PDC docs, made from DocBook source, comments ?

(This used to be commit 551a0eebb7c2d71bdc2b340c4d6244a840ac6958)
author: David Bannon <dbannon@samba.org> 2000-11-28 06:18:04 +0000
committer: David Bannon <dbannon@samba.org> 2000-11-28 06:18:04 +0000
commit: e28ad8f1d5a4c701d021f0e4a7893920eb021b6f (patch)
tree: ace499c5fa40e6287eb151145dae593500336479 /docs/htmldocs
parent: a149c6b02534e417e324fc58e79dcca4553e2fe1 (diff)
download: samba-e28ad8f1d5a4c701d021f0e4a7893920eb021b6f.tar.gz
samba-e28ad8f1d5a4c701d021f0e4a7893920eb021b6f.tar.bz2
samba-e28ad8f1d5a4c701d021f0e4a7893920eb021b6f.zip
2 files changed, 4253 insertions, 0 deletions
diff --git a/docs/htmldocs/samba-pdc-faq.html b/docs/htmldocs/samba-pdc-faq.html
new file mode 100644
index 0000000000..08301f8a40
--- /dev/null
+++ b/docs/htmldocs/samba-pdc-faq.html
@@ -0,0 +1,2157 @@
+<HTML
+><HEAD
+><TITLE
+>The Samba 2.2 PDC FAQ</TITLE
+><META
+NAME="GENERATOR"
+CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
+><BODY
+CLASS="BOOK"
+BGCOLOR="#FFFFFF"
+TEXT="#000000"
+LINK="#0000FF"
+VLINK="#840084"
+ALINK="#0000FF"
+><DIV
+CLASS="BOOK"
+><A
+NAME="SAMBA-PDC-FAQ"
+></A
+><DIV
+CLASS="TITLEPAGE"
+><H1
+CLASS="TITLE"
+><A
+NAME="SAMBA-PDC-FAQ"
+>The Samba 2.2 PDC FAQ</A
+></H1
+><H3
+CLASS="AUTHOR"
+><A
+NAME="AEN4"
+>David Bannon</A
+></H3
+><DIV
+CLASS="AFFILIATION"
+><SPAN
+CLASS="ORGNAME"
+>La Trobe University<BR></SPAN
+></DIV
+><HR></DIV
+><HR><H1
+><A
+NAME="AEN12"
+></A
+></H1
+><P
+>Comments, corrections and additions to <TT
+CLASS="EMAIL"
+>&#60;<A
+HREF="mailto:D.Bannon@latrobe.edu.au"
+>D.Bannon@latrobe.edu.au</A
+>&#62;</TT
+></P
+><P
+>This is the FAQ for Samba 2.2 as an NTDomain controller. 
+	This document is derived from the origional FAQ that was built and 
+	maintained by Gerald Carter
+	from the early days of Samba NTDomain development up until recently. 
+	It is now being updated as significent changes are made to 2.2.0.</P
+><P
+>Please note it does not apply to Samba2.2alpha0, Samba2.2alpha1, Samba 2.0.7, TNG nor HEAD branch.
+    </P
+><P
+>I'll repeat, it does not apply to the current snapshot [ftp mirror]:/pub/samba/alpha/samba-2.2.0-alpha1.tar.gz, only to the to the current cvs.</P
+><P
+>	Also available is a Samba 2.2 PDC <A
+HREF="samba-pdc-howto.html"
+TARGET="_top"
+>HowTo</A
+> that takes you, step
+    by step, over the process of setting up a very basic Samba 2.2 Primary Domain Controller
+    </P
+><DIV
+CLASS="NOTE"
+><BLOCKQUOTE
+CLASS="NOTE"
+><P
+><B
+>Note: </B
+>Please read the Introduction for the current <A
+HREF="#AEN27"
+> state of play</A
+>.</P
+></BLOCKQUOTE
+></DIV
+><DIV
+CLASS="TOC"
+><DL
+><DT
+><B
+>Table of Contents</B
+></DT
+><DT
+>1. <A
+HREF="#AEN25"
+>Introduction</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN27"
+>State of Play</A
+></DT
+><DT
+><A
+HREF="#AEN44"
+>Introduction</A
+></DT
+></DL
+></DD
+><DT
+>2. <A
+HREF="#AEN49"
+>General Information</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN51"
+>What can we do ?</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN53"
+>What can Samba Primary Domain Controller (PDC) do ?</A
+></DT
+><DT
+><A
+HREF="#AEN86"
+>Can I have a Windows 2000 client logon to a Samba controlled domain?</A
+></DT
+><DT
+><A
+HREF="#AEN89"
+>What's the status of print spool (spoolss) support in the NTDOM code?</A
+></DT
+></DL
+></DD
+><DT
+><A
+HREF="#AEN92"
+>CVS</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN95"
+>What are the different Samba branches available in CVS ?</A
+></DT
+><DT
+><A
+HREF="#AEN118"
+>What are the CVS commands ?</A
+></DT
+></DL
+></DD
+></DL
+></DD
+><DT
+>3. <A
+HREF="#AEN149"
+>Establishing Connections</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN151"
+></A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN153"
+>How do I get my NT4 or W2000 Workstation to login to the Samba controlled Domain?</A
+></DT
