JSI Tip 5949. How do I use the Kerberos setup tool to configure Windows 2000 clients to use an MIT Kerberos server instead of using a Windows 2000 domain for user authentication?

NOTE: The text in the following Microsoft Knowledge Base article is provided so that the site search can find this page. Please click the Knowledge Base link to insure that you are reading the most current information.

Microsoft Knowledge Base article Q324143 contains:

IN THIS TASK

SUMMARY

KSetup is a command-line tool that configures Windows 2000 clients to use an MIT Kerberos server instead of using a Windows 2000 domain for user authentication. This article describes how to use KSetup to configure a computer for Kerberos authentication.

back to the top

KSetup Syntax

KSetup is part of the Windows 2000 Resource Kit. The KSetup tool updates the Windows 2000 registry to force Windows to modify the settings for authentication so that the computer can talk to MIT Kerberos domain controllers. When you run KSetup on clients, it changes the way that information is looked up during authentication. Additionally, it adjusts how users are authenticated. You can use KSetup on servers to provide cross-realm trust relationships that allow single sign-on across UNIX and Windows-based computers.

The following text is the syntax of the KSetup tool:

The following list describes the parameters of this tool:

back to the top

Determine Current Settings

To determine the current settings, run the KSetup tool without any parameters.

back to the top

Set the Kerberos Domain

To set the Kerberos domain for the current computer, use the /domain parameter:

back to the top

Add or Remove a Kerberos Domain Controller

To add a Kerberos KDC, use /addkdc with the name of the domain that this KDC applies to and the address of the server for this domain. For example:

To remove, use the /delkdc parameter:

back to the top

Set the Local Computer Account Password

To set the password for the local computer account on the Kerberos server, use /setcomputerpassword. For example:

back to the top

Map a Kerberos User to a Local User

To map a Kerberos user to a local user account to turn on single sign-on across servers, use the /MapUser parameter:

You can also map users using wildcard characters (*). The special token AllUsers refers to all the users in a Kerberos domain and the wildcard character defines all the users in the local domain. For example, to map all users on a Kerberos KDC to the corresponding user on the local computer, run the following command:

NOTE: On a domain controller, this command maps users between the two authentication systems and allows both UNIX and Windows clients to log on to servers using the Kerberos authentication system.

back to the top