docs/htmldocs/Samba-PDC-HOWTO.html

   1 <HTML
   2 ><HEAD
   3 ><TITLE
   4 >How to Configure Samba 2.2 as a Primary Domain Controller</TITLE
   5 ><META
   6 NAME="GENERATOR"
   7 CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
   8 ><BODY
   9 CLASS="ARTICLE"
  10 BGCOLOR="#FFFFFF"
  11 TEXT="#000000"
  12 LINK="#0000FF"
  13 VLINK="#840084"
  14 ALINK="#0000FF"
  15 ><DIV
  16 CLASS="ARTICLE"
  17 ><DIV
  18 CLASS="TITLEPAGE"
  19 ><H1
  20 CLASS="TITLE"
  21 ><A
  22 NAME="SAMBA-PDC"
  23 >How to Configure Samba 2.2 as a Primary Domain Controller</A
  24 ></H1
  25 ><HR></DIV
  26 ><DIV
  27 CLASS="SECT1"
  28 ><H1
  29 CLASS="SECT1"
  30 ><A
  31 NAME="AEN3"
  32 >Prerequisite Reading</A
  33 ></H1
  34 ><P
  35 >Before you continue reading in this chapter, please make sure
  36 that you are comfortable with configuring basic files services
  37 in smb.conf and how to enable and administer password
  38 encryption in Samba.  Theses two topics are covered in the
  39 <A
  40 HREF="smb.conf.5.html"
  41 TARGET="_top"
  42 ><TT
  43 CLASS="FILENAME"
  44 >smb.conf(5)</TT
  45 ></A
  46 >
  47 manpage and the <A
  48 HREF="ENCRYPTION.html"
  49 TARGET="_top"
  50 >Encryption chapter</A
  51 >
  52 of this HOWTO Collection.</P
  53 ></DIV
  54 ><DIV
  55 CLASS="SECT1"
  56 ><HR><H1
  57 CLASS="SECT1"
  58 ><A
  59 NAME="AEN9"
  60 >Background</A
  61 ></H1
  62 ><DIV
  63 CLASS="NOTE"
  64 ><BLOCKQUOTE
  65 CLASS="NOTE"
  66 ><P
  67 ><B
  68 >Note: </B
  69 ><I
  70 CLASS="EMPHASIS"
  71 >Author's Note :</I
  72 > This document is a combination
  73 of David Bannon's Samba 2.2 PDC HOWTO and the Samba NT Domain FAQ.
  74 Both documents are superseded by this one.</P
  75 ></BLOCKQUOTE
  76 ></DIV
  77 ><P
  78 >Version of Samba prior to release 2.2 had marginal capabilities to
  79 act as a Windows NT 4.0 Primary DOmain Controller  (PDC).  Beginning with
  80 Samba 2.2.0, we are proud to announce official support for Windows NT 4.0
  81 style domain logons from Windows NT 4.0 (through SP6) and Windows 2000 (through
  82 SP1) clients.  This article outlines the steps necessary for configuring Samba
  83 as a PDC.  It is necessary to have a working Samba server prior to implementing the
  84 PDC functionality.  If you have not followed the steps outlined in
  85 <A
  86 HREF="UNIX_INSTALL.html"
  87 TARGET="_top"
  88 > UNIX_INSTALL.html</A
  89 >, please make sure
  90 that your server is configured correctly before proceeding.  Another good
  91 resource in the <A
  92 HREF="smb.conf.5.html"
  93 TARGET="_top"
  94 >smb.conf(5) man
  95 page</A
  96 >. The following  functionality should work in 2.2:</P
  97 ><P
  98 ></P
  99 ><UL
 100 ><LI
 101 ><P
 102 >       domain logons for Windows NT 4.0/2000 clients.
 103         </P
 104 ></LI
 105 ><LI
 106 ><P
 107 >       placing a Windows 9x client in user level security
 108         </P
 109 ></LI
 110 ><LI
 111 ><P
 112 >       retrieving a list of users and groups from a Samba PDC to
 113         Windows 9x/NT/2000 clients
 114         </P
 115 ></LI
 116 ><LI
 117 ><P
 118 >       roving (roaming) user profiles
 119         </P
 120 ></LI
 121 ><LI
 122 ><P
 123 >       Windows NT 4.0 style system policies
 124         </P
 125 ></LI
 126 ></UL
 127 ><DIV
 128 CLASS="WARNING"
 129 ><P
 130 ></P
 131 ><TABLE
 132 CLASS="WARNING"
 133 BORDER="1"
 134 WIDTH="100%"
 135 ><TR
 136 ><TD
 137 ALIGN="CENTER"
 138 ><B
 139 >Windows 2000 Service Pack 2 Clients</B
 140 ></TD
 141 ></TR
 142 ><TR
 143 ><TD
 144 ALIGN="LEFT"
 145 ><P
 146 >       Samba 2.2.1 is required for PDC functionality when using Windows 2000
 147         SP2 clients.
 148         </P
 149 ></TD
 150 ></TR
 151 ></TABLE
 152 ></DIV
 153 ><P
 154 >The following pieces of functionality are not included in the 2.2 release:</P
 155 ><P
 156 ></P
 157 ><UL
 158 ><LI
 159 ><P
 160 >       Windows NT 4 domain trusts
 161         </P
 162 ></LI
 163 ><LI
 164 ><P
 165 >       SAM replication with Windows NT 4.0 Domain Controllers
 166         (i.e. a Samba PDC and a Windows NT BDC or vice versa)
 167         </P
 168 ></LI
 169 ><LI
 170 ><P
 171 >       Adding users via the User Manager for Domains
 172         </P
 173 ></LI
 174 ><LI
 175 ><P
 176 >       Acting as a Windows 2000 Domain Controller (i.e. Kerberos and
 177         Active Directory)
 178         </P
 179 ></LI
 180 ></UL
 181 ><P
 182 >Please note that Windows 9x clients are not true members of a domain
 183 for reasons outlined in this article.  Therefore the protocol for
 184 support Windows 9x style domain logons is completely different
 185 from NT4 domain logons and has been officially supported for some
 186 time.</P
 187 ><P
 188 >Implementing a Samba PDC can basically be divided into 2 broad
 189 steps.</P
 190 ><P
 191 ></P
 192 ><OL
 193 TYPE="1"
 194 ><LI
 195 ><P
 196 >       Configuring the Samba PDC
 197         </P
 198 ></LI
 199 ><LI
 200 ><P
 201 >       Creating machine trust accounts and joining clients
 202         to the domain
 203         </P
 204 ></LI
 205 ></OL
 206 ><P
 207 >There are other minor details such as user profiles, system
 208 policies, etc...  However, these are not necessarily specific
 209 to a Samba PDC as much as they are related to Windows NT networking
 210 concepts.  They will be mentioned only briefly here.</P
 211 ></DIV
 212 ><DIV
 213 CLASS="SECT1"
 214 ><HR><H1
 215 CLASS="SECT1"
 216 ><A
 217 NAME="AEN51"
 218 >Configuring the Samba Domain Controller</A
 219 ></H1
 220 ><P
 221 >The first step in creating a working Samba PDC is to
 222 understand the parameters necessary in smb.conf.  I will not
 223 attempt to re-explain the parameters here as they are more that
 224 adequately covered in <A
 225 HREF="smb.conf.5.html"
 226 TARGET="_top"
 227 > the smb.conf
 228 man page</A
 229 >.  For convenience, the parameters have been
 230 linked with the actual smb.conf description.</P
 231 ><P
 232 >Here is an example smb.conf for acting as a PDC:</P
 233 ><P
 234 ><PRE
 235 CLASS="PROGRAMLISTING"
 236 >[global]
 237     ; Basic server settings
 238     <A
 239 HREF="smb.conf.5.html#NETBIOSNAME"
 240 TARGET="_top"
 241 >netbios name</A
 242 > = <TT
 243 CLASS="REPLACEABLE"
 244 ><I
 245 >POGO</I
 246 ></TT
 247 >
 248     <A
 249 HREF="smb.conf.5.html#WORKGROUP"
 250 TARGET="_top"
 251 >workgroup</A
 252 > = <TT
 253 CLASS="REPLACEABLE"
 254 ><I
 255 >NARNIA</I
 256 ></TT
 257 >
 258
 259     ; we should act as the domain and local master browser
 260     <A
 261 HREF="smb.conf.5.html#OSLEVEL"
 262 TARGET="_top"
 263 >os level</A
 264 > = 64
 265     <A
 266 HREF="smb.conf.5.html#PERFERREDMASTER"
 267 TARGET="_top"
 268 >preferred master</A
 269 > = yes
 270     <A
 271 HREF="smb.conf.5.html#DOMAINMASTER"
 272 TARGET="_top"
 273 >domain master</A
 274 > = yes
 275     <A
 276 HREF="smb.conf.5.html#LOCALMASTER"
 277 TARGET="_top"
 278 >local master</A
 279 > = yes
 280
 281     ; security settings (must user security = user)
 282     <A
 283 HREF="smb.conf.5.html#SECURITYEQUALSUSER"
 284 TARGET="_top"
 285 >security</A
 286 > = user
 287
 288     ; encrypted passwords are a requirement for a PDC
 289     <A
 290 HREF="smb.conf.5.html#ENCRYPTPASSWORDS"
 291 TARGET="_top"
 292 >encrypt passwords</A
 293 > = yes
 294
 295     ; support domain logons
 296     <A
 297 HREF="smb.conf.5.html#DOMAINLOGONS"
 298 TARGET="_top"
 299 >domain logons</A
 300 > = yes
 301
 302     ; where to store user profiles?
 303     <A
 304 HREF="smb.conf.5.html#LOGONPATH"
 305 TARGET="_top"
 306 >logon path</A
 307 > = \\%N\profiles\%u
 308
 309     ; where is a user's home directory and where should it
 310     ; be mounted at?