+><DT
+><A
+HREF="#AEN158"
+>What is a 'machine account' ?</A
+></DT
+><DT
+><A
+HREF="#AEN165"
+>"The machine account for this computer either does not exist or is not accessable."</A
+></DT
+><DT
+><A
+HREF="#AEN171"
+>How do I create machine accounts manually ?</A
+></DT
+><DT
+><A
+HREF="#AEN184"
+>I cannot include a '$' in a machine name.</A
+></DT
+><DT
+><A
+HREF="#AEN190"
+>I get told "You already have a connection to the Domain...." when creating a
+	 machine account.</A
+></DT
+><DT
+><A
+HREF="#AEN194"
+>I get told "Cannot join domain, the credentials supplied conflict
+                with an existing set.."</A
+></DT
+><DT
+><A
+HREF="#AEN198"
+>"The system can not log you on (C000019B)...."</A
+></DT
+></DL
+></DD
+></DL
+></DD
+><DT
+>4. <A
+HREF="#AEN202"
+>User Account Management</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN204"
+>Domain Admins</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN206"
+>How do I configure an account as a domain administrator?</A
+></DT
+></DL
+></DD
+><DT
+><A
+HREF="#AEN210"
+>Profiles</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN212"
+>Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ?</A
+></DT
+><DT
+><A
+HREF="#AEN226"
+>Why are all the users listed in the "domain admin users" using the same profile?</A
+></DT
+><DT
+><A
+HREF="#AEN229"
+>The roaming profiles do not seem to be updating on the server.</A
+></DT
+></DL
+></DD
+><DT
+><A
+HREF="#AEN237"
+>Policies</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN239"
+>What are 'Policies' ?.</A
+></DT
+><DT
+><A
+HREF="#AEN246"
+>I can't get system policies to work.</A
+></DT
+><DT
+><A
+HREF="#AEN260"
+>What about Windows NT Policy Editor ?</A
+></DT
+><DT
+><A
+HREF="#AEN274"
+>Can Win95 do Policies ?</A
+></DT
+></DL
+></DD
+><DT
+><A
+HREF="#AEN280"
+>Passwords</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN282"
+>What is password sync and should I use it ?</A
+></DT
+><DT
+><A
+HREF="#AEN295"
+>How do I get remote password (unix and SMB) changing working ?</A
+></DT
+></DL
+></DD
+></DL
+></DD
+><DT
+>5. <A
+HREF="#AEN301"
+>Miscellaneous</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN303"
+></A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN305"
+>What editor can I use in DOS/Windows that won't mess with my unix EOF</A
+></DT
+><DT
+><A
+HREF="#AEN318"
+>How do I get 'User Manager' and 'Server Manager'</A
+></DT
+><DT
+><A
+HREF="#AEN333"
+>The time setting from a Samba server does not work.</A
+></DT
+><DT
+><A
+HREF="#AEN337"
+>"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A
+></DT
+><DT
+><A
+HREF="#AEN341"
+>How do I get my samba server to become a member ( not PDC ) of an NT domain?</A
+></DT
+></DL
+></DD
+></DL
+></DD
+><DT
+>6. <A
+HREF="#AEN376"
+>Troubleshooting and Bug Reporting</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN378"
+>Diagnostic tools</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN380"
+>What are some diagnostics tools I can use to debug the domain logon process and where can I
+	find them?</A
+></DT
+><DT
+><A
+HREF="#AEN394"
+>How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box?</A
+></DT
+></DL
+></DD
+><DT
+><A
+HREF="#AEN423"
+>What other help can I get ?</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN426"
+>URLs and similar</A
+></DT
+><DT
+><A
+HREF="#AEN472"
+>How do I get help from the mailing lists ?</A
+></DT
+><DT
+><A
+HREF="#AEN501"
+>How do I get off the mailing lists ?</A
+></DT
+></DL
+></DD
+></DL
+></DD
+></DL
+></DIV
+><DIV
+CLASS="CHAPTER"
+><HR><H1
+><A
+NAME="AEN25"
+>Chapter 1. Introduction</A
+></H1
+><DIV
+CLASS="SECT1"
+><H1
+CLASS="SECT1"
+><A
+NAME="AEN27"
+>State of Play</A
+></H1
+><P
+><I
+CLASS="EMPHASIS"
+>It should be noted that 2.2.0 in its pre-release form still has a few problems,
+	I'll try and keep this section current while things are still dynamic. 
