merge from 2.2

(This used to be commit c5ee06b7c8fc9f1fec679acc7d7f47f333707456)

1 files changed, 0 insertions, 1083 deletions

diff --git a/docs/docbook/faq/samba-pdc-faq.sgml b/docs/docbook/faq/samba-pdc-faq.sgml
deleted file mode 100644
index 3dae096f04..0000000000
--- a/docs/docbook/faq/samba-pdc-faq.sgml
+++ /dev/null
@@ -1,1083 +0,0 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
-<book id="samba-pdc-faq">
-
-<title>The Samba 2.2 PDC FAQ</title>
-
-<bookinfo>
-    <author>
-        <firstname>David</firstname><surname>Bannon</surname>
-        <affiliation><orgname>La Trobe University</orgname></affiliation>
-    </author>
-    <address><email>dbannon@samba.org</email></address>    
-    <pubdate>November 2000</pubdate>
-</bookinfo>
-
-
-<dedication><title></title>
-
-	<para>
-	This is the FAQ for Samba 2.2 as an NTDomain controller. 
-	This document is derived from the origional FAQ that was built and 
-	maintained by Gerald Carter from the early days of Samba NTDomain development 
-	up until recently.  It is now being updated as significent changes are 
-	made to 2.2.0.
-	</para> 
-
-	<para>
-	Please note it does not apply to the SAMBA_TNG nor the HEAD branch.
-	</para>
-
-	<para>
-	Also available is a Samba 2.2 PDC <ulink url="samba-pdc-howto.html">HOWTO</ulink> 
-	that takes you, step by step, over the process of setting up a very basic Samba 
-	2.2 Primary Domain Controller
-	</para>
-
-</dedication>
-
-<toc></toc> 
-
-<!-- ================ I N T R O D U C T I O N  ==================== -->
-
-
-<chapter>
-
-<title>Introduction</title>
-
-<sect1>
-<title id=stateofplay>State of Play</title>
-
-	<para>Much of the related code does work. For example, if an NT is removed from the 
-	domain and then rejoins, the <filename>Create a Computer Account in the Domain</> dialog
-	will let you reset the smbpasswd. That is you don't need to do it from
-	the unix box. However, at the present, you do need to have root as an 
-	administrator and use the root user name and password.</para> 
-
-    <para><command>Policies</command> do work on a W2K machine. MS says that recent 
-	builds of W2K dont observe an NT policy but it appears it does in 'legacy' 
-	mode.</para>
-  
-</sect1>
-
-<sect1>
-<title>Introduction</title>
-
-	<para>
-	This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing 
-	with the 'old HEAD' version of Samba and its NTDomain facilities. It is 
-	being rewritten by David Bannon (drb) so that it addresses more 
-	accurately the Samba 2.2.x release. 
-	</para>
-
-	<para>
-	This document probably still contains some material that does not apply 
-	to Samba 2.2 but most (all?) of the really misleading stuff has been 
-	removed. Some issues are not dealt with or are dealt with badly. Please 
-	send corrections and additions to <ulink
-	url="mailto:D.Bannon@latrobe.edu.au">David Bannon</ulink>.
-	</para> 
-
-	<para>Hopefully, as we all become familiar with the Samba 2.2 as a 
-	PDC this document will become much more usefull.</para>
-
-</sect1>
-
-</chapter>
-
-<!-- ============== G E N E R A L   I N F O R M A T I O N ============== -->
-
-<chapter><title>General Information</>
-
-
-<sect1><title>What can we do ?</title>
-
-<sect2>
-<title>What can Samba 2.2.x Primary Domain Controller (PDC) do ?</title>
-
-	<para>
-	If you wish to have Samba act as a PDC for Windows NT 4.0/2000 client, 
-	then you will need to obtain the 2.2.0 version. Release of a stable, 
-	full featured Samba PDC is currently slated for version 3.0. 
-	</para>
-
-	<para>
-	The following is a list of included  features currently in 
-	Samba 2.2:
-	</para>
-
-	<itemizedlist>
-			<listitem><para>The ability to act as a limited PDC for 
-			Windows NT and W2000 clients. This includes adding NT and 
-			W2K machines to the domain and authenticating users logging 
-			into the domain.</para></listitem> 
-			
-			<listitem><para>Domain account can be viewed using the User 
-			Manager for Domains</para></listitem>  
-			
-			<listitem><para>Viewing/adding/deleting resources on the Samba 
-			PDC via the Server Manager for Domains from the NT client.
-			</para></listitem> 
-			
-			<listitem><para>Windows 95/98/ME clients will allow user 
-			level security to be set and browsing of domain accounts.
-			</para></listitem>  
-			
-			<listitem><para>Machine account password updates.</para></listitem>
-			
-			<listitem><para>Changing of user passwords from an NT client.
-			</para></listitem>  
-			
-			<listitem><para>Partial support for Windows NT username mapping.
