10

---

NOTE:

In Windows NT Advanced Server 3.1, there was a physical limit of 255 simultaneous Macintosh connections that was due to the design of the Services for Macintosh. However, with NT Server 3.5, Microsoft removed that limit. In fact, Microsoft has actually done internal testing of NT Server 3.51 with 1,000 simultaneous Macintosh clients without a problem.

---

---

TIP:

Two other methods of configuring the Macintosh Services options are using the Server Manager and using the MACFILE command-line utility. Additionally, both of these methods enable you to configure Services for Macintosh on remote machines.

---

Configuring AppleTalk Routing On Windows NT Server

You can configure AppleTalk routing either during the Services for Macintosh installation process or at a later time. To configure the options at a later time, make sure you are logged on as a member of the Administrators group and start at step 1. If you want to configure AppleTalk routing during the Services for Macintosh installation process, start at step 4.

1. Open the Control Panel and double-click the Network icon.
2. Click the Services tab. The Services page should appear. It lists all the installed network services.
3. Find Services for Macintosh on the list and double-click it. This will open the Microsoft AppleTalk Protocol Properties window.
4. Click the Routing tab on the Microsoft AppleTalk Protocol Properties window. This will display the AppleTalk Routing page, as shown in Figure 10.13.

   Figure 10.13

   The options on the Routing page can be used to configure NT Server as an AppleTalk router.

5. By default, AppleTalk routing is disabled, so all other options on the page should be grayed out. To enable AppleTalk routing, check the box next to Enable Routing.
   Enabling AppleTalk routing does two things. First, it routes AppleTalk packets between any Ethernet, LocalTalk and Token Ring network interfaces on your computer. Second, it enables you to seed the AppleTalk network to create zones.
6. You can configure the seeding of AppleTalk networks individually for each network interface. If you have more than one network interface, choose the one you want to configure for AppleTalk seeding from the Adapter pull-down list.
7. Click the option Use this Router to Seed the Network. The Network Range field and the Zone list box should now be enabled (not grayed out).
8. Enter a valid AppleTalk zone range into the From and To fields. The AppleTalk zone range is used to identify different physical networks. If you are attached to a larger network, check with the person in charge of the AppleTalk protocol to obtain the correct ranges. For more information on AppleTalk zone ranges, see the section on Understanding AppleTalk earlier in this chapter. Acceptable values are between 1 and 65,279. It is also acceptable to use the same value in the From and To fields.
9. Use the Add button to add zone names for the specified network segment. The first zone you enter will become the default zone for the network segment. If you want to change the default zone, select it from the zone list box and click the Make Default button.
10. If there are other AppleTalk routers on this physical network, you can click the Get Zones button to import the zone list. If you do this, all zones you entered manually will be replaced. NT will ask you to confirm that you want to replace the zone list, as shown in Figure 10.14.

    Figure 10.14

    If you click the Get Zones button, NT asks you if you want to replace the zone list you entered manually with a list it acquires from existing AppleTalk routers.

    Figure 10.15 shows sample configuration information for AppleTalk routing.

    Figure 10.15

    These configuration settings indicate that the NT Server will act as an AppleTalk router and seed the local network segment with network values 10 through 12. Additionally, zones SALES and PROCUREMENT are on the local network segment.

11. When you are finished entering AppleTalk routing information, click the General tab at the top of the screen.
12. You can now use the Default Zone list to select the zone where you want your server to appear. When you are finished, click OK.
13. A window will appear notifying you that the AppleTalk protocol been successfully configured. Click OK. You will be returned to the Network Control Panel.
14. Click OK. Restart the computer to ensure the changes take effect.

When to Use AppleTalk Routing

If you're not intimately familiar with AppleTalk routing, it might be hard to determine when you need to use it and how best to configure it. There are two basic configurations where AppleTalk routing might be useful to you:

• When you are using your NT Server to connect two physically separate AppleTalk networks. In this sense, you are using AppleTalk routing in the traditional sense of routing.
• When you have an AppleTalk network and you want to logically divide the network into zones. This provides for easier browsing, and is not necessarily consistent with the traditional use of the word routing.

In both cases, you can use the NT Server as a seed router, depending on the existence of other AppleTalk routers on the network.

---

NOTE:

You need to have a seed router for each zone that you want to appear on a subnet.

---

Let's address these scenarios separately.

Routing AppleTalk Between Two Physically Separate Networks

Let's say that you are working on a large, private network, with 1,000 Macintosh clients spread around the network. You have five major zones: Sales, Procurement, Tech Support, Administration, and General. You have a new suite of 20-30 Macintosh computers served by an NT Server running Services for Macintosh that you need to connect into the existing network backbone.

Of course one option would be to connect the computers directly to the network backbone, as shown in Figure 10.16.

Figure 10.16

Connecting a series of Macintosh clients served by an NT Server directly to the network backbone.

In this case, the Macintosh clients in the group of computers we just added can communicate with the NT Server, as can any Macintosh clients on the rest of the network. Additionally, the newly added clients can become part of any of the zones available on the backbone.

As far as the NT Server goes, you don't need to enable AppleTalk routing because there is no need for actual routing, nor do you need to seed a new zone.

While this might seem nice and simple, there are two problems. First the minor one. You might not want the clients on the newly added network to be able to join any of the zones on the network. For instance, if the people in the newly added group of computers only need to be part of the Procurement and Sales zones, you might want to be able to restrict them to these zones. In this example, there are only five zones, so this might seem unnecessary. However, it is not uncommon for larger enterprises to have dozens and even hundreds of zones, where being able to restrict groups of computers to certain zones could be a necessity.

The second reason that the network architecture in Figure 10.17 is not adequate is that the users on the newly added computers will share all network bandwidth with the rest of the users on the network. This single-segment approach can have a negative impact on network performance.

To help alleviate both of these problems, you can use the NT Server as an AppleTalk router, as shown in Figure 10.17.

Figure 10.17

In this scenario, the NT Server is used as an AppleTalk router between the local subnet and the rest of the network.

To make this scenario work you need the following:

• a second network card for the NT Server
• a unique range of network numbers for the new subnet

Let's say you will use the network range 36-38, since it's not being used elsewhere on the network.

To configure NT properly for this scenario, you would use the following steps:

1. Open the Control Panel.
2. Double-click the Network icon.
3. Click the Services tab.
4. Double-click the Services for Macintosh.
5. Click the Routing tab. This is where the real work begins.
6. Click the Enable Routing check box.
7. From the Adapter pick-list, choose the network adapter that is connected to the new subnet.
8. Select the option Use this Router to Seed the Network.
9. Enter 36 in the From field, and 38 in the To field.
10. Click the Add button. The Add Zone window appears. Type Sales and click OK. Repeat this step to add the Procurement zone as well.

    ---

    NOTE:

    Make sure you enter the AppleTalk zone names exactly the same as they appear elsewhere on the network. Be especially careful to include exact spacing, punctuation and case.

    ---

    Because you entered the Sales zone first, it appears as the default zone. This means that all Macintosh clients will appear in this zone automatically, unless you manually configure them to use a different zone.

    Figure 10.18 shows the configuration options discussed in the preceding steps.

    Figure 10.18

    Services for Macintosh is now configured for AppleTalk routing.

11. Click the General tab at the top of the Microsoft AppleTalk Protocol Properties window.
12. From the Default Adapter pick-list, choose the adapter that is connected to the new subnet. This is the same adapter you chose in step 7.
13. From the Default Zone pick-list, choose the zone you want the NT Server to appear in. The only choices will be Sales and Procurement, because these are the zones you chose to seed on the new subnet.
14. Now choose OK a few times to get out of the Control Panel, and then restart the computer.

