PHPTR Edit 2. More to come.

(This used to be commit bc4d2f60cefa126415b06440280761d19e8c0d21)

1 files changed, 115 insertions, 112 deletions

diff --git a/docs/Samba3-HOWTO/TOSHARG-NT4Migration.xml b/docs/Samba3-HOWTO/TOSHARG-NT4Migration.xml
index e6c68bb5ff..8209fce16f 100644
--- a/docs/Samba3-HOWTO/TOSHARG-NT4Migration.xml
+++ b/docs/Samba3-HOWTO/TOSHARG-NT4Migration.xml
@@ -9,8 +9,8 @@
 <title>Migration from NT4 PDC to Samba-3 PDC</title>
 
 <para>
-This is a rough guide to assist those wishing to migrate from NT4 Domain Control to
-Samba-3-based Domain Control.
+This is a rough guide to assist those wishing to migrate from NT4 domain control to
+Samba-3-based domain control.
 </para>
 
 <sect1>
@@ -23,31 +23,31 @@ and planned for. Then again, good planning will anticipate most show-stopper-typ
 </para>
 
 <para>
-Those wishing to migrate from MS Windows NT4 Domain Control to a Samba-3 Domain Control
+Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control
 environment would do well to develop a detailed migration plan. So here are a few pointers to
-help migration get under way.
+help migration get underway.
 </para>
 
 <sect2>
 <title>Objectives</title>
 
 <para>
-The key objective for most organizations will be to make the migration from MS Windows NT4 
-to Samba-3 Domain Control as painless as possible. One of the challenges you may experience
-in your migration process may well be one of convincing management that the new environment
+The key objective for most organizations is to make the migration from MS Windows NT4 
+to Samba-3 domain control as painless as possible. One of the challenges you may experience
+in your migration process may well be convincing management that the new environment
 should remain in place. Many who have introduced open source technologies have experienced
 pressure to return to a Microsoft-based platform solution at the first sign of trouble. 
 </para>
 
 <para>
-Before attempting a migration to a Samba-3 controlled network, make every possible effort to
+Before attempting a migration to a Samba-3-controlled network, make every possible effort to
 gain all-round commitment to the change. Know precisely <emphasis>why</emphasis> the change
 is important for the organization. Possible motivations to make a change include:
 </para>
 
 <itemizedlist>
     <listitem><para>Improve network manageability.</para></listitem>
-    <listitem><para>Obtain better user level functionality.</para></listitem>
+    <listitem><para>Obtain better user-level functionality.</para></listitem>
     <listitem><para>Reduce network operating costs.</para></listitem>
     <listitem><para>Reduce exposure caused by Microsoft withdrawal of NT4 support.</para></listitem>
     <listitem><para>Avoid MS License 6 implications.</para></listitem>
@@ -82,31 +82,31 @@ include:
 <itemizedlist>
 	<listitem><para>Lower cost of ownership.</para></listitem>
 	<listitem><para>Global availability of support with no strings attached.</para></listitem>
-	<listitem><para>Dynamic SMB Servers (can run more than one SMB/CIFS server per UNIX/Linux system).</para></listitem>
+	<listitem><para>Dynamic SMB servers (can run more than one SMB/CIFS server per UNIX/Linux system).</para></listitem>
 	<listitem><para>Creation of on-the-fly logon scripts.</para></listitem>
-	<listitem><para>Creation of on-the-fly Policy Files.</para></listitem>
-	<listitem><para>Greater stability, reliability, performance and availability.</para></listitem>
-	<listitem><para>Manageability via an ssh connection.</para></listitem>
-	<listitem><para>Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam).</para></listitem>
+	<listitem><para>Creation of on-the-fly policy files.</para></listitem>
+	<listitem><para>Greater stability, reliability, performance, and availability.</para></listitem>
+	<listitem><para>Manageability via an SSH connection.</para></listitem>
+	<listitem><para>Flexible choices of backend authentication technologies (tdbsam, ldapsam, mysqlsam).</para></listitem>
 	<listitem><para>Ability to implement a full single-sign-on architecture.</para></listitem>
-	<listitem><para>Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand.</para></listitem>
+	<listitem><para>Ability to distribute authentication systems for absolute minimum wide-area network bandwidth demand.</para></listitem>
 </itemizedlist>
 
