docs/Samba-HOWTO-Collection/Group-Mapping.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <chapter id="groupmapping">
   4 <chapterinfo>
   5         &author.jht;
   6         <author>
   7                 <firstname>Jean François</firstname><surname>Micouleau</surname>
   8         </author>
   9         &author.jerry;
  10 </chapterinfo>
  11 <title>Group Mapping &smbmdash; MS Windows and UNIX</title>
  12
  13
  14         <para>
  15 <indexterm significance="preferred"><primary>groups</primary><secondary>mapping</secondary></indexterm>
  16         Starting with Samba-3, new group mapping functionality is available to create associations
  17         between Windows group SIDs and UNIX groups. The <command>groupmap</command> subcommand
  18         included with the &net; tool can be used to manage these associations.
  19         </para>
  20
  21         <para>
  22         The new facility for mapping NT Groups to UNIX system groups allows the administrator to decide
  23         which NT Domain Groups are to be exposed to MS Windows clients. Only those NT Groups that map
  24         to a UNIX group that has a value other than the default (<constant>-1</constant>) will be exposed
  25         in group selection lists in tools that access domain users and groups.
  26         </para>
  27
  28         <warning>
  29         <para>
  30         <indexterm><primary>domain admin group</primary></indexterm>
  31         The <parameter>domain admin group</parameter> parameter has been removed in Samba-3 and should no longer
  32         be specified in &smb.conf;. In Samba-2.2.x, this parameter was used to give the listed users membership in the
  33         <constant>Domain Admins</constant> Windows group which gave local admin rights on their workstations
  34         (in default configurations).
  35         </para>
  36         </warning>
  37
  38 <sect1>
  39 <title>Features and Benefits</title>
  40
  41         <para>
  42         Samba allows the administrator to create MS Windows NT4/200x group accounts and to
  43         arbitrarily associate them with UNIX/Linux group accounts.
  44         </para>
  45
  46         <para>
  47 <indexterm><primary>UID</primary></indexterm>
  48 <indexterm><primary>GID</primary></indexterm>
  49 <indexterm><primary>idmap uid</primary></indexterm>
  50         Group accounts can be managed using the MS Windows NT4 or MS Windows 200x/XP Professional MMC tools.
  51         Appropriate interface scripts should be provided in &smb.conf; if it is desired that UNIX/Linux system
  52         accounts should be automatically created when these tools are used. In the absence of these scripts, and
  53         so long as <command>winbindd</command> is running, Samba group accounts that are created using these
  54         tools will be allocated UNIX UIDs/GIDs from the ID range specified by the
  55         <smbconfoption name="idmap uid"/>/<smbconfoption name="idmap gid"/>
  56         parameters in the &smb.conf; file.
  57         </para>
  58
  59         <image id="idmap-sid2gid">
  60                 <imagedescription>IDMAP: group SID to GID resolution.</imagedescription>
  61                 <imagefile scale="50">idmap-sid2gid</imagefile>
  62         </image>
  63
  64         <image id="idmap-gid2sid">
  65                 <imagedescription>IDMAP: GID resolution to matching SID.</imagedescription>
  66         <imagefile scale="50">idmap-gid2sid</imagefile>
  67         </image>
  68
  69         <para>
  70         <indexterm><primary>IDMAP</primary></indexterm>
  71         In both cases, when winbindd is not running, only locally resolvable groups can be recognized. Please refer to
  72         <link linkend="idmap-sid2gid">IDMAP: group SID to GID resolution</link> and <link linkend="idmap-gid2sid">IDMAP: GID resolution to matching SID</link>.
  73         The <command>net groupmap</command> is
  74         used to establish UNIX group to NT SID mappings as shown in <link linkend="idmap-store-gid2sid">IDMAP: storing group mappings</link>.
