This commit was manufactured by cvs2svn to create branch 'SAMBA_3_0'.(This used to be commit 500f2d0e5e71057fbad510c5fe2807c506b21565)

5 files changed, 1253 insertions, 0 deletions

diff --git a/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml
new file mode 100644
index 0000000000..fe0774810b
--- /dev/null
+++ b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml
@@ -0,0 +1,178 @@
+<chapter id="AdvancedNetworkManagement">
+<chapterinfo>
+        <author>
+                <firstname>John H</firstname><surname>Terpstra</surname>
+                <affiliation>
+                        <orgname>Samba Team</orgname>
+                        <address>
+                        <email>jht@samba.org</email>
+                        </address>
+                </affiliation>
+        </author>
+        <pubdate>April 3 2003</pubdate>
+</chapterinfo>
+
+<title>Advanced Network Manangement</title>
+
+<para>
+This section attempts to document peripheral issues that are of great importance to network
+administrators who want to improve network resource access control, to automate the user
+environment, and to make their lives a little easier.
+</para>
+
+<sect1>
+<title>Configuring Samba Share Access Controls</title>
+
+<para>
+This section deals with how to configure Samba per share access control restrictions.
+By default samba sets no restrictions on the share itself. Restrictions on the share itself
+can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can
+connect to a share. In the absence of specific restrictions the default setting is to allow
+the global user <emphasis>Everyone</emphasis> Full Control (ie: Full control, Change and Read).
+</para>
+
+<para>
+At this time Samba does NOT provide a tool for configuring access control setting on the Share
+itself. Samba does have the capacity to store and act on access control settings, but  the only
+way to create those settings is to use either the NT4 Server Manager or the Windows 200x MMC for
+Computer Management.
+</para>
+
+<para>
+Samba stores the per share access control settings in a file called <filename>share_info.tdb</filename>.
+The location of this file on your system will depend on how samba was compiled. The default location
+for samba's tdb files is under <filename>/usr/local/samba/var</filename>. If the <filename>tdbdump</filename>
+utility has been compiled and installed on your system then you can examine the contents of this file
+by: <filename>tdbdump share_info.tdb</filename>.
+</para>
+
+<sect2>
+<title>Share Permissions Management</title>
+
+<para>
+The best tool for the task is platform dependant. Choose the best tool for your environmemt.
+</para>
+
+<sect3>
+<title>Windows NT4 Workstation/Server</title>
+<para>
+The tool you need to use to manage share permissions on a Samba server is the NT Server Manager.
+Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation.
+You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below.
+</para>
+
+<para>
+Instructions:
+</para>
+
+	<para>
+	Launch the NT4 Server Manager, click on the Samba server you want to administer, then from the menu
+	select Computer, then click on the Shared Directories entry.
+	</para>
+
+	<para>
+	Now click on the share that you wish to manage, then click on the Properties tab, next click on
+	the Permissions tab. Now you can Add or change access control settings as you wish.
+	</para>
+
+</sect3>
+
+<sect3>
+<title>Windows 200x/XP</title>
+
+<para>
+On MS Windows NT4/200x/XP system access control lists on the share itself are set using native
+tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder,
+then select 'Sharing', then click on 'Permissions'. The default Windows NT4/200x permission allows
+<emphasis>Everyone</emphasis> Full Control on the Share.
+</para>
+
+<para>
+MS Windows 200x and later all comes with a tool called the 'Computer Management' snap-in for the
+Microsoft Management Console (MMC). This tool is located by clicking on <filename>Control Panel ->
+Administrative Tools -> Computer Management</filename>.
+</para>
+
+<para>
+Instructions:
+</para>
+	<para>
+	After launching the MMC with the Computer Management snap-in, click on the menu item 'Action',
+	select 'Connect to another computer'. If you are not logged onto a domain you will be prompted
+	to enter a domain login user identifier and a password. This will authenticate you to the domain.
+	If you where already logged in with administrative privilidge this step is not offered.
+	</para>
+
+	<para>
+	If the Samba server is not shown in the Select Computer box, then type in the name of the target
+	Samba server in the field 'Name:'. Now click on the [+] next to 'System Tools', then on the [+]
+	next to 'Shared Folders' in the left panel.
+	</para>
+
+	<para>
+	Now in the right panel, double-click on the share you wish to set access control permissions on.
+	Then click on the tab 'Share Permissions'. It is now possible to add access control entities
+	to the shared folder. Do NOT forget to set what type of access (full control, change, read) you
+	wish to assign for each entry.
+	</para>
+
+	<note>
+	<para>
+	Be careful. If you take away all permissions from the Everyone user without removing this user
+	then effectively no user will be able to access the share. This is a result of what is known as
+	ACL precidence. ie: Everyone with NO ACCESS means that MaryK who is part of the group Everyone
+	will have no access even if this user is given explicit full control access.
+	</para>
+	</note>
+
+</sect3>
+</sect2>
+</sect1>
+
+<sect1>
+<title>Remote Server Administration</title>
+
+<para>
+<emphasis>How do I get 'User Manager' and 'Server Manager'?</emphasis>
+</para>
+
+<para>
+Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains',
+the 'Server Manager'?