 <para>
 Before migrating a network from MS Windows NT4 to Samba-3, consider all necessary factors. Users
 should be educated about changes they may experience so the change will be a welcome one
-and not become an obstacle to the work they need to do. The following are factors that will 
-help ensure a successful migration:
+and not become an obstacle to the work they need to do. The following sections explain factors that will 
+help ensure a successful migration.
 </para>
 
 <sect3>
 <title>Domain Layout</title>
 
 <para>
-Samba-3 can be configured as a Domain Controller, a back-up Domain Controller (probably best called
-a secondary controller), a Domain Member, or as a stand-alone Server. The Windows network security
+Samba-3 can be configured as a domain controller, a backup domain controller (probably best called
+a secondary controller), a domain member, or a standalone server. The Windows network security
 domain context should be sized and scoped before implementation. Particular attention needs to be
-paid to the location of the primary Domain Controller (PDC) as well as backup controllers (BDCs).
+paid to the location of the Primary Domain Controller (PDC) as well as backup controllers (BDCs).
 One way in which Samba-3 differs from Microsoft technology is that if one chooses to use an LDAP
 authentication backend, then the same database can be used by several different domains. In a
 complex organization, there can be a single LDAP database, which itself can be distributed (have
@@ -121,11 +121,11 @@ domain should be scaled taking into consideration server capacity and network ba
 <para>
 A physical network segment may house several domains. Each may span multiple network segments.
 Where domains span routed network segments, consider and test the performance implications of
-the design and layout of a network. A centrally located Domain Controller that is designed to
+the design and layout of a network. A centrally located domain controller that is designed to
 serve multiple routed network segments may result in severe performance problems. Check the
 response time (ping timing) between the remote segment and the PDC. If
 it's long (more than 100 ms),
-locate a backup controller (BDC) on the remote segment to serve as the local authentication and
+locate a BDC on the remote segment to serve as the local authentication and
 access control server.
 </para>
 </sect3>
@@ -142,16 +142,16 @@ of keeping systems secure and functional.
 
 <para>
 Keep in mind the nature of how data must be shared. Physical disk space layout should be considered
-carefully. Some data must be backed up. The simpler the disk layout the easier it will be to
+carefully. Some data must be backed up. The simpler the disk layout, the easier it will be to
 keep track of backup needs. Identify what backup media will meet your needs; consider backup to tape,
-CD-ROM or (DVD-ROM), or other offline storage medium. Plan and implement for minimum
+CD-ROM or DVD-ROM, or other offline storage medium. Plan and implement for minimum
 maintenance. Leave nothing to chance in your design; above all, do not leave backups to chance:
-Backup, test, and validate every backup, create a disaster recovery plan and prove that it works.
+backup, test, and validate every backup; create a disaster recovery plan and prove that it works.
 </para>
 
 <para>
 Users should be grouped according to data access control needs. File and directory access 
-is best controlled via group permissions and the use of the <quote>sticky bit</quote> on group controlled
+is best controlled via group permissions, and the use of the <quote>sticky bit</quote> on group-controlled
 directories may substantially avoid file access complaints from Samba share users.
 </para>
 
@@ -162,7 +162,7 @@ Keep your design and implementation simple and document your design extensively.
 audit your documentation. Do not create a complex mess that your successor will not understand.
 Remember, job security through complex design and implementation may cause loss of operations
 and downtime to users as the new administrator learns to untangle your knots. Keep access
-controls simple and effective and make sure that users will never be interrupted by obtuse
+controls simple and effective, and make sure that users will never be interrupted by obtuse
 complexity.
 </para>
 </sect3>
@@ -175,8 +175,8 @@ Logon scripts can help to ensure that all users gain the share and printer conne
 </para>
 
