcome Screen May Not Use Windows Username From Client Login Profile

In cases where the Client credential provider used by the Windows welcome screen login is switched between Computer Only Logon mode and Network Logon mode prior to performing a Network Logon login attempt, the Windows account name used during the login attempt might be whatever Windows account name was specified in the Username field while the credential provider was in Computer Only Logon mode, instead of the correct Windows account name saved and retrieved from the Windows tab of the effective Client login profile.

This represents an unintentional behavior, and is being examined for future versions of the Client. The workaround is to avoid the switch between Computer Only Logon mode and Network Logon mode when possible. And when the issue does occur, provide the correct Windows account credentials in the Windows logon fields that appear after the attempt to use the incorrect Windows account name.

6.26 Failures Installing, Uninstalling, and Using the Client for Open Enterprise Server if iPrint is Installed Before the Client

The Novell iPrint 5.32 and iPrint 5.30 clients contain an issue in which incorrect security is established on the [HKEY_LOCAL_MACHINE\Software\Novell] registry key, if and when the Novell iPrint client was the first installed software that needed to create this registry key. This registry security issue is addressed in the Novell iPrint 5.35 client and later.

If the Novell iPrint 5.32 or iPrint 5.30 client is installed prior to the Client for Open Enterprise Server, the security that is established on the [HKEY_LOCAL_MACHINE\Software\Novell] registry key causes incorrect security to be propagated to the Client's own registry sub-keys. In addition, the incorrect registry security can cause the Novell NMAS Challenge Response Method installation to fail with Error 1603, due to incorrect registry security which was propagated to the Novell NMAS Client's registry sub-keys.

The Novell Client 2 SP1 (IR1) contained some mitigation for this issue that could clean-up the incorrect registry security established by Novell iPrint and proceed with a successful Client installation if the Client for Open Enterprise Server or earlier Client installation had not already been attempted and failed after installing the Novell iPrint client. If a failed Client installation had already been attempted after installing the Novell iPrint client first, the Novell Client 2 SP1 (IR1) installation will still fail due to the improper registry security which has already been established.

The Novell Client 2 SP1 (IR2) contains further mitigation which will actually clean up the registry security issue created by the Novell iPrint client, and furthermore will clean up the incorrect security which may have already been propagated to the Client registry sub-keys and the Novell NMAS Client sub-keys. So on a machine where the Novell iPrint 5.32 or iPrint 5.30 client was installed prior to the Client for Open Enterprise Server, but a Client installation has already subsequently failed, the primary corrective action to perform is to install Novell Client 2 SP1 (IR2) on top of the previously failed Client installation.

There is however one scenario under which even the Novell Client 2 SP1 (IR2) fix will be unable to detect and clean-up registry security problems which still exist due to the Novell iPrint client installation. This problem scenario occurs specifically when all of the following conditions are met:

In this specific sequence where the initial failed Client installation was performed after explicitly deselecting Novell NMAS from being installed with the Client, the subsequent mitigations for the Novell iPrint security issue performed by the Novell Client 2 SP1 (IR1) and Novell Client 2 SP1 (IR2) installations are unable to detect or correct that further clean-up of the Novell iPrint registry security permissions is still necessary.

The symptoms that occur when a machine is still in this broken state include a crash that occurs whenever the Client login dialog would have been presented. For example, when attempting to invoke the “Show Advanced Options” link on the Windows welcome screen, the Windows LogonUI.exe process can crash. When trying to invoke “OES Login” from the client tray menu in the Windows taskbar notification area (systray), the Client NWTRAY.EXE process can crash.

Unfortunately the incorrect permissions established on the registry by Novell iPrint client will also prevent successful un-installation from being performed after the machine is already in this state. This remaining scenario where the Novell iPrint registry permissions are not successfully cleaned up is being examined for additional mitigation in future versions of the Client.

6.27 eDirectory AutoAdminLogon Requires Windows AutoAdminLogon

Establishing an eDirectory AutoAdminLogon configuration requires that a Windows AutoAdminLogon configuration is also established. Meaning at minimum an automatic Windows account logon will occur if only a Windows AutoAdminLogon is configured; or both an eDirectory account logon and a Windows account logon will occur if both eDirectory AutoAdminLogon and Windows AutoAdminLogon are configured. Any workstation where only an eDirectory AutoAdminLogon is configured will now have the AutoAdminLogon configuration ignored, instead of experiencing undefined results.

For more information on configuring a Windows AutoAdminLogon policy or both an eDirectory AutoAdminLogon and Windows AutoAdminLogon policy, see Section Enabling AutoAdminLogon of the Client for Open Enterprise Server Administration Guide.

6.28 Client for Open Enterprise Server 802.1x Authentication Not Supported with Microsoft Server 2008 R2-based RADIUS Server

The Client 802.1x Authentication integration does not succeed when Microsoft Server 2008 R2- based RADIUS service is being used for 802.1x authentication.

For more information, see TID 7007679 or bug 631640.

6.29 Issues in Novell Client 2 SP4 for Windows (IR1) When Windows 7 or 8.1 is Upgraded to Latest Windows 10

If you install the Novell Client 2 SP4 for Windows (IR1) on Windows 7 or 8.1 and then upgrade the Windows to latest Windows 10, the already installed Novell Client 2 SP4 for Windows (IR1) might not work properly. To avoid this issue, ensure that the Novell Client 2 SP4 for Windows (IR1) is newly installed on Windows 10.

This issue is being examined and will be fixed for future versions of the Client.

7.1 Mapping RDN Paths

Relative distinguished name paths are not supported for mapping network drives. For example \\tree\server_volume.context. (note the trailing period) is not supported whereas \\tree\server_volume.context (no trailing period) is.

10.1 OpenSLP

“OpenSLP” is copyrighted to Caldera systems. Micro Focus ships a modified version of OpenSLP for the Client for Open Enterprise Servers. Micro Focus supports the modified OpenSLP software shipped with the Client for Open Enterprise Server.

Copyright © 2000 Caldera Systems, IncAll rights reserved.Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE CALDERA SYSTEMS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.