 311     <A
 312 HREF="smb.conf.5.html#LOGONDRIVE"
 313 TARGET="_top"
 314 >logon drive</A
 315 > = H:
 316     <A
 317 HREF="smb.conf.5.html#LOGONHOME"
 318 TARGET="_top"
 319 >logon home</A
 320 > = \\homeserver\%u
 321
 322     ; specify a generic logon script for all users
 323     ; this is a relative **DOS** path to the [netlogon] share
 324     <A
 325 HREF="smb.conf.5.html#LOGONSCRIPT"
 326 TARGET="_top"
 327 >logon script</A
 328 > = logon.cmd
 329
 330 ; necessary share for domain controller
 331 [netlogon]
 332     <A
 333 HREF="smb.conf.5.html#PATH"
 334 TARGET="_top"
 335 >path</A
 336 > = /usr/local/samba/lib/netlogon
 337     <A
 338 HREF="smb.conf.5.html#WRITEABLE"
 339 TARGET="_top"
 340 >writeable</A
 341 > = no
 342     <A
 343 HREF="smb.conf.5.html#WRITELIST"
 344 TARGET="_top"
 345 >write list</A
 346 > = <TT
 347 CLASS="REPLACEABLE"
 348 ><I
 349 >ntadmin</I
 350 ></TT
 351 >
 352
 353 ; share for storing user profiles
 354 [profiles]
 355     <A
 356 HREF="smb.conf.5.html#PATH"
 357 TARGET="_top"
 358 >path</A
 359 > = /export/smb/ntprofile
 360     <A
 361 HREF="smb.conf.5.html#WRITEABLE"
 362 TARGET="_top"
 363 >writeable</A
 364 > = yes
 365     <A
 366 HREF="smb.conf.5.html#CREATEMASK"
 367 TARGET="_top"
 368 >create mask</A
 369 > = 0600
 370     <A
 371 HREF="smb.conf.5.html#DIRECTORYMASK"
 372 TARGET="_top"
 373 >directory mask</A
 374 > = 0700</PRE
 375 ></P
 376 ><P
 377 >There are a couple of points to emphasize in the above configuration.</P
 378 ><P
 379 ></P
 380 ><UL
 381 ><LI
 382 ><P
 383 >       Encrypted passwords must be enabled.  For more details on how
 384         to do this, refer to <A
 385 HREF="ENCRYPTION.html"
 386 TARGET="_top"
 387 >ENCRYPTION.html</A
 388 >.
 389         </P
 390 ></LI
 391 ><LI
 392 ><P
 393 >       The server must support domain logons and a
 394         <TT
 395 CLASS="FILENAME"
 396 >[netlogon]</TT
 397 > share
 398         </P
 399 ></LI
 400 ><LI
 401 ><P
 402 >       The server must be the domain master browser in order for Windows
 403         client to locate the server as a DC.  Please refer to the various
 404         Network Browsing documentation included with this distribution for
 405         details.
 406         </P
 407 ></LI
 408 ></UL
 409 ><P
 410 >As Samba 2.2 does not offer a complete implementation of group mapping between
 411 Windows NT groups and UNIX groups (this is really quite complicated to explain
 412 in a short space), you should refer to the <A
 413 HREF="smb.conf.5.html#DOMAINADMINGROUP"
 414 TARGET="_top"
 415 >domain
 416 admin group</A
 417 > smb.conf parameter for information of creating "Domain Admins"
 418 style accounts.</P
 419 ></DIV
 420 ><DIV
 421 CLASS="SECT1"
 422 ><HR><H1
 423 CLASS="SECT1"
 424 ><A
 425 NAME="AEN93"
 426 >Creating Machine Trust Accounts and Joining Clients
 427 to the Domain</A
 428 ></H1
 429 ><P
 430 >A machine trust account is a samba user account owned by a computer.
 431 The account password acts as the shared secret for secure
 432 communication with the Domain Controller.  This is a security feature
 433 to prevent an unauthorized machine with the same NetBIOS name from
 434 joining the domain and gaining access to domain user/group accounts.
 435 Hence a Windows 9x host is never a true member of a domain because it does
 436 not posses a machine trust account, and thus has no shared secret with the DC.</P
 437 ><P
 438 >On a Windows NT PDC, these machine trust account passwords are stored
 439 in the registry.  A Samba PDC stores these accounts in the same location
 440 as user LanMan and NT password hashes (currently <TT
 441 CLASS="FILENAME"
 442 >smbpasswd</TT
 443 >).
 444 However, machine trust accounts only possess and use the NT password hash.</P
 445 ><P
 446 >Because Samba requires machine accounts to possess a UNIX uid from
 447 which an Windows NT SID can be generated, all of these accounts
 448 must have an entry in <TT
 449 CLASS="FILENAME"
 450 >/etc/passwd</TT
 451 > and smbpasswd.
 452 Future releases will alleviate the need to create
 453 <TT
 454 CLASS="FILENAME"
 455 >/etc/passwd</TT
 456 > entries.  </P
 457 ><P
 458 >There are two means of creating machine trust accounts.</P
 459 ><P
 460 ></P
 461 ><UL
 462 ><LI
 463 ><P
 464 >       Manual creation before joining the client to the domain.  In this case,
 465         the password is set to a known value -- the lower case of the
 466         machine's NetBIOS name.
 467         </P
 468 ></LI
 469 ><LI
 470 ><P
 471 >       Creation of the account at the time of joining the domain.  In
 472         this case, the session key of the administrative account used to join
 473         the client to the domain acts as an encryption key for setting the
 474         password to a random value (This is the recommended method).
 475         </P
 476 ></LI
 477 ></UL
 478 ><DIV
 479 CLASS="SECT2"
 480 ><HR><H2
 481 CLASS="SECT2"
 482 ><A
 483 NAME="AEN107"
 484 >Manually creating machine trust accounts</A
 485 ></H2
 486 ><P
 487 >The first step in creating a machine trust account by hand is to
 488 create an entry for the machine in /etc/passwd.  This can be done
 489 using <B
 490 CLASS="COMMAND"
 491 >vipw</B
 492 > or any 'add userr' command which is normally
 493 used to create new UNIX accounts.  The following is an example for a Linux
 494 based Samba server:</P
 495 ><P
 496 ><TT
 497 CLASS="PROMPT"
 498 >root# </TT
 499 >/usr/sbin/useradd -g 100 -d /dev/null -c <TT
 500 CLASS="REPLACEABLE"
 501 ><I
 502 >"machine
 503 nickname"</I
 504 ></TT
 505 > -s /bin/false <TT
 506 CLASS="REPLACEABLE"
 507 ><I
 508 >machine_name</I
 509 ></TT
 510 >$ </P
 511 ><P
 512 ><TT
 513 CLASS="PROMPT"
 514 >root# </TT
 515 >passwd -l <TT
 516 CLASS="REPLACEABLE"
 517 ><I
 518 >machine_name</I
 519 ></TT
 520 >$</P
 521 ><P
 522 >The <TT
 523 CLASS="FILENAME"
 524 >/etc/passwd</TT
 525 > entry will list the machine name
 526 with a $ appended, won't have a passwd, will have a null shell and no
 527 home directory. For example a machine called 'doppy' would have an
 528 <TT
 529 CLASS="FILENAME"
 530 >/etc/passwd</TT
 531 > entry like this :</P
 532 ><P
 533 ><PRE
 534 CLASS="PROGRAMLISTING"
 535 >doppy$:x:505:501:<TT
 536 CLASS="REPLACEABLE"
 537 ><I
 538 >machine_nickname</I
 539 ></TT
 540 >:/dev/null:/bin/false</PRE
 541 ></P
 542 ><P
 543 >Above, <TT
 544 CLASS="REPLACEABLE"
 545 ><I
 546 >machine_nickname</I
 547 ></TT
 548 > can be any descriptive name for the
 549 pc i.e. BasementComputer. The <TT
 550 CLASS="REPLACEABLE"
 551 ><I
 552 >machine_name</I
 553 ></TT
 554 > absolutely must be
 555 the NetBIOS name of the pc to be added to the domain.  The "$" must append the NetBIOS
 556 name of the pc or samba will not recognize this as a machine account</P
 557 ><P
 558 >Now that the UNIX account has been created, the next step is to create
 559 the smbpasswd entry for the machine containing the well known initial
 560 trust account password.  This can be done using the <A
 561 HREF="smbpasswd.6.html"
 562 TARGET="_top"
 563 ><B
 564 CLASS="COMMAND"
 565 >smbpasswd(8)</B
 566 ></A
 567 > command
 568 as shown here:</P
 569 ><P
 570 ><TT
 571 CLASS="PROMPT"
 572 >root# </TT
 573 > smbpasswd -a -m <TT
 574 CLASS="REPLACEABLE"
 575 ><I
 576 >machine_name</I
 577 ></TT
 578 ></P
 579 ><P
 580 >where <TT
 581 CLASS="REPLACEABLE"
 582 ><I
 583 >machine_name</I
 584 ></TT
 585 > is the machine's NetBIOS
 586 name. </P
 587 ><DIV
 588 CLASS="WARNING"
 589 ><P
 590 ></P
 591 ><TABLE
 592 CLASS="WARNING"
 593 BORDER="1"
 594 WIDTH="100%"
 595 ><TR
 596 ><TD
 597 ALIGN="CENTER"
 598 ><B
 599 >Join the client to the domain immediately</B
 600 ></TD
 601 ></TR
 602 ><TR
 603 ><TD
 604 ALIGN="LEFT"
 605 ><P
 606 >       Manually creating a machine trust account using this method is the
 607         equivalent of creating a machine account on a Windows NT PDC using
 608         the "Server Manager".  From the time at which the account is created
 609         to the time which th client joins the domain and changes the password,
 610         your domain is vulnerable to an intruder joining your domain using a
 611         a machine with the same NetBIOS name.  A PDC inherently trusts
 612         members of the domain and will serve out a large degree of user
 613         information to such clients.  You have been warned!
