docs/htmldocs/Samba-PDC-HOWTO.html

   1 <HTML
   2 ><HEAD
   3 ><TITLE
   4 >How to Configure Samba 2.2 as a Primary Domain Controller</TITLE
   5 ><META
   6 NAME="GENERATOR"
   7 CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
   8 ><BODY
   9 CLASS="ARTICLE"
  10 BGCOLOR="#FFFFFF"
  11 TEXT="#000000"
  12 LINK="#0000FF"
  13 VLINK="#840084"
  14 ALINK="#0000FF"
  15 ><DIV
  16 CLASS="ARTICLE"
  17 ><DIV
  18 CLASS="TITLEPAGE"
  19 ><H1
  20 CLASS="TITLE"
  21 ><A
  22 NAME="AEN1"
  23 >How to Configure Samba 2.2 as a Primary Domain Controller</A
  24 ></H1
  25 ><HR></DIV
  26 ><DIV
  27 CLASS="SECT1"
  28 ><H1
  29 CLASS="SECT1"
  30 ><A
  31 NAME="AEN3"
  32 >Prerequisite Reading</A
  33 ></H1
  34 ><P
  35 >Before you continue readingin this chapter, please make sure
  36 that you are comfortable with configuring basic files services
  37 in smb.conf and how to enable and administrate password
  38 encryption in Samba.  Theses two topics are covered in the
  39 <A
  40 HREF="smb.conf.5.html"
  41 TARGET="_top"
  42 ><TT
  43 CLASS="FILENAME"
  44 >smb.conf(5)</TT
  45 ></A
  46 >
  47 manpage and the <A
  48 HREF="EMCRYPTION.html"
  49 TARGET="_top"
  50 >Encryption chapter</A
  51 >
  52 of this HOWTO Collection.</P
  53 ></DIV
  54 ><DIV
  55 CLASS="SECT1"
  56 ><HR><H1
  57 CLASS="SECT1"
  58 ><A
  59 NAME="AEN9"
  60 >Background</A
  61 ></H1
  62 ><DIV
  63 CLASS="NOTE"
  64 ><BLOCKQUOTE
  65 CLASS="NOTE"
  66 ><P
  67 ><B
  68 >Note: </B
  69 ><I
  70 CLASS="EMPHASIS"
  71 >Author's Note :</I
  72 > This document is a combination
  73 of David Bannon's Samba 2.2 PDC HOWTO and the Samba NT Domain FAQ.
  74 Both documents are superceeded by this one.</P
  75 ></BLOCKQUOTE
  76 ></DIV
  77 ><P
  78 >Version of Samba prior to release 2.2 had marginal capabilities to
  79 act as a Windows NT 4.0 Primary Domain Controller (PDC).  Beginning with
  80 Samba 2.2.0, we are proud to announce official support for Windows NT 4.0
  81 style domain logons from Windows NT 4.0 (through SP6) and Windows 2000 (through
  82 SP1) clients.  This article outlines the steps necessary for configuring Samba
  83 as a PDC.  It is necessary to have a working Samba server prior to implementing the
  84 PDC functionality.  If you have not followed the steps outlined in
  85 <A
  86 HREF="UNIX_INSTALL.html"
  87 TARGET="_top"
  88 > UNIX_INSTALL.html</A
  89 >, please make sure
  90 that your server is configured correctly before proceeding.  Another good
  91 resource in the <A
  92 HREF="smb.conf.5.html"
  93 TARGET="_top"
  94 >smb.conf(5) man
  95 page</A
  96 >. The following  functionality should work in 2.2:</P
  97 ><P
  98 ></P
  99 ><UL
 100 ><LI
 101 ><P
 102 >       domain logons for Windows NT 4.0/2000 clients.
 103         </P
 104 ></LI
 105 ><LI
 106 ><P
 107 >       placing a Windows 9x client in user level security
 108         </P
 109 ></LI
 110 ><LI
 111 ><P
 112 >       retrieving a list of users and groups from a Samba PDC to
 113         Windows 9x/NT/2000 clients
 114         </P
 115 ></LI
 116 ><LI
 117 ><P
 118 >       roving (roaming) user profiles
 119         </P
 120 ></LI
 121 ><LI
 122 ><P
 123 >       Windows NT 4.0 style system policies
 124         </P
 125 ></LI
 126 ></UL
 127 ><DIV
 128 CLASS="WARNING"
 129 ><P
 130 ></P
 131 ><TABLE
 132 CLASS="WARNING"
 133 BORDER="1"
 134 WIDTH="100%"
 135 ><TR
 136 ><TD
 137 ALIGN="CENTER"
 138 ><B
 139 >Windows 2000 Service Pack 2 Clients</B
 140 ></TD
 141 ></TR
 142 ><TR
 143 ><TD
 144 ALIGN="LEFT"
 145 ><P
 146 >       Samba 2.2.1 is required for PDC functionality when using Windows 2000
 147         SP2 clients.
 148         </P
 149 ></TD
 150 ></TR
 151 ></TABLE
 152 ></DIV
 153 ><P
 154 >The following pieces of functionality are not included in the 2.2 release:</P
 155 ><P
 156 ></P
 157 ><UL
 158 ><LI
 159 ><P
 160 >       Windows NT 4 domain trusts
 161         </P
 162 ></LI
 163 ><LI
 164 ><P
 165 >       SAM replication with Windows NT 4.0 Domain Controllers
 166         (i.e. a Samba PDC and a Windows NT BDC or vice versa)
 167         </P
 168 ></LI
 169 ><LI
 170 ><P
 171 >       Adding users via the User Manager for Domains
 172         </P
 173 ></LI
 174 ><LI
 175 ><P
 176 >       Acting as a Windows 2000 Domain Controller (i.e. Kerberos and
 177         Active Directory)
 178         </P
 179 ></LI
 180 ></UL
 181 ><P
 182 >Please note that Windows 9x clients are not true members of a domain
 183 for reasons outlined in this article.  Therefore the protocol for
 184 support Windows 9x style domain logons is completely different
 185 from NT4 domain logons and has been officially supported for some
 186 time.</P
 187 ><P
 188 >Implementing a Samba PDC can basically be divided into 2 broad
 189 steps.</P
 190 ><P
 191 ></P
 192 ><OL
 193 TYPE="1"
 194 ><LI
 195 ><P
 196 >       Configuring the Samba PDC
 197         </P
 198 ></LI
 199 ><LI
 200 ><P
 201 >       Creating machine trust accounts and joining clients
 202         to the domain
 203         </P
 204 ></LI
 205 ></OL
 206 ><P
 207 >There are other minor details such as user profiles, system
 208 policies, etc...  However, these are not necessarily specific
 209 to a Samba PDC as much as they are related to Windows NT networking
 210 concepts.  They will be mentioned only briefly here.</P
 211 ></DIV
 212 ><DIV
 213 CLASS="SECT1"
 214 ><HR><H1
 215 CLASS="SECT1"
 216 ><A
 217 NAME="AEN49"
 218 >Configuring the Samba Domain Controller</A
 219 ></H1
 220 ><P
 221 >The first step in creating a working Samba PDC is to
 222 understand the parameters necessary in smb.conf.  I will not
 223 attempt to re-explain the parameters here as they are more that
 224 adequately covered in <A
 225 HREF="smb.conf.5.html"
 226 TARGET="_top"
 227 > the smb.conf
 228 man page</A
 229 >.  For convenience, the parameters have been
 230 linked with the actual smb.conf description.</P
 231 ><P
 232 >Here is an example smb.conf for acting as a PDC:</P
 233 ><P
 234 ><PRE
 235 CLASS="PROGRAMLISTING"
 236 >[global]
 237     ; Basic server settings
 238     <A
 239 HREF="smb.conf.5.html#NETBIOSNAME"
 240 TARGET="_top"
 241 >netbios name</A
 242 > = <TT
 243 CLASS="REPLACEABLE"
 244 ><I
 245 >POGO</I
 246 ></TT
 247 >
 248     <A
 249 HREF="smb.conf.5.html#WORKGROUP"
 250 TARGET="_top"
 251 >workgroup</A
 252 > = <TT
 253 CLASS="REPLACEABLE"
 254 ><I
 255 >NARNIA</I
 256 ></TT
 257 >
 258
 259     ; we should act as the domain and local master browser
 260     <A
 261 HREF="smb.conf.5.html#OSLEVEL"
 262 TARGET="_top"
 263 >os level</A
 264 > = 64
 265     <A
 266 HREF="smb.conf.5.html#PERFERREDMASTER"
 267 TARGET="_top"
 268 >preferred master</A
 269 > = yes
 270     <A
 271 HREF="smb.conf.5.html#DOMAINMASTER"
 272 TARGET="_top"
 273 >domain master</A
 274 > = yes
 275     <A
 276 HREF="smb.conf.5.html#LOCALMASTER"
 277 TARGET="_top"
 278 >local master</A
 279 > = yes
 280
 281     ; security settings (must user security = user)
 282     <A
 283 HREF="smb.conf.5.html#SECURITYEQUALSUSER"
 284 TARGET="_top"
 285 >security</A
 286 > = user
 287
 288     ; encrypted passwords are a requirement for a PDC
 289     <A
 290 HREF="smb.conf.5.html#ENCRYPTPASSWORDS"
 291 TARGET="_top"
 292 >encrypt passwords</A
 293 > = yes
 294
 295     ; support domain logons
 296     <A
 297 HREF="smb.conf.5.html#DOMAINLOGONS"
 298 TARGET="_top"
 299 >domain logons</A
 300 > = yes
 301
 302     ; where to store user profiles?
 303     <A
 304 HREF="smb.conf.5.html#LOGONPATH"
 305 TARGET="_top"
 306 >logon path</A
 307 > = \\%N\profiles\%u
 308
 309     ; where is a user's home directory and where should it
 310     ; be mounted at?
