docs/htmldocs/samba-pdc-faq.html

   1 <HTML
   2 ><HEAD
   3 ><TITLE
   4 >The Samba 2.2 PDC FAQ</TITLE
   5 ><META
   6 NAME="GENERATOR"
   7 CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
   8 ><BODY
   9 CLASS="BOOK"
  10 BGCOLOR="#FFFFFF"
  11 TEXT="#000000"
  12 LINK="#0000FF"
  13 VLINK="#840084"
  14 ALINK="#0000FF"
  15 ><DIV
  16 CLASS="BOOK"
  17 ><A
  18 NAME="SAMBA-PDC-FAQ"
  19 ></A
  20 ><DIV
  21 CLASS="TITLEPAGE"
  22 ><H1
  23 CLASS="TITLE"
  24 ><A
  25 NAME="SAMBA-PDC-FAQ"
  26 >The Samba 2.2 PDC FAQ</A
  27 ></H1
  28 ><H3
  29 CLASS="AUTHOR"
  30 ><A
  31 NAME="AEN4"
  32 >David Bannon</A
  33 ></H3
  34 ><DIV
  35 CLASS="AFFILIATION"
  36 ><SPAN
  37 CLASS="ORGNAME"
  38 >La Trobe University<BR></SPAN
  39 ></DIV
  40 ><HR></DIV
  41 ><HR><H1
  42 ><A
  43 NAME="AEN12"
  44 ></A
  45 ></H1
  46 ><P
  47 >       This is the FAQ for Samba 2.2 as an NTDomain controller.
  48         This document is derived from the origional FAQ that was built and
  49         maintained by Gerald Carter from the early days of Samba NTDomain development
  50         up until recently.  It is now being updated as significent changes are
  51         made to 2.2.0.
  52         </P
  53 ><P
  54 >       Please note it does not apply to the SAMBA_TNG nor the HEAD branch.
  55         </P
  56 ><P
  57 >       Also available is a Samba 2.2 PDC <A
  58 HREF="samba-pdc-howto.html"
  59 TARGET="_top"
  60 >HOWTO</A
  61 >
  62         that takes you, step by step, over the process of setting up a very basic Samba
  63         2.2 Primary Domain Controller
  64         </P
  65 ><DIV
  66 CLASS="TOC"
  67 ><DL
  68 ><DT
  69 ><B
  70 >Table of Contents</B
  71 ></DT
  72 ><DT
  73 >1. <A
  74 HREF="#AEN19"
  75 >Introduction</A
  76 ></DT
  77 ><DD
  78 ><DL
  79 ><DT
  80 ><A
  81 HREF="#AEN21"
  82 >State of Play</A
  83 ></DT
  84 ><DT
  85 ><A
  86 HREF="#AEN27"
  87 >Introduction</A
  88 ></DT
  89 ></DL
  90 ></DD
  91 ><DT
  92 >2. <A
  93 HREF="#AEN33"
  94 >General Information</A
  95 ></DT
  96 ><DD
  97 ><DL
  98 ><DT
  99 ><A
 100 HREF="#AEN35"
 101 >What can we do ?</A
 102 ></DT
 103 ><DD
 104 ><DL
 105 ><DT
 106 ><A
 107 HREF="#AEN37"
 108 >What can Samba 2.2.x Primary Domain Controller (PDC) do ?</A
 109 ></DT
 110 ><DT
 111 ><A
 112 HREF="#AEN62"
 113 >Can I have a Windows 2000 client logon to a Samba
 114 controlled domain?</A
 115 ></DT
 116 ></DL
 117 ></DD
 118 ><DT
 119 ><A
 120 HREF="#AEN65"
 121 >CVS</A
 122 ></DT
 123 ><DD
 124 ><DL
 125 ><DT
 126 ><A
 127 HREF="#AEN68"
 128 >What are the different Samba branches available in CVS ?</A
 129 ></DT
 130 ><DT
 131 ><A
 132 HREF="#AEN91"
 133 >What are the CVS commands ?</A
 134 ></DT
 135 ></DL
 136 ></DD
 137 ></DL
 138 ></DD
 139 ><DT
 140 >3. <A
 141 HREF="#AEN95"
 142 >Establishing Connections</A
 143 ></DT
 144 ><DD
 145 ><DL
 146 ><DT
 147 ><A
 148 HREF="#AEN97"
 149 ></A
 150 ></DT
 151 ><DD
 152 ><DL
 153 ><DT
 154 ><A
 155 HREF="#AEN99"
 156 >How do I get my NT4 or W2000 Workstation to login to the Samba
 157 controlled Domain?</A
 158 ></DT
 159 ><DT
 160 ><A
 161 HREF="#AEN103"
 162 >What is a 'machine account' ?</A
 163 ></DT
 164 ><DT
 165 ><A
 166 HREF="#AEN110"
 167 >"The machine account for this computer either does not
 168 exist or is not accessable."</A
 169 ></DT
 170 ><DT
 171 ><A
 172 HREF="#AEN116"
 173 >How do I create machine accounts manually ?</A
 174 ></DT
 175 ><DT
 176 ><A
 177 HREF="#AEN129"
 178 >I cannot include a '$' in a machine name.</A
 179 ></DT
 180 ><DT
 181 ><A
 182 HREF="#AEN135"
 183 >I get told "You already have a connection to the Domain...."
 184 when creating a machine account.</A
 185 ></DT
 186 ><DT
 187 ><A
 188 HREF="#AEN139"
 189 >I get told "Cannot join domain, the credentials supplied
 190 conflict with an existing set.."</A
 191 ></DT
 192 ><DT
 193 ><A
 194 HREF="#AEN143"
 195 >"The system can not log you on (C000019B)...."</A
 196 ></DT
 197 ></DL
 198 ></DD
 199 ></DL
 200 ></DD
 201 ><DT
 202 >4. <A
 203 HREF="#AEN147"
 204 >User Account Management</A
 205 ></DT
 206 ><DD
 207 ><DL
 208 ><DT
 209 ><A
 210 HREF="#AEN149"
 211 >Domain Admins</A
 212 ></DT
 213 ><DD
 214 ><DL
 215 ><DT
 216 ><A
 217 HREF="#AEN151"
 218 >How do I configure an account as a domain administrator?</A
 219 ></DT
 220 ></DL
 221 ></DD
 222 ><DT
 223 ><A
 224 HREF="#AEN155"
 225 >Profiles</A
 226 ></DT
 227 ><DD
 228 ><DL
 229 ><DT
 230 ><A
 231 HREF="#AEN157"
 232 >Why is it bad to set "logon path = \\%N\%U\profile" in
 233 smb.conf?</A
 234 ></DT
 235 ><DT
 236 ><A
 237 HREF="#AEN169"
 238 >Why are all the users listed in the "domain admin users" using the
 239 same profile?</A
 240 ></DT
 241 ><DT
 242 ><A
 243 HREF="#AEN172"
 244 >The roaming profiles do not seem to be updating on the
 245 server.</A
 246 ></DT
 247 ></DL
 248 ></DD
 249 ><DT
 250 ><A
 251 HREF="#AEN180"
 252 >Policies</A
 253 ></DT
 254 ><DD
 255 ><DL
 256 ><DT
 257 ><A
 258 HREF="#AEN182"
 259 >What are 'Policies' ?.</A
 260 ></DT
 261 ><DT
 262 ><A
 263 HREF="#AEN188"
 264 >I can't get system policies to work.</A
 265 ></DT
 266 ><DT
 267 ><A
 268 HREF="#AEN203"
 269 >What about Windows NT Policy Editor ?</A
 270 ></DT
 271 ><DT
 272 ><A
 273 HREF="#AEN217"
 274 >Can Win95 do Policies ?</A
 275 ></DT
 276 ></DL
 277 ></DD
 278 ><DT
 279 ><A
 280 HREF="#AEN223"
 281 >Passwords</A
 282 ></DT
 283 ><DD
 284 ><DL
 285 ><DT
 286 ><A
 287 HREF="#AEN225"
 288 >What is password sync and should I use it ?</A
 289 ></DT
 290 ><DT
 291 ><A
 292 HREF="#AEN239"
 293 >How do I get remote password (unix and SMB) changing working ?</A
 294 ></DT
 295 ></DL
 296 ></DD
 297 ></DL
 298 ></DD
 299 ><DT
 300 >5. <A