-			Group name mapping is slated for a later release.</para></listitem>  
-		</itemizedlist>
-
-
-	<para>
-	These things are note expected to work in the forseeable future:
-	</para>
-	
-	<itemizedlist>
-	 		<listitem><para>Trust relationships</para></listitem>
-			<listitem><para>PDC and BDC integration</para></listitem>
-	</itemizedlist>
-</sect2>
-
-<sect2>
-<title>Can I have a Windows 2000 client logon to a Samba 
-controlled domain?</title>
-
-	<para>
-	The 2.2 release branch of Samba  supports Windows 2000 domain 
-	clients in legacy mode, ie as if the PDC is a NTServer, not a
-	W2K server.
-	</para>
-</sect2>
-
-</sect1>
-
-<sect1>
-<title>CVS</title>
-
-	<para>
-	CVS is a programme (publically available) that the Samba developers 
-	use to maintain the central source code. Non developers can get 
-	access to the source in a read only capacity. Many flavours of unix 
-	now arrive with cvs installed.</>
-
-<sect2>
-<title>What are the different Samba branches available in CVS ?</title>
-
-	<para>You can find out more about obtaining Samba's via anonymous 
-	CVS from <ulink url="http://pserver.samba.org/samba/cvs.html">
-	http://pserver.samba.org/samba/cvs.html</ulink>. 
-	</para>
-
-	<para>
-	There are basically four branches to watch at the moment :
-	</para>
-	
-	<variablelist>
-		<varlistentry>
-		<term>HEAD</term> 
-		<listitem><para>Samba 3.0 ? This code boasts all the main 
-		development work in Samba. Due to its developmental
-		nature, its not really suitable for production work.
-		</para></listitem></varlistentry>
-		
-		<varlistentry>
-		<term>SAMBA_2_0</term> 
-		<listitem><para>This branch contains the previous stable 
-		release.  At the moment it contains 2.0.8, a version that 
-		will do some limited PDC stuff. If you are really going to 
-		do PDC things, you consider 2.2 instead.
-		</para></listitem></varlistentry>
-		
-		<varlistentry>
-		<term>SAMBA_2_2</term>
-		<listitem><para>The 2.2.x release branch which is a subset 
-		of the features of the HEAD branch.  This document addresses 
-		only SAMBA_2_2.
-		</para></listitem></varlistentry>
-
-		<varlistentry>
-		<term>SAMBA_TNG</term> 
-		<listitem><para>This branch is no longer maintained from the Samba 
-		sites.  Please see <ulink url="http://www.samba-tng.org/">
-		http://www.samba-tng.org/</ulink>.  It has been requested 
-		that questions about TNG are not posted to the regular Samba 
-		mailing lists including samba-ntdom and samba-technical.
-		</para></listitem></varlistentry>
-	</variablelist>
-</sect2>
-
-<sect2>
-<title>What are the CVS commands ?</title>
-
-	<para>
-	See <ulink url="http://pserver.samba.org/samba/cvs.html">
-	http://pserver.samba.org/samba/cvs.html</ulink> for instructions
-	on obtaining the SAMBA_2_2 or HEAD cvs code.
-	</para>
-</sect2>
-</sect1>
-</chapter>
-
-
-<chapter>
-<title>Establishing Connections</title>
-
-<sect1>
-<title></title>
-
-<sect2>
-<title>How do I get my NT4 or W2000 Workstation to login to the Samba 
-controlled Domain?</> 
-
-	<para>
-	There is a comprehensive Samba PDC <ulink
-	url="samba-pdc-howto.html">HOWTO</ulink> accessable from the samba web 
-	site under 'Documentation'. Read it.
-	</para>
-</sect2>
-
-<sect2>
-<title>What is a 'machine account' ?</title>
-
-	<para>
-	Every NT, W2K or Samba machine that joins a Samba controlled 
-	domain must be known to the Samba PDC. There are two entries 
-	required, one in (typically) <filename>/etc/passwd</filename>
-    and the other in (typically) <filename>/usr/local/samba/private/smbpasswd</filename>. 
-	Under some circumstances these entries are made 
-	<link linkend=machineaccounts>manually</link>, the <ulink 
-	url="samba-pdc-howto.html">HOWTO</ulink> 
-	discusses ways of creating them automatically.</para>
-</sect2>
-
-
-<sect2>
-<title>"The machine account for this computer either does not 
-exist or is not accessable."</>
-
-	<para>
-	When I try to join the domain I get the message "The machine account 
-	for this computer either does not exist or is not accessable". Whats 
-	wrong ?
-	</para>
-
-	<para>
-	This problem is caused by the PDC not having a suitable machine account. 
-	If you are using the <command>add user script =</> method to create 
-	accounts then this would indicate that it has not worked. Ensure the domain 
-	admin user system is working.
-	</para>
-
-	<para>
-	Alternatively if you are creating account entries manually then they 
-	have not been created correctly. Make sure that you have the entry 
-	correct for the machine account in smbpasswd file on the Samba PDC. 
