More edits, hackety hack.

(This used to be commit 044489f218fa90df3a4838980b060738d6dcbffc)

1 files changed, 207 insertions, 22 deletions

diff --git a/docs/docbook/projdoc/DOMAIN_MEMBER.xml b/docs/docbook/projdoc/DOMAIN_MEMBER.xml
index de4a8510c0..ecb8a3afb3 100644
--- a/docs/docbook/projdoc/DOMAIN_MEMBER.xml
+++ b/docs/docbook/projdoc/DOMAIN_MEMBER.xml
@@ -1,9 +1,9 @@
 <chapter id="domain-member">
 
 <chapterinfo>
+	&author.jht;
 	&author.jeremy;
 	&author.jerry;
-	&author.jht;
 </chapterinfo>
 
 <title>Domain Membership</title>
@@ -40,6 +40,44 @@ Samba-3 can join an MS Windows NT4 style domain as a native member server, an MS
 Active Directory Domain as a native member server, or a Samba Domain Control network.
 </para>
 
+<para>
+Domain membership has many advantages:
+</para>
+
+<itemizedlist>
+	<listitem><para>
+	MS Windows workstation users get the benefit of SSO
+	</para></listitem>
+
+	<listitem><para>
+	Domain user access rights and file ownership / access controls can be set from
+	the single Domain SAM (Security Accounts Management) database (works with Domain member
+	servers as well as with MS Windows workstations that are domain members)
+	</para></listitem>
+
+	<listitem><para>
+	Only MS Windows NT4 / 200x / XP Professional workstations that are Domain members
+	can use network logon facilities
+	</para></listitem>
+
+	<listitem><para>
+	Domain Member workstations can be better controlled through the use of Policy files
+	(NTConfig.POL) and Desktop Profiles.
+	</para></listitem>
+
+	<listitem><para>
+	Through the use of logon scripts users can be given transparent access to network
+	applications that run off application servers
+	</para></listitem>
+
+	<listitem><para>
+	Network administrators gain better application and user access management abilities
+	because there is no need to maintain user accounts on any network client or server,
+	other than the central Domain database (either NT4/Samba SAM style Domain, NT4 Domain
+	that is back ended with an LDAP directory, or via an Active Directory infrastructure)
+	</para></listitem>
+</itemizedlist>
+
 </sect1>
 
 <sect1>
@@ -64,8 +102,8 @@ shared secret with the domain controller.
 </para>
 
 <para>
-A Windows NT4 PDC stores each machine trust account in the Windows
-Registry. The introduction of MS Windows 2000 saw the introduction of Active Directory,
+A Windows NT4 PDC stores each machine trust account in the Windows Registry.
+The introduction of MS Windows 2000 saw the introduction of Active Directory,
 the new repository for machine trust accounts.
 </para>
 
@@ -103,12 +141,19 @@ as follows:
 </para>
 
 <para>
-There are two ways to create machine trust accounts:
+There are three ways to create machine trust accounts:
 </para>
 
 <itemizedlist>
 	<listitem><para>
-	Manual creation. Both the Samba and corresponding Unix account are created by hand.
+	Manual creation from the Unix/Linux command line. Here, both the Samba and corresponding
+	Unix account are created by hand.
+	</para></listitem>
+
+	<listitem><para>
+	Using the MS Windows NT4 Server Manager (either from an NT4 Domain member server, or using
+	the Nexus toolkit available from the Microsoft web site. This tool can be run from any
+	MS Windows machine so long as the user is logged on as the administrator account.
 	</para></listitem>
 	
 	<listitem><para>
@@ -200,6 +245,56 @@ the corresponding Unix account.
 </warning>
 </sect2>
 
+<sect2>
+<title>Using NT4 Server Manager to Add Machine Accounts to the Domain</title>
+
+<para>
+If the machine from which you are trying to manage the domain is an MS Windows NT4 workstation
+then the tool of choice is the package called SRVTOOLS.EXE. When executed in the target directory
+this will unpack SrvMge.exe and UsrMgr.exe (both are Domain Management tools for MS Windows NT4
+workstation.
+</para>
+
+<para>
+If your workstation is any other MS Windows product you should download the Nexus.exe package
+from the Microsoft web site. When executed from the target directory this will unpack the same
+tools but for use on MS Windows 9x/Me/200x/XP.
+</para>
+
+<para>
+Launch the <command>srvmgr.exe</command> (Server Manager for Domains) and follow these steps:
+</para>
+
+<procedure>
+<title>Server Manager Account Machine Account Management</title>
+	<step><para>
+	From the menu select Computer
+	</para></step>
+
+	<step><para>
+	Click on "Select Domain"
+	</para></step>
+
+	<step><para>
+	Click on the name of the domain you wish to administer in the "Select Domain" panel
+	and then Click OK.
+	</para></step>
+
+	<step><para>
+	Again from the menu select Computer
+	</para></step>
+
+	<step><para>
+	Select "Add to Domain"
+	</para></step>
+
+	<step><para>
+	In the dialog box, click on the radio button to "Add NT Workstation of Server", then
+	enter the machine name in the field provided, then Click the "Add" button.
+	</para></step>
+</procedure>
+
+</sect2>
 
 <sect2>
 <title>"On-the-Fly" Creation of Machine Trust Accounts</title>
@@ -210,13 +305,11 @@ simply to allow the Samba server to create them as needed when the client
 is joined to the domain.
 </para>
 