 614         </P
 615 ></TD
 616 ></TR
 617 ></TABLE
 618 ></DIV
 619 ></DIV
 620 ><DIV
 621 CLASS="SECT2"
 622 ><HR><H2
 623 CLASS="SECT2"
 624 ><A
 625 NAME="AEN138"
 626 >Creating machine trust accounts "on the fly"</A
 627 ></H2
 628 ><P
 629 >The second, and most recommended way of creating machine trust accounts
 630 is to create them as needed at the time the client is joined to
 631 the domain.  You will need to include a value for the <A
 632 HREF="smb.conf.5.html#ADDUSERSCRIPT"
 633 TARGET="_top"
 634 >add user script</A
 635 >
 636 parameter.  Below is an example from a RedHat 6.2 Linux system.</P
 637 ><P
 638 ><PRE
 639 CLASS="PROGRAMLISTING"
 640 >add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u </PRE
 641 ></P
 642 ><P
 643 >In Samba 2.2.1, <I
 644 CLASS="EMPHASIS"
 645 >only the root account</I
 646 > can be used to create
 647 machine accounts like this.  Therefore, it is required to create
 648 an entry in smbpasswd for <I
 649 CLASS="EMPHASIS"
 650 >root</I
 651 >.  The password
 652 <I
 653 CLASS="EMPHASIS"
 654 >SHOULD</I
 655 > be set to a different password that the
 656 associated <TT
 657 CLASS="FILENAME"
 658 >/etc/passwd</TT
 659 > entry for security reasons.</P
 660 ></DIV
 661 ></DIV
 662 ><DIV
 663 CLASS="SECT1"
 664 ><HR><H1
 665 CLASS="SECT1"
 666 ><A
 667 NAME="AEN149"
 668 >Common Problems and Errors</A
 669 ></H1
 670 ><P
 671 ></P
 672 ><P
 673 ></P
 674 ><UL
 675 ><LI
 676 ><P
 677 >       <I
 678 CLASS="EMPHASIS"
 679 >I cannot include a '$' in a machine name.</I
 680 >
 681         </P
 682 ><P
 683 >       A 'machine name' in (typically) <TT
 684 CLASS="FILENAME"
 685 >/etc/passwd</TT
 686 >
 687         of the machine name with a '$' appended. FreeBSD (and other BSD
 688         systems ?) won't create a user with a '$' in their name.
 689         </P
 690 ><P
 691 >       The problem is only in the program used to make the entry, once
 692         made, it works perfectly. So create a user without the '$' and
 693         use <B
 694 CLASS="COMMAND"
 695 >vipw</B
 696 > to edit the entry, adding the '$'. Or create
 697         the whole entry with vipw if you like, make sure you use a
 698         unique uid !
 699         </P
 700 ></LI
 701 ><LI
 702 ><P
 703 >       <I
 704 CLASS="EMPHASIS"
 705 >I get told "You already have a connection to the Domain...."
 706         or "Cannot join domain, the credentials supplied conflict with an
 707         existing set.." when creating a machine account.</I
 708 >
 709         </P
 710 ><P
 711 >       This happens if you try to create a machine account from the
 712         machine itself and already have a connection (e.g. mapped drive)
 713         to a share (or IPC$) on the Samba PDC.  The following command
 714         will remove all network drive connections:
 715         </P
 716 ><P
 717 >       <TT
 718 CLASS="PROMPT"
 719 >C:\WINNT\&#62;</TT
 720 > <B
 721 CLASS="COMMAND"
 722 >net use * /d</B
 723 >
 724         </P
 725 ><P
 726 >       Further, if the machine is a already a 'member of a workgroup' that
 727         is the same name as the domain you are joining (bad idea) you will
 728         get this message.  Change the workgroup name to something else, it
 729         does not matter what, reboot, and try again.
 730         </P
 731 ></LI
 732 ><LI
 733 ><P
 734 >       <I
 735 CLASS="EMPHASIS"
 736 >The system can not log you on (C000019B)....</I
 737 >
 738         </P
 739 ><P
 740 >I joined the domain successfully but after upgrading
 741         to a newer version of the Samba code I get the message, "The system
 742         can not log you on (C000019B), Please try a gain or consult your
 743         system administrator" when attempting to logon.
 744         </P
 745 ><P
 746 >       This occurs when the domain SID stored in
 747         <TT
 748 CLASS="FILENAME"
 749 >private/WORKGROUP.SID</TT
 750 > is
 751         changed.  For example, you remove the file and <B
 752 CLASS="COMMAND"
 753 >smbd</B
 754 > automatically
 755         creates a new one.  Or you are swapping back and forth between
 756         versions 2.0.7, TNG and the HEAD branch code (not recommended).  The
 757         only way to correct the problem is to restore the original domain
 758         SID or remove the domain client from the domain and rejoin.
 759         </P
 760 ></LI
 761 ><LI
 762 ><P
 763 >       <I
 764 CLASS="EMPHASIS"
 765 >The machine account for this computer either does not
 766         exist or is not accessible.</I
 767 >
 768         </P
 769 ><P
 770 >       When I try to join the domain I get the message "The machine account
 771         for this computer either does not exist or is not accessible". Whats
 772         wrong?
 773         </P
 774 ><P
 775 >       This problem is caused by the PDC not having a suitable machine account.
 776         If you are using the <TT
 777 CLASS="PARAMETER"
 778 ><I
 779 >add user script</I
 780 ></TT
 781 > method to create
 782         accounts then this would indicate that it has not worked. Ensure the domain
 783         admin user system is working.
 784         </P
 785 ><P
 786 >       Alternatively if you are creating account entries manually then they
 787         have not been created correctly. Make sure that you have the entry
 788         correct for the machine account in smbpasswd file on the Samba PDC.
 789         If you added the account using an editor rather than using the smbpasswd
 790         utility, make sure that the account name is the machine NetBIOS name
 791         with a '$' appended to it ( i.e. computer_name$ ). There must be an entry
 792         in both /etc/passwd and the smbpasswd file. Some people have reported
 793         that inconsistent subnet masks between the Samba server and the NT
 794         client have caused this problem.   Make sure that these are consistent
 795         for both client and server.
 796         </P
 797 ></LI
 798 ><LI
 799 ><P
 800 >       <I
 801 CLASS="EMPHASIS"
 802 >When I attempt to login to a Samba Domain from a NT4/W2K workstation,
 803         I get a message about my account being disabled.</I
 804 >
 805         </P
 806 ><P
 807 >       This problem is caused by a PAM related bug in Samba 2.2.0.  This bug is
 808         fixed in 2.2.1.  Other symptoms could be unaccessible shares on
 809         NT/W2K member servers in the domain or the following error in your smbd.log:
 810         passdb/pampass.c:pam_account(268) PAM: UNKNOWN ERROR for User: %user%
 811         </P
 812 ><P
 813 >       At first be ensure to enable the useraccounts with <B
 814 CLASS="COMMAND"
 815 >smbpasswd -e
 816         %user%</B
 817 >, this is normally done, when you create an account.
 818         </P
 819 ><P
 820 >       In order to work around this problem in 2.2.0, configure the
 821         <TT
 822 CLASS="PARAMETER"
 823 ><I
 824 >account</I
 825 ></TT
 826 > control flag in
 827         <TT
 828 CLASS="FILENAME"
 829 >/etc/pam.d/samba</TT
 830 > file as follows:
 831         </P
 832 ><P
 833 ><PRE
 834 CLASS="PROGRAMLISTING"
 835 >       account required        pam_permit.so
 836         </PRE
 837 ></P
 838 ><P
 839 >       If you want to remain backward compatibility to samba 2.0.x use
 840         <TT
 841 CLASS="FILENAME"
 842 >pam_permit.so</TT
 843 >, it's also possible to use
 844         <TT
 845 CLASS="FILENAME"
 846 >pam_pwdb.so</TT
 847 >. There are some bugs if you try to
 848         use <TT
 849 CLASS="FILENAME"
 850 >pam_unix.so</TT
 851 >, if you need this, be ensure to use
 852         the most recent version of this file.
 853         </P
 854 ></LI
 855 ></UL
 856 ></DIV
 857 ><DIV
 858 CLASS="SECT1"
 859 ><HR><H1
 860 CLASS="SECT1"
 861 ><A
 862 NAME="AEN197"
 863 >System Policies and Profiles</A
 864 ></H1
 865 ><P
 866 >Much of the information necessary to implement System Policies and
 867 Roving User Profiles in a Samba domain is the same as that for
 868 implementing these same items in a Windows NT 4.0 domain.
 869 You should read the white paper <A
 870 HREF="http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp"
 871 TARGET="_top"
 872 >Implementing
 873 Profiles and Policies in Windows NT 4.0</A
 874 > available from Microsoft.</P
 875 ><P
 876 >Here are some additional details:</P
 877 ><P
 878 ></P
 879 ><UL
 880 ><LI
 881 ><P
 882 >       <I
 883 CLASS="EMPHASIS"
 884 >What about Windows NT Policy Editor ?</I
 885 >
 886         </P
 887 ><P
 888 >       To create or edit <TT
 889 CLASS="FILENAME"
 890 >ntconfig.pol</TT
 891 > you must use
 892         the NT Server Policy Editor, <B
 893 CLASS="COMMAND"
 894 >poledit.exe</B
 895 >       which
 896         is included with NT Server but <I
 897 CLASS="EMPHASIS"
 898 >not NT Workstation</I
 899 >.
 900         There is a Policy Editor on a NTws
 901         but it is not suitable for creating <I
 902 CLASS="EMPHASIS"
 903 >Domain Policies</I
 904 >.
 905         Further, although the Windows 95
 906         Policy Editor can be installed on an NT Workstation/Server, it will not
 907         work with NT policies because the registry key that are set by the policy templates.
 908         However, the files from the NT Server will run happily enough on an NTws.
 909         You need <TT
 910 CLASS="FILENAME"
 911 >poledit.exe, common.adm</TT
 912 > and <TT
 913 CLASS="FILENAME"
 914 >winnt.adm</TT
 915 >. It is convenient
 916         to put the two *.adm files in <TT
 917 CLASS="FILENAME"
 918 >c:\winnt\inf</TT
 919 > which is where
 920         the binary will look for them unless told otherwise. Note also that that
 921         directory is 'hidden'.
 922         </P
 923 ><P
 924 >       The Windows NT policy editor is also included with the Service Pack 3 (and
 925         later) for Windows NT 4.0. Extract the files using <B
 926 CLASS="COMMAND"
 927 >servicepackname /x</B
 928 >,
 929         i.e. that's <B
 930 CLASS="COMMAND"
 931 >Nt4sp6ai.exe /x</B
 932 > for service pack 6a.  The policy editor,
 933         <B
 934 CLASS="COMMAND"
 935 >poledit.exe</B
 936 > and the associated template files (*.adm) should
 937         be extracted as well.  It is also possible to downloaded the policy template
 938         files for Office97 and get a copy of the policy editor.  Another possible
 939         location is with the Zero Administration Kit available for download from Microsoft.