 <para>
-Logon scripts can be created on-the-fly so all commands executed are specific to the
-rights and privileges granted to the user. The preferred controls should be affected through
+Logon scripts can be created on the fly so all commands executed are specific to the
+rights and privileges granted to the user. The preferred controls should be effected through
 group membership so group information can be used to create a custom logon script using
 the <smbconfoption name="root preexec"/> parameters to the <smbconfsection name="NETLOGON"/> share.
 </para>
@@ -193,16 +193,16 @@ deals with how to add printers without user intervention via the logon script pr
 <title>Profile Migration/Creation</title>
 
 <para>
-User and Group Profiles may be migrated using the tools described in the section titled Desktop Profile
+User and group profiles may be migrated using the tools described in the section titled Desktop Profile
 Management.
 </para>
 
 
 <para>
 <indexterm><primary>SID</primary></indexterm>
-Profiles may also be managed using the Samba-3 tool <command>profiles</command>. This tool allows
-the MS Windows NT-style security identifiers (SIDs) that are stored inside the profile <filename>NTuser.DAT</filename> file
-to be changed to the SID of the Samba-3 domain.
+Profiles may also be managed using the Samba-3 tool <command>profiles</command>. This tool allows the MS
+Windows NT-style security identifiers (SIDs) that are stored inside the profile
+<filename>NTuser.DAT</filename> file to be changed to the SID of the Samba-3 domain.
 </para>
 </sect3>
 
@@ -211,7 +211,7 @@ to be changed to the SID of the Samba-3 domain.
 
 <para>
 It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before
-attempting to migrate user and group accounts, it is STRONGLY advised to create in Samba-3 the
+attempting to migrate user and group accounts, you are STRONGLY advised to create in Samba-3 the
 groups that are present on the MS Windows NT4 domain <emphasis>AND</emphasis> to map them to
 suitable UNIX/Linux groups. By following this simple advice, all user and group attributes
 should migrate painlessly.
@@ -228,37 +228,43 @@ The approximate migration process is described below.
 </para>
 
 <itemizedlist>
-<listitem><para>
-You have an NT4 PDC that has the users, groups, policies and profiles to be migrated.
-</para></listitem>
-
-<listitem><para>
-Samba-3 set up as a DC with netlogon share, profile share, and so on. Configure the &smb.conf; file
-to function as a BDC, i.e., <parameter>domain master = No</parameter>.
-</para></listitem>
+	<listitem><para>
+	You have an NT4 PDC that has the users, groups, policies, and profiles to be migrated.
+	</para></listitem>
+
+	<listitem><para>
+	Samba-3 is set up as a domain controller with netlogon share, profile share, and so on. Configure the &smb.conf; file
+	to function as a BDC: <parameter>domain master = No</parameter>.
+	</para></listitem>
 </itemizedlist>
 
-<procedure><title>The Account Migration Process</title>
-	<step><para>
-<indexterm><primary>pdbedit</primary></indexterm>
-			Create a BDC account in the old NT4 domain for the Samba server using NT Server Manager.</para>
-		<substeps><step><para>Samba must not be running.</para></step></substeps></step>
+<procedure>
+<title>The Account Migration Process</title>
 
+	<step><para>
+	<indexterm><primary>pdbedit</primary></indexterm>
+	Create a BDC account in the old NT4 domain for the Samba server using NT Server Manager.
+	<emphasis>Samba must not be running.</emphasis>
+	</para></step>
 
 	<step><para>
-<indexterm><primary>net</primary><secondary>rpc</secondary></indexterm>
-			<userinput>net rpc join -S <replaceable>NT4PDC</replaceable> -w <replaceable>DOMNAME</replaceable> -U Administrator%<replaceable>passwd</replaceable></userinput></para></step>
+	<indexterm><primary>net</primary><secondary>rpc</secondary></indexterm>
+	<userinput>net rpc join -S <replaceable>NT4PDC</replaceable> -w <replaceable>DOMNAME</replaceable> -U
+	Administrator%<replaceable>passwd</replaceable></userinput>
+	</para></step>
 
-	<step><para><userinput>net rpc vampire -S <replaceable>NT4PDC</replaceable> -U administrator%<replaceable>passwd</replaceable></userinput></para></step>
+	<step><para>
+	<userinput>net rpc vampire -S <replaceable>NT4PDC</replaceable> -U 
+	administrator%<replaceable>passwd</replaceable></userinput>
+	</para></step>
 
