PC-Leland User Guide
About PC-Leland

Troubleshooting

Glossary

Troubleshooting PC-Leland

If you don’t find the information you need in this document, the PC-Leland web page contains additional information:

http:/ess.stanford.edu/pc/pcleland.html

Login Problems and Error Messages:

I can't login with my SUNet ID and password, or PC-Leland rejects my password.
PC-Leland login screen always uses the wrong name as the default.
How can I log in to a host machine using a different userID?
"Kerberos error 56: Retry count exceeded (send_to_kdc)"
"Can't send request (send_to_kdc)"
"Kerberos service has expired or your clock is not synchronized with the network. Please make sure your date, time and time zone settings are correct."
"An error occurred and you are partially logged in with only Kerberos 4 credentials. Limited access may be available to some services."
"Kerberos 5 password incorrect or your clock is not synchronized with the network. Please make sure your date, time and time zone settings are correct."
"Initialization of the dynamic link library C:\Program Files\Stanford\PC-Leland\krbcc32.dll failed. The process is terminating abnormally."
"Program failed to initialize properly", or "Unable to initialize leland.dll" or "Initialization of the dynamic link library C:\Program Files\Stanford\PC-Leland\leland.dll failed. The process is terminating abnormally."
"There was an error start the POP mailproxy for canonical server."

Miscellaneous Problems:

My email program has suddenly stopped retrieving new mail and I'm no longer logged in to PC-Leland.
My computer is behind a firewall that does Network Address Translation (NAT). Can I use PC-Leland?
Why can't I mount my home folder (or other AFS folders)

I can't login with my SUNet ID and password, or PC-Leland rejects my password.

You need to enter a valid SUNet ID (which you may think of as your Leland login ID) and password. Remember that both are case sensitive. Ensure that the Caps Lock key is off and that there are no leading or trailing blank spaces. For help with ID and password issues, contact the Sweet Hall consulting desk, phone 725-2101, or Stanford IT Help Desk, phone 725-HELP.

One possibility is that some part of the network connection between your PC and the PC-Leland Kerberos authentication servers has failed. Perhaps with the help of your local network administrator or cluster consultant, check that the network cables are properly connected, and that other users in your area are not being affected as well. For network consulting, contact 723-3909.

Another possibility is that PC-Leland's Time settings are not correct. For most users and most PCs, those settings should never be changed from their defaults. If Set Time from Network does not have a check mark indicating that the option is on, try clicking on the Set Time Now button to synchronize your kerberos tickets with other hosts on the network. (See the Settings section on Time in this document if you need to see what the default settings should be.)

It is also possible, though we expect unlikely, that the servers that handle PC-Leland validation could be unavailable. If you are fairly certain that this is the problem (for example, if others around you experience the same problem and no error messages help you make a better diagnosis), please phone Stanford IT Help Desk 725-HELP(4357) and report a problem with the campus Kerberos authentication servers.

PC-Leland login screen always uses the wrong name as the default.

PC-Leland is using your login name for Windows 95/98 instead of your SUNet ID.

You can change your Windows login name by restarting Windows and entering a new name (your SUNet ID) and password.

If you are the only user of this PC, you can remove the Windows login prompt.

Open the Start / Settings / Control Panel, and double-click on the Network icon.
From the list entitled "Primary Network Logon:", choose "Windows Logon", and click OK.

Note: If this doesn't work, make sure you didn't initially set a password for the Windows login. Once the password is set, Windows will always require it. As a workaround for this, double-click on the Passwords icon in Control Panel to choose nothing (leave it blank) for your password.

How can I log in to a host machine using a different userID?

This problem might arise when you have logged in to PC-Leland and then try to log into a host machine that is Kerberized, such as elaine-best. Since the host will use PC-Leland’s Kerberos tickets to log you in automatically, it won’t give you a chance to enter a userID yourself. But what do you do if you need to log in with a different userID, for example, because a friend needs to log in for a minute?

