Connecting to a remote SMS Server

The quick and easy way to get this working is to install a small remote access product such as VNC to control your workstation at the office from home. Since you are connecting via a tunnel, you should have no problems connecting to your workstationat the office. You can install VNC to run as a service under either NT or Win2k, setup a password for access, then tunnel in and connect. Once you have made your VNC connection, simply start your SMS rmc and you'll be able to use your SMS server from home.
If you want more info on VNC, send me an email... btw VNC is free ;)

Surely somebody has done this before!

I couldn't post a comment since you rejected the answer :) Anyway, upon thinking about your problem further, I noticed you get the same error when you try to dconnect to the SMS server from a workstation on the LAN that also doesn't log into the domain. That would make sense since SMS relies on NT authentication to decide what a user can and cannot do from the mmc. Does your VPN allow you to authenticate on your domain? If so, try entering your domain credentials and trying to connect to the server. Since you will be fully logged into your domain, and will have the appropriate access token (by way of your domain ACL), SMS should recognize who you are and allow access to control it via mmc.
Give that a shot and see if it helps...

-B-

FYI (mainly for Bobby) -- using hybrid IKE based IPSec with a Check Point VPN-1 and RSA SecurID for authentication.

And, according to Microsoft Technet article Q201126, in order to administer a remote SMS server, you either need to be in a domain that has a trust relationship with the SMS domain, or "a user account with the same name and password must be created in the site server domain". The later is definately true.

I may be WAY off base here, but on most OS's "allow remote admin" features default to NO or OFF. This may be what you are running into. Also, are you logging access attempts? If so , maybe you already thought of this though, look at those logs, specifically where you tried to gain access and you may find something more verbose than "Connection failed". Hopefully something that will clue you in on what is actually going on with your current setup. Also check your DNS setings and make sure that the domain is at least getting host names from your other domain or workgroup. Sorry if some of this does not apply to NT as I an more into *nix'es myself, who knows maybe I helped :-)

Paul

I do not get the point - what exactly do You want to do? Use SMS Administrator console on home computer ( to manage SMS site ) or use remote tools to remote control some server ( workstation).
If first - check security on site server -
SMS uses not NT accounts SID's but account names ( as You type them).
If secont - try this little cmd file.
---------
@ECHO OFF
ping -n 1 %1 | find "Reply" && GOTO UP
ping -n 1 %1 | find "Request" && GOTO END
ping -n 1 %1 | find "Bad" && GOTO END
:UPfor /f "tokens=2 delims=[]" %%i in ('ping %1') do set machineip=%%i
start C:\smsadmin\bin\i386\remote.exe 2 %machineip% \\Yoursmssiteservername\
:END
-------------
It is faster to use that full console.( it assumes that sms console files are installed on c:\smsadmin folder).
SMS console also requires local admin privileges.

In order for the remote control tools to work, the client is verified to see whether it is within the Site Database. You must be able to see the database for this work.

Check the security permissions on the SQL database using the SMS Console. If you have set up a group that has access to the database then your user name will NOT allow you entry to the database as your access token will not contain the SID of the group.

Rather than using a group you must explicity add the user name (without the domain name) of the user that you wish to access the database, providing you keep your password synchronised on your workstation (which I assume is NT4/2000) and user account at work then this should work.

You must also check that the list of permitted viewers for the SMS Remote Tool Client Agent also contains your username.

HI ....

I had this problem with one of my users, recently. Thge way I solved it was under
to enable SDL, and SSO.
Secure Domain Logon and Single Sign On.

if you fill in these two, it logs you into the domain, as a specific user..
I actually use from hom eto administer my Exchnage Server, which like SMS requires a DOMAIN logon.
Under passwords, in the securemote client.. You will find both these, if you configure SSO to log you on as your domain user, when it is asked for these credentials it hands them over with ease...
It really works....
Good luck

if your stuck mail me
tony@pc-tony.com

Tony
MCSE MCP CCNA

While it is possible to get the client to work from another domain, you will have problems with a vpn. sms server opens back connections on the rpc port to the client and it is unlikely that your gateway will be able to forward these properly.

to get the client to work remotely, you should create a user account on the server itself and add that user into the sms security rights section. then pass through auth should work.