docs/htmldocs/samba-pdc.html

   1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
   2 <HTML
   3 ><HEAD
   4 ><TITLE
   5 >How to Configure Samba as a NT4 Primary Domain Controller</TITLE
   6 ><META
   7 NAME="GENERATOR"
   8 CONTENT="Modular DocBook HTML Stylesheet Version 1.77"><LINK
   9 REL="HOME"
  10 TITLE="SAMBA Project Documentation"
  11 HREF="samba-howto-collection.html"><LINK
  12 REL="UP"
  13 TITLE="Type of installation"
  14 HREF="type.html"><LINK
  15 REL="PREVIOUS"
  16 TITLE="User and Share security level (for servers not in a domain)"
  17 HREF="securitylevels.html"><LINK
  18 REL="NEXT"
  19 TITLE="How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain"
  20 HREF="samba-bdc.html"></HEAD
  21 ><BODY
  22 CLASS="CHAPTER"
  23 BGCOLOR="#FFFFFF"
  24 TEXT="#000000"
  25 LINK="#0000FF"
  26 VLINK="#840084"
  27 ALINK="#0000FF"
  28 ><DIV
  29 CLASS="NAVHEADER"
  30 ><TABLE
  31 SUMMARY="Header navigation table"
  32 WIDTH="100%"
  33 BORDER="0"
  34 CELLPADDING="0"
  35 CELLSPACING="0"
  36 ><TR
  37 ><TH
  38 COLSPAN="3"
  39 ALIGN="center"
  40 >SAMBA Project Documentation</TH
  41 ></TR
  42 ><TR
  43 ><TD
  44 WIDTH="10%"
  45 ALIGN="left"
  46 VALIGN="bottom"
  47 ><A
  48 HREF="securitylevels.html"
  49 ACCESSKEY="P"
  50 >Prev</A
  51 ></TD
  52 ><TD
  53 WIDTH="80%"
  54 ALIGN="center"
  55 VALIGN="bottom"
  56 ></TD
  57 ><TD
  58 WIDTH="10%"
  59 ALIGN="right"
  60 VALIGN="bottom"
  61 ><A
  62 HREF="samba-bdc.html"
  63 ACCESSKEY="N"
  64 >Next</A
  65 ></TD
  66 ></TR
  67 ></TABLE
  68 ><HR
  69 ALIGN="LEFT"
  70 WIDTH="100%"></DIV
  71 ><DIV
  72 CLASS="CHAPTER"
  73 ><H1
  74 ><A
  75 NAME="SAMBA-PDC"
  76 ></A
  77 >Chapter 7. How to Configure Samba as a NT4 Primary Domain Controller</H1
  78 ><DIV
  79 CLASS="SECT1"
  80 ><H1
  81 CLASS="SECT1"
  82 ><A
  83 NAME="AEN591"
  84 ></A
  85 >7.1. Prerequisite Reading</H1
  86 ><P
  87 >Before you continue reading in this chapter, please make sure
  88 that you are comfortable with configuring basic files services
  89 in smb.conf and how to enable and administer password
  90 encryption in Samba.  Theses two topics are covered in the
  91 <A
  92 HREF="smb.conf.5.html"
  93 TARGET="_top"
  94 ><TT
  95 CLASS="FILENAME"
  96 >smb.conf(5)</TT
  97 ></A
  98 >
  99 manpage and the <A
 100 HREF="ENCRYPTION.html"
 101 TARGET="_top"
 102 >Encryption chapter</A
 103 >
 104 of this HOWTO Collection.</P
 105 ></DIV
 106 ><DIV
 107 CLASS="SECT1"
 108 ><H1
 109 CLASS="SECT1"
 110 ><A
 111 NAME="AEN597"
 112 ></A
 113 >7.2. Background</H1
 114 ><DIV
 115 CLASS="NOTE"
 116 ><P
 117 ></P
 118 ><TABLE
 119 CLASS="NOTE"
 120 WIDTH="100%"
 121 BORDER="0"
 122 ><TR
 123 ><TD
 124 WIDTH="25"
 125 ALIGN="CENTER"
 126 VALIGN="TOP"
 127 ><IMG
 128 SRC="/docbook-dsssl/note.gif"
 129 HSPACE="5"
 130 ALT="Note"></TD
 131 ><TD
 132 ALIGN="LEFT"
 133 VALIGN="TOP"
 134 ><P
 135 ><SPAN
 136 CLASS="emphasis"
 137 ><I
 138 CLASS="EMPHASIS"
 139 >Author's Note:</I
 140 ></SPAN
 141 > This document is a combination
 142 of David Bannon's "Samba 2.2 PDC HOWTO" and "Samba NT Domain FAQ".
 143 Both documents are superseded by this one.</P
 144 ></TD
 145 ></TR
 146 ></TABLE
 147 ></DIV
 148 ><P
 149 >Versions of Samba prior to release 2.2 had marginal capabilities to act
 150 as a Windows NT 4.0 Primary Domain Controller
 151
 152 (PDC).  With Samba 2.2.0, we are proud to announce official support for
 153 Windows NT 4.0-style domain logons from Windows NT 4.0 and Windows
 154 2000 clients.  This article outlines the steps
 155 necessary for configuring Samba as a PDC.  It is necessary to have a
 156 working Samba server prior to implementing the PDC functionality.  If
 157 you have not followed the steps outlined in <A
 158 HREF="UNIX_INSTALL.html"
 159 TARGET="_top"
 160 > UNIX_INSTALL.html</A
 161 >, please make sure
 162 that your server is configured correctly before proceeding.  Another
 163 good resource in the <A
 164 HREF="smb.conf.5.html"
 165 TARGET="_top"
 166 >smb.conf(5) man
 167 page</A
 168 >. The following functionality should work in 2.2:</P
 169 ><P
 170 ></P
 171 ><UL
 172 ><LI
 173 ><P
 174 >       domain logons for Windows NT 4.0/2000 clients.
 175         </P
 176 ></LI
 177 ><LI
 178 ><P
 179 >       placing a Windows 9x client in user level security
 180         </P
 181 ></LI
 182 ><LI
 183 ><P
 184 >       retrieving a list of users and groups from a Samba PDC to
 185         Windows 9x/NT/2000 clients
 186         </P
 187 ></LI
 188 ><LI
 189 ><P
 190 >       roving (roaming) user profiles
 191         </P
 192 ></LI
 193 ><LI
 194 ><P
 195 >       Windows NT 4.0-style system policies
 196         </P
 197 ></LI
 198 ></UL
 199 ><P
 200 >The following pieces of functionality are not included in the 2.2 release:</P
 201 ><P
 202 ></P
 203 ><UL
 204 ><LI
 205 ><P
 206 >       Windows NT 4 domain trusts
 207         </P
 208 ></LI
 209 ><LI
 210 ><P
 211 >       SAM replication with Windows NT 4.0 Domain Controllers
 212         (i.e. a Samba PDC and a Windows NT BDC or vice versa)
 213         </P
 214 ></LI
 215 ><LI
 216 ><P
 217 >       Adding users via the User Manager for Domains
 218         </P
 219 ></LI
 220 ><LI
 221 ><P
 222 >       Acting as a Windows 2000 Domain Controller (i.e. Kerberos and
 223         Active Directory)
 224         </P
 225 ></LI
 226 ></UL
 227 ><P
 228 >Please note that Windows 9x clients are not true members of a domain
 229 for reasons outlined in this article.  Therefore the protocol for
 230 support Windows 9x-style domain logons is completely different
 231 from NT4 domain logons and has been officially supported for some
 232 time.</P
 233 ><P
 234 >Implementing a Samba PDC can basically be divided into 2 broad
 235 steps.</P
 236 ><P
 237 ></P
 238 ><OL
 239 TYPE="1"
 240 ><LI
 241 ><P
 242 >       Configuring the Samba PDC
 243         </P
 244 ></LI
 245 ><LI
 246 ><P
 247 >       Creating machine trust accounts and joining clients
 248         to the domain
 249         </P
 250 ></LI
 251 ></OL
 252 ><P
 253 >There are other minor details such as user profiles, system
 254 policies, etc...  However, these are not necessarily specific
 255 to a Samba PDC as much as they are related to Windows NT networking
 256 concepts.  They will be mentioned only briefly here.</P
 257 ></DIV
 258 ><DIV
 259 CLASS="SECT1"
 260 ><H1
 261 CLASS="SECT1"
 262 ><A
 263 NAME="AEN636"
 264 ></A
 265 >7.3. Configuring the Samba Domain Controller</H1
 266 ><P
 267 >The first step in creating a working Samba PDC is to
 268 understand the parameters necessary in smb.conf.  I will not
 269 attempt to re-explain the parameters here as they are more that
 270 adequately covered in <A
 271 HREF="smb.conf.5.html"
 272 TARGET="_top"
 273 > the smb.conf
 274 man page</A
 275 >.  For convenience, the parameters have been
 276 linked with the actual smb.conf description.</P
 277 ><P
 278 >Here is an example <TT
 279 CLASS="FILENAME"
 280 >smb.conf</TT
 281 > for acting as a PDC:</P
 282 ><P
 283 ><PRE
 284 CLASS="PROGRAMLISTING"
 285 >[global]
 286     ; Basic server settings
 287     <A
 288 HREF="smb.conf.5.html#NETBIOSNAME"
 289 TARGET="_top"
 290 >netbios name</A
 291 > = <TT
 292 CLASS="REPLACEABLE"
 293 ><I
 294 >POGO</I
 295 ></TT
 296 >
 297     <A
 298 HREF="smb.conf.5.html#WORKGROUP"
 299 TARGET="_top"
 300 >workgroup</A
 301 > = <TT
 302 CLASS="REPLACEABLE"
 303 ><I
 304 >NARNIA</I
 305 ></TT
 306 >
 307
 308     ; we should act as the domain and local master browser
 309     <A
 310 HREF="smb.conf.5.html#OSLEVEL"
 311 TARGET="_top"
 312 >os level</A
 313 > = 64
 314     <A
 315 HREF="smb.conf.5.html#PERFERREDMASTER"
 316 TARGET="_top"
 317 >preferred master</A
 318 > = yes
 319     <A
 320 HREF="smb.conf.5.html#DOMAINMASTER"
 321 TARGET="_top"
 322 >domain master</A
 323 > = yes
 324     <A
 325 HREF="smb.conf.5.html#LOCALMASTER"
 326 TARGET="_top"
 327 >local master</A
 328 > = yes
 329
 330     ; security settings (must user security = user)
 331     <A
 332 HREF="smb.conf.5.html#SECURITYEQUALSUSER"
 333 TARGET="_top"
 334 >security</A
 335 > = user
 336
 337     ; encrypted passwords are a requirement for a PDC
 338     <A
 339 HREF="smb.conf.5.html#ENCRYPTPASSWORDS"
 340 TARGET="_top"
 341 >encrypt passwords</A
 342 > = yes
 343
 344     ; support domain logons
 345     <A
 346 HREF="smb.conf.5.html#DOMAINLOGONS"
 347 TARGET="_top"
 348 >domain logons</A
 349 > = yes
 350
 351     ; where to store user profiles?
 352     <A
 353 HREF="smb.conf.5.html#LOGONPATH"
 354 TARGET="_top"
 355 >logon path</A
 356 > = \\%N\profiles\%u
 357
 358     ; where is a user's home directory and where should it
 359     ; be mounted at?