When the computer comes back up, it will be configured properly to support the routing scenario depicted in Figure 10.17.

Using AppleTalk Routing to Create Zones

The second common scenario is to use the AppleTalk routing capabilities to create AppleTalk zones on the network. My experience is that this is what the vast majority of people using NT Server's Services for Macintosh use AppleTalk routing for.

Remember, in the Microsoft world, there are workgroups and domains that provide logical grouping of computers. These logical groupings make locating a resource on the network easier.

In the Macintosh world, you can use an AppleTalk router to create zones, which are used to logically group machines and resources on the network. In a smaller network, full-fledged routing is often not necessary, but it is still often useful to create zones for organization of resources. Windows NT Server enables you to do this.

Let's use an example. Let's say that you have a small network that has 45 Macintosh computers and a couple of networked AppleTalk printers. You want to logically group our network into five zones: Development, Production, Advertising, General, and Printers.

You can use the AppleTalk routing capabilities of NT Server to do this. While it won't make your network any faster, it does help you to organize a little better.

To configure NT properly for this scenario, you would use the following steps:

1. Open the Control Panel.
2. Double-click the Network icon.
3. Click the Services tab.
4. Double-click the Services for Macintosh.
5. Click the Routing tab.
6. Click the Enable Routing check box. Although this example only includes one network card on the server, so there won't be any real routing, you still need to enable this feature.
7. Select the option Use this Router to Seed the Network.
8. Because this machine is the only AppleTalk router on the network, you can use whatever values you want to seed the network. For now, enter 10 in the From field, and 11 in the To field.
9. Click the Add button. The Add Zone window appears. Type Development and click OK. Repeat this step to add the Production, Advertising, General, and Printers zones as well.
   Because you entered the Development zone first, it appears as the default zone. This means that all Macintosh clients (and even printers) will appear in this zone by default.
   Figure 10.19 shows the configuration options discussed in the preceding steps.

   Figure 10.19

   These options will create five zones on the AppleTalk network.

10. Click the General tab at the top of the Microsoft AppleTalk Protocol Properties window.
11. From the Default Zone pick-list, choose the zone you want the NT Server to appear in. Because it will be used by everyone, put it in the General zone.
12. Now exit the Control Panel and restart the computer.

When the server comes back up, it will create the five zones specified earlier in the example. Now you'll be able to see the zones on your Macintosh clients, and you'll be able to move them into the appropriate zones.

Creating Macintosh-Accessible Volumes

In the AppleShare world, network volumes are the resources that are made available on an AFP file server for network users to connect to. They are logically the same as network shares, share points, or mount points in the Windows networking world. The process for creating a Macintosh-accessible volume with NT Server is similar to that of creating a standard network share that would be accessed by Windows networking clients.

---

NOTE:

There is one major difference between Macintosh volumes and standard Windows share, which you should be careful of. With Windows shares, you can create shares within shares. Let's take a look at an example. If you had a file structure that looked like the one shown in Figure 10.20, you could create a share-point for the Divisions folder. You could also create separate share-points for each of the folders in the Divisions folder, Accounting, Advertising, General, Procurement, and Sales. If a user attached to the Divisions share-point, he or she would be able to see the folders beneath that folder, given the correct permissions, of course. Likewise, if a user attached to the Accounting share-point, he our she could see the things below that level, but could not see anything else in the Divisions folder. This provides for a useful method of organization.

---

Figure 10.20

Sample Windows directory structure showing shares within shares.

---

NOTE:

However, with Services for Macintosh, you cannot create Macintosh-accessible volumes within other Macintosh-accessible volumes. This would preclude you from setting up an environment like the one described above. You could either create a volume for each division, or you could create a single volume that contained all the divisions, but not both.

---

There are four tools you can use to create Macintosh-accessible volumes in Windows NT:

• File Manager
• Server Manager
• MACFILE command-line utility
• Administrative Wizards

The easiest of these options is to use the Administrative Wizards, which we'll discuss in this section. We'll also look at using the File Manager for creating Macintosh volumes. The Server Manager interface for creating Macintosh volumes functions in almost the exact same manner as the File Manager interface. The syntax for using the MACFILE utility is listed at the end of this chapter.

---

NOTE:

Microsoft did not include a method for creating Macintosh shares from the NT Explorer interface.

---

---

NOTE:

NT Server automatically creates a Macintosh-accessible volume called Microsoft UAM Volume when you install Services for Macintosh. This volume is created on the first NTFS partition on your server.

---

Using the Administrative Wizards to Create a Macintosh-Accessible Volume

One of the new features of Windows NT Server 4.0 is the inclusion of a set of administrative wizards that simplify common administrative functions. There are eight basic administrative wizards, on of which is called Managing File and Folder Access. This wizard permits you to specify files and folders on the local server or on a remote server that should be shared to the clients—including Macintosh clients—on the network.

To use the Administrative Wizards to create a Macintosh-accessible network volume, follow these steps:

---

NOTE:

You must be logged on as a user with administrative privileges to create network shares.

---

1. From the Start menu, choose Programs, Administrative Tools, then Administrative Wizards. The Administrative Wizards main window is shown in Figure 10.21.

   Figure 10.21

   The Administrative Wizards permit you to perform a variety of common administrative tasks.

2. Click on Managing File and Folder Access. This will open the Share Management Wizard.
3. You will be asked if you want to provide network access to files and folders located on the local computer, or on a remote computer, as shown in Figure 10.22.

   Figure 10.22

   You can use the Share Management Wizard to create network shares on the local computer, or on a remote NT system.

4. By default, the share will be created on the local computer. Click the Next button to continue.
5. You will be given a list of all the local drives, as shown in Figure 10.23. Choose the drive the contains the files and folders you want to share. The drive will expand and you can see the files and folders contained on the drive. Locate the folder you want to share as a Macintosh volume, then click the Next button.

   Figure 10.23

   You need to specify which local drive contains the files and folders you want to make available to the network.

   ---

   TIP:

   If you know the exact path of the folder you want to share, you can enter it in the field at the bottom of this screen, rather than browsing for it.

   ---

6. You will now be shown the current directory permissions on the folder you specified, as shown in Figure 10.24. Set the permissions to what you want, then click the Next button to continue.

   Figure 10.24

   The Share Management Wizard permits you to specify the permissions on the folder you specified.

   ---

   CAUTION:

   The Share Management Wizard is not a very robust tool and is probably best used by beginners who are just beginning to learn about Windows NT. However, if you are a more advanced user and commonly change permissions on files witholding subfolders, and want a fine level of granularity when specifying permissions, you should not use the Share Management Wizard.

   ---

7. You will be asked if you want to share the folder with network users. Click Yes.
8. The Share Management Wizard will ask you for a name for the share, a comment, and what kind of clients you want to share the folder to, as shown in Figure 10.25.

   Figure 10.25

   You need to specify a name for the network share, as well as what kind of clients should be able to connect to it.

   ---

   NOTE:

   Each shared volume on an NT Server must have a unique name. If you enter a name that is the same as an existing share name, NT will advise you that the name is already in use and ask you to choose a new name for the share.

   ---

   ---

   NOTE:

   If the Macintosh Users option is grayed out—indicating that you cannot share the folder with Macintosh users—then you either selected a folder located on a FAT partition, or you don't have Services for Macintosh installed on your NT Server.

   ---

9. Click the check box for Macintosh users to access the share. If you don't want to make the share available to Windows clients, you should uncheck the button for Users of Microsoft Windows. Click the Next button.
10. The Share Management Wizard presents a summary page indicating the name of the share you created, its network path, and what clients it will be shared to. Click Finish.