+</para>
+
+<para>
+Microsoft distributes a version of these tools called nexus for installation on Windows 9x / Me
+systems.  The tools set includes:
+</para>
+
+<itemizedlist>
+	<listitem><para>Server Manager</para></listitem> 
+	
+	<listitem><para>User Manager for Domains</para></listitem> 
+
+	<listitem><para>Event Viewer</para></listitem> 
+</itemizedlist>
+
+<para>
+Click here to download the archived file <ulink 
+url="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</ulink>
+</para>
+
+<para>
+The Windows NT 4.0 version of the 'User Manager for 
+Domains' and 'Server Manager' are available from Microsoft via ftp 
+from <ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</ulink>
+</para>
+
+</sect1>
+<sect1>
+<title>Network Logon Script Magic</title>
+
+<para>
+This section needs work. Volunteer contributions most welcome. Please send your patches or updates
+to jht@samba.org.
+</para>
+
+</chapter>
+
diff --git a/docs/docbook/projdoc/NT4Migration.sgml b/docs/docbook/projdoc/NT4Migration.sgml
new file mode 100644
index 0000000000..1a4499038d
--- /dev/null
+++ b/docs/docbook/projdoc/NT4Migration.sgml
@@ -0,0 +1,47 @@
+<chapter id="NT4Migration">
+<chapterinfo>
+	<author>
+		<firstname>John H</firstname><surname>Terpstra</surname>
+	</author>
+	<pubdate>April 3, 2003</pubdate>
+</chapterinfo>
+
+<title>Migration from NT4 PDC to Samba-3 PDC</title>
+
+<para>
+This is a rough guide to assist those wishing to migrate from NT4 domain control to
+Samba-3 based domain control.
+</para>
+
+<sect1>
+<title>Planning and Getting Started</title>
+
+<para>You must use at least the following ...</para>
+
+<sect2>
+<title>Objectives</title>
+
+<para>
+Blah blah objectives here.
+</para>
+
+</sect2>
+<sect2>
+<title>Steps In Migration Process</title>
+
+<para>
+Document steps right here!
+</para>
+
+</sect2>
+</sect1>
+
+<sect1>
+<title>Managing Samba-3 Domain Control</title>
+
+<para>
+Lots of blah blah here.
+</para>
+
+</sect1>
+</chapter>
diff --git a/docs/docbook/projdoc/PolicyMgmt.sgml b/docs/docbook/projdoc/PolicyMgmt.sgml
new file mode 100644
index 0000000000..1dc4dd435d
--- /dev/null
+++ b/docs/docbook/projdoc/PolicyMgmt.sgml
@@ -0,0 +1,304 @@
+<chapter id="PolicyMgmt">
+<chapterinfo>
+        <author>
+                <firstname>John H</firstname><surname>Terpstra</surname>
+                <affiliation>
+                        <orgname>Samba Team</orgname>
+                        <address>
+                        <email>jht@samba.org</email>
+                        </address>
+                </affiliation>
+        </author>
+        <pubdate>April 3 2003</pubdate>
+</chapterinfo>
+<title>System and Account Policies</title>
+
+<sect1>
+<title>Creating and Managing System Policies</title>
+
+<para>
+Under MS Windows platforms, particularly those following the release of MS Windows
+NT4 and MS Windows 95) it is possible to create a type of file that would be placed
+in the NETLOGON share of a domain controller. As the client logs onto the network
+this file is read and the contents initiate changes to the registry of the client
+machine. This file allows changes to be made to those parts of the registry that
+affect users, groups of users, or machines.
+</para>
+
+<para>
+For MS Windows 9x/Me this file must be called <filename>Config.POL</filename> and may
+be generated using a tool called <filename>poledit.exe</filename>, better known as the
+Policy Editor. The policy editor was provided on the Windows 98 installation CD, but
+dissappeared again with the introduction of MS Windows Me (Millenium Edition). From
+comments from MS Windows network administrators it would appear that this tool became
+a part of the MS Windows Me Resource Kit.
+</para>
+
+<para>
+MS Windows NT4 Server products include the <emphasis>System Policy Editor</emphasis>
+under the <filename>Start -> Programs -> Administrative Tools</filename> menu item.
+For MS Windows NT4 and later clients this file must be called <filename>NTConfig.POL</filename>.
+</para>
+
+<para>
+New with the introduction of MS Windows 2000 was the Microsoft Management Console
+or MMC.  This tool is the new wave in the ever changing landscape of Microsoft
+methods for management of network access and security. Every new Microsoft product
+or technology seems to obsolete the old rules and to introduce newer and more
+complex tools and methods. To Microsoft's credit though, the MMC does appear to
+be a step forward, but improved functionality comes at a great price.
+</para>
+
+<para>
+Before embarking on the configuration of network and system policies it is highly
+advisable to read the documentation available from Microsoft's web site regarding
+<ulink url="http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp">
+Implementing Profiles and Policies in Windows NT 4.0 from http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp</ulink> available from Microsoft.