 	<step><para><userinput>pdbedit -L</userinput></para>
-		<substeps><step><para>Note &smbmdash; did the users migrate?</para></step></substeps>
+		<para>Note: Did the users migrate?</para>
 	</step>
 
-
 	<step><para>
-<indexterm><primary>net</primary><secondary>groupmap</secondary></indexterm>
-<indexterm><primary>initGroups.sh</primary></indexterm>
+	<indexterm><primary>net</primary><secondary>groupmap</secondary></indexterm>
+	<indexterm><primary>initGroups.sh</primary></indexterm>
 	Now assign each of the UNIX groups to NT groups:
 	(It may be useful to copy this text to a script called <filename>initGroups.sh</filename>)
 	<programlisting>
@@ -278,8 +284,8 @@ net groupmap add ntgroup="QA Team"   unixgroup=qateam    type=d rid=3220
 	</para></step>
 
 	<step><para><userinput>net groupmap list</userinput></para>
-		<substeps><step><para>Check that all groups are recognized.</para></step></substeps>
-	</step>
+		<para>Check that all groups are recognized.
+	</para></step>
 </procedure>
 
 <para>
@@ -293,7 +299,7 @@ Migrate all the profiles, then migrate all policy files.
 <title>Migration Options</title>
 
 <para>
-Sites that wish to migrate from MS Windows NT4 Domain Control to a Samba-based solution
+Sites that wish to migrate from MS Windows NT4 domain control to a Samba-based solution
 generally fit into three basic categories. <link linkend="majtypes">Following table</link> shows the possibilities.
 </para>
 
@@ -306,8 +312,9 @@ generally fit into three basic categories. <link linkend="majtypes">Following ta
 	</thead>
 	<tbody>
 	<row><entry>&lt; 50</entry><entry><para>Want simple conversion with no pain.</para></entry></row>
-	<row><entry>50 - 250</entry><entry><para>Want new features, can manage some in-house complexity.</para></entry></row>
-	<row><entry>&gt; 250</entry><entry><para>Solution/Implementation must scale well, complex needs. Cross-departmental decision process. Local expertise in most areas.</para></entry></row>
+	<row><entry>50 - 250</entry><entry><para>Want new features; can manage some inhouse complexity.</para></entry></row>
+	<row><entry>&gt; 250</entry><entry><para>Solution/implementation must scale well; complex needs.
+		Cross-departmental decision process. Local expertise in most areas.</para></entry></row>
 	</tbody>
 </tgroup>
 </table>
@@ -335,7 +342,7 @@ to Samba-3:
 </itemizedlist>
 
 <para>
-Minimize down-stream problems by:
+Minimize downstream problems by:
 </para>
 
 <itemizedlist>
@@ -344,7 +351,7 @@ Minimize down-stream problems by:
 	</para></listitem>
 
 	<listitem><para>
-	Avoiding Panic.
+	Avoiding panic.
 	</para></listitem>
 
 	<listitem><para>
@@ -370,9 +377,9 @@ being contemplated.
 	</thead>
 	<tbody>
 	<row>
-	<entry><para>Make use of minimal OS specific features.</para></entry>
-	<entry><para>Translate NT4 features to new host OS features.</para></entry>
-	<entry><para>Decide:</para></entry>
+	<entry><para>Make use of minimal OS specific features</para></entry>
+	<entry><para>Translate NT4 features to new host OS features</para></entry>
+	<entry><para>Decide: (John, decide what???????)</para></entry>
 	</row>
 	<row>
 	<entry><para>Move all accounts from NT4 into Samba-3</para></entry>
@@ -395,7 +402,7 @@ being contemplated.
 	<entry><para>Identify Needs for: <emphasis>Manageability, Scalability, Security, Availability</emphasis></para></entry>
 	</row>
 	<row>
-	<entry><para>Integrate Samba-3 then migrate while users are active, then change of control (swap out)</para></entry>
+	<entry><para>Integrate Samba-3, then migrate while users are active, then change of control (swap out)</para></entry>
 	<entry><para>Take advantage of lower maintenance opportunity</para></entry>
 	<entry><para></para></entry>
 	</row>
@@ -408,7 +415,7 @@ being contemplated.
 <title>Samba-3 Implementation Choices</title>
 