 360     <A
 361 HREF="smb.conf.5.html#LOGONDRIVE"
 362 TARGET="_top"
 363 >logon drive</A
 364 > = H:
 365     <A
 366 HREF="smb.conf.5.html#LOGONHOME"
 367 TARGET="_top"
 368 >logon home</A
 369 > = \\homeserver\%u
 370
 371     ; specify a generic logon script for all users
 372     ; this is a relative **DOS** path to the [netlogon] share
 373     <A
 374 HREF="smb.conf.5.html#LOGONSCRIPT"
 375 TARGET="_top"
 376 >logon script</A
 377 > = logon.cmd
 378
 379 ; necessary share for domain controller
 380 [netlogon]
 381     <A
 382 HREF="smb.conf.5.html#PATH"
 383 TARGET="_top"
 384 >path</A
 385 > = /usr/local/samba/lib/netlogon
 386     <A
 387 HREF="smb.conf.5.html#READONLY"
 388 TARGET="_top"
 389 >read only</A
 390 > = yes
 391     <A
 392 HREF="smb.conf.5.html#WRITELIST"
 393 TARGET="_top"
 394 >write list</A
 395 > = <TT
 396 CLASS="REPLACEABLE"
 397 ><I
 398 >ntadmin</I
 399 ></TT
 400 >
 401
 402 ; share for storing user profiles
 403 [profiles]
 404     <A
 405 HREF="smb.conf.5.html#PATH"
 406 TARGET="_top"
 407 >path</A
 408 > = /export/smb/ntprofile
 409     <A
 410 HREF="smb.conf.5.html#READONLY"
 411 TARGET="_top"
 412 >read only</A
 413 > = no
 414     <A
 415 HREF="smb.conf.5.html#CREATEMASK"
 416 TARGET="_top"
 417 >create mask</A
 418 > = 0600
 419     <A
 420 HREF="smb.conf.5.html#DIRECTORYMASK"
 421 TARGET="_top"
 422 >directory mask</A
 423 > = 0700</PRE
 424 ></P
 425 ><P
 426 >There are a couple of points to emphasize in the above configuration.</P
 427 ><P
 428 ></P
 429 ><UL
 430 ><LI
 431 ><P
 432 >       Encrypted passwords must be enabled.  For more details on how
 433         to do this, refer to <A
 434 HREF="ENCRYPTION.html"
 435 TARGET="_top"
 436 >ENCRYPTION.html</A
 437 >.
 438         </P
 439 ></LI
 440 ><LI
 441 ><P
 442 >       The server must support domain logons and a
 443         <TT
 444 CLASS="FILENAME"
 445 >[netlogon]</TT
 446 > share
 447         </P
 448 ></LI
 449 ><LI
 450 ><P
 451 >       The server must be the domain master browser in order for Windows
 452         client to locate the server as a DC.  Please refer to the various
 453         Network Browsing documentation included with this distribution for
 454         details.
 455         </P
 456 ></LI
 457 ></UL
 458 ><P
 459 >As Samba 2.2 does not offer a complete implementation of group mapping
 460 between Windows NT groups and Unix groups (this is really quite
 461 complicated to explain in a short space), you should refer to the
 462 <A
 463 HREF="smb.conf.5.html#DOMAINADMINGROUP"
 464 TARGET="_top"
 465 >domain admin
 466 group</A
 467 > smb.conf parameter for information of creating "Domain
 468 Admins" style accounts.</P
 469 ></DIV
 470 ><DIV
 471 CLASS="SECT1"
 472 ><H1
 473 CLASS="SECT1"
 474 ><A
 475 NAME="AEN679"
 476 ></A
 477 >7.4. Creating Machine Trust Accounts and Joining Clients to the
 478 Domain</H1
 479 ><P
 480 >A machine trust account is a Samba account that is used to
 481 authenticate a client machine (rather than a user) to the Samba
 482 server.  In Windows terminology, this is known as a "Computer
 483 Account."</P
 484 ><P
 485 >The password of a machine trust account acts as the shared secret for
 486 secure communication with the Domain Controller.  This is a security
 487 feature to prevent an unauthorized machine with the same NetBIOS name
 488 from joining the domain and gaining access to domain user/group
 489 accounts.  Windows NT and 2000 clients use machine trust accounts, but
 490 Windows 9x clients do not.  Hence, a Windows 9x client is never a true
 491 member of a domain because it does not possess a machine trust
 492 account, and thus has no shared secret with the domain controller.</P
 493 ><P
 494 >A Windows PDC stores each machine trust account in the Windows
 495 Registry.  A Samba PDC, however, stores each machine trust account
 496 in two parts, as follows:
 497
 498 <P
 499 ></P
 500 ><UL
 501 ><LI
 502 ><P
 503 >A Samba account, stored in the same location as user
 504     LanMan and NT password hashes (currently
 505     <TT
 506 CLASS="FILENAME"
 507 >smbpasswd</TT
 508 >). The Samba account
 509     possesses and uses only the NT password hash.</P
 510 ></LI
 511 ><LI
 512 ><P
 513 >A corresponding Unix account, typically stored in
 514     <TT
 515 CLASS="FILENAME"
 516 >/etc/passwd</TT
 517 >. (Future releases will alleviate the need to
 518     create <TT
 519 CLASS="FILENAME"
 520 >/etc/passwd</TT
 521 > entries.) </P
 522 ></LI
 523 ></UL
 524 ></P
 525 ><P
 526 >There are two ways to create machine trust accounts:</P
 527 ><P
 528 ></P
 529 ><UL
 530 ><LI
 531 ><P
 532 > Manual creation. Both the Samba and corresponding
 533         Unix account are created by hand.</P
 534 ></LI
 535 ><LI
 536 ><P
 537 > "On-the-fly" creation. The Samba machine trust
 538         account is automatically created by Samba at the time the client
 539         is joined to the domain. (For security, this is the
 540         recommended method.) The corresponding Unix account may be
 541         created automatically or manually. </P
 542 ></LI
 543 ></UL
 544 ><DIV
 545 CLASS="SECT2"
 546 ><H2
 547 CLASS="SECT2"
 548 ><A
 549 NAME="AEN698"
 550 ></A
 551 >7.4.1. Manual Creation of Machine Trust Accounts</H2
 552 ><P
 553 >The first step in manually creating a machine trust account is to
 554 manually create the corresponding Unix account in
 555 <TT
 556 CLASS="FILENAME"
 557 >/etc/passwd</TT
 558 >.  This can be done using
 559 <B
 560 CLASS="COMMAND"
 561 >vipw</B
 562 > or other 'add user' command that is normally
 563 used to create new Unix accounts.  The following is an example for a
 564 Linux based Samba server:</P
 565 ><P
 566 >  <TT
 567 CLASS="PROMPT"
 568 >root# </TT
 569 ><B
 570 CLASS="COMMAND"
 571 >/usr/sbin/useradd -g 100 -d /dev/null -c <TT
 572 CLASS="REPLACEABLE"
 573 ><I
 574 >"machine
 575 nickname"</I
 576 ></TT
 577 > -s /bin/false <TT
 578 CLASS="REPLACEABLE"
 579 ><I
 580 >machine_name</I
 581 ></TT
 582 >$ </B
 583 ></P
 584 ><P
 585 ><TT
 586 CLASS="PROMPT"
 587 >root# </TT
 588 ><B
 589 CLASS="COMMAND"
 590 >passwd -l <TT
 591 CLASS="REPLACEABLE"
 592 ><I
 593 >machine_name</I
 594 ></TT
 595 >$</B
 596 ></P
 597 ><P
 598 >On *BSD systems, this can be done using the 'chpass' utility:</P
 599 ><P
 600 ><TT
 601 CLASS="PROMPT"
 602 >root# </TT
 603 ><B
 604 CLASS="COMMAND"
 605 >chpass -a "<TT
 606 CLASS="REPLACEABLE"
 607 ><I
 608 >machine_name</I
 609 ></TT
 610 >$:*:101:100::0:0:Workstation <TT
 611 CLASS="REPLACEABLE"
 612 ><I
 613 >machine_name</I
 614 ></TT
 615 >:/dev/null:/sbin/nologin"</B
 616 ></P
 617 ><P
 618 >The <TT
 619 CLASS="FILENAME"
 620 >/etc/passwd</TT
 621 > entry will list the machine name
 622 with a "$" appended, won't have a password, will have a null shell and no
 623 home directory. For example a machine named 'doppy' would have an
 624 <TT
 625 CLASS="FILENAME"
 626 >/etc/passwd</TT
 627 > entry like this:</P
 628 ><P
 629 ><PRE
 630 CLASS="PROGRAMLISTING"
 631 >doppy$:x:505:501:<TT
 632 CLASS="REPLACEABLE"
 633 ><I
 634 >machine_nickname</I
 635 ></TT
 636 >:/dev/null:/bin/false</PRE
 637 ></P
 638 ><P
 639 >Above, <TT
 640 CLASS="REPLACEABLE"
 641 ><I
 642 >machine_nickname</I
 643 ></TT
 644 > can be any
 645 descriptive name for the client, i.e., BasementComputer.
 646 <TT
 647 CLASS="REPLACEABLE"
 648 ><I
 649 >machine_name</I
 650 ></TT
 651 > absolutely must be the NetBIOS
 652 name of the client to be joined to the domain.  The "$" must be
 653 appended to the NetBIOS name of the client or Samba will not recognize
 654 this as a machine trust account.</P
 655 ><P
 656 >Now that the corresponding Unix account has been created, the next step is to create
 657 the Samba account for the client containing the well-known initial
 658 machine trust account password.  This can be done using the <A
 659 HREF="smbpasswd.8.html"
 660 TARGET="_top"
 661 ><B
 662 CLASS="COMMAND"
 663 >smbpasswd(8)</B
 664 ></A
 665 > command
 666 as shown here:</P
 667 ><P
 668 ><TT
 669 CLASS="PROMPT"
 670 >root# </TT
 671 ><B
 672 CLASS="COMMAND"
 673 >smbpasswd -a -m <TT
 674 CLASS="REPLACEABLE"
 675 ><I
 676 >machine_name</I
 677 ></TT
 678 ></B
 679 ></P
 680 ><P
 681 >where <TT
 682 CLASS="REPLACEABLE"
 683 ><I
 684 >machine_name</I
 685 ></TT
 686 > is the machine's NetBIOS
 687 name.  The RID of the new machine account is generated from the UID of
 688 the corresponding Unix account.</P
 689 ><DIV
 690 CLASS="WARNING"
 691 ><P
 692 ></P
 693 ><TABLE
 694 CLASS="WARNING"
 695 WIDTH="100%"
 696 BORDER="0"
 697 ><TR
 698 ><TD
 699 WIDTH="25"
 700 ALIGN="CENTER"
 701 VALIGN="TOP"
 702 ><IMG
 703 SRC="/docbook-dsssl/warning.gif"
 704 HSPACE="5"
 705 ALT="Warning"></TD
 706 ><TH
 707 ALIGN="LEFT"
 708 VALIGN="CENTER"
 709 ><B
 710 >Join the client to the domain immediately</B
 711 ></TH
 712 ></TR
 713 ><TR
 714 ><TD
 715 >&nbsp;</TD
 716 ><TD
 717 ALIGN="LEFT"
 718 VALIGN="TOP"
 719 ><P
 720 >       Manually creating a machine trust account using this method is the
 721         equivalent of creating a machine trust account on a Windows NT PDC using
 722         the "Server Manager".  From the time at which the account is created
 723         to the time which the client joins the domain and changes the password,
 724         your domain is vulnerable to an intruder joining your domain using a
 725         a machine with the same NetBIOS name.  A PDC inherently trusts
 726         members of the domain and will serve out a large degree of user
 727         information to such clients.  You have been warned!