Define a saved session in Samson for Windows, specifying the userID you want to login as. This userID will be used by Samson for Windows when opening that saved session. If you are logged into PC-Leland, Samson for Windows will try to authenticate you as you log into the specified account.

If you yourself need to log in to the same host with a different userID, then you will need to logout from PC-Leland. Restart your Samson for Windows session to the host. When PC-Leland prompts you for your SUNet ID, press the Cancel button. the host computer will then continue with a normal session, prompting you for the userID and password you want to use on that host. The terminal session will not be Kerberized, however.

This situation might also come up when you want to use a kerberized host, but your userID on that host is different from your SUNet ID. In that case, the userID on that host must have a .klogin file that contains your SUNet ID. This allows Kerberos to log you in via your SUNet ID, even though your true userID on that host is different. Contact the system administrator of the host you want to use to see whether a .klogin file is required.

"Kerberos error 56: Retry count exceeded (send_to_kdc)"

This error message could be caused by a problem with your network connection. If you are off-campus and connecting through a third-party Internet Service Provider (ISP) or corporate network, this error message could also be caused by a firewall which secures their network.

If you're on-campus, contact your Local Network Administrator to troubleshoot network connection problems. If you are connecting from off-campus, contact the technical support staff for your ISP or corporate network. Also, you can try secure alternatives to PC-Leland: Detailed information is available at the SSH at Stanford web site (http://www.stanford.edu/services/ssh/).

"Can't send request (send_to_kdc)"

Most likely, this is a symptom of either non-existent or bad network connection.

If you are a modem user, you are probably not dialed in to the Stanford system. Dial in with your modem and try again. If this still doesn't work, make sure you have the correct DNS settings in your Network control panel.

If you are on-campus or using an Ethernet connection (a direct connection to the Internet), you should troubleshoot your networking. If you still have problems, contact your Local Network Administrator.

For detailed configuration instructions, see the Connecting to the Stanford Network web pages (http://ess.stanford.edu/pc/sunet.html).

"Kerberos service has expired or your clock is not synchronized with the network. Please make sure your date, time and time zone settings are correct."

This is usually caused by a significant difference (over 5 minutes) between the time settings on your computer and the Kerberos server.

To change the time on your computer to match the Kerberos server:

If you are a modem user, dial in to the campus modem pool before continuing below.
Start PC-Leland (if it isn't already in your task bar).
Right-click on the PC-Leland icon in the taskbar, and select Settings... from the menu.
Click on the Time tab.
Click on the Set Time Now button.
Note: If this doesn't work, make sure your computer is set to the correct time zone. Open your Date/Time control panel and click on the Time Zone tab to set it.

"An error occurred and you are partially logged in with only Kerberos 4 credentials. Limited access may be available to some services."

You can usually correct this problem by simply resetting your SUNet ID password. The problem is that not all users have correct entries in the Kerberos 5 database. Resetting your password updates your password in the database.

However, if you are running Windows 95, first check to make sure Winsock 2 is properly installed.

There are two ways to reset your password:

1) In PC-Leland, select Change Password from the PC-Leland popup menu (right-click on the PC-Leland icon in the taskbar), enter your current password and new password and click OK.

2) Go to the Stanford.You web page (http://stanfordyou.stanford.edu) and click on SUNet Services Settings. Then click on the word "Change" next to Password for SUNet ID and follow the instructions on the Change Password page.

"Kerberos 5 password incorrect or your clock is not synchronized with the network. Please make sure your date, time and time zone settings are correct."

You can usually correct this problem by resetting your SUNet ID password and making sure the time setting on your computer is correct.

To reset your password, select Change Password from the PC-Leland popup menu (right-click on the PC-Leland icon in the taskbar), enter your current password and new password and click OK. The problem is that not all users have correct entries in the Kerberos 5 database. Resetting your password updates your password in the database.