+There are a large number of documents in addition to this old one that should also
+be read and understood. Try searching on the Microsoft web site for "Group Policies".
+</para>
+
+<para>
+What follows is a very discussion with some helpful notes. The information provided
+here is incomplete - you are warned.
+</para>
+
+<sect2>
+<title>Windows 9x/Me Policies</title>
+
+<para>
+You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me.
+It can be found on the Original full product Win98 installation CD under
+<filename>tools/reskit/netadmin/poledit</filename>.  Install this using the
+Add/Remove Programs facility and then click on the 'Have Disk' tab.
+</para>
+
+<para>
+Use the Group Policy Editor to create a policy file that specifies the location of
+user profiles and/or the <filename>My Documents</filename> etc.  stuff. Then
+save these settings in a file called <filename>Config.POL</filename> that needs to
+be placed in the root of the [NETLOGON] share. If Win98 is configured to log onto
+the Samba Domain, it will automatically read this file and update the Win9x/Me registry
+of the machine as it logs on.
+</para>
+
+<para>
+Further details are covered in the Win98 Resource Kit documentation.
+</para>
+
+<para>
+If you do not take the right steps, then every so often Win9x/Me will check the
+integrity of the registry and will restore it's settings from the back-up
+copy of the registry it stores on each Win9x/Me machine. Hence, you will
+occasionally notice things changing back to the original settings.
+</para>
+
+<para>
+Install the group policy handler for Win9x to pick up group policies. Look on the
+Win98 CD in <filename>\tools\reskit\netadmin\poledit</filename>.
+Install group policies on a Win9x client by double-clicking
+<filename>grouppol.inf</filename>. Log off and on again a couple of times and see
+if Win98 picks up group policies.  Unfortunately this needs to be done on every
+Win9x/Me machine that uses group policies.
+</para>
+
+</sect2>
+<sect2>
+<title>Windows NT4 Style Policy Files</title>
+
+<para>
+To create or edit <filename>ntconfig.pol</filename> you must use the NT Server
+Policy Editor, <command>poledit.exe</command> which is included with NT4 Server
+but <emphasis>not NT Workstation</emphasis>. There is a Policy Editor on a NT4
+Workstation but it is not suitable for creating <emphasis>Domain Policies</emphasis>.
+Further, although the Windows 95 Policy Editor can be installed on an NT4
+Workstation/Server, it will not work with NT clients. However, the files from
+the NT Server will run happily enough on an NT4 Workstation.
+</para>
+
+<para>
+You need <filename>poledit.exe, common.adm</filename> and <filename>winnt.adm</filename>.
+It is convenient to put the two *.adm files in  the <filename>c:\winnt\inf</filename> 
+directory which is where the binary will look for them unless told otherwise. Note also that that
+directory is normally 'hidden'.
+</para>
+
+<para>
+The Windows NT policy editor is also included with the Service Pack 3 (and
+later) for Windows NT 4.0. Extract the files using <command>servicepackname /x</command>,
+i.e. that's <command>Nt4sp6ai.exe /x</command> for service pack 6a.  The policy editor,
+<command>poledit.exe</command> and the associated template files (*.adm) should
+be extracted as well.  It is also possible to downloaded the policy template
+files for Office97 and get a copy of the policy editor.  Another possible
+location is with the Zero Administration Kit available for download from Microsoft.
+</para>
+
+<sect3>
+<title>Registry Tattoos</title>
+
+	<para>
+	With NT4 style registry based policy changes, a large number of settings are not
+	automatically reversed as the user logs off. Since the settings that were in the
+	NTConfig.POL file were applied to the client machine registry and that apply to the
+	hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known
+	as tattooing. It can have serious consequences down-stream and the administrator must
+	be extremely careful not to lock out the ability to manage the machine at a later date.
+	</para>
+
+
+</sect3>
+</sect2>
+<sect2>
+<title>MS Windows 200x / XP Professional Policies</title>
+
+<para>
+Windows NT4 System policies allows setting of registry parameters specific to
+users, groups and computers (client workstations) that are members of the NT4
+style domain. Such policy file will work with MS Windows 2000 / XP clients also.
+</para>
+
+<para>
+New to MS Windows 2000 Microsoft introduced a new style of group policy that confers
+a superset of capabilities compared with NT4 style policies. Obviously, the tool used
+to create them is different, and the mechanism for implementing them is much changed.
+</para>
+
+<para>
+The older NT4 style registry based policies are known as <emphasis>Administrative Templates</emphasis>
+in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security
+configurations, enforce Internet Explorer browser settings, change and redirect aspects of the
+users' desktop (including: the location of <emphasis>My Documents</emphasis> files (directory), as
+well as intrinsics of where menu items will appear in the Start menu). An additional new
+feature is the ability to make available particular software Windows applications to particular
+users and/or groups.
+</para>
+
+<para>
+Remember: NT4 policy files are named <filename>NTConfig.POL</filename> and are stored in the root
+of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password
+and selects the domain name to which the logon will attempt to take place. During the logon
+process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating
+server, modifies the local registry values according to the settings in this file.
