Filling in some more blanks.

(This used to be commit 157a5525d371b6c90d9d634eaf3d98fed648569a)

2 files changed, 309 insertions, 92 deletions

diff --git a/docs/docbook/projdoc/PolicyMgmt.sgml b/docs/docbook/projdoc/PolicyMgmt.sgml
index 9dee288b1f..867f5740e7 100644
--- a/docs/docbook/projdoc/PolicyMgmt.sgml
+++ b/docs/docbook/projdoc/PolicyMgmt.sgml
@@ -248,40 +248,68 @@ use this powerful tool. Please refer to the resource kit manuals for specific us
 <title>Managing Account/User Policies</title>
 
 <para>
-Document what are user policies (ie: Account Policies) here.
+Policies can define a specific user's settings or the settings for a group of users. The resulting
+policy file contains the registry settings for all users, groups, and computers that will be using
+the policy file. Separate policy files for each user, group, or computer are not not necessary.
 </para>
 
-<sect2>
-<title>With Windows NT4/200x</title>
+<para>
+If you create a policy that will be automatically downloaded from validating domain controllers,
+you should name the file NTconfig.POL. As system administrator, you have the option of renaming the
+policy file and, by modifying the Windows NT-based workstation, directing the computer to update
+the policy from a manual path. You can do this by either manually changing the registry or by using
+the System Policy Editor. This path can even be a local path such that each machine has its own policy file,
+but if a change is necessary to all machines, this change must be made individually to each workstation.
+</para>
 
 <para>
-Brief overview of the tools and how to use them.
+When a Windows NT4/200x/XP machine logs onto the network the NETLOGON share on the authenticating domain 
+controller for the presence of the NTConfig.POL file. If one exists it is downloaded, parsed and then
+applied to the user's part of the registry.
 </para>
 
-<sect3>
-<title>Windows NT4 Tools</title>
+<para>
+MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally,
+acquire policy settings through Group Policy Objects (GPOs) that are defined and stored in Active Directory
+itself. The key benefit of using AS GPOs is that they impose no registry <emphasis>tatooing</emphasis> effect.
+This has considerable advanage compared with the use of NTConfig.POL (NT4) style policy updates.
+</para>
 
 <para>
-Blah, blah, blah ...
+Inaddition to user access controls that may be imposed or applied via system and/or group policies
+in a manner that works in conjunction with user profiles, the user management environment under
+MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied.
+Common restrictions that are frequently used includes:
 </para>
 
-</sect3>
+<para>
+<simplelist>
+	<member>Logon Hours</member>
+	<member>Password Aging</member>
+	<member>Permitted Logon from certain machines only</member>
+	<member>Account type (Local or Global)</member>
+	<member>User Rights</member>
+</simplelist>
+</para>
 
-<sect3>
-<title>Windows 200x Tools</title>
+<sect2>
+<title>With Windows NT4/200x</title>
 
 <para>
-Blah, blah, blah ...
+The tools that may be used to configure these types of controls from the MS Windows environment are:
+The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe).
+Under MS Windows 200x/XP this is done using the Microsoft Managment Console (MMC) with approapriate
+"snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor.
 </para>
-
-</sect3>
 </sect2>
 
 <sect2>
 <title>With a Samba PDC</title>
 
 <para>
-Document the HOWTO here.
+With a Samba Domain Controller, the new tools for managing of user account and policy information includes:
+<filename>smbpasswd, pdbedit, smbgroupedit, net, rpcclient.</filename>. The administrator should read the
+man pages for these tools and become familiar with their use.
 </para>
 
 </sect1>
diff --git a/docs/docbook/projdoc/ProfileMgmt.sgml b/docs/docbook/projdoc/ProfileMgmt.sgml
index 8eded5e9fb..d894093c63 100644
--- a/docs/docbook/projdoc/ProfileMgmt.sgml
+++ b/docs/docbook/projdoc/ProfileMgmt.sgml
@@ -151,16 +151,16 @@ and deny them write access to this file.
 </para>
 
