6.1 Salvage, Purge and OES Copy Features do not Support Long Paths
The Client for Open Enterprise Server shell extension features such as Salvage, Purge and OES Copy do not yet support the longer paths, which can be created and accessed through the Client for Open Enterprise Server 2 SP7 client. These features are not be available for paths which exceed the Microsoft Windows MAX_PATH limit of 260 characters. In addition, the Salvage, Purge and OES Copy features skips processing any enumerated files or subfolders, which cannot be supported within MAX_PATH limits.
6.2 Microsoft SmartScreen Warning when Accessing Some Files on Long Paths
It is observed that the Microsoft's SmartScreen filter sometimes present a warning “Windows Security: These files can't be opened. Your Internet Security settings prevented one or more files from being opened.” This happens when using Microsoft's File Explorer to launch an associated application for a file that exists on a long path, which exceeds the Windows MAX_PATH default length of 260 characters. It is currently unclear whether this is a MAX_PATH limitation of SmartScreen itself, and remains under investigation.
6.3 Earlier Versions of Client for Open Enterprise Server Fail to Load on Windows 11 22H2 and Later
If the Client for Open Enterprise Server 2 SP6 (IR1) or earlier is available on a machine that is updated to Windows 11 22H2, the login interface reports: “a required network service has not started”. The Windows 11 22H2 release actively blocks the Client 2SP6 (IR1) or earlier kernel-mode drivers, but only on certain hardware platforms. Installing the Client for Open Enterprise Server 2 SP6 (IR2) or later release resolves the issue. For more information, see the Micro Focus Knowledge Base Article.
6.4 Newly Added Windows User Does Not Get Default Client Login Option
When using the “Windows 10 behavior” credential provider mode, Microsoft initially defaults to selecting the Microsoft credential provider for new Windows users. The “Sign-in options” must be used for first-time or newly-created Windows user accounts, to explicitly select the Client for Open Enterprise Server's credential provider. The selection is then expected to remain the default for future logins as this same Windows user account, until the user explicitly uses the “Sign-in options” again to select a different credential provider.
6.5 Change Password Feature is Not Available when the Workstation is Connected to Azure AD Domain
-
The change password feature in NWTray does not work for Azure Password change. The password change can be done only through Azure Portal. To change the Azure AD password, use option.
-
Ctrl+Alt+Del option in Azure Environment will take the user to the portal to change the password. To change the password of an eDirectory user use NWTray.
-
Windows is unable to take either old or new password after the eDirectory password is changed with Zenworks DLU policy applied.
6.6 The Client on Microsoft Surface Pro 4 or Later Does Not Reconnect After the Workstation Wakes Up
After the Microsoft Surface Pro 4 or later wakes up from sleep mode, the Client for Open Enterprise Server on it does not reconnect and reports an error. To resolve this issue, create a registry key NetworkAdapterPowerEventHandling of type DWORD under [HKLM\SOFTWARE\Novell\Client\Parameters\NetworkAdapterPowerEventHandling] and set the value to 0.
6.7 Additional Advanced Authentication Login is not Prompted for Additional eDirectory Login Attempts Through Login Script
Additional eDirectory logins created during eDirectory login script processing does not prompt for additional Advanced Authentication logins. The password of the primary eDirectory login performed with Advanced Authentication is used for the additional eDirectory login attempts as well.
6.8 Client for Open Enterprise Server 2 SP4 (IR11) Does Not Support Authentication Chain
The Advanced Authentication feature of selecting which authentication chain should be used during login is currently not supported in Client for Open Enterprise Server.
6.9 Deferred Write or Time Stamp Changes Might Not Reflect in Directory Listings
With File Caching configured for Read and Write, if an application performs a directory enumeration before one or more deferred writes or time stamp changes have been committed to the server, the enumerated file information received from the server might not reflect the written file size or time stamp information. This is because the Read and Write caching is still being processed. However, the information is not lost and it will reflect in future directory enumerations after the background writer commits all pending changes.
6.10 eDirectory Login Fails After Windows Upgrade to Windows 10 RS3
When you upgrade a device to Windows 10 RS3 (Fall Creators Update) with Client for Open Enterprise Server 2 SP4 (IR6) or earlier already installed, the eDirectory login scripts fail to run and NCP connections fail to establish after Windows logon.
When you upgrade a device to Windows 10 RS3 without Client for Open Enterprise Server, the first login after installing Client for Open Enterprise Server on the upgraded device logs into both eDirectory and Windows successfully. But the issue of eDirectory login scripts failing to run and missing NCP connections is observed on the second and subsequent logins with the same credentials used for first login.
