Security Compliance

How do I make ARM work with older domain where the NetBIOS name contains a dot?

This article explains how to configure ARM to correctly work with old pre-Windows 2000 domains.

First published date

5/14/2020 2:20 AM

Last published date

10/2/2023 7:08 AM

Overview

Pre-Windows 2000 domain allowed the creation of a NetBIOS name which contains a dot, for example arm.local as domain FQDN and arm.loc as NetBIOS name.
This is no longer possible.

Since this is a very rare case, ARM by default interprets these NetBIOS names as domain FQDN and won't work correctly.

Product section

Access Rights Manager

Resolution

To make ARM work correctly with a domain whose NetBIOS name contains a dot, please add the following entry to the pnServer.config.xml on the ARM server located at %ProgramData%\protected-networks.com\8MAN\cfg
<activeDirectory.FqdnToNetBios.<netbiosname>><domainname></activeDirectory.FqdnToNetBios.<netbiosname>>
<activeDirectory.NetBiosToFqdn.<domainname>><netbiosname></activeDirectory.NetBiosToFqdn.<domainname>>

Placeholders:
<domainname> = FQDN of the domain
<netbiosname> = NetBIOS name of the domain

Please make sure the pnServer.config.xml still ends with the </config> tag.
Afterward, restart the ARM service.

Example:

Domain FQDN: arm.local
NetBIOS name: arm.loc

The entry would look like this:
<activeDirectory.FqdnToNetBios.arm.loc>arm.local</activeDirectory.FqdnToNetBios.arm.loc>
<activeDirectory.NetBiosToFqdn.arm.local>arm.loc</activeDirectory.NetBiosToFqdn.arm.local>

Since the release of ARM 2023.2.0 a third switch is needed to make the login work properly. The example entries described above should look as shown below.
<activeDirectory.FqdnToNetBios.arm.loc>arm.local</activeDirectory.FqdnToNetBios.arm.loc>
<activeDirectory.NetBiosToFqdn.arm.local>arm.loc</activeDirectory.NetBiosToFqdn.arm.local>
<options.SupportPeriodInNetbiosName type="System.Boolean">true</options.SupportPeriodInNetbiosName>