+	At the time of this update (November 13, 2000) the current state of play is :</I
+></P
+><P
+>Comments here about W2K joining the domain apply only to Samba 2.2 from the CVS after November 27th. The
+    'snapshot' release Samba2.2alpha1 does not work !!! See below on how to get a CVS tree.</P
+><P
+>Client Side creation of Machine accounts does work but is not complete. 
+    Firstly, the <TT
+CLASS="FILENAME"
+>add user script</TT
+> runs as the user who's
+    name was entered, not as root. Secondly, the machine name passed to the script (%U) 
+    has an underscore at the end, not a '$'. One alternative is to use  %m and add the $.
+    This method is documented in the <A
+HREF="samba-pdc-howto.html"
+TARGET="_top"
+>HowTo</A
+>.  
+    And thirdly, it does not work with NT4ws. 
+    </P
+><P
+>A W2K machine can join the domain. See the <A
+HREF="samba-pdc-howto.html"
+TARGET="_top"
+>HowTo</A
+>
+     which explains the process. The methods
+    described are 'work arounds' and should be regarded as temporary. Although I (drb) 
+    have tested these procedures a number  of people have had difficulty so there
+    may be other issues at work. JFM is aware of these 
+    problems and will attend to them when he can.</P
+><P
+>A Domain Admin account is required and at present it appears that only root
+	is a suitable candidate.</P
+><P
+>Much of the related code does work. For example, if an NT is removed from the 
+	domain and then rejoins, the <TT
+CLASS="FILENAME"
+>Create a Computer Account in the Domain</TT
+> dialog
+	will let you reset the smbpasswd. That is you don't need to do it from
+	the unix box. However, at the present, you do need to have root as an 
+	administrator and use the root user name and password.</P
+><P
+><I
+CLASS="EMPHASIS"
+>Actually I'm 
+    not sure that last paragraph is correct ....</I
+></P
+><P
+><B
+CLASS="COMMAND"
+>Policies</B
+> do work on a W2K machine. MS says that recent builds of 
+    W2K dont observe an NT policy but it appears it does in 'legacy' mode.</P
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H1
+CLASS="SECT1"
+><A
+NAME="AEN44"
+>Introduction</A
+></H1
+><P
+>This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing with the 'old head'
+	version of Samba and its NTDomain facilities. It is being rewritten by David Bannon (drb)
+	so that it addresses more accurately the Samba 2.2 planned for release late 2000. </P
+><P
+>This document probably still contains some material that does not apply to 
+	Samba 2.2 but most (all?) of the really misleading stuff has been removed. Some 
+    issues are not dealt with or are dealt with badly. Please send corrections and additions to
+	David Bannon at D.Bannon@latrobe.edu.au</P
+><P
+>Hopefully, as we all become familiar with the Samba 2.2 as a PDC this document will
+	become much more usefull.</P
+></DIV
+></DIV
+><DIV
+CLASS="CHAPTER"
+><HR><H1
+><A
+NAME="AEN49"
+>Chapter 2. General Information</A
+></H1
+><DIV
+CLASS="SECT1"
+><H1
+CLASS="SECT1"
+><A
+NAME="AEN51"
+>What can we do ?</A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN53"
+>What can Samba Primary Domain Controller (PDC) do ?</A
+></H2
+><P
+>If you wish to have Samba act as a PDC for Windows NT 3.51.and 4.0 or W2000 client, then you 
+	will need to obtain the 2.2.0 version, currently in pre-release. Release of a stable, 
+	full featured Samba PDC is currently slated for version 3.0. </P
+><P
+>The following is a list of included  features currently in Samba 2.2:</P
+><P
+></P
+><UL
+><LI
+><P
+>The ability to act as a limited PDC for Windows NT and W2000 clients.  