 728         </P
 729 ></TD
 730 ></TR
 731 ></TABLE
 732 ></DIV
 733 ></DIV
 734 ><DIV
 735 CLASS="SECT2"
 736 ><H2
 737 CLASS="SECT2"
 738 ><A
 739 NAME="AEN739"
 740 ></A
 741 >7.4.2. "On-the-Fly" Creation of Machine Trust Accounts</H2
 742 ><P
 743 >The second (and recommended) way of creating machine trust accounts is
 744 simply to allow the Samba server to create them as needed when the client
 745 is joined to the domain. </P
 746 ><P
 747 >Since each Samba machine trust account requires a corresponding
 748 Unix account, a method for automatically creating the
 749 Unix account is usually supplied; this requires configuration of the
 750 <A
 751 HREF="smb.conf.5.html#ADDUSERSCRIPT"
 752 TARGET="_top"
 753 >add user script</A
 754 >
 755 option in <TT
 756 CLASS="FILENAME"
 757 >smb.conf</TT
 758 >.  This
 759 method is not required, however; corresponding Unix accounts may also
 760 be created manually.</P
 761 ><P
 762 >Below is an example for a RedHat 6.2 Linux system.</P
 763 ><P
 764 ><PRE
 765 CLASS="PROGRAMLISTING"
 766 >[global]
 767    # &#60;...remainder of parameters...&#62;
 768    add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u </PRE
 769 ></P
 770 ></DIV
 771 ><DIV
 772 CLASS="SECT2"
 773 ><H2
 774 CLASS="SECT2"
 775 ><A
 776 NAME="AEN748"
 777 ></A
 778 >7.4.3. Joining the Client to the Domain</H2
 779 ><P
 780 >The procedure for joining a client to the domain varies with the
 781 version of Windows.</P
 782 ><P
 783 ></P
 784 ><UL
 785 ><LI
 786 ><P
 787 ><SPAN
 788 CLASS="emphasis"
 789 ><I
 790 CLASS="EMPHASIS"
 791 >Windows 2000</I
 792 ></SPAN
 793 ></P
 794 ><P
 795 > When the user elects to join the client to a domain, Windows prompts for
 796         an account and password that is privileged to join the domain.  A
 797         Samba administrative account (i.e., a Samba account that has root
 798         privileges on the Samba server) must be entered here; the
 799         operation will fail if an ordinary user account is given.
 800         The password for this account should be
 801         set to a different password than the associated
 802         <TT
 803 CLASS="FILENAME"
 804 >/etc/passwd</TT
 805 > entry, for security
 806         reasons. </P
 807 ><P
 808 >The session key of the Samba administrative account acts as an
 809         encryption key for setting the password of the machine trust
 810         account. The machine trust account will be created on-the-fly, or
 811         updated if it already exists.</P
 812 ></LI
 813 ><LI
 814 ><P
 815 ><SPAN
 816 CLASS="emphasis"
 817 ><I
 818 CLASS="EMPHASIS"
 819 >Windows NT</I
 820 ></SPAN
 821 ></P
 822 ><P
 823 > If the machine trust account was created manually, on the
 824         Identification Changes menu enter the domain name, but do not
 825         check the box "Create a Computer Account in the Domain."  In this case,
 826         the existing machine trust account is used to join the machine to
 827         the domain.</P
 828 ><P
 829 > If the machine trust account is to be created
 830         on-the-fly, on the Identification Changes menu enter the domain
 831         name, and check the box "Create a Computer Account in the Domain."  In
 832         this case, joining the domain proceeds as above for Windows 2000
 833         (i.e., you must supply a Samba administrative account when
 834         prompted).</P
 835 ></LI
 836 ></UL
 837 ></DIV
 838 ></DIV
 839 ><DIV
 840 CLASS="SECT1"
 841 ><H1
 842 CLASS="SECT1"
 843 ><A
 844 NAME="AEN763"
 845 ></A
 846 >7.5. Common Problems and Errors</H1
 847 ><P
 848 ></P
 849 ><P
 850 ></P
 851 ><UL
 852 ><LI
 853 ><P
 854 >       <SPAN
 855 CLASS="emphasis"
 856 ><I
 857 CLASS="EMPHASIS"
 858 >I cannot include a '$' in a machine name.</I
 859 ></SPAN
 860 >
 861         </P
 862 ><P
 863 >       A 'machine name' in (typically) <TT
 864 CLASS="FILENAME"
 865 >/etc/passwd</TT
 866 >
 867         of the machine name with a '$' appended. FreeBSD (and other BSD
 868         systems?) won't create a user with a '$' in their name.
 869         </P
 870 ><P
 871 >       The problem is only in the program used to make the entry, once
 872         made, it works perfectly. So create a user without the '$' and
 873         use <B
 874 CLASS="COMMAND"
 875 >vipw</B
 876 > to edit the entry, adding the '$'. Or create
 877         the whole entry with vipw if you like, make sure you use a
 878         unique User ID !
 879         </P
 880 ></LI
 881 ><LI
 882 ><P
 883 >       <SPAN
 884 CLASS="emphasis"
 885 ><I
 886 CLASS="EMPHASIS"
 887 >I get told "You already have a connection to the Domain...."
 888         or "Cannot join domain, the credentials supplied conflict with an
 889         existing set.." when creating a machine trust account.</I
 890 ></SPAN
 891 >
 892         </P
 893 ><P
 894 >       This happens if you try to create a machine trust account from the
 895         machine itself and already have a connection (e.g. mapped drive)
 896         to a share (or IPC$) on the Samba PDC.  The following command
 897         will remove all network drive connections:
 898         </P
 899 ><P
 900 >       <TT
 901 CLASS="PROMPT"
 902 >C:\WINNT\&#62;</TT
 903 > <B
 904 CLASS="COMMAND"
 905 >net use * /d</B
 906 >
 907         </P
 908 ><P
 909 >       Further, if the machine is a already a 'member of a workgroup' that
 910         is the same name as the domain you are joining (bad idea) you will
 911         get this message.  Change the workgroup name to something else, it
 912         does not matter what, reboot, and try again.
 913         </P
 914 ></LI
 915 ><LI
 916 ><P
 917 >       <SPAN
 918 CLASS="emphasis"
 919 ><I
 920 CLASS="EMPHASIS"
 921 >The system can not log you on (C000019B)....</I
 922 ></SPAN
 923 >
 924         </P
 925 ><P
 926 >I joined the domain successfully but after upgrading
 927         to a newer version of the Samba code I get the message, "The system
 928         can not log you on (C000019B), Please try a gain or consult your
 929         system administrator" when attempting to logon.
 930         </P
 931 ><P
 932 >       This occurs when the domain SID stored in
 933         <TT
 934 CLASS="FILENAME"
 935 >private/WORKGROUP.SID</TT
 936 > is
 937         changed.  For example, you remove the file and <B
 938 CLASS="COMMAND"
 939 >smbd</B
 940 > automatically
 941         creates a new one.  Or you are swapping back and forth between
 942         versions 2.0.7, TNG and the HEAD branch code (not recommended).  The
 943         only way to correct the problem is to restore the original domain
 944         SID or remove the domain client from the domain and rejoin.
 945         </P
 946 ></LI
 947 ><LI
 948 ><P
 949 >       <SPAN
 950 CLASS="emphasis"
 951 ><I
 952 CLASS="EMPHASIS"
 953 >The machine trust account for this computer either does not
 954         exist or is not accessible.</I
 955 ></SPAN
 956 >
 957         </P
 958 ><P
 959 >       When I try to join the domain I get the message "The machine account
 960         for this computer either does not exist or is not accessible". What's
 961         wrong?
 962         </P
 963 ><P
 964 >       This problem is caused by the PDC not having a suitable machine trust account.
 965         If you are using the <TT
 966 CLASS="PARAMETER"
 967 ><I
 968 >add user script</I
 969 ></TT
 970 > method to create
 971         accounts then this would indicate that it has not worked. Ensure the domain
 972         admin user system is working.
 973         </P
 974 ><P
 975 >       Alternatively if you are creating account entries manually then they
 976         have not been created correctly. Make sure that you have the entry
 977         correct for the machine trust account in smbpasswd file on the Samba PDC.
 978         If you added the account using an editor rather than using the smbpasswd
 979         utility, make sure that the account name is the machine NetBIOS name
 980         with a '$' appended to it ( i.e. computer_name$ ). There must be an entry
 981         in both /etc/passwd and the smbpasswd file. Some people have reported
 982         that inconsistent subnet masks between the Samba server and the NT
 983         client have caused this problem.   Make sure that these are consistent
 984         for both client and server.
 985         </P
 986 ></LI
 987 ><LI
 988 ><P
 989 >       <SPAN
 990 CLASS="emphasis"
 991 ><I
 992 CLASS="EMPHASIS"
 993 >When I attempt to login to a Samba Domain from a NT4/W2K workstation,
 994         I get a message about my account being disabled.</I
 995 ></SPAN
 996 >
 997         </P
 998 ><P
 999 >       This problem is caused by a PAM related bug in Samba 2.2.0.  This bug is
1000         fixed in 2.2.1.  Other symptoms could be unaccessible shares on
1001         NT/W2K member servers in the domain or the following error in your smbd.log:
1002         passdb/pampass.c:pam_account(268) PAM: UNKNOWN ERROR for User: %user%
1003         </P
1004 ><P
1005 >       At first be ensure to enable the useraccounts with <B
1006 CLASS="COMMAND"
1007 >smbpasswd -e
1008         %user%</B
1009 >, this is normally done, when you create an account.
1010         </P
1011 ><P
1012 >       In order to work around this problem in 2.2.0, configure the
1013         <TT
1014 CLASS="PARAMETER"
1015 ><I
1016 >account</I
1017 ></TT
1018 > control flag in
1019         <TT
1020 CLASS="FILENAME"
1021 >/etc/pam.d/samba</TT
1022 > file as follows:
1023         </P
1024 ><P
1025 ><PRE
1026 CLASS="PROGRAMLISTING"
1027 >       account required        pam_permit.so
1028         </PRE
1029 ></P
1030 ><P
1031 >       If you want to remain backward compatibility to samba 2.0.x use
1032         <TT
1033 CLASS="FILENAME"
1034 >pam_permit.so</TT
1035 >, it's also possible to use
1036         <TT
1037 CLASS="FILENAME"
1038 >pam_pwdb.so</TT
1039 >. There are some bugs if you try to
1040         use <TT
1041 CLASS="FILENAME"
1042 >pam_unix.so</TT
1043 >, if you need this, be ensure to use
1044         the most recent version of this file.
1045         </P
1046 ></LI
1047 ></UL
1048 ></DIV
1049 ><DIV
1050 CLASS="SECT1"
1051 ><H1
1052 CLASS="SECT1"
1053 ><A
1054 NAME="AEN811"
1055 ></A
1056 >7.6. System Policies and Profiles</H1
1057 ><P
1058 >Much of the information necessary to implement System Policies and
1059 Roving User Profiles in a Samba domain is the same as that for
1060 implementing these same items in a Windows NT 4.0 domain.
