summaryrefslogtreecommitdiff
path: root/docs/htmldocs/PolicyMgmt.html
diff options
context:
space:
mode:
authorGerald Carter <jerry@samba.org>2003-09-09 02:58:53 +0000
committerGerald Carter <jerry@samba.org>2003-09-09 02:58:53 +0000
commit99bde6889d3d8b7a9e950c86c30e82662e1dacdd (patch)
treebb7d34722e3b2b98ae7e36c11f4e7e4d4538b6fb /docs/htmldocs/PolicyMgmt.html
parenta50367ee119d0acf1bcaaf93f8c6fcc8fa68c999 (diff)
downloadsamba-99bde6889d3d8b7a9e950c86c30e82662e1dacdd.tar.gz
samba-99bde6889d3d8b7a9e950c86c30e82662e1dacdd.tar.bz2
samba-99bde6889d3d8b7a9e950c86c30e82662e1dacdd.zip
syncing files from 3.0 into HEAD again
(This used to be commit bca0bba209255d0effbae6a3d3b6d298f0952c3a)
Diffstat (limited to 'docs/htmldocs/PolicyMgmt.html')
-rw-r--r--docs/htmldocs/PolicyMgmt.html59
1 files changed, 33 insertions, 26 deletions
diff --git a/docs/htmldocs/PolicyMgmt.html b/docs/htmldocs/PolicyMgmt.html
index 775cd6cc16..754ca9b686 100644
--- a/docs/htmldocs/PolicyMgmt.html
+++ b/docs/htmldocs/PolicyMgmt.html
@@ -1,10 +1,10 @@
-<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 23. System and Account Policies</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.60.1"><link rel="home" href="index.html" title="SAMBA Project Documentation"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="previous" href="AdvancedNetworkManagement.html" title="Chapter 22. Advanced Network Management"><link rel="next" href="ProfileMgmt.html" title="Chapter 24. Desktop Profile Management"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 23. System and Account Policies</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="AdvancedNetworkManagement.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="ProfileMgmt.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="PolicyMgmt"></a>Chapter 23. System and Account Policies</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email">&lt;<a href="mailto:jht@samba.org">jht@samba.org</a>&gt;</tt></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="PolicyMgmt.html#id2984380">Features and Benefits</a></dt><dt><a href="PolicyMgmt.html#id2984435">Creating and Managing System Policies</a></dt><dd><dl><dt><a href="PolicyMgmt.html#id2986217">Windows 9x/Me Policies</a></dt><dt><a href="PolicyMgmt.html#id2986312">Windows NT4 Style Policy Files</a></dt><dt><a href="PolicyMgmt.html#id2986445">MS Windows 200x / XP Professional Policies</a></dt></dl></dd><dt><a href="PolicyMgmt.html#id2986697">Managing Account/User Policies</a></dt><dd><dl><dt><a href="PolicyMgmt.html#id2986798">Samba Editreg Toolset</a></dt><dt><a href="PolicyMgmt.html#id2986819">Windows NT4/200x</a></dt><dt><a href="PolicyMgmt.html#id2986839">Samba PDC</a></dt></dl></dd><dt><a href="PolicyMgmt.html#id2986883">System Startup and Logon Processing Overview</a></dt><dt><a href="PolicyMgmt.html#id2987030">Common Errors</a></dt><dd><dl><dt><a href="PolicyMgmt.html#id2987044">Policy Does Not Work</a></dt></dl></dd></dl></div><p>
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 23. System and Account Policies</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.60.1"><link rel="home" href="samba-doc.html" title="SAMBA Project Documentation"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="previous" href="AdvancedNetworkManagement.html" title="Chapter 22. Advanced Network Management"><link rel="next" href="ProfileMgmt.html" title="Chapter 24. Desktop Profile Management"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 23. System and Account Policies</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="AdvancedNetworkManagement.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="ProfileMgmt.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="PolicyMgmt"></a>Chapter 23. System and Account Policies</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email">&lt;<a href="mailto:jht@samba.org">jht@samba.org</a>&gt;</tt></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="PolicyMgmt.html#id2944479">Features and Benefits</a></dt><dt><a href="PolicyMgmt.html#id2944538">Creating and Managing System Policies</a></dt><dd><dl><dt><a href="PolicyMgmt.html#id2944652">Windows 9x/Me Policies</a></dt><dt><a href="PolicyMgmt.html#id2944748">Windows NT4 Style Policy Files</a></dt><dt><a href="PolicyMgmt.html#id2944880">MS Windows 200x / XP Professional Policies</a></dt></dl></dd><dt><a href="PolicyMgmt.html#id2945132">Managing Account/User Policies</a></dt><dd><dl><dt><a href="PolicyMgmt.html#id2945238">Samba Editreg Toolset</a></dt><dt><a href="PolicyMgmt.html#id2945277">Windows NT4/200x</a></dt><dt><a href="PolicyMgmt.html#id2945301">Samba PDC</a></dt></dl></dd><dt><a href="PolicyMgmt.html#id2945346">System Startup and Logon Processing Overview</a></dt><dt><a href="PolicyMgmt.html#id2945496">Common Errors</a></dt><dd><dl><dt><a href="PolicyMgmt.html#id2945511">Policy Does Not Work</a></dt></dl></dd></dl></div><p>
This chapter summarises the current state of knowledge derived from personal
practice and knowledge from samba mailing list subscribers. Before reproduction
of posted information effort has been made to validate the information provided.