+</para>
+
+<para>
+Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of
+a Windows 200x policy file is stored in the Active Directory itself and the other part is stored
+in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active
+Directory domain controllers. The part that is stored in the Active Directory itself is called the
+group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is
+known as the group policy template (GPT).
+</para>
+
+<para>
+With NT4 clients the policy file is read and executed upon only aas each user log onto the network.
+MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine
+startup (machine specific part) and when the user logs onto the network the user specific part
+is applied. In MS Windows 200x style policy management each machine and/or user may be subject
+to any number of concurently applicable (and applied) policy sets (GPOs). Active Directory allows
+the administrator to also set filters over the policy settings. No such equivalent capability
+exists with NT4 style policy files.
+</para>
+
+<sect3>
+<title>Administration of Win2K / XP Policies</title>
+
+<para>
+Instead of using the tool called "The System Policy Editor", commonly called Poledit (from the
+executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console
+(MMC) snap-in as follows:
+</para>
+
+<itemizedlist>
+	<listitem>
+	<para>
+	Go to the Windows 200x / XP menu <filename>Start->Programs->Administrative Tools</filename>
+	and select the MMC snap-in called "Active Directory Users and Computers"
+	<para>
+	</listitem>
+
+	<listitem>
+	<para>
+	Select the domain or organizational unit (OU) that you wish to manage, then right click
+	to open the context menu for that object, select the properties item.
+	</para>
+	</listitem>
+
+	<listitem>
+	<para>
+	Now left click on the Group Policy tab, then left click on the New tab. Type a name
+	for the new policy you will create.
+	</para>
+	</listitem>
+
+	<listitem>
+	<para>
+	Now left click on the Edit tab to commence the steps needed to create the GPO.
+	</para>
+	</listitem>
+</itemizedlist>
+
+<para>
+All policy configuration options are controlled through the use of policy administrative
+templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP.
+Beware however, since the .adm files are NOT interchangible across NT4 and Windows 200x.
+The later introduces many new features as well as extended definition capabilities. It is
+well beyond the scope of this documentation to explain how to program .adm files, for that
+the adminsitrator is referred to the Microsoft Windows Resource Kit for your particular
+version of MS Windows.
+</para>
+
+<note>
+<para>
+The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used
+to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you
+use this powerful tool. Please refer to the resource kit manuals for specific usage information.
+</para>
+</note>
+
+</sect2>
+</sect1>
+
+<sect1>
+<title>Managing Account/User Policies</title>
+
+<para>
+Document what are user policies (ie: Account Policies) here.
+</para>
+
+<sect2>
+<title>With Windows NT4/200x</title>
+
+<para>
+Brief overview of the tools and how to use them.
+</para>
+
+<sect3>
+<title>Windows NT4 Tools</title>
+
+<para>
+Blah, blah, blah ...
+</para>
+
+</sect3>
+
+<sect3>
+<title>Windows 200x Tools</title>
+
+<para>
+Blah, blah, blah ...
+</para>
+
+</sect3>
+</sect2>
+
+<sect2>
+<title>With a Samba PDC</title>
+
+<para>
+Document the HOWTO here.
+</para>
+
+</sect1>
+
+</chapter>
diff --git a/docs/docbook/projdoc/ProfileMgmt.sgml b/docs/docbook/projdoc/ProfileMgmt.sgml
new file mode 100644
index 0000000000..72eac8635a
--- /dev/null
+++ b/docs/docbook/projdoc/ProfileMgmt.sgml
@@ -0,0 +1,644 @@
+<chapter id="ProfileMgmt">
+<chapterinfo>
+        <author>
+                <firstname>John H</firstname><surname>Terpstra</surname>
+                <affiliation>
+                        <orgname>Samba Team</orgname>
+                        <address>
+                        <email>jht@samba.org</email>
+                        </address>
+                </affiliation>
+        </author>
+        <pubdate>April 3 2003</pubdate>
+</chapterinfo>
+
+<title>Desktop Profile Management</title>
+
+<sect1>
+<title>Roaming Profiles</title>
+
+<warning>
+<para>
+<emphasis>NOTE!</emphasis> Roaming profiles support is different for Win9x / Me
+and Windows NT4/200x.
+</para>
+</warning>
+
+<para>
+Before discussing how to configure roaming profiles, it is useful to see how
+Windows 9x / Me and Windows NT4/200x clients implement these features.
+</para>
+
+<para>
+Windows 9x / Me clients send a NetUserGetInfo request to the server to get the user's
+profiles location. However, the response does not have room for a separate
+profiles location field, only the user's home share. This means that Win9X/Me
+profiles are restricted to being stored in the user's home directory.
+</para>
+
+
+<para>
+Windows NT4/200x  clients send a NetSAMLogon RPC request, which contains many fields,
+including a separate field for the location of the user's profiles.
+</para>
+
+<sect2>
+<title>Samba Configuration for Profile Handling</title>
+
+<para>
+This section documents how to configure Samba for MS Windows client profile support.