 301 HREF="#AEN246"
 302 >Miscellaneous</A
 303 ></DT
 304 ><DD
 305 ><DL
 306 ><DT
 307 ><A
 308 HREF="#AEN248"
 309 ></A
 310 ></DT
 311 ><DD
 312 ><DL
 313 ><DT
 314 ><A
 315 HREF="#AEN250"
 316 >What editor can I use in DOS/Windows that won't
 317 mess with my unix EOF</A
 318 ></DT
 319 ><DT
 320 ><A
 321 HREF="#AEN263"
 322 >How do I get 'User Manager' and 'Server Manager'</A
 323 ></DT
 324 ><DT
 325 ><A
 326 HREF="#AEN278"
 327 >The time setting from a Samba server does not work.</A
 328 ></DT
 329 ><DT
 330 ><A
 331 HREF="#AEN282"
 332 >"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A
 333 ></DT
 334 ><DT
 335 ><A
 336 HREF="#AEN286"
 337 >How do I get my samba server to become a member ( not PDC ) of an NT domain?</A
 338 ></DT
 339 ></DL
 340 ></DD
 341 ></DL
 342 ></DD
 343 ><DT
 344 >6. <A
 345 HREF="#AEN290"
 346 >Troubleshooting and Bug Reporting</A
 347 ></DT
 348 ><DD
 349 ><DL
 350 ><DT
 351 ><A
 352 HREF="#AEN292"
 353 >Diagnostic tools</A
 354 ></DT
 355 ><DD
 356 ><DL
 357 ><DT
 358 ><A
 359 HREF="#AEN294"
 360 >What are some diagnostics tools I can use to debug the domain logon process and where can I
 361         find them?</A
 362 ></DT
 363 ><DT
 364 ><A
 365 HREF="#AEN309"
 366 >How do I install 'Network Monitor' on an NT Workstation
 367 or a Windows 9x box?</A
 368 ></DT
 369 ></DL
 370 ></DD
 371 ><DT
 372 ><A
 373 HREF="#AEN338"
 374 >What other help can I get ?</A
 375 ></DT
 376 ><DD
 377 ><DL
 378 ><DT
 379 ><A
 380 HREF="#AEN341"
 381 >URLs and similar</A
 382 ></DT
 383 ><DT
 384 ><A
 385 HREF="#AEN374"
 386 >How do I get help from the mailing lists ?</A
 387 ></DT
 388 ><DT
 389 ><A
 390 HREF="#AEN403"
 391 >How do I get off the mailing lists ?</A
 392 ></DT
 393 ></DL
 394 ></DD
 395 ></DL
 396 ></DD
 397 ></DL
 398 ></DIV
 399 ><DIV
 400 CLASS="CHAPTER"
 401 ><HR><H1
 402 ><A
 403 NAME="AEN19"
 404 >Chapter 1. Introduction</A
 405 ></H1
 406 ><DIV
 407 CLASS="SECT1"
 408 ><H1
 409 CLASS="SECT1"
 410 ><A
 411 NAME="AEN21"
 412 >State of Play</A
 413 ></H1
 414 ><P
 415 >Much of the related code does work. For example, if an NT is removed from the
 416         domain and then rejoins, the <TT
 417 CLASS="FILENAME"
 418 >Create a Computer Account in the Domain</TT
 419 > dialog
 420         will let you reset the smbpasswd. That is you don't need to do it from
 421         the unix box. However, at the present, you do need to have root as an
 422         administrator and use the root user name and password.</P
 423 ><P
 424 ><B
 425 CLASS="COMMAND"
 426 >Policies</B
 427 > do work on a W2K machine. MS says that recent
 428         builds of W2K dont observe an NT policy but it appears it does in 'legacy'
 429         mode.</P
 430 ></DIV
 431 ><DIV
 432 CLASS="SECT1"
 433 ><HR><H1
 434 CLASS="SECT1"
 435 ><A
 436 NAME="AEN27"
 437 >Introduction</A
 438 ></H1
 439 ><P
 440 >       This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing
 441         with the 'old HEAD' version of Samba and its NTDomain facilities. It is
 442         being rewritten by David Bannon (drb) so that it addresses more
 443         accurately the Samba 2.2.x release.
 444         </P
 445 ><P
 446 >       This document probably still contains some material that does not apply
 447         to Samba 2.2 but most (all?) of the really misleading stuff has been
 448         removed. Some issues are not dealt with or are dealt with badly. Please
 449         send corrections and additions to <A
 450 HREF="mailto:D.Bannon@latrobe.edu.au"
 451 TARGET="_top"
 452 >David Bannon</A
 453 >.
 454         </P
 455 ><P
 456 >Hopefully, as we all become familiar with the Samba 2.2 as a
 457         PDC this document will become much more usefull.</P
 458 ></DIV
 459 ></DIV
 460 ><DIV
 461 CLASS="CHAPTER"
 462 ><HR><H1
 463 ><A
 464 NAME="AEN33"
 465 >Chapter 2. General Information</A
 466 ></H1
 467 ><DIV
 468 CLASS="SECT1"
 469 ><H1
 470 CLASS="SECT1"
 471 ><A
 472 NAME="AEN35"
 473 >What can we do ?</A
 474 ></H1
 475 ><DIV
 476 CLASS="SECT2"
 477 ><H2
 478 CLASS="SECT2"
 479 ><A
 480 NAME="AEN37"
 481 >What can Samba 2.2.x Primary Domain Controller (PDC) do ?</A
 482 ></H2
 483 ><P
 484 >       If you wish to have Samba act as a PDC for Windows NT 4.0/2000 client,
 485         then you will need to obtain the 2.2.0 version. Release of a stable,
 486         full featured Samba PDC is currently slated for version 3.0.
 487         </P
 488 ><P
 489 >       The following is a list of included  features currently in
 490         Samba 2.2:
 491         </P
 492 ><P
 493 ></P
 494 ><UL
 495 ><LI
 496 ><P
 497 >The ability to act as a limited PDC for
 498                         Windows NT and W2000 clients. This includes adding NT and
 499                         W2K machines to the domain and authenticating users logging
 500                         into the domain.</P
 501 ></LI
 502 ><LI
 503 ><P
 504 >Domain account can be viewed using the User
 505                         Manager for Domains</P
 506 ></LI
 507 ><LI
 508 ><P
 509 >Viewing/adding/deleting resources on the Samba
 510                         PDC via the Server Manager for Domains from the NT client.
 511                         </P
 512 ></LI
 513 ><LI
 514 ><P
 515 >Windows 95/98/ME clients will allow user
 516                         level security to be set and browsing of domain accounts.
 517                         </P
 518 ></LI
 519 ><LI
 520 ><P
 521 >Machine account password updates.</P
 522 ></LI
 523 ><LI
 524 ><P
 525 >Changing of user passwords from an NT client.
 526                         </P
 527 ></LI
 528 ><LI
 529 ><P
 530 >Partial support for Windows NT username mapping.
