Detailed Instructions for installing OpenAFS for Windows - Last edited 8/9/2010 **NOTE** Because of recent bug fixes and improvements to the OpenAFS client, we strongly urge anyone who had previously installed OpenAFS to upgrade to the newest version. Please read all instructions before upgrading. Overview

1) Download and install Kerberos for Windows 2) Configure Kerberos 3) Download and install OpenAFS 4) Use AFS

Basic Instructions All Users: You should always check for and install all Microsoft Windows Updates before installing new software. Please see Microsoft's instructions if you're unsure of how to update your operating system. http://support.microsoft.com/kb/311047 Also, some computers now come with “64 bit” versions of Windows. These systems require specific version of both Kerberos and OpenAFS. If you’re unsure whether your operating system is a 32 bit or 64 bit version, please see these instructions from Microsoft: http://windows.microsoft.com/en-US/windows-vista/32-bit-and-64-bit-Windows-frequently-asked-questions Upgrading AFS from an older version: If you have had AFS installed and working in the past, you should already have Kerberos for Windows installed, and the appropriate settings configured. In order to upgrade to the newest version of OpenAFS, you should only need to download and install the newest OpenAFS client from http://openafs.org/windows.html . Installing AFS for the first time: Download & Install Kerberos: For 32 bit Windows, download and install this file:

http://web.mit.edu/kerberos/dist/kfw/3.2/kfw-3.2.2/kfw-3-2-2.msi

For 64 bit Windows, download and install these files, in order:

1) http://www.secure-endpoints.com/binaries/mit-kfw-3-2-2/kfw-amd64-3-2-2.msi 2) http://www.secure-endpoints.com/binaries/mit-kfw-3-2-2/kfw-i386-3-2-2.msi

Double-click the “kfw-3-2-2.msi” file to run the installer…

Click “Next” to continue…

Accept the license agreement by clicking “Next”…

You may get a warning about removing a previous version. If so, click “Confirm”…

Click “Typical” for the setup type…

Finally, click “Install”…

Configure Kerberos: Click the Start menu…click Run…

Type %SYSTEMROOT%...then click OK…

In the window that opens, find the krb5.ini file and open it…

It should look something like this…

Under the [libdefaults] section, make sure the “default realm” line says…

default_realm = BERKELEY.EDU (Yes, BERKELEY.EDU must be in ALL CAPS).

Under the [domain_realm] section, make sure you have the following 2 lines…

.berkeley.edu = BERKELEY.EDU berkeley.edu = BERKELEY.EDU

Download OpenAFS: For 32-bit systems, click: http://openafs.org/pages/windows.html#1_5_32bit_downloads…and download the 32-bit MSI installer. For 64-bit systems, click: http://openafs.org/pages/windows.html#1_5_64bit_downloads…and download the 64-bit MSI installer. **Note, you should not need to install the 32-bit libraries separately, despite what the page may say. Install OpenAFS: Run the installer…click “Next” to continue…

Accept the license agreement by clicking “Next”…

You may be warned about removing an old version of OpenAFS…if so, simply click “Confirm” to continue…

Click “Typical” to select the setup type…

Type “berkeley.edu” (all lower-case) into the “Default Cell” field… You should disable “Integrated logon” if this is a laptop or home computer, or any computer that isn’t a member of the CAMPUS domain.

Uncheck the box next to “Start AFS Credentials at startup”…

Click “Install”…

Finally, click “Finish”…

When the installer is finished, you will be prompted to restart your computer. Make sure any work is saved, and then click “yes”…

Using AFS:

After logging in to Windows, click the “Network Identity Manager” icon in the system tray. It looks like this…

Click the yellow “Obtain new credentials” button

Enter your CalNet ID as the Username (i.e. jsmith) and make sure the Realm is BERKELEY.EDU (in all caps). Then enter your CalNet passphrase and click “Ok”…

You should now see a “Kerberos Ticket” of the form calnetid@BERKELEY.EDU...

If you also have a calnetid@CAMPUS.BERKELEY.EDU Kerberos Ticket, right-click the @BERKELEY.EDU ticket and set it as the default…

You should now be signed in to AFS.

To browse AFS, click the Start menu, click Run, and type “\\afs\berkeley.edu” and click “Ok”...

And remember, AFS is always connected, but that doesn't mean you're signed in. If you try to browse through the berkeley.edu folders on AFS but get denied, check the Network Identity Manager icon to make sure you have signed in. Please send questions and comments to jmacdonald@law.berkeley.edu