 311     <A
 312 HREF="smb.conf.5.html#LOGONDRIVE"
 313 TARGET="_top"
 314 >logon drive</A
 315 > = H:
 316     <A
 317 HREF="smb.conf.5.html#LOGONHOME"
 318 TARGET="_top"
 319 >logon home</A
 320 > = \\homeserver\%u
 321
 322     ; specify a generic logon script for all users
 323     ; this is a relative **DOS** path to the [netlogon] share
 324     <A
 325 HREF="smb.conf.5.html#LOGONSCRIPT"
 326 TARGET="_top"
 327 >logon script</A
 328 > = logon.cmd
 329
 330 ; necessary share for domain controller
 331 [netlogon]
 332     <A
 333 HREF="smb.conf.5.html#PATH"
 334 TARGET="_top"
 335 >path</A
 336 > = /usr/local/samba/lib/netlogon
 337     <A
 338 HREF="smb.conf.5.html#WRITEABLE"
 339 TARGET="_top"
 340 >writeable</A
 341 > = no
 342     <A
 343 HREF="smb.conf.5.html#WRITELIST"
 344 TARGET="_top"
 345 >write list</A
 346 > = <TT
 347 CLASS="REPLACEABLE"
 348 ><I
 349 >ntadmin</I
 350 ></TT
 351 >
 352
 353 ; share for storing user profiles
 354 [profiles]
 355     <A
 356 HREF="smb.conf.5.html#PATH"
 357 TARGET="_top"
 358 >path</A
 359 > = /export/smb/ntprofile
 360     <A
 361 HREF="smb.conf.5.html#WRITEABLE"
 362 TARGET="_top"
 363 >writeable</A
 364 > = yes
 365     <A
 366 HREF="smb.conf.5.html#CREATEMASK"
 367 TARGET="_top"
 368 >create mask</A
 369 > = 0600
 370     <A
 371 HREF="smb.conf.5.html#DIRECTORYMASK"
 372 TARGET="_top"
 373 >directory mask</A
 374 > = 0700</PRE
 375 ></P
 376 ><P
 377 >There are a couple of points to emphasize in the above configuration.</P
 378 ><P
 379 ></P
 380 ><UL
 381 ><LI
 382 ><P
 383 >       Encrypted passwords must be enabled.  For more details on how
 384         to do this, refer to <A
 385 HREF="ENCRYPTION.html"
 386 TARGET="_top"
 387 >ENCRYPTION.html</A
 388 >.
 389         </P
 390 ></LI
 391 ><LI
 392 ><P
 393 >       The server must support domain logons and a
 394         <TT
 395 CLASS="FILENAME"
 396 >[netlogon]</TT
 397 > share
 398         </P
 399 ></LI
 400 ><LI
 401 ><P
 402 >       The server must be the domain master browser in order for Windows
 403         client to locate the server as a DC.  Please refer to the various
 404         Network Browsing documentation included with this distribution for
 405         details.
 406         </P
 407 ></LI
 408 ></UL
 409 ><P
 410 >As Samba 2.2 does not offer a complete implementation of group mapping between
 411 Windows NT groups and UNIX groups (this is really quite complicated to explain
 412 in a short space), you should refer to the <A
 413 HREF="smb.conf.5.html#DOMAINADMINUSERS"
 414 TARGET="_top"
 415 >domain
 416 admin users</A
 417 > and <A
 418 HREF="smb.conf.5.html#DOMAINADMINGROUP"
 419 TARGET="_top"
 420 >domain
 421 admin group</A
 422 > smb.conf parameters for information of creating a Domain Admins
 423 style accounts.</P
 424 ></DIV
 425 ><DIV
 426 CLASS="SECT1"
 427 ><HR><H1
 428 CLASS="SECT1"
 429 ><A
 430 NAME="AEN92"
 431 >Creating Machine Trust Accounts and Joining Clients
 432 to the Domain</A
 433 ></H1
 434 ><P
 435 >A machine trust account is a samba user account owned by a computer.
 436 The account password acts as the shared secret for secure
 437 communication with the Domain Controller.  This is a security feature
 438 to prevent an unauthorized machine with the same netbios name from
 439 joining the domain and gaining access to domain user/group accounts.
 440 Hence a Windows 9x host is never a true member of a domain because it does
 441 not posses a machine trust account, and thus has no shared secret with the DC.</P
 442 ><P
 443 >On a Windows NT PDC, these machine trust account passwords are stored
 444 in the registry.  A Samba PDC stores these accounts in the same location
 445 as user LanMan and NT password hashes (currently <TT
 446 CLASS="FILENAME"
 447 >smbpasswd</TT
 448 >).
 449 However, machine trust accounts only possess and use the NT password hash.</P
 450 ><P
 451 >Because Samba requires machine accounts to possess a UNIX uid from
 452 which an Windows NT SID can be generated, all of these accounts
 453 must have an entry in <TT
 454 CLASS="FILENAME"
 455 >/etc/passwd</TT
 456 > and smbpasswd.
 457 Future releases will alleviate the need to create
 458 <TT
 459 CLASS="FILENAME"
 460 >/etc/passwd</TT
 461 > entries.  </P
 462 ><P
 463 >There are two means of creating machine trust accounts.</P
 464 ><P
 465 ></P
 466 ><UL
 467 ><LI
 468 ><P
 469 >       Manual creation before joining the client to the domain.  In this case,
 470         the password is set to a known value -- the lower case of the
 471         machine's netbios name.
 472         </P
 473 ></LI
 474 ><LI
 475 ><P
 476 >       Creation of the account at the time of joining the domain.  In
 477         this case, the session key of the administrative account used to join
 478         the client to the domain acts as an encryption key for setting the
 479         password to a random value (This is the recommended method).
 480         </P
 481 ></LI
 482 ></UL
 483 ><DIV
 484 CLASS="SECT2"
 485 ><HR><H2
 486 CLASS="SECT2"
 487 ><A
 488 NAME="AEN106"
 489 >Manually creating machine trust accounts</A
 490 ></H2
 491 ><P
 492 >The first step in creating a machine trust account by hand is to
 493 create an entry for the machine in /etc/passwd.  This can be done
 494 using <B
 495 CLASS="COMMAND"
 496 >vipw</B
 497 > or any 'add userr' command which is normally
 498 used to create new UNIX accounts.  The following is an example for a Linux
 499 based Samba server:</P
 500 ><P
 501 ><TT
 502 CLASS="PROMPT"
 503 >root# </TT
 504 >/usr/sbin/useradd -g 100 -d /dev/null -c <TT
 505 CLASS="REPLACEABLE"
 506 ><I
 507 >machine_nickname</I
 508 ></TT
 509 > -m -s /bin/false <TT
 510 CLASS="REPLACEABLE"
 511 ><I
 512 >machine_name</I
 513 ></TT
 514 >$</P
 515 ><P
 516 >The <TT
 517 CLASS="FILENAME"
 518 >/etc/passwd</TT
 519 > entry will list the machine name
 520 with a $ appended, won't have a passwd, will have a null shell and no
 521 home directory. For example a machine called 'doppy' would have an
 522 <TT
 523 CLASS="FILENAME"
 524 >/etc/passwd</TT
 525 > entry like this :</P
 526 ><P
 527 ><PRE
 528 CLASS="PROGRAMLISTING"
 529 >doppy$:x:505:501:<TT
 530 CLASS="REPLACEABLE"
 531 ><I
 532 >machine_nickname</I
 533 ></TT
 534 >:/dev/null:/bin/false</PRE
 535 ></P
 536 ><P
 537 >Above, <TT
 538 CLASS="REPLACEABLE"
 539 ><I
 540 >machine_nickname</I
 541 ></TT
 542 > can be any descriptive name for the
 543 pc i.e. BasementComputer. The <TT
 544 CLASS="REPLACEABLE"
 545 ><I
 546 >machine_name</I
 547 ></TT
 548 > absolutely must be
 549 the netbios name of the pc to be added to the domain.  The "$" must append the netbios
 550 name of the pc or samba will not recognize this as a machine account</P
 551 ><P
 552 >Now that the UNIX account has been created, the next step is to create
 553 the smbpasswd entry for the machine containing the well known initial
 554 trust account password.  This can be done using the <A
 555 HREF="smbpasswd.6.html"
 556 TARGET="_top"
 557 ><B
 558 CLASS="COMMAND"
 559 >smbpasswd(8)</B
 560 ></A
 561 > command
 562 as shown here:</P
 563 ><P
 564 ><TT
 565 CLASS="PROMPT"
 566 >root# </TT
 567 > smbpasswd -a -m <TT
 568 CLASS="REPLACEABLE"
 569 ><I
 570 >machine_name</I
 571 ></TT
 572 ></P
 573 ><P
 574 >where <TT
 575 CLASS="REPLACEABLE"
 576 ><I
 577 >machine_name</I
 578 ></TT
 579 > is the machine's netbios
 580 name. </P
 581 ><DIV
 582 CLASS="WARNING"
 583 ><P
 584 ></P
 585 ><TABLE
 586 CLASS="WARNING"
 587 BORDER="1"
 588 WIDTH="100%"
 589 ><TR
 590 ><TD
 591 ALIGN="CENTER"
 592 ><B
 593 >Join the client to the domain immediately</B
 594 ></TD
 595 ></TR
 596 ><TR
 597 ><TD
 598 ALIGN="LEFT"
 599 ><P
 600 >       Manually creating a machine trust account using this method is the
 601         equivalent of creating a machine account on a Windows NT PDC using
 602         the "Server Manager".  From the time at which the account is created
 603         to the time which th client joins the domain and changes the password,
 604         your domain is vulnerable to an intruder joining your domain using a
 605         a machine with the same netbios name.  A PDC inherently trusts
 606         members of the domain and will serve out a large degree of user
 607         information to such clients.  You have been warned!