 940         </P
 941 ></LI
 942 ><LI
 943 ><P
 944 >       <I
 945 CLASS="EMPHASIS"
 946 >Can Win95 do Policies ?</I
 947 >
 948         </P
 949 ><P
 950 >       Install the group policy handler for Win9x to pick up group
 951         policies.   Look on the Win98 CD in <TT
 952 CLASS="FILENAME"
 953 >\tools\reskit\netadmin\poledit</TT
 954 >.
 955         Install group policies on a Win9x client by double-clicking
 956         <TT
 957 CLASS="FILENAME"
 958 >grouppol.inf</TT
 959 >. Log off and on again a couple of
 960         times and see if Win98 picks up group policies.  Unfortunately this needs
 961         to be done on every Win9x machine that uses group policies....
 962         </P
 963 ><P
 964 >       If group policies don't work one reports suggests getting the updated
 965         (read: working) grouppol.dll for Windows 9x. The group list is grabbed
 966         from /etc/group.
 967         </P
 968 ></LI
 969 ><LI
 970 ><P
 971 >       <I
 972 CLASS="EMPHASIS"
 973 >How do I get 'User Manager' and 'Server Manager'</I
 974 >
 975         </P
 976 ><P
 977 >       Since I don't need to buy an NT Server CD now, how do I get
 978         the 'User Manager for Domains', the 'Server Manager' ?
 979         </P
 980 ><P
 981 >       Microsoft distributes a version of these tools called nexus for
 982         installation on Windows 95 systems.  The tools set includes
 983         </P
 984 ><P
 985 ></P
 986 ><UL
 987 ><LI
 988 ><P
 989 >Server Manager</P
 990 ></LI
 991 ><LI
 992 ><P
 993 >User Manager for Domains</P
 994 ></LI
 995 ><LI
 996 ><P
 997 >Event Viewer</P
 998 ></LI
 999 ></UL
1000 ><P
1001 >       Click here to download the archived file <A
1002 HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE"
1003 TARGET="_top"
1004 >ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A
1005 >
1006         </P
1007 ><P
1008 >       The Windows NT 4.0 version of the 'User Manager for
1009         Domains' and 'Server Manager' are available from Microsoft via ftp
1010         from <A
1011 HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE"
1012 TARGET="_top"
1013 >ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A
1014 >
1015         </P
1016 ></LI
1017 ></UL
1018 ></DIV
1019 ><DIV
1020 CLASS="SECT1"
1021 ><HR><H1
1022 CLASS="SECT1"
1023 ><A
1024 NAME="AEN241"
1025 >What other help can I get ?</A
1026 ></H1
1027 ><P
1028 >There are many sources of information available in the form
1029 of mailing lists, RFC's and documentation.  The docs that come
1030 with the samba distribution contain very good explanations of
1031 general SMB topics such as browsing.</P
1032 ><P
1033 ></P
1034 ><UL
1035 ><LI
1036 ><P
1037 >       <I
1038 CLASS="EMPHASIS"
1039 >What are some diagnostics tools I can use to debug the domain logon
1040         process and where can I find them?</I
1041 >
1042         </P
1043 ><P
1044 >       One of the best diagnostic tools for debugging problems is Samba itself.
1045         You can use the -d option for both smbd and nmbd to specify what
1046         'debug level' at which to run.  See the man pages on smbd, nmbd  and
1047         smb.conf for more information on debugging options.  The debug
1048         level can range from 1 (the default) to 10 (100 for debugging passwords).
1049         </P
1050 ><P
1051 >       Another helpful method of debugging is to compile samba using the
1052         <B
1053 CLASS="COMMAND"
1054 >gcc -g </B
1055 > flag.   This will include debug
1056         information in the binaries and allow you to attach gdb to the
1057         running smbd / nmbd process.  In order to attach gdb to an smbd
1058         process for an NT workstation, first get the workstation to make the
1059         connection. Pressing ctrl-alt-delete and going down to the domain box
1060         is sufficient (at least, on the first time you join the domain) to
1061         generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation
1062         maintains an open connection, and therefore there will be an smbd
1063         process running (assuming that you haven't set a really short smbd
1064         idle timeout)  So, in between pressing ctrl alt delete, and actually
1065         typing in your password, you can gdb attach and continue.
1066         </P
1067 ><P
1068 >       Some useful samba commands worth investigating:
1069         </P
1070 ><P
1071 ></P
1072 ><UL
1073 ><LI
1074 ><P
1075 >testparam | more</P
1076 ></LI
1077 ><LI
1078 ><P
1079 >smbclient -L //{netbios name of server}</P
1080 ></LI
1081 ></UL
1082 ><P
1083 >       An SMB enabled version of tcpdump is available from
1084         <A
1085 HREF="http://www.tcpdump.org/"
1086 TARGET="_top"
1087 >http://www.tcpdup.org/</A
1088 >.
1089         Ethereal, another good packet sniffer for UNIX and Win32
1090         hosts, can be downloaded from <A
1091 HREF="http://www.ethereal.com/"
1092 TARGET="_top"
1093 >http://www.ethereal.com</A
1094 >.
1095         </P
1096 ><P
1097 >       For tracing things on the Microsoft Windows NT, Network Monitor
1098         (aka. netmon) is available on the Microsoft Developer Network CD's,
1099         the Windows NT Server install CD and the SMS CD's.  The version of
1100         netmon that ships with SMS allows for dumping packets between any two
1101         computers (i.e. placing the network interface in promiscuous mode).
1102         The version on the NT Server install CD will only allow monitoring
1103         of network traffic directed to the local NT box and broadcasts on the
1104         local subnet.  Be aware that Ethereal can read and write netmon
1105         formatted files.
1106         </P
1107 ></LI
1108 ><LI
1109 ><P
1110 >       <I
1111 CLASS="EMPHASIS"
1112 >How do I install 'Network Monitor' on an NT Workstation
1113         or a Windows 9x box?</I
1114 >
1115         </P
1116 ><P
1117 >       Installing netmon on an NT workstation requires a couple
1118         of steps.  The following are for installing Netmon V4.00.349, which comes
1119         with Microsoft Windows NT Server 4.0, on Microsoft Windows NT
1120         Workstation 4.0.  The process should be similar for other version of
1121         Windows NT / Netmon.  You will need both the Microsoft Windows
1122         NT Server 4.0 Install CD and the Workstation 4.0 Install CD.
1123         </P
1124 ><P
1125 >       Initially you will need to install 'Network Monitor Tools and Agent'
1126         on the NT Server.  To do this
1127         </P
1128 ><P
1129 ></P
1130 ><UL
1131 ><LI
1132 ><P
1133 >Goto Start - Settings - Control Panel -
1134                 Network - Services - Add </P
1135 ></LI
1136 ><LI
1137 ><P
1138 >Select the 'Network Monitor Tools and Agent' and
1139                 click on 'OK'.</P
1140 ></LI
1141 ><LI
1142 ><P
1143 >Click 'OK' on the Network Control Panel.
1144                 </P
1145 ></LI
1146 ><LI
1147 ><P
1148 >Insert the Windows NT Server 4.0 install CD
1149                 when prompted.</P
1150 ></LI
1151 ></UL
1152 ><P
1153 >       At this point the Netmon files should exist in
1154         <TT
1155 CLASS="FILENAME"
1156 >%SYSTEMROOT%\System32\netmon\*.*</TT
1157 >.
1158         Two subdirectories exist as well, <TT
1159 CLASS="FILENAME"
1160 >parsers\</TT
1161 >
1162         which contains the necessary DLL's for parsing the netmon packet
1163         dump, and <TT
1164 CLASS="FILENAME"
1165 >captures\</TT
1166 >.
1167         </P
1168 ><P
1169 >       In order to install the Netmon tools on an NT Workstation, you will
1170         first need to install the 'Network  Monitor Agent' from the Workstation
1171         install CD.
1172         </P
1173 ><P
1174 ></P
1175 ><UL
1176 ><LI
1177 ><P
1178 >Goto Start - Settings - Control Panel -
1179                 Network - Services - Add</P
1180 ></LI
1181 ><LI
1182 ><P
1183 >Select the 'Network Monitor Agent' and click
1184                 on 'OK'.</P
1185 ></LI
1186 ><LI
1187 ><P
1188 >Click 'OK' on the Network Control Panel.
1189                 </P
1190 ></LI
1191 ><LI
1192 ><P
1193 >Insert the Windows NT Workstation 4.0 install
1194                 CD when prompted.</P
1195 ></LI
1196 ></UL
1197 ><P
1198 >       Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.*
1199         to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set
1200         permissions as  you deem appropriate for your site. You will need
1201         administrative rights on the NT box to run netmon.