This is because of a new feature introduced in Windows 10 RS3 to automatically reboot the device using the logon information of the user who had logged in last on the device. This feature creates a Windows-only logon session automatically on behalf of previously logged-on user and you are reconnected to this Windows-only logon session even after you provide your credentials to login to eDirectory and Windows again through the interactive credential provider.
To resolve this issue and perform eDirectory login along with Windows logon, disable the existing Windows Update group policy for ‘Automatic Restart Sign On’. The feature can be disabled by creating a registry key DisableAutomaticRestartsSignOn of type DWORD under [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] and set the value to 0x1. Installing or Upgrading to Client for Open Enterprise Server 2 SP4 (IR7) or later by default disables this feature by setting the group policy for Automatic Restart Sign On.
6.11 Loss of Client Configuration Settings After Upgrading to Windows 10 RS2
The Windows 10 Creators Update ("1703" or March 2017 release of Windows 10) has introduced a Windows upgrade issue that causes loss of all Client for Open Enterprise Server configuration settings during the Windows upgrade process. For more information on this issue, see TID 7018786.
NOTE:With current preview builds of the upcoming Windows 10 (Fall Creators Update) expected from Microsoft in October 2017, this loss of Client for Open Enterprise Server settings no longer occurs during the Windows 10 upgrade process.
6.12 Windows 7 and Windows Server 2008 R2 Displays the Verification Prompt Even if Trusted Software Is Selected
During installations or upgrades of Client for Open Enterprise Server the Microsoft Verification prompt is displayed even if “Always trust software from Micro Focus” is selected or the certificate is installed as a “Trusted Publisher”.
To resolve this issue, apply the Microsoft HotFix KB2921916 in addition to selecting the “Always trust software from Micro Focus” checkbox or pre-installing the Micro Focus SHA-2 certificate as a “Trusted Publisher”.
6.13 The 8.3 File Name Support is Unavailable with the Lazy Close Feature
If the Lazy Close feature is set to "ON", the 8.3 (short file name/DOS name) file name support will be unavailable for Client for Open Enterprise Server. For example, a Dir /x command will display blank characters instead of the DOS/short file names and will display only the long names for the files in a mapped drive. Also, 16-bit applications will not be able to retrieve the 8.3 file names for the files.
6.14 “Login with Third-Party Credential Provider” Feature Not Supported When Microsoft Windows Live ID is Used
"Login with Third-Party Credential Provider" feature is currently not supported when a user tries to login using Microsoft Windows Live ID and Password. Novell plans to fix this in the future release of Novell Client. Also note that "Login with Non-Novell Credential Provider" feature works when PIN-based or Picture Based Login is enabled for the same Microsoft Windows Live ID.
6.15 Novell Products Not Supported with the Client for Open Enterprise Server
The NetWare Administrator utility (nwadmn32.exe) and ConsoleOne are not supported on Windows or with the Novell Client for Windows, except where explicitly declared by the ConsoleOne release notes.
6.16 Welcome Screen Issues
One-time Failure to Remember Last Logged-on User When Upgrading to Client for Open Enterprise Server
After installing Client for Open Enterprise Server on a machine which was previously using Novell Client 2 SP1 or earlier, during the next boot-up the “Username” field will come up blank rather than defaulting to the previous “last logged-on user” info. Once a new login has been performed using the Client for Open Enterprise Server, future logouts and/or reboots will correctly show the last logged-on user info again. Note that the Client login profile information (the eDirectory tree name, context, and so on.) has not been lost; only a one-time inability to display the last logged-on username.
This issue is not observed when you upgrade to Client for Open Enterprise Server from Novell Client 2 SP3 or SP2.
After Installing the Client, Local User Tiles Are No Longer Visible During Login
If you install the Client on a machine with multiple local users, after rebooting, you are asked to log in to the Client. At this point, there are only two available tiles: one for the local administrator user, and one for the Client for Open Enterprise Server. You will no longer see the individual tiles for the local users.
This is working as designed. The Client for Open Enterprise Server follows Microsoft’s recommendations to filter out the local user accounts after installing the Client. If you install the workstation into a Microsoft Domain, the local user tiles are also filtered out, and the Client follows this behavior.
Welcome Screen Cancel Button
When logging in to eDirectory via the Windows welcome screen, the button that is displayed is not active and therefore cannot be clicked.
Fast User Switching/Connecting via Remote Desktop Connection
When logging in to a Windows workstation using the Client for OES, OES connections made during the login will persist only if the Windows account you specify is not currently logged on to the workstation. If the Windows account specified is already logged in, Windows will reconnect you to that existing session when you log back in to the workstation, regardless of what eDirectory credentials might have been supplied, or whether they're the same as the eDirectory credentials already in use for that running session (if any).