 608         </P
 609 ></TD
 610 ></TR
 611 ></TABLE
 612 ></DIV
 613 ></DIV
 614 ><DIV
 615 CLASS="SECT2"
 616 ><HR><H2
 617 CLASS="SECT2"
 618 ><A
 619 NAME="AEN134"
 620 >Creating machine trust accounts "on the fly"</A
 621 ></H2
 622 ><P
 623 >The second, and most recommended way of creating machine trust accounts
 624 is to create them as needed at the time the client is joined to
 625 the domain.  You will need to include a value for the <A
 626 HREF="smb.conf.5.html#ADDUSERSCRIPT"
 627 TARGET="_top"
 628 >add user script</A
 629 >
 630 parameter.  Below is an example from a RedHat 6.2 Linux system.</P
 631 ><P
 632 ><PRE
 633 CLASS="PROGRAMLISTING"
 634 >add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u </PRE
 635 ></P
 636 ><P
 637 >In Samba 2.2.1, <I
 638 CLASS="EMPHASIS"
 639 >only the root account</I
 640 > can be used to create
 641 machine accounts like this.  Therefore, it is required to create
 642 an entry in smbpasswd for <I
 643 CLASS="EMPHASIS"
 644 >root</I
 645 >.  The password
 646 <I
 647 CLASS="EMPHASIS"
 648 >SHOULD</I
 649 > be set to s different password that the
 650 associated <TT
 651 CLASS="FILENAME"
 652 >/etc/passwd</TT
 653 > entry for security reasons.</P
 654 ></DIV
 655 ></DIV
 656 ><DIV
 657 CLASS="SECT1"
 658 ><HR><H1
 659 CLASS="SECT1"
 660 ><A
 661 NAME="AEN145"
 662 >Common Problems and Errors</A
 663 ></H1
 664 ><P
 665 ></P
 666 ><P
 667 ></P
 668 ><UL
 669 ><LI
 670 ><P
 671 >       <I
 672 CLASS="EMPHASIS"
 673 >I cannot include a '$' in a machine name.</I
 674 >
 675         </P
 676 ><P
 677 >       A 'machine name' in (typically) <TT
 678 CLASS="FILENAME"
 679 >/etc/passwd</TT
 680 >
 681         of the machine name with a '$' appended. FreeBSD (and other BSD
 682         systems ?) won't create a user with a '$' in their name.
 683         </P
 684 ><P
 685 >       The problem is only in the program used to make the entry, once
 686         made, it works perfectly. So create a user without the '$' and
 687         use <B
 688 CLASS="COMMAND"
 689 >vipw</B
 690 > to edit the entry, adding the '$'. Or create
 691         the whole entry with vipw if you like, make sure you use a
 692         unique uid !
 693         </P
 694 ></LI
 695 ><LI
 696 ><P
 697 >       <I
 698 CLASS="EMPHASIS"
 699 >I get told "You already have a connection to the Domain...."
 700         or "Cannot join domain, the credentials supplied conflict with an
 701         existing set.." when creating a machine account.</I
 702 >
 703         </P
 704 ><P
 705 >       This happens if you try to create a machine account from the
 706         machine itself and already have a connection (e.g. mapped drive)
 707         to a share (or IPC$) on the Samba PDC.  The following command
 708         will remove all network drive connections:
 709         </P
 710 ><P
 711 >       <TT
 712 CLASS="PROMPT"
 713 >C:\WINNT\&#62;</TT
 714 > <B
 715 CLASS="COMMAND"
 716 >net use * /d</B
 717 >
 718         </P
 719 ><P
 720 >       Further, if the machine is a already a 'member of a workgroup' that
 721         is the same name as the domain you are joining (bad idea) you will
 722         get this message.  Change the workgroup name to something else, it
 723         does not matter what, reboot, and try again.
 724         </P
 725 ></LI
 726 ><LI
 727 ><P
 728 >       <I
 729 CLASS="EMPHASIS"
 730 >The system can not log you on (C000019B)....</I
 731 >
 732         </P
 733 ><P
 734 >I joined the domain successfully but after upgrading
 735         to a newer version of the Samba code I get the message, "The system
 736         can not log you on (C000019B), Please try a gain or consult your
 737         system administrator" when attempting to logon.
 738         </P
 739 ><P
 740 >       This occurs when the domain SID stored in
 741         <TT
 742 CLASS="FILENAME"
 743 >private/WORKGROUP.SID</TT
 744 > is
 745         changed.  For example, you remove the file and <B
 746 CLASS="COMMAND"
 747 >smbd</B
 748 > automatically
 749         creates a new one.  Or you are swapping back and forth between
 750         versions 2.0.7, TNG and the HEAD branch code (not recommended).  The
 751         only way to correct the problem is to restore the original domain
 752         SID or remove the domain client from the domain and rejoin.
 753         </P
 754 ></LI
 755 ><LI
 756 ><P
 757 >       <I
 758 CLASS="EMPHASIS"
 759 >The machine account for this computer either does not
 760         exist or is not accessible.</I
 761 >
 762         </P
 763 ><P
 764 >       When I try to join the domain I get the message "The machine account
 765         for this computer either does not exist or is not accessible". Whats
 766         wrong?
 767         </P
 768 ><P
 769 >       This problem is caused by the PDC not having a suitable machine account.
 770         If you are using the <TT
 771 CLASS="PARAMETER"
 772 ><I
 773 >add user script</I
 774 ></TT
 775 > method to create
 776         accounts then this would indicate that it has not worked. Ensure the domain
 777         admin user system is working.
 778         </P
 779 ><P
 780 >       Alternatively if you are creating account entries manually then they
 781         have not been created correctly. Make sure that you have the entry
 782         correct for the machine account in smbpasswd file on the Samba PDC.
 783         If you added the account using an editor rather than using the smbpasswd
 784         utility, make sure that the account name is the machine netbios name
 785         with a '$' appended to it ( ie. computer_name$ ). There must be an entry
 786         in both /etc/passwd and the smbpasswd file. Some people have reported
 787         that inconsistent subnet masks between the Samba server and the NT
 788         client have caused this problem.   Make sure that these are consistent
 789         for both client and server.
 790         </P
 791 ></LI
 792 ><LI
 793 ><P
 794 >       <I
 795 CLASS="EMPHASIS"
 796 >When I attempt to login to a Samba Domain from a NT4/W2K workstation,
 797         I get a message about my account being disabled.</I
 798 >
 799         </P
 800 ><P
 801 >       This problem is caused by a PAM related bug in Samba 2.2.0.  This bug is
 802         fixed in 2.2.1.  Other symptoms could be unaccessible shares on
 803         NT/W2K member servers in the domain or the following error in your smbd.log:
 804         passdb/pampass.c:pam_account(268) PAM: UNKNOWN ERROR for User: %user%
 805         </P
 806 ><P
 807 >       At first be ensure to enable the useraccounts with <B
 808 CLASS="COMMAND"
 809 >smbpasswd -e
 810         %user%</B
 811 >, this is normaly done, when you create an account.
 812         </P
 813 ><P
 814 >       In order to work around this problem in 2.2.0, configure the
 815         <TT
 816 CLASS="PARAMETER"
 817 ><I
 818 >account</I
 819 ></TT
 820 > control flag in
 821         <TT
 822 CLASS="FILENAME"
 823 >/etc/pam.d/samba</TT
 824 > file as follows:
 825         </P
 826 ><P
 827 ><PRE
 828 CLASS="PROGRAMLISTING"
 829 >       account required        pam_permit.so
 830         </PRE
 831 ></P
 832 ><P
 833 >       If you want to remain backward compatibility to samba 2.0.x use
 834         <TT
 835 CLASS="FILENAME"
 836 >pam_permit.so</TT
 837 >, it's also possible to use
 838         <TT
 839 CLASS="FILENAME"
 840 >pam_pwdb.so</TT
 841 >. There are some bugs if you try to
 842         use <TT
 843 CLASS="FILENAME"
 844 >pam_unix.so</TT
 845 >, if you need this, be ensure to use
 846         the most recent version of this file.
 847         </P
 848 ></LI
 849 ></UL
 850 ></DIV
 851 ><DIV
 852 CLASS="SECT1"
 853 ><HR><H1
 854 CLASS="SECT1"
 855 ><A
 856 NAME="AEN193"
 857 >System Policies and Profiles</A
 858 ></H1
 859 ><P
 860 >Much of the information necessary to implement System Policies and
 861 Roving User Profiles in a Samba domain is the same as that for
 862 implementing these same items in a Windows NT 4.0 domain.
 863 You should read the white paper <A
 864 HREF="http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp"
 865 TARGET="_top"
 866 >Implementing
 867 Profiles and Policies in Windows NT 4.0</A
 868 > available from Microsoft.</P
 869 ><P
 870 >Here are some additional details:</P
 871 ><P
 872 ></P
 873 ><UL
 874 ><LI
 875 ><P
 876 >       <I
 877 CLASS="EMPHASIS"
 878 >What about Windows NT Policy Editor ?</I
 879 >
 880         </P
 881 ><P
 882 >       To create or edit <TT
 883 CLASS="FILENAME"
 884 >ntconfig.pol</TT
 885 > you must use
 886         the NT Server Policy Editor, <B
 887 CLASS="COMMAND"
 888 >poledit.exe</B
 889 >       which
 890         is included with NT Server but <I
 891 CLASS="EMPHASIS"
 892 >not NT Workstation</I
 893 >.
 894         There is a Policy Editor on a NTws
 895         but it is not suitable for creating <I
 896 CLASS="EMPHASIS"
 897 >Domain Policies</I
 898 >.
 899         Further, although the Windows 95
 900         Policy Editor can be installed on an NT Workstation/Server, it will not
 901         work with NT policies because the registry key that are set by the policy templates.
 902         However, the files from the NT Server will run happily enough on an NTws.
 903         You need <TT
 904 CLASS="FILENAME"
 905 >poledit.exe, common.adm</TT
 906 > and <TT
 907 CLASS="FILENAME"
 908 >winnt.adm</TT
 909 >. It is convenient
 910         to put the two *.adm files in <TT
 911 CLASS="FILENAME"
 912 >c:\winnt\inf</TT
 913 > which is where
 914         the binary will look for them unless told otherwise. Note also that that
 915         directory is 'hidden'.
 916         </P
 917 ><P
 918 >       The Windows NT policy editor is also included with the Service Pack 3 (and
 919         later) for Windows NT 4.0. Extract the files using <B
 920 CLASS="COMMAND"
 921 >servicepackname /x</B
 922 >,
 923         ie thats <B
 924 CLASS="COMMAND"
 925 >Nt4sp6ai.exe /x</B
 926 > for service pack 6a.  The policy editor,
 927         <B
 928 CLASS="COMMAND"
 929 >poledit.exe</B
 930 > and the associated template files (*.adm) should
 931         be extracted as well.  It is also possible to downloaded the policy template
 932         files for Office97 and get a copy of the policy editor.  Another possible
 933         location is with the Zero Administration Kit available for download from Microsoft.