The share should now be available for users on the network. You can change Macintosh permissions for the file using the File Manager, or the MACFILE command-line utility.

Using the File Manager to Create a Macintosh-Accessible Volume

To create a Macintosh-accessible volume using the File Manager, follow these procedures:

1. Open the File Manager.

   ---

   NOTE:

   The easiest way to get into the File Manger in NT 4.0 is to click the Start menu, choose Run and then type winfile and hit return.

   ---

2. Find and select the directory you want to share as a Macintosh volume, such as D:\USERS, as shown in Figure 10.26.

   Figure 10.26

   Select the directory you want to make accessible to Macintosh clients.

3. Choose Create Volume from the MacFile menu. The Create Macintosh-Accessible Volume window appears, as shown in Figure 10.27.

   Figure 10.27

   The Create Macintosh-Accessible Volume window enables you to specify options for the new volume.

   From here, you must specify the following:

   • Volume Name. This is the volume name the Macintosh clients will see. It must be 27 characters or less. You can create a maximum of 255 Macintosh volumes on a single server. By default, this is the name of the folder you are sharing.
   • Path. This is the path of the folder you want to share. It must be on a local volume, and it must be NTFS, or CDFS.

     ---

     NOTE:

     Services for Macintosh allows you to create Macintosh-accessible volumes on a CD-ROM.

     ---

   • Password/Confirm Password. You can specify a password here and any Macintosh will be required to enter this password when connecting to this share. This security is provided in addition to any additional folder- and volume-level permission you might have set.
   • This volume is read-only. If you check this box, the volume will be marked as read-only. Any Macintosh user who connects to the volume will be unable to make changes to the volume, regardless of what additional privileges they might have.
   • Guests can use this volume. If you select this option, Macintosh users will be able to connect to this volume as a guest. If guest access is disabled from the MacFile Control Panel, this option has no effect. NOTE:

     Guest access from Macintosh clients has nothing to do with the NT Guest account. For more information on Macintosh guest access, see the section Understanding Macintosh Guest Logons, earlier in this chapter.

   • User Limit. You can use this setting to limit the number of simultaneous Macintosh clients that can access this volume. NT Server has no built-in practical limitation as to the number of Macintosh clients it can serve. NOTE:

     The sum of the number of users of all the Macintosh-accessible volumes cannot exceed the Macintosh user limit in the MacFile Control Panel.

4. When you are finished entering the volume information into the Create Macintosh-Accessible Volume window, click the Permissions button to specify the access permissions for the volume. The Macintosh View of Directory Permissions window is shown in Figure 10.28.

   Figure 10.28

   You can use NT to specify the Macintosh permissions exactly as you would on a standard AppleShare server.

   From here you can specify the permissions for the Owner, Primary Group, and Everyone. Additionally, you can change the Owner and Primary Group.
   For more information on setting Macintosh permissions, see Working with Macintosh Permissions, earlier in this chapter.

   ---

   WARNING:

   :It is very important to realize that Services for Macintosh does not distinguish between share permissions and file folder permissions. Standard Windows NT shares have their own permissions, which are different from the permissions set on the files and directories contained within. However, the volume permissions for a Macintosh, are exactly the same as the folder where the volume begins. This means that if you change the permissions when you create a Macintosh volume, the NTFS permissions will directly and immediately reflect the change.

   ---

5. Click OK to close the security window.
6. Click OK again to create the share.

Macintosh users should now be able to access the share.

Viewing and Modifying Macintosh-Accessible Volumes

You can use the MacFile option in the File Manger to view and modify the settings for Macintosh-Accessible volumes.

Any changes you make to the volume, including setting or clearing the read-only flag, will take effect immediately. However, if you remove guest access for the volume by clearing the Guests Can Use this Volume option, it will not affect any users currently logged on as guests. This is because this option is only checked at logon.

Removing Macintosh-Accessible Volumes

You can remove Macintosh-Accessible volumes, by using the Remove Volumes option under the MacFile menu in the File Manager.

If there are any Macintosh users accessing the share, you will be warned that removing the share could result in the connected users loosing data, as shown in Figure 10.29.

Figure 10.29

You will be warned if you try to remove a Macintosh-accessible volume with active users.

You can wait until the users have logged out, or you can click Yes to proceed and remove the volume anyway.

The Microsoft User Authentication Module (MS UAM)

When a Macintosh client connects to an AppleShare file server, it uses a user authentication module (UAM) to handle the authentication of the user by exchanging user name and password with the server. Macintosh computers running System 7.x (or System 6.0.7 and above, running AppleShare 2.1 or greater) have a built-in Apple authentication module. When communicating with other Macintosh computers running System 7.x, or with Apple's AppleShare servers, this allows the user's password to be encrypted before being sent over the network.

However, because of the way Windows NT stores passwords, it cannot take advantage of the Apple encryption method, called Apple Random Number Exchange. This means that when a Macintosh client wants to connect to an NT Server running Services for Macintosh, it sends the password in plain text over the network. Passing the password in clear text over the network results in a situation where anyone on the network could see the password as it goes between the network client and the server, thus sacrificing the security of the user's account.

Additionally, Apple's built-in UAM only supports passwords of up to 8 characters, while NT Server supports passwords of up to 14 characters. If a user has a password longer than 8 characters, he or she will not be able to login to the NT Server from a Macintosh client using Apple's standard authentication module.

Thus, there are two occasions where you would want to install the Microsoft UAM:

• When you don't want user passwords to be sent in clear text over the network.
• When users have passwords longer than 8 characters.

Understanding the MS UAM

To help rectify the security problem, Microsoft created the Microsoft User Authentication Module (MS UAM). This module must be installed on each client that wants to use it. It interfaces with the Chooser, and provides for encrypted user verifications using Microsoft's Challenge Authentication Protocol (MS-CHAP). In addition, it supports up to 14-character passwords.

When you install Services for Macintosh on an NT Server, it automatically creates a directory called Microsoft UAM Volume on the first available NTFS partition. It then shares this directory as a read-only Macintosh volume and grants guest access. Macintosh clients can then connect to this share to obtain the MS UAM and install it on their system.

---

NOTE:

The reason the Microsoft UAM Volume is created with guest access enabled is so that Macintosh users do not need to sacrifice their passwords in order to obtain the UAM!

---

The MS UAM might seem like a great thing, and worthwhile to rush off and install it on all your systems. However, before you do this, let's take a look at the downside.

In the README.UAM file that is installed with Services for Macintosh, Microsoft writes, "Microsoft encourages you to install Microsoft Authentication (MS UAM) only if you need increased security on your Windows NT computer."

The reason for the caveat is that installing the Microsoft User Authentication Module adversely affects two major functions on Macintosh computers:

• The UAM cannot be used to connect to volumes at startup.
• The UAM cannot be used to connect to remote resources through aliases.

---

NOTE:

For those not well versed in Macintosh terminology, file aliases are very similar to Shortcuts in the Windows 95-style interface.

---

When Macintosh users connect to AppleShare file servers, they have the option of designating that certain shares should be reconnected automatically at startup, as shown in Figure 10.30.

Figure 10.30

Macintosh users can designate certain network volumes to be reconnected at startup.

This is similar to the persistent connections option on Windows systems.