This applies to both Fast User Switching and connecting via Remote Desktop Connection.
6.17 Authenticating to a OES Server Through a UNC Path
If you log in to a OES server using a UNC path in Windows Explorer and specify more than just the server and volume, the Windows Explorer window will appear in the foreground and the Results page will appear in the background.
If you specify only the server and volume, authenticating with a UNC path works correctly.
6.18 Using Ctrl+Alt+Del to Change Your Password
If you are currently authenticated to eDirectory, after entering your old password and new password, you will see a Change Password dialog box after clicking the button. From the Change Password dialog box, you can choose which resources you want the password change to go to.
If you are not currently authenticated to eDirectory, the password change will only be performed for your Windows account.
6.19 Mapped Drive Icon Doesn’t Update on Re-Authentication
When you detach from a mapped Network drive, the mapped drive icon displayed in Windows Explorer changes to a red X to indicate that the mapped drive is no longer accessible. If you use the Client Tray icon to re-authenticate to the eDirectory tree (and you selected the option when you originally mapped the drive), the mapped drive icon does not update to show that the drive is accessible again.
6.20 LDAP Contextless Login Differences in the Client for Open Enterprise Server
The LDAP Contextless Login feature in the Client includes the following limitations for those familiar with the Novell Client 4.x for Windows XP/2003.
-
When invoking from the Client for Open Enterprise Server welcome screen (the login dialog seen at boot time and when logging out of Windows Vista), the LDAP Contextless Login lookup cannot be triggered when viewing the tab. If LDAP Contextless Login is enabled, a lookup is performed after the user attempts to log in to eDirectory from the welcome screen.
This is different from the LDAP Contextless Login behavior when running LOGINW32.EXE or selecting the option from the Client tray application on the desktop. In those instances, you can see the effect of the LDAP Contextless Login lookup prior to actually proceeding with the eDirectory login.
-
The options to search eDirectory using information other than a complete username (for example partial usernames using wildcards, or alternate attributes such as phone number or e-mail address) have been disabled in the Client for Open Enterprise Server. Only complete usernames can be used for LDAP Contextless Login.
6.21 Login Profiles
Using DHCP in Login Profiles
If is chosen as an option in a login profile for Tree, Context, or Server, it cannot be removed by simply editing the field when logging in or by saving the profile on successful login. Any values entered in these fields during login will not be saved when is enabled for that field. This is working as designed.
Disabling the Login Profile List
If you set the option (available on the Advanced Login tab in the Client Properties dialog box) to (meaning that the drop-down list will not be displayed on the Client Login dialog box), your next login will automatically use the last profile you logged in with.
If you want to use the default profile when the option is turned off, make sure that you log in using the default before you turn the option off.
6.22 Using the Force Grace Login Password Change Option
If you set the option (available on the Advanced Login tab in the Client Properties dialog box) to (it is Off by default), the OES Login will require a password change on the next-to-last grace login instead of the last grace login.
To work around this issue, use one of the following options:
-
Avoid this setting. Users are prompted to change the password on every grace login, but on the last one they have the option of canceling out and potentially getting locked out if they log out one more time without changing the password.
-
Add one to the number of grace logins. The message will tell users that they have four, three, then two grace logins, and then they will be required to change the password.
-
Suggest that users change their password while they still have two or more grace logins.
6.23 File Caching Settings Ignored
The Client for Open Enterprise Server ignores the SET CLIENT FILE CACHING ENABLED parameter on NetWare servers. Caching is on by default. Setting the parameter to on or off has no effect on the Client behavior. This set parameter does still affect the NCP server’s behavior with regard to granting level 1 oplocks when requested.
To disable caching for a client, do the following:
-
Right-click the Client Tray icon in the System Tray.
-
Click .
-
Select the tab.
-
Select and set it to .
For information on File Caching, see “Advanced Settings” in the administration guide for the client.
6.24 Exceeding Disk Quota Is Reported As Out Of Disk Space
Error
When a user or directory quota has been exceeded, the expected error condition will reflect only out of disk space,
in whatever manner the application chooses to report this error condition. The error status will not differentiate between the disk is out of total physical space
and the current user or directory quota has been exceeded
.
6.25 Login Script Execution Starts Before User’s Desktop
When logging in to both eDirectory and Windows through the credential provider of the Client for Open Enterprise Server, the processing of login scripts stored in eDirectory now starts at the same time other login scripts are processed, such as the Windows user login script. This means that eDirectory login script execution will start (but not necessarily finish) before the user's Desktop is built.