  75         </para>
  76
  77         <image id="idmap-store-gid2sid">
  78                 <imagedescription>IDMAP storing group mappings.</imagedescription>
  79                 <imagefile scale="50">idmap-store-gid2sid</imagefile>
  80         </image>
  81
  82         <para>
  83         <indexterm><primary>groupadd</primary></indexterm>
  84         <indexterm><primary>groupdel</primary></indexterm>
  85         Administrators should be aware that where &smb.conf; group interface scripts make
  86         direct calls to the UNIX/Linux system tools (the shadow utilities, <command>groupadd</command>,
  87         <command>groupdel</command>, and <command>groupmod</command>), the resulting UNIX/Linux group names will be subject
  88         to any limits imposed by these tools. If the tool does not allow upper case characters
  89         or space characters, then the creation of an MS Windows NT4/200x style group of
  90         <ntgroup>Engineering Managers</ntgroup> will attempt to create an identically named
  91         UNIX/Linux group, an attempt that will of course fail.
  92         </para>
  93
  94
  95
  96         <para>
  97         <indexterm><primary>GID</primary></indexterm>
  98         <indexterm><primary>SID</primary></indexterm>
  99         There are several possible work-arounds for the operating system tools limitation. One
 100         method is to use a script that generates a name for the UNIX/Linux system group that
 101         fits the operating system limits, and that then just passes the UNIX/Linux group ID (GID)
 102         back to the calling Samba interface. This will provide a dynamic work-around solution.
 103         </para>
 104
 105         <para>
 106         Another work-around is to manually create a UNIX/Linux group, then manually create the
 107         MS Windows NT4/200x group on the Samba server and then use the <command>net groupmap</command>
 108         tool to connect the two to each other.
 109         </para>
 110
 111 </sect1>
 112
 113 <sect1>
 114 <title>Discussion</title>
 115
 116         <para>
 117         When installing <application>MS Windows NT4/200x</application> on a computer, the installation
 118         program creates default users and groups, notably the <constant>Administrators</constant> group,
 119         and gives that group privileges necessary privileges to perform essential system tasks,
 120         such as the ability to change the date and time or to kill (or close) any process running on the
 121         local machine.
 122         </para>
 123
 124         <para>
 125         <indexterm><primary>Administrator</primary></indexterm>
 126         The <constant>Administrator</constant> user is a member of the <constant>Administrators</constant> group, and thus inherits
 127         <constant>Administrators</constant> group privileges. If a <constant>joe</constant> user is created to be a member of the
 128         <constant>Administrators</constant> group, <constant>joe</constant> has exactly the same rights as the user,
 129         <constant>Administrator</constant>.
 130         </para>
 131
 132         <para>
 133         When an MS Windows NT4/200x/XP machine is made a Domain Member, the <quote>Domain Admins</quote> group of the
 134         PDC is added to the local <constant>Administrators</constant> group of the workstation. Every member of the
 135         <constant>Domain Administrators</constant> group inherits the rights of the local <constant>Administrators</constant> group when
 136         logging on the workstation.
 137         </para>
 138
 139         <para>
 140         The following steps describe how to make Samba PDC users members of the <constant>Domain Admins</constant> group?
 141         </para>
 142
 143         <orderedlist>
 144                 <listitem><para>
 145                 Create a UNIX group (usually in <filename>/etc/group</filename>), let's call it <constant>domadm</constant>.
 146                 </para></listitem>
 147
 148                 <listitem><para>
 149                 Add to this group the users that must be <quote>Administrators</quote>. For example,
 150                 if you want <constant>joe, john</constant> and <constant>mary</constant> to be administrators,
 151                 your entry in <filename>/etc/group</filename> will look like this:
 152                 </para>
 153
 154                 <para><programlisting>
 155                 domadm:x:502:joe,john,mary
 156                 </programlisting>
 157                 </para></listitem>
 158
 159                 <listitem><para>
 160                 Map this domadm group to the <quote>Domain Admins</quote> group by running the command:
 161                 </para>
 162
 163                 <para>
 164         <screen>
 165         &rootprompt;<userinput>net groupmap add ntgroup="Domain Admins" unixgroup=domadm</userinput>
 166         </screen>
 167         </para>
 168
 169                 <para>
 170                 <indexterm><primary>Domain Admins group</primary></indexterm>