However, because of problems internal to Apple's system software, the Macintosh cannot use alternative UAMs to reconnect at startup. This means that either one of a couple of things will happen, depending on the server's configuration:

• If the server is configured to allow users to connect without the MS UAM, the user will be able to logon to the server at startup using the standard Apple UAM. The problem is that this defeats the increased security of the MS UAM.
• If the server is configured to require MS UAM authentication, and the volumes the user is mounting permit Macintosh guest access, the Macintosh user will connect to the volumes as a guest.
• If the server is configured to require MS UAM authentication, and the volumes the user is mounting do not permit Macintosh guest access, the volumes will not be mounted.

The second problem with the MS UAM has to do with the way it interferes with reconnecting to file aliases located on network resources. Very often Macintosh users will create aliases to files or folders on remote file servers. If a user double-clicks an alias and is not currently connected to the file server where the file is located, the Macintosh tries to connect to the server. This is considered a great feature by many Macintosh network users. However, the problem is that the alias will always try to connect using the standard Apple UAM. The results are the same as listed previously when users automatically connect at startup.

However, there is one slight saving grace. Once the user is attached to a network volume, the aliases will work. This is because the user authentication process is only dealt with when you first connect to the resource. While this doesn't provide a solution for connecting to systems at startup, it does mean that your users can use the MS UAM to attach to a Macintosh-accessible volume on the NT Server, and then use their aliases.

This leaves the system administrator, you and me, in a very unenviable position. It means that we can either forfeit the security provided by the MS UAM, or you can cripple the functionality of your users' systems. The correct solution to this problem must be handled on a site-by-site basis. If you choose to require the MS UAM, I encourage you to not turn it into a PC versus Macintosh argument.

---

NOTE:

I want to make one thing clear. This problem is mostly because of defects in the Macintosh OS. All custom UAMs, including the NetWare UAM provided by Novell, have this same problem. Hopefully Apple will resolve this problem by adding full support for custom authentication modules sometime in the near future. As for the question of why can Macintosh clients use encrypted authentication with other Macintosh computers, including Apple's AppleShare servers, it is because Apple uses a different encryption method that requires the clear text password to be available at both ends. NT Servers do not store user passwords in a form that can be decrypted.

---

Installing the MS UAM on Macintosh Clients

Installing the Microsoft UAM on Macintosh clients is straightforward. If you are going to require users to use the MS UAM, you need to install it on all Macintosh clients.

---

NOTE:

Don't be too concerned about the size of the MS UAM. It's only about 30KB.

---

To install the MS UAM on a Macintosh client, use the following procedure:

1. From the Macintosh client, open the Chooser from under the Apple menu.
2. Click the AppleShare icon in the upper-left corner of the Chooser.
3. Select the zone where you installed the NT Server running Services for Macintosh. Find the NT Server in the list on the right and double-click it.
   If you have already configured the NT Server to require Microsoft authentication, you will only be able to logon as a guest. However, if you have also disabled Macintosh guest access, you will get an error, as shown in Figure 10.31.

   Figure 10.31

   If you require Microsoft authentication and have disabled guest access, you will get an error.

4. Select the option to logon as a Guest and click OK. The next screen appears, which lists all the Macintosh-accessible volumes on the NT Server, as shown in Figure 10.32.

   Figure 10.32

   You can copy the Microsoft UAM from the Microsoft UAM Volume, which is created on the NT Server when you install Services for Macintosh.

5. Double-click the Microsoft UAM Volume entry.

   ---

   NOTE:

   Be sure not to put a check mark in the box of the right side of the entry. If you check this box, the Microsoft UAM Volume will automatically appear on your desktop the next time you restart the Macintosh.

   ---

   If you have a logon message configured, it will appear now. Click OK to continue.
   The Microsoft UAM Volume should now appear on the desktop.

6. Close the Chooser.
7. Open the Microsoft UAM Volume. There should be a folder called AppleShare Folder inside, as shown in Figure 10.33.

   Figure 10.33

   The AppleShare Folder contains the MS UAM file needed to provide secure logons.

8. Drag-copy the AppleShare Folder into the System Folder on the Macintosh Client.

   ---

   CAUTION:

   By default, there is no folder called AppleShare Folder inside the System Folder. However, if you have other UAMs installed, such as the NetWare UAM, the AppleShare Folder will exist and you will receive an message asking if you want to replace the AppleShare Folder. Do not do this. Simply open the AppleShare Folder on the NT Server and copy the MS UAM file inside into the existing AppleShare Folder on the Macintosh client.

   ---

9. Reboot the Macintosh to take advantage of the MS UAM.

Using the MS UAM on Macintosh Clients

Using the Microsoft User Authentication Module on the Macintosh is just as easy as installing it. Here's an example of connecting to an NT Server using the MS UAM:

1. From the Chooser, locate an NT Server to log on to and double-click it.
2. If the NT Server does not require Microsoft authentication, you will be asked if you want to use Microsoft authentication or standard authentication. Choose Microsoft authentication. The Microsoft authentication window will appear.
   However, if the server is configured to require Microsoft authentication, you will not be given a choice, but rather the Microsoft authentication windows will appear automatically.
3. Enter your user name and password. If the user account comes from a trusted domain, enter the name of the trusted domain, a back-slash, and then the user name (procurement\jgarms, for example).
4. Click OK.
5. Select the volumes you want to mount. If you want to select more than one volume, use the shift when you select the additional volumes.
6. Click OK. Volumes will appear on the desktop.
7. Close the Chooser.

Printing to an AppleTalk Printer

After you install Services for Macintosh, you can create an NT printer that sends jobs to any printer on an AppleTalk network. This is quite a neat feature because even if you don't have Macintosh computers on your network, you might still have a printer that takes advantage of AppleTalk networking. If this is the case, you can use NT to allow Windows and DOS clients to print to this printer exactly as they would any other printer on an NT Server.

To create a printer on the NT Server that sends jobs to a printer device on an AppleTalk network, use the following procedure:

---

NOTE:

In order to print to a printer on using AppleTalk, you must have Services for Macintosh installed. See the section Installing and Configuring Services for Macintosh earlier in this chapter for more information.

---

1. Make sure you have Services for Macintosh installed and are logged on as a member of the Administrators group.
2. From the Start menu, choose Settings, and then Printers. This will open the Printers windows, which shows all currently created NT printers.
3. Double-click the Add Printer icon to start to the Add Printer Wizard. The Add Printer Wizard is shown in Figure 10.34.

   Figure 10.34

   The Add Printer Wizard is used to create or connect to an NT printer.

4. Choose the option for My Computer and click the Next button to continue.

   ---

   NOTE:

   It might not seem obvious to choose the My Computer option, because you are in fact connecting to a computer on the network, so let's take a quick look at this. You can choose the Network Print Server option only when the printer has been created on another NT or Windows for Workgroups system, or on a Novell system if you have the Client or Gateway Services for Novell installed. For stand-alone network printers that you print to using AppleTalk, DLC, or TCP/IP, you must create the printer on your system. This is why you choose the My Computer option.

   ---

5. You now need to specify the port you want to add to. By default, you should see a number of LPT ports and COM ports listed. Click on the Add Port button to specify the location of the AppleTalk printer. This will bring up the Printer Ports window.
6. Choose AppleTalk Printing Devices from the list of available print monitors, as shown in Figure 10.35. Click OK.

   Figure 10.35

   Choose the AppleTalk Printing Devices option.

   ---

   NOTE:

   If the AppleTalk Printing Devices option does not appear in the list of available print monitors, then you have not installed Services for Macintosh. See the section Installing and Configuring Services for Macintosh earlier in this chapter for more information on installing Services for Macintosh.

   ---

7. The Available AppleTalk Printing Devices window will appear, as shown in Figure 10.36. This window is similar to the standard Windows network browser and is used to locate the AppleTalk printer on network.