 <orderedlist>
-<listitem>
+	<listitem>
         <para>
         On the Windows 9x / Me machine, go to Control Panel -> Passwords and
         select the User Profiles tab.  Select the required level of
         roaming preferences.  Press OK, but do _not_ allow the computer
         to reboot.
         </para>
-</listitem>
+	</listitem>
 
-<listitem>
+	<listitem>
         <para>
         On the Windows 9x / Me machine, go to Control Panel -> Network ->
         Client for Microsoft Networks -> Preferences.  Select 'Log on to
@@ -168,8 +168,7 @@ and deny them write access to this file.
         Microsoft Networks'.  Press OK, and this time allow the computer
         to reboot.
         </para>
-</listitem>
-
+	</listitem>
 </orderedlist>
 
 <para>
@@ -228,13 +227,14 @@ they will be told that they are logging in "for the first time".
 </para>
 
 <orderedlist>
-<listitem>
+	<listitem>
         <para>
         instead of logging in under the [user, password, domain] dialog,
         press escape.
         </para>
-</listitem>
-<listitem>
+	</listitem>
+
+	<listitem>
         <para>
         run the regedit.exe program, and look in:
         </para>
@@ -251,7 +251,7 @@ they will be told that they are logging in "for the first time".
         [Exit the registry editor].
 
         </para>
-</listitem>
+	</listitem>
 
 	<listitem>
         <para>
@@ -362,52 +362,52 @@ profile on the MS Windows workstation as follows:
 </para>
 
 <itemizedlist>
-<listitem><para>
-Log on as the LOCAL workstation administrator.
-</para></listitem>
-
-<listitem><para>
-Right click on the 'My Computer' Icon, select 'Properties'
-</para></listitem>
-
-<listitem><para>
-Click on the 'User Profiles' tab
-</para></listitem>
-
-<listitem><para>
-Select the profile you wish to convert (click on it once)
-</para></listitem>
-
-<listitem><para>
-Click on the button 'Copy To'
-</para></listitem>
-
-<listitem><para>
-In the "Permitted to use" box, click on the 'Change' button.
-</para></listitem>
-
-<listitem><para>
-Click on the 'Look in" area that lists the machine name, when you click
-here it will open up a selection box. Click on the domain to which the
-profile must be accessible.
-</para>
+	<listitem><para>
+	Log on as the LOCAL workstation administrator.
+	</para></listitem>
+
+	<listitem><para>
+	Right click on the 'My Computer' Icon, select 'Properties'
+	</para></listitem>
+
+	<listitem><para>
+	Click on the 'User Profiles' tab
+	</para></listitem>
+
+	<listitem><para>
+	Select the profile you wish to convert (click on it once)
+	</para></listitem>
+
+	<listitem><para>
+	Click on the button 'Copy To'
+	</para></listitem>
+
+	<listitem><para>
+	In the "Permitted to use" box, click on the 'Change' button.
+	</para></listitem>
+
+	<listitem><para>
+	Click on the 'Look in" area that lists the machine name, when you click
+	here it will open up a selection box. Click on the domain to which the
+	profile must be accessible.
+	</para>
 
-<note><para>You will need to log on if a logon box opens up. Eg: In the connect
-as: MIDEARTH\root, password: mypassword.</para></note>
-</listitem>
+	<note><para>You will need to log on if a logon box opens up. Eg: In the connect
+	as: MIDEARTH\root, password: mypassword.</para></note>
+	</listitem>
 
-<listitem><para>
-To make the profile capable of being used by anyone select 'Everyone'
-</para></listitem>
+	<listitem><para>
+	To make the profile capable of being used by anyone select 'Everyone'
+	</para></listitem>
 
-<listitem><para>
-Click OK. The Selection box will close.
-</para></listitem>
+	<listitem><para>
+	Click OK. The Selection box will close.
+	</para></listitem>
 