-<para>Since each Samba machine trust account requires a corresponding
-Unix account, a method for automatically creating the
-Unix account is usually supplied; this requires configuration of the
-<ulink url="smb.conf.5.html#ADDMACHINESCRIPT">add machine script</ulink> 
-option in <filename>smb.conf</filename>.  This
-method is not required, however; corresponding Unix accounts may also
-be created manually.
+<para>Since each Samba machine trust account requires a corresponding Unix account, a method
+for automatically creating the Unix account is usually supplied; this requires configuration of the
+<ulink url="smb.conf.5.html#ADDMACHINESCRIPT">add machine script</ulink> option in
+<filename>smb.conf</filename>. This method is not required, however; corresponding Unix
+accounts may also be created manually.
 </para>
 
 
@@ -230,25 +323,39 @@ Below is an example for a RedHat Linux system.
    add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u 
 </programlisting></para>
 
+
 </sect2>
 
 
-<sect2><title>Joining the Client to the Domain</title>
+<sect2><title>Making an MS Windows Workstation or Server a Domain Member</title>
 
 <para>
-The procedure for joining a client to the domain varies with the version of Windows.
+The procedure for making an MS Windows workstation of server a member of the domain varies
+with the version of Windows:
 </para>
 
 <itemizedlist>
-	<listitem><para><emphasis>Windows 2000</emphasis></para>
+	<listitem><para><emphasis>Windows 200x XP Professional</emphasis></para>
+
+	<para>
+	When the user elects to make the client a domain member, Windows 200x prompts for
+	an account and password that has privileges to create  machine accounts in the domain.
+	A Samba administrative account (i.e., a Samba account that has root privileges on the
+	Samba server) must be entered here; the operation will fail if an ordinary user
+	account is given. 
+	</para>
+
+	<para>
+	Note: For security reasons the password for this administrative account should be set
+	to a password that is other than that used for the root user in the
+	<filename>/etc/passwd</filename>.
+	</para>
 
 	<para>
-	When the user elects to join the client to a domain, Windows prompts for
-	an account and password that is privileged to join the domain. A Samba administrative
-	account (i.e., a Samba account that has root privileges on the Samba server) must be
-	entered here; the operation will fail if an ordinary user account is given. 
-	The password for this account should be set to a different password than the associated
-	<filename>/etc/passwd</filename> entry, for security reasons.
+	The name of the account that is used to create domain member machine accounts can be
+	anything the network administrator may choose. If it is other than <command>root</command>
+	then this is easily mapped to root using the file pointed to be the &smb.conf; parameter
+	<emphasis>username map =</emphasis> <command>/etc/samba/smbusers</command>.
 	</para>
 
 	<para>
@@ -258,7 +365,7 @@ The procedure for joining a client to the domain varies with the version of Wind
 	updated if it already exists.
 	</para></listitem>
 
-	<listitem><para><emphasis>Windows NT</emphasis></para>
+	<listitem><para><emphasis>Windows NT4</emphasis></para>
 
 	<para>
 	If the machine trust account was created manually, on the
@@ -701,6 +808,84 @@ their defaults DNS setup. Maybe fixed in service packs?
 </para>
 
 </sect2>
+</sect1>
+
+<sect1>
+<title>Common Errors</title>
+
+<para>
+In the process of adding / deleting / re-adding domain member machine accounts there are
+many traps for the unwary player and there are many "little" things that can go wrong.
+It is particularly interesting how often subscribers on the samba mailing list have concluded
+after repeated failed attempts to add a machine account that it is necessary to "re-install"
+MS Windows on t he machine. In truth, it is seldom necessary to reinstall because of this type
+of problem. The real solution is often very simple, and with understanding of how MS Windows
+networking functions. easily overcome.
+</para>
+
+<sect2>
+<title>Can Not Add Machine Back to Domain</title>
+
+<para>
+<emphasis>Problem:</emphasis> A Windows workstation was reinstalled. The original domain machine
+account was deleted and added immediately. The workstation will not join the domain if I use 
+the same machine name. Attempts to add the machine fail with a message that the machine already
+exists on the network - I know it doen't. Why is this failing?
+</para>
+
+<para>
+The original name is still in the NetBIOS name cache and must expire after machine account
+deletion BEFORE adding that same name as a domain member again. The best advice is to delete
+the old account and then to add the machine with a new name.
+</para>
+
+</sect2>
+
+<sect2>
+<title>Adding Machine to Domain Fails</title>
+
+<para>
+Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a
+message that, "The machine could not be added at this time, there is a network problem.
+Please try again later." Why?
+</para>
+
+<para>
+You should check that there is an <emphasis>add machine script</emphasis> in your &smb.conf;
+file. If there is not, please add one that is appropriate for your OS platform. If a script
+has been defined you will need to debug it's operation. Increase the <emphasis>log level</emphasis>
+in the &smb.conf; file to level 10, then try to rejoin the domain. Check the logs to see which
+operation is failing.
+</para>
+
+<para>
+Possible causes include:
+</para>
+
+<itemizedlist>
+	<listitem><para>
+	The script does not actually exist, or could not be located in the path specified.
+	</para>
+
+	<para>
+	<emphasis>Corrective Action:</emphasis> Fix it. Make sure that when run manually
+	that the script will add both the Unix system account _and_ the Samba SAM account.
+	</para></listitem>
+
+	<listitem><para>
+	The machine could not be added to the Unix system accounts file <filename>/etc/passwd</filename>
+	</para>
+
+	<para>
+	<emphasis>Corrective Action:</emphasis> Check that the machine name is a legal Unix
+	system account name. ie: If the Unix utility <command>useradd</command> is called
+	then make sure that the machine name you are trying to add can be added using this
+	tool. <command>Useradd</command> on some systems will not allow any upper case characters
+	nor will it allow spaces in the name.
+	</para></listitem>
+</itemizedlist>
+
+</sect2>
 
 </sect1>
 </chapter>