 171                 The quotes around <quote>Domain Admins</quote> are necessary due to the space in the group name.
 172                 Also make sure to leave no white-space surrounding the equal character (=).
 173                 </para></listitem>
 174         </orderedlist>
 175
 176         <para>
 177         Now <constant>joe, john</constant> and <constant>mary</constant> are domain administrators.
 178         </para>
 179
 180         <para>
 181         <indexterm><primary>groups</primary><secondary>domain</secondary></indexterm>
 182         It is possible to map any arbitrary UNIX group to any Windows NT4/200x group as well as
 183         making any UNIX group a Windows domain group. For example, if you wanted to include a
 184         UNIX group (e.g., acct) in an ACL on a local file or printer on a Domain Member machine,
 185         you would flag that group as a domain group by running the following on the Samba PDC:
 186         </para>
 187
 188         <para>
 189 <screen>
 190 &rootprompt;<userinput>net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct</userinput>
 191 </screen>
 192         </para>
 193
 194         <para>
 195         Be aware that the RID parameter is a unsigned 32-bit integer that should
 196         normally start at 1000. However, this RID must not overlap with any RID assigned
 197         to a user. Verification for this is done differently depending on the passdb backend
 198         you are using. Future versions of the tools may perform the verification automatically,
 199         but for now the burden is on you.
 200         </para>
 201
 202         <sect2>
 203         <title>Important Administrative Information</title>
 204
 205         <para>
 206         Administrative rights are necessary in two specific forms:
 207         </para>
 208
 209         <orderedlist>
 210                 <listitem><para>For Samba-3 Domain Controllers and
 211                                 Domain Member Servers/Clients.</para></listitem>
 212                 <listitem><para>To manage Domain Member Windows workstations.</para></listitem>
 213         </orderedlist>
 214
 215         <para>
 216         Versions of Samba up to and including 3.0.10 do not provide a means for assigning rights and privileges
 217         that are necessary for system administration tasks from a Windows Domain Member Client machine so that
 218         domain administration tasks such as adding/deleting/changing user and group account information, and
 219         managing workstation domain membership accounts, can be handled by any account other than root.
 220         </para>
 221
 222         <para>
 223         Samba-3.0.11 introduced a new privilege management interface (see <link linkend="rights">Chapter on Rights and Privileges</link>)
 224         that permits these tasks to be delegated to non-root (i.e.: accounts other than the equivalent of the
 225         MS Windows Administrator) account.
 226         </para>
 227
 228         <para>
 229         Administrative tasks on a Windows Domain Member workstation, can be done by anyone who is a member of the
 230         <constant>Domain Admins</constant> group. This group can be mapped to any convenient UNIX group.
 231         </para>
 232
 233         <sect3>
 234         <title>Applicable Only to Versions Earlier than 3.0.11</title>
 235
 236         <para>
 237         Administrative tasks on UNIX/Linux systems, such as adding users or groups, requires <constant>root</constant>
 238         level privilege. The addition of a Windows client to a Samba Domain involves the addition of a user account
 239         for the Windows client.
 240         </para>
 241
 242         <para>
 243         Many UNIX administrators continue to request the Samba Team make it possible to add Windows workstations, or
 244         to ability to add/delete or modify user accounts, without requiring <constant>root</constant> privileges.
 245         Such a request violates every understanding of basic UNIX system security.
 246         </para>
 247
 248         <para>
 249         There is no safe way to provide access on a UNIX/Linux system without providing <constant>root</constant>
 250         level privilege. Provision of <constant>root</constant> privileges can be done either by logging onto
 251         the Domain as the user <constant>root</constant>, or by permitting particular users to use a UNIX account
 252         that has a UID=0 in the <filename>/etc/passwd</filename> database. Users of such accounts can use tools
 253         like the NT4 Domain User Manager, and the NT4 Domain Server Manager to manage user and group accounts as
 254         well as Domain Member server and client accounts. This level of privilege is also needed to manage share
 255         level ACLs.