 934         </P
 935 ></LI
 936 ><LI
 937 ><P
 938 >       <I
 939 CLASS="EMPHASIS"
 940 >Can Win95 do Policies ?</I
 941 >
 942         </P
 943 ><P
 944 >       Install the group policy handler for Win9x to pick up group
 945         policies.   Look on the Win98 CD in <TT
 946 CLASS="FILENAME"
 947 >\tools\reskit\netadmin\poledit</TT
 948 >.
 949         Install group policies on a Win9x client by double-clicking
 950         <TT
 951 CLASS="FILENAME"
 952 >grouppol.inf</TT
 953 >. Log off and on again a couple of
 954         times and see if Win98 picks up group policies.  Unfortunately this needs
 955         to be done on every Win9x machine that uses group policies....
 956         </P
 957 ><P
 958 >       If group policies don't work one reports suggests getting the updated
 959         (read: working) grouppol.dll for Windows 9x. The group list is grabbed
 960         from /etc/group.
 961         </P
 962 ></LI
 963 ><LI
 964 ><P
 965 >       <I
 966 CLASS="EMPHASIS"
 967 >How do I get 'User Manager' and 'Server Manager'</I
 968 >
 969         </P
 970 ><P
 971 >       Since I don't need to buy an NT Server CD now, how do I get
 972         the 'User Manager for Domains', the 'Server Manager' ?
 973         </P
 974 ><P
 975 >       Microsoft distributes a version of these tools called nexus for
 976         installation on Windows 95 systems.  The tools set includes
 977         </P
 978 ><P
 979 ></P
 980 ><UL
 981 ><LI
 982 ><P
 983 >Server Manager</P
 984 ></LI
 985 ><LI
 986 ><P
 987 >User Manager for Domains</P
 988 ></LI
 989 ><LI
 990 ><P
 991 >Event Viewer</P
 992 ></LI
 993 ></UL
 994 ><P
 995 >       Click here to download the archived file <A
 996 HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE"
 997 TARGET="_top"
 998 >ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A
 999 >
1000         </P
1001 ><P
1002 >       The Windows NT 4.0 version of the 'User Manager for
1003         Domains' and 'Server Manager' are available from Microsoft via ftp
1004         from <A
1005 HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE"
1006 TARGET="_top"
1007 >ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A
1008 >
1009         </P
1010 ></LI
1011 ></UL
1012 ></DIV
1013 ><DIV
1014 CLASS="SECT1"
1015 ><HR><H1
1016 CLASS="SECT1"
1017 ><A
1018 NAME="AEN237"
1019 >What other help can I get ?</A
1020 ></H1
1021 ><P
1022 >There are many sources of information available in the form
1023 of mailing lists, RFC's and documentation.  The docs that come
1024 with the samba distribution contain very good explanations of
1025 general SMB topics such as browsing.</P
1026 ><P
1027 ></P
1028 ><UL
1029 ><LI
1030 ><P
1031 >       <I
1032 CLASS="EMPHASIS"
1033 >What are some diagnostics tools I can use to debug the domain logon
1034         process and where can I find them?</I
1035 >
1036         </P
1037 ><P
1038 >       One of the best diagnostic tools for debugging problems is Samba itself.
1039         You can use the -d option for both smbd and nmbd to specifiy what
1040         'debug level' at which to run.  See the man pages on smbd, nmbd  and
1041         smb.conf for more information on debugging options.  The debug
1042         level can range from 1 (the default) to 10 (100 for debugging passwords).
1043         </P
1044 ><P
1045 >       Another helpful method of debugging is to compile samba using the
1046         <B
1047 CLASS="COMMAND"
1048 >gcc -g </B
1049 > flag.   This will include debug
1050         information in the binaries and allow you to attach gdb to the
1051         running smbd / nmbd process.  In order to attach gdb to an smbd
1052         process for an NT workstation, first get the workstation to make the
1053         connection. Pressing ctrl-alt-delete and going down to the domain box
1054         is sufficient (at least, on the first time you join the domain) to
1055         generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation
1056         maintains an open connection, and therefore there will be an smbd
1057         process running (assuming that you haven't set a really short smbd
1058         idle timeout)  So, in between pressing ctrl alt delete, and actually
1059         typing in your password, you can gdb attach and continue.
1060         </P
1061 ><P
1062 >       Some useful samba commands worth investigating:
1063         </P
1064 ><P
1065 ></P
1066 ><UL
1067 ><LI
1068 ><P
1069 >testparam | more</P
1070 ></LI
1071 ><LI
1072 ><P
1073 >smbclient -L //{netbios name of server}</P
1074 ></LI
1075 ></UL
1076 ><P
1077 >       An SMB enabled version of tcpdump is available from
1078         <A
1079 HREF="http://www.tcpdump.org/"
1080 TARGET="_top"
1081 >http://www.tcpdup.org/</A
1082 >.
1083         Ethereal, another good packet sniffer for UNIX and Win32
1084         hosts, can be downloaded from <A
1085 HREF="http://www.ethereal.com/"
1086 TARGET="_top"
1087 >http://www.ethereal.com</A
1088 >.
1089         </P
1090 ><P
1091 >       For tracing things on the Microsoft Windows NT, Network Monitor
1092         (aka. netmon) is available on the Microsoft Developer Network CD's,
1093         the Windows NT Server install CD and the SMS CD's.  The version of
1094         netmon that ships with SMS allows for dumping packets between any two
1095         computers (ie. placing the network interface in promiscuous mode).
1096         The version on the NT Server install CD will only allow monitoring
1097         of network traffic directed to the local NT box and broadcasts on the
1098         local subnet.  Be aware that Ethereal can read and write netmon
1099         formatted files.
1100         </P
1101 ></LI
1102 ><LI
1103 ><P
1104 >       <I
1105 CLASS="EMPHASIS"
1106 >How do I install 'Network Monitor' on an NT Workstation
1107         or a Windows 9x box?</I
1108 >
1109         </P
1110 ><P
1111 >       Installing netmon on an NT workstation requires a couple
1112         of steps.  The following are for installing Netmon V4.00.349, which comes
1113         with Microsoft Windows NT Server 4.0, on Microsoft Windows NT
1114         Workstation 4.0.  The process should be similar for other version of
1115         Windows NT / Netmon.  You will need both the Microsoft Windows
1116         NT Server 4.0 Install CD and the Workstation 4.0 Install CD.
1117         </P
1118 ><P
1119 >       Initially you will need to install 'Network Monitor Tools and Agent'
1120         on the NT Server.  To do this
1121         </P
1122 ><P
1123 ></P
1124 ><UL
1125 ><LI
1126 ><P
1127 >Goto Start - Settings - Control Panel -
1128                 Network - Services - Add </P
1129 ></LI
1130 ><LI
1131 ><P
1132 >Select the 'Network Monitor Tools and Agent' and
1133                 click on 'OK'.</P
1134 ></LI
1135 ><LI
1136 ><P
1137 >Click 'OK' on the Network Control Panel.
1138                 </P
1139 ></LI
1140 ><LI
1141 ><P
1142 >Insert the Windows NT Server 4.0 install CD
1143                 when prompted.</P
1144 ></LI
1145 ></UL
1146 ><P
1147 >       At this point the Netmon files should exist in
1148         <TT
1149 CLASS="FILENAME"
1150 >%SYSTEMROOT%\System32\netmon\*.*</TT
1151 >.
1152         Two subdirectories exist as well, <TT
1153 CLASS="FILENAME"
1154 >parsers\</TT
1155 >
1156         which contains the necessary DLL's for parsing the netmon packet
1157         dump, and <TT
1158 CLASS="FILENAME"
1159 >captures\</TT
1160 >.
1161         </P
1162 ><P
1163 >       In order to install the Netmon tools on an NT Workstation, you will
1164         first need to install the 'Network  Monitor Agent' from the Workstation
1165         install CD.
1166         </P
1167 ><P
1168 ></P
1169 ><UL
1170 ><LI
1171 ><P
1172 >Goto Start - Settings - Control Panel -
1173                 Network - Services - Add</P
1174 ></LI
1175 ><LI
1176 ><P
1177 >Select the 'Network Monitor Agent' and click
1178                 on 'OK'.</P
1179 ></LI
1180 ><LI
1181 ><P
1182 >Click 'OK' on the Network Control Panel.
1183                 </P
1184 ></LI
1185 ><LI
1186 ><P
1187 >Insert the Windows NT Workstation 4.0 install
1188                 CD when prompted.</P
1189 ></LI
1190 ></UL
1191 ><P
1192 >       Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.*
1193         to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set
1194         permissions as  you deem appropriate for your site. You will need
1195         administrative rights on the NT box to run netmon.