 <variablelist>
-	<varlistentry><term>Authentication Database/Backend</term><listitem>
+		<varlistentry><term>Authentication Database/Backend</term><listitem>
 		<para>
 		Samba-3 can use an external authentication backend:
 		</para>
@@ -416,43 +423,42 @@ being contemplated.
 		<para>
 		<itemizedlist>
 			<listitem><para>Winbind (external Samba or NT4/200x server).</para></listitem>
-			<listitem><para>External server could use Active Directory or NT4 Domain.</para></listitem>
-			<listitem><para>Can use pam_mkhomedir.so to auto-create home dirs.</para></listitem>
-			<listitem><para>
-					Samba-3 can use a local authentication backend: <parameter>smbpasswd, tdbsam, ldapsam, mysqlsam</parameter></para></listitem>
-	</itemizedlist>
-		</para>
-	</listitem></varlistentry>
+			<listitem><para>External server could use Active Directory or NT4 domain.</para></listitem>
+			<listitem><para>Can use pam_mkhomedir.so to autocreate home directories.</para></listitem>
+			<listitem><para> Samba-3 can use a local authentication backend: <parameter>smbpasswd</parameter>,
+				<parameter>tdbsam</parameter>, <parameter>ldapsam</parameter>, <parameter>mysqlsam</parameter>
+			</para></listitem>
+		</itemizedlist></para></listitem>
+		</varlistentry>
 
         <varlistentry><term>Access Control Points</term><listitem>
 		<para>
-		Samba permits Access Control Points to be set:
+		Samba permits Access Control points to be set:
 		</para>
 		<itemizedlist>
-                        <listitem><para>On the share itself &smbmdash; using Share ACLs.</para></listitem>
-                        <listitem><para>On the file system &smbmdash; using UNIX permissions on files and directories.</para>
-				<para>Note: Can enable Posix ACLs in file system also.</para></listitem>
-                        <listitem><para>Through Samba share parameters &smbmdash; not recommended except as last resort.</para></listitem>
-		</itemizedlist>
-                </listitem>
+			<listitem><para>On the share itself &smbmdash; using share ACLs.</para></listitem>
+			<listitem><para>On the file system &smbmdash; using UNIX permissions on files and directories.</para>
+			<para>Note: Can enable Posix ACLs in file system also.</para></listitem>
+			<listitem><para>Through Samba share parameters &smbmdash; not recommended except as last resort.</para></listitem>
+		</itemizedlist></listitem>
         </varlistentry>
 
         <varlistentry><term>Policies (migrate or create new ones)</term><listitem>
 		<para>
-		Exercise great caution when affecting registry changes, use the right tool and be aware
+		Exercise great caution when making registry changes; use the right tool and be aware
 		that changes made through NT4-style <filename>NTConfig.POL</filename> files can leave
 		permanent changes.
 		</para>
                 <itemizedlist>
                         <listitem><para>Using Group Policy Editor (NT4).</para></listitem>
-                        <listitem><para>Watch out for Tattoo effect.</para></listitem>
+                        <listitem><para>Watch out for tattoo effect.</para></listitem>
 		</itemizedlist>
                 </listitem>
         </varlistentry>
 
         <varlistentry><term>User and Group Profiles</term><listitem>
                 <para>
-		Platform-specific so use platform tool to change from a Local to a Roaming profile.
+		Platform-specific, so use platform tool to change from a local to a roaming profile.
 		Can use new profiles tool to change SIDs (<filename>NTUser.DAT</filename>).
 		</para>
                 </listitem>
@@ -468,53 +474,50 @@ being contemplated.
 