-<listitem><para>
-Now click on the 'Ok' button to create the profile in the path you
-nominated.
-</para></listitem>
+	<listitem><para>
+	Now click on the 'Ok' button to create the profile in the path you
+	nominated.
+	</para></listitem>
 </itemizedlist>
 
 <para>
@@ -450,29 +450,29 @@ same way as a domain group policy):
 On the XP workstation log in with an Administrator account.
 </para></listitem>
 
-<listitem><para>Click: "Start", "Run"</para></listitem>
-<listitem><para>Type: "mmc"</para></listitem>
-<listitem><para>Click: "OK"</para></listitem>
-
-<listitem><para>A Microsoft Management Console should appear.</para></listitem>
-<listitem><para>Click: File, "Add/Remove Snap-in...", "Add"</para></listitem>
-<listitem><para>Double-Click: "Group Policy"</para></listitem>
-<listitem><para>Click: "Finish", "Close"</para></listitem>
-<listitem><para>Click: "OK"</para></listitem>
-
-<listitem><para>In the "Console Root" window:</para></listitem>
-<listitem><para>Expand: "Local Computer Policy", "Computer Configuration",</para></listitem>
-<listitem><para>"Administrative Templates", "System", "User Profiles"</para></listitem>
-<listitem><para>Double-Click: "Do not check for user ownership of Roaming Profile</para></listitem>
-<listitem><para>Folders"</para></listitem>
-<listitem><para>Select: "Enabled"</para></listitem>
-<listitem><para>Click: OK"</para></listitem>
-
-<listitem><para>Close the whole console.  You do not need to save the settings (this
-refers to the console settings rather than the policies you have
-changed).</para></listitem>
-
-<listitem><para>Reboot</para></listitem>
+	<listitem><para>Click: "Start", "Run"</para></listitem>
+	<listitem><para>Type: "mmc"</para></listitem>
+	<listitem><para>Click: "OK"</para></listitem>
+
+	<listitem><para>A Microsoft Management Console should appear.</para></listitem>
+	<listitem><para>Click: File, "Add/Remove Snap-in...", "Add"</para></listitem>
+	<listitem><para>Double-Click: "Group Policy"</para></listitem>
+	<listitem><para>Click: "Finish", "Close"</para></listitem>
+	<listitem><para>Click: "OK"</para></listitem>
+
+	<listitem><para>In the "Console Root" window:</para></listitem>
+	<listitem><para>Expand: "Local Computer Policy", "Computer Configuration",</para></listitem>
+	<listitem><para>"Administrative Templates", "System", "User Profiles"</para></listitem>
+	<listitem><para>Double-Click: "Do not check for user ownership of Roaming Profile</para></listitem>
+	<listitem><para>Folders"</para></listitem>
+	<listitem><para>Select: "Enabled"</para></listitem>
+	<listitem><para>Click: OK"</para></listitem>
+
+	<listitem><para>Close the whole console.  You do not need to save the settings (this
+	refers to the console settings rather than the policies you have
+	changed).</para></listitem>
+
+	<listitem><para>Reboot</para></listitem>
 </itemizedlist>
 </note>
 </sect3>
@@ -706,14 +706,186 @@ To modify the registry directly, launch the Registry Editor (regedit.exe), selec
 "User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0.
 </para>
 
+<para>
+<title>How User Profiles Are Handled in Windows 9x / Me?</title>
+
+When a user logs on to a Windows 9x / Me machine, the local profile path, 
+<filename>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList</filename>, is checked
+for an existing entry for that user:
+</para>
+
+<para>
+If the user has an entry in this registry location, Windows 9x / Me checks for a locally cached
+version of the user profile. Windows 9x / Me also checks the user's home directory (or other
+specified directory if the location has been modified) on the server for the User Profile.
+If a profile exists in both locations, the newer of the two is used. If the User Profile exists
+on the server, but does not exist on the local machine, the profile on the server is downloaded
+and used. If the User Profile only exists on the local machine, that copy is used.
+</para>
+
+<para>
+If a User Profile is not found in either location, the Default User Profile from the Windows 9x / Me
+machine is used and is copied to a newly created folder for the logged on user. At log off, any
+changes that the user made are written to the user's local profile. If the user has a roaming
+profile, the changes are written to the user's profile on the server.
+</para>
+
 </sect2>
 