To change the time on your computer to match the Kerberos server:

If you are a modem user, dial in to the campus modem pool before continuing below.
Start PC-Leland (if it isn't already in your task bar).
Right-click on the PC-Leland icon in the taskbar, and select Settings... from the menu.
Click on the Time tab.
Click on the Set Time Now button.
Note: If this doesn't work, make sure your computer is set to the correct time zone. Open your Date/Time control panel and click on the Time Zone tab to set it.

"Initialization of the dynamic link library C:\Program Files\Stanford\PC-Leland\krbcc32.dll failed. The process is terminating abnormally."

Sometimes this is a harmless error that will not affect PC-Leland at all. To avoid receiving this error in the future, go to the Security section of PC-Leland Settings (right-click on the PC-Leland icon and select Settings...) and uncheck the "PC-Leland screen lock on screen saver" and "Logout on screen saver" options.

However, if it the error occurs the first time you restart your computer after installing PC-Leland 2.1, it may be a bug that can be fixed by changing the registry. It may also be caused by some missing Client for Microsoft Networks files. The solution in this case is to install Client for Microsoft Networks.

Contact the Computer Resource Center via the HelpSU web page (http://helpsu.stanford.edu) for assistance.

"Program failed to initialize properly", or "Unable to initialize leland.dll" or "Initialization of the dynamic link library C:\Program Files\Stanford\PC-Leland\leland.dll failed. The process is terminating abnormally."

This may be caused by a bug that can be fixed by changing the registry. It may also be caused by some missing Client for Microsoft Networks files. The solution in this case is to install Client for Microsoft Networks.

Contact the Computer Resource Center via the HelpSU web page (http://helpsu.stanford.edu) for assistance.

"There was an error starting the POP mailproxy for the canonical server."

If you are running Windows 95, check to make sure Winsock 2 is properly installed.

The problem could also be caused by a conflict with Norton Antivirus Email scanner. Email programs such as Outlook Express connect to the PC-Leland mail proxy on "localhost" and PC-Leland in turn connects to the actual mail server. The Norton Antivirus E-mail scanner was designed to do the exact same thing. Unfortunately the NAV scanner is not sufficiently configurable to be used in conjunction with PC-Leland.

First, check to make sure the Incoming Mail Server in the mail client is set to "localhost" and not to "pop3.norton.antivirus."

Then, disable "email protection" without disabling "auto-protect" in Norton Antivirus 2000. For NAV 2000, open Norton Antivirus and click Options, then click Email Protection, and uncheck all boxes in the Email clients list box. In NAV 2001, you may have to go one level deeper into the Advanced options for Email protection, and uncheck a checkbox labeled "enable manual configuration."

There are two versions of Norton AntiVirus available on the PC-Stanford web page that do not include Email Protection, but they do include the Autoprotect feature -- and that seems to be enough email protection for most users.

My email client has suddenly stopped retrieving new mail and I'm no longer logged in to PC-Leland.

Your PC-Leland login is set by default to expire (automatically logging you out) after 600 minutes (about 10 hours). When this happens, your email client will not be able to retrieve new mail until you quit the email program and restart it (you don't need to restart the computer, however).

My computer is behind a firewall that does Network Address Translation (NAT). Can I use PC-Leland?

Unfortunately Kerberos does not work well with NAT so your options are limited. Some services will work correctly with NAT while others will fail due to an IP address check. Ticket forwarding, for instance, will not work. Luckily, our Kerberized POP and IMAP daemons do not perform the IP address check and therefore work through NAT without any problems. PC-Leland 2.1 includes an option in the Kerberos section of Settings called "Do not include IP addresses in Kerberos 5 tickets" which will help, but only once we migrate more thoroughly to Kerberos 5.

Why can't I mount my home folder (or other AFS folders)?

If you are running Windows 2000 or XP, you should install Stanford OpenAFS for Windows, the AFS Client application, for access to AFS. Check the Essential Stanford Software web page (http://ess.stanford.edu/pc/openafs.html) for information about Stanford OpenAFS.