1196         </P
1197 ><P
1198 >       To install Netmon on a Windows 9x box install the network monitor agent
1199         from the Windows 9x CD (\admin\nettools\netmon).  There is a readme
1200         file located with the netmon driver files on the CD if you need
1201         information on how to do this.  Copy the files from a working
1202         Netmon installation.
1203         </P
1204 ></LI
1205 ><LI
1206 ><P
1207 >       The following is a list if helpful URLs and other links:
1208         </P
1209 ><P
1210 ></P
1211 ><UL
1212 ><LI
1213 ><P
1214 >Home of Samba site <A
1215 HREF="http://samba.org"
1216 TARGET="_top"
1217 >        http://samba.org</A
1218 >. We have a mirror near you !</P
1219 ></LI
1220 ><LI
1221 ><P
1222 > The <I
1223 CLASS="EMPHASIS"
1224 >Development</I
1225 > document
1226         on the Samba mirrors might mention your problem. If so,
1227         it might mean that the developers are working on it.</P
1228 ></LI
1229 ><LI
1230 ><P
1231 >See how Scott Merrill simulates a BDC behavior at
1232         <A
1233 HREF="http://www.skippy.net/linux/smb-howto.html"
1234 TARGET="_top"
1235 >        http://www.skippy.net/linux/smb-howto.html</A
1236 >. </P
1237 ></LI
1238 ><LI
1239 ><P
1240 >Although 2.0.7 has almost had its day as a PDC, David Bannon will
1241         keep the 2.0.7 PDC pages at <A
1242 HREF="http://bioserve.latrobe.edu.au/samba"
1243 TARGET="_top"
1244 >        http://bioserve.latrobe.edu.au/samba</A
1245 > going for a while yet.</P
1246 ></LI
1247 ><LI
1248 ><P
1249 >Misc links to CIFS information
1250         <A
1251 HREF="http://samba.org/cifs/"
1252 TARGET="_top"
1253 >http://samba.org/cifs/</A
1254 ></P
1255 ></LI
1256 ><LI
1257 ><P
1258 >NT Domains for Unix <A
1259 HREF="http://mailhost.cb1.com/~lkcl/ntdom/"
1260 TARGET="_top"
1261 >        http://mailhost.cb1.com/~lkcl/ntdom/</A
1262 ></P
1263 ></LI
1264 ><LI
1265 ><P
1266 >FTP site for older SMB specs:
1267         <A
1268 HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/"
1269 TARGET="_top"
1270 >        ftp://ftp.microsoft.com/developr/drg/CIFS/</A
1271 ></P
1272 ></LI
1273 ></UL
1274 ></LI
1275 ></UL
1276 ><P
1277 ></P
1278 ><UL
1279 ><LI
1280 ><P
1281 >       <I
1282 CLASS="EMPHASIS"
1283 >How do I get help from the mailing lists ?</I
1284 >
1285         </P
1286 ><P
1287 >       There are a number of Samba related mailing lists. Go to <A
1288 HREF="http://samba.org"
1289 TARGET="_top"
1290 >http://samba.org</A
1291 >, click on your nearest mirror
1292         and then click on <B
1293 CLASS="COMMAND"
1294 >Support</B
1295 > and then click on <B
1296 CLASS="COMMAND"
1297 >       Samba related mailing lists</B
1298 >.
1299         </P
1300 ><P
1301 >       For questions relating to Samba TNG go to
1302         <A
1303 HREF="http://www.samba-tng.org/"
1304 TARGET="_top"
1305 >http://www.samba-tng.org/</A
1306 >
1307         It has been requested that you don't post questions about Samba-TNG to the
1308         main stream Samba lists.</P
1309 ><P
1310 >       If you post a message to one of the lists please observe the following guide lines :
1311         </P
1312 ><P
1313 ></P
1314 ><UL
1315 ><LI
1316 ><P
1317 > Always remember that the developers are volunteers, they are
1318                 not paid and they never guarantee to produce a particular feature at
1319                 a particular time. Any time lines are 'best guess' and nothing more.
1320                 </P
1321 ></LI
1322 ><LI
1323 ><P
1324 > Always mention what version of samba you are using and what
1325                 operating system its running under. You should probably list the
1326         relevant sections of your smb.conf file, at least the options
1327         in [global] that affect PDC support.</P
1328 ></LI
1329 ><LI
1330 ><P
1331 >In addition to the version, if you obtained Samba via
1332         CVS mention the date when you last checked it out.</P
1333 ></LI
1334 ><LI
1335 ><P
1336 > Try and make your question clear and brief, lots of long,
1337                 convoluted questions get deleted before they are completely read !
1338                 Don't post html encoded messages (if you can select colour or font
1339                 size its html).</P
1340 ></LI
1341 ><LI
1342 ><P
1343 > If you run one of those nifty 'I'm on holidays' things when
1344                 you are away, make sure its configured  to not answer mailing lists.
1345                 </P
1346 ></LI
1347 ><LI
1348 ><P
1349 > Don't cross post. Work out which is the best list to post to
1350                 and see what happens, ie don't post to both samba-ntdom and samba-technical.
1351         Many people active on the lists subscribe to more
1352                 than one list and get annoyed to see the same message two or more times.
1353                 Often someone will see a message and thinking it would be better dealt
1354                 with on another, will forward it on for you.</P
1355 ></LI
1356 ><LI
1357 ><P
1358 >You might include <I
1359 CLASS="EMPHASIS"
1360 >partial</I
1361 >
1362         log files written at a debug level set to as much as 20.
1363         Please don't send the entire log but enough to give the context of the
1364         error messages.</P
1365 ></LI
1366 ><LI
1367 ><P
1368 >(Possibly) If you have a complete netmon trace ( from the opening of
1369         the pipe to the error ) you can send the *.CAP file as well.</P
1370 ></LI
1371 ><LI
1372 ><P
1373 >Please think carefully before attaching a document to an email.
1374         Consider pasting the relevant parts into the body of the message. The samba
1375         mailing lists go to a huge number of people, do they all need a copy of your
1376         smb.conf in their attach directory ?</P
1377 ></LI
1378 ></UL
1379 ></LI
1380 ><LI
1381 ><P
1382 >       <I
1383 CLASS="EMPHASIS"
1384 >How do I get off the mailing lists ?</I
1385 >
1386         </P
1387 ><P
1388 >To have your name removed from a samba mailing list, go to the
1389         same place you went to to get on it. Go to <A
1390 HREF="http://lists.samba.org/"
1391 TARGET="_top"
1392 >http://lists.samba.org</A
1393 >,
1394         click on your nearest mirror and then click on <B
1395 CLASS="COMMAND"
1396 >Support</B
1397 > and
1398         then click on <B
1399 CLASS="COMMAND"
1400 > Samba related mailing lists</B
1401 >. Or perhaps see
1402         <A
1403 HREF="http://lists.samba.org/mailman/roster/samba-ntdom"
1404 TARGET="_top"
1405 >here</A
1406 >
1407         </P
1408 ><P
1409 >       Please don't post messages to the list asking to be removed, you will just
1410         be referred to the above address (unless that process failed in some way...)
1411         </P
1412 ></LI
1413 ></UL
1414 ></DIV
1415 ><DIV
1416 CLASS="SECT1"
1417 ><HR><H1
1418 CLASS="SECT1"
1419 ><A
1420 NAME="AEN351"
1421 >Domain Control for Windows 9x/ME</A
1422 ></H1
1423 ><DIV
1424 CLASS="NOTE"
1425 ><BLOCKQUOTE
1426 CLASS="NOTE"
1427 ><P
1428 ><B
1429 >Note: </B
1430 >The following section contains much of the original
1431 DOMAIN.txt file previously included with Samba.  Much of
1432 the material is based on what went into the book Special
1433 Edition, Using Samba. (Richard Sharpe)</P
1434 ></BLOCKQUOTE
1435 ></DIV
1436 ><P
1437 >A domain and a workgroup are exactly the same thing in terms of network
1438 browsing.  The difference is that a distributable authentication
1439 database is associated with a domain, for secure login access to a
1440 network.  Also, different access rights can be granted to users if they
1441 successfully authenticate against a domain logon server (NT server and
1442 other systems based on NT server support this, as does at least Samba TNG now).</P
1443 ><P
1444 >The SMB client logging on to a domain has an expectation that every other
1445 server in the domain should accept the same authentication information.
1446 Network browsing functionality of domains and workgroups is
1447 identical and is explained in BROWSING.txt. It should be noted, that browsing
1448 is total orthogonal to logon support.</P
1449 ><P
1450 >Issues related to the single-logon network model are discussed in this
1451 document.  Samba supports domain logons, network logon scripts, and user
1452 profiles for MS Windows for workgroups and MS Windows 9X clients.</P
1453 ><P
1454 >When an SMB client in a domain wishes to logon it broadcast requests for a
1455 logon server.  The first one to reply gets the job, and validates its
1456 password using whatever mechanism the Samba administrator has installed.
1457 It is possible (but very stupid) to create a domain where the user
1458 database is not shared between servers, ie they are effectively workgroup
1459 servers advertising themselves as participating in a domain.  This
1460 demonstrates how authentication is quite different from but closely
1461 involved with domains.</P
1462 ><P
1463 >Another thing commonly associated with single-logon domains is remote
1464 administration over the SMB protocol.  Again, there is no reason why this
1465 cannot be implemented with an underlying username database which is
1466 different from the Windows NT SAM.  Support for the Remote Administration
1467 Protocol is planned for a future release of Samba.</P
1468 ><P
1469 >Network logon support as discussed in this section is aimed at Window for
1470 Workgroups, and Windows 9X clients. </P
1471 ><P
1472 >Support for profiles is confirmed as working for Win95, NT 4.0 and NT 3.51.
1473 It is possible to specify: the profile location; script file to be loaded
1474 on login; the user's home directory; and for NT a kick-off time could also
1475 now easily be supported. However, there are some differences between Win9X
1476 profile support and WinNT profile support. These are discussed below.</P
1477 ><P
1478 >With NT Workstations, all this does not require the use or intervention of
1479 an NT 4.0 or NT 3.51 server: Samba can now replace the logon services
1480 provided by an NT server, to a limited and experimental degree (for example,
1481 running "User Manager for Domains" will not provide you with access to
1482 a domain created by a Samba Server).</P
1483 ><P
1484 >With Win95, the help of an NT server can be enlisted, both for profile storage
1485 and for user authentication.  For details on user authentication, see
1486 security_level.txt.  For details on profile storage, see below.</P
1487 ><P
1488 >Using these features you can make your clients verify their logon via
1489 the Samba server; make clients run a batch file when they logon to
1490 the network and download their preferences, desktop and start menu.</P
1491 ><P
1492 >Before launching into the configuration instructions, it is worthwhile looking
1493 at how a Win9X client performs a logon:</P
1494 ><P
1495 ></P
1496 ><OL
1497 TYPE="1"
1498 ><LI
1499 ><P
1500 >       The client broadcasts (to the IP broadcast address of the subnet it is in)
1501         a NetLogon request. This is sent to the NetBIOS address DOMAIN&#60;00&#62; at the
1502         NetBIOS layer.  The client chooses the first response it receives, which
1503         contains the NetBIOS name of the logon server to use in the format of
1504         \\SERVER.
1505         </P
1506 ></LI
1507 ><LI
1508 ><P
1509 >       The client then connects to that server, logs on (does an SMBsessetupX) and
1510         then connects to the IPC$ share (using an SMBtconX).