+</para>
+
+<sect3>
+<title>NT4/200x User Profiles</title>
+
+<para>
+To support Windowns NT4/200x clients, in the [global] section of smb.conf set the
+following (for example):
+</para>
+
+<para>
+<programlisting>
+	logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath
+
+	This is typically implemented like:
+
+		logon path = \\%L\Profiles\%u
+
+	where:
+		%L translates to the name of the Samba server
+		%u translates to the user name
+</programlisting>
+</para>
+
+<para>
+The default for this option is \\%N\%U\profile, namely \\sambaserver\username\profile. 
+The \\N%\%U service is created automatically by the [homes] service.  If you are using
+a samba server for the profiles, you _must_ make the share specified in the logon path
+browseable. Please refer to the man page for smb.conf in respect of the different
+symantics of %L and %N, as well as %U and %u.
+</para>
+
+<note>
+<para>
+MS Windows NT/2K clients at times do not disconnect a connection to a server
+between logons. It is recommended to NOT use the <emphasis>homes</emphasis>
+meta-service name as part of the profile share path.
+</para>
+</note>
+</sect3>
+
+<sect3>
+<title>Windows 9x / Me User Profiles</title>
+
+<para>
+To support Windows 9x / Me clients, you must use the "logon home" parameter. Samba has
+now been fixed so that "net use /home" now works as well, and it, too, relies
+on the "logon home" parameter.
+</para>
+
+<para>
+By using the logon home parameter, you are restricted to putting Win9x / Me
+profiles in the user's home directory.   But wait! There is a trick you
+can use. If you set the following in the [global] section of your smb.conf file:
+</para>
+<para><programlisting>
+	logon home = \\%L\%U\.profiles
+</programlisting></para>
+
+<para>
+then your Windows 9x / Me clients will dutifully put their clients in a subdirectory
+of your home directory called .profiles (thus making them hidden).
+</para>
+
+<para>
+Not only that, but 'net use/home' will also work, because of a feature in
+Windows 9x / Me. It removes any directory stuff off the end of the home directory area
+and only uses the server and share portion. That is, it looks like you
+specified \\%L\%U for "logon home".
+</para>
+</sect3>
+
+<sect3>
+<title>Mixed Windows 9x / Me and Windows NT4/200x User Profiles</title>
+
+<para>
+You can support profiles for both Win9X and WinNT clients by setting both the
+"logon home" and "logon path" parameters. For example:
+</para>
+
+<para><programlisting>
+	logon home = \\%L\%u\.profiles
+	logon path = \\%L\profiles\%u
+</programlisting></para>
+
+</sect3>
+</sect2>
+
+<sect2>
+<title>Windows Client Profile Configuration Information</title>
+
+<sect3>
+<title>Windows 9x / Me Profile Setup</title>
+
+<para>
+When a user first logs in on Windows 9X, the file user.DAT is created,
+as are folders "Start Menu", "Desktop", "Programs" and "Nethood".
+These directories and their contents will be merged with the local
+versions stored in c:\windows\profiles\username on subsequent logins,
+taking the most recent from each.  You will need to use the [global]
+options "preserve case = yes", "short preserve case = yes" and
+"case sensitive = no" in order to maintain capital letters in shortcuts
+in any of the profile folders.
+</para>
+
+<para>
+The user.DAT file contains all the user's preferences.  If you wish to
+enforce a set of preferences, rename their user.DAT file to user.MAN,
+and deny them write access to this file.
+</para>
+
+<orderedlist>
+<listitem>
+        <para>
+        On the Windows 9x / Me machine, go to Control Panel -> Passwords and
+        select the User Profiles tab.  Select the required level of
+        roaming preferences.  Press OK, but do _not_ allow the computer
+        to reboot.
+        </para>
+</listitem>
+
+<listitem>
+        <para>
+        On the Windows 9x / Me machine, go to Control Panel -> Network ->
+        Client for Microsoft Networks -> Preferences.  Select 'Log on to
+        NT Domain'.  Then, ensure that the Primary Logon is 'Client for
+        Microsoft Networks'.  Press OK, and this time allow the computer
+        to reboot.
+        </para>
+</listitem>
+
+</orderedlist>
+
+<para>
+Under Windows 9x / Me Profiles are downloaded from the Primary Logon.
+If you have the Primary Logon as 'Client for Novell Networks', then
+the profiles and logon script will be downloaded from your Novell
+Server.  If you have the Primary Logon as 'Windows Logon', then the
+profiles will be loaded from the local machine - a bit against the
+concept of roaming profiles, it would seem!
+</para>
+
+<para>
+You will now find that the Microsoft Networks Login box contains
+[user, password, domain] instead of just [user, password].  Type in
+the samba server's domain name (or any other domain known to exist,
+but bear in mind that the user will be authenticated against this
+domain and profiles downloaded from it, if that domain logon server
+supports it), user name and user's password.
+</para>
+
+<para>
+Once the user has been successfully validated, the Windows 9x / Me machine
+will inform you that 'The user has not logged on before' and asks you
+if you wish to save the user's preferences?  Select 'yes'.
+</para>
+
+<para>
+Once the Windows 9x / Me client comes up with the desktop, you should be able
+to examine the contents of the directory specified in the "logon path"
+on the samba server and verify that the "Desktop", "Start Menu",
+"Programs" and "Nethood" folders have been created.
