1

Situation: CNC machines are old and running something in the neighborhood of NT. There is a XP sp1 machine on the network that has mapped network drives to each CNC machine.

I went out to one of the CNC machines and they are logging into it with "user1" no password. I noticed the xp machine has a "user1" no password account. The xp machine has no problem getting to the shares without any username and password prompt.

Problem: They want me to map the CNC shares on a Vista machine. When I try to connect to the same IPs as the XP machine I'm met with a username and password prompt. I put in "user1" and no password and I get an error saying that the username and password are wrong.

Is there any way that I can tell what creds are being used to access the NT shares from the xp machine?

  • I was going to start ---> run and typing the \\192.168.0.1\ – needle_in_thestack May 15 '13 at 14:04
  • I even copied the unc path directly from the xp machine and tried that as well. \\192.168.0.1\c\user1\default – needle_in_thestack May 15 '13 at 14:05
  • oh, Yeah, I tried it with nameofpc\user1 and no password – needle_in_thestack May 15 '13 at 14:05
  • Check the share permissions/NTFS permissions on the CNCmachine itself and see what accounts are allowed. It could be using a different account. – TheCleaner May 15 '13 at 14:07
  • That is where we run into a problem. The way the machines were built we cannot get out of the CNC program without it logging us out of windows. I guess we could try alt-tabbing. The system was setup to run full screen and the exit button on the program logs out automagically. That is why I was wondering if we could see what creds the xp machine was using to access those shares. – needle_in_thestack May 15 '13 at 14:12
0

If those CNC machines are truly antique it could be they are still running NT 4 or worse,
That also means that they don't do password encryption, which is something Vista will insist on unless it is explicitly told to fall back to the very old insecure LANMAN mechanisms if needed.

You can find the settings for that in the Local Policy editor. Sorry, I don't have a Windows box around the tell you where exactly. I'm on a Mac today.

You will also need to figure out which credentials are really used by the XP box, but that is already mentioned in another answer I see.

Just curious: The harddrives in those antiques are bound to fail sooner or later. Not to mention the capacitors on the motherboard starting to leak.
What on earth are they going to do then ? Raid a museum to get replacement parts ?

  • The username/pass was the same as all the other pcs. See fix below: Change Local Security Policy on Vista: start--->run ----> secpol.msc Local Policy ---> Security Options Network Security: Lan Manager Authentication Level --change to: Send LM & NTLM -use NTLMv2 session security if negotiated – needle_in_thestack May 15 '13 at 21:04
  • Right now they are having people buy stuff off ebay or send it to someone to rebuild capacitors and circuits. – needle_in_thestack May 15 '13 at 21:15
0

Windows won't allow you to use blank passwords when it comes to network shares. If you give "user1" a password you'll have much greater success.

What particular version of Windows do you have? If it's Windows 2000, you can add a password to the account remotely (even if it's just "user1" or something):

net password \\ip.address user1

This should prompt you for the old/new password. I don't have an NT-ish machine to test this for sure, though.

  • the problem with this whole thing is not being able to use the OS on the CNC machines. Trying to figure out the auth creds on the XP machine would solve the problem. – needle_in_thestack May 15 '13 at 14:42
  • Right. Even if the OS is unavailable, you can still use another machine to execute commands remotely on the CNC machine. As far as I know, attempts are made as the currently logged in user in Vista/7 for mapped drives. – Nathan C May 15 '13 at 14:53
0

Since you want to determine this from your XP machine, do this.

  1. Open regedit on the XP machine
  2. Go to HKEY_CURRENT_USER\Network\ driveletter
  3. Look at the UserName string value
  4. If it is blank then it used the current logged on user to connect (whatever that account and password is)
  5. If it is another account, it will be listed there

That should get you the info you need to determine what account is used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.