         <varlistentry><term>User and Group Mapping to UNIX/Linux</term><listitem>
 		<para>
-<indexterm><primary>pdbedit</primary></indexterm>
-		User and Group mapping code is new. Many problems have been experienced as network administrators
+		<indexterm><primary>pdbedit</primary></indexterm>
+		User and group mapping code is new. Many problems have been experienced as network administrators
 		who are familiar with Samba-2.2.x migrate to Samba-3. Carefully study the chapters that document
 		the new password backend behavior and the new group mapping functionality.
 		</para>
-                <itemizedlist>
-                        <listitem><para>The <parameter>username map</parameter> facility may be needed.</para></listitem>
-                        <listitem><para>Use <command>net groupmap</command> to connect NT4 groups to UNIX groups.</para></listitem>
-                        <listitem><para>Use <command>pdbedit</command> to set/change user configuration.</para>
-
-				<para>
-				When migrating to LDAP backend, it may be easier to dump the initial
-				LDAP database to LDIF, edit, then reload into LDAP.
-				</para>
-			</listitem>
-		</itemizedlist>
-                </listitem>
+			<itemizedlist>
+				<listitem><para>The <parameter>username map</parameter> facility may be needed.</para></listitem>
+				<listitem><para>Use <command>net groupmap</command> to connect NT4 groups to UNIX groups.</para></listitem>
+				<listitem><para>
+					Use <command>pdbedit</command> to set/change user configuration.
+					</para>
+
+					<para>
+					When migrating to LDAP backend, it may be easier to dump the initial
+					LDAP database to LDIF, edit, then reload into LDAP.
+					</para></listitem>
+			</itemizedlist></listitem>
         </varlistentry>
 
-        <varlistentry><term>OS Specific Scripts/Programs may be Needed</term><listitem>
+        <varlistentry><term>OS Specific Scripts/Programs May be Needed</term><listitem>
 		<para>
 		Every operating system has its peculiarities. These are the result of engineering decisions
-		that were based on the experience of the designer, and may have side-effects that were not
+		that were based on the experience of the designer and may have side effects that were not
 		anticipated. Limitations that may bite the Windows network administrator include:
 		</para>
                 <itemizedlist>
                         <listitem><para>Add/Delete Users: Note OS limits on size of name
-				(Linux 8 chars) NT4 up to 254 chars.</para></listitem>
-                        <listitem><para>Add/Delete Machines: Applied only to Domain Members
+				(Linux 8 chars, NT4 up to 254 chars).</para></listitem>
+                        <listitem><para>Add/Delete Machines: Applied only to domain members
 				(Note: machine names may be limited to 16 characters).</para></listitem>
                         <listitem><para>Use <command>net groupmap</command> to connect NT4 groups to UNIX groups.</para></listitem>
                         <listitem><para>Add/Delete Groups: Note OS limits on size and nature.
-				Linux limit is 16 char, no spaces and no upper case chars (<command>groupadd</command>).</para></listitem>
-		</itemizedlist>
-                </listitem>
+				Linux limit is 16 char, no spaces, and no uppercase chars (<command>groupadd</command>).</para></listitem>
+		</itemizedlist></listitem>
         </varlistentry>
 
         <varlistentry><term>Migration Tools</term><listitem>
                 <para>
-<indexterm><primary>pdbedit</primary></indexterm>
-		Domain Control (NT4 Style) Profiles, Policies, Access Controls, Security
-		<itemizedlist>
-                        <listitem><para>Samba: <command>net, rpcclient, smbpasswd, pdbedit, profiles.</command></para></listitem>
-                        <listitem><para>Windows: <command>NT4 Domain User Manager, Server Manager (NEXUS)</command></para></listitem>
-                </itemizedlist>
-			</para>
-                </listitem>
+				<indexterm><primary>pdbedit</primary></indexterm>
+				Domain Control (NT4-Style) Profiles, Policies, Access Controls, Security
+				<itemizedlist>
+					 <listitem><para>Samba: <command>net, rpcclient, smbpasswd, pdbedit, profiles</command></para></listitem>
+					 <listitem><para>Windows: <command>NT4 Domain User Manager, Server Manager (NEXUS)</command></para></listitem>
+				</itemizedlist></para></listitem>
         </varlistentry>
 </variablelist>