In addition, existing Windows policies such as Run logon scripts synchronously now apply to how the Client logon script execution will be handled. This appears to be the default behavior in Windows Server with Terminal Services, but the policy may need to be explicitly set in other Windows configurations.
If you require that logon script processing must finish before the user's desktop is built, you can enable this Windows policy in the Group Policy Editor (GPEDIT.MSC) under > > > > . Note the same policy is also available as a User Configuration policy.
6.26 Roaming User Profile Paths Saved On Non-Windows Servers
In Windows 2000 SP4 and Windows XP SP1 and later, by default Windows will require that the roaming profile directory successfully pass a test for specific Windows-based permissions. This test fails against OES Network paths since permissions are based on eDirectory permissions instead of Windows permissions, and can fail against Windows- or other non-Windows-based servers as well.
Windows defines a Do not check for user ownership of Roaming Profile Folders
policy CompatibleRUPSecurity
) to allow opting out of this security check where necessary. Enabling this policy is required to successfully store roaming profiles on a OES server or other Windows or non-Windows server where the security check cannot succeed.
In the Novell Client for Windows XP/2003, installation of the Client automatically enabled the CompatibleRUPSecurity
policy by default, regardless of whether it was known that user profiles were being saved to OES Network paths. Administrators who did want to allow the new Microsoft security test to be performed had to override and disable the policy.
Installation of the Client on Windows Vista and later does not enable the CompatibleRUPSecurity
policy by default. Administrators must enable this policy if they intend to store roaming profiles on OES or non-OES servers that will fail the Microsoft security check.
NOTE:In addition to being able to push this policy setting out with normal Novell ZENworks or Microsoft Group Policy methods, the Client also provides a parameter in . This parameter can be set during installation through use of a Client Properties File (NCPF), for example UNATTEND.TXT.
6.27 Windows Program Compatibility Assistant May Be Invoked After Successfully Running NCIMAN.EXE on Windows 7, 8, 10 or Windows Server 2012
After running the Client Installation Manager (NCIMAN.EXE) application on Windows 7, 8, 10, or Windows Server 2012, Windows may prompt with the Program Compatibility Assistant as though NCIMAN.EXE was an installation program that may not have completed successfully.
NCIMAN.EXE is not actually a program that attempts to install or uninstall any part of Client for Open Enterprise Server software, and is just a tool for creating and editing Client Property Files (NCPF), such as an UNATTEND.TXT file.
This warning can be ignored by simply selecting the link offered by the Windows Program Compatibility Assistant.
6.28 TSClientAutoAdminLogon May Not Use The Profile Specified In DefaultLoginProfile
As part of establishing a TSClientAutoAdminLogon policy, it is required to create a DefaultLoginProfile value to specify which Client login profile should be used for the eDirectory portion of the login.
For Windows Server configurations where only a single Client login profile exists anyway (for example, Default), there is no issue and the single profile will be successfully used. But it has been observed that when more than one login profile is defined, it is possible for the TSClientAutoAdminLogon attempt to use the last-used Client login profile for a user instead of the login profile explicitly specified in the DefaultLoginProfile configuration.
This represents an unintentional behavior, and is being examined for future versions of the Client for Open Enterprise Server. The workaround if this issue is encountered is to define and use just a single Client login profile, at least on Windows Server machines on which Terminal Services and TSClientAutoAdminLogon are expected to be used.
6.29 Login From Windows Welcome Screen May Not Use Windows Username From Client Login Profile
In cases where the Client credential provider used by the Windows welcome screen login is switched between Computer Only Logon
mode and Network Logon
mode prior to performing a Network Logon login attempt, the Windows account name used during the login attempt might be whatever Windows account name was specified in the field while the credential provider was in Computer Only Logon mode, instead of the correct Windows account name saved and retrieved from the tab of the effective Client login profile.
This represents an unintentional behavior, and is being examined for future versions of the Client. The workaround is to avoid the switch between Computer Only Logon mode and Network Logon mode when possible. And when the issue does occur, provide the correct Windows account credentials in the Windows logon fields that appear after the attempt to use the incorrect Windows account name.
6.30 Failures Installing, Uninstalling, and Using the Client for Open Enterprise Server if iPrint is Installed Before the Client
The Novell iPrint 5.32 and iPrint 5.30 clients contain an issue in which incorrect security is established on the [HKEY_LOCAL_MACHINE\Software\Novell] registry key, if and when the Novell iPrint client was the first installed software that needed to create this registry key. This registry security issue is addressed in the Novell iPrint 5.35 client and later.