1061 You should read the white paper <A
1062 HREF="http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp"
1063 TARGET="_top"
1064 >Implementing
1065 Profiles and Policies in Windows NT 4.0</A
1066 > available from Microsoft.</P
1067 ><P
1068 >Here are some additional details:</P
1069 ><P
1070 ></P
1071 ><UL
1072 ><LI
1073 ><P
1074 >       <SPAN
1075 CLASS="emphasis"
1076 ><I
1077 CLASS="EMPHASIS"
1078 >What about Windows NT Policy Editor?</I
1079 ></SPAN
1080 >
1081         </P
1082 ><P
1083 >       To create or edit <TT
1084 CLASS="FILENAME"
1085 >ntconfig.pol</TT
1086 > you must use
1087         the NT Server Policy Editor, <B
1088 CLASS="COMMAND"
1089 >poledit.exe</B
1090 >       which
1091         is included with NT Server but <SPAN
1092 CLASS="emphasis"
1093 ><I
1094 CLASS="EMPHASIS"
1095 >not NT Workstation</I
1096 ></SPAN
1097 >.
1098         There is a Policy Editor on a NTws
1099         but it is not suitable for creating <SPAN
1100 CLASS="emphasis"
1101 ><I
1102 CLASS="EMPHASIS"
1103 >Domain Policies</I
1104 ></SPAN
1105 >.
1106         Further, although the Windows 95
1107         Policy Editor can be installed on an NT Workstation/Server, it will not
1108         work with NT policies because the registry key that are set by the policy templates.
1109         However, the files from the NT Server will run happily enough on an NTws.
1110         You need <TT
1111 CLASS="FILENAME"
1112 >poledit.exe, common.adm</TT
1113 > and <TT
1114 CLASS="FILENAME"
1115 >winnt.adm</TT
1116 >. It is convenient
1117         to put the two *.adm files in <TT
1118 CLASS="FILENAME"
1119 >c:\winnt\inf</TT
1120 > which is where
1121         the binary will look for them unless told otherwise. Note also that that
1122         directory is 'hidden'.
1123         </P
1124 ><P
1125 >       The Windows NT policy editor is also included with the Service Pack 3 (and
1126         later) for Windows NT 4.0. Extract the files using <B
1127 CLASS="COMMAND"
1128 >servicepackname /x</B
1129 >,
1130         i.e. that's <B
1131 CLASS="COMMAND"
1132 >Nt4sp6ai.exe /x</B
1133 > for service pack 6a.  The policy editor,
1134         <B
1135 CLASS="COMMAND"
1136 >poledit.exe</B
1137 > and the associated template files (*.adm) should
1138         be extracted as well.  It is also possible to downloaded the policy template
1139         files for Office97 and get a copy of the policy editor.  Another possible
1140         location is with the Zero Administration Kit available for download from Microsoft.
1141         </P
1142 ></LI
1143 ><LI
1144 ><P
1145 >       <SPAN
1146 CLASS="emphasis"
1147 ><I
1148 CLASS="EMPHASIS"
1149 >Can Win95 do Policies?</I
1150 ></SPAN
1151 >
1152         </P
1153 ><P
1154 >       Install the group policy handler for Win9x to pick up group
1155         policies.   Look on the Win98 CD in <TT
1156 CLASS="FILENAME"
1157 >\tools\reskit\netadmin\poledit</TT
1158 >.
1159         Install group policies on a Win9x client by double-clicking
1160         <TT
1161 CLASS="FILENAME"
1162 >grouppol.inf</TT
1163 >. Log off and on again a couple of
1164         times and see if Win98 picks up group policies.  Unfortunately this needs
1165         to be done on every Win9x machine that uses group policies....
1166         </P
1167 ><P
1168 >       If group policies don't work one reports suggests getting the updated
1169         (read: working) grouppol.dll for Windows 9x. The group list is grabbed
1170         from /etc/group.
1171         </P
1172 ></LI
1173 ><LI
1174 ><P
1175 >       <SPAN
1176 CLASS="emphasis"
1177 ><I
1178 CLASS="EMPHASIS"
1179 >How do I get 'User Manager' and 'Server Manager'</I
1180 ></SPAN
1181 >
1182         </P
1183 ><P
1184 >       Since I don't need to buy an NT Server CD now, how do I get
1185         the 'User Manager for Domains', the 'Server Manager'?
1186         </P
1187 ><P
1188 >       Microsoft distributes a version of these tools called nexus for
1189         installation on Windows 95 systems.  The tools set includes
1190         </P
1191 ><P
1192 ></P
1193 ><UL
1194 ><LI
1195 ><P
1196 >Server Manager</P
1197 ></LI
1198 ><LI
1199 ><P
1200 >User Manager for Domains</P
1201 ></LI
1202 ><LI
1203 ><P
1204 >Event Viewer</P
1205 ></LI
1206 ></UL
1207 ><P
1208 >       Click here to download the archived file <A
1209 HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE"
1210 TARGET="_top"
1211 >ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A
1212 >
1213         </P
1214 ><P
1215 >       The Windows NT 4.0 version of the 'User Manager for
1216         Domains' and 'Server Manager' are available from Microsoft via ftp
1217         from <A
1218 HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE"
1219 TARGET="_top"
1220 >ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A
1221 >
1222         </P
1223 ></LI
1224 ></UL
1225 ></DIV
1226 ><DIV
1227 CLASS="SECT1"
1228 ><H1
1229 CLASS="SECT1"
1230 ><A
1231 NAME="AEN855"
1232 ></A
1233 >7.7. What other help can I get?</H1
1234 ><P
1235 >There are many sources of information available in the form
1236 of mailing lists, RFC's and documentation.  The docs that come
1237 with the samba distribution contain very good explanations of
1238 general SMB topics such as browsing.</P
1239 ><P
1240 ></P
1241 ><UL
1242 ><LI
1243 ><P
1244 >       <SPAN
1245 CLASS="emphasis"
1246 ><I
1247 CLASS="EMPHASIS"
1248 >What are some diagnostics tools I can use to debug the domain logon
1249         process and where can I find them?</I
1250 ></SPAN
1251 >
1252         </P
1253 ><P
1254 >       One of the best diagnostic tools for debugging problems is Samba itself.
1255         You can use the -d option for both smbd and nmbd to specify what
1256         'debug level' at which to run.  See the man pages on smbd, nmbd  and
1257         smb.conf for more information on debugging options.  The debug
1258         level can range from 1 (the default) to 10 (100 for debugging passwords).
1259         </P
1260 ><P
1261 >       Another helpful method of debugging is to compile samba using the
1262         <B
1263 CLASS="COMMAND"
1264 >gcc -g </B
1265 > flag.   This will include debug
1266         information in the binaries and allow you to attach gdb to the
1267         running smbd / nmbd process.  In order to attach gdb to an smbd
1268         process for an NT workstation, first get the workstation to make the
1269         connection. Pressing ctrl-alt-delete and going down to the domain box
1270         is sufficient (at least, on the first time you join the domain) to
1271         generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation
1272         maintains an open connection, and therefore there will be an smbd
1273         process running (assuming that you haven't set a really short smbd
1274         idle timeout)  So, in between pressing ctrl alt delete, and actually
1275         typing in your password, you can gdb attach and continue.
1276         </P
1277 ><P
1278 >       Some useful samba commands worth investigating:
1279         </P
1280 ><P
1281 ></P
1282 ><UL
1283 ><LI
1284 ><P
1285 >testparam | more</P
1286 ></LI
1287 ><LI
1288 ><P
1289 >smbclient -L //{netbios name of server}</P
1290 ></LI
1291 ></UL
1292 ><P
1293 >       An SMB enabled version of tcpdump is available from
1294         <A
1295 HREF="http://www.tcpdump.org/"
1296 TARGET="_top"
1297 >http://www.tcpdup.org/</A
1298 >.
1299         Ethereal, another good packet sniffer for Unix and Win32
1300         hosts, can be downloaded from <A
1301 HREF="http://www.ethereal.com/"
1302 TARGET="_top"
1303 >http://www.ethereal.com</A
1304 >.
1305         </P
1306 ><P
1307 >       For tracing things on the Microsoft Windows NT, Network Monitor
1308         (aka. netmon) is available on the Microsoft Developer Network CD's,
1309         the Windows NT Server install CD and the SMS CD's.  The version of
1310         netmon that ships with SMS allows for dumping packets between any two
1311         computers (i.e. placing the network interface in promiscuous mode).
1312         The version on the NT Server install CD will only allow monitoring
1313         of network traffic directed to the local NT box and broadcasts on the
1314         local subnet.  Be aware that Ethereal can read and write netmon
1315         formatted files.
1316         </P
1317 ></LI
1318 ><LI
1319 ><P
1320 >       <SPAN
1321 CLASS="emphasis"
1322 ><I
1323 CLASS="EMPHASIS"
1324 >How do I install 'Network Monitor' on an NT Workstation
1325         or a Windows 9x box?</I
1326 ></SPAN
1327 >
1328         </P
1329 ><P
1330 >       Installing netmon on an NT workstation requires a couple
1331         of steps.  The following are for installing Netmon V4.00.349, which comes
1332         with Microsoft Windows NT Server 4.0, on Microsoft Windows NT
1333         Workstation 4.0.  The process should be similar for other version of
1334         Windows NT / Netmon.  You will need both the Microsoft Windows
1335         NT Server 4.0 Install CD and the Workstation 4.0 Install CD.
1336         </P
1337 ><P
1338 >       Initially you will need to install 'Network Monitor Tools and Agent'
1339         on the NT Server.  To do this
1340         </P
1341 ><P
1342 ></P
1343 ><UL
1344 ><LI
1345 ><P
1346 >Goto Start - Settings - Control Panel -
1347                 Network - Services - Add </P
1348 ></LI
1349 ><LI
1350 ><P
1351 >Select the 'Network Monitor Tools and Agent' and
1352                 click on 'OK'.</P
1353 ></LI
1354 ><LI
1355 ><P
1356 >Click 'OK' on the Network Control Panel.
1357                 </P
1358 ></LI
1359 ><LI
1360 ><P
1361 >Insert the Windows NT Server 4.0 install CD
1362                 when prompted.</P
1363 ></LI
1364 ></UL
1365 ><P
1366 >       At this point the Netmon files should exist in
1367         <TT
1368 CLASS="FILENAME"
1369 >%SYSTEMROOT%\System32\netmon\*.*</TT
1370 >.
1371         Two subdirectories exist as well, <TT
1372 CLASS="FILENAME"
1373 >parsers\</TT
1374 >
1375         which contains the necessary DLL's for parsing the netmon packet
1376         dump, and <TT
1377 CLASS="FILENAME"
1378 >captures\</TT
1379 >.
1380         </P
1381 ><P
1382 >       In order to install the Netmon tools on an NT Workstation, you will
1383         first need to install the 'Network  Monitor Agent' from the Workstation
1384         install CD.
1385         </P
1386 ><P
1387 ></P
1388 ><UL
1389 ><LI
1390 ><P
1391 >Goto Start - Settings - Control Panel -
1392                 Network - Services - Add</P
1393 ></LI
1394 ><LI
1395 ><P
1396 >Select the 'Network Monitor Agent' and click
1397                 on 'OK'.</P
1398 ></LI
1399 ><LI
1400 ><P
1401 >Click 'OK' on the Network Control Panel.