 256         </para>
 257
 258         </sect3>
 259
 260         </sect2>
 261
 262         <sect2>
 263         <title>Default Users, Groups and Relative Identifiers</title>
 264
 265         <para>
 266 <indexterm><primary>Relative Identifier</primary><see>RID</see></indexterm>
 267 <indexterm><primary>RID</primary></indexterm>
 268         When first installed, Microsoft Windows NT4/200x/XP are pre-configured with certain User, Group, and
 269         Alias entities. Each has a well-known Relative Identifier (RID). These must be preserved for continued
 270         integrity of operation. Samba must be provisioned with certain essential Domain Groups that require
 271         the appropriate RID value. When Samba-3 is configured to use <constant>tdbsam</constant> the essential
 272         Domain Groups are automatically created. It is the LDAP administrators' responsibility to create
 273         (provision) the default NT Groups.
 274         </para>
 275
 276         <para>
 277         Each essential Domain Group must be assigned its respective well-known RID. The default Users, Groups,
 278         Aliases, and RIDs are shown in <link linkend="WKURIDS">Well-Known User Default RIDs</link> table.
 279         </para>
 280
 281         <note><para>
 282         When the <parameter>passdb backend</parameter> uses LDAP (<constant>ldapsam</constant>) it is the
 283         administrators' responsibility to create the essential Domain Groups, and to assign each its default RID.
 284         </para></note>
 285
 286         <para>
 287         It is permissible to create any Domain Group that may be necessary, just make certain that the essential
 288         Domain Groups (well known) have been created and assigned its default RID. Other groups you create may
 289         be assigned any arbitrary RID you care to use.
 290         </para>
 291
 292         <para>
 293         Be sure to map each Domain Group to a UNIX system group. That is the only way to ensure that the group
 294         will be available for use as an NT Domain Group.
 295         </para>
 296
 297         <para>
 298         <table frame="all" id="WKURIDS">
 299         <title>Well-Known User Default RIDs</title>
 300                 <tgroup cols="4" align="left">
 301                         <colspec align="left"/>
 302                         <colspec align="left"/>
 303                         <colspec align="left"/>
 304                         <colspec align="center"/>
 305                         <thead>
 306                                 <row>
 307                                         <entry>Well-Known Entity</entry>
 308                                         <entry>RID</entry>
 309                                         <entry>Type</entry>
 310                                         <entry>Essential</entry>
 311                                 </row>
 312                         </thead>
 313                         <tbody>
 314                                 <row>
 315                                         <entry>Domain Administrator</entry>
 316                                         <entry>500</entry>
 317                                         <entry>User</entry>
 318                                         <entry>No</entry>
 319                                 </row>
 320                                 <row>
 321                                         <entry>Domain Guest</entry>
 322                                         <entry>501</entry>
 323                                         <entry>User</entry>
 324                                         <entry>No</entry>
 325                                 </row>
 326                                 <row>
 327                                         <entry>Domain KRBTGT</entry>
 328                                         <entry>502</entry>
 329                                         <entry>User</entry>
 330                                         <entry>No</entry>
 331                                 </row>
 332                                 <row>
 333                                         <entry>Domain Admins</entry>
 334                                         <entry>512</entry>
 335                                         <entry>Group</entry>
 336                                         <entry>Yes</entry>
 337                                 </row>
 338                                 <row>
 339                                         <entry>Domain Users</entry>
 340                                         <entry>513</entry>
 341                                         <entry>Group</entry>
 342                                         <entry>Yes</entry>
 343                                 </row>
 344                                 <row>
 345                                         <entry>Domain Guests</entry>
 346                                         <entry>514</entry>
 347                                         <entry>Group</entry>
 348                                         <entry>Yes</entry>
 349                                 </row>
 350                                 <row>
 351                                         <entry>Domain Computers</entry>
 352                                         <entry>515</entry>
 353                                         <entry>Group</entry>
 354                                         <entry>No</entry>
 355                                 </row>
 356                                 <row>
 357                                         <entry>Domain Controllers</entry>
 358                                         <entry>516</entry>
 359                                         <entry>Group</entry>
 360                                         <entry>No</entry>
 361                                 </row>
 362                                 <row>
 363                                         <entry>Domain Certificate Admins</entry>
 364                                         <entry>517</entry>
 365                                         <entry>Group</entry>