If the Novell iPrint 5.32 or iPrint 5.30 client is installed prior to the Client for Open Enterprise Server, the security that is established on the [HKEY_LOCAL_MACHINE\Software\Novell] registry key causes incorrect security to be propagated to the Client's own registry sub-keys. In addition, the incorrect registry security can cause the Novell NMAS Challenge Response Method installation to fail with Error 1603, due to incorrect registry security which was propagated to the Novell NMAS Client's registry sub-keys.
The Novell Client 2 SP1 (IR1) contained some mitigation for this issue that could clean-up the incorrect registry security established by Novell iPrint and proceed with a successful Client installation if the Client for Open Enterprise Server or earlier Client installation had not already been attempted and failed after installing the Novell iPrint client. If a failed Client installation had already been attempted after installing the Novell iPrint client first, the Novell Client 2 SP1 (IR1) installation will still fail due to the improper registry security which has already been established.
The Novell Client 2 SP1 (IR2) contains further mitigation which will actually clean up the registry security issue created by the Novell iPrint client, and furthermore will clean up the incorrect security which may have already been propagated to the Client registry sub-keys and the Novell NMAS Client sub-keys. So on a machine where the Novell iPrint 5.32 or iPrint 5.30 client was installed prior to the Client for Open Enterprise Server, but a Client installation has already subsequently failed, the primary corrective action to perform is to install Novell Client 2 SP1 (IR2) on top of the previously failed Client installation.
There is however one scenario under which even the Novell Client 2 SP1 (IR2) fix will be unable to detect and clean-up registry security problems which still exist due to the Novell iPrint client installation. This problem scenario occurs specifically when all of the following conditions are met:
-
Novell iPrint 5.32 or iPrint 5.32 was installed before the first Client installation.
-
Novell Client 2 SP1 or earlier was installed without NMAS, and with or without NICI.
-
Same machine was then upgraded to Novell Client 2 SP1 (IR1); installed with or without NMAS, and with or without NICI.
-
Same machine was then upgraded to Novell Client 2 SP1 (IR2); installed with or without NMAS, and with or without NICI.
In this specific sequence where the initial failed Client installation was performed after explicitly deselecting Novell NMAS from being installed with the Client, the subsequent mitigations for the Novell iPrint security issue performed by the Novell Client 2 SP1 (IR1) and Novell Client 2 SP1 (IR2) installations are unable to detect or correct that further clean-up of the Novell iPrint registry security permissions is still necessary.
The symptoms that occur when a machine is still in this broken state include a crash that occurs whenever the Client login dialog would have been presented. For example, when attempting to invoke the “Show Advanced Options” link on the Windows welcome screen, the Windows LogonUI.exe process can crash. When trying to invoke “OES Login” from the client tray menu in the Windows taskbar notification area (systray), the Client NWTRAY.EXE process can crash.
Unfortunately the incorrect permissions established on the registry by Novell iPrint client will also prevent successful un-installation from being performed after the machine is already in this state. This remaining scenario where the Novell iPrint registry permissions are not successfully cleaned up is being examined for additional mitigation in future versions of the Client.
6.31 eDirectory AutoAdminLogon Requires Windows AutoAdminLogon
Establishing an eDirectory AutoAdminLogon configuration requires that a Windows AutoAdminLogon configuration is also established. Meaning at minimum an automatic Windows account logon will occur if only a Windows AutoAdminLogon is configured; or both an eDirectory account logon and a Windows account logon will occur if both eDirectory AutoAdminLogon and Windows AutoAdminLogon are configured. Any workstation where only an eDirectory AutoAdminLogon is configured will now have the AutoAdminLogon configuration ignored, instead of experiencing undefined results.
For more information on configuring a Windows AutoAdminLogon policy or both an eDirectory AutoAdminLogon and Windows AutoAdminLogon policy, see Section Enabling AutoAdminLogon
of the Client for Open Enterprise Server Administration Guide.
6.32 Client for Open Enterprise Server 802.1x Authentication Not Supported with Microsoft Server 2008 R2-based RADIUS Server
The Client 802.1x Authentication integration does not succeed when Microsoft Server 2008 R2- based RADIUS service is being used for 802.1x authentication.
For more information, see TID 7007679 or bug 631640.
6.33 Issues in Novell Client 2 SP4 for Windows (IR1) When Windows 7 or 8.1 is Upgraded to Latest Windows 10
If you install the Novell Client 2 SP4 for Windows (IR1) on Windows 7 or 8.1 and then upgrade the Windows to latest Windows 10, the already installed Novell Client 2 SP4 for Windows (IR1) might not work properly. To avoid this issue, ensure that the Novell Client 2 SP4 for Windows (IR1) is newly installed on Windows 10.
This issue is being examined and will be fixed for future versions of the Client.