1402                 </P
1403 ></LI
1404 ><LI
1405 ><P
1406 >Insert the Windows NT Workstation 4.0 install
1407                 CD when prompted.</P
1408 ></LI
1409 ></UL
1410 ><P
1411 >       Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.*
1412         to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set
1413         permissions as  you deem appropriate for your site. You will need
1414         administrative rights on the NT box to run netmon.
1415         </P
1416 ><P
1417 >       To install Netmon on a Windows 9x box install the network monitor agent
1418         from the Windows 9x CD (\admin\nettools\netmon).  There is a readme
1419         file located with the netmon driver files on the CD if you need
1420         information on how to do this.  Copy the files from a working
1421         Netmon installation.
1422         </P
1423 ></LI
1424 ><LI
1425 ><P
1426 >       The following is a list if helpful URLs and other links:
1427         </P
1428 ><P
1429 ></P
1430 ><UL
1431 ><LI
1432 ><P
1433 >Home of Samba site <A
1434 HREF="http://samba.org"
1435 TARGET="_top"
1436 >        http://samba.org</A
1437 >. We have a mirror near you !</P
1438 ></LI
1439 ><LI
1440 ><P
1441 > The <SPAN
1442 CLASS="emphasis"
1443 ><I
1444 CLASS="EMPHASIS"
1445 >Development</I
1446 ></SPAN
1447 > document
1448         on the Samba mirrors might mention your problem. If so,
1449         it might mean that the developers are working on it.</P
1450 ></LI
1451 ><LI
1452 ><P
1453 >See how Scott Merrill simulates a BDC behavior at
1454         <A
1455 HREF="http://www.skippy.net/linux/smb-howto.html"
1456 TARGET="_top"
1457 >        http://www.skippy.net/linux/smb-howto.html</A
1458 >. </P
1459 ></LI
1460 ><LI
1461 ><P
1462 >Although 2.0.7 has almost had its day as a PDC, David Bannon will
1463         keep the 2.0.7 PDC pages at <A
1464 HREF="http://bioserve.latrobe.edu.au/samba"
1465 TARGET="_top"
1466 >        http://bioserve.latrobe.edu.au/samba</A
1467 > going for a while yet.</P
1468 ></LI
1469 ><LI
1470 ><P
1471 >Misc links to CIFS information
1472         <A
1473 HREF="http://samba.org/cifs/"
1474 TARGET="_top"
1475 >http://samba.org/cifs/</A
1476 ></P
1477 ></LI
1478 ><LI
1479 ><P
1480 >NT Domains for Unix <A
1481 HREF="http://mailhost.cb1.com/~lkcl/ntdom/"
1482 TARGET="_top"
1483 >        http://mailhost.cb1.com/~lkcl/ntdom/</A
1484 ></P
1485 ></LI
1486 ><LI
1487 ><P
1488 >FTP site for older SMB specs:
1489         <A
1490 HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/"
1491 TARGET="_top"
1492 >        ftp://ftp.microsoft.com/developr/drg/CIFS/</A
1493 ></P
1494 ></LI
1495 ></UL
1496 ></LI
1497 ></UL
1498 ><P
1499 ></P
1500 ><UL
1501 ><LI
1502 ><P
1503 >       <SPAN
1504 CLASS="emphasis"
1505 ><I
1506 CLASS="EMPHASIS"
1507 >How do I get help from the mailing lists?</I
1508 ></SPAN
1509 >
1510         </P
1511 ><P
1512 >       There are a number of Samba related mailing lists. Go to <A
1513 HREF="http://samba.org"
1514 TARGET="_top"
1515 >http://samba.org</A
1516 >, click on your nearest mirror
1517         and then click on <B
1518 CLASS="COMMAND"
1519 >Support</B
1520 > and then click on <B
1521 CLASS="COMMAND"
1522 >       Samba related mailing lists</B
1523 >.
1524         </P
1525 ><P
1526 >       For questions relating to Samba TNG go to
1527         <A
1528 HREF="http://www.samba-tng.org/"
1529 TARGET="_top"
1530 >http://www.samba-tng.org/</A
1531 >
1532         It has been requested that you don't post questions about Samba-TNG to the
1533         main stream Samba lists.</P
1534 ><P
1535 >       If you post a message to one of the lists please observe the following guide lines :
1536         </P
1537 ><P
1538 ></P
1539 ><UL
1540 ><LI
1541 ><P
1542 > Always remember that the developers are volunteers, they are
1543                 not paid and they never guarantee to produce a particular feature at
1544                 a particular time. Any time lines are 'best guess' and nothing more.
1545                 </P
1546 ></LI
1547 ><LI
1548 ><P
1549 > Always mention what version of samba you are using and what
1550                 operating system its running under. You should probably list the
1551         relevant sections of your smb.conf file, at least the options
1552         in [global] that affect PDC support.</P
1553 ></LI
1554 ><LI
1555 ><P
1556 >In addition to the version, if you obtained Samba via
1557         CVS mention the date when you last checked it out.</P
1558 ></LI
1559 ><LI
1560 ><P
1561 > Try and make your question clear and brief, lots of long,
1562                 convoluted questions get deleted before they are completely read !
1563                 Don't post html encoded messages (if you can select colour or font
1564                 size its html).</P
1565 ></LI
1566 ><LI
1567 ><P
1568 > If you run one of those nifty 'I'm on holidays' things when
1569                 you are away, make sure its configured  to not answer mailing lists.
1570                 </P
1571 ></LI
1572 ><LI
1573 ><P
1574 > Don't cross post. Work out which is the best list to post to
1575                 and see what happens, i.e. don't post to both samba-ntdom and samba-technical.
1576         Many people active on the lists subscribe to more
1577                 than one list and get annoyed to see the same message two or more times.
1578                 Often someone will see a message and thinking it would be better dealt
1579                 with on another, will forward it on for you.</P
1580 ></LI
1581 ><LI
1582 ><P
1583 >You might include <SPAN
1584 CLASS="emphasis"
1585 ><I
1586 CLASS="EMPHASIS"
1587 >partial</I
1588 ></SPAN
1589 >
1590         log files written at a debug level set to as much as 20.
1591         Please don't send the entire log but enough to give the context of the
1592         error messages.</P
1593 ></LI
1594 ><LI
1595 ><P
1596 >(Possibly) If you have a complete netmon trace ( from the opening of
1597         the pipe to the error ) you can send the *.CAP file as well.</P
1598 ></LI
1599 ><LI
1600 ><P
1601 >Please think carefully before attaching a document to an email.
1602         Consider pasting the relevant parts into the body of the message. The samba
1603         mailing lists go to a huge number of people, do they all need a copy of your
1604         smb.conf in their attach directory?</P
1605 ></LI
1606 ></UL
1607 ></LI
1608 ><LI
1609 ><P
1610 >       <SPAN
1611 CLASS="emphasis"
1612 ><I
1613 CLASS="EMPHASIS"
1614 >How do I get off the mailing lists?</I
1615 ></SPAN
1616 >
1617         </P
1618 ><P
1619 >To have your name removed from a samba mailing list, go to the
1620         same place you went to to get on it. Go to <A
1621 HREF="http://lists.samba.org/"
1622 TARGET="_top"
1623 >http://lists.samba.org</A
1624 >,
1625         click on your nearest mirror and then click on <B
1626 CLASS="COMMAND"
1627 >Support</B
1628 > and
1629         then click on <B
1630 CLASS="COMMAND"
1631 > Samba related mailing lists</B
1632 >. Or perhaps see
1633         <A
1634 HREF="http://lists.samba.org/mailman/roster/samba-ntdom"
1635 TARGET="_top"
1636 >here</A
1637 >
1638         </P
1639 ><P
1640 >       Please don't post messages to the list asking to be removed, you will just
1641         be referred to the above address (unless that process failed in some way...)
1642         </P
1643 ></LI
1644 ></UL
1645 ></DIV
1646 ><DIV
1647 CLASS="SECT1"
1648 ><H1
1649 CLASS="SECT1"
1650 ><A
1651 NAME="AEN969"
1652 ></A
1653 >7.8. Domain Control for Windows 9x/ME</H1
1654 ><DIV
1655 CLASS="NOTE"
1656 ><P
1657 ></P
1658 ><TABLE
1659 CLASS="NOTE"
1660 WIDTH="100%"
1661 BORDER="0"
1662 ><TR
1663 ><TD
1664 WIDTH="25"
1665 ALIGN="CENTER"
1666 VALIGN="TOP"
1667 ><IMG
1668 SRC="/docbook-dsssl/note.gif"
1669 HSPACE="5"
1670 ALT="Note"></TD
1671 ><TD
1672 ALIGN="LEFT"
1673 VALIGN="TOP"
1674 ><P
1675 >The following section contains much of the original
1676 DOMAIN.txt file previously included with Samba.  Much of
1677 the material is based on what went into the book <SPAN
1678 CLASS="emphasis"
1679 ><I
1680 CLASS="EMPHASIS"
1681 >Special
1682 Edition, Using Samba</I
1683 ></SPAN
1684 >, by Richard Sharpe.</P
1685 ></TD
1686 ></TR
1687 ></TABLE
1688 ></DIV
1689 ><P
1690 >A domain and a workgroup are exactly the same thing in terms of network
1691 browsing.  The difference is that a distributable authentication
1692 database is associated with a domain, for secure login access to a
1693 network.  Also, different access rights can be granted to users if they
1694 successfully authenticate against a domain logon server (NT server and
1695 other systems based on NT server support this, as does at least Samba TNG now).</P
1696 ><P
1697 >The SMB client logging on to a domain has an expectation that every other
1698 server in the domain should accept the same authentication information.
1699 Network browsing functionality of domains and workgroups is
1700 identical and is explained in BROWSING.txt. It should be noted, that browsing
1701 is totally orthogonal to logon support.</P
1702 ><P
1703 >Issues related to the single-logon network model are discussed in this
1704 section.  Samba supports domain logons, network logon scripts, and user
1705 profiles for MS Windows for workgroups and MS Windows 9X/ME clients
1706 which will be the focus of this section.</P
1707 ><P
1708 >When an SMB client in a domain wishes to logon it broadcast requests for a
1709 logon server.  The first one to reply gets the job, and validates its
1710 password using whatever mechanism the Samba administrator has installed.
1711 It is possible (but very stupid) to create a domain where the user
1712 database is not shared between servers, i.e. they are effectively workgroup
1713 servers advertising themselves as participating in a domain.  This
1714 demonstrates how authentication is quite different from but closely
1715 involved with domains.</P
1716 ><P
1717 >Using these features you can make your clients verify their logon via
1718 the Samba server; make clients run a batch file when they logon to
1719 the network and download their preferences, desktop and start menu.</P
1720 ><P
1721 >Before launching into the configuration instructions, it is
1722 worthwhile lookingat how a Windows 9x/ME client performs a logon:</P
1723 ><P
1724 ></P
1725 ><OL
1726 TYPE="1"
1727 ><LI
1728 ><P
1729 >       The client broadcasts (to the IP broadcast address of the subnet it is in)
1730         a NetLogon request. This is sent to the NetBIOS name DOMAIN&#60;1c&#62; at the
1731         NetBIOS layer.  The client chooses the first response it receives, which
1732         contains the NetBIOS name of the logon server to use in the format of
1733         \\SERVER.