-	If you added the account using an editor rather than using the smbpasswd 
-	utility, make sure that the account name is the machine netbios name 
-	with a '$' appended to it ( ie. computer_name$ ). There must be an entry 
-	in both /etc/passwd and the smbpasswd file. Some people have reported 
-	that inconsistent subnet masks between the Samba server and the NT 
-	client have caused this problem.   Make sure that these are consistent 
-	for both client and server.
-	</para>
-</sect2>
-
-<sect2>
-<title id=machineaccounts>How do I create machine accounts manually ?</title>
-
-	<para>
-	This was the only option until recently, now in version 2.2 better 
-	means are available.  You might still need to do it manually for a 
-	couple of reasons. A machine account consists of two entries (assuming 
-	a standard install and /etc/passwd use), one in /etc/passwd and the 
-	other in /usr/local/samba/private/smbpasswd. The /etc/passwd
-	entry will list the machine name with a $ appended, won't have a 
-	passwd, will have a null shell and no home directory. For example 
-	a machine called 'doppy' would have an /etc/passwd entry like this :</para>
-
-	<para>
-	<command>doppy$:x:505:501:NTMachine:/dev/null:/bin/false</command>
-	</para>
-
-	<para>
-	On a linux system for example, you would typically add it like 
-	this :
-	</para>
-
-	<para>
-	<command>adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n 
-	doppy$</command>
-	</para>
-
-	<para>
-	Then you need to add that entry to smbpasswd, assuming you have a suitable
-	path to the <command>smbpasswd</> programme, do this :
-	</para>
-
-	<para>
-	<command>smbpasswd -a -m doppy$</command>
-	</para>
-
-	<para>
-	The entry will be created with a well known password, so any machine that 
-	says its doppy could join the domain as long as it gets in first. So 
-	don't create the accounts any earlier than you need them.
-	</para>
-</sect2> 
-
-<sect2>
-<title>I cannot include a '$' in a machine name.</title>
-
-    <para>
-	A 'machine name' in (typically) <filename>/etc/passwd</> consists 
-    of the machine name with a '$' appended. FreeBSD (and other BSD 
-	systems ?) won't create a user with a '$' in their name.
-	</para>
-
-    <para>
-	The problem is only in the program used to make the entry, once 
-	made, it works perfectly. So create a user without the '$' and 
-	use <command>vipw</> to edit the entry, adding the '$'. Or create 
-	the whole entry with vipw if you like, make sure you use a 
-	unique uid !</para>
-</sect2>
-
-<sect2>
-<title id=alreadyhaveconnection>I get told "You already have a connection to the Domain...." 
-when creating a machine account.</title>
-	
-	<para>
-	This happens if you try to create a machine account from the 
-	machine itself and use a user	name that does not work (for whatever 
-	reason) and then try another (possibly valid) user name.
-	Exit out of the network applet to close the initial connection 
-	and try again.
-	</para>
-
-    <para>
-	Further, if the machine is a already a 'member of a workgroup' that 
-	is the same name as the domain you are joining (bad idea) you will 
-	get this message.  Change the workgroup name to something else, it 
-	does not matter what, reboot, and try again.</para>
-</sect2>
-
-<sect2>
-<title>I get told "Cannot join domain, the credentials supplied 
-conflict with an existing set.."</title>
-
-    <para>
-	This is the same basic problem as mentioned above, <link 
-	linkend=alreadyhaveconnection> "You already have a connection..."</link>
-	</para>
-</sect2>
-
-<sect2>
-<title>"The system can not log you on (C000019B)...."</title>
-
-	<para>I joined the domain successfully but after upgrading 
-	to a newer version of the Samba code I get the message, "The system 
-	can not log you on (C000019B), Please try a gain or consult your 
-	system administrator" when attempting to logon.
-	</para>
-
-	<para>
-	This occurs when the domain SID stored in private/WORKGROUP.SID is 
-	changed.  For example, you remove the file and smbd automatically 
-	creates a new one.  Or you are swapping back and forth between 
-	versions 2.0.7, TNG and the HEAD branch code (not recommended).  The 
-	only way to correct the problem is to restore the original domain 
-	SID or 	remove the domain client from the domain and rejoin.
-	</para> 
-</sect2>
-
-</sect1>
-
-</chapter>
-
-
-<!-- ============ U S E R   A C C O U N T   M A N A G M E N T   ============= -->
-
-<chapter>
-<title>User Account Management</title>
-
-<sect1>
-<title>Domain Admins</title>
-
-<sect2>
-<title>How do I configure an account as a domain administrator?</title>
-
-	<para>
-	See the NTDom <ulink url="samba-pdc-howto.html">HowTo</ulink>.
-	</para>
-</sect2>
-</sect1>
-
-<sect1>
-<title>Profiles</title>
-
-<sect2>
-<title>Why is it bad to set "logon path = \\%N\%U\profile" in 
-smb.conf?</title>
-
-	<para>
-	Sometimes Windows clients will maintain a connection to 
-	the \\homes\ ( or [%U] ) share even after the user has logged out. 
