Fix changed link - thanks Eric.

(This used to be commit f92e5f6392d0afaa9b24d7af1329b3923c7f9576)

2 files changed, 29 insertions, 27 deletions

diff --git a/docs/Samba3-ByExample/SBE-KerberosFastStart.xml b/docs/Samba3-ByExample/SBE-KerberosFastStart.xml
index 58ac2b6931..e2b2e4b83e 100644
--- a/docs/Samba3-ByExample/SBE-KerberosFastStart.xml
+++ b/docs/Samba3-ByExample/SBE-KerberosFastStart.xml
@@ -766,9 +766,10 @@
 				<ulink url="http://support.microsoft.com/default.aspx?kbid=321733">acknowledged</ulink>
 				and for which a fix was provided. In fact,
 				<ulink url="http://www.tangent-systems.com/support/delayedwrite.html">Tangent Systems</ulink> 
-				appears even today<footnote>January 2004</footnote> to be unsure whether the problem has been resolved,
-				it is evident that some delay in release of new functionality may have
-				fortuitous consequences.
+				have documented a significant problem with delays writes that can be connected with the
+				implementation of sign'n'seal. They provide a work-around that is not trivial for many
+				Windows networking sites. From notes such as this it is clear that there are benefits
+				from not rushing new technology out of the door too soon.
 				</para>
 
 	      <para><indexterm>
@@ -915,13 +916,10 @@
 	trusting the kerberos server, users and services can authenticate each other.
 	</para>
 
-	  <para><indexterm>
-	      <primary>restricted export</primary>
-	    </indexterm><indexterm>
-	      <primary>MIT Kerberos</primary>
-	    </indexterm><indexterm>
-	      <primary>Heimdal Kerberos</primary>
-	    </indexterm>
+	<para>
+	<indexterm><primary>restricted export</primary></indexterm>
+	<indexterm><primary>MIT Kerberos</primary></indexterm>
+	<indexterm><primary>Heimdal Kerberos</primary></indexterm>
 	Kerberos was, until recently, a technology that was restricted from being exported from the United States.
 	For many years that hindered global adoption of more secure networking technologies both within the United States
 	and abroad. A free and unencumbered implementation of MIT Kerberos has been produced in Europe
@@ -931,12 +929,13 @@
 	and in the general deployment and use of Kerberos across the spectrum of the information technology industry.
 	</para>
 
-	  <para><indexterm>
-	      <primary>Kerberos</primary>
-	      <secondary>interoperability</secondary>
-	    </indexterm>
+	<para>
+	<indexterm><primary>Kerberos</primary><secondary>interoperability</secondary></indexterm>
 	A storm has broken out concerning interoperability between MIT Kerberos and Microsofts' implementation
-	of it. For example, a 2002 report by <ulink url="http://www.idg.com.sg/idgwww.nsf/0/5DDA8D153A7505A748256BAB000D992A?OpenDocument">IDG</ulink>
+	of it. For example, a 2002
+	<ulink url="http://www.idg.com.sg/idgwww.nsf/0/5DDA8D153A7505A748256BAB000D992A?OpenDocument">IDG</ulink>
+	report<footnote>Note: This link is no longer active. The same article is still
+	available from <ulink url="http://199.105.191.226/Man/2699/020430msdoj/">ITWorld.com</ulink> (July 5, 2005)</footnote> by
 	states:
 	</para>
 
@@ -947,10 +946,8 @@
 	use of the Kerberos authentication specification, not everyone agrees.
 	</para>
 
-	    <para><indexterm>
-		<primary>Kerberos</primary>
-		<secondary>unspecified fields</secondary>
-	      </indexterm>
+	<para>
+	<indexterm><primary>Kerberos</primary><secondary>unspecified fields</secondary></indexterm>
 	Robert Short, vice president of Windows core technology at Microsoft, wrote in his direct testimony prepared 
 	before his appearance that non-Microsoft operating systems can disregard the portion of the Kerberos version 
 	5 specification that Windows clients use for proprietary purposes and still achieve interoperability with 
@@ -959,11 +956,9 @@
 	that software developers could add their own authorization information, he said.
 	</para></blockquote>
 
-	  <para><indexterm>
-	      <primary>DCE</primary>
-	    </indexterm><indexterm>
-	      <primary>RPC</primary>
-	    </indexterm>
+	<para>
+	<indexterm><primary>DCE</primary></indexterm>
+	<indexterm><primary>RPC</primary></indexterm>
 	It so happens that Microsoft Windows clients depend on and expect the contents of the <emphasis>unspecified
 	fields</emphasis> in the Kerberos 5 communications data stream for their Windows interoperability,
 	particularly when Samba is expected to emulate a Windows Server 200x domain controller. But the interoperability
@@ -974,7 +969,8 @@
 	</para>
 
 	<para>
-	Microsoft makes the following comment in a reference in a <ulink url="http://www.microsoft.com/technet/itsolutions/interop/mgmt/kerberos.asp">
+	Microsoft makes the following comment in a reference in a
+	<ulink url="http://www.microsoft.com/technet/itsolutions/interop/mgmt/kerberos.asp">
 	technet</ulink> article:
 	</para>
 
diff --git a/docs/Samba3-ByExample/SBE-MakingHappyUsers.xml b/docs/Samba3-ByExample/SBE-MakingHappyUsers.xml
index ba708668dd..9a95b8b44a 100644
--- a/docs/Samba3-ByExample/SBE-MakingHappyUsers.xml
+++ b/docs/Samba3-ByExample/SBE-MakingHappyUsers.xml
@@ -51,6 +51,9 @@ clients is conservative and if followed will minimize problems &smbmdash; but it
 		</para>
 
 		<para>
+		<indexterm><primary>PDC</primary></indexterm>
+		<indexterm><primary>BDC</primary></indexterm>
+		<indexterm><primary>clients per DC</primary></indexterm>
 		If the domain controller provides only network logon services
 		and all file and print activity is handled by domain member servers, one domain	
 		controller per 150 clients on a single network segment may suffice. In any
@@ -58,8 +61,11 @@ clients is conservative and if followed will minimize problems &smbmdash; but it
 		per network segment. It is better to have at least one BDC on the network
 		segment that has a PDC. If the domain controller is also used as a file and
 		print server, the number of clients it can service reliably is reduced,
-		and a common rule is not to exceed 30 machines (Windows workstations plus
-		domain member servers) per domain controller.
+		and generally for low powered hardware should not exceed 30 machines (Windows 
+		workstations plus domain member servers) per domain controller. Many sites are
+		able to operate with more clients per domain controller, the number of clients
+		that can be supported is limited by the CPU speed, memory and the workload on
+		the Samba server as well as network bandwidth utilization.
 		</para></listitem>
 		</varlistentry>