Unable to Add NT Group, NT Groups Vanish

Unable to Add NT Group, NT Groups Vanish

If you are using the Windows NT/SAM User Authentication connector in either Titan FTP Server or Cornerstone MFT Server, you may experience an issue where the NT Groups begin to vanish from the Admin Console.


You may also experience an issue in the New Group Wizard where no Windows NT/SAM Groups appear, or you receive an error of "Item Not Found".


The reason for this is related to a recent Microsoft Windows Security Update which was released by Microsoft as part of the weekly patch rollout for Windows in July of 2019. In order for Microsoft to fix a known security vulnerability, they made a change to the way 3rd party software accesses Windows NT AD systems.


The 2019, build 3538 release of Titan and Cornerstone have a workaround for this issue, follow this procedure to address the issue.


FOR TITAN CUSTOMERS:
You'll want to make sure you have the latest build of Titan installed, Titan v2019 build 3538 or later, and then follow these instructions to apply the workaround until MS fixes the problem.

1. Run RegEdit and go to HKLM\Software\South River Technologies\South River Technologies\Titan FTP Server\Servers\

2. under there will be an entry with the server ID, probably 2 (or 3, or there will be multiple serverIDs)

3. Under each ServerId, add a new String value named 'AuthNoNetQuery' and set the value to '1'

4. Close RegEdit and restart the OS

Once the OS has restarted, go back in to the Admin console under groups -> Add new group and see if the groups are listed.


FOR CORNERSTONE CUSTOMERS:


You'll want to make sure you have the latest build of Cornerstone installed, Cornerstone v2019 build 3538 or later, and then follow these instructions to apply the workaround until MS fixes the problem.

1. Run RegEdit and go to HKLM\Software\South River Technologies\South River Technologies\Titan FTP Server\Servers\

2. under there will be an entry with the server ID, probably 2 (or 3, or there will be multiple serverIDs)

3. Under each ServerId, Check the name of the DSN used to connect to the database.

4. Close RegEdit


5. Run the "DATA SOURCES" applet in Windows and look for the Data source being used by Cornerstone. Specifically you want to find the name of the Sql Server and Database.


6. Using SSMS, connect to the Sql Server and open the database. Find the sr_serverparams table and Edit All Rows.


7. Insert a new row at the end for the specified ServerId, the rowtag will be "AuthNoNetQuery" and the rowval will be "1" 


8. Close SSMS and restart the OS.


Once the OS has restarted, go back in to the Admin console under groups -> Add new group and see if the groups are listed.




    • Related Articles

    • NT Authentication - Why Group-Level Admining Preferred

      The preferred way to manage Cornerstone with NT authentication is to add entire groups, rather than individual users. By managing at the group level, you will notice improved performance and it will be easier to configure and maintain your server. ...

    • NT Authentication - Group-Level Administration Preferred

      The preferred way to manage Titan/Cornerstone with NT authentication is to add entire groups, rather than individual users. By managing at the group level, fewer inquiries will be made into the database, from a lower level. You will notice improved ...

    • How To: Set Permission To Inherit From Group

      How To: Set permissions to inherit from Group Question How can I set permissions to inherit only in Group level and not by individual users? Reasoning It is better to manage many Users permissions if it is under group permission. Answer Follow the ...

    • Managing Cornerstone users and groups with custom C# .net API applications

      Question: Is it possible to manage Cornerstone/Titan from our own code? (C# .NET)? Is there an API so we can add groups to Cornerstone/Titan when using NT authentication ? Answer: Yes, you can use the srxCOM.DLL interface to interact with ...

    • Managing Cornerstone users and groups with custom C# .net API applications

      Question: Is it possible in any way to manage Cornerstone from our own code? (C# .NET) ? Is there an API so we can add groups to Cornerstone when using NT authentication ? Answer: Yes, you can use the srxCOM.DLL interface to interact with ...