1734         </P
1735 ></LI
1736 ><LI
1737 ><P
1738 >       The client then connects to that server, logs on (does an SMBsessetupX) and
1739         then connects to the IPC$ share (using an SMBtconX).
1740         </P
1741 ></LI
1742 ><LI
1743 ><P
1744 >       The client then does a NetWkstaUserLogon request, which retrieves the name
1745         of the user's logon script.
1746         </P
1747 ></LI
1748 ><LI
1749 ><P
1750 >       The client then connects to the NetLogon share and searches for this
1751         and if it is found and can be read, is retrieved and executed by the client.
1752         After this, the client disconnects from the NetLogon share.
1753         </P
1754 ></LI
1755 ><LI
1756 ><P
1757 >       The client then sends a NetUserGetInfo request to the server, to retrieve
1758         the user's home share, which is used to search for profiles. Since the
1759         response to the NetUserGetInfo request does not contain much more
1760         the user's home share, profiles for Win9X clients MUST reside in the user
1761         home directory.
1762         </P
1763 ></LI
1764 ><LI
1765 ><P
1766 >       The client then connects to the user's home share and searches for the
1767         user's profile. As it turns out, you can specify the user's home share as
1768         a sharename and path. For example, \\server\fred\.profile.
1769         If the profiles are found, they are implemented.
1770         </P
1771 ></LI
1772 ><LI
1773 ><P
1774 >       The client then disconnects from the user's home share, and reconnects to
1775         the NetLogon share and looks for CONFIG.POL, the policies file. If this is
1776         found, it is read and implemented.
1777         </P
1778 ></LI
1779 ></OL
1780 ><DIV
1781 CLASS="SECT2"
1782 ><H2
1783 CLASS="SECT2"
1784 ><A
1785 NAME="AEN995"
1786 ></A
1787 >7.8.1. Configuration Instructions:     Network Logons</H2
1788 ><P
1789 >The main difference between a PDC and a Windows 9x logon
1790 server configuration is that</P
1791 ><P
1792 ></P
1793 ><UL
1794 ><LI
1795 ><P
1796 >Password encryption is not required for a Windows 9x logon server.</P
1797 ></LI
1798 ><LI
1799 ><P
1800 >Windows 9x/ME clients do not possess machine trust accounts.</P
1801 ></LI
1802 ></UL
1803 ><P
1804 >Therefore, a Samba PDC will also act as a Windows 9x logon
1805 server.</P
1806 ><DIV
1807 CLASS="WARNING"
1808 ><P
1809 ></P
1810 ><TABLE
1811 CLASS="WARNING"
1812 WIDTH="100%"
1813 BORDER="0"
1814 ><TR
1815 ><TD
1816 WIDTH="25"
1817 ALIGN="CENTER"
1818 VALIGN="TOP"
1819 ><IMG
1820 SRC="/docbook-dsssl/warning.gif"
1821 HSPACE="5"
1822 ALT="Warning"></TD
1823 ><TH
1824 ALIGN="LEFT"
1825 VALIGN="CENTER"
1826 ><B
1827 >security mode and master browsers</B
1828 ></TH
1829 ></TR
1830 ><TR
1831 ><TD
1832 >&nbsp;</TD
1833 ><TD
1834 ALIGN="LEFT"
1835 VALIGN="TOP"
1836 ><P
1837 >There are a few comments to make in order to tie up some
1838 loose ends.  There has been much debate over the issue of whether
1839 or not it is ok to configure Samba as a Domain Controller in security
1840 modes other than <TT
1841 CLASS="CONSTANT"
1842 >USER</TT
1843 >.  The only security mode
1844 which  will not work due to technical reasons is <TT
1845 CLASS="CONSTANT"
1846 >SHARE</TT
1847 >
1848 mode security.  <TT
1849 CLASS="CONSTANT"
1850 >DOMAIN</TT
1851 > and <TT
1852 CLASS="CONSTANT"
1853 >SERVER</TT
1854 >
1855 mode security is really just a variation on SMB user level security.</P
1856 ><P
1857 >Actually, this issue is also closely tied to the debate on whether
1858 or not Samba must be the domain master browser for its workgroup
1859 when operating as a DC.  While it may technically be possible
1860 to configure a server as such (after all, browsing and domain logons
1861 are two distinctly different functions), it is not a good idea to
1862 so.  You should remember that the DC must register the DOMAIN#1b NetBIOS
1863 name.  This is the name used by Windows clients to locate the DC.
1864 Windows clients do not distinguish between the DC and the DMB.
1865 For this reason, it is very wise to configure the Samba DC as the DMB.</P
1866 ><P
1867 >Now back to the issue of configuring a Samba DC to use a mode other
1868 than "security = user".  If a Samba host is configured to use
1869 another SMB server or DC in order to validate user connection
1870 requests, then it is a fact that some other machine on the network
1871 (the "password server") knows more about user than the Samba host.
1872 99% of the time, this other host is a domain controller.  Now
1873 in order to operate in domain mode security, the "workgroup" parameter
1874 must be set to the name of the Windows NT domain (which already
1875 has a domain controller, right?)</P
1876 ><P
1877 >Therefore configuring a Samba box as a DC for a domain that
1878 already by definition has a PDC is asking for trouble.
1879 Therefore, you should always configure the Samba DC to be the DMB
1880 for its domain.</P
1881 ></TD
1882 ></TR
1883 ></TABLE
1884 ></DIV
1885 ></DIV
1886 ><DIV
1887 CLASS="SECT2"
1888 ><H2
1889 CLASS="SECT2"
1890 ><A
1891 NAME="AEN1014"
1892 ></A
1893 >7.8.2. Configuration Instructions:     Setting up Roaming User Profiles</H2
1894 ><DIV
1895 CLASS="WARNING"
1896 ><P
1897 ></P
1898 ><TABLE
1899 CLASS="WARNING"
1900 WIDTH="100%"
1901 BORDER="0"
1902 ><TR
1903 ><TD
1904 WIDTH="25"
1905 ALIGN="CENTER"
1906 VALIGN="TOP"
1907 ><IMG
1908 SRC="/docbook-dsssl/warning.gif"
1909 HSPACE="5"
1910 ALT="Warning"></TD
1911 ><TD
1912 ALIGN="LEFT"
1913 VALIGN="TOP"
1914 ><P
1915 ><SPAN
1916 CLASS="emphasis"
1917 ><I
1918 CLASS="EMPHASIS"
1919 >NOTE!</I
1920 ></SPAN
1921 > Roaming profiles support is different
1922 for Win9X and WinNT.</P
1923 ></TD
1924 ></TR
1925 ></TABLE
1926 ></DIV
1927 ><P
1928 >Before discussing how to configure roaming profiles, it is useful to see how
1929 Win9X and WinNT clients implement these features.</P
1930 ><P
1931 >Win9X clients send a NetUserGetInfo request to the server to get the user's
1932 profiles location. However, the response does not have room for a separate
1933 profiles location field, only the user's home share. This means that Win9X
1934 profiles are restricted to being in the user's home directory.</P
1935 ><P
1936 >WinNT clients send a NetSAMLogon RPC request, which contains many fields,
1937 including a separate field for the location of the user's profiles.
1938 This means that support for profiles is different for Win9X and WinNT.</P
1939 ><DIV
1940 CLASS="SECT3"
1941 ><H3
1942 CLASS="SECT3"
1943 ><A
1944 NAME="AEN1022"
1945 ></A
1946 >7.8.2.1. Windows NT Configuration</H3
1947 ><P
1948 >To support WinNT clients, in the [global] section of smb.conf set the
1949 following (for example):</P
1950 ><P
1951 ><PRE
1952 CLASS="PROGRAMLISTING"
1953 >logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath</PRE
1954 ></P
1955 ><P
1956 >The default for this option is \\%N\%U\profile, namely
1957 \\sambaserver\username\profile.  The \\N%\%U service is created
1958 automatically by the [homes] service.
1959 If you are using a samba server for the profiles, you _must_ make the
1960 share specified in the logon path browseable. </P
1961 ><DIV
1962 CLASS="NOTE"
1963 ><P
1964 ></P
1965 ><TABLE
1966 CLASS="NOTE"
1967 WIDTH="100%"
1968 BORDER="0"
1969 ><TR
1970 ><TD
1971 WIDTH="25"
1972 ALIGN="CENTER"
1973 VALIGN="TOP"
1974 ><IMG
1975 SRC="/docbook-dsssl/note.gif"
1976 HSPACE="5"
1977 ALT="Note"></TD
1978 ><TD
1979 ALIGN="LEFT"
1980 VALIGN="TOP"
1981 ><P
1982 >[lkcl 26aug96 - we have discovered a problem where Windows clients can
1983 maintain a connection to the [homes] share in between logins.  The
1984 [homes] share must NOT therefore be used in a profile path.]</P
1985 ></TD
1986 ></TR
1987 ></TABLE
1988 ></DIV
1989 ></DIV
1990 ><DIV
1991 CLASS="SECT3"
1992 ><H3
1993 CLASS="SECT3"
1994 ><A
1995 NAME="AEN1030"
1996 ></A
1997 >7.8.2.2. Windows 9X Configuration</H3
1998 ><P
1999 >To support Win9X clients, you must use the "logon home" parameter. Samba has
2000 now been fixed so that "net use/home" now works as well, and it, too, relies
2001 on the "logon home" parameter.</P
2002 ><P
2003 >By using the logon home parameter, you are restricted to putting Win9X
2004 profiles in the user's home directory.   But wait! There is a trick you
2005 can use. If you set the following in the [global] section of your
2006 smb.conf file:</P
2007 ><P
2008 ><PRE
2009 CLASS="PROGRAMLISTING"
2010 >logon home = \\%L\%U\.profiles</PRE
2011 ></P
2012 ><P
2013 >then your Win9X clients will dutifully put their clients in a subdirectory
2014 of your home directory called .profiles (thus making them hidden).</P
2015 ><P
2016 >Not only that, but 'net use/home' will also work, because of a feature in
2017 Win9X. It removes any directory stuff off the end of the home directory area
2018 and only uses the server and share portion. That is, it looks like you
2019 specified \\%L\%U for "logon home".</P
2020 ></DIV
2021 ><DIV
2022 CLASS="SECT3"
2023 ><H3
2024 CLASS="SECT3"
2025 ><A
2026 NAME="AEN1038"
2027 ></A
2028 >7.8.2.3. Win9X and WinNT Configuration</H3
2029 ><P
2030 >You can support profiles for both Win9X and WinNT clients by setting both the
2031 "logon home" and "logon path" parameters. For example:</P
2032 ><P
2033 ><PRE
2034 CLASS="PROGRAMLISTING"
2035 >logon home = \\%L\%U\.profiles
2036 logon path = \\%L\profiles\%U</PRE
2037 ></P
2038 ><DIV
2039 CLASS="NOTE"
2040 ><P
2041 ></P
2042 ><TABLE
2043 CLASS="NOTE"
2044 WIDTH="100%"
2045 BORDER="0"
2046 ><TR
2047 ><TD
2048 WIDTH="25"
2049 ALIGN="CENTER"
2050 VALIGN="TOP"
2051 ><IMG
2052 SRC="/docbook-dsssl/note.gif"
2053 HSPACE="5"
2054 ALT="Note"></TD
2055 ><TD
2056 ALIGN="LEFT"
2057 VALIGN="TOP"
2058 ><P
2059 >I have not checked what 'net use /home' does on NT when "logon home" is
2060 set as above.</P
2061 ></TD
2062 ></TR
2063 ></TABLE
2064 ></DIV
2065 ></DIV
2066 ><DIV
2067 CLASS="SECT3"
2068 ><H3
2069 CLASS="SECT3"
2070 ><A
2071 NAME="AEN1045"
2072 ></A
2073 >7.8.2.4. Windows 9X Profile Setup</H3
2074 ><P
2075 >When a user first logs in on Windows 9X, the file user.DAT is created,
2076 as are folders "Start Menu", "Desktop", "Programs" and "Nethood".