 366                                         <entry>No</entry>
 367                                 </row>
 368                                 <row>
 369                                         <entry>Domain Schema Admins</entry>
 370                                         <entry>518</entry>
 371                                         <entry>Group</entry>
 372                                         <entry>No</entry>
 373                                 </row>
 374                                 <row>
 375                                         <entry>Domain Enterprise Admins</entry>
 376                                         <entry>519</entry>
 377                                         <entry>Group</entry>
 378                                         <entry>No</entry>
 379                                 </row>
 380                                 <row>
 381                                         <entry>Domain Policy Admins</entry>
 382                                         <entry>520</entry>
 383                                         <entry>Group</entry>
 384                                         <entry>No</entry>
 385                                 </row>
 386                                 <row>
 387                                         <entry>Builtin Admins</entry>
 388                                         <entry>544</entry>
 389                                         <entry>Alias</entry>
 390                                         <entry>No</entry>
 391                                 </row>
 392                                 <row>
 393                                         <entry>Builtin users</entry>
 394                                         <entry>545</entry>
 395                                         <entry>Alias</entry>
 396                                         <entry>No</entry>
 397                                 </row>
 398                                 <row>
 399                                         <entry>Builtin Guests</entry>
 400                                         <entry>546</entry>
 401                                         <entry>Alias</entry>
 402                                         <entry>No</entry>
 403                                 </row>
 404                                 <row>
 405                                         <entry>Builtin Power Users</entry>
 406                                         <entry>547</entry>
 407                                         <entry>Alias</entry>
 408                                         <entry>No</entry>
 409                                 </row>
 410                                 <row>
 411                                         <entry>Builtin Account Operators</entry>
 412                                         <entry>548</entry>
 413                                         <entry>Alias</entry>
 414                                         <entry>No</entry>
 415                                 </row>
 416                                 <row>
 417                                         <entry>Builtin System Operators</entry>
 418                                         <entry>549</entry>
 419                                         <entry>Alias</entry>
 420                                         <entry>No</entry>
 421                                 </row>
 422                                 <row>
 423                                         <entry>Builtin Print Operators</entry>
 424                                         <entry>550</entry>
 425                                         <entry>Alias</entry>
 426                                         <entry>No</entry>
 427                                 </row>
 428                                 <row>
 429                                         <entry>Builtin Backup Operators</entry>
 430                                         <entry>551</entry>
 431                                         <entry>Alias</entry>
 432                                         <entry>No</entry>
 433                                 </row>
 434                                 <row>
 435                                         <entry>Builtin Replicator</entry>
 436                                         <entry>552</entry>
 437                                         <entry>Alias</entry>
 438                                         <entry>No</entry>
 439                                 </row>
 440                                 <row>
 441                                         <entry>Builtin RAS Servers</entry>
 442                                         <entry>553</entry>
 443                                         <entry>Alias</entry>
 444                                         <entry>No</entry>
 445                                 </row>
 446                         </tbody>
 447                 </tgroup>
 448         </table>
 449         </para>
 450
 451         </sect2>
 452
 453         <sect2>
 454         <title>Example Configuration</title>
 455
 456                 <para>
 457                 You can list the various groups in the mapping database by executing
 458                 <command>net groupmap list</command>. Here is an example:
 459                 </para>
 460
 461 <indexterm><primary>net</primary><secondary>groupmap</secondary></indexterm>
 462
 463                 <para>
 464 <screen>
 465 &rootprompt; <userinput>net groupmap list</userinput>
 466 Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin
 467 Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser
 468 Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest
 469 </screen>
 470                 </para>
 471
 472                 <para>
 473                 For complete details on <command>net groupmap</command>, refer to the net(8) man page.
 474                 </para>
 475
 476         </sect2>
 477
 478 </sect1>
 479
 480 <sect1>
 481 <title>Configuration Scripts</title>
 482
 483         <para>
 484         Everyone needs tools. Some of us like to create our own, others prefer to use canned tools
 485         (i.e., prepared by someone else for general use).