Where additional information was uncovered through this validation it is provided
also.
-</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2984380"></a>Features and Benefits</h2></div></div><div></div></div><p>
+</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2944479"></a>Features and Benefits</h2></div></div><div></div></div><p>
When MS Windows NT3.5 was introduced the hot new topic was the ability to implement
Group Policies for users and group. Then along came MS Windows NT4 and a few sites
started to adopt this capability. How do we know that? By way of the number of &quot;booboos&quot;
@@ -23,9 +23,9 @@ the deployment in many sites. This chapter reviews techniques and methods that c
be used to exploit opportunities for automation of control over user desktops and
network client workstations.
</p><p>
-A tool new to Samba-3 may become an important part of the future Samba Administrators'
+A tool new to Samba may become an important part of the future Samba Administrators'
arsenal. The <b class="command">editreg</b> tool is described in this document.
-</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2984435"></a>Creating and Managing System Policies</h2></div></div><div></div></div><p>
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2944538"></a>Creating and Managing System Policies</h2></div></div><div></div></div><p>
Under MS Windows platforms, particularly those following the release of MS Windows
NT4 and MS Windows 95) it is possible to create a type of file that would be placed
in the NETLOGON share of a domain controller. As the client logs onto the network
@@ -54,13 +54,13 @@ be a step forward, but improved functionality comes at a great price.
Before embarking on the configuration of network and system policies it is highly
advisable to read the documentation available from Microsoft's web site regarding
<a href="http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp" target="_top">
-Implementing Profiles and Policies in Windows NT 4.0 from http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp</a> available from Microsoft.
+Implementing Profiles and Policies in Windows NT 4.0</a> available from Microsoft.
There are a large number of documents in addition to this old one that should also
be read and understood. Try searching on the Microsoft web site for &quot;Group Policies&quot;.
</p><p>
What follows is a very brief discussion with some helpful notes. The information provided
here is incomplete - you are warned.
-</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2986217"></a>Windows 9x/Me Policies</h3></div></div><div></div></div><p>
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2944652"></a>Windows 9x/Me Policies</h3></div></div><div></div></div><p>
You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me.
It can be found on the Original full product Win98 installation CD under
<tt class="filename">tools/reskit/netadmin/poledit</tt>. Install this using the
@@ -86,7 +86,7 @@ here is incomplete - you are warned.
<tt class="filename">grouppol.inf</tt>. Log off and on again a couple of times and see
if Win98 picks up group policies. Unfortunately this needs to be done on every
Win9x/Me machine that uses group policies.
- </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2986312"></a>Windows NT4 Style Policy Files</h3></div></div><div></div></div><p>
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2944748"></a>Windows NT4 Style Policy Files</h3></div></div><div></div></div><p>
To create or edit <tt class="filename">ntconfig.pol</tt> you must use the NT Server
Policy Editor, <b class="command">poledit.exe</b> which is included with NT4 Server
but <span class="emphasis"><em>not NT Workstation</em></span>. There is a Policy Editor on a NT4
@@ -107,14 +107,14 @@ here is incomplete - you are warned.
be extracted as well. It is also possible to downloaded the policy template
files for Office97 and get a copy of the policy editor. Another possible
location is with the Zero Administration Kit available for download from Microsoft.