2077 These directories and their contents will be merged with the local
2078 versions stored in c:\windows\profiles\username on subsequent logins,
2079 taking the most recent from each.  You will need to use the [global]
2080 options "preserve case = yes", "short preserve case = yes" and
2081 "case sensitive = no" in order to maintain capital letters in shortcuts
2082 in any of the profile folders.</P
2083 ><P
2084 >The user.DAT file contains all the user's preferences.  If you wish to
2085 enforce a set of preferences, rename their user.DAT file to user.MAN,
2086 and deny them write access to this file.</P
2087 ><P
2088 ></P
2089 ><OL
2090 TYPE="1"
2091 ><LI
2092 ><P
2093 >       On the Windows 95 machine, go to Control Panel | Passwords and
2094         select the User Profiles tab.  Select the required level of
2095         roaming preferences.  Press OK, but do _not_ allow the computer
2096         to reboot.
2097         </P
2098 ></LI
2099 ><LI
2100 ><P
2101 >       On the Windows 95 machine, go to Control Panel | Network |
2102         Client for Microsoft Networks | Preferences.  Select 'Log on to
2103         NT Domain'.  Then, ensure that the Primary Logon is 'Client for
2104         Microsoft Networks'.  Press OK, and this time allow the computer
2105         to reboot.
2106         </P
2107 ></LI
2108 ></OL
2109 ><P
2110 >Under Windows 95, Profiles are downloaded from the Primary Logon.
2111 If you have the Primary Logon as 'Client for Novell Networks', then
2112 the profiles and logon script will be downloaded from your Novell
2113 Server.  If you have the Primary Logon as 'Windows Logon', then the
2114 profiles will be loaded from the local machine - a bit against the
2115 concept of roaming profiles, if you ask me.</P
2116 ><P
2117 >You will now find that the Microsoft Networks Login box contains
2118 [user, password, domain] instead of just [user, password].  Type in
2119 the samba server's domain name (or any other domain known to exist,
2120 but bear in mind that the user will be authenticated against this
2121 domain and profiles downloaded from it, if that domain logon server
2122 supports it), user name and user's password.</P
2123 ><P
2124 >Once the user has been successfully validated, the Windows 95 machine
2125 will inform you that 'The user has not logged on before' and asks you
2126 if you wish to save the user's preferences?  Select 'yes'.</P
2127 ><P
2128 >Once the Windows 95 client comes up with the desktop, you should be able
2129 to examine the contents of the directory specified in the "logon path"
2130 on the samba server and verify that the "Desktop", "Start Menu",
2131 "Programs" and "Nethood" folders have been created.</P
2132 ><P
2133 >These folders will be cached locally on the client, and updated when
2134 the user logs off (if you haven't made them read-only by then :-).
2135 You will find that if the user creates further folders or short-cuts,
2136 that the client will merge the profile contents downloaded with the
2137 contents of the profile directory already on the local client, taking
2138 the newest folders and short-cuts from each set.</P
2139 ><P
2140 >If you have made the folders / files read-only on the samba server,
2141 then you will get errors from the w95 machine on logon and logout, as
2142 it attempts to merge the local and the remote profile.  Basically, if
2143 you have any errors reported by the w95 machine, check the Unix file
2144 permissions and ownership rights on the profile directory contents,
2145 on the samba server.</P
2146 ><P
2147 >If you have problems creating user profiles, you can reset the user's
2148 local desktop cache, as shown below.  When this user then next logs in,
2149 they will be told that they are logging in "for the first time".</P
2150 ><P
2151 ></P
2152 ><OL
2153 TYPE="1"
2154 ><LI
2155 ><P
2156 >       instead of logging in under the [user, password, domain] dialog,
2157         press escape.
2158         </P
2159 ></LI
2160 ><LI
2161 ><P
2162 >       run the regedit.exe program, and look in:
2163         </P
2164 ><P
2165 >       HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList
2166         </P
2167 ><P
2168 >       you will find an entry, for each user, of ProfilePath.  Note the
2169         contents of this key (likely to be c:\windows\profiles\username),
2170         then delete the key ProfilePath for the required user.
2171         </P
2172 ><P
2173 >       [Exit the registry editor].
2174         </P
2175 ></LI
2176 ><LI
2177 ><P
2178 >       <SPAN
2179 CLASS="emphasis"
2180 ><I
2181 CLASS="EMPHASIS"
2182 >WARNING</I
2183 ></SPAN
2184 > - before deleting the contents of the
2185         directory listed in
2186    the ProfilePath (this is likely to be c:\windows\profiles\username),
2187    ask them if they have any important files stored on their desktop
2188    or in their start menu.  delete the contents of the directory
2189    ProfilePath (making a backup if any of the files are needed).
2190         </P
2191 ><P
2192 >   This will have the effect of removing the local (read-only hidden
2193    system file) user.DAT in their profile directory, as well as the
2194    local "desktop", "nethood", "start menu" and "programs" folders.
2195         </P
2196 ></LI
2197 ><LI
2198 ><P
2199 >       search for the user's .PWL password-caching file in the c:\windows
2200         directory, and delete it.
2201         </P
2202 ></LI
2203 ><LI
2204 ><P
2205 >       log off the windows 95 client.
2206         </P
2207 ></LI
2208 ><LI
2209 ><P
2210 >       check the contents of the profile path (see "logon path" described
2211         above), and delete the user.DAT or user.MAN file for the user,
2212         making a backup if required.
2213         </P
2214 ></LI
2215 ></OL
2216 ><P
2217 >If all else fails, increase samba's debug log levels to between 3 and 10,
2218 and / or run a packet trace program such as tcpdump or netmon.exe, and
2219 look for any error reports.</P
2220 ><P
2221 >If you have access to an NT server, then first set up roaming profiles
2222 and / or netlogons on the NT server.  Make a packet trace, or examine
2223 the example packet traces provided with NT server, and see what the
2224 differences are with the equivalent samba trace.</P
2225 ></DIV
2226 ><DIV
2227 CLASS="SECT3"
2228 ><H3
2229 CLASS="SECT3"
2230 ><A
2231 NAME="AEN1081"
2232 ></A
2233 >7.8.2.5. Windows NT Workstation 4.0</H3
2234 ><P
2235 >When a user first logs in to a Windows NT Workstation, the profile
2236 NTuser.DAT is created.  The profile location can be now specified
2237 through the "logon path" parameter.  </P
2238 ><DIV
2239 CLASS="NOTE"
2240 ><P
2241 ></P
2242 ><TABLE
2243 CLASS="NOTE"
2244 WIDTH="100%"
2245 BORDER="0"
2246 ><TR
2247 ><TD
2248 WIDTH="25"
2249 ALIGN="CENTER"
2250 VALIGN="TOP"
2251 ><IMG
2252 SRC="/docbook-dsssl/note.gif"
2253 HSPACE="5"
2254 ALT="Note"></TD
2255 ><TD
2256 ALIGN="LEFT"
2257 VALIGN="TOP"
2258 ><P
2259 >[lkcl 10aug97 - i tried setting the path to
2260 \\samba-server\homes\profile, and discovered that this fails because
2261 a background process maintains the connection to the [homes] share
2262 which does _not_ close down in between user logins.  you have to
2263 have \\samba-server\%L\profile, where user is the username created
2264 from the [homes] share].</P
2265 ></TD
2266 ></TR
2267 ></TABLE
2268 ></DIV
2269 ><P
2270 >There is a parameter that is now available for use with NT Profiles:
2271 "logon drive".  This should be set to "h:" or any other drive, and
2272 should be used in conjunction with the new "logon home" parameter.</P
2273 ><P
2274 >The entry for the NT 4.0 profile is a _directory_ not a file.  The NT
2275 help on profiles mentions that a directory is also created with a .PDS
2276 extension.  The user, while logging in, must have write permission to
2277 create the full profile path (and the folder with the .PDS extension)
2278 [lkcl 10aug97 - i found that the creation of the .PDS directory failed,
2279 and had to create these manually for each user, with a shell script.