1511         </P
1512 ></LI
1513 ><LI
1514 ><P
1515 >       The client then does a NetWkstaUserLogon request, which retrieves the name
1516         of the user's logon script.
1517         </P
1518 ></LI
1519 ><LI
1520 ><P
1521 >       The client then connects to the NetLogon share and searches for this
1522         and if it is found and can be read, is retrieved and executed by the client.
1523         After this, the client disconnects from the NetLogon share.
1524         </P
1525 ></LI
1526 ><LI
1527 ><P
1528 >       The client then sends a NetUserGetInfo request to the server, to retrieve
1529         the user's home share, which is used to search for profiles. Since the
1530         response to the NetUserGetInfo request does not contain much more
1531         the user's home share, profiles for Win9X clients MUST reside in the user
1532         home directory.
1533         </P
1534 ></LI
1535 ><LI
1536 ><P
1537 >       The client then connects to the user's home share and searches for the
1538         user's profile. As it turns out, you can specify the users home share as
1539         a sharename and path. For example, \\server\fred\.profile.
1540         If the profiles are found, they are implemented.
1541         </P
1542 ></LI
1543 ><LI
1544 ><P
1545 >       The client then disconnects from the user's home share, and reconnects to
1546         the NetLogon share and looks for CONFIG.POL, the policies file. If this is
1547         found, it is read and implemented.
1548         </P
1549 ></LI
1550 ></OL
1551 ><DIV
1552 CLASS="SECT2"
1553 ><HR><H2
1554 CLASS="SECT2"
1555 ><A
1556 NAME="AEN381"
1557 >Configuration Instructions:    Network Logons</A
1558 ></H2
1559 ><P
1560 >To use domain logons and profiles you need to do the following:</P
1561 ><P
1562 ></P
1563 ><OL
1564 TYPE="1"
1565 ><LI
1566 ><P
1567 >       Create a share called [netlogon] in your smb.conf. This share should
1568         be readable by all users, and probably should not be writeable. This
1569         share will hold your network logon scripts, and the CONFIG.POL file
1570         (Note: for details on the CONFIG.POL file, how to use it, what it is,
1571         refer to the Microsoft Windows NT Administration documentation.
1572         The format of these files is not known, so you will need to use
1573         Microsoft tools).
1574         </P
1575 ><P
1576 >       For example I have used:
1577         </P
1578 ><P
1579 ><PRE
1580 CLASS="PROGRAMLISTING"
1581 >[netlogon]
1582      path = /data/dos/netlogon
1583      writeable = no
1584      guest ok = no</PRE
1585 ></P
1586 ><P
1587 >       Note that it is important that this share is not writeable by ordinary
1588         users, in a secure environment: ordinary users should not be allowed
1589         to modify or add files that another user's computer would then download
1590         when they log in.
1591         </P
1592 ></LI
1593 ><LI
1594 ><P
1595 >       in the [global] section of smb.conf set the following:
1596         </P
1597 ><P
1598 ><PRE
1599 CLASS="PROGRAMLISTING"
1600 >domain logons = yes
1601 logon script = %U.bat
1602         </PRE
1603 ></P
1604 ><P
1605 >       The choice of batch file is, of course, up to you. The above would
1606         give each user a separate batch file as the %U will be changed to
1607         their username automatically. The other standard % macros may also be
1608         used. You can make the batch files come from a subdirectory by using
1609         something like:
1610         </P
1611 ><P
1612 ><PRE
1613 CLASS="PROGRAMLISTING"
1614 >logon script = scripts\%U.bat
1615         </PRE
1616 ></P
1617 ></LI
1618 ><LI
1619 ><P
1620 >       create the batch files to be run when the user logs in. If the batch
1621         file doesn't exist then no batch file will be run.
1622         </P
1623 ><P
1624 >       In the batch files you need to be careful to use DOS style cr/lf line
1625         endings. If you don't then DOS may get confused. I suggest you use a
1626         DOS editor to remotely edit the files if you don't know how to produce
1627         DOS style files under unix.
1628         </P
1629 ></LI
1630 ><LI
1631 ><P
1632 >       Use smbclient with the -U option for some users to make sure that
1633         the \\server\NETLOGON share is available, the batch files are
1634         visible and they are readable by the users.
1635         </P
1636 ></LI
1637 ><LI
1638 ><P
1639 >       you will probabaly find that your clients automatically mount the
1640         \\SERVER\NETLOGON share as drive z: while logging in. You can put
1641         some useful programs there to execute from the batch files.
1642         </P
1643 ></LI
1644 ></OL
1645 ><DIV
1646 CLASS="WARNING"
1647 ><P
1648 ></P
1649 ><TABLE
1650 CLASS="WARNING"
1651 BORDER="1"
1652 WIDTH="100%"
1653 ><TR
1654 ><TD
1655 ALIGN="CENTER"
1656 ><B
1657 >security mode and master browsers</B
1658 ></TD
1659 ></TR
1660 ><TR
1661 ><TD
1662 ALIGN="LEFT"
1663 ><P
1664 >There are a few comments to make in order to tie up some
1665 loose ends.  There has been much debate over the issue of whether
1666 or not it is ok to configure Samba as a Domain Controller in security
1667 modes other than <TT
1668 CLASS="CONSTANT"
1669 >USER</TT
1670 >.  The only security mode
1671 which  will not work due to technical reasons is <TT
1672 CLASS="CONSTANT"
1673 >SHARE</TT
1674 >
1675 mode security.  <TT
1676 CLASS="CONSTANT"
1677 >DOMAIN</TT
1678 > and <TT
1679 CLASS="CONSTANT"
1680 >SERVER</TT
1681 >
1682 mode security is really just a variation on SMB user level security.</P
1683 ><P
1684 >Actually, this issue is also closer tied to the debate on whether
1685 or not Samba must be the domain master browser for its workgroup
1686 when operating as a DC.  While it may technically be possible
1687 to configure a server as such (after all, browsing and domain logons
1688 are two distinctly different functions), it is not a good idea to
1689 so.  You should remember that the DC must register the DOMAIN#1b netbios
1690 name.  This is the name used by Windows clients to locate the DC.
1691 Windows clients do not distinguish between the DC and the DMB.
1692 For this reason, it is very wise to configure the Samba DC as the DMB.</P
1693 ><P
1694 >Now back to the issue of configuring a Samba DC to use a mode other
1695 than "security = user".  If a Samba host is configured to use
1696 another SMB server or DC in order to validate user connection
1697 requests, then it is a fact that some other machine on the network
1698 (the "password server") knows more about user than the Samba host.
1699 99% of the time, this other host is a domain controller.  Now
1700 in order to operate in domain mode security, the "workgroup" parameter
1701 must be set to the name of the Windows NT domain (which already
1702 has a domain controller, right?)</P
1703 ><P
1704 >Therefore configuring a Samba box as a DC for a domain that
1705 already by definition has a PDC is asking for trouble.
1706 Therefore, you should always configure the Samba DC to be the DMB
1707 for its domain.</P
1708 ></TD
1709 ></TR
1710 ></TABLE
1711 ></DIV
1712 ></DIV
1713 ><DIV
1714 CLASS="SECT2"
1715 ><HR><H2
1716 CLASS="SECT2"
1717 ><A
1718 NAME="AEN415"
1719 >Configuration Instructions:    Setting up Roaming User Profiles</A
1720 ></H2
1721 ><DIV
1722 CLASS="WARNING"
1723 ><P
1724 ></P
1725 ><TABLE
1726 CLASS="WARNING"
1727 BORDER="1"
1728 WIDTH="100%"
1729 ><TR
1730 ><TD
1731 ALIGN="CENTER"
1732 ><B
1733 >Warning</B
1734 ></TD
1735 ></TR
1736 ><TR
1737 ><TD
1738 ALIGN="LEFT"
1739 ><P
1740 ><I
1741 CLASS="EMPHASIS"
1742 >NOTE!</I
1743 > Roaming profiles support is different
1744 for Win9X and WinNT.</P
1745 ></TD
1746 ></TR
1747 ></TABLE
1748 ></DIV
1749 ><P
1750 >Before discussing how to configure roaming profiles, it is useful to see how
1751 Win9X and WinNT clients implement these features.</P
1752 ><P
1753 >Win9X clients send a NetUserGetInfo request to the server to get the user's
1754 profiles location. However, the response does not have room for a separate
1755 profiles location field, only the users home share. This means that Win9X
1756 profiles are restricted to being in the user's home directory.</P
1757 ><P
1758 >WinNT clients send a NetSAMLogon RPC request, which contains many fields,
1759 including a separate field for the location of the user's profiles.
1760 This means that support for profiles is different for Win9X and WinNT.</P
1761 ><DIV
1762 CLASS="SECT3"
1763 ><HR><H3
1764 CLASS="SECT3"
1765 ><A
1766 NAME="AEN423"
1767 >Windows NT Configuration</A
1768 ></H3
1769 ><P
1770 >To support WinNT clients, inn the [global] section of smb.conf set the
1771 following (for example):</P
1772 ><P
1773 ><PRE
1774 CLASS="PROGRAMLISTING"
1775 >logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath</PRE
1776 ></P
1777 ><P
1778 >The default for this option is \\%N\%U\profile, namely
1779 \\sambaserver\username\profile.  The \\N%\%U service is created
1780 automatically by the [homes] service.