 531                         Group name mapping is slated for a later release.</P
 532 ></LI
 533 ></UL
 534 ><P
 535 >       These things are note expected to work in the forseeable future:
 536         </P
 537 ><P
 538 ></P
 539 ><UL
 540 ><LI
 541 ><P
 542 >Trust relationships</P
 543 ></LI
 544 ><LI
 545 ><P
 546 >PDC and BDC integration</P
 547 ></LI
 548 ></UL
 549 ></DIV
 550 ><DIV
 551 CLASS="SECT2"
 552 ><HR><H2
 553 CLASS="SECT2"
 554 ><A
 555 NAME="AEN62"
 556 >Can I have a Windows 2000 client logon to a Samba
 557 controlled domain?</A
 558 ></H2
 559 ><P
 560 >       The 2.2 release branch of Samba  supports Windows 2000 domain
 561         clients in legacy mode, ie as if the PDC is a NTServer, not a
 562         W2K server.
 563         </P
 564 ></DIV
 565 ></DIV
 566 ><DIV
 567 CLASS="SECT1"
 568 ><HR><H1
 569 CLASS="SECT1"
 570 ><A
 571 NAME="AEN65"
 572 >CVS</A
 573 ></H1
 574 ><P
 575 >       CVS is a programme (publically available) that the Samba developers
 576         use to maintain the central source code. Non developers can get
 577         access to the source in a read only capacity. Many flavours of unix
 578         now arrive with cvs installed.</P
 579 ><DIV
 580 CLASS="SECT2"
 581 ><HR><H2
 582 CLASS="SECT2"
 583 ><A
 584 NAME="AEN68"
 585 >What are the different Samba branches available in CVS ?</A
 586 ></H2
 587 ><P
 588 >You can find out more about obtaining Samba's via anonymous
 589         CVS from <A
 590 HREF="http://pserver.samba.org/samba/cvs.html"
 591 TARGET="_top"
 592 >       http://pserver.samba.org/samba/cvs.html</A
 593 >.
 594         </P
 595 ><P
 596 >       There are basically four branches to watch at the moment :
 597         </P
 598 ><P
 599 ></P
 600 ><DIV
 601 CLASS="VARIABLELIST"
 602 ><DL
 603 ><DT
 604 >HEAD</DT
 605 ><DD
 606 ><P
 607 >Samba 3.0 ? This code boasts all the main
 608                 development work in Samba. Due to its developmental
 609                 nature, its not really suitable for production work.
 610                 </P
 611 ></DD
 612 ><DT
 613 >SAMBA_2_0</DT
 614 ><DD
 615 ><P
 616 >This branch contains the previous stable
 617                 release.  At the moment it contains 2.0.8, a version that
 618                 will do some limited PDC stuff. If you are really going to
 619                 do PDC things, you consider 2.2 instead.
 620                 </P
 621 ></DD
 622 ><DT
 623 >SAMBA_2_2</DT
 624 ><DD
 625 ><P
 626 >The 2.2.x release branch which is a subset
 627                 of the features of the HEAD branch.  This document addresses
 628                 only SAMBA_2_2.
 629                 </P
 630 ></DD
 631 ><DT
 632 >SAMBA_TNG</DT
 633 ><DD
 634 ><P
 635 >This branch is no longer maintained from the Samba
 636                 sites.  Please see <A
 637 HREF="http://www.samba-tng.org/"
 638 TARGET="_top"
 639 >               http://www.samba-tng.org/</A
 640 >.  It has been requested
 641                 that questions about TNG are not posted to the regular Samba
 642                 mailing lists including samba-ntdom and samba-technical.
 643                 </P
 644 ></DD
 645 ></DL
 646 ></DIV
 647 ></DIV
 648 ><DIV
 649 CLASS="SECT2"
 650 ><HR><H2
 651 CLASS="SECT2"
 652 ><A
 653 NAME="AEN91"
 654 >What are the CVS commands ?</A
 655 ></H2
 656 ><P
 657 >       See <A
 658 HREF="http://pserver.samba.org/samba/cvs.html"
 659 TARGET="_top"
 660 >       http://pserver.samba.org/samba/cvs.html</A
 661 > for instructions
 662         on obtaining the SAMBA_2_2 or HEAD cvs code.
 663         </P
 664 ></DIV
 665 ></DIV
 666 ></DIV
 667 ><DIV
 668 CLASS="CHAPTER"
 669 ><HR><H1
 670 ><A
 671 NAME="AEN95"
 672 >Chapter 3. Establishing Connections</A
 673 ></H1
 674 ><DIV
 675 CLASS="SECT1"
 676 ><H1
 677 CLASS="SECT1"
 678 ><A
 679 NAME="AEN97"
 680 ></A
 681 ></H1
 682 ><DIV
 683 CLASS="SECT2"
 684 ><H2
 685 CLASS="SECT2"
 686 ><A
 687 NAME="AEN99"
 688 >How do I get my NT4 or W2000 Workstation to login to the Samba
 689 controlled Domain?</A
 690 ></H2
 691 ><P
 692 >       There is a comprehensive Samba PDC <A
 693 HREF="samba-pdc-howto.html"
 694 TARGET="_top"
 695 >HOWTO</A
 696 > accessable from the samba web
 697         site under 'Documentation'. Read it.
 698         </P
 699 ></DIV
 700 ><DIV
 701 CLASS="SECT2"
 702 ><HR><H2
 703 CLASS="SECT2"
 704 ><A
 705 NAME="AEN103"
 706 >What is a 'machine account' ?</A
 707 ></H2
 708 ><P
 709 >       Every NT, W2K or Samba machine that joins a Samba controlled
 710         domain must be known to the Samba PDC. There are two entries
 711         required, one in (typically) <TT
 712 CLASS="FILENAME"
 713 >/etc/passwd</TT
 714 >
 715     and the other in (typically) <TT
 716 CLASS="FILENAME"
 717 >/usr/local/samba/private/smbpasswd</TT
 718 >.
 719         Under some circumstances these entries are made
 720         <A
 721 HREF="#AEN116"
 722 >manually</A
 723 >, the <A
 724 HREF="samba-pdc-howto.html"
 725 TARGET="_top"
 726 >HOWTO</A
 727 >
 728         discusses ways of creating them automatically.</P
 729 ></DIV
 730 ><DIV
 731 CLASS="SECT2"
 732 ><HR><H2
 733 CLASS="SECT2"
 734 ><A
 735 NAME="AEN110"
 736 >"The machine account for this computer either does not
 737 exist or is not accessable."</A
 738 ></H2
 739 ><P
 740 >       When I try to join the domain I get the message "The machine account
 741         for this computer either does not exist or is not accessable". Whats
 742         wrong ?
 743         </P
 744 ><P
 745 >       This problem is caused by the PDC not having a suitable machine account.
 746         If you are using the <B
 747 CLASS="COMMAND"
 748 >add user script =</B
 749 > method to create
 750         accounts then this would indicate that it has not worked. Ensure the domain
 751         admin user system is working.
 752         </P
 753 ><P
 754 >       Alternatively if you are creating account entries manually then they
 755         have not been created correctly. Make sure that you have the entry
 756         correct for the machine account in smbpasswd file on the Samba PDC.
 757         If you added the account using an editor rather than using the smbpasswd
 758         utility, make sure that the account name is the machine netbios name
 759         with a '$' appended to it ( ie. computer_name$ ). There must be an entry
 760         in both /etc/passwd and the smbpasswd file. Some people have reported
 761         that inconsistent subnet masks between the Samba server and the NT
 762         client have caused this problem.   Make sure that these are consistent
 763         for both client and server.
