NFS: User Identity Logon

Microsoft.Windows.FileServer.NFS.Library.Server.UserLogon (UnitMonitor)

This object monitors user name mapping and credentials and generates an alert if a user cannot log on, if the alert is enabled for this monitor.

Knowledge Base article:

Summary

This object monitors user name mapping and credentials and generates an alert if a user cannot log on, if the alert is enabled for this monitor.

User Name Mapping associates Windows and UNIX user accounts so that users logged on to a UNIX domain can access shared resources in a Windows domain without logging on separately to the Windows domain.

Causes

This monitor can enter a Warning health state if there is a user logon problem or security policy issues.

Inspect the Windows System event log to determine the specific cause by looking for messages from Event source NfsServer with any of the following event IDs:

Event 1071 indicates that the Server for NFS was unable to obtain a logon token for the account used to process anonymous logons or for UNIX UIDs that do not have an explicit mapping. The event message details the account that led to the problem report.
Event 1072 indicates the Server for NFS was unable to obtain a logon token for the account used to access the NFS server when using an RPCSEC_GSS based identity. The event message details the account that led to the problem report.
Event 1073 indicates the Server for NFS was unable to refresh an access token. The event message details the account that led to the problem report.

If the health state is unknown, it means that monitoring has not yet begun for this object.

Resolutions

Configure Server for NFS to use an identity mapping source

To configure Server for NFS to use an identity mapping source, use the following procedure:

1. At an elevated command prompt on the affected server, type nfsadmin mapping to display and configure identity mapping settings.

2. Do one of the following:

To configure identity mapping settings for a User Name Mapping server, type nfsadmin mapping config maplookup=yes mapsvr=<computername>.
To configure identity mapping settings for an LDAP server, type nfsadmin mapping config adlookup=yes addomain=<domainname>.

Verification

To verify that Server for NFS is properly configured for User Name Mapping, use the following procedure:

1. At an elevated command prompt on the affected server, type nfsadmin mapping.

2. Verify that at least one of the following is configured:

User Name Mapping Service: User Name Mapping service is configured if the Mapping Server Lookup field is set to Enabled and the MappingServer field displays the computer name for your installed User Name Mapping service.
Active Directory Domain Services (AD DS)- based user name mapping: AD DS- based user name mapping is configured if the AD Lookup field is set to Enabled.

This monitor automatically resets to a Healthy state after Server for NFS is restarted.

Additional

Events IDs 1071 through 1073 (http://go.microsoft.com/fwlink/?LinkId=186008)

For information about managing user accounts, see Manage Users (http://go.microsoft.com/fwlink/?LinkId=185984) and Account Policies (http://go.microsoft.com/fwlink/?LinkId=185985).

For more information about configuring Server for NFS, see Services for Network File System (http://go.microsoft.com/fwlink/?LinkId=185983).

Element properties:

Target	Microsoft.Windows.FileServer.Service.NFS.Base
Parent Monitor	System.Health.AvailabilityState
Category	AvailabilityHealth
Enabled	True
Alert Generate	False
Alert Auto Resolve	True
Monitor Type	Microsoft.Windows.2SingleEventLog2StateMonitorType
Remotable	True
Accessibility	Public
RunAs	Default

Source Code:

<UnitMonitor ID="Microsoft.Windows.FileServer.NFS.Library.Server.UserLogon" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.FileServer.Service.NFS.Base" ParentMonitorID="SystemHealth!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">

  <Category>AvailabilityHealth</Category>

  <OperationalStates>

    <OperationalState ID="FirstEventRaised" MonitorTypeStateID="FirstEventRaised" HealthState="Warning"/>

    <OperationalState ID="SecondEventRaised" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>System</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">NfsServer</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1071</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1072</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1073</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>System</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">1000</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">NfsServer</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>