1781 If you are using a samba server for the profiles, you _must_ make the
1782 share specified in the logon path browseable. </P
1783 ><DIV
1784 CLASS="NOTE"
1785 ><BLOCKQUOTE
1786 CLASS="NOTE"
1787 ><P
1788 ><B
1789 >Note: </B
1790 >[lkcl 26aug96 - we have discovered a problem where Windows clients can
1791 maintain a connection to the [homes] share in between logins.  The
1792 [homes] share must NOT therefore be used in a profile path.]</P
1793 ></BLOCKQUOTE
1794 ></DIV
1795 ></DIV
1796 ><DIV
1797 CLASS="SECT3"
1798 ><HR><H3
1799 CLASS="SECT3"
1800 ><A
1801 NAME="AEN431"
1802 >Windows 9X Configuration</A
1803 ></H3
1804 ><P
1805 >To support Win9X clients, you must use the "logon home" parameter. Samba has
1806 now been fixed so that "net use/home" now works as well, and it, too, relies
1807 on the "logon home" parameter.</P
1808 ><P
1809 >By using the logon home parameter, you are restricted to putting Win9X
1810 profiles in the user's home directory.   But wait! There is a trick you
1811 can use. If you set the following in the [global] section of your
1812 smb.conf file:</P
1813 ><P
1814 ><PRE
1815 CLASS="PROGRAMLISTING"
1816 >logon home = \\%L\%U\.profiles</PRE
1817 ></P
1818 ><P
1819 >then your Win9X clients will dutifully put their clients in a subdirectory
1820 of your home directory called .profiles (thus making them hidden).</P
1821 ><P
1822 >Not only that, but 'net use/home' will also work, because of a feature in
1823 Win9X. It removes any directory stuff off the end of the home directory area
1824 and only uses the server and share portion. That is, it looks like you
1825 specified \\%L\%U for "logon home".</P
1826 ></DIV
1827 ><DIV
1828 CLASS="SECT3"
1829 ><HR><H3
1830 CLASS="SECT3"
1831 ><A
1832 NAME="AEN439"
1833 >Win9X and WinNT Configuration</A
1834 ></H3
1835 ><P
1836 >You can support profiles for both Win9X and WinNT clients by setting both the
1837 "logon home" and "logon path" parameters. For example:</P
1838 ><P
1839 ><PRE
1840 CLASS="PROGRAMLISTING"
1841 >logon home = \\%L\%U\.profiles
1842 logon path = \\%L\profiles\%U</PRE
1843 ></P
1844 ><DIV
1845 CLASS="NOTE"
1846 ><BLOCKQUOTE
1847 CLASS="NOTE"
1848 ><P
1849 ><B
1850 >Note: </B
1851 >I have not checked what 'net use /home' does on NT when "logon home" is
1852 set as above.</P
1853 ></BLOCKQUOTE
1854 ></DIV
1855 ></DIV
1856 ><DIV
1857 CLASS="SECT3"
1858 ><HR><H3
1859 CLASS="SECT3"
1860 ><A
1861 NAME="AEN446"
1862 >Windows 9X Profile Setup</A
1863 ></H3
1864 ><P
1865 >When a user first logs in on Windows 9X, the file user.DAT is created,
1866 as are folders "Start Menu", "Desktop", "Programs" and "Nethood".
1867 These directories and their contents will be merged with the local
1868 versions stored in c:\windows\profiles\username on subsequent logins,
1869 taking the most recent from each.  You will need to use the [global]
1870 options "preserve case = yes", "short case preserve = yes" and
1871 "case sensitive = no" in order to maintain capital letters in shortcuts
1872 in any of the profile folders.</P
1873 ><P
1874 >The user.DAT file contains all the user's preferences.  If you wish to
1875 enforce a set of preferences, rename their user.DAT file to user.MAN,
1876 and deny them write access to this file.</P
1877 ><P
1878 ></P
1879 ><OL
1880 TYPE="1"
1881 ><LI
1882 ><P
1883 >       On the Windows 95 machine, go to Control Panel | Passwords and
1884         select the User Profiles tab.  Select the required level of
1885         roaming preferences.  Press OK, but do _not_ allow the computer
1886         to reboot.
1887         </P
1888 ></LI
1889 ><LI
1890 ><P
1891 >       On the Windows 95 machine, go to Control Panel | Network |
1892         Client for Microsoft Networks | Preferences.  Select 'Log on to
1893         NT Domain'.  Then, ensure that the Primary Logon is 'Client for
1894         Microsoft Networks'.  Press OK, and this time allow the computer
1895         to reboot.
1896         </P
1897 ></LI
1898 ></OL
1899 ><P
1900 >Under Windows 95, Profiles are downloaded from the Primary Logon.
1901 If you have the Primary Logon as 'Client for Novell Networks', then
1902 the profiles and logon script will be downloaded from your Novell
1903 Server.  If you have the Primary Logon as 'Windows Logon', then the
1904 profiles will be loaded from the local machine - a bit against the
1905 concept of roaming profiles, if you ask me.</P
1906 ><P
1907 >You will now find that the Microsoft Networks Login box contains
1908 [user, password, domain] instead of just [user, password].  Type in
1909 the samba server's domain name (or any other domain known to exist,
1910 but bear in mind that the user will be authenticated against this
1911 domain and profiles downloaded from it, if that domain logon server
1912 supports it), user name and user's password.</P
1913 ><P
1914 >Once the user has been successfully validated, the Windows 95 machine
1915 will inform you that 'The user has not logged on before' and asks you
1916 if you wish to save the user's preferences?  Select 'yes'.</P
1917 ><P
1918 >Once the Windows 95 client comes up with the desktop, you should be able
1919 to examine the contents of the directory specified in the "logon path"
1920 on the samba server and verify that the "Desktop", "Start Menu",
1921 "Programs" and "Nethood" folders have been created.</P
1922 ><P
1923 >These folders will be cached locally on the client, and updated when
1924 the user logs off (if you haven't made them read-only by then :-).
1925 You will find that if the user creates further folders or short-cuts,
1926 that the client will merge the profile contents downloaded with the
1927 contents of the profile directory already on the local client, taking
1928 the newest folders and short-cuts from each set.</P
1929 ><P
1930 >If you have made the folders / files read-only on the samba server,
1931 then you will get errors from the w95 machine on logon and logout, as
1932 it attempts to merge the local and the remote profile.  Basically, if
1933 you have any errors reported by the w95 machine, check the unix file
1934 permissions and ownership rights on the profile directory contents,
1935 on the samba server.</P
1936 ><P
1937 >If you have problems creating user profiles, you can reset the user's
1938 local desktop cache, as shown below.  When this user then next logs in,
1939 they will be told that they are logging in "for the first time".</P
1940 ><P
1941 ></P
1942 ><OL
1943 TYPE="1"
1944 ><LI
1945 ><P
1946 >       instead of logging in under the [user, password, domain] dialog,
1947         press escape.
1948         </P
1949 ></LI
1950 ><LI
1951 ><P
1952 >       run the regedit.exe program, and look in:
1953         </P
1954 ><P
1955 >       HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList
1956         </P
1957 ><P
1958 >       you will find an entry, for each user, of ProfilePath.  Note the
1959         contents of this key (likely to be c:\windows\profiles\username),
1960         then delete the key ProfilePath for the required user.
1961         </P
1962 ><P
1963 >       [Exit the registry editor].
1964         </P
1965 ></LI
1966 ><LI
1967 ><P
1968 >       <I
1969 CLASS="EMPHASIS"
1970 >WARNING</I
1971 > - before deleting the contents of the
1972         directory listed in
1973    the ProfilePath (this is likely to be c:\windows\profiles\username),
1974    ask them if they have any important files stored on their desktop
1975    or in their start menu.  delete the contents of the directory
1976    ProfilePath (making a backup if any of the files are needed).
1977         </P
1978 ><P
1979 >   This will have the effect of removing the local (read-only hidden
1980    system file) user.DAT in their profile directory, as well as the
1981    local "desktop", "nethood", "start menu" and "programs" folders.
1982         </P
1983 ></LI
1984 ><LI
1985 ><P
1986 >       search for the user's .PWL password-cacheing file in the c:\windows
1987         directory, and delete it.
1988         </P
1989 ></LI
1990 ><LI
1991 ><P
1992 >       log off the windows 95 client.
1993         </P
1994 ></LI
1995 ><LI
1996 ><P
1997 >       check the contents of the profile path (see "logon path" described
1998         above), and delete the user.DAT or user.MAN file for the user,
1999         making a backup if required.
2000         </P
2001 ></LI
2002 ></OL
2003 ><P
2004 >If all else fails, increase samba's debug log levels to between 3 and 10,
2005 and / or run a packet trace program such as tcpdump or netmon.exe, and
2006 look for any error reports.</P
2007 ><P
2008 >If you have access to an NT server, then first set up roaming profiles
2009 and / or netlogons on the NT server.  Make a packet trace, or examine
2010 the example packet traces provided with NT server, and see what the
2011 differences are with the equivalent samba trace.</P
2012 ></DIV
2013 ><DIV
2014 CLASS="SECT3"
2015 ><HR><H3
2016 CLASS="SECT3"
2017 ><A
2018 NAME="AEN482"
2019 >Windows NT Workstation 4.0</A
2020 ></H3
2021 ><P
2022 >When a user first logs in to a Windows NT Workstation, the profile
2023 NTuser.DAT is created.  The profile location can be now specified
2024 through the "logon path" parameter.  </P
2025 ><DIV
2026 CLASS="NOTE"
2027 ><BLOCKQUOTE
2028 CLASS="NOTE"
2029 ><P
2030 ><B
2031 >Note: </B
2032 >[lkcl 10aug97 - i tried setting the path to
2033 \\samba-server\homes\profile, and discovered that this fails because
2034 a background process maintains the connection to the [homes] share
2035 which does _not_ close down in between user logins.  you have to
2036 have \\samba-server\%L\profile, where user is the username created
2037 from the [homes] share].</P
2038 ></BLOCKQUOTE
2039 ></DIV
2040 ><P
2041 >There is a parameter that is now available for use with NT Profiles:
2042 "logon drive".  This should be set to "h:" or any other drive, and
2043 should be used in conjunction with the new "logon home" parameter.</P
2044 ><P
2045 >The entry for the NT 4.0 profile is a _directory_ not a file.  The NT
2046 help on profiles mentions that a directory is also created with a .PDS
2047 extension.  The user, while logging in, must have write permission to
2048 create the full profile path (and the folder with the .PDS extension)
2049 [lkcl 10aug97 - i found that the creation of the .PDS directory failed,
2050 and had to create these manually for each user, with a shell script.