 764         </P
 765 ></DIV
 766 ><DIV
 767 CLASS="SECT2"
 768 ><HR><H2
 769 CLASS="SECT2"
 770 ><A
 771 NAME="AEN116"
 772 >How do I create machine accounts manually ?</A
 773 ></H2
 774 ><P
 775 >       This was the only option until recently, now in version 2.2 better
 776         means are available.  You might still need to do it manually for a
 777         couple of reasons. A machine account consists of two entries (assuming
 778         a standard install and /etc/passwd use), one in /etc/passwd and the
 779         other in /usr/local/samba/private/smbpasswd. The /etc/passwd
 780         entry will list the machine name with a $ appended, won't have a
 781         passwd, will have a null shell and no home directory. For example
 782         a machine called 'doppy' would have an /etc/passwd entry like this :</P
 783 ><P
 784 >       <B
 785 CLASS="COMMAND"
 786 >doppy$:x:505:501:NTMachine:/dev/null:/bin/false</B
 787 >
 788         </P
 789 ><P
 790 >       On a linux system for example, you would typically add it like
 791         this :
 792         </P
 793 ><P
 794 >       <B
 795 CLASS="COMMAND"
 796 >adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n
 797         doppy$</B
 798 >
 799         </P
 800 ><P
 801 >       Then you need to add that entry to smbpasswd, assuming you have a suitable
 802         path to the <B
 803 CLASS="COMMAND"
 804 >smbpasswd</B
 805 > programme, do this :
 806         </P
 807 ><P
 808 >       <B
 809 CLASS="COMMAND"
 810 >smbpasswd -a -m doppy$</B
 811 >
 812         </P
 813 ><P
 814 >       The entry will be created with a well known password, so any machine that
 815         says its doppy could join the domain as long as it gets in first. So
 816         don't create the accounts any earlier than you need them.
 817         </P
 818 ></DIV
 819 ><DIV
 820 CLASS="SECT2"
 821 ><HR><H2
 822 CLASS="SECT2"
 823 ><A
 824 NAME="AEN129"
 825 >I cannot include a '$' in a machine name.</A
 826 ></H2
 827 ><P
 828 >       A 'machine name' in (typically) <TT
 829 CLASS="FILENAME"
 830 >/etc/passwd</TT
 831 > consists
 832     of the machine name with a '$' appended. FreeBSD (and other BSD
 833         systems ?) won't create a user with a '$' in their name.
 834         </P
 835 ><P
 836 >       The problem is only in the program used to make the entry, once
 837         made, it works perfectly. So create a user without the '$' and
 838         use <B
 839 CLASS="COMMAND"
 840 >vipw</B
 841 > to edit the entry, adding the '$'. Or create
 842         the whole entry with vipw if you like, make sure you use a
 843         unique uid !</P
 844 ></DIV
 845 ><DIV
 846 CLASS="SECT2"
 847 ><HR><H2
 848 CLASS="SECT2"
 849 ><A
 850 NAME="AEN135"
 851 >I get told "You already have a connection to the Domain...."
 852 when creating a machine account.</A
 853 ></H2
 854 ><P
 855 >       This happens if you try to create a machine account from the
 856         machine itself and use a user   name that does not work (for whatever
 857         reason) and then try another (possibly valid) user name.
 858         Exit out of the network applet to close the initial connection
 859         and try again.
 860         </P
 861 ><P
 862 >       Further, if the machine is a already a 'member of a workgroup' that
 863         is the same name as the domain you are joining (bad idea) you will
 864         get this message.  Change the workgroup name to something else, it
 865         does not matter what, reboot, and try again.</P
 866 ></DIV
 867 ><DIV
 868 CLASS="SECT2"
 869 ><HR><H2
 870 CLASS="SECT2"
 871 ><A
 872 NAME="AEN139"
 873 >I get told "Cannot join domain, the credentials supplied
 874 conflict with an existing set.."</A
 875 ></H2
 876 ><P
 877 >       This is the same basic problem as mentioned above, <A
 878 HREF="#AEN135"
 879 > "You already have a connection..."</A
 880 >
 881         </P
 882 ></DIV
 883 ><DIV
 884 CLASS="SECT2"
 885 ><HR><H2
 886 CLASS="SECT2"
 887 ><A
 888 NAME="AEN143"
 889 >"The system can not log you on (C000019B)...."</A
 890 ></H2
 891 ><P
 892 >I joined the domain successfully but after upgrading
 893         to a newer version of the Samba code I get the message, "The system
 894         can not log you on (C000019B), Please try a gain or consult your
 895         system administrator" when attempting to logon.
 896         </P
 897 ><P
 898 >       This occurs when the domain SID stored in private/WORKGROUP.SID is
 899         changed.  For example, you remove the file and smbd automatically
 900         creates a new one.  Or you are swapping back and forth between
 901         versions 2.0.7, TNG and the HEAD branch code (not recommended).  The
 902         only way to correct the problem is to restore the original domain
 903         SID or  remove the domain client from the domain and rejoin.
 904         </P
 905 ></DIV
 906 ></DIV
 907 ></DIV
 908 ><DIV
 909 CLASS="CHAPTER"
 910 ><HR><H1
 911 ><A
 912 NAME="AEN147"
 913 >Chapter 4. User Account Management</A
 914 ></H1
 915 ><DIV
 916 CLASS="SECT1"
 917 ><H1
 918 CLASS="SECT1"
 919 ><A
 920 NAME="AEN149"
 921 >Domain Admins</A
 922 ></H1
 923 ><DIV
 924 CLASS="SECT2"
 925 ><H2
 926 CLASS="SECT2"
 927 ><A
 928 NAME="AEN151"
 929 >How do I configure an account as a domain administrator?</A
 930 ></H2
 931 ><P
 932 >       See the NTDom <A
 933 HREF="samba-pdc-howto.html"
 934 TARGET="_top"
 935 >HowTo</A
 936 >.
 937         </P
 938 ></DIV
 939 ></DIV
 940 ><DIV
 941 CLASS="SECT1"
 942 ><HR><H1
 943 CLASS="SECT1"
 944 ><A
 945 NAME="AEN155"
 946 >Profiles</A
 947 ></H1
 948 ><DIV
 949 CLASS="SECT2"
 950 ><H2
 951 CLASS="SECT2"
 952 ><A
 953 NAME="AEN157"
 954 >Why is it bad to set "logon path = \\%N\%U\profile" in
 955 smb.conf?</A
 956 ></H2
 957 ><P
 958 >       Sometimes Windows clients will maintain a connection to
 959         the \\homes\ ( or [%U] ) share even after the user has logged out.
 960         Consider the following scenario.
 961         </P
 962 ><P
 963 ></P
 964 ><UL
 965 ><LI
 966 ><P
 967 > user1 logs into the Windows NT machine.
 968                         Therefore the [homes] share is set to \\server\user1.
 969                         </P
 970 ></LI
 971 ><LI
 972 ><P
 973 > user1 works for a while and then logs
 974                         out. </P
 975 ></LI
 976 ><LI
 977 ><P
 978 > user2 logs into the same Windows NT
 979                         machine.</P
 980 ></LI
 981 ></UL
 982 ><P
 983 >       However, since the NT box has maintained a connection to [homes]
 984         which was previously set to \\server\user1, when the operating system
 985         attempts to get the profile and if it can read users1's profile, will
 986         get it otherwise it will return an error. You get the picture.
 987         </P
 988 ><P
 989 >       A better solution is to use a separate [profiles] share and
 990         set the "logon path = \\%N\profiles\%U"
 991         </P
 992 ></DIV
 993 ><DIV
 994 CLASS="SECT2"
 995 ><HR><H2
 996 CLASS="SECT2"
 997 ><A
 998 NAME="AEN169"
 999 >Why are all the users listed in the "domain admin users" using the
1000 same profile?</A
1001 ></H2
1002 ><P
1003 >       You are using a very very old development version of Samba.
1004         Upgrade.
1005         </P
1006 ></DIV
1007 ><DIV
1008 CLASS="SECT2"
1009 ><HR><H2
1010 CLASS="SECT2"
1011 ><A
1012 NAME="AEN172"
1013 >The roaming profiles do not seem to be updating on the
1014 server.</A
1015 ></H2
1016 ><P
1017 >       There can be several reasons for this.