- </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2986421"></a>Registry Spoiling</h4></div></div><div></div></div><p>
+ </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2944857"></a>Registry Spoiling</h4></div></div><div></div></div><p>
With NT4 style registry based policy changes, a large number of settings are not
automatically reversed as the user logs off. Since the settings that were in the
NTConfig.POL file were applied to the client machine registry and that apply to the
hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known
as tattooing. It can have serious consequences down-stream and the administrator must
be extremely careful not to lock out the ability to manage the machine at a later date.
- </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2986445"></a>MS Windows 200x / XP Professional Policies</h3></div></div><div></div></div><p>
+ </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2944880"></a>MS Windows 200x / XP Professional Policies</h3></div></div><div></div></div><p>
Windows NT4 System policies allows setting of registry parameters specific to
users, groups and computers (client workstations) that are members of the NT4
style domain. Such policy file will work with MS Windows 2000 / XP clients also.
@@ -151,7 +151,7 @@ here is incomplete - you are warned.
to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows
the administrator to also set filters over the policy settings. No such equivalent capability
exists with NT4 style policy files.
- </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2986546"></a>Administration of Win2K / XP Policies</h4></div></div><div></div></div><p>
+ </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2944981"></a>Administration of Win2K / XP Policies</h4></div></div><div></div></div><p>
Instead of using the tool called <span class="application">The System Policy Editor</span>, commonly called Poledit (from the
executable name <b class="command">poledit.exe</b>), <span class="acronym">GPOs</span> are created and managed using a
<span class="application">Microsoft Management Console</span> <span class="acronym">(MMC)</span> snap-in as follows:</p><div class="procedure"><ol type="1"><li><p>
@@ -177,10 +177,10 @@ here is incomplete - you are warned.
The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used
to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you
use this powerful tool. Please refer to the resource kit manuals for specific usage information.
- </p></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2986697"></a>Managing Account/User Policies</h2></div></div><div></div></div><p>
+ </p></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2945132"></a>Managing Account/User Policies</h2></div></div><div></div></div><p>
Policies can define a specific user's settings or the settings for a group of users. The resulting
policy file contains the registry settings for all users, groups, and computers that will be using
-the policy file. Separate policy files for each user, group, or computer are not not necessary.
+the policy file. Separate policy files for each user, group, or computer are not necessary.
</p><p>
If you create a policy that will be automatically downloaded from validating domain controllers,
you should name the file NTconfig.POL. As system administrator, you have the option of renaming the
@@ -203,20 +203,27 @@ in a manner that works in conjunction with user profiles, the user management en
MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied.
Common restrictions that are frequently used includes:
</p><p>
-</p><table class="simplelist" border="0" summary="Simple list"><tr><td>Logon Hours</td></tr><tr><td>Password Aging</td></tr><tr><td>Permitted Logon from certain machines only</td></tr><tr><td>Account type (Local or Global)</td></tr><tr><td>User Rights</td></tr></table><p>
-</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2986798"></a>Samba Editreg Toolset</h3></div></div><div></div></div><p>
- Describe in detail the benefits of <b class="command">editreg</b> and how to use it.
- </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2986819"></a>Windows NT4/200x</h3></div></div><div></div></div><p>
+</p><div class="itemizedlist"><ul type="disc"><li><p>Logon Hours</p></li><li><p>Password Aging</p></li><li><p>Permitted Logon from certain machines only</p></li><li><p>Account type (Local or Global)</p></li><li><p>User Rights</p></li></ul></div><p>
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2945238"></a>Samba Editreg Toolset</h3></div></div><div></div></div><p>
+ A new tool called <b class="command">editreg</b> is under development. This tool can be used
+ to edit registry files (called NTUser.DAT) that are stored in user and group profiles.
+ NTConfig.POL files have the same structure as the NTUser.DAT file and can be editted using
+ this tool. <b class="command">editreg</b> is being built with the intent to enable NTConfig.POL
+ files to be saved in text format and to permit the building of new NTConfig.POL files with
+ extended capabilities. It is proving difficult to realise this capability, so do not be surprised
+ if this feature does not materialise. Formal capabilities will be announced at the time that
+ this tool is released for production use.
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2945277"></a>Windows NT4/200x</h3></div></div><div></div></div><p>
The tools that may be used to configure these types of controls from the MS Windows environment are:
The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe).
Under MS Windows 200x/XP this is done using the Microsoft Management Console (MMC) with appropriate
&quot;snap-ins&quot;, the registry editor, and potentially also the NT4 System and Group Policy Editor.