1202         </P
1203 ><P
1204 >       To install Netmon on a Windows 9x box install the network monitor agent
1205         from the Windows 9x CD (\admin\nettools\netmon).  There is a readme
1206         file located with the netmon driver files on the CD if you need
1207         information on how to do this.  Copy the files from a working
1208         Netmon installation.
1209         </P
1210 ></LI
1211 ><LI
1212 ><P
1213 >       The following is a list if helpful URLs and other links:
1214         </P
1215 ><P
1216 ></P
1217 ><UL
1218 ><LI
1219 ><P
1220 >Home of Samba site <A
1221 HREF="http://samba.org"
1222 TARGET="_top"
1223 >        http://samba.org</A
1224 >. We have a mirror near you !</P
1225 ></LI
1226 ><LI
1227 ><P
1228 > The <I
1229 CLASS="EMPHASIS"
1230 >Development</I
1231 > document
1232         on the Samba mirrors might mention your problem. If so,
1233         it might mean that the developers are working on it.</P
1234 ></LI
1235 ><LI
1236 ><P
1237 >See how Scott Merrill simulates a BDC behavior at
1238         <A
1239 HREF="http://www.skippy.net/linux/smb-howto.html"
1240 TARGET="_top"
1241 >        http://www.skippy.net/linux/smb-howto.html</A
1242 >. </P
1243 ></LI
1244 ><LI
1245 ><P
1246 >Although 2.0.7 has almost had its day as a PDC, David Bannon will
1247         keep the 2.0.7 PDC pages at <A
1248 HREF="http://bioserve.latrobe.edu.au/samba"
1249 TARGET="_top"
1250 >        http://bioserve.latrobe.edu.au/samba</A
1251 > going for a while yet.</P
1252 ></LI
1253 ><LI
1254 ><P
1255 >Misc links to CIFS information
1256         <A
1257 HREF="http://samba.org/cifs/"
1258 TARGET="_top"
1259 >http://samba.org/cifs/</A
1260 ></P
1261 ></LI
1262 ><LI
1263 ><P
1264 >NT Domains for Unix <A
1265 HREF="http://mailhost.cb1.com/~lkcl/ntdom/"
1266 TARGET="_top"
1267 >        http://mailhost.cb1.com/~lkcl/ntdom/</A
1268 ></P
1269 ></LI
1270 ><LI
1271 ><P
1272 >FTP site for older SMB specs:
1273         <A
1274 HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/"
1275 TARGET="_top"
1276 >        ftp://ftp.microsoft.com/developr/drg/CIFS/</A
1277 ></P
1278 ></LI
1279 ></UL
1280 ></LI
1281 ></UL
1282 ><P
1283 ></P
1284 ><UL
1285 ><LI
1286 ><P
1287 >       <I
1288 CLASS="EMPHASIS"
1289 >How do I get help from the mailing lists ?</I
1290 >
1291         </P
1292 ><P
1293 >       There are a number of Samba related mailing lists. Go to <A
1294 HREF="http://samba.org"
1295 TARGET="_top"
1296 >http://samba.org</A
1297 >, click on your nearest mirror
1298         and then click on <B
1299 CLASS="COMMAND"
1300 >Support</B
1301 > and then click on <B
1302 CLASS="COMMAND"
1303 >       Samba related mailing lists</B
1304 >.
1305         </P
1306 ><P
1307 >       For questions relating to Samba TNG go to
1308         <A
1309 HREF="http://www.samba-tng.org/"
1310 TARGET="_top"
1311 >http://www.samba-tng.org/</A
1312 >
1313         It has been requested that you don't post questions about Samba-TNG to the
1314         main stream Samba lists.</P
1315 ><P
1316 >       If you post a message to one of the lists please observe the following guide lines :
1317         </P
1318 ><P
1319 ></P
1320 ><UL
1321 ><LI
1322 ><P
1323 > Always remember that the developers are volunteers, they are
1324                 not paid and they never guarantee to produce a particular feature at
1325                 a particular time. Any time lines are 'best guess' and nothing more.
1326                 </P
1327 ></LI
1328 ><LI
1329 ><P
1330 > Always mention what version of samba you are using and what
1331                 operating system its running under. You should probably list the
1332         relevant sections of your smb.conf file, at least the options
1333         in [global] that affect PDC support.</P
1334 ></LI
1335 ><LI
1336 ><P
1337 >In addition to the version, if you obtained Samba via
1338         CVS mention the date when you last checked it out.</P
1339 ></LI
1340 ><LI
1341 ><P
1342 > Try and make your question clear and brief, lots of long,
1343                 convoluted questions get deleted before they are completely read !
1344                 Don't post html encoded messages (if you can select colour or font
1345                 size its html).</P
1346 ></LI
1347 ><LI
1348 ><P
1349 > If you run one of those nifty 'I'm on holidays' things when
1350                 you are away, make sure its configured  to not answer mailing lists.
1351                 </P
1352 ></LI
1353 ><LI
1354 ><P
1355 > Don't cross post. Work out which is the best list to post to
1356                 and see what happens, i.e. don't post to both samba-ntdom and samba-technical.
1357         Many people active on the lists subscribe to more
1358                 than one list and get annoyed to see the same message two or more times.
1359                 Often someone will see a message and thinking it would be better dealt
1360                 with on another, will forward it on for you.</P
1361 ></LI
1362 ><LI
1363 ><P
1364 >You might include <I
1365 CLASS="EMPHASIS"
1366 >partial</I
1367 >
1368         log files written at a debug level set to as much as 20.
1369         Please don't send the entire log but enough to give the context of the
1370         error messages.</P
1371 ></LI
1372 ><LI
1373 ><P
1374 >(Possibly) If you have a complete netmon trace ( from the opening of
1375         the pipe to the error ) you can send the *.CAP file as well.</P
1376 ></LI
1377 ><LI
1378 ><P
1379 >Please think carefully before attaching a document to an email.
1380         Consider pasting the relevant parts into the body of the message. The samba
1381         mailing lists go to a huge number of people, do they all need a copy of your
1382         smb.conf in their attach directory ?</P
1383 ></LI
1384 ></UL
1385 ></LI
1386 ><LI
1387 ><P
1388 >       <I
1389 CLASS="EMPHASIS"
1390 >How do I get off the mailing lists ?</I
1391 >
1392         </P
1393 ><P
1394 >To have your name removed from a samba mailing list, go to the
1395         same place you went to to get on it. Go to <A
1396 HREF="http://lists.samba.org/"
1397 TARGET="_top"
1398 >http://lists.samba.org</A
1399 >,
1400         click on your nearest mirror and then click on <B
1401 CLASS="COMMAND"
1402 >Support</B
1403 > and
1404         then click on <B
1405 CLASS="COMMAND"
1406 > Samba related mailing lists</B
1407 >. Or perhaps see
1408         <A
1409 HREF="http://lists.samba.org/mailman/roster/samba-ntdom"
1410 TARGET="_top"
1411 >here</A
1412 >
1413         </P
1414 ><P
1415 >       Please don't post messages to the list asking to be removed, you will just
1416         be referred to the above address (unless that process failed in some way...)
1417         </P
1418 ></LI
1419 ></UL
1420 ></DIV
1421 ><DIV
1422 CLASS="SECT1"
1423 ><HR><H1
1424 CLASS="SECT1"
1425 ><A
1426 NAME="AEN355"
1427 >Domain Control for Windows 9x/ME</A
1428 ></H1
1429 ><DIV
1430 CLASS="NOTE"
1431 ><BLOCKQUOTE
1432 CLASS="NOTE"
1433 ><P
1434 ><B
1435 >Note: </B
1436 >The following section contains much of the original
1437 DOMAIN.txt file previously included with Samba.  Much of
1438 the material is based on what went into the book Special
1439 Edition, Using Samba. (Richard Sharpe)</P
1440 ></BLOCKQUOTE
1441 ></DIV
1442 ><P
1443 >A domain and a workgroup are exactly the same thing in terms of network
1444 browsing.  The difference is that a distributable authentication
1445 database is associated with a domain, for secure login access to a
1446 network.  Also, different access rights can be granted to users if they
1447 successfully authenticate against a domain logon server (NT server and
1448 other systems based on NT server support this, as does at least Samba TNG now).</P
1449 ><P
1450 >The SMB client logging on to a domain has an expectation that every other
1451 server in the domain should accept the same authentication information.
1452 Network browsing functionality of domains and workgroups is
1453 identical and is explained in BROWSING.txt. It should be noted, that browsing
1454 is total orthogonal to logon support.</P
1455 ><P
1456 >Issues related to the single-logon network model are discussed in this
1457 document.  Samba supports domain logons, network logon scripts, and user
1458 profiles for MS Windows for workgroups and MS Windows 9X clients.</P
1459 ><P
1460 >When an SMB client in a domain wishes to logon it broadcast requests for a
1461 logon server.  The first one to reply gets the job, and validates its
1462 password using whatever mechanism the Samba administrator has installed.
1463 It is possible (but very stupid) to create a domain where the user
1464 database is not shared between servers, i.e. they are effectively workgroup
1465 servers advertising themselves as participating in a domain.  This
1466 demonstrates how authentication is quite different from but closely
1467 involved with domains.</P
1468 ><P
1469 >Another thing commonly associated with single-logon domains is remote
1470 administration over the SMB protocol.  Again, there is no reason why this
1471 cannot be implemented with an underlying username database which is
1472 different from the Windows NT SAM.  Support for the Remote Administration
1473 Protocol is planned for a future release of Samba.</P
1474 ><P
1475 >Network logon support as discussed in this section is aimed at Window for
1476 Workgroups, and Windows 9X clients. </P
1477 ><P
1478 >Support for profiles is confirmed as working for Win95, NT 4.0 and NT 3.51.
1479 It is possible to specify: the profile location; script file to be loaded
1480 on login; the user's home directory; and for NT a kick-off time could also
1481 now easily be supported. However, there are some differences between Win9X
1482 profile support and WinNT profile support. These are discussed below.</P
1483 ><P
1484 >With NT Workstations, all this does not require the use or intervention of
1485 an NT 4.0 or NT 3.51 server: Samba can now replace the logon services
1486 provided by an NT server, to a limited and experimental degree (for example,
1487 running "User Manager for Domains" will not provide you with access to
1488 a domain created by a Samba Server).</P
1489 ><P
1490 >With Win95, the help of an NT server can be enlisted, both for profile storage
1491 and for user authentication.  For details on user authentication, see
1492 security_level.txt.  For details on profile storage, see below.</P
1493 ><P
1494 >Using these features you can make your clients verify their logon via
1495 the Samba server; make clients run a batch file when they logon to
1496 the network and download their preferences, desktop and start menu.</P
1497 ><P
1498 >Before launching into the configuration instructions, it is worthwhile looking
1499 at how a Win9X client performs a logon:</P
1500 ><P
1501 ></P
1502 ><OL
1503 TYPE="1"
1504 ><LI
1505 ><P
1506 >       The client broadcasts (to the IP broadcast address of the subnet it is in)
1507         a NetLogon request. This is sent to the NetBIOS address DOMAIN&#60;00&#62; at the
1508         NetBIOS layer.  The client chooses the first response it receives, which
1509         contains the NetBIOS name of the logon server to use in the format of
1510         \\SERVER.
1511         </P
1512 ></LI
1513 ><LI
1514 ><P
1515 >       The client then connects to that server, logs on (does an SMBsessetupX) and
1516         then connects to the IPC$ share (using an SMBtconX).
