"Canet: error 86" "The specified network password is not correct" ERROR: OS Image share ....... is not available. or ERROR: No camenu-11 Boot Server share available !!!

Products

• CA Automation Suite for Data Centers - Configuration Automation
• CA Client Automation - Asset Management
• CA Client Automation - IT Client Manager
• CA Client Automation
• CA Client Automation - Remote Control
• CA Client Automation - Asset Intelligence
• CA Client Automation - Desktop Migration Manager
• CA Client Automation - Patch Manager

Issue/Introduction

• Deploying a media based OS Image fails with the following.
  • "Canet: error 86"
  • "The specified network password is not correct"
  • ERROR: OS Image share ....... is not available.
• Deploying an ImageX based OS Image fails with the following
  • "Canet: error 86"
  • "The specified network password is not correct"
  • ERROR: No camenu-11 Boot Server share available !!!

Cause

• Windows Network Security has been increased from the default value to require NTLMv2 authentication and refuse both LM and NTLM
• This can be defined in Policy (Group or Local)
  • Computer Configuration - Windows Settings - Security Settings - Local Policies - Security Option - Network security: LAN Manager authentication Level =
    • Send NTLMv2 response only/refuse LM & NTLM
• or in the registry
  • HKLM\SYSTEM\CurrentControlSet\Control\Lsa
    • LmCompatibilityLevel = 5

Microsoft article KB823659 section 10 describes the Network security: Lan Manager authentication level

• The templates provided are configured with LmCompatibility=1 this is compatible with all settings except for 5
• When the server has LmCompatibilityLevel=5 it will refuse all LM and NTLM requests 

Environment

OS Images of Windows 7 and aboveBoot server configured for Share Access

Resolution

Media Based OS Images

Edit the OSImage to support LmCompatibilityLevel = 5

• Edit the file .....\CA\DSM\Server\SDBS\var\managedpc\camenu\<imagename>.cmd
• Find the line
  rem ---- Add Lm compatibility reg key
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LmCompatibilityLevel /t REG_DWORD /d 1 /f
• Edit this line to support LmCompatibilityLevel=5
  rem ---- Add Lm compatibility reg key
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LmCompatibilityLevel /t REG_DWORD /d 5 /f
  

If you have remote Scalability Servers that act as boot servers then you need to create an update package. In order to do this we need to tell the update wizard that we have modified the <imagename>.cmd file

• Edit the file ....\CA\DSM\Server\SDBS\var\managedpc\images\<imagename>\osinfo.ini
• Find the [update] section and add the line
  • addfile1=camenu\<imagename>.cmd
• Run the update OS Image wizard selecting
  • Update the image registration in a domain only
    • Register the image package in the Software Package Library only
• When the wizard completes there will be an update package in the software delivery library that can be deployed to your Scalability servers to update the local copies of the OS Image.

ImageX Based OS Image

• Edit the Boot Image to support LmCompatibilityLevel = 5
  • Edit the file .....\CA\DSM\osimps\os-template\updates\<WinPE_version>\<i386 or amd64>\ca-osim\osimrun.cmd
  • Find the line
    REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LmCompatibilityLevel /t REG_DWORD /d 1 /f
  • Edit this line to support LmCompatibilityLevel=5
    REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LmCompatibilityLevel /t REG_DWORD /d 5 /f
• Run the Update Boot Image wizard selecting either
  • Update both the local image and the image registration in a domain
    • use this when you have remote Scalability servers that will need the updated Boot Image
  • Update the local image only
    • use this if your only boot server is the local DM
• When the wizard completes the Boot Image is updated and if selected you will have a software package to deploy the update to your Scalability servers
• Update the Scalability servers if required.