   Figure 10.36

   The Available AppleTalk Printing Devices window is used for browsing the network to locate an AppleTalk printer.

8. Double-click on the zone where the AppleTalk Printer you want to connect to is located. This will search for and display all available AppleTalk printers in the zone, as shown in Figure 10.37.

   Figure 10.37

   When you expand the AppleTalk zone, all AppleTalk printers in the zone will be displayed.

9. From the list, choose the printer you want to connect to and click OK.

   ---

   NOTE:

   An AppleTalk name must be unique in its zone. However, you can have the same name used in multiple zones without problems, since AppleTalk resources are identified and located by both their name, and their zone.

   ---

   ---

   NOTE:

   You cannot use NT to change the actual name of an AppleTalk printer. If the printer is an Apple printer, you can use the LaserWriter Utility program that came with the printer to rename it.

   ---

10. A window will appear asking if you want to capture the AppleTalk printer, as shown in Figure 10.38. If you capture the printer, no one will be able to print directly to the printer. Rather, they will be forced to print through the NT print spooler. If you don't capture the printer, people can bypass the NT printer spooler and print directly to the printer.

    Figure 10.38

    You can capture an AppleTalk print device, which prevents people from printing directly to it.

    ---

    TIP:

    For security reasons, you should capture the AppleTalk printers. The first security issue is that people if you permit people to print directly to the printer, you have no method of auditing and tracking printer usage. The second, more critical problem is that if you don't capture the printer, someone else could capture the printer and deny everyone else access to it. Even in a smaller network where this might be easy to troubleshoot, this denial of service could result in lost productivity and angry users.

    ---

11. Click Close to close the Printer Ports window. The port identifier for the printer you just specified should appear in the list of available ports, as shown in Figure 10.39.

    Figure 10.39

    The AppleTalk printer you specified will appear in the list of available ports.

12. Make sure there is a check mark in the box next to the port, and click the Next button.
13. Choose the correct make and model for the printer. For example, an HP LaserJet 4Si, as shown in Figure 10.40.

    Figure 10.40

    You must specify the make and model of the printer.

    ---

    NOTE:

    It is important that you choose the correct make and model for the printer so that NT knows exactly what features the printer includes and how to work with it. Choosing the wrong printer can often cause unpredictable results.

    ---

14. Give the printer a name, as shown in Figure 10.41. You also need to tell NT whether or not you want to make this your default printer. Since this is a server, if you already have other printers created, you probably want to select No.

    Figure 10.41

    Give the printer a name and specify if you want it to be the default printer when printing jobs from the server console.

15. Click the Next button to continue. This will take you to the screen where you specify that you want the printer to be shared to the network.
16. Click the Shared button, as shown in Figure 10.42. Specify the name you want the printer shared as. If you have MS-DOS or Windows 3.x clients, you should make the share name 8 characters or shorter. If you will have Windows 95 or NT clients that need to print to the printer, you should specify the appropriate printer drivers to be installed.

    Figure 10.42

    Give the printer a share name and choose the additional operating system drivers to install on the server.

17. Click the Next button. This will take you to a screen where you are prompted to print a test page. Click Yes to print a test page and click the Finish button.
18. You will be prompted for the NT Server distribution media. Enter the full path, or click the browse button to locate the necessary files.
19. As the final step, NT will display the Properties page for the newly created printer, as shown in Figure 10.43.

    Figure 10.43

    The Printer Properties page is used to change various settings once the printer has been created.

    You should take the opportunity to enter any comments about the printer, as well as the location. If you want to change scheduling, sharing, security, or device settings you can do it now, or later as necessary. For more information on these options, refer to chapter 8, Configuring and Installing Print Services.
    Click OK when you are finished configuring the printer.

The printer you just created and shared on the network is capable of receiving print jobs from any Windows NT client. This means that standard Windows clients, other NT clients, Macintosh clients, Novell clients (with File and Print Services for NetWare) and UNIX clients (using LPD and TCP/IP) can all print to this printer through the NT Server. The strength in this feature is that the clients don't need to have AppleTalk installed; only the server must have AppleTalk installed.

Printing from Macintosh Clients to an NT Server

One of the truly remarkable aspects of NT Server is how seamlessly the Services for Macintosh are integrated with the rest of the system. Perhaps this is seen best in how easy it is for Macintosh Clients to print to printers through an NT Server.

When you install Services for Macintosh, NT automatically makes all printers on the NT system available to Macintosh clients. This means there is nothing that needs to be done for your Macintosh users to begin printing. All printers created on the NT Server will appear in the same zone as the NT Server.

---

NOTE:

It is extremely important when you create printers on NT Server that you choose the correct printer type. NT knows from the printer type exactly what features are supported by the printer. With Macintosh clients, it is important to know which printers have PostScript and which don't. For example with HP printers, all printers with an M in the model name have PostScript. The M is HP's standard designation that lets you know the printer is made to work with Macintosh computers. (It also means the printer has a built-in LocalTalk interface.) If you have an HP LaserJet 4M Plus, you should be certain to select this when configuring the printer. If you choose HP LaserJet 4 Plus instead, NT will think the printer does not support PostScript and will rasterize the PostScript and send the bitmapped image to the printer, resulting in reduced print quality.

---

From a Macintosh client, you use the Chooser to select a printer on an NT Server exactly the same way you would to any other AppleTalk network printer.

---

NOTE:

The PostScript interpreter built into Windows NT Server emulates an Apple LaserWriter Plus v38.0.

---

Administering Services for Macintosh

There are three major places you will need to go to for configuring Services for Macintosh:

• MacFile Control Panel. This applet enables you to get current statistics on the Services for Macintosh, including a list of the current users, what files are in use, and what volumes are shared. Also, you can use it to alerts to Macintosh users. It also enables you to configure the properties for Services for Macintosh, including the server's name on the AppleTalk network, a logon message for Macintosh clients, and the global policy for Macintosh guests.
• File Manager. The File Manager is used to create, view, modify and remove Macintosh-accessible volumes. It can also be used to set Macintosh folder-level permissions, and associate MS-DOS-style extensions with Macintosh creator and type information. From here, you can also access the online help for Services for Macintosh.
• Network Control Panel. From the Services page in the Network Control Panel, you can configure the AppleTalk routing and zone information for Service for Macintosh.

Additionally, there are two other places that enable you to manipulate the Services for Macintosh options:

• Server Manager. You can use the Server Manager to do everything that the MacFile Control Panel does. Additionally, you can use it to create, view, modify, and delete volumes. The big advantage for Server Manager is that it can be used to configure remote systems.
• MACFILE Command-Line Utility. The MACFILE command-line utility can do everything—except configure AppleTalk routing and send alerts to Macintosh users. It even works on remote systems.

Identifying Logged-On Macintosh Users

If you need to identify what Macintosh users are logged on, what volumes they are accessing, and what files they have open, you should use the MacFile Control Panel.

---

NOTE:

When Macintosh users connect through Services for Macintosh, they will not appear under the list of active users in the Server Control Panel. The Server Control Panel only lists users who connect using the standard Microsoft networking.

---

The MacFile Control Panel, shown in Figure 10.44, provides four different sets of information that enables you, as the system administrator, to find out who is access in what files through Services for Macintosh.

Figure 10.44

The MacFile Control Panel enables you to get information about what Macintosh users are connected to the NT Server.

This screen gives you a summary of connections provided by Service for Macintosh. Included are the number of connected users, the number of open files, and the number of file locks. File locks typically occur when files are opened with write access.

The other connection-related information that can be obtained from the MacFile Control Panel is as follows:

• Connection information by User. The Users button from the MacFile Control Panel enables you to get statistics about the users currently connected to Services for Macintosh, as shown in Figure 10.45.