1517         </P
1518 ></LI
1519 ><LI
1520 ><P
1521 >       The client then does a NetWkstaUserLogon request, which retrieves the name
1522         of the user's logon script.
1523         </P
1524 ></LI
1525 ><LI
1526 ><P
1527 >       The client then connects to the NetLogon share and searches for this
1528         and if it is found and can be read, is retrieved and executed by the client.
1529         After this, the client disconnects from the NetLogon share.
1530         </P
1531 ></LI
1532 ><LI
1533 ><P
1534 >       The client then sends a NetUserGetInfo request to the server, to retrieve
1535         the user's home share, which is used to search for profiles. Since the
1536         response to the NetUserGetInfo request does not contain much more
1537         the user's home share, profiles for Win9X clients MUST reside in the user
1538         home directory.
1539         </P
1540 ></LI
1541 ><LI
1542 ><P
1543 >       The client then connects to the user's home share and searches for the
1544         user's profile. As it turns out, you can specify the user's home share as
1545         a sharename and path. For example, \\server\fred\.profile.
1546         If the profiles are found, they are implemented.
1547         </P
1548 ></LI
1549 ><LI
1550 ><P
1551 >       The client then disconnects from the user's home share, and reconnects to
1552         the NetLogon share and looks for CONFIG.POL, the policies file. If this is
1553         found, it is read and implemented.
1554         </P
1555 ></LI
1556 ></OL
1557 ><DIV
1558 CLASS="SECT2"
1559 ><HR><H2
1560 CLASS="SECT2"
1561 ><A
1562 NAME="AEN385"
1563 >Configuration Instructions:    Network Logons</A
1564 ></H2
1565 ><P
1566 >To use domain logons and profiles you need to do the following:</P
1567 ><P
1568 ></P
1569 ><OL
1570 TYPE="1"
1571 ><LI
1572 ><P
1573 >       Create a share called [netlogon] in your smb.conf. This share should
1574         be readable by all users, and probably should not be writeable. This
1575         share will hold your network logon scripts, and the CONFIG.POL file
1576         (Note: for details on the CONFIG.POL file, how to use it, what it is,
1577         refer to the Microsoft Windows NT Administration documentation.
1578         The format of these files is not known, so you will need to use
1579         Microsoft tools).
1580         </P
1581 ><P
1582 >       For example I have used:
1583         </P
1584 ><P
1585 ><PRE
1586 CLASS="PROGRAMLISTING"
1587 >[netlogon]
1588      path = /data/dos/netlogon
1589      writeable = no
1590      guest ok = no</PRE
1591 ></P
1592 ><P
1593 >       Note that it is important that this share is not writeable by ordinary
1594         users, in a secure environment: ordinary users should not be allowed
1595         to modify or add files that another user's computer would then download
1596         when they log in.
1597         </P
1598 ></LI
1599 ><LI
1600 ><P
1601 >       in the [global] section of smb.conf set the following:
1602         </P
1603 ><P
1604 ><PRE
1605 CLASS="PROGRAMLISTING"
1606 >domain logons = yes
1607 logon script = %U.bat
1608         </PRE
1609 ></P
1610 ><P
1611 >       The choice of batch file is, of course, up to you. The above would
1612         give each user a separate batch file as the %U will be changed to
1613         their username automatically. The other standard % macros may also be
1614         used. You can make the batch files come from a subdirectory by using
1615         something like:
1616         </P
1617 ><P
1618 ><PRE
1619 CLASS="PROGRAMLISTING"
1620 >logon script = scripts\%U.bat
1621         </PRE
1622 ></P
1623 ></LI
1624 ><LI
1625 ><P
1626 >       create the batch files to be run when the user logs in. If the batch
1627         file doesn't exist then no batch file will be run.
1628         </P
1629 ><P
1630 >       In the batch files you need to be careful to use DOS style cr/lf line
1631         endings. If you don't then DOS may get confused. I suggest you use a
1632         DOS editor to remotely edit the files if you don't know how to produce
1633         DOS style files under unix.
1634         </P
1635 ></LI
1636 ><LI
1637 ><P
1638 >       Use smbclient with the -U option for some users to make sure that
1639         the \\server\NETLOGON share is available, the batch files are
1640         visible and they are readable by the users.
1641         </P
1642 ></LI
1643 ><LI
1644 ><P
1645 >       you will probably find that your clients automatically mount the
1646         \\SERVER\NETLOGON share as drive z: while logging in. You can put
1647         some useful programs there to execute from the batch files.
1648         </P
1649 ></LI
1650 ></OL
1651 ><DIV
1652 CLASS="WARNING"
1653 ><P
1654 ></P
1655 ><TABLE
1656 CLASS="WARNING"
1657 BORDER="1"
1658 WIDTH="100%"
1659 ><TR
1660 ><TD
1661 ALIGN="CENTER"
1662 ><B
1663 >security mode and master browsers</B
1664 ></TD
1665 ></TR
1666 ><TR
1667 ><TD
1668 ALIGN="LEFT"
1669 ><P
1670 >There are a few comments to make in order to tie up some
1671 loose ends.  There has been much debate over the issue of whether
1672 or not it is ok to configure Samba as a Domain Controller in security
1673 modes other than <TT
1674 CLASS="CONSTANT"
1675 >USER</TT
1676 >.  The only security mode
1677 which  will not work due to technical reasons is <TT
1678 CLASS="CONSTANT"
1679 >SHARE</TT
1680 >
1681 mode security.  <TT
1682 CLASS="CONSTANT"
1683 >DOMAIN</TT
1684 > and <TT
1685 CLASS="CONSTANT"
1686 >SERVER</TT
1687 >
1688 mode security is really just a variation on SMB user level security.</P
1689 ><P
1690 >Actually, this issue is also closer tied to the debate on whether
1691 or not Samba must be the domain master browser for its workgroup
1692 when operating as a DC.  While it may technically be possible
1693 to configure a server as such (after all, browsing and domain logons
1694 are two distinctly different functions), it is not a good idea to
1695 so.  You should remember that the DC must register the DOMAIN#1b NetBIOS
1696 name.  This is the name used by Windows clients to locate the DC.
1697 Windows clients do not distinguish between the DC and the DMB.
1698 For this reason, it is very wise to configure the Samba DC as the DMB.</P
1699 ><P
1700 >Now back to the issue of configuring a Samba DC to use a mode other
1701 than "security = user".  If a Samba host is configured to use
1702 another SMB server or DC in order to validate user connection
1703 requests, then it is a fact that some other machine on the network
1704 (the "password server") knows more about user than the Samba host.
1705 99% of the time, this other host is a domain controller.  Now
1706 in order to operate in domain mode security, the "workgroup" parameter
1707 must be set to the name of the Windows NT domain (which already
1708 has a domain controller, right?)</P
1709 ><P
1710 >Therefore configuring a Samba box as a DC for a domain that
1711 already by definition has a PDC is asking for trouble.
1712 Therefore, you should always configure the Samba DC to be the DMB
1713 for its domain.</P
1714 ></TD
1715 ></TR
1716 ></TABLE
1717 ></DIV
1718 ></DIV
1719 ><DIV
1720 CLASS="SECT2"
1721 ><HR><H2
1722 CLASS="SECT2"
1723 ><A
1724 NAME="AEN419"
1725 >Configuration Instructions:    Setting up Roaming User Profiles</A
1726 ></H2
1727 ><DIV
1728 CLASS="WARNING"
1729 ><P
1730 ></P
1731 ><TABLE
1732 CLASS="WARNING"
1733 BORDER="1"
1734 WIDTH="100%"
1735 ><TR
1736 ><TD
1737 ALIGN="CENTER"
1738 ><B
1739 >Warning</B
1740 ></TD
1741 ></TR
1742 ><TR
1743 ><TD
1744 ALIGN="LEFT"
1745 ><P
1746 ><I
1747 CLASS="EMPHASIS"
1748 >NOTE!</I
1749 > Roaming profiles support is different
1750 for Win9X and WinNT.</P
1751 ></TD
1752 ></TR
1753 ></TABLE
1754 ></DIV
1755 ><P
1756 >Before discussing how to configure roaming profiles, it is useful to see how
1757 Win9X and WinNT clients implement these features.</P
1758 ><P
1759 >Win9X clients send a NetUserGetInfo request to the server to get the user's
1760 profiles location. However, the response does not have room for a separate
1761 profiles location field, only the user's home share. This means that Win9X
1762 profiles are restricted to being in the user's home directory.</P
1763 ><P
1764 >WinNT clients send a NetSAMLogon RPC request, which contains many fields,
1765 including a separate field for the location of the user's profiles.
1766 This means that support for profiles is different for Win9X and WinNT.</P
1767 ><DIV
1768 CLASS="SECT3"
1769 ><HR><H3
1770 CLASS="SECT3"
1771 ><A
1772 NAME="AEN427"
1773 >Windows NT Configuration</A
1774 ></H3
1775 ><P
1776 >To support WinNT clients, inn the [global] section of smb.conf set the
1777 following (for example):</P
1778 ><P
1779 ><PRE
1780 CLASS="PROGRAMLISTING"
1781 >logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath</PRE
1782 ></P
1783 ><P
1784 >The default for this option is \\%N\%U\profile, namely
1785 \\sambaserver\username\profile.  The \\N%\%U service is created
1786 automatically by the [homes] service.