-	Consider the following scenario.
-	</para> 
-
-	<itemizedlist>
-			<listitem><para> user1 logs into the Windows NT machine.  
-			Therefore the [homes] share is set to \\server\user1.
-			</para></listitem>
-			
-			<listitem><para> user1 works for a while and then logs 
-			out. </para></listitem>
-			
-			<listitem><para> user2 logs into the same Windows NT  
-			machine.</para></listitem> 
-	</itemizedlist>
-
-	<para>
-	However, since the NT box has maintained a connection to [homes] 
-	which was previously set to \\server\user1, when the operating system 
-	attempts to get the profile and if it can read users1's profile, will 
-	get it otherwise it will return an error. You get the picture.
-	</para>
-
-	<para>
-	A better solution is to use a separate [profiles] share and 
-	set the "logon path = \\%N\profiles\%U" 
-	</para>
-</sect2>
-
-
-<sect2>
-<title>Why are all the users listed in the "domain admin users" using the 
-same profile?</title>
-
-	<para>
-	You are using a very very old development version of Samba. 
-	Upgrade.
-	</para>
-</sect2>
-    
-
-
-<sect2>
-<title>The roaming profiles do not seem to be updating on the 
-server.</title>
-
-    <para>
-	There can be several reasons for this.
-	</para> 
-
-    <para>
-	Make sure that the time on the client and the PDC are synchronized.  You 
-	can accomplish this by executing a <command>net time  \\server /set /yes</command> 
-	replacing server with the name of your PDC (or another synchronized SMB server). 
-	See <link linkend="SettingTime"> about Setting Time</link>
-	</para>
-
-	<para>
-	Make sure that the "logon path" is writeable by the user and make sure 
-	that the connection to the logon path location is by the current user.   
-	Sometimes Windows client do not drop the connection immediately upon 
-	logoff.
-	</para> 
-
-    <para>
-	Some people have reported that the logon path location should 
-	also be browseable.  I (GC) have yet to emperically verify this, 
-	but you can try.</para> 
-</sect2>
-</sect1>
-
-<sect1><title>Policies</title>
-
-<sect2>
-<title>What are 'Policies' ?.</title>
-
-    <para>
-	When a user logs onto the domain via a client machine, the PDC 
-	sends the client machine a list of things contained in the 
-	'policy' (if it exists).  This list may do things like suppress 
-	a splach screen, format the dates the way you like them or perhaps 
-	remove locally stored profiles.
-	</para>
-
-    <para>
-	On a samba PDC this list is obtained from a file called 
-	<filename>ntconfig.pol</filename> and located in the [netlogon] 
-	share. The file is created with a policy editor and must be readable 
-	by anyone and writeable by only root. See <link linkend=policyeditor>
-    below</link> for how  to get a suitable editor.
-	</para>  
-</sect2>
-
-<sect2>
-<title>I can't get system policies to work.</title>
-
-	<para>
-	There are two possible reasons for system policies not 
-	functioning correctly. Make sure that you have the following 
-	parameters set in smb.conf 
-	</para>
-
-    <para><programlisting>
-	[netlogon]
-	....
-	locking = no
-	public = no
-	browseable = yes
-	....   
-    </programlisting></para>
-
-    <para>
-	A policy file must be in the [netlogon] share and must be 
-    readable by everyone and writeable by only root. The file 
-	must be created by an NTServer <link linkend=policyeditor>Policy 
-	Editor</link>.
-	</para>
-
-    <para>
-	Last time I (drb) looked in the source, it was looking for 
-	<filename>ntconfig.pol</filename> first then several other 
-	combinations of upper and lower case. People have reported 
-	success using <filename>NTconfig.pol</filename>, <filename>NTconfig.POL</filename> 
-	and <filename>ntconfig.pol</filename>.   These are the case settings that 
-	I (GC) use with the	filename <filename>ntconfig.pol</filename>:
-	</para>
-
-	<para><programlisting>
-        case sensitive = no
-        case preserve = yes
-		short preserve case = no
-        default case = yes
-	</programlisting></para>
-	 
-</sect2>
-
-<sect2>
-<title id=policyeditor>What about Windows NT Policy Editor ?</title>
-
-	<para>
-	To create or edit <filename>ntconfig.pol</filename> you must use 
-	the NT Server Policy Editor, <command>poledit.exe</command>	which 
-	is included with NT Server but <emphasis>not NT Workstation</emphasis>. 
-	There is a Policy Editor on a NTws 
-    but it is not suitable for creating <emphasis>Domain Policies</emphasis>. 
-    Further, although the Windows 95 
-	Policy Editor can be installed on an NT Workstation/Server, it will not
-	work with NT policies because the registry key that are set by the policy templates. 
-	However, the files from the NT Server will run happily enough on an NTws. 