- </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2986839"></a>Samba PDC</h3></div></div><div></div></div><p>
+ </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2945301"></a>Samba PDC</h3></div></div><div></div></div><p>
With a Samba Domain Controller, the new tools for managing of user account and policy information includes:
<b class="command">smbpasswd</b>, <b class="command">pdbedit</b>, <b class="command">net</b>, <b class="command">rpcclient</b>.
The administrator should read the
man pages for these tools and become familiar with their use.
- </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2986883"></a>System Startup and Logon Processing Overview</h2></div></div><div></div></div><p>
+ </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2945346"></a>System Startup and Logon Processing Overview</h2></div></div><div></div></div><p>
The following attempts to document the order of processing of system and user policies following a system
reboot and as part of the user logon:
</p><div class="orderedlist"><ol type="1"><li><p>
@@ -225,7 +232,7 @@ reboot and as part of the user logon:
</p></li><li><p>
Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded
and applied. The list may include GPOs that:
-</p><table class="simplelist" border="0" summary="Simple list"><tr><td>Apply to the location of machines in a Directory</td></tr><tr><td>Apply only when settings have changed</td></tr><tr><td>Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.</td></tr></table><p>
+</p><div class="itemizedlist"><ul type="disc"><li><p>Apply to the location of machines in a Directory</p></li><li><p>Apply only when settings have changed</p></li><li><p>Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.</p></li></ul></div><p>
No desktop user interface is presented until the above have been processed.
</p></li><li><p>
Execution of start-up scripts (hidden and synchronous by default).
@@ -236,7 +243,7 @@ reboot and as part of the user logon:
</p></li><li><p>
An ordered list of User GPOs is obtained. The list contents depends on what is configured in respect of:
-</p><table class="simplelist" border="0" summary="Simple list"><tr><td>Is user a domain member, thus subject to particular policies</td></tr><tr><td>Loopback enablement, and the state of the loopback policy (Merge or Replace)</td></tr><tr><td>Location of the Active Directory itself</td></tr><tr><td>Has the list of GPOs changed. No processing is needed if not changed.</td></tr></table><p>
+</p><div class="itemizedlist"><ul type="disc"><li><p>Is user a domain member, thus subject to particular policies</p></li><li><p>Loopback enablement, and the state of the loopback policy (Merge or Replace)</p></li><li><p>Location of the Active Directory itself</p></li><li><p>Has the list of GPOs changed. No processing is needed if not changed.</p></li></ul></div><p>
</p></li><li><p>
User Policies are applied from Active Directory. Note: There are several types.
</p></li><li><p>
@@ -246,15 +253,15 @@ reboot and as part of the user logon:
</p></li><li><p>
The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like and NT4
Domain) machine (system) policies are applied at start-up, User policies are applied at logon.
- </p></li></ol></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2987030"></a>Common Errors</h2></div></div><div></div></div><p>
+ </p></li></ol></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2945496"></a>Common Errors</h2></div></div><div></div></div><p>
Policy related problems can be very difficult to diagnose and even more difficult to rectify. The following
collection demonstrates only basic issues.
-</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2987044"></a>Policy Does Not Work</h3></div></div><div></div></div><p>
-Question: We have created the <tt class="filename">config.pol</tt> file and put it in the <span class="emphasis"><em>NETLOGON</em></span> share.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2945511"></a>Policy Does Not Work</h3></div></div><div></div></div><p>
+ &#8220;<span class="quote">We have created the <tt class="filename">config.pol</tt> file and put it in the <span class="emphasis"><em>NETLOGON</em></span> share.
It has made no difference to our Win XP Pro machines, they just don't see it. IT worked fine with Win 98 but does not
-work any longer since we upgraded to Win XP Pro. Any hints?
+work any longer since we upgraded to Win XP Pro. Any hints?</span>&#8221;
</p><p>
-<span class="emphasis"><em>ANSWER:</em></span> Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based
+Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based
platforms. You need to use the NT4 Group Policy Editor to create a file called <tt class="filename">NTConfig.POL</tt> so that
it is in the correct format for your MS Windows XP Pro clients.
-</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="AdvancedNetworkManagement.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="ProfileMgmt.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 22. Advanced Network Management </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 24. Desktop Profile Management</td></tr></table></div></body></html>
+</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="AdvancedNetworkManagement.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="ProfileMgmt.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 22. Advanced Network Management </td><td width="20%" align="center"><a accesskey="h" href="samba-doc.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 24. Desktop Profile Management</td></tr></table></div></body></html>