1787 If you are using a samba server for the profiles, you _must_ make the
1788 share specified in the logon path browseable. </P
1789 ><DIV
1790 CLASS="NOTE"
1791 ><BLOCKQUOTE
1792 CLASS="NOTE"
1793 ><P
1794 ><B
1795 >Note: </B
1796 >[lkcl 26aug96 - we have discovered a problem where Windows clients can
1797 maintain a connection to the [homes] share in between logins.  The
1798 [homes] share must NOT therefore be used in a profile path.]</P
1799 ></BLOCKQUOTE
1800 ></DIV
1801 ></DIV
1802 ><DIV
1803 CLASS="SECT3"
1804 ><HR><H3
1805 CLASS="SECT3"
1806 ><A
1807 NAME="AEN435"
1808 >Windows 9X Configuration</A
1809 ></H3
1810 ><P
1811 >To support Win9X clients, you must use the "logon home" parameter. Samba has
1812 now been fixed so that "net use/home" now works as well, and it, too, relies
1813 on the "logon home" parameter.</P
1814 ><P
1815 >By using the logon home parameter, you are restricted to putting Win9X
1816 profiles in the user's home directory.   But wait! There is a trick you
1817 can use. If you set the following in the [global] section of your
1818 smb.conf file:</P
1819 ><P
1820 ><PRE
1821 CLASS="PROGRAMLISTING"
1822 >logon home = \\%L\%U\.profiles</PRE
1823 ></P
1824 ><P
1825 >then your Win9X clients will dutifully put their clients in a subdirectory
1826 of your home directory called .profiles (thus making them hidden).</P
1827 ><P
1828 >Not only that, but 'net use/home' will also work, because of a feature in
1829 Win9X. It removes any directory stuff off the end of the home directory area
1830 and only uses the server and share portion. That is, it looks like you
1831 specified \\%L\%U for "logon home".</P
1832 ></DIV
1833 ><DIV
1834 CLASS="SECT3"
1835 ><HR><H3
1836 CLASS="SECT3"
1837 ><A
1838 NAME="AEN443"
1839 >Win9X and WinNT Configuration</A
1840 ></H3
1841 ><P
1842 >You can support profiles for both Win9X and WinNT clients by setting both the
1843 "logon home" and "logon path" parameters. For example:</P
1844 ><P
1845 ><PRE
1846 CLASS="PROGRAMLISTING"
1847 >logon home = \\%L\%U\.profiles
1848 logon path = \\%L\profiles\%U</PRE
1849 ></P
1850 ><DIV
1851 CLASS="NOTE"
1852 ><BLOCKQUOTE
1853 CLASS="NOTE"
1854 ><P
1855 ><B
1856 >Note: </B
1857 >I have not checked what 'net use /home' does on NT when "logon home" is
1858 set as above.</P
1859 ></BLOCKQUOTE
1860 ></DIV
1861 ></DIV
1862 ><DIV
1863 CLASS="SECT3"
1864 ><HR><H3
1865 CLASS="SECT3"
1866 ><A
1867 NAME="AEN450"
1868 >Windows 9X Profile Setup</A
1869 ></H3
1870 ><P
1871 >When a user first logs in on Windows 9X, the file user.DAT is created,
1872 as are folders "Start Menu", "Desktop", "Programs" and "Nethood".
1873 These directories and their contents will be merged with the local
1874 versions stored in c:\windows\profiles\username on subsequent logins,
1875 taking the most recent from each.  You will need to use the [global]
1876 options "preserve case = yes", "short preserve case = yes" and
1877 "case sensitive = no" in order to maintain capital letters in shortcuts
1878 in any of the profile folders.</P
1879 ><P
1880 >The user.DAT file contains all the user's preferences.  If you wish to
1881 enforce a set of preferences, rename their user.DAT file to user.MAN,
1882 and deny them write access to this file.</P
1883 ><P
1884 ></P
1885 ><OL
1886 TYPE="1"
1887 ><LI
1888 ><P
1889 >       On the Windows 95 machine, go to Control Panel | Passwords and
1890         select the User Profiles tab.  Select the required level of
1891         roaming preferences.  Press OK, but do _not_ allow the computer
1892         to reboot.
1893         </P
1894 ></LI
1895 ><LI
1896 ><P
1897 >       On the Windows 95 machine, go to Control Panel | Network |
1898         Client for Microsoft Networks | Preferences.  Select 'Log on to
1899         NT Domain'.  Then, ensure that the Primary Logon is 'Client for
1900         Microsoft Networks'.  Press OK, and this time allow the computer
1901         to reboot.
1902         </P
1903 ></LI
1904 ></OL
1905 ><P
1906 >Under Windows 95, Profiles are downloaded from the Primary Logon.
1907 If you have the Primary Logon as 'Client for Novell Networks', then
1908 the profiles and logon script will be downloaded from your Novell
1909 Server.  If you have the Primary Logon as 'Windows Logon', then the
1910 profiles will be loaded from the local machine - a bit against the
1911 concept of roaming profiles, if you ask me.</P
1912 ><P
1913 >You will now find that the Microsoft Networks Login box contains
1914 [user, password, domain] instead of just [user, password].  Type in
1915 the samba server's domain name (or any other domain known to exist,
1916 but bear in mind that the user will be authenticated against this
1917 domain and profiles downloaded from it, if that domain logon server
1918 supports it), user name and user's password.</P
1919 ><P
1920 >Once the user has been successfully validated, the Windows 95 machine
1921 will inform you that 'The user has not logged on before' and asks you
1922 if you wish to save the user's preferences?  Select 'yes'.</P
1923 ><P
1924 >Once the Windows 95 client comes up with the desktop, you should be able
1925 to examine the contents of the directory specified in the "logon path"
1926 on the samba server and verify that the "Desktop", "Start Menu",
1927 "Programs" and "Nethood" folders have been created.</P
1928 ><P
1929 >These folders will be cached locally on the client, and updated when
1930 the user logs off (if you haven't made them read-only by then :-).
1931 You will find that if the user creates further folders or short-cuts,
1932 that the client will merge the profile contents downloaded with the
1933 contents of the profile directory already on the local client, taking
1934 the newest folders and short-cuts from each set.</P
1935 ><P
1936 >If you have made the folders / files read-only on the samba server,
1937 then you will get errors from the w95 machine on logon and logout, as
1938 it attempts to merge the local and the remote profile.  Basically, if
1939 you have any errors reported by the w95 machine, check the unix file
1940 permissions and ownership rights on the profile directory contents,
1941 on the samba server.</P
1942 ><P
1943 >If you have problems creating user profiles, you can reset the user's
1944 local desktop cache, as shown below.  When this user then next logs in,
1945 they will be told that they are logging in "for the first time".</P
1946 ><P
1947 ></P
1948 ><OL
1949 TYPE="1"
1950 ><LI
1951 ><P
1952 >       instead of logging in under the [user, password, domain] dialog,
1953         press escape.
1954         </P
1955 ></LI
1956 ><LI
1957 ><P
1958 >       run the regedit.exe program, and look in:
1959         </P
1960 ><P
1961 >       HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList
1962         </P
1963 ><P
1964 >       you will find an entry, for each user, of ProfilePath.  Note the
1965         contents of this key (likely to be c:\windows\profiles\username),
1966         then delete the key ProfilePath for the required user.
1967         </P
1968 ><P
1969 >       [Exit the registry editor].
1970         </P
1971 ></LI
1972 ><LI
1973 ><P
1974 >       <I
1975 CLASS="EMPHASIS"
1976 >WARNING</I
1977 > - before deleting the contents of the
1978         directory listed in
1979    the ProfilePath (this is likely to be c:\windows\profiles\username),
1980    ask them if they have any important files stored on their desktop
1981    or in their start menu.  delete the contents of the directory
1982    ProfilePath (making a backup if any of the files are needed).
1983         </P
1984 ><P
1985 >   This will have the effect of removing the local (read-only hidden
1986    system file) user.DAT in their profile directory, as well as the
1987    local "desktop", "nethood", "start menu" and "programs" folders.
1988         </P
1989 ></LI
1990 ><LI
1991 ><P
1992 >       search for the user's .PWL password-caching file in the c:\windows
1993         directory, and delete it.
1994         </P
1995 ></LI
1996 ><LI
1997 ><P
1998 >       log off the windows 95 client.
1999         </P
2000 ></LI
2001 ><LI
2002 ><P
2003 >       check the contents of the profile path (see "logon path" described
2004         above), and delete the user.DAT or user.MAN file for the user,
2005         making a backup if required.
2006         </P
2007 ></LI
2008 ></OL
2009 ><P
2010 >If all else fails, increase samba's debug log levels to between 3 and 10,
2011 and / or run a packet trace program such as tcpdump or netmon.exe, and
2012 look for any error reports.</P
2013 ><P
2014 >If you have access to an NT server, then first set up roaming profiles
2015 and / or netlogons on the NT server.  Make a packet trace, or examine
2016 the example packet traces provided with NT server, and see what the
2017 differences are with the equivalent samba trace.</P
2018 ></DIV
2019 ><DIV
2020 CLASS="SECT3"
2021 ><HR><H3
2022 CLASS="SECT3"
2023 ><A
2024 NAME="AEN486"
2025 >Windows NT Workstation 4.0</A
2026 ></H3
2027 ><P
2028 >When a user first logs in to a Windows NT Workstation, the profile
2029 NTuser.DAT is created.  The profile location can be now specified
2030 through the "logon path" parameter.  </P
2031 ><DIV
2032 CLASS="NOTE"
2033 ><BLOCKQUOTE
2034 CLASS="NOTE"
2035 ><P
2036 ><B
2037 >Note: </B
2038 >[lkcl 10aug97 - i tried setting the path to
2039 \\samba-server\homes\profile, and discovered that this fails because
2040 a background process maintains the connection to the [homes] share
2041 which does _not_ close down in between user logins.  you have to
2042 have \\samba-server\%L\profile, where user is the username created
2043 from the [homes] share].</P
2044 ></BLOCKQUOTE
2045 ></DIV
2046 ><P
2047 >There is a parameter that is now available for use with NT Profiles:
2048 "logon drive".  This should be set to "h:" or any other drive, and
2049 should be used in conjunction with the new "logon home" parameter.</P
2050 ><P
2051 >The entry for the NT 4.0 profile is a _directory_ not a file.  The NT
2052 help on profiles mentions that a directory is also created with a .PDS
2053 extension.  The user, while logging in, must have write permission to
2054 create the full profile path (and the folder with the .PDS extension)
2055 [lkcl 10aug97 - i found that the creation of the .PDS directory failed,
2056 and had to create these manually for each user, with a shell script.