-	You need <filename>poledit.exe, common.adm</> and <filename>winnt.adm</>. It is convenient
-    to put the two *.adm files in <filename>c:\winnt\inf</> which is where
-    the binary will look for them unless told otherwise. Note also that that 
-    directory is 'hidden'.
-	</para>
-
-	<para>The Windows NT policy editor is also included with the 
-	Service Pack 3 (and later) for Windows NT 4.0. Extract the files using 
-    <command>servicepackname /x</command>, ie thats <command>Nt4sp6ai.exe 
-	/x</command> for service pack 6a.  The policy editor, <command>poledt.exe</command> and the 
-	associated template files (*.adm) should
-	be extracted as well.  It is also possible to downloaded the policy template 
-	files for Office97 and get a copy of the policy editor.  Another possible 
-	location is with the Zero Administration Kit available for download from Microsoft.
-    </para>
-</sect2>
-
-
-<sect2>
-<title>Can Win95 do Policies ?</title>
-
-	<para>
-	Install the group policy handler for Win9x to pick up group 
-	policies.   Look on the Win98 CD in <filename>\tools\reskit\netadmin\poledit</filename>. 
-	Install group policies on a Win9x client by double-clicking 
-	<filename>grouppol.inf</filename>. Log off and on again a couple of 
-	times and see if Win98 picks up group policies.  Unfortunately this needs 
-	to be done on every Win9x machine that uses group policies....
-	</para> 
-
-	<para>
-	If group policies don't work one reports suggests getting the updated 
-	(read: working) grouppol.dll for Windows 9x. The group list is grabbed 
-	from /etc/group.
-	</para>
-
-</sect2>
-
-</sect1>
-
-<sect1>
-<title>Passwords</title>
-
-<sect2>
-<title>What is password sync and should I use it ?</title>
-
-    <para>
-	NTws users can change their domain password by pressing Ctrl-Alt-Del 
-	and choosing 'Change Password'. By default however, this does not change the unix password 
-    (typically in <filename>/etc/passwd</filename> or <filename>/etc/shadow</filename>). 
-	In lots of situations thats OK, for example :
-	</para>
-
-	<itemizedlist>
-		<listitem><para>The server is only accessible to the user via 
-		samba.</para></listitem>
-		
-		<listitem><para>Pam_smb or similar is installed so other applications 
-        still refer to the samba password.</para></listitem>
-    </itemizedlist>
-
-    <para>
-	But sometimes you really do need to maintain two seperate password 
-	databases and there are good reasons to keep then in sync.  Trying 
-	to explain to users that they need to change their passwords in two 
-	seperate places or use two seperate passwords is not fun.
-	</para>
-
-    <para>
-	However do understand that setting up password sync is not without 
-	problems either. The chief difficulty is the interface between Samba 
-	and the <command>passwd</command> command, it can be a fiddle to set 
-	up and if the password the user has entered fails, the resulting errors 
-	are ambiguously reported and the user is confused. Further, you need 
-	to take steps to ensure that users only ever change their passwords 
-	via samba (or use <command>smbpasswd</command>), otherwise they will 
-	only be changing the unix password.</para>
-    
-
-</sect2>
-
-<sect2>
-<title>How do I get remote password (unix and SMB) changing working ?</title>
-
-	<para>
-	Have a practice changing a user's password (as root) to see 
-	what discussion takes place and change the text in the 'passwd chat' 
-	line below  as necessary. The line as shown works for recent RH Linux 
-	but most other systems seem to like to do something different. The '*' is 
-	a wild card and will match anything (or nothing).
-	</para>
-
-	<para>
-	Add these lines to smb.conf under [Global]
-	</para>
-
-	<para><programlisting> 
-
-		unix password sync = true
-   		passwd program = /usr/bin/passwd %u
-   		passwd chat = *password* %n\n *password* %n\n *successful*
-	</programlisting></para>
-
-	<para>
-	As mentioned above, the change to the unix password happens as root, 
-	not as the user, as is indicated in ~/smbd/chgpasswd.c  If
-	you are using NIS, the Samba server must be running on the NIS 
-	master machine.
-	</para>
-</sect2>
-
-</sect1>
-
-</chapter>
-
-<!-- ===================  M I S C E L L A N E O U S  ================= -->
-
-<chapter>
-<title>Miscellaneous</title>
-
-<sect1>
-<title></title>
-
-<sect2>
-<title>What editor can I use in DOS/Windows that won't 
-mess with my unix EOF</title>
-
-    <para>There are a number of Windows or DOS based editors that will 
-	understand, and leave intact, the unix eof (as opposed to a DOS CL/LF). 