+</para>
+
+<para>
+These folders will be cached locally on the client, and updated when
+the user logs off (if you haven't made them read-only by then).
+You will find that if the user creates further folders or short-cuts,
+that the client will merge the profile contents downloaded with the
+contents of the profile directory already on the local client, taking
+the newest folders and short-cuts from each set.
+</para>
+
+<para>
+If you have made the folders / files read-only on the samba server,
+then you will get errors from the Windows 9x / Me machine on logon and logout, as
+it attempts to merge the local and the remote profile.  Basically, if
+you have any errors reported by the Windows 9x / Me machine, check the Unix file
+permissions and ownership rights on the profile directory contents,
+on the samba server.
+</para>
+
+<para>
+If you have problems creating user profiles, you can reset the user's
+local desktop cache, as shown below.  When this user then next logs in,
+they will be told that they are logging in "for the first time".
+</para>
+
+<orderedlist>
+<listitem>
+        <para>
+        instead of logging in under the [user, password, domain] dialog,
+        press escape.
+        </para>
+</listitem>
+<listitem>
+        <para>
+        run the regedit.exe program, and look in:
+        </para>
+
+        <para>
+        HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList
+        </para>
+
+        <para>
+        you will find an entry, for each user, of ProfilePath.  Note the
+        contents of this key (likely to be c:\windows\profiles\username),
+        then delete the key ProfilePath for the required user.
+
+        [Exit the registry editor].
+
+        </para>
+</listitem>
+
+	<listitem>
+        <para>
+        <emphasis>WARNING</emphasis> - before deleting the contents of the
+        directory listed in the ProfilePath (this is likely to be
+	<filename>c:\windows\profiles\username)</filename>, ask them if they
+	have any important files stored on their desktop or in their start menu. 
+	Delete the contents of the directory ProfilePath (making a backup if any
+	of the files are needed).
+        </para>
+
+        <para>
+	This will have the effect of removing the local (read-only hidden
+	system file) user.DAT in their profile directory, as well as the
+	local "desktop", "nethood", "start menu" and "programs" folders.
+        </para>
+	</listitem>
+
+	<listitem>
+        <para>
+        search for the user's .PWL password-caching file in the c:\windows
+        directory, and delete it.
+        </para>
+	</listitem>
+
+	<listitem>
+        <para>
+        log off the windows 9x / Me client.
+        </para>
+	</listitem>
+
+	<listitem>
+        <para>
+        check the contents of the profile path (see "logon path" described
+        above), and delete the user.DAT or user.MAN file for the user,
+        making a backup if required.
+        </para>
+	</listitem>
+
+</orderedlist>
+
+<para>
+If all else fails, increase samba's debug log levels to between 3 and 10,
+and / or run a packet trace program such as ethereal or netmon.exe, and
+look for error messages.
+</para>
+
+<para>
+If you have access to an Windows NT4/200x server, then first set up roaming profiles
+and / or netlogons on the Windows NT4/200x server.  Make a packet trace, or examine
+the example packet traces provided with Windows NT4/200x server, and see what the
+differences are with the equivalent samba trace.
+</para>
+
+</sect3>
+
+<sect3>
+<title>Windows NT4 Workstation</title>
+
+<para>
+When a user first logs in to a Windows NT Workstation, the profile
+NTuser.DAT is created.  The profile location can be now specified
+through the "logon path" parameter.
+</para>
+
+<para>
+There is a parameter that is now available for use with NT Profiles:
+"logon drive".  This should be set to <filename>H:</filename> or any other drive, and
+should be used in conjunction with the new "logon home" parameter.
+</para>
+
+<para>
+The entry for the NT4 profile is a _directory_ not a file.  The NT
+help on profiles mentions that a directory is also created with a .PDS
+extension.  The user, while logging in, must have write permission to
+create the full profile path (and the folder with the .PDS extension
+for those situations where it might be created.)
+</para>
+
+<para>
+In the profile directory, Windows NT4 creates more folders than Windows 9x / Me. 
+It creates "Application Data" and others, as well as "Desktop", "Nethood",
+"Start Menu" and "Programs".  The profile itself is stored in a file
+NTuser.DAT.  Nothing appears to be stored in the .PDS directory, and
+its purpose is currently unknown.
+</para>
+
+<para>
+You can use the System Control Panel to copy a local profile onto
+a samba server (see NT Help on profiles: it is also capable of firing
+up the correct location in the System Control Panel for you).  The
+NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN
+turns a profile into a mandatory one.
+</para>
+
+<para>
+The case of the profile is significant.  The file must be called
+NTuser.DAT or, for a mandatory profile, NTuser.MAN.
+</para>
+</sect3>
+
+<sect3>
+<title>Windows 2000/XP Professional</title>
+
+<para>
+You must first convert the profile from a local profile to a domain
+profile on the MS Windows workstation as follows:
+</para>
+
+<itemizedlist>
+<listitem><para>
+Log on as the LOCAL workstation administrator.