2280 also, i presume, but have not tested, that the full profile path must
2281 be browseable just as it is for w95, due to the manner in which they
2282 attempt to create the full profile path: test existence of each path
2283 component; create path component].</P
2284 ><P
2285 >In the profile directory, NT creates more folders than 95.  It creates
2286 "Application Data" and others, as well as "Desktop", "Nethood",
2287 "Start Menu" and "Programs".  The profile itself is stored in a file
2288 NTuser.DAT.  Nothing appears to be stored in the .PDS directory, and
2289 its purpose is currently unknown.</P
2290 ><P
2291 >You can use the System Control Panel to copy a local profile onto
2292 a samba server (see NT Help on profiles: it is also capable of firing
2293 up the correct location in the System Control Panel for you).  The
2294 NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN
2295 turns a profile into a mandatory one.</P
2296 ><DIV
2297 CLASS="NOTE"
2298 ><P
2299 ></P
2300 ><TABLE
2301 CLASS="NOTE"
2302 WIDTH="100%"
2303 BORDER="0"
2304 ><TR
2305 ><TD
2306 WIDTH="25"
2307 ALIGN="CENTER"
2308 VALIGN="TOP"
2309 ><IMG
2310 SRC="/docbook-dsssl/note.gif"
2311 HSPACE="5"
2312 ALT="Note"></TD
2313 ><TD
2314 ALIGN="LEFT"
2315 VALIGN="TOP"
2316 ><P
2317 >[lkcl 10aug97 - i notice that NT Workstation tells me that it is
2318 downloading a profile from a slow link.  whether this is actually the
2319 case, or whether there is some configuration issue, as yet unknown,
2320 that makes NT Workstation _think_ that the link is a slow one is a
2321 matter to be resolved].</P
2322 ><P
2323 >[lkcl 20aug97 - after samba digest correspondence, one user found, and
2324 another confirmed, that profiles cannot be loaded from a samba server
2325 unless "security = user" and "encrypt passwords = yes" (see the file
2326 ENCRYPTION.txt) or "security = server" and "password server = ip.address.
2327 of.yourNTserver" are used.  Either of these options will allow the NT
2328 workstation to access the samba server using LAN manager encrypted
2329 passwords, without the user intervention normally required by NT
2330 workstation for clear-text passwords].</P
2331 ><P
2332 >[lkcl 25aug97 - more comments received about NT profiles: the case of
2333 the profile _matters_.  the file _must_ be called NTuser.DAT or, for
2334 a mandatory profile, NTuser.MAN].</P
2335 ></TD
2336 ></TR
2337 ></TABLE
2338 ></DIV
2339 ></DIV
2340 ><DIV
2341 CLASS="SECT3"
2342 ><H3
2343 CLASS="SECT3"
2344 ><A
2345 NAME="AEN1094"
2346 ></A
2347 >7.8.2.6. Windows NT Server</H3
2348 ><P
2349 >There is nothing to stop you specifying any path that you like for the
2350 location of users' profiles.  Therefore, you could specify that the
2351 profile be stored on a samba server, or any other SMB server, as long as
2352 that SMB server supports encrypted passwords.</P
2353 ></DIV
2354 ><DIV
2355 CLASS="SECT3"
2356 ><H3
2357 CLASS="SECT3"
2358 ><A
2359 NAME="AEN1097"
2360 ></A
2361 >7.8.2.7. Sharing Profiles between W95 and NT Workstation 4.0</H3
2362 ><DIV
2363 CLASS="WARNING"
2364 ><P
2365 ></P
2366 ><TABLE
2367 CLASS="WARNING"
2368 WIDTH="100%"
2369 BORDER="0"
2370 ><TR
2371 ><TD
2372 WIDTH="25"
2373 ALIGN="CENTER"
2374 VALIGN="TOP"
2375 ><IMG
2376 SRC="/docbook-dsssl/warning.gif"
2377 HSPACE="5"
2378 ALT="Warning"></TD
2379 ><TH
2380 ALIGN="LEFT"
2381 VALIGN="CENTER"
2382 ><B
2383 >Potentially outdated or incorrect material follows</B
2384 ></TH
2385 ></TR
2386 ><TR
2387 ><TD
2388 >&nbsp;</TD
2389 ><TD
2390 ALIGN="LEFT"
2391 VALIGN="TOP"
2392 ><P
2393 >I think this is all bogus, but have not deleted it. (Richard Sharpe)</P
2394 ></TD
2395 ></TR
2396 ></TABLE
2397 ></DIV
2398 ><P
2399 >The default logon path is \\%N\%U.  NT Workstation will attempt to create
2400 a directory "\\samba-server\username.PDS" if you specify the logon path
2401 as "\\samba-server\username" with the NT User Manager.  Therefore, you
2402 will need to specify (for example) "\\samba-server\username\profile".
2403 NT 4.0 will attempt to create "\\samba-server\username\profile.PDS", which
2404 is more likely to succeed.</P
2405 ><P
2406 >If you then want to share the same Start Menu / Desktop with W95, you will
2407 need to specify "logon path = \\samba-server\username\profile" [lkcl 10aug97
2408 this has its drawbacks: i created a shortcut to telnet.exe, which attempts
2409 to run from the c:\winnt\system32 directory.  this directory is obviously
2410 unlikely to exist on a Win95-only host].</P
2411 ><P
2412 >&#13;If you have this set up correctly, you will find separate user.DAT and
2413 NTuser.DAT files in the same profile directory.</P
2414 ><DIV
2415 CLASS="NOTE"
2416 ><P
2417 ></P
2418 ><TABLE
2419 CLASS="NOTE"
2420 WIDTH="100%"
2421 BORDER="0"
2422 ><TR
2423 ><TD
2424 WIDTH="25"
2425 ALIGN="CENTER"
2426 VALIGN="TOP"
2427 ><IMG
2428 SRC="/docbook-dsssl/note.gif"
2429 HSPACE="5"
2430 ALT="Note"></TD
2431 ><TD
2432 ALIGN="LEFT"
2433 VALIGN="TOP"
2434 ><P
2435 >[lkcl 25aug97 - there are some issues to resolve with downloading of
2436 NT profiles, probably to do with time/date stamps.  i have found that
2437 NTuser.DAT is never updated on the workstation after the first time that
2438 it is copied to the local workstation profile directory.  this is in
2439 contrast to w95, where it _does_ transfer / update profiles correctly].</P
2440 ></TD
2441 ></TR
2442 ></TABLE
2443 ></DIV
2444 ></DIV
2445 ></DIV
2446 ></DIV
2447 ><DIV
2448 CLASS="SECT1"
2449 ><H1
2450 CLASS="SECT1"
2451 ><A
2452 NAME="AEN1107"
2453 ></A
2454 >7.9. DOMAIN_CONTROL.txt : Windows NT Domain Control &#38; Samba</H1
2455 ><DIV
2456 CLASS="WARNING"
2457 ><P
2458 ></P
2459 ><TABLE
2460 CLASS="WARNING"
2461 WIDTH="100%"
2462 BORDER="0"
2463 ><TR
2464 ><TD
2465 WIDTH="25"
2466 ALIGN="CENTER"
2467 VALIGN="TOP"
2468 ><IMG
2469 SRC="/docbook-dsssl/warning.gif"
2470 HSPACE="5"
2471 ALT="Warning"></TD
2472 ><TH
2473 ALIGN="LEFT"
2474 VALIGN="CENTER"
2475 ><B
2476 >Possibly Outdated Material</B
2477 ></TH
2478 ></TR
2479 ><TR
2480 ><TD
2481 >&nbsp;</TD
2482 ><TD
2483 ALIGN="LEFT"
2484 VALIGN="TOP"
2485 ><P
2486 >       This appendix was originally authored by John H Terpstra of
2487         the Samba Team and is included here for posterity.
2488         </P
2489 ></TD
2490 ></TR
2491 ></TABLE
2492 ></DIV
2493 ><P
2494 ><SPAN
2495 CLASS="emphasis"
2496 ><I
2497 CLASS="EMPHASIS"
2498 >NOTE :</I
2499 ></SPAN
2500 >
2501 The term "Domain Controller" and those related to it refer to one specific
2502 method of authentication that can underly an SMB domain. Domain Controllers
2503 prior to Windows NT Server 3.1 were sold by various companies and based on
2504 private extensions to the LAN Manager 2.1 protocol. Windows NT introduced
2505 Microsoft-specific ways of distributing the user authentication database.
2506 See DOMAIN.txt for examples of how Samba can participate in or create
2507 SMB domains based on shared authentication database schemes other than the
2508 Windows NT SAM.</P
2509 ><P
2510 >Windows NT Server can be installed as either a plain file and print server
2511 (WORKGROUP workstation or server) or as a server that participates in Domain
2512 Control (DOMAIN member, Primary Domain controller or Backup Domain controller).
2513 The same is true for OS/2 Warp Server, Digital Pathworks and other similar
2514 products, all of which can participate in Domain Control along with Windows NT.</P
2515 ><P
2516 >To many people these terms can be confusing, so let's try to clear the air.</P
2517 ><P
2518 >Every Windows NT system (workstation or server) has a registry database.
2519 The registry contains entries that describe the initialization information
2520 for all services (the equivalent of Unix Daemons) that run within the Windows
2521 NT environment. The registry also contains entries that tell application
2522 software where to find dynamically loadable libraries that they depend upon.
2523 In fact, the registry contains entries that describes everything that anything
2524 may need to know to interact with the rest of the system.</P
2525 ><P
2526 >The registry files can be located on any Windows NT machine by opening a
2527 command prompt and typing:</P
2528 ><P
2529 ><TT
2530 CLASS="PROMPT"
2531 >C:\WINNT\&#62;</TT
2532 > dir %SystemRoot%\System32\config</P
2533 ><P
2534 >The environment variable %SystemRoot% value can be obtained by typing:</P
2535 ><P
2536 ><TT
2537 CLASS="PROMPT"
2538 >C:\WINNT&#62;</TT
2539 >echo %SystemRoot%</P
2540 ><P
2541 >The active parts of the registry that you may want to be familiar with are
2542 the files called: default, system, software, sam and security.</P
2543 ><P
2544 >In a domain environment, Microsoft Windows NT domain controllers participate
2545 in replication of the SAM and SECURITY files so that all controllers within
2546 the domain have an exactly identical copy of each.</P
2547 ><P
2548 >The Microsoft Windows NT system is structured within a security model that
2549 says that all applications and services must authenticate themselves before
2550 they can obtain permission from the security manager to do what they set out
2551 to do.</P
2552 ><P
2553 >The Windows NT User database also resides within the registry. This part of
2554 the registry contains the user's security identifier, home directory, group
2555 memberships, desktop profile, and so on.</P
2556 ><P
2557 >Every Windows NT system (workstation as well as server) will have its own
2558 registry. Windows NT Servers that participate in Domain Security control
2559 have a database that they share in common - thus they do NOT own an
2560 independent full registry database of their own, as do Workstations and
2561 plain Servers.</P
2562 ><P
2563 >The User database is called the SAM (Security Access Manager) database and
2564 is used for all user authentication as well as for authentication of inter-
2565 process authentication (i.e. to ensure that the service action a user has
2566 requested is permitted within the limits of that user's privileges).</P
2567 ><P
2568 >The Samba team have produced a utility that can dump the Windows NT SAM into
2569 smbpasswd format: see ENCRYPTION.txt for information on smbpasswd and
2570 /pub/samba/pwdump on your nearest Samba mirror for the utility. This
2571 facility is useful but cannot be easily used to implement SAM replication
2572 to Samba systems.</P
2573 ><P
2574 >Windows for Workgroups, Windows 95, and Windows NT Workstations and Servers
2575 can participate in a Domain security system that is controlled by Windows NT
2576 servers that have been correctly configured. Almost every domain will have
2577 ONE Primary Domain Controller (PDC). It is desirable that each domain will
2578 have at least one Backup Domain Controller (BDC).</P
2579 ><P
2580 >The PDC and BDCs then participate in replication of the SAM database so that
2581 each Domain Controlling participant will have an up to date SAM component
2582 within its registry.</P
2583 ></DIV
2584 ></DIV
2585 ><DIV
2586 CLASS="NAVFOOTER"
2587 ><HR
2588 ALIGN="LEFT"
2589 WIDTH="100%"><TABLE
2590 SUMMARY="Footer navigation table"
2591 WIDTH="100%"
2592 BORDER="0"
2593 CELLPADDING="0"
2594 CELLSPACING="0"
2595 ><TR
2596 ><TD
2597 WIDTH="33%"
2598 ALIGN="left"
2599 VALIGN="top"
2600 ><A
2601 HREF="securitylevels.html"
2602 ACCESSKEY="P"
2603 >Prev</A
2604 ></TD
2605 ><TD
2606 WIDTH="34%"
2607 ALIGN="center"
2608 VALIGN="top"
2609 ><A
2610 HREF="samba-howto-collection.html"
2611 ACCESSKEY="H"
2612 >Home</A
2613 ></TD
2614 ><TD
2615 WIDTH="33%"
2616 ALIGN="right"
2617 VALIGN="top"
2618 ><A
2619 HREF="samba-bdc.html"
2620 ACCESSKEY="N"
2621 >Next</A
2622 ></TD
2623 ></TR
2624 ><TR
2625 ><TD
2626 WIDTH="33%"
2627 ALIGN="left"
2628 VALIGN="top"
2629 >User and Share security level (for servers not in a domain)</TD
2630 ><TD
2631 WIDTH="34%"
2632 ALIGN="center"
2633 VALIGN="top"
2634 ><A
2635 HREF="type.html"
2636 ACCESSKEY="U"
2637 >Up</A
2638 ></TD
2639 ><TD
2640 WIDTH="33%"
2641 ALIGN="right"
2642 VALIGN="top"
2643 >How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain</TD
2644 ></TR
2645 ></TABLE
2646 ></DIV
2647 ></BODY
2648 ></HTML
2649 >