-	List members suggested :
-	</para>
-
-	<itemizedlist>
-		<listitem><para>UltraEdit at <ulink url="http://www.ultraedit.com">www.ultraedit.com</ulink></para></listitem>
-
-	    <listitem><para>VI for windows at <ulink url="http://home.snafu.de/ramo/WinViEn.htm">
-        home.snafu.de/ramo/WinViEn.htm</ulink></para></listitem>
-
-		<listitem><para>The author prefers PFE at <ulink url="http://www.lancs.ac.uk/people/cpaap/pfe/">
-		www.lancs.ac.uk/people/cpaap/pfe/</ulink> but its no longer being developed...</para></listitem>
-    </itemizedlist>
-</sect2>
-
-
-
-
-<sect2>
-<title>How do I get 'User Manager' and 'Server Manager'</title>
-
-	<para>
-	Since I don't need to buy an NT Server CD now, how do I get 
-	the 'User Manager for Domains', the 'Server Manager' ?
-	</para>
-
-	<para>
-	Microsoft distributes a version of 
-	these tools called nexus for installation on Windows 95 systems.  The 
-	tools set includes
-	</para>
-	
-	<itemizedlist>
-		<listitem><para>Server Manager</para></listitem> 
-		
-		<listitem><para>User Manager for Domains</para></listitem> 
-
-		<listitem><para>Event Viewer</para></listitem> 
-	</itemizedlist>
-
-	<para>
-	Click here to download the archived file <ulink 
-	url="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</ulink>
-	</para>
-
-	<para>
-	The Windows NT 4.0 version of the 'User Manager for 
-	Domains' and 'Server Manager' are available from Microsoft via ftp 
-	from <ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</ulink>
-	</para>
-</sect2>
-
-
-<sect2><title id="SettingTime">The time setting from a Samba server does not work.</title>
-	<para>If it works OK when you log on as Domain Admin then the problem is that ordinary users
-	don't have permission to change the time. (The system is running with their permission
-	at logon time.) This is not a Samba problem, you will have the same problem where ever
-	you connect. You can give 'everyone' permission to change the time from the User Manager.
-	</para>
-
-	<para>Anyone know what the registry settings are so this could be done with a Policy ?</para>
-</sect2>
-
-<sect2><title>"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</>
-	<para>I keep getting the message "trust account xxx should be in DOMAIN_GROUP_RID_USERS." 
-	in the logs. What do I need to do?</para>
-
-	<para>You are using one of the old development versions. Upgrade. 
-	(The message is unimportant, was a reminder to a developer)</para>
-
-</sect2>
-
-<sect2><title>How do I get my samba server to become a member ( not PDC ) of an NT domain?</title>
-
-
-	<para>
-	Please refer to the <ulink url="DOMAIN_MEMBER.html">Domain Member 
-	HOWTO</ulink> for more information on this.
-	</para>
-
-</sect2>
-</sect1>
-</chapter>
-
-
-<!-- ======== T R O U B L E   S H O O T I N G   and  B U G    R E P O R T I N G ======== -->
-
-
-
-<chapter><title>Troubleshooting and Bug Reporting</title>
-
-<sect1><title>Diagnostic tools</title>
-
-<sect2><title>What are some diagnostics tools I can use to debug the domain logon process and where can I
-	find them? </title>
-
-    <para>
-	One of the best diagnostic tools for debugging problems is Samba itself.  
-	You can use the -d option for both smbd and nmbd to specifiy what 
-	'debug level' at which to run.  See the man pages on smbd, nmbd  and 
-	smb.conf for more information on debugging options.  The debug 
-	level can range from 1 (the default) to 10 (100 for debugging passwords).
-	</para>
-	
-	<para>
-	Another helpful method of debugging is to compile samba using the 
-	<command>gcc -g </command> flag.   This will include debug 
-	information in the binaries and allow you to attch gdb to the 
-	running smbd / nmbd process.  In order to attach gdb to an smbd 
-	process for an NT workstation, first get the workstation to make the 
-	connection. Pressing ctrl-alt-delete and going down to the domain box 
-	is sufficient (at least, on the first time you join the domain) to 
-	generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation 
-	maintains an open connection, and therefore there will be an smbd 
-	process running (assuming that you haven't set a really short smbd 
-	idle timeout)  So, in between pressing ctrl alt delete, and actually 
-	typing in your password, you can gdb attach and continue.
-	</para>
-
-	<para>
-	Some usefull samba commands worth investigating:
-	</para>
-	
-	<itemizedlist>
-		<listitem><para>testparam | more</para></listitem>
-		<listitem><para>smbclient -L //{netbios name of server}</para></listitem>
-	</itemizedlist>
-    
-    <para>
-	An SMB enabled version of tcpdump is available from 
-    <ulink url="http://www.tcpdump.org/">http://www.tcpdump.org/</ulink>.
-	Ethereal, another good packet sniffer for UNIX and Win32
-	hosts, can be downloaded from <ulink 
-	url="http://www.ethereal.com/">http://www.ethereal.com</ulink>.
-	</para>
-	
-	<para>
-	For tracing things on the Microsoft Windows NT, Network Monitor 
-	(aka. netmon) is available on the Microsoft Developer Network CD's, 
-	the Windows NT Server install CD and the SMS CD's.  The version of 
-	netmon that ships with SMS allows for dumping packets between any two 
-	computers (ie. placing the network interface in promiscuous mode).  