1018         </P
1019 ><P
1020 >       Make sure that the time on the client and the PDC are synchronized.  You
1021         can accomplish this by executing a <B
1022 CLASS="COMMAND"
1023 >net time  \\server /set /yes</B
1024 >
1025         replacing server with the name of your PDC (or another synchronized SMB server).
1026         See <A
1027 HREF="#AEN278"
1028 > about Setting Time</A
1029 >
1030         </P
1031 ><P
1032 >       Make sure that the "logon path" is writeable by the user and make sure
1033         that the connection to the logon path location is by the current user.
1034         Sometimes Windows client do not drop the connection immediately upon
1035         logoff.
1036         </P
1037 ><P
1038 >       Some people have reported that the logon path location should
1039         also be browseable.  I (GC) have yet to emperically verify this,
1040         but you can try.</P
1041 ></DIV
1042 ></DIV
1043 ><DIV
1044 CLASS="SECT1"
1045 ><HR><H1
1046 CLASS="SECT1"
1047 ><A
1048 NAME="AEN180"
1049 >Policies</A
1050 ></H1
1051 ><DIV
1052 CLASS="SECT2"
1053 ><H2
1054 CLASS="SECT2"
1055 ><A
1056 NAME="AEN182"
1057 >What are 'Policies' ?.</A
1058 ></H2
1059 ><P
1060 >       When a user logs onto the domain via a client machine, the PDC
1061         sends the client machine a list of things contained in the
1062         'policy' (if it exists).  This list may do things like suppress
1063         a splach screen, format the dates the way you like them or perhaps
1064         remove locally stored profiles.
1065         </P
1066 ><P
1067 >       On a samba PDC this list is obtained from a file called
1068         <TT
1069 CLASS="FILENAME"
1070 >ntconfig.pol</TT
1071 > and located in the [netlogon]
1072         share. The file is created with a policy editor and must be readable
1073         by anyone and writeable by only root. See <A
1074 HREF="#AEN203"
1075 >    below</A
1076 > for how  to get a suitable editor.
1077         </P
1078 ></DIV
1079 ><DIV
1080 CLASS="SECT2"
1081 ><HR><H2
1082 CLASS="SECT2"
1083 ><A
1084 NAME="AEN188"
1085 >I can't get system policies to work.</A
1086 ></H2
1087 ><P
1088 >       There are two possible reasons for system policies not
1089         functioning correctly. Make sure that you have the following
1090         parameters set in smb.conf
1091         </P
1092 ><P
1093 ><PRE
1094 CLASS="PROGRAMLISTING"
1095 >       [netlogon]
1096         ....
1097         locking = no
1098         public = no
1099         browseable = yes
1100         ....
1101     </PRE
1102 ></P
1103 ><P
1104 >       A policy file must be in the [netlogon] share and must be
1105     readable by everyone and writeable by only root. The file
1106         must be created by an NTServer <A
1107 HREF="#AEN203"
1108 >Policy
1109         Editor</A
1110 >.
1111         </P
1112 ><P
1113 >       Last time I (drb) looked in the source, it was looking for
1114         <TT
1115 CLASS="FILENAME"
1116 >ntconfig.pol</TT
1117 > first then several other
1118         combinations of upper and lower case. People have reported
1119         success using <TT
1120 CLASS="FILENAME"
1121 >NTconfig.pol</TT
1122 >, <TT
1123 CLASS="FILENAME"
1124 >NTconfig.POL</TT
1125 >
1126         and <TT
1127 CLASS="FILENAME"
1128 >ntconfig.pol</TT
1129 >.   These are the case settings that
1130         I (GC) use with the     filename <TT
1131 CLASS="FILENAME"
1132 >ntconfig.pol</TT
1133 >:
1134         </P
1135 ><P
1136 ><PRE
1137 CLASS="PROGRAMLISTING"
1138 >        case sensitive = no
1139         case preserve = yes
1140                 short preserve case = no
1141         default case = yes
1142         </PRE
1143 ></P
1144 ></DIV
1145 ><DIV
1146 CLASS="SECT2"
1147 ><HR><H2
1148 CLASS="SECT2"
1149 ><A
1150 NAME="AEN203"
1151 >What about Windows NT Policy Editor ?</A
1152 ></H2
1153 ><P
1154 >       To create or edit <TT
1155 CLASS="FILENAME"
1156 >ntconfig.pol</TT
1157 > you must use
1158         the NT Server Policy Editor, <B
1159 CLASS="COMMAND"
1160 >poledit.exe</B
1161 >       which
1162         is included with NT Server but <I
1163 CLASS="EMPHASIS"
1164 >not NT Workstation</I
1165 >.
1166         There is a Policy Editor on a NTws
1167     but it is not suitable for creating <I
1168 CLASS="EMPHASIS"
1169 >Domain Policies</I
1170 >.
1171     Further, although the Windows 95
1172         Policy Editor can be installed on an NT Workstation/Server, it will not
1173         work with NT policies because the registry key that are set by the policy templates.
1174         However, the files from the NT Server will run happily enough on an NTws.
1175         You need <TT
1176 CLASS="FILENAME"
1177 >poledit.exe, common.adm</TT
1178 > and <TT
1179 CLASS="FILENAME"
1180 >winnt.adm</TT
1181 >. It is convenient
1182     to put the two *.adm files in <TT
1183 CLASS="FILENAME"
1184 >c:\winnt\inf</TT
1185 > which is where
1186     the binary will look for them unless told otherwise. Note also that that
1187     directory is 'hidden'.
1188         </P
1189 ><P
1190 >The Windows NT policy editor is also included with the
1191         Service Pack 3 (and later) for Windows NT 4.0. Extract the files using
1192     <B
1193 CLASS="COMMAND"
1194 >servicepackname /x</B
1195 >, ie thats <B
1196 CLASS="COMMAND"
1197 >Nt4sp6ai.exe
1198         /x</B
1199 > for service pack 6a.  The policy editor, <B
1200 CLASS="COMMAND"
1201 >poledt.exe</B
1202 > and the
1203         associated template files (*.adm) should
1204         be extracted as well.  It is also possible to downloaded the policy template
1205         files for Office97 and get a copy of the policy editor.  Another possible
1206         location is with the Zero Administration Kit available for download from Microsoft.
1207     </P
1208 ></DIV
1209 ><DIV
1210 CLASS="SECT2"
1211 ><HR><H2
1212 CLASS="SECT2"
1213 ><A
1214 NAME="AEN217"
1215 >Can Win95 do Policies ?</A
1216 ></H2
1217 ><P
1218 >       Install the group policy handler for Win9x to pick up group
1219         policies.   Look on the Win98 CD in <TT
1220 CLASS="FILENAME"
1221 >\tools\reskit\netadmin\poledit</TT
1222 >.
1223         Install group policies on a Win9x client by double-clicking
1224         <TT
1225 CLASS="FILENAME"
1226 >grouppol.inf</TT
1227 >. Log off and on again a couple of
1228         times and see if Win98 picks up group policies.  Unfortunately this needs
1229         to be done on every Win9x machine that uses group policies....
1230         </P
1231 ><P
1232 >       If group policies don't work one reports suggests getting the updated
1233         (read: working) grouppol.dll for Windows 9x. The group list is grabbed
1234         from /etc/group.
1235         </P
1236 ></DIV
1237 ></DIV
1238 ><DIV
1239 CLASS="SECT1"
1240 ><HR><H1
1241 CLASS="SECT1"
1242 ><A
1243 NAME="AEN223"
1244 >Passwords</A
1245 ></H1
1246 ><DIV
1247 CLASS="SECT2"
1248 ><H2
1249 CLASS="SECT2"
1250 ><A
1251 NAME="AEN225"
1252 >What is password sync and should I use it ?</A
1253 ></H2
1254 ><P
1255 >       NTws users can change their domain password by pressing Ctrl-Alt-Del
1256         and choosing 'Change Password'. By default however, this does not change the unix password
1257     (typically in <TT
1258 CLASS="FILENAME"
1259 >/etc/passwd</TT
1260 > or <TT
1261 CLASS="FILENAME"
1262 >/etc/shadow</TT
1263 >).