 <sect2>
 <title>MS Windows NT4 Workstation</title>
 
 <para>
-Document NT4 default profile handling stuff here! Someone - please contribute appropriate
-material here. Email your contribution to jht@samba.org.
+On MS Windows NT4 the default user profile is obtained from the location
+<filename>%SystemRoot%\Profiles</filename> which in a default installation will translate to
+<filename>C:\WinNT\Profiles</filename>. Under this directory on a clean install there will be
+three (3) directories: <filename>Administrator, All Users, Default User</filename>.
+</para>
+
+<para>
+The <filename>All Users</filename> directory contains menu settings that are common across all 
+system users. The <filename>Default User</filename> directory contains menu entries that are
+customisable per user depending on the profile settings chosen/created.
+</para>
+
+<para>
+When a new user first logs onto an MS Windows NT4 machine a new profile is created from:
+</para>
+
+<simplelist>
+	<member>All Users settings</member>
+	<member>Default User settings (contains the default NTUser.DAT file)</member>
+</simplelist>
+
+<para>
+When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain
+the following steps are followed in respect of profile handling:
+</para>
+
+<orderedlist>
+	<listitem>
+	<para>
+	The users' account information which is obtained during the logon process contains
+	the location of the users' desktop profile. The profile path may be local to the
+	machine or it may be located on a network share. If there exists a profile at the location
+	of the path from the user account, then this profile is copied to the location
+	<filename>%SystemRoot%\Profiles\%USERNAME%</filename>. This profile then inherits the
+	settings in the <filename>All Users</filename> profile in the <filename>%SystemRoot%\Profiles</filename>
+	location.
+	</para>
+	</listitem>
+
+	<listitem>
+	<para>
+	If the user account has a profile path, but at it's location a profile does not exist,
+	then a new profile is created in the <filename>%SystemRoot%\Profiles\%USERNAME%</filename>
+	directory from reading the <filename>Default User</filename> profile.
+	</para>
+	</listitem>
+
+	<listitem>
+	<para>
+	If the NETLOGON share on the authenticating server (logon server) contains a policy file
+	(<filename>NTConfig.POL</filename>) then it's contents are applied to the <filename>NTUser.DAT</filename>
+	which is applied to the <filename>HKEY_CURRENT_USER</filename> part of the registry. 
+	</para>
+	</listitem>
+
+	<listitem>
+	<para>
+	When the user logs out, if the profile is set to be a roaming profile it will be written
+	out to the location of the profile. The <filename>NTuser.DAT</filename> file is then
+	re-created from the contents of the <filename>HKEY_CURRENT_USER</filename> contents.
+	Thus, should there not exist in the NETLOGON share an <filename>NTConfig.POL</filename> at the
+	next logon, the effect of the provious <filename>NTConfig.POL</filename> will still be held
+	in the profile. The effect of this is known as <emphasis>tatooing</emphasis>.
+	</para>
+	</listitem>
+</orderedlist>
+
+<para>
+MS Windows NT4 profiles may be <emphasis>Local</emphasis> or <emphasis>Roaming</emphasis>. A Local profile
+will stored in the <filename>%SystemRoot%\Profiles\%USERNAME%</filename> location. A roaming profile will
+also remain stored in the same way, unless the following registry key is created:
+</para>
+
+<para>
+<programlisting>
+	HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\
+	"DeleteRoamingCache"=dword:00000001
+</programlisting>
+
+In which case, the local copy (in <filename>%SystemRoot%\Profiles\%USERNAME%</filename>) will be
+deleted on logout.
+</para>
+
+<para>
+Under MS Windows NT4 default locations for common resources (like <filename>My Documents</filename>
+may be redirected to a network share by modifying the following registry keys. These changes may be affected
+via use of the System Policy Editor (to do so may require that you create your owns template extension
+for the policy editor to allow this to be done through the GUI. Another way to do this is by way of first
+creating a default user profile, then while logged in as that user, run regedt32 to edit the key settings.
+</para>
+
+<para>
+The Registry Hive key that affects the behaviour of folders that are part of the default user profile
+are controlled by entries on Windows NT4 is:
+</para>
+
+<para>
+<programlisting>
+        HKEY_CURRENT_USER
+                \Software
+                        \Microsoft
+                                \Windows
+                                        \CurrentVersion
+                                                \Explorer
+                                                        \User Shell Folders\
+</programlisting>
+</para>
+
+<para>
+The above hive key contains a list of automatically managed folders. The default entries are:
+</para>
+
+        <para>
+        <programlisting>
+        Name            Default Value
+        --------------  -----------------------------------------
+        AppData         %USERPROFILE%\Application Data
+        Desktop         %USERPROFILE%\Desktop
+        Favorites       %USERPROFILE%\Favorites
+        NetHood         %USERPROFILE%\NetHood
+        PrintHood       %USERPROFILE%\PrintHood
+        Programs        %USERPROFILE%\Start Menu\Programs
+        Recent          %USERPROFILE%\Recent
+        SendTo          %USERPROFILE%\SendTo
+        Start Menu      %USERPROFILE%\Start Menu
+        Startup         %USERPROFILE%\Start Menu\Programs\Startup
+        </programlisting>
+        </para>
+
+<para>
+The registry key that contains the location of the default profile settings is:
+
+<programlisting>
+	HKEY_LOCAL_MACHINE
+		\SOFTWARE
+			\Microsoft
+				\Windows
+					\CurrentVersion
+						\Explorer
+							\User Shell Folders
+</programlisting>
+
+The default entries are:
+
+<programlisting>
+	Common Desktop		%SystemRoot%\Profiles\All Users\Desktop
+	Common Programs		%SystemRoot%\Profiles\All Users\Programs
+	Common Start Menu	%SystemRoot%\Profiles\All Users\Start Menu
+	Common Startu	p	%SystemRoot%\Profiles\All Users\Start Menu\Progams\Startup
+</programlisting>
 </para>
 