-	The version on the NT Server install CD will only allow monitoring 
-	of network traffic directed to the local NT box and broadcasts on the 
-	local subnet.  Be aware that Ethereal can read and write netmon 
-	formatted files.
-	</para>
-
-</sect2>
-
-<sect2>
-<title>How do I install 'Network Monitor' on an NT Workstation 
-or a Windows 9x box?</title>
-
-	<para>
-	Installing netmon on an NT workstation requires a couple 
-	of steps.  The following are for installing Netmon V4.00.349, which comes 
-	with Microsoft Windows NT Server 4.0, on Microsoft Windows NT 
-	Workstation 4.0.  The process should be similar for other version of 
-	Windows NT / Netmon.  You will need both the Microsoft Windows 
-	NT Server 4.0 Install CD and the Workstation 4.0 Install CD.
-	</para> 
-
-	<para>
-	Initially you will need to install 'Network Monitor Tools and Agent' 
-	on the NT Server.  To do this 
-	</para>
-
-	<itemizedlist>
-		<listitem><para>Goto Start - Settings - Control Panel - 
-		Network - Services - Add </para></listitem>
-		
-		<listitem><para>Select the 'Network Monitor Tools and Agent' and 
-		click on 'OK'.</para></listitem> 
-		
-		<listitem><para>Click 'OK' on the Network Control Panel.
-		</para></listitem> 
-		
-		<listitem><para>Insert the Windows NT Server 4.0 install CD 
-		when prompted.</para></listitem> 
-	</itemizedlist>
-
-	<para>
-	At this point the Netmon files should exist in 
-	<filename>%SYSTEMROOT%\System32\netmon\*.*</filename>.    
-	Two subdirectories exist as well, <filename>parsers\</filename> 
-	which contains the necessary DLL's for parsing the netmon packet 
-	dump, and <filename>captures\</filename>.
-	</para>
-
-	<para>
-	In order to install the Netmon tools on an NT Workstation, you will 
-	first need to install the 'Network  Monitor Agent' from the Workstation 
-	install CD.
-	</para>
-
-	<itemizedlist>
-		<listitem><para>Goto Start - Settings - Control Panel - 
-		Network - Services - Add</para></listitem> 
-
-		<listitem><para>Select the 'Network Monitor Agent' and click 
-		on 'OK'.</para></listitem> 
-		
-		<listitem><para>Click 'OK' on the Network Control Panel.
-		</para></listitem> 
-		
-		<listitem><para>Insert the Windows NT Workstation 4.0 install 
-		CD when prompted.</para></listitem> 
-	</itemizedlist>
-
-
-	<para>
-	Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* 
-	to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set 
-	permissions as  you deem appropriate for your site. You will need 
-	administrative rights on the NT box to run netmon.
-	</para>
-
-	<para>
-	To install Netmon on a Windows 9x box install the network monitor agent 
-	from the Windows 9x CD (\admin\nettools\netmon).  There is a readme 
-	file located with the netmon driver files on the CD if you need 
-	information on how to do this.  Copy the files from a working 
-	Netmon installation.
-	</para> 
-</sect2>
-
-</sect1>
-
-<sect1>
-<title>What other help can I get ? </title>
-
-	<para>
-	There are many sources of information available in the form 
-	of mailing lists, RFC's and documentation.  The docs that come 
-	with the samba distribution contain very good explanations of 
-	general SMB topics such as browsing.</para> 
-
-<sect2>
-<title id=urls>URLs and similar</title>
-
-
-	<itemizedlist>
-
-    <listitem><para>Home of Samba site <ulink url="http://samba.org">
-        http://samba.org</ulink>. We have a mirror near you !</para></listitem>
-
-    <listitem><para> The <emphasis role=strong>Development</emphasis> document 
-		on the Samba mirrors might mention your problem. If so,
-		it might mean that the developers are working on it.</para></listitem>
- 
-	<listitem><para> Ignacio Coupeau has a very comprehesive look at LDAP with Samba at 
-		<ulink url="http://www.unav.es/cti/ldap-smb-howto.html">
-		http://www.unav.es/cti/ldap-smb-howto.html</ulink> 
-		Be a little carefull however, I suspect that it does not specificly 
-		address samba 2.2.x. The HEAD pre-2.1 may possibly be the best
-		stream to look at.</para></listitem>
-
-	<listitem><para>  Lars Kneschke's site covers <ulink url="http://www.samba-tng.org">
-        Samba-TNG</ulink> at 
-		<ulink url="http://www.kneschke.de/projekte/samba_tng">
-		http://www.kneschke.de/projekte/samba_tng</ulink>, but again, a 
-		lot of it does not apply to the main stream Samba.</para></listitem>
-
-    <listitem><para>See how Scott Merrill simulates a BDC behaviour at 
-        <ulink url="http://www.skippy.net/linux/smb-howto.html">
-        http://www.skippy.net/linux/smb-howto.html</>. </para></listitem>
-
-    <listitem><para>Although 2.0.7 has almost had its day as a PDC, I (drb) will
-        keep the 2.0.7 PDC pages at <ulink url="http://bioserve.latrobe.edu.au/samba">