 486         </para>
 487
 488         <sect2>
 489         <title>Sample &smb.conf; Add Group Script</title>
 490
 491                 <para>
 492                 <indexterm><primary>smbgrpadd.sh</primary></indexterm>
 493                 <indexterm><primary>groupadd limitations</primary></indexterm>
 494                 A script to create complying group names for use by the Samba group interfaces
 495                 is provided in <link linkend="smbgrpadd.sh">smbgrpadd.sh</link>. This script will
 496                 add a temporary entry in the <filename>/etc/group</filename> file and then rename
 497                 it to to the desired name. This is an example of a method to get around operating
 498                 system maintenance tool limititations such as that present in some version of the
 499                 <command>groupadd</command> tool.
 500                 </para>
 501
 502 <indexterm><primary>smbgrpadd.sh</primary></indexterm>
 503                 <para>
 504 <example id="smbgrpadd.sh">
 505         <title>smbgrpadd.sh</title>
 506 <programlisting>
 507
 508 #!/bin/bash
 509
 510 # Add the group using normal system groupadd tool.
 511 groupadd smbtmpgrp00
 512
 513 thegid=`cat /etc/group | grep ^smbtmpgrp00 | cut -d ":" -f3`
 514
 515 # Now change the name to what we want for the MS Windows networking end
 516 cp /etc/group /etc/group.bak
 517 cat /etc/group.bak | sed "s/^smbtmpgrp00/$1/g" > /etc/group
 518
 519 # Now return the GID as would normally happen.
 520 echo $thegid
 521 exit 0
 522 </programlisting>
 523 </example>
 524 </para>
 525
 526                 <para>
 527                 The &smb.conf; entry for the above script would be something like that in <link linkend="smbgrpadd">the following example</link>.
 528 <smbconfexample id="smbgrpadd">
 529 <title>Configuration of &smb.conf; for the add group script.</title>
 530 <smbconfsection>[global]</smbconfsection>
 531 <member>...</member>
 532 <smbconfoption name="add group script">/path_to_tool/smbgrpadd.sh &quot;%g&quot;</smbconfoption>
 533 <member>...</member>
 534 </smbconfexample>
 535                 </para>
 536
 537         </sect2>
 538
 539         <sect2>
 540         <title>Script to Configure Group Mapping</title>
 541
 542         <para>
 543                 In our example we have created a UNIX/Linux group called <ntgroup>ntadmin</ntgroup>.
 544                 Our script will create the additional groups <ntgroup>Orks</ntgroup>, <ntgroup>Elves</ntgroup>, and <ntgroup>Gnomes</ntgroup>.
 545                 It is a good idea to save this shell script for later re-use just in case you ever need to rebuild your mapping database.
 546                 For the sake of convenience we elect to save this script as a file called <filename>initGroups.sh</filename>.
 547                 This script is given in <link linkend="set-group-map">intGroups.sh</link>.
 548         </para>
 549
 550 <para>
 551 <indexterm><primary>initGroups.sh</primary></indexterm>
 552 <example id="set-group-map">
 553         <title>Script to Set Group Mapping</title>
 554 <programlisting>
 555 #!/bin/bash
 556
 557 net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin
 558 net groupmap modify ntgroup="Domain Users" unixgroup=users
 559 net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
 560
 561 groupadd Orks
 562 groupadd Elves
 563 groupadd Gnomes
 564
 565 net groupmap add ntgroup="Orks"   unixgroup=Orks   type=d
 566 net groupmap add ntgroup="Elves"  unixgroup=Elves  type=d
 567 net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d
 568 </programlisting>
 569 </example>
 570 </para>
 571
 572         <para>
 573         Of course it is expected that the administrator will modify this to suit local needs.
 574         For information regarding the use of the <command>net groupmap</command> tool please
 575         refer to the man page.