1264         In lots of situations thats OK, for example :
1265         </P
1266 ><P
1267 ></P
1268 ><UL
1269 ><LI
1270 ><P
1271 >The server is only accessible to the user via
1272                 samba.</P
1273 ></LI
1274 ><LI
1275 ><P
1276 >Pam_smb or similar is installed so other applications
1277         still refer to the samba password.</P
1278 ></LI
1279 ></UL
1280 ><P
1281 >       But sometimes you really do need to maintain two seperate password
1282         databases and there are good reasons to keep then in sync.  Trying
1283         to explain to users that they need to change their passwords in two
1284         seperate places or use two seperate passwords is not fun.
1285         </P
1286 ><P
1287 >       However do understand that setting up password sync is not without
1288         problems either. The chief difficulty is the interface between Samba
1289         and the <B
1290 CLASS="COMMAND"
1291 >passwd</B
1292 > command, it can be a fiddle to set
1293         up and if the password the user has entered fails, the resulting errors
1294         are ambiguously reported and the user is confused. Further, you need
1295         to take steps to ensure that users only ever change their passwords
1296         via samba (or use <B
1297 CLASS="COMMAND"
1298 >smbpasswd</B
1299 >), otherwise they will
1300         only be changing the unix password.</P
1301 ></DIV
1302 ><DIV
1303 CLASS="SECT2"
1304 ><HR><H2
1305 CLASS="SECT2"
1306 ><A
1307 NAME="AEN239"
1308 >How do I get remote password (unix and SMB) changing working ?</A
1309 ></H2
1310 ><P
1311 >       Have a practice changing a user's password (as root) to see
1312         what discussion takes place and change the text in the 'passwd chat'
1313         line below  as necessary. The line as shown works for recent RH Linux
1314         but most other systems seem to like to do something different. The '*' is
1315         a wild card and will match anything (or nothing).
1316         </P
1317 ><P
1318 >       Add these lines to smb.conf under [Global]
1319         </P
1320 ><P
1321 ><PRE
1322 CLASS="PROGRAMLISTING"
1323 >
1324
1325                 unix password sync = true
1326                 passwd program = /usr/bin/passwd %u
1327                 passwd chat = *password* %n\n *password* %n\n *successful*
1328         </PRE
1329 ></P
1330 ><P
1331 >       As mentioned above, the change to the unix password happens as root,
1332         not as the user, as is indicated in ~/smbd/chgpasswd.c  If
1333         you are using NIS, the Samba server must be running on the NIS
1334         master machine.
1335         </P
1336 ></DIV
1337 ></DIV
1338 ></DIV
1339 ><DIV
1340 CLASS="CHAPTER"
1341 ><HR><H1
1342 ><A
1343 NAME="AEN246"
1344 >Chapter 5. Miscellaneous</A
1345 ></H1
1346 ><DIV
1347 CLASS="SECT1"
1348 ><H1
1349 CLASS="SECT1"
1350 ><A
1351 NAME="AEN248"
1352 ></A
1353 ></H1
1354 ><DIV
1355 CLASS="SECT2"
1356 ><H2
1357 CLASS="SECT2"
1358 ><A
1359 NAME="AEN250"
1360 >What editor can I use in DOS/Windows that won't
1361 mess with my unix EOF</A
1362 ></H2
1363 ><P
1364 >There are a number of Windows or DOS based editors that will
1365         understand, and leave intact, the unix eof (as opposed to a DOS CL/LF).
1366         List members suggested :
1367         </P
1368 ><P
1369 ></P
1370 ><UL
1371 ><LI
1372 ><P
1373 >UltraEdit at <A
1374 HREF="http://www.ultraedit.com"
1375 TARGET="_top"
1376 >www.ultraedit.com</A
1377 ></P
1378 ></LI
1379 ><LI
1380 ><P
1381 >VI for windows at <A
1382 HREF="http://home.snafu.de/ramo/WinViEn.htm"
1383 TARGET="_top"
1384 >        home.snafu.de/ramo/WinViEn.htm</A
1385 ></P
1386 ></LI
1387 ><LI
1388 ><P
1389 >The author prefers PFE at <A
1390 HREF="http://www.lancs.ac.uk/people/cpaap/pfe/"
1391 TARGET="_top"
1392 >               www.lancs.ac.uk/people/cpaap/pfe/</A
1393 > but its no longer being developed...</P
1394 ></LI
1395 ></UL
1396 ></DIV
1397 ><DIV
1398 CLASS="SECT2"
1399 ><HR><H2
1400 CLASS="SECT2"
1401 ><A
1402 NAME="AEN263"
1403 >How do I get 'User Manager' and 'Server Manager'</A
1404 ></H2
1405 ><P
1406 >       Since I don't need to buy an NT Server CD now, how do I get
1407         the 'User Manager for Domains', the 'Server Manager' ?
1408         </P
1409 ><P
1410 >       Microsoft distributes a version of
1411         these tools called nexus for installation on Windows 95 systems.  The
1412         tools set includes
1413         </P
1414 ><P
1415 ></P
1416 ><UL
1417 ><LI
1418 ><P
1419 >Server Manager</P
1420 ></LI
1421 ><LI
1422 ><P
1423 >User Manager for Domains</P
1424 ></LI
1425 ><LI
1426 ><P
1427 >Event Viewer</P
1428 ></LI
1429 ></UL
1430 ><P
1431 >       Click here to download the archived file <A
1432 HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE"
1433 TARGET="_top"
1434 >ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A
1435 >
1436         </P
1437 ><P
1438 >       The Windows NT 4.0 version of the 'User Manager for
1439         Domains' and 'Server Manager' are available from Microsoft via ftp
1440         from <A
1441 HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE"
1442 TARGET="_top"
1443 >ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A
1444 >
1445         </P
1446 ></DIV
1447 ><DIV
1448 CLASS="SECT2"
1449 ><HR><H2
1450 CLASS="SECT2"
1451 ><A
1452 NAME="AEN278"
1453 >The time setting from a Samba server does not work.</A
1454 ></H2
1455 ><P
1456 >If it works OK when you log on as Domain Admin then the problem is that ordinary users
1457         don't have permission to change the time. (The system is running with their permission
1458         at logon time.) This is not a Samba problem, you will have the same problem where ever
1459         you connect. You can give 'everyone' permission to change the time from the User Manager.
1460         </P
1461 ><P
1462 >Anyone know what the registry settings are so this could be done with a Policy ?</P
1463 ></DIV
1464 ><DIV
1465 CLASS="SECT2"
1466 ><HR><H2
1467 CLASS="SECT2"
1468 ><A
1469 NAME="AEN282"
1470 >"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A
1471 ></H2
1472 ><P
1473 >I keep getting the message "trust account xxx should be in DOMAIN_GROUP_RID_USERS."
1474         in the logs. What do I need to do?</P
1475 ><P
1476 >You are using one of the old development versions. Upgrade.
1477         (The message is unimportant, was a reminder to a developer)</P
1478 ></DIV
1479 ><DIV
1480 CLASS="SECT2"
1481 ><HR><H2
1482 CLASS="SECT2"
1483 ><A
1484 NAME="AEN286"
1485 >How do I get my samba server to become a member ( not PDC ) of an NT domain?</A
1486 ></H2
1487 ><P
1488 >       Please refer to the <A
1489 HREF="DOMAIN_MEMBER.html"
1490 TARGET="_top"
1491 >Domain Member
1492         HOWTO</A
1493 > for more information on this.