2057 also, i presume, but have not tested, that the full profile path must
2058 be browseable just as it is for w95, due to the manner in which they
2059 attempt to create the full profile path: test existence of each path
2060 component; create path component].</P
2061 ><P
2062 >In the profile directory, NT creates more folders than 95.  It creates
2063 "Application Data" and others, as well as "Desktop", "Nethood",
2064 "Start Menu" and "Programs".  The profile itself is stored in a file
2065 NTuser.DAT.  Nothing appears to be stored in the .PDS directory, and
2066 its purpose is currently unknown.</P
2067 ><P
2068 >You can use the System Control Panel to copy a local profile onto
2069 a samba server (see NT Help on profiles: it is also capable of firing
2070 up the correct location in the System Control Panel for you).  The
2071 NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN
2072 turns a profile into a mandatory one.</P
2073 ><DIV
2074 CLASS="NOTE"
2075 ><BLOCKQUOTE
2076 CLASS="NOTE"
2077 ><P
2078 ><B
2079 >Note: </B
2080 >[lkcl 10aug97 - i notice that NT Workstation tells me that it is
2081 downloading a profile from a slow link.  whether this is actually the
2082 case, or whether there is some configuration issue, as yet unknown,
2083 that makes NT Workstation _think_ that the link is a slow one is a
2084 matter to be resolved].</P
2085 ><P
2086 >[lkcl 20aug97 - after samba digest correspondence, one user found, and
2087 another confirmed, that profiles cannot be loaded from a samba server
2088 unless "security = user" and "encrypt passwords = yes" (see the file
2089 ENCRYPTION.txt) or "security = server" and "password server = ip.address.
2090 of.yourNTserver" are used.  Either of these options will allow the NT
2091 workstation to access the samba server using LAN manager encrypted
2092 passwords, without the user intervention normally required by NT
2093 workstation for clear-text passwords].</P
2094 ><P
2095 >[lkcl 25aug97 - more comments received about NT profiles: the case of
2096 the profile _matters_.  the file _must_ be called NTuser.DAT or, for
2097 a mandatory profile, NTuser.MAN].</P
2098 ></BLOCKQUOTE
2099 ></DIV
2100 ></DIV
2101 ><DIV
2102 CLASS="SECT3"
2103 ><HR><H3
2104 CLASS="SECT3"
2105 ><A
2106 NAME="AEN499"
2107 >Windows NT Server</A
2108 ></H3
2109 ><P
2110 >There is nothing to stop you specifying any path that you like for the
2111 location of users' profiles.  Therefore, you could specify that the
2112 profile be stored on a samba server, or any other SMB server, as long as
2113 that SMB server supports encrypted passwords.</P
2114 ></DIV
2115 ><DIV
2116 CLASS="SECT3"
2117 ><HR><H3
2118 CLASS="SECT3"
2119 ><A
2120 NAME="AEN502"
2121 >Sharing Profiles between W95 and NT Workstation 4.0</A
2122 ></H3
2123 ><DIV
2124 CLASS="WARNING"
2125 ><P
2126 ></P
2127 ><TABLE
2128 CLASS="WARNING"
2129 BORDER="1"
2130 WIDTH="100%"
2131 ><TR
2132 ><TD
2133 ALIGN="CENTER"
2134 ><B
2135 >Potentially outdated or incorrect material follows</B
2136 ></TD
2137 ></TR
2138 ><TR
2139 ><TD
2140 ALIGN="LEFT"
2141 ><P
2142 >I think this is all bogus, but have not deleted it. (Richard Sharpe)</P
2143 ></TD
2144 ></TR
2145 ></TABLE
2146 ></DIV
2147 ><P
2148 >The default logon path is \\%N\U%.  NT Workstation will attempt to create
2149 a directory "\\samba-server\username.PDS" if you specify the logon path
2150 as "\\samba-server\username" with the NT User Manager.  Therefore, you
2151 will need to specify (for example) "\\samba-server\username\profile".
2152 NT 4.0 will attempt to create "\\samba-server\username\profile.PDS", which
2153 is more likely to succeed.</P
2154 ><P
2155 >If you then want to share the same Start Menu / Desktop with W95, you will
2156 need to specify "logon path = \\samba-server\username\profile" [lkcl 10aug97
2157 this has its drawbacks: i created a shortcut to telnet.exe, which attempts
2158 to run from the c:\winnt\system32 directory.  this directory is obviously
2159 unlikely to exist on a Win95-only host].</P
2160 ><P
2161 >&#13;If you have this set up correctly, you will find separate user.DAT and
2162 NTuser.DAT files in the same profile directory.</P
2163 ><DIV
2164 CLASS="NOTE"
2165 ><BLOCKQUOTE
2166 CLASS="NOTE"
2167 ><P
2168 ><B
2169 >Note: </B
2170 >[lkcl 25aug97 - there are some issues to resolve with downloading of
2171 NT profiles, probably to do with time/date stamps.  i have found that
2172 NTuser.DAT is never updated on the workstation after the first time that
2173 it is copied to the local workstation profile directory.  this is in
2174 contrast to w95, where it _does_ transfer / update profiles correctly].</P
2175 ></BLOCKQUOTE
2176 ></DIV
2177 ></DIV
2178 ></DIV
2179 ></DIV
2180 ><DIV
2181 CLASS="SECT1"
2182 ><HR><H1
2183 CLASS="SECT1"
2184 ><A
2185 NAME="AEN512"
2186 >DOMAIN_CONTROL.txt : Windows NT Domain Control &#38; Samba</A
2187 ></H1
2188 ><DIV
2189 CLASS="WARNING"
2190 ><P
2191 ></P
2192 ><TABLE
2193 CLASS="WARNING"
2194 BORDER="1"
2195 WIDTH="100%"
2196 ><TR
2197 ><TD
2198 ALIGN="CENTER"
2199 ><B
2200 >Possibly Outdated Material</B
2201 ></TD
2202 ></TR
2203 ><TR
2204 ><TD
2205 ALIGN="LEFT"
2206 ><P
2207 >       This appendix was originally authored by John H Terpstra of
2208         the Samba Team and is included here for posterity.
2209         </P
2210 ></TD
2211 ></TR
2212 ></TABLE
2213 ></DIV
2214 ><P
2215 ><I
2216 CLASS="EMPHASIS"
2217 >NOTE :</I
2218 >
2219 The term "Domain Controller" and those related to it refer to one specific
2220 method of authentication that can underly an SMB domain. Domain Controllers
2221 prior to Windows NT Server 3.1 were sold by various companies and based on
2222 private extensions to the LAN Manager 2.1 protocol. Windows NT introduced
2223 Microsoft-specific ways of distributing the user authentication database.
2224 See DOMAIN.txt for examples of how Samba can participate in or create
2225 SMB domains based on shared authentication database schemes other than the
2226 Windows NT SAM.</P
2227 ><P
2228 >Windows NT Server can be installed as either a plain file and print server
2229 (WORKGROUP workstation or server) or as a server that participates in Domain
2230 Control (DOMAIN member, Primary Domain controller or Backup Domain controller).
2231 The same is true for OS/2 Warp Server, Digital Pathworks and other similar
2232 products, all of which can participate in Domain Control along with Windows NT.</P
2233 ><P
2234 >To many people these terms can be confusing, so let's try to clear the air.</P
2235 ><P
2236 >Every Windows NT system (workstation or server) has a registry database.
2237 The registry contains entries that describe the initialization information
2238 for all services (the equivalent of Unix Daemons) that run within the Windows
2239 NT environment. The registry also contains entries that tell application
2240 software where to find dynamically loadable libraries that they depend upon.
2241 In fact, the registry contains entries that describes everything that anything
2242 may need to know to interact with the rest of the system.</P
2243 ><P
2244 >The registry files can be located on any Windows NT machine by opening a
2245 command prompt and typing:</P
2246 ><P
2247 ><TT
2248 CLASS="PROMPT"
2249 >C:\WINNT\&#62;</TT
2250 > dir %SystemRoot%\System32\config</P
2251 ><P
2252 >The environment variable %SystemRoot% value can be obtained by typing:</P
2253 ><P
2254 ><TT
2255 CLASS="PROMPT"
2256 >C:\WINNT&#62;</TT
2257 >echo %SystemRoot%</P
2258 ><P
2259 >The active parts of the registry that you may want to be familiar with are
2260 the files called: default, system, software, sam and security.</P
2261 ><P
2262 >In a domain environment, Microsoft Windows NT domain controllers participate
2263 in replication of the SAM and SECURITY files so that all controllers within
2264 the domain have an exactly identical copy of each.</P
2265 ><P
2266 >The Microsoft Windows NT system is structured within a security model that
2267 says that all applications and services must authenticate themselves before
2268 they can obtain permission from the security manager to do what they set out
2269 to do.</P
2270 ><P
2271 >The Windows NT User database also resides within the registry. This part of
2272 the registry contains the user's security identifier, home directory, group
2273 memberships, desktop profile, and so on.</P
2274 ><P
2275 >Every Windows NT system (workstation as well as server) will have its own
2276 registry. Windows NT Servers that participate in Domain Security control
2277 have a database that they share in common - thus they do NOT own an
2278 independent full registry database of their own, as do Workstations and
2279 plain Servers.</P
2280 ><P
2281 >The User database is called the SAM (Security Access Manager) database and
2282 is used for all user authentication as well as for authentication of inter-
2283 process authentication (i.e. to ensure that the service action a user has
2284 requested is permitted within the limits of that user's privileges).</P
2285 ><P
2286 >The Samba team have produced a utility that can dump the Windows NT SAM into
2287 smbpasswd format: see ENCRYPTION.txt for information on smbpasswd and
2288 /pub/samba/pwdump on your nearest Samba mirror for the utility. This
2289 facility is useful but cannot be easily used to implement SAM replication
2290 to Samba systems.</P
2291 ><P
2292 >Windows for Workgroups, Windows 95, and Windows NT Workstations and Servers
2293 can participate in a Domain security system that is controlled by Windows NT
2294 servers that have been correctly configured. Almost every domain will have
2295 ONE Primary Domain Controller (PDC). It is desirable that each domain will
2296 have at least one Backup Domain Controller (BDC).</P
2297 ><P
2298 >The PDC and BDCs then participate in replication of the SAM database so that
2299 each Domain Controlling participant will have an up to date SAM component
2300 within its registry.</P
2301 ></DIV
2302 ></DIV
2303 ></BODY
2304 ></HTML
2305 >