  Figure 10.45

  You can find out to what volumes a particular user is connected.

  The top box includes a list of all the current Macintosh users, their computer name, how many files they have open, and how long they've been connected. When you click a user, the bottom window will show the volumes that user is connected, the number of open files the user has on that volume, and how long the user has been connected to that file.
  While you have a user selected in the top window, you can select the Disconnect button at the bottom of the screen. If the user has no open files, you will be asked if you want to disconnect the user. Click Yes if you really want to disconnect the selected user. This will disconnect the user from all Macintosh volumes.
  However, if the selected user has files open, NT will warn you that the user has open files and could loose data if you disconnect the user. It then asks you to confirm that you really want to disconnect the user. Click Yes to disconnect the user. This will disconnect the user from all Macintosh volumes.
  If you want to disconnect all users, you can use the Disconnect All button.

• Connection information by Volume. With the Volumes button, you can get information about which volumes are being accessed by which users, as shown in Figure 10.46.

  Figure 10.46

  You can find out what users are connected to a particular volume.

  The top window shows all the Macintosh-accessible volumes on the local server. It also includes the number of open files on each volume and the actual path where the share is located.

  ---

  TIP:

  If the path for a particular volume does not fit in the window, as with the Microsoft UAM Volume in the Figure 10.34, you can double-click the volume name and NT will display a window containing the full path to the volume.

  ---

  When you click a volume from the top window, the bottom window displays all the users attached to that volume, including how long the user has been connected and whether or not the share is in use. The definition of "in use" in this case refers to whether or not the user has file locks in that volume.
  If you click a user and click the Disconnect button, NT will ask you to confirm the request. If you click Yes, the user will be disconnected from the selected volume only. If you click the Disconnect All button, all users on that volume will be disconnected. This will have no effect on user connections to other volumes.

• Connection information by File. If you simply want a list of all the files that are being accessed by Macintosh clients, you can use the Files button. This gives you a list of all the in-use files, including the name of the user accessing the file, whether the file is opened for read or read/write access, the number of locks the user has on that file, and the full path to that file on the local server. This information is shown in Figure 10.47.

  Figure 10.47

  You can find get a list of all files that are currently in use by Macintosh clients.

  ---

  NOTE:

  More often than not, you will not be able to read the full path of the files listed in this window. If you want to know the full path to a file, you can double-click the file name and NT will display a window containing its full path.

  ---

  You can use this screen to close a user's access to particular files. This can be done by clicking on a file fork you want to close and then clicking on the Close Fork button. NT will ask you to confirm this action. If you click Yes, the user will be disconnected from the particular file.
  However, if you click the Close All Forks button, all files open by Macintosh users on this server will be closed.

Sending Messages to Macintosh Clients

Windows NT's Services for Macintosh supports the capability to send alert messages to Macintosh users. This requires a Macintosh client running AppleShare 2.1 or above (built-in to System 7.x), and requires that the client be logged into the server. This differs from standard Microsoft clients, which aren't required to be logged into a server to receive alerts.

---

NOTE:

The NET SEND command and the Server Control Panel applet cannot be used to send messages to Macintosh users. So, if you have Services for Macintosh installed, be sure to send any important server alerts to your Macintosh clients as well.

---

Alerts can be sent from the MacFile Control Panel. From the MacFile Control Panel applet, simply choose the Users button. This brings up a window that displays all the currently connected Macintosh users, as shown in Figure 10.48.

Figure 10.48

You can send messages to Macintosh users from the Users button in the MacFile Control Panel.

Simply select the user you want to send a message to and click the Send Message button.

---

TIP:

If you want to send a message to more than one user, you can hold down the control key while selecting additional users.

---

This will bring up a window where you can enter the message, as shown in Figure 10.49.

Figure 10.49

You can send messages to the selected users or to all users.

From here, you can also choose to send the message to all the users on the Macintosh local computer. You can enter up to four lines of text. Once you have entered the message, click OK and it will be immediately sent to the selected users.

---

NOTE:

While the current AppleShare client for Macintosh supports sending messages from the server to connected clients, there is no provision for sending messages to clients who are not connected, or from client to server, or from client to client.

---

Mapping File Extensions to Macintosh Creator and Type Fields

As described earlier in this chapter, creator and type information is very important for Macintosh files. This information allows the Macintosh Finder to know what application to launch when a user double-clicks it. It is also used to filter what a user sees when he or she tries to open a file.

Windows NT comes with a set of default mappings, as well as an extensive list of common Macintosh creator and file types.

To view the current mappings, or to set and create new ones, you'll need to use the Associate option from the MacFile menu in the File Manager. The Associate window is shown in Figure 10.50.

Figure 10.50

The Associate window is used to set DOS extension to Macintosh creator and file type mappings.

The pick list at the top of the screen contains approximately 60 of the most common MS-DOS file extensions.

The scroll list at the bottom of the screen contains almost 70 common Macintosh creator and file types. For instance, you can scroll down and see the Microsoft Word 6.0 documents have creator MSWD and type W6BN. If you want to add new creator and file types, use the Add button. Likewise, you can select an existing entry and use the Delete button to remove it.

Let's take a look at how this works. From the list of MS-DOS extensions, choose BAT. You'll see that files with the BAT extension will be mapped to LMAN/DEXE and are LMAN Executables, as shown in Figure 10.51.

Figure 10.51

MS-DOS files with the BAT extension are mapped to Macintosh file type LMAN/DEXE.

Now if we wanted to change that, we could simply choose a different creator/type combination from the list and click the Associate button. For instance, if we wanted Macintosh users to be able to double-click MS-DOS batch files and open them in a text editor, we could select the LMAN/TEXT option from the top of the creator/type list and click the Associate button, as shown in Figure 10.52.

Figure 10.52

Now Macintosh clients will automatically open MS-DOS batch files with a text editor.

Now, from a Macintosh client, all files with the BAT extension will be recognized as text files and can be opened in any program the recognized text files.

So why is it important to establish these associations? Well, normally the Macintosh stores and maintains these all by itself. However, if the file originates on a PC, it does not contain the creator/type information. The Macintosh then does not know what to do with the file. For instance, let's say that you used the Windows version of Microsoft Word 6.0 to create a file and saved it to an NT Server. Now if you went to a Macintosh and used Microsoft Word to look for the file on the NT Server, if the file associations were not created properly, the document would not even show up in the open list on the Macintosh. This is because the Macintosh can't find a valid creator/type for the file. However, with file associations, as long as you named the file with a DOC extension, the Macintosh version of Word would recognize it because NT Server would provide the creator/type information to the Macintosh.

Administering Services for Macintosh from an NT Workstation

Although you can't set up NT Workstation as an AppleTalk file and print server, you can use an NT Workstation to administer NT Servers running Services for Macintosh. In order to do this, you need to install the AppleTalk protocol on the NT Workstation. In addition to enabling you to use Server Manager to manage Services for Macintosh on NT Servers, there are two other benefits for installing AppleTalk on an NT Workstation:

• You can use the NT Workstation to print directly to an AppleTalk printer
• You can use third-party products that take advantage of the WinSock-compatible AppleTalk stack to communicate with other devices on the AppleTalk network. Possible products could include client software that allows NT Workstations to access files from an AppleShare server.