2051 also, i presume, but have not tested, that the full profile path must
2052 be browseable just as it is for w95, due to the manner in which they
2053 attempt to create the full profile path: test existence of each path
2054 component; create path component].</P
2055 ><P
2056 >In the profile directory, NT creates more folders than 95.  It creates
2057 "Application Data" and others, as well as "Desktop", "Nethood",
2058 "Start Menu" and "Programs".  The profile itself is stored in a file
2059 NTuser.DAT.  Nothing appears to be stored in the .PDS directory, and
2060 its purpose is currently unknown.</P
2061 ><P
2062 >You can use the System Control Panel to copy a local profile onto
2063 a samba server (see NT Help on profiles: it is also capable of firing
2064 up the correct location in the System Control Panel for you).  The
2065 NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN
2066 turns a profile into a mandatory one.</P
2067 ><DIV
2068 CLASS="NOTE"
2069 ><BLOCKQUOTE
2070 CLASS="NOTE"
2071 ><P
2072 ><B
2073 >Note: </B
2074 >[lkcl 10aug97 - i notice that NT Workstation tells me that it is
2075 downloading a profile from a slow link.  whether this is actually the
2076 case, or whether there is some configuration issue, as yet unknown,
2077 that makes NT Workstation _think_ that the link is a slow one is a
2078 matter to be resolved].</P
2079 ><P
2080 >[lkcl 20aug97 - after samba digest correspondance, one user found, and
2081 another confirmed, that profiles cannot be loaded from a samba server
2082 unless "security = user" and "encrypt passwords = yes" (see the file
2083 ENCRYPTION.txt) or "security = server" and "password server = ip.address.
2084 of.yourNTserver" are used.  either of these options will allow the NT
2085 workstation to access the samba server using LAN manager encrypted
2086 passwords, without the user intervention normally required by NT
2087 workstation for clear-text passwords].</P
2088 ><P
2089 >[lkcl 25aug97 - more comments received about NT profiles: the case of
2090 the profile _matters_.  the file _must_ be called NTuser.DAT or, for
2091 a mandatory profile, NTuser.MAN].</P
2092 ></BLOCKQUOTE
2093 ></DIV
2094 ></DIV
2095 ><DIV
2096 CLASS="SECT3"
2097 ><HR><H3
2098 CLASS="SECT3"
2099 ><A
2100 NAME="AEN495"
2101 >Windows NT Server</A
2102 ></H3
2103 ><P
2104 >There is nothing to stop you specifying any path that you like for the
2105 location of users' profiles.  Therefore, you could specify that the
2106 profile be stored on a samba server, or any other SMB server, as long as
2107 that SMB server supports encrypted passwords.</P
2108 ></DIV
2109 ><DIV
2110 CLASS="SECT3"
2111 ><HR><H3
2112 CLASS="SECT3"
2113 ><A
2114 NAME="AEN498"
2115 >Sharing Profiles between W95 and NT Workstation 4.0</A
2116 ></H3
2117 ><DIV
2118 CLASS="WARNING"
2119 ><P
2120 ></P
2121 ><TABLE
2122 CLASS="WARNING"
2123 BORDER="1"
2124 WIDTH="100%"
2125 ><TR
2126 ><TD
2127 ALIGN="CENTER"
2128 ><B
2129 >Potentially outdated or incorrect material follows</B
2130 ></TD
2131 ></TR
2132 ><TR
2133 ><TD
2134 ALIGN="LEFT"
2135 ><P
2136 >I think this is all bogus, but have not deleted it. (Richard Sharpe)</P
2137 ></TD
2138 ></TR
2139 ></TABLE
2140 ></DIV
2141 ><P
2142 >The default logon path is \\%N\U%.  NT Workstation will attempt to create
2143 a directory "\\samba-server\username.PDS" if you specify the logon path
2144 as "\\samba-server\username" with the NT User Manager.  Therefore, you
2145 will need to specify (for example) "\\samba-server\username\profile".
2146 NT 4.0 will attempt to create "\\samba-server\username\profile.PDS", which
2147 is more likely to succeed.</P
2148 ><P
2149 >If you then want to share the same Start Menu / Desktop with W95, you will
2150 need to specify "logon path = \\samba-server\username\profile" [lkcl 10aug97
2151 this has its drawbacks: i created a shortcut to telnet.exe, which attempts
2152 to run from the c:\winnt\system32 directory.  this directory is obviously
2153 unlikely to exist on a Win95-only host].</P
2154 ><P
2155 >&#13;If you have this set up correctly, you will find separate user.DAT and
2156 NTuser.DAT files in the same profile directory.</P
2157 ><DIV
2158 CLASS="NOTE"
2159 ><BLOCKQUOTE
2160 CLASS="NOTE"
2161 ><P
2162 ><B
2163 >Note: </B
2164 >[lkcl 25aug97 - there are some issues to resolve with downloading of
2165 NT profiles, probably to do with time/date stamps.  i have found that
2166 NTuser.DAT is never updated on the workstation after the first time that
2167 it is copied to the local workstation profile directory.  this is in
2168 contrast to w95, where it _does_ transfer / update profiles correctly].</P
2169 ></BLOCKQUOTE
2170 ></DIV
2171 ></DIV
2172 ></DIV
2173 ></DIV
2174 ><DIV
2175 CLASS="SECT1"
2176 ><HR><H1
2177 CLASS="SECT1"
2178 ><A
2179 NAME="AEN508"
2180 >DOMAIN_CONTROL.txt : Windows NT Domain Control &#38; Samba</A
2181 ></H1
2182 ><DIV
2183 CLASS="WARNING"
2184 ><P
2185 ></P
2186 ><TABLE
2187 CLASS="WARNING"
2188 BORDER="1"
2189 WIDTH="100%"
2190 ><TR
2191 ><TD
2192 ALIGN="CENTER"
2193 ><B
2194 >Possibly Outdated Material</B
2195 ></TD
2196 ></TR
2197 ><TR
2198 ><TD
2199 ALIGN="LEFT"
2200 ><P
2201 >       This appendix was originally authored by John H Terpstra of
2202         the Samba Team and is included here for posterity.
2203         </P
2204 ></TD
2205 ></TR
2206 ></TABLE
2207 ></DIV
2208 ><P
2209 ><I
2210 CLASS="EMPHASIS"
2211 >NOTE :</I
2212 >
2213 The term "Domain Controller" and those related to it refer to one specific
2214 method of authentication that can underly an SMB domain. Domain Controllers
2215 prior to Windows NT Server 3.1 were sold by various companies and based on
2216 private extensions to the LAN Manager 2.1 protocol. Windows NT introduced
2217 Microsoft-specific ways of distributing the user authentication database.
2218 See DOMAIN.txt for examples of how Samba can participate in or create
2219 SMB domains based on shared authentication database schemes other than the
2220 Windows NT SAM.</P
2221 ><P
2222 >Windows NT Server can be installed as either a plain file and print server
2223 (WORKGROUP workstation or server) or as a server that participates in Domain
2224 Control (DOMAIN member, Primary Domain controller or Backup Domain controller).
2225 The same is true for OS/2 Warp Server, Digital Pathworks and other similar
2226 products, all of which can participate in Domain Control along with Windows NT.</P
2227 ><P
2228 >To many people these terms can be confusing, so let's try to clear the air.</P
2229 ><P
2230 >Every Windows NT system (workstation or server) has a registry database.
2231 The registry contains entries that describe the initialization information
2232 for all services (the equivalent of Unix Daemons) that run within the Windows
2233 NT environment. The registry also contains entries that tell application
2234 software where to find dynamically loadable libraries that they depend upon.
2235 In fact, the registry contains entries that describes everything that anything
2236 may need to know to interact with the rest of the system.</P
2237 ><P
2238 >The registry files can be located on any Windows NT machine by opening a
2239 command prompt and typing:</P
2240 ><P
2241 ><TT
2242 CLASS="PROMPT"
2243 >C:\WINNT\&#62;</TT
2244 > dir %SystemRoot%\System32\config</P
2245 ><P
2246 >The environment variable %SystemRoot% value can be obtained by typing:</P
2247 ><P
2248 ><TT
2249 CLASS="PROMPT"
2250 >C:\WINNT&#62;</TT
2251 >echo %SystemRoot%</P
2252 ><P
2253 >The active parts of the registry that you may want to be familiar with are
2254 the files called: default, system, software, sam and security.</P
2255 ><P
2256 >In a domain environment, Microsoft Windows NT domain controllers participate
2257 in replication of the SAM and SECURITY files so that all controllers within
2258 the domain have an exactly identical copy of each.</P
2259 ><P
2260 >The Microsoft Windows NT system is structured within a security model that
2261 says that all applications and services must authenticate themselves before
2262 they can obtain permission from the security manager to do what they set out
2263 to do.</P
2264 ><P
2265 >The Windows NT User database also resides within the registry. This part of
2266 the registry contains the user's security identifier, home directory, group
2267 memberships, desktop profile, and so on.</P
2268 ><P
2269 >Every Windows NT system (workstation as well as server) will have its own
2270 registry. Windows NT Servers that participate in Domain Security control
2271 have a database that they share in common - thus they do NOT own an
2272 independent full registry database of their own, as do Workstations and
2273 plain Servers.</P
2274 ><P
2275 >The User database is called the SAM (Security Access Manager) database and
2276 is used for all user authentication as well as for authentication of inter-
2277 process authentication (ie: to ensure that the service action a user has
2278 requested is permitted within the limits of that user's privileges).</P
2279 ><P
2280 >The Samba team have produced a utility that can dump the Windows NT SAM into
2281 smbpasswd format: see ENCRYPTION.txt for information on smbpasswd and
2282 /pub/samba/pwdump on your nearest Samba mirror for the utility. This
2283 facility is useful but cannot be easily used to implement SAM replication
2284 to Samba systems.</P
2285 ><P
2286 >Windows for Workgroups, Windows 95, and Windows NT Workstations and Servers
2287 can participate in a Domain security system that is controlled by Windows NT
2288 servers that have been correctly configured. At most every domain will have
2289 ONE Primary Domain Controller (PDC). It is desirable that each domain will
2290 have at least one Backup Domain Controller (BDC).</P
2291 ><P
2292 >The PDC and BDCs then participate in replication of the SAM database so that
2293 each Domain Controlling participant will have an up to date SAM component
2294 within its registry.</P
2295 ></DIV
2296 ></DIV
2297 ></BODY
2298 ></HTML
2299 >