 576         </para>
 577
 578         </sect2>
 579
 580 </sect1>
 581
 582 <sect1>
 583 <title>Common Errors</title>
 584
 585 <para>
 586 At this time there are many little surprises for the unwary administrator. In a real sense
 587 it is imperative that every step of automated control scripts must be carefully tested
 588 manually before putting them into active service.
 589 </para>
 590
 591         <sect2>
 592         <title>Adding Groups Fails</title>
 593
 594                 <para>
 595                 This is a common problem when the <command>groupadd</command> is called directly
 596                 by the Samba interface script for the <smbconfoption name="add group script"/> in
 597                 the &smb.conf; file.
 598                 </para>
 599
 600                 <para>
 601                 The most common cause of failure is an attempt to add an MS Windows group account
 602                 that has either an upper case character and/or a space character in it.
 603                 </para>
 604
 605                 <para>
 606                 There are three possible work-arounds. First, use only group names that comply
 607                 with the limitations of the UNIX/Linux <command>groupadd</command> system tool.
 608                 Second, it involves the use of the script mentioned earlier in this chapter, and
 609                 third is the option is to manually create a UNIX/Linux group account that can substitute
 610                 for the MS Windows group name, then use the procedure listed above to map that group
 611                 to the MS Windows group.
 612                 </para>
 613
 614         </sect2>
 615
 616         <sect2>
 617         <title>Adding MS Windows Groups to MS Windows Groups Fails</title>
 618
 619         <indexterm><primary>groups</primary><secondary>nested</secondary></indexterm>
 620
 621                 <para>
 622                 Samba-3 does not support nested groups from the MS Windows control environment.
 623                 </para>
 624
 625         </sect2>
 626
 627         <sect2>
 628         <title>Adding <emphasis>Domain Users</emphasis> to the <emphasis>Power Users</emphasis> Group</title>
 629
 630                 <para><quote>
 631                 What must I do to add Domain Users to the Power Users group?
 632                 </quote></para>
 633
 634 <indexterm><primary>Domain Users group</primary></indexterm>
 635
 636                 <para>
 637                 The Power Users group is a group that is local to each Windows 200x/XP Professional workstation.
 638                 You cannot add the Domain Users group to the Power Users group automatically, it must be done on
 639                 each workstation by logging in as the local workstation <emphasis>administrator</emphasis> and
 640                 then using the following procedure:
 641                 </para>
 642
 643                 <procedure>
 644                         <step><para>
 645                         Click <guimenu>Start -> Control Panel -> Users and Passwords</guimenu>.
 646                         </para></step>
 647
 648                         <step><para>
 649                         Click the <guimenuitem>Advanced</guimenuitem> tab.
 650                         </para></step>
 651
 652                         <step><para>
 653                         Click the <guibutton>Advanced</guibutton> button.
 654                         </para></step>
 655
 656                         <step><para>
 657                         Click <constant>Groups</constant>.
 658                         </para></step>
 659
 660                         <step><para>
 661                         Double click <constant>Power Users</constant>. This will launch the panel to add users or groups
 662                         to the local machine <constant>Power Uses</constant> group.
 663                         </para></step>
 664
 665                         <step><para>
 666                         Click the <guibutton>Add</guibutton> button.
 667                         </para></step>
 668
 669                         <step><para>
 670                         Select the domain from which the <constant>Domain Users</constant> group is to be added.
 671                         </para></step>
 672
 673                         <step><para>
 674                         Double click the <constant>Domain Users</constant> group.
 675                         </para></step>
 676
 677                         <step><para>
 678                         Click the <guibutton>Ok</guibutton> button. If a logon box is presented during this process
 679                         please remember to enter the connect as <constant>DOMAIN\UserName</constant>. i.e., For the
 680                         domain <constant>MIDEARTH</constant> and the user <constant>root</constant> enter
 681                         <constant>MIDEARTH\root</constant>.
 682                         </para></step>
 683                 </procedure>
 684         </sect2>
 685
 686 </sect1>
 687
 688 </chapter>