-        http://bioserve.latrobe.edu.au/samba</ulink> going for a while yet.</para></listitem>
-
-    <listitem><para>Misc links to CIFS information 
-        <ulink url="http://samba.org/cifs/">http://samba.org/cifs/</ulink></para></listitem>
-
-    <listitem><para>NT Domains for Unix <ulink url="http://mailhost.cb1.com/~lkcl/ntdom/">
-        http://mailhost.cb1.com/~lkcl/ntdom/</ulink></para></listitem>
-
-    <listitem><para>FTP site for older SMB specs: 
-        <ulink url="ftp://ftp.microsoft.com/developr/drg/CIFS/">
-        ftp://ftp.microsoft.com/developr/drg/CIFS/</ulink></para></listitem>
-
-	</itemizedlist>
-
-
-	<para>
-	You should also refer to the MS archives at
-	<ulink url="ftp://ftp.microsoft.com/developr/drg/CIFS/">ftp://ftp.microsoft.com/developr/drg/CIFS/"</ulink>
-	</para>
-
-</sect2>
-
-
-<sect2>
-<title>How do I get help from the mailing lists ?</title>
-
-    <para> There are a number of Samba related mailing lists. Go to <ulink url=
-        "http://samba.org">http://samba.org</ulink>, click on your nearest mirror
-        and then click on <command>Support</> and then click on <command>
-        Samba related mailing lists</>.</para>
-
-    <para>For questions relating to Samba TNG go to
-        <ulink url="http://www.samba-tng.org/">http://www.samba-tng.org/</ulink> 
-	    It has been requested that you don't post questions about Samba-TNG to the
-        main stream Samba lists.</para>
-	 
-<itemizedlist><title>If you post a message to one of the lists please
-	 observe the following guide lines :</title>
-
-	<listitem><para> Always remember that the developers are volunteers, they are 
-		not paid and they never guarantee to produce a particular feature at 
-		a particular time. Any time lines are 'best guess' and nothing more.
-		</para></listitem>
-
-	<listitem><para> Always mention what version of samba you are using and what 
-		operating system its running under. You should probably list the
-        relevant sections of your smb.conf file, at least the options 
-        in [global] that affect PDC support.</para></listitem>
-
-    <listitem><para>In addition to the version, if you obtained Samba via
-        CVS mention the date when you last checked it out.</para></listitem>
-
-	<listitem><para> Try and make your question clear and brief, lots of long, 
-		convoluted questions get deleted before	they are completely read ! 
-		Don't post html encoded messages (if you can select colour or font 
-		size its html).</para></listitem>
-
-	<listitem><para> If you run one of those niffy 'I'm on holidays' things when 
-		you are away, make sure its configured	to not answer mailing lists.
-		</para></listitem> 
-
-	<listitem><para> Don't cross post. Work out which is the best list to post to 
-		and see what happens, ie don't post to both samba-ntdom and samba-technical.
-        Many people active on the lists subscribe to more 
-		than one list and get annoyed to see the same message two or more times. 
-		Often someone will see a message and thinking it would be better dealt 
-		with on another, will forward it on for you.</para></listitem>
-
-    <listitem><para>You might include <emphasis>partial</emphasis>
-        log files written at a debug level set to as much as 20.  
-        Please don't send the entire log but enough to give the context of the 
-        error messages.</para></listitem>
-
-    <listitem><para>(Possibly) If you have a complete netmon trace ( from the opening of 
-        the pipe to the error ) you can send the *.CAP file as well.</para></listitem> 
-
-    <listitem><para>Please think carefully before attaching a document to an email.
-        Consider pasting the relevant parts into the body of the message. The samba
-        mailing lists go to a huge number of people, do they all need a copy of your 
-        smb.conf in their attach directory ?</para></listitem>
-
-</itemizedlist>
-</sect2>
-
-
-<sect2>
-<title>How do I get off the mailing lists ?</title>
-
-    <para>To have your name removed from a samba mailing list, go to the
-        same place you went to to get on it. Go to <ulink url=
-        "http://lists.samba.org/">http://lists.samba.org</ulink>, click 
-		on your nearest mirror and then click on <command>Support</> and 
-		then click on <command> Samba related mailing lists</>. Or perhaps see 
-        <ulink url="http://lists.samba.org/mailman/roster/samba-ntdom">here</ulink></para>
-
-    <para>
-	Please don't post messages to the list asking to be removed, you will just
-        be refered to the above address (unless that process failed in some way...)
-    </para>
-</sect2>
-      
-</sect1>
-
-</chapter>
-
-
-
-
-</book>