+</para></listitem>
+
+<listitem><para>
+Right click on the 'My Computer' Icon, select 'Properties'
+</para></listitem>
+
+<listitem><para>
+Click on the 'User Profiles' tab
+</para></listitem>
+
+<listitem><para>
+Select the profile you wish to convert (click on it once)
+</para></listitem>
+
+<listitem><para>
+Click on the button 'Copy To'
+</para></listitem>
+
+<listitem><para>
+In the "Permitted to use" box, click on the 'Change' button.
+</para></listitem>
+
+<listitem><para>
+Click on the 'Look in" area that lists the machine name, when you click
+here it will open up a selection box. Click on the domain to which the
+profile must be accessible.
+</para>
+
+<note><para>You will need to log on if a logon box opens up. Eg: In the connect
+as: MIDEARTH\root, password: mypassword.</para></note>
+</listitem>
+
+<listitem><para>
+To make the profile capable of being used by anyone select 'Everyone'
+</para></listitem>
+
+<listitem><para>
+Click OK. The Selection box will close.
+</para></listitem>
+
+<listitem><para>
+Now click on the 'Ok' button to create the profile in the path you
+nominated.
+</para></listitem>
+</itemizedlist>
+
+<para>
+Done. You now have a profile that can be editted using the samba-3.0.0
+profiles tool.
+</para>
+
+<note>
+<para>
+Under NT/2K the use of mandotory profiles forces the use of MS Exchange
+storage of mail data. That keeps desktop profiles usable.
+</para>
+</note>
+
+<note>
+<itemizedlist>
+<listitem><para>
+This is a security check new to Windows XP (or maybe only
+Windows XP service pack 1).  It can be disabled via a group policy in
+Active Directory.  The policy is:</para>
+
+<para>"Computer Configuration\Administrative Templates\System\User
+Profiles\Do not check for user ownership of Roaming Profile Folders"</para>
+
+<para>...and it should be set to "Enabled".
+Does the new version of samba have an Active Directory analogue?  If so,
+then you may be able to set the policy through this.
+</para>
+
+<para>
+If you cannot set group policies in samba, then you may be able to set
+the policy locally on each machine.  If you want to try this, then do
+the following (N.B. I don't know for sure that this will work in the
+same way as a domain group policy):
+</para>
+
+</listitem>
+
+<listitem><para>
+On the XP workstation log in with an Administrator account.
+</para></listitem>
+
+<listitem><para>Click: "Start", "Run"</para></listitem>
+<listitem><para>Type: "mmc"</para></listitem>
+<listitem><para>Click: "OK"</para></listitem>
+
+<listitem><para>A Microsoft Management Console should appear.</para></listitem>
+<listitem><para>Click: File, "Add/Remove Snap-in...", "Add"</para></listitem>
+<listitem><para>Double-Click: "Group Policy"</para></listitem>
+<listitem><para>Click: "Finish", "Close"</para></listitem>
+<listitem><para>Click: "OK"</para></listitem>
+
+<listitem><para>In the "Console Root" window:</para></listitem>
+<listitem><para>Expand: "Local Computer Policy", "Computer Configuration",</para></listitem>
+<listitem><para>"Administrative Templates", "System", "User Profiles"</para></listitem>
+<listitem><para>Double-Click: "Do not check for user ownership of Roaming Profile</para></listitem>
+<listitem><para>Folders"</para></listitem>
+<listitem><para>Select: "Enabled"</para></listitem>
+<listitem><para>Click: OK"</para></listitem>
+
+<listitem><para>Close the whole console.  You do not need to save the settings (this
+refers to the console settings rather than the policies you have
+changed).</para></listitem>
+
+<listitem><para>Reboot</para></listitem>
+</itemizedlist>
+</note>
+</sect3>
+</sect2>
+
+<sect2>
+<title>Sharing Profiles between W9x/Me and NT4/200x/XP workstations</title>
+
+<para>
+Sharing of desktop profiles between Windows versions is NOT recommended.
+Desktop profiles are an evolving phenomenon and profiles for later versions
+of MS Windows clients add features that may interfere with earlier versions
+of MS Windows clients. Probably the more salient reason to NOT mix profiles
+is that when logging off an earlier version of MS Windows the older format
+of profile contents may overwrite information that belongs to the newer
+version resulting in loss of profile information content when that user logs
+on again with the newer version of MS Windows.
+</para>
+
+<para>
+If you then want to share the same Start Menu / Desktop with W9x/Me, you will
+need to specify a common location for the profiles. The smb.conf parameters
+that need to be common are <emphasis>logon path</emphasis> and
+<emphasis>logon home</emphasis>.
+</para>
+
+<para>
+If you have this set up correctly, you will find separate user.DAT and
+NTuser.DAT files in the same profile directory.
+</para>
+
+</sect2>
+
+<sect2>
+<title>Profile Migration from Windows NT4/200x Server to Samba</title>
+
+<para>
+There is nothing to stop you specifying any path that you like for the
+location of users' profiles.  Therefore, you could specify that the
+profile be stored on a samba server, or any other SMB server, as long as
+that SMB server supports encrypted passwords.