1494         </P
1495 ></DIV
1496 ></DIV
1497 ></DIV
1498 ><DIV
1499 CLASS="CHAPTER"
1500 ><HR><H1
1501 ><A
1502 NAME="AEN290"
1503 >Chapter 6. Troubleshooting and Bug Reporting</A
1504 ></H1
1505 ><DIV
1506 CLASS="SECT1"
1507 ><H1
1508 CLASS="SECT1"
1509 ><A
1510 NAME="AEN292"
1511 >Diagnostic tools</A
1512 ></H1
1513 ><DIV
1514 CLASS="SECT2"
1515 ><H2
1516 CLASS="SECT2"
1517 ><A
1518 NAME="AEN294"
1519 >What are some diagnostics tools I can use to debug the domain logon process and where can I
1520         find them?</A
1521 ></H2
1522 ><P
1523 >       One of the best diagnostic tools for debugging problems is Samba itself.
1524         You can use the -d option for both smbd and nmbd to specifiy what
1525         'debug level' at which to run.  See the man pages on smbd, nmbd  and
1526         smb.conf for more information on debugging options.  The debug
1527         level can range from 1 (the default) to 10 (100 for debugging passwords).
1528         </P
1529 ><P
1530 >       Another helpful method of debugging is to compile samba using the
1531         <B
1532 CLASS="COMMAND"
1533 >gcc -g </B
1534 > flag.   This will include debug
1535         information in the binaries and allow you to attch gdb to the
1536         running smbd / nmbd process.  In order to attach gdb to an smbd
1537         process for an NT workstation, first get the workstation to make the
1538         connection. Pressing ctrl-alt-delete and going down to the domain box
1539         is sufficient (at least, on the first time you join the domain) to
1540         generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation
1541         maintains an open connection, and therefore there will be an smbd
1542         process running (assuming that you haven't set a really short smbd
1543         idle timeout)  So, in between pressing ctrl alt delete, and actually
1544         typing in your password, you can gdb attach and continue.
1545         </P
1546 ><P
1547 >       Some usefull samba commands worth investigating:
1548         </P
1549 ><P
1550 ></P
1551 ><UL
1552 ><LI
1553 ><P
1554 >testparam | more</P
1555 ></LI
1556 ><LI
1557 ><P
1558 >smbclient -L //{netbios name of server}</P
1559 ></LI
1560 ></UL
1561 ><P
1562 >       An SMB enabled version of tcpdump is available from
1563     <A
1564 HREF="http://www.tcpdump.org/"
1565 TARGET="_top"
1566 >http://www.tcpdup.org/</A
1567 >.
1568         Ethereal, another good packet sniffer for UNIX and Win32
1569         hosts, can be downloaded from <A
1570 HREF="http://www.ethereal.com/"
1571 TARGET="_top"
1572 >http://www.ethereal.com</A
1573 >.
1574         </P
1575 ><P
1576 >       For tracing things on the Microsoft Windows NT, Network Monitor
1577         (aka. netmon) is available on the Microsoft Developer Network CD's,
1578         the Windows NT Server install CD and the SMS CD's.  The version of
1579         netmon that ships with SMS allows for dumping packets between any two
1580         computers (ie. placing the network interface in promiscuous mode).
1581         The version on the NT Server install CD will only allow monitoring
1582         of network traffic directed to the local NT box and broadcasts on the
1583         local subnet.  Be aware that Ethereal can read and write netmon
1584         formatted files.
1585         </P
1586 ></DIV
1587 ><DIV
1588 CLASS="SECT2"
1589 ><HR><H2
1590 CLASS="SECT2"
1591 ><A
1592 NAME="AEN309"
1593 >How do I install 'Network Monitor' on an NT Workstation
1594 or a Windows 9x box?</A
1595 ></H2
1596 ><P
1597 >       Installing netmon on an NT workstation requires a couple
1598         of steps.  The following are for installing Netmon V4.00.349, which comes
1599         with Microsoft Windows NT Server 4.0, on Microsoft Windows NT
1600         Workstation 4.0.  The process should be similar for other version of
1601         Windows NT / Netmon.  You will need both the Microsoft Windows
1602         NT Server 4.0 Install CD and the Workstation 4.0 Install CD.
1603         </P
1604 ><P
1605 >       Initially you will need to install 'Network Monitor Tools and Agent'
1606         on the NT Server.  To do this
1607         </P
1608 ><P
1609 ></P
1610 ><UL
1611 ><LI
1612 ><P
1613 >Goto Start - Settings - Control Panel -
1614                 Network - Services - Add </P
1615 ></LI
1616 ><LI
1617 ><P
1618 >Select the 'Network Monitor Tools and Agent' and
1619                 click on 'OK'.</P
1620 ></LI
1621 ><LI
1622 ><P
1623 >Click 'OK' on the Network Control Panel.
1624                 </P
1625 ></LI
1626 ><LI
1627 ><P
1628 >Insert the Windows NT Server 4.0 install CD
1629                 when prompted.</P
1630 ></LI
1631 ></UL
1632 ><P
1633 >       At this point the Netmon files should exist in
1634         <TT
1635 CLASS="FILENAME"
1636 >%SYSTEMROOT%\System32\netmon\*.*</TT
1637 >.
1638         Two subdirectories exist as well, <TT
1639 CLASS="FILENAME"
1640 >parsers\</TT
1641 >
1642         which contains the necessary DLL's for parsing the netmon packet
1643         dump, and <TT
1644 CLASS="FILENAME"
1645 >captures\</TT
1646 >.
1647         </P
1648 ><P
1649 >       In order to install the Netmon tools on an NT Workstation, you will
1650         first need to install the 'Network  Monitor Agent' from the Workstation
1651         install CD.
1652         </P
1653 ><P
1654 ></P
1655 ><UL
1656 ><LI
1657 ><P
1658 >Goto Start - Settings - Control Panel -
1659                 Network - Services - Add</P
1660 ></LI
1661 ><LI
1662 ><P
1663 >Select the 'Network Monitor Agent' and click
1664                 on 'OK'.</P
1665 ></LI
1666 ><LI
1667 ><P
1668 >Click 'OK' on the Network Control Panel.
1669                 </P
1670 ></LI
1671 ><LI
1672 ><P
1673 >Insert the Windows NT Workstation 4.0 install
1674                 CD when prompted.</P
1675 ></LI
1676 ></UL
1677 ><P
1678 >       Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.*
1679         to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set
1680         permissions as  you deem appropriate for your site. You will need
1681         administrative rights on the NT box to run netmon.
1682         </P
1683 ><P
1684 >       To install Netmon on a Windows 9x box install the network monitor agent