To install the AppleTalk protocol stack and administer remote NT Servers running Services for Macintosh, follow these steps:

1. On the NT Workstation, make sure you are logged on as a member of the local Administrators group.
2. Install the Server Tools for Windows NT. These can be found on the NT Server CD-ROM, and include utilities such as Server Manager, User Manager for Domains, and others. For more information on installing these tools, see Chapter 9, Working with Clients.
3. Open the Control Panel and double-click the Network icon.
4. Click the Protocols tab. This takes you to the Protocols page, which lists all currently installed network protocols.
5. Click the Add button. This will present you with a list of all available network protocols.
6. Select AppleTalk Protocol, and click the OK button.
7. You might be asked to provide the location of the Windows NT Workstation installation files. If so, enter full path, such as f:\i386, where f: is the CD-ROM drive. Click the Continue button.
   NT Setup will copy files from the distribution media and make modifications to your system. This might take a few moments. When completed, it will return you to the Protocols page in the Network Control Panel window. You should see the AppleTalk Protocol in the list of installed protocols.
8. Click the Close button to continue. NT will review the network bindings information and start the AppleTalk protocol so you can configure it. The Microsoft AppleTalk Protocol Properties window will appear, as shown in Figure 10.53.

   Figure 10.53

   You must configure the AppleTalk zone where you want your NT Workstation to reside.

9. Choose the Default Adapter and Default Zone for you NT Workstation.
   Your network adapter should be listed in the Default Adapter list. If you have more than one network adapter, the default adapter should be listed. If you have any third-party utilities that allow your NT Workstation to take advantage of the AppleTalk protocol, this is the adapter they will be bound to.
   Additionally, if you have an AppleTalk router on the network, the default AppleTalk zone should appear in the Default Zone. For most uses, this is really pretty unimportant, because NT Workstations do not publish services by default. However, if you have any third-party utilities that enable your NT Workstation to publish services to the AppleTalk network, this is the zone where they will appear.
10. Click OK to continue. A message will appear telling you that the AppleTalk protocol has been configured.
11. Click OK. You will be prompted to restart you computer.
12. Click Yes to initiate a system restart.

When the system restarts, the AppleTalk protocol will be fully installed and you will be able to use the Server Manager utility to manage NT Servers running Services for Macintosh.

Additionally, you can use the Add Printer Wizard or the Print Manager to create a local printer that can be used to print directly to an AppleTalk printer on the network.

---

NOTE:

The MACFILE.EXE command-line utility will not be installed on the NT Workstation. If you want to use this utility to administer remote NT Servers running Services for Macintosh, you can copy the MACFILE.EXE executable from an NT Server with Services for Macintosh installed onto the NT Workstation.

---

Using the MACFILE Command-Line Utility

When you install Services for Macintosh, you also get a command-line utility called MACFILE.EXE. This utility performs four major functions. While three of these can be done from a graphical front-end, with the MacFile Control Panel applet, or with the Server Manager, the fourth function, FORKIZE, can only be done through the MACFILE utility. Additionally, it's nice to have a command-line tool for appropriate tasks, such as writing batch files.

---

NOTE:

Even if you're not interested in command-line utilities, look at the MACFILE FORKIZE. This command has no graphical equivalent, and deserves careful attention.

---

One of the additional benefits of the MACFILE command is that it enables you to configure remote NT Servers running Services for Macintosh.

The MACFILE utility is broken down into four basic commands:

• MACFILE VOLUME
• MACFILE DIRECTORY
• MACFILE SERVER
• MACFILE FORKIZE

MACFILE VOLUME

The MACFILE VOLUME command enables you to add, remove, or change network-accessible Macintosh volumes.

The syntax for the MACFILE VOLUME command is

macfile volume /add [/server:\\computername] /name:volumename /path:directory[/readonly:[true | false]] [/guestsallowed:[true | false]] [/password:password] [/maxusers:number | unlimited]

macfile volume /remove [/server:\\computername] /name:volumename

macfile volume /set [/server:\\computername] /name:volumename /path:directory [/readonly:[true | false]] [/guestsallowed:[true | false]] [/password:password] [/maxusers:number | unlimited]

Parameters

/add—Specifies that you want to add a Macintosh-accessible volume.

/remove—Specifies that you want to remove a Macintosh-accessible volume.

/set—Specifies that you want to change options on an already existing Macintosh-accessible volume.

/server:\\computername—Specifies the name of the NT Server running Services for Macintosh that you wish to administer. If this switch is omitted, changes will be made to the local computer.

/name:volumename—Specifies the name of the Macintosh-accessible volume you wish to create, remove, of modify. This can be between 1 and 27 characters and should be enclosed in quotation marks if it contains any spaces or special characters.

/path:directory—Specifies the path to the directory to be shared on the AppleTalk network. Only include this when creating a new share.

/readonly:[true | false]—If true, users cannot make changes to any files located on the volume, regardless of additional rights given to them on particular folders within the volume. If false, user access to particular files is determined on a folder-by-folder basis. If this switch is not included when creating a volume, changes to the volume will be permitted (readonly=false).

/guestsallowed:[true | false]—If set to true, Macintosh users can connect to the volume as a guest. If false, users will not be able to connect to the volume as a guest. When creating a new volume, the default is for guests to be able to logon (guestsallowed=true). NOTE:This is independent of the Windows NT Guest user account. For more information on this, see the Understanding Macintosh Guest Logons section from earlier in this chapter.

/password:password—Specifies that users need to enter a password when connecting to this volume. If you don't use this switch, all access control is based on their user account and users will not be required to type an additional password when logging on. Using this option along with /guestsallowed:true, enables you to effectively create a resource with share-level permissions, instead of user-level permissions.

/maxusers:number | unlimited—By using this switch, you can restrict the number of users that can connect to a particular share. If you don't specify this switch when creating a volume, there is no limit placed on the number of users who can connect.

MACFILE DIRECTORY

The MACFILE DIRECTORY command is used to set the owner, group, and permission information on a directory in a Macintosh-accessible volume.

The syntax for the MACFILE DIRECTORY command is

macfile directory [/server:\\computername] /path:directory [/owner:ownername] [/group:groupname] [/permissions:permissions]

Parameters

/server:\\computername—Specifies the name of the NT Server running Services for Macintosh that you wish to administer. If this switch is omitted, changes will be made to the local computer.

/path:directory—Specifies the path to the directory in a Macintosh-accessible volume where you want to modify permissions, owner, or group information. Remember, Macintosh file permissions are designated on a per-folder, not a per-file, basis.

/owner:ownername—Specifies the new owner of the folder. If you omit this switch, the ownership will not change.

/group:groupname—Specifies the new primary group for the folder. If you omit this switch, the primary group will not change.

/permissions:permissions—This switch indicated the permissions to be set on the specified folder. With this switch you can set standard Macintosh folder permissions, which include the ability to see file, see folders, and make changes. You can set each of these options for the owner, the primary group, and everyone (also called world). In addition, this switch can be used to designate that the folder cannot be renamed, moved, or deleted. You can specify that the changes should be applied to all subdirectories within the specified directory. This switch is used by specifying a 11-digit string of ones (1) and zeros (0). A one (1) is used to grant the permission, and a zero (0) is used to revoke the permission, following this pattern:

Position	Permission
1xxxxxxxxxx	Allows the Owner to see files
x1xxxxxxxxx	Allows the Owner to see folders
xx1xxxxxxxx	Allows the Owner to make changes
xxx1xxxxxxx	Allows the Primary Group to see files
xxxx1xxxxxx	Allows the Primary Group to see folders
xxxxx1xxxxx	Allows the Primary Group to make changes
xxxxxx1xxxx	Allows Everyone to see files
xxxxxxx1xxx	Allows Everyone to see folders
xxxxxxxx1xx	Allows Everyone to make changes
xxxxxxxxx1x	Specifies that the directory cannot be renamed, moved, or deleted
xxxxxxxxxx1	Specifies that changes should be applied to the current directory and to all subdirectories.