 </sect2>
@@ -804,7 +976,7 @@ are controlled by entries on Windows 200x/XP is:
 	HKEY_CURRENT_USER
 		\Software
 			\Microsoft
-				\Windows NT
+				\Windows
 					\CurrentVersion
 						\Explorer
 							\User Shell Folders\
@@ -852,15 +1024,19 @@ write Outlook PST file over the network for every login and logout.
 </para>
 
 <para>
-To set this to a network location you could use the followin examples:
+To set this to a network location you could use the following examples:
 
+<programlisting>
 	%LOGONSERVER%\%USERNAME%\Default Folders
+</programlisting>
 
 This would store the folders in the user's home directory under a directory called "Default Folders"
 
 You could also use:
 
+<programlisting>
 	\\SambaServer\FolderShare\%USERNAME%
+</programlisting>
 
 in which case the default folders will be stored in the server named <emphasis>SambaServer</emphasis>
 in the share called <emphasis>FolderShare</emphasis> under a directory that has the name of the MS Windows
@@ -872,6 +1048,19 @@ Please note that once you have created a default profile share, you MUST migrate
 (default or custom) to it.
 </para>
 
+<para>
+MS Windows 200x/XP profiles may be <emphasis>Local</emphasis> or <emphasis>Roaming</emphasis>.
+A roaming profile will be cached locally unless the following registry key is created:
+</para>
+
+<para>
+<programlisting>
+	HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\
+	"DeleteRoamingCache"=dword:00000001
+</programlisting>
+
+In which case, the local cache copy will be deleted on logout.
+</para>
 </sect2
 </sect1>