+</para>
+
+<sect3>
+<title>Windows NT4 Profile Management Tools</title>
+
+<para>
+Unfortunately, the Resource Kit information is specific to the version of MS Windows
+NT4/200x. The correct resource kit is required for each platform.
+</para>
+
+<para>
+Here is a quick guide:
+</para>
+
+<itemizedlist>
+
+<listitem><para>
+On your NT4 Domain Controller, right click on 'My Computer', then
+select the tab labelled 'User Profiles'.
+</para></listitem>
+
+<listitem><para>
+Select a user profile you want to migrate and click on it.
+</para>
+
+<note><para>I am using the term &quot;migrate&quot; lossely. You can copy a profile to
+create a group profile. You can give the user 'Everyone' rights to the
+profile you copy this to. That is what you need to do, since your samba
+domain is not a member of a trust relationship with your NT4 PDC.</para></note>
+</listitem>
+
+	<listitem><para>Click the 'Copy To' button.</para></listitem>
+
+	<listitem><para>In the box labelled 'Copy Profile to' add your new path, eg:
+	<filename>c:\temp\foobar</filename></para></listitem>
+
+	<listitem><para>Click on the button labelled 'Change' in the "Permitted to use" box.</para></listitem>
+
+	<listitem><para>Click on the group 'Everyone' and then click OK. This closes the
+	'chose user' box.</para></listitem>
+
+	<listitem><para>Now click OK.</para></listitem>
+</itemizedlist>
+
+<para>
+Follow the above for every profile you need to migrate.
+</para>
+
+<sect3>
+<title>Side bar Notes</title>
+
+<para>
+You should obtain the SID of your NT4 domain. You can use smbpasswd to do
+this. Read the man page.</para>
+
+<para>
+With Samba-3.0.0 alpha code you can import all you NT4 domain accounts
+using the net samsync method. This way you can retain your profile
+settings as well as all your users.
+</para>
+
+</sect3>
+
+
+<sect3>
+<title>moveuser.exe</title>
+
+<para>
+The W2K professional resource kit has moveuser.exe. moveuser.exe changes
+the security of a profile from one user to another.  This allows the account
+domain to change, and/or the user name to change.
+</para>
+
+</sect3>
+
+<sect3>
+<title>Get SID</title>
+
+<para>
+You can identify the SID by using GetSID.exe from the Windows NT Server 4.0
+Resource Kit.
+</para>
+
+<para>
+Windows NT 4.0 stores the local profile information in the registry under
+the following key:
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
+</para>
+
+<para>
+Under the ProfileList key, there will be subkeys named with the SIDs of the
+users who have logged on to this computer. (To find the profile information
+for the user whose locally cached profile you want to move, find the SID for
+the user with the GetSID.exe utility.) Inside of the appropriate user's
+subkey, you will see a string value named ProfileImagePath.
+</para>
+
+</sect3>
+</sect2>
+</sect1>
+
+<sect1>
+<title>Mandatory profiles</title>
+
+<para>
+The above method can be used to create mandatory profiles also. To convert
+a group profile into a mandatory profile simply locate the NTUser.DAT file
+in the copied profile and rename it to NTUser.MAN.
+</para>
+
+</sect1>
+
+<sect1>
+<title>Creating/Managing Group Profiles</title>
+
+<para>
+Blah goes here.
+</para>
+</sect1>
+</chapter>
diff --git a/docs/docbook/projdoc/SWAT.sgml b/docs/docbook/projdoc/SWAT.sgml
new file mode 100644
index 0000000000..9df94b9aee
--- /dev/null
+++ b/docs/docbook/projdoc/SWAT.sgml
@@ -0,0 +1,80 @@
+<chapter id="SWAT">
+<chapterinfo>
+	<author>
+		<firstname>John H</firstname><surname>Terpstra</surname>
+	</author>
+	<pubdate>April 3, 2003</pubdate>
+</chapterinfo>
+
+<title>SWAT - The Samba Web Admininistration Tool</title>
+
+<para>
+This is a rough guide to SWAT.
+</para>
+
+<sect1>
+<title>SWAT Features and Benefits</title>
+
+<para>You must use at least the following ...</para>
+
+<sect2>
+<title>The SWAT Home Page</title>
+
+<para>
+Blah blah here.
+</para>
+
+</sect2>
+<sect2>
+<title>Global Settings</title>
+
+<para>
+Document steps right here!
+</para>
+
+</sect2>
+<sect2>
+<title>The SWAT Wizard</title>
+
+<para>
+Lots of blah blah here.
+</para>
+
+</sect2>
+
+<sect2>
+<title>Share Settings</title>
+
+<para>
+Document steps right here!
+</para>
+
+</sect2>
+
+<sect2>
+<title>Printing Settings</title>
+
+<para>
+Document steps right here!
+</para>
+
+</sect2>
+<sect2>
+<title>The Status Page</title>
+
+<para>
+Document steps right here!
+</para>
+
+</sect2>
+
+<sect2>
+<title>The Password Change Page</title>
+
+<para>
+Document steps right here!
+</para>
+
+</sect2>
+</sect1>
+</chapter>