+	This includes adding NT and W2K machines to the domain and authenticating users logging 
+	into the domain.</P
+></LI
+><LI
+><P
+>Domain account can be viewed using the User Manager for 
+	Domains  ????</P
+></LI
+><LI
+><P
+>Viewing resources on the Samba PDC via the Server Manager for Domains 
+	from the NT client. ??</P
+></LI
+><LI
+><P
+>Windows 95 clients will allow user level security to be set 
+	but will not currently allow browsing of accounts.</P
+></LI
+><LI
+><P
+>Machine account password updates.</P
+></LI
+><LI
+><P
+>Changing of user passwords from an NT client.</P
+></LI
+><LI
+><P
+>Partial support for Windows NT group and username mapping.</P
+></LI
+><LI
+><P
+>Support for a LDAP password database backend.</P
+></LI
+><LI
+><P
+>Printing.</P
+></LI
+></UL
+><P
+></P
+><P
+><B
+>These things are note expected to work in the forseeable future</B
+></P
+><UL
+><LI
+><P
+>Trust relationships</P
+></LI
+><LI
+><P
+>PDC and BDC integration</P
+></LI
+><LI
+><P
+>Windows NT ACLs (on the Samba shares)</P
+></LI
+><LI
+><P
+>Offer a list of domain users to User Manager for Domains 
+	(or the Security Tab etc).</P
+></LI
+></UL
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN86"
+>Can I have a Windows 2000 client logon to a Samba controlled domain?</A
+></H2
+><P
+>The 2.2 release branch of Samba  supports Windows 2000 domain 
+		clients in legacy mode, ie as if the PDC is a NTServer, not a
+        W2K server.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN89"
+>What's the status of print spool (spoolss) support in the NTDOM code?</A
+></H2
+><P
+>The implementation of support for SPOOLSS pipe is complete and it will be available
+	in the 2.2.0 release. This means that Samba will support the automatic downloading of printer
+	drivers for Windows NT clients just as it currently does for Windows 9x clients.</P
+></DIV
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H1
+CLASS="SECT1"
+><A
+NAME="AEN92"
+>CVS</A
+></H1
+><P
+>CVS is a programme (publically available) that the Samba developers use to
+    maintain the central source code. Non developers can get access to the source in
+    a read only capacity. Many flavours of unix now arrive with cvs installed.</P
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN95"
+>What are the different Samba branches available in CVS ?</A
+></H2
+><P
+>You can find out more about obtaining Samba's  via 
+	anonymous CVS from 
+	<A
+HREF="http://pserver.samba.org/samba/cvs.html"
+TARGET="_top"
+>	http://pserver.samba.org/samba/cvs.html"</A
+>. </P
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><P
+><B
+>There are basically four branches to watch at the moment :</B
+></P
+><DL
+><DT
+>HEAD</DT
+><DD
+><P
+>Samba 3.0 ? This code boasts all the main development 
+		work in Samba. Two things that most people are not aware of 
+		which live in the HEAD branch code are winbind NSS module and
+		Tim Potter's VFS implementation. Due to its developmental
+		nature, its not really suitable for production work.
+	</P
+></DD
+><DT
+>SAMBA_2_0</DT
+><DD
+><P
+>This branch contains the current stable release release. 
+		At the moment it contains 2.0.7, a version that will do some 
+		limited PDC stuff. If you are really going to do PDC things then 
+		I (drb) suggest that you consider 2.2 instead.
+	</P
+></DD
+><DT
+>SAMBA_2_2</DT
+><DD
+><P
+>The next stable release, currently in a 'alpha' form.
+		It provides the Samba developers, testers and interested 
+		people with an approximation of what is to come. This document 
+		addresses only SAMBA_2_2.
+	</P
+></DD
+><DT
+>SAMBA_TNG</DT
+><DD
+><P
+>This branch is no longer maintained from the Samba sites. 
+		Please see <A
+HREF="http://www.samba-tng.org/"
+TARGET="_top"
+>		http://www.samba-tng.org/</A
+>.  It has been requested 
+		that questions about TNG are not posted to the regular Samba mailing 
+		lists including samba-ntdom and samba-technical.
+	</P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN118"
+>What are the CVS commands ?</A
+></H2
+><P
+>See <A
+HREF="http://pserver.samba.org/samba/cvs.html"
+TARGET="_top"
+>	http://pserver.samba.org/samba/cvs.html</A
+></P
+><P
+></P
+><P
+><B
+>To get the Samba 2.2 version, tag SAMBA_2_2 you would do :</B
+></P
+><UL
+><LI
+><P
+> For example : <B
+CLASS="COMMAND"
+>cd /usr/local/src/</B
+></P
+></LI
+><LI
+><P
+> <B
+CLASS="COMMAND"
+>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot 
+			login</B
+></P
+></LI
+><LI
+><P
+> When prompted enter a password of <B
+CLASS="COMMAND"
+>cvs</B
+></P
+></LI
+><LI
+><P
+> <B
+CLASS="COMMAND"
+>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot 
+			co -r SAMBA_2_2 samba</B
+></P
+></LI
+></UL
+><P
+></P
+><P
+><B
+>Then to update that directory at some later time,</B
+></P
+><UL
+><LI
+><P
+> <B
+CLASS="COMMAND"
+>cd /usr/local/src/samba</B
+></P
+></LI
+><LI
+><P
+> <B
+CLASS="COMMAND"
+>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot login</B
+></P
+></LI
+><LI
+><