MACFILE SERVER

The MACFILE SERVER option enables you to change default server configurations, such as the server's name as it appears on the AppleTalk network, guest access permissions, and the maximum number of users.

macfile server [/server:\\computername] [/maxsessions:number | unlimited] [/loginmessage:message] [/guestsallowed:[true | false]]

Parameters

/server:\\computername—Specifies the name of the NT Server running Services for Macintosh that you wish to administer. If this switch is omitted, changes will be made to the local computer.

/maxsessions:number | unlimited—Specifies the maximum number of Macintosh users that can be simultaneously connected to the server.

/loginmessage:message—Specifies a message that will be sent to Macintosh clients when they connect to the NT Server. This is supported by all AppleShare 2.1 clients and greater (includes all System 7 clients). If left blank, no message is sent to clients when they connect.

/guestsallowed:[true | false]—Specifies whether or not Macintosh clients can connect as guests. If set to true, guests are able to connect to Macintosh-accessible volumes. However, you can restrict guest access to volumes on a volume-by-volume basis by using the MACFILE VOLUME command. Additionally, if this switch is set to false, all Macintosh guest access will be denied, regardless of the settings on individual volumes. By default, Macintosh computers can connect as guests.

---

NOTE:

This is independent of the Windows NT Guest user account. For more information on this, see the Understanding Macintosh Guest Logons section from earlier in this chapter.

MACFILE FORKIZE

The MACFILE FORKIZE can be used to join two separate files together into the a single Macintosh file with a data fork and a resource fork. Additionally, it can be used to set the file's creator and type information.

---

NOTE:

The true usefulness of this command is in its capability to set the file's creator and type information. While the capability to join to separate files together into a single Macintosh file is useful, most people will not need it.

---

macfile forkize [/server:\\computername] [/creator:creatorname] [/type:typename] [/datafork:filepath] [/resourcefork:filepath] /targetfile:filepath

Parameters

/server:\\computername—Specifies the name of the NT Server running Services for Macintosh that you wish to administer. If this switch is omitted, changes will be made to the local computer.

/creator:creatorname—This specifies the program that was used to create the file. When a Macintosh user double-clicks a file in the Finder, the creator information is used to determine what program to start. It can be up to four characters. Every company that writes software for the Macintosh is required to register their creator code with Apple to ensure its uniqueness.

/type:typename—This specifies exactly what the file is. This helps the program called by double-clicking the file to determine how to handle the file.

/datafork:filepath—Specifies the name of the file you want to use as the data fork.

/resourcefork:filepath—Specifies the name of the file you want to use as the resource fork.

/targetfile:filepath—If you are joining two files into a single Macintosh file, this specifies the name of the file you want to create by combining the resource and data forks. If you don't specify the /datafork and /resourcefork switches, this is the file whose information you are modifying. This file must reside on an NTFS volume on the server specified by the /server switch.

Shortcomings and Problems

If you read through this chapter and the rest of the guide, you will catch glimpses of where I point out the limitations of Services for Macintosh. I thought this was important enough for people to understand, however, so I created this section to bring them together in one place.

Some of these limitations are lack of features, and others are just things to be aware of. They are as follows:

• NT Server cannot read Macintosh CD-ROMs. Although you can create a Macintosh-accessible volume on a Windows CD-ROM, NT is completely unable to read Macintosh CD-ROMs. This is because most Windows CD-ROMs use the ISO 9660 format, whereas most Macintosh CD-ROMs use the High Sierra format.
• NT RAS does not support dial-in AppleTalk clients. The standard remote networking for Macintosh clients is AppleTalk Remote Access (ARA). This is not, however, supported at this time by NT Server. Macintosh clients can, though, dial into an NT Server using TCP/IP over PPP. This requires usually a third-party add-on such as MacPPP. When Macintosh clients dials in using this method, however, they cannot access the Macintosh volumes on the NT Server because this requires the AppleTalk protocol. Microsoft expects to have ARA support in NT Server soon.
• The Microsoft UAM is not fully integrated with the MacOS. If you use the Microsoft UAM, you cannot take full advantage of aliases in System 7.x. This can be an extreme inconvenience to Macintosh users. This is discussed at greater length earlier in this chapter.
• Services for Macintosh requires an NTFS partition. In order to install Services for Macintosh, you need an NTFS partition. This is because the installation process creates a Macintosh-accessible network volume that contains the Microsoft UAM. Due to the dual-fork nature of Macintosh files, they cannot be stored on a FAT or HPFS partition.
• AppleTalk printers do not support user authentication. Under Windows NT, you can restrict access to printers based on a person's user account. However, the AppleTalk Printer Access Protocol (PAP) does not provide authenticated information on the user who submitted the print job. Additionally, by default Macintosh clients can print to any printer created on the NT Server. With Macintosh clients, all print jobs are submitted using the built-in SYSTEM account. This means that you cannot control printer access for individual Macintosh users.
• Using NT as a PostScript interpreter is limited. One of the most amazing features about Windows NT is that it can enable clients to send PostScript jobs to any NT printer, even printers that don't understand PostScript. While this a great feature for Macintosh clients, because the standard laser printer driver is PostScript, there are limitations. Probably the most obvious is that when NT converts the PostScript code into a bit-mapped image that can be printed to any printer, it does so at 300 dpi. Until recently, this might not have been a real problem, but today with even the cheapest laser printers supporting 600 dpi, the difference is noticeable. If print output is of high concern, be sure to use a real PostScript printer.
• Macintosh guest access is unrelated to the Guest user account. Even if you have the NT Guest account disabled, Macintosh users can still access Macintosh-accessible volumes as guests. For more information on this, see the section Understanding Macintosh Guest Logons earlier in this chapter.
• Services for Macintosh allows for a breach in NT file security. Although by its very nature, NT is not supposed to allow you to assign ownership of files to other users, there is a way around this. If Services for Macintosh is installed, an NT user can use the Macintosh permissions to assign ownership of files to a different user, which is normally not permitted. For more information on this, see Chapter 25, "Advanced Security Guidelines."

Summary

This chapter discussed using Windows NT Server as a complete server solution for networks with Macintosh clients. We looked at the core Macintosh services provided by NT Server, including the ability to act as an AFP-compliant file server, as well as providing Macintosh print services, and native AppleTalk routing.

We looked at the structure of a Macintosh file and how it differs from a standard PC file. In addition, we looked at how NT Server provides on-the-fly translation of long file names for Macintosh clients. We continued by looking at the Macintosh AFP permission structure for restricting access to network resources, as well as the differences between a Macintosh guest user and a PC guest user.

The chapter continued with a step-by-step installation guide for Services for Macintosh, including a guide to setting up AppleTalk printing. We also took a look at how and when to set up AppleTalk routing by looking at two common network scenarios.

We also took a close look at the Microsoft User Authentication Module (MS UAM) and how it can be used to strengthen the security of your network. We also saw that the MS UAM has some pitfalls that prevent Macintosh users from performing certain functions.

Next we looked at tools that are used to administer the Services for Macintosh, such as the File Manager, the Administrative Wizard, the MacFile Control Panel applet, the Print Manager, and the MACFILE command-line utility. Included in this discussion was information on remotely administering Services for Macintosh from remote NT Server, as well as NT Workstations.

Finally, the chapter ended with a look at some of the limits of NT Server's Services for Macintosh. While NT provides a robust and powerful server platform for supporting Macintosh clients, it can't do everything and it is important to understand the limitations.