1685         from the Windows 9x CD (\admin\nettools\netmon).  There is a readme
1686         file located with the netmon driver files on the CD if you need
1687         information on how to do this.  Copy the files from a working
1688         Netmon installation.
1689         </P
1690 ></DIV
1691 ></DIV
1692 ><DIV
1693 CLASS="SECT1"
1694 ><HR><H1
1695 CLASS="SECT1"
1696 ><A
1697 NAME="AEN338"
1698 >What other help can I get ?</A
1699 ></H1
1700 ><P
1701 >       There are many sources of information available in the form
1702         of mailing lists, RFC's and documentation.  The docs that come
1703         with the samba distribution contain very good explanations of
1704         general SMB topics such as browsing.</P
1705 ><DIV
1706 CLASS="SECT2"
1707 ><HR><H2
1708 CLASS="SECT2"
1709 ><A
1710 NAME="AEN341"
1711 >URLs and similar</A
1712 ></H2
1713 ><P
1714 ></P
1715 ><UL
1716 ><LI
1717 ><P
1718 >Home of Samba site <A
1719 HREF="http://samba.org"
1720 TARGET="_top"
1721 >        http://samba.org</A
1722 >. We have a mirror near you !</P
1723 ></LI
1724 ><LI
1725 ><P
1726 > The <I
1727 CLASS="EMPHASIS"
1728 >Development</I
1729 > document
1730                 on the Samba mirrors might mention your problem. If so,
1731                 it might mean that the developers are working on it.</P
1732 ></LI
1733 ><LI
1734 ><P
1735 > Ignacio Coupeau has a very comprehesive look at LDAP with Samba at
1736                 <A
1737 HREF="http://www.unav.es/cti/ldap-smb-howto.html"
1738 TARGET="_top"
1739 >               http://www.unav.es/cti/ldap-smb-howto.html</A
1740 >
1741                 Be a little carefull however, I suspect that it does not specificly
1742                 address samba 2.2.x. The HEAD pre-2.1 may possibly be the best
1743                 stream to look at.</P
1744 ></LI
1745 ><LI
1746 ><P
1747 >  Lars Kneschke's site covers <A
1748 HREF="http://www.samba-tng.org"
1749 TARGET="_top"
1750 >        Samba-TNG</A
1751 > at
1752                 <A
1753 HREF="http://www.kneschke.de/projekte/samba_tng"
1754 TARGET="_top"
1755 >               http://www.kneschke.de/projekte/samba_tng</A
1756 >, but again, a
1757                 lot of it does not apply to the main stream Samba.</P
1758 ></LI
1759 ><LI
1760 ><P
1761 >See how Scott Merrill simulates a BDC behaviour at
1762         <A
1763 HREF="http://www.skippy.net/linux/smb-howto.html"
1764 TARGET="_top"
1765 >        http://www.skippy.net/linux/smb-howto.html</A
1766 >. </P
1767 ></LI
1768 ><LI
1769 ><P
1770 >Although 2.0.7 has almost had its day as a PDC, I (drb) will
1771         keep the 2.0.7 PDC pages at <A
1772 HREF="http://bioserve.latrobe.edu.au/samba"
1773 TARGET="_top"
1774 >        http://bioserve.latrobe.edu.au/samba</A
1775 > going for a while yet.</P
1776 ></LI
1777 ><LI
1778 ><P
1779 >Misc links to CIFS information
1780         <A
1781 HREF="http://samba.org/cifs/"
1782 TARGET="_top"
1783 >http://samba.org/cifs/</A
1784 ></P
1785 ></LI
1786 ><LI
1787 ><P
1788 >NT Domains for Unix <A
1789 HREF="http://mailhost.cb1.com/~lkcl/ntdom/"
1790 TARGET="_top"
1791 >        http://mailhost.cb1.com/~lkcl/ntdom/</A
1792 ></P
1793 ></LI
1794 ><LI
1795 ><P
1796 >FTP site for older SMB specs:
1797         <A
1798 HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/"
1799 TARGET="_top"
1800 >        ftp://ftp.microsoft.com/developr/drg/CIFS/</A
1801 ></P
1802 ></LI
1803 ></UL
1804 ><P
1805 >       You should also refer to the MS archives at
1806         <A
1807 HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/"
1808 TARGET="_top"
1809 >ftp://ftp.microsoft.com/developr/drg/CIFS/"</A
1810 >
1811         </P
1812 ></DIV
1813 ><DIV
1814 CLASS="SECT2"
1815 ><HR><H2
1816 CLASS="SECT2"
1817 ><A
1818 NAME="AEN374"
1819 >How do I get help from the mailing lists ?</A
1820 ></H2
1821 ><P
1822 > There are a number of Samba related mailing lists. Go to <A
1823 HREF="http://samba.org"
1824 TARGET="_top"
1825 >http://samba.org</A
1826 >, click on your nearest mirror
1827         and then click on <B
1828 CLASS="COMMAND"
1829 >Support</B
1830 > and then click on <B
1831 CLASS="COMMAND"
1832 >        Samba related mailing lists</B
1833 >.</P
1834 ><P
1835 >For questions relating to Samba TNG go to
1836         <A
1837 HREF="http://www.samba-tng.org/"
1838 TARGET="_top"
1839 >http://www.samba-tng.org/</A
1840 >
1841             It has been requested that you don't post questions about Samba-TNG to the
1842         main stream Samba lists.</P
1843 ><P
1844 ></P
1845 ><P
1846 ><B
1847 >If you post a message to one of the lists please
1848          observe the following guide lines :</B
1849 ></P
1850 ><UL
1851 ><LI
1852 ><P
1853 > Always remember that the developers are volunteers, they are
1854                 not paid and they never guarantee to produce a particular feature at
1855                 a particular time. Any time lines are 'best guess' and nothing more.
1856                 </P
1857 ></LI
1858 ><LI
1859 ><P
1860 > Always mention what version of samba you are using and what
1861                 operating system its running under. You should probably list the
1862         relevant sections of your smb.conf file, at least the options
1863         in [global] that affect PDC support.</P
1864 ></LI
1865 ><LI
1866 ><P
1867 >In addition to the version, if you obtained Samba via
1868         CVS mention the date when you last checked it out.</P
1869 ></LI
1870 ><LI
1871 ><P
1872 > Try and make your question clear and brief, lots of long,
1873                 convoluted questions get deleted before they are completely read !
1874                 Don't post html encoded messages (if you can select colour or font
1875                 size its html).</P
1876 ></LI
1877 ><LI
1878 ><P
1879 > If you run one of those niffy 'I'm on holidays' things when
1880                 you are away, make sure its configured  to not answer mailing lists.
1881                 </P
1882 ></LI
1883 ><LI
1884 ><P
1885 > Don't cross post. Work out which is the best list to post to
1886                 and see what happens, ie don't post to both samba-ntdom and samba-technical.
1887         Many people active on the lists subscribe to more
1888                 than one list and get annoyed to see the same message two or more times.
1889                 Often someone will see a message and thinking it would be better dealt
1890                 with on another, will forward it on for you.</P
1891 ></LI
1892 ><LI
1893 ><P
1894 >You might include <I
1895 CLASS="EMPHASIS"
1896 >partial</I
1897 >
1898         log files written at a debug level set to as much as 20.
1899         Please don't send the entire log but enough to give the context of the
1900         error messages.</P
1901 ></LI
1902 ><LI
1903 ><P
1904 >(Possibly) If you have a complete netmon trace ( from the opening of
1905         the pipe to the error ) you can send the *.CAP file as well.</P
1906 ></LI
1907 ><LI
1908 ><P
1909 >Please think carefully before attaching a document to an email.
1910         Consider pasting the relevant parts into the body of the message. The samba
1911         mailing lists go to a huge number of people, do they all need a copy of your
1912         smb.conf in their attach directory ?</P
1913 ></LI
1914 ></UL
1915 ></DIV
1916 ><DIV
1917 CLASS="SECT2"
1918 ><HR><H2
1919 CLASS="SECT2"
1920 ><A
1921 NAME="AEN403"
1922 >How do I get off the mailing lists ?</A
1923 ></H2
1924 ><P
1925 >To have your name removed from a samba mailing list, go to the
1926         same place you went to to get on it. Go to <A
1927 HREF="http://lists.samba.org/"
1928 TARGET="_top"
1929 >http://lists.samba.org</A
1930 >, click
1931                 on your nearest mirror and then click on <B
1932 CLASS="COMMAND"
1933 >Support</B
1934 > and
1935                 then click on <B
1936 CLASS="COMMAND"
1937 > Samba related mailing lists</B
1938 >. Or perhaps see
1939         <A
1940 HREF="http://lists.samba.org/mailman/roster/samba-ntdom"
1941 TARGET="_top"
1942 >here</A
1943 ></P
1944 ><P
1945 >       Please don't post messages to the list asking to be removed, you will just
1946         be refered to the above address (unless that process failed in some way...)
1947     </P
1948 ></DIV
1949 ></DIV
1950 ></DIV
1951 ></DIV
1952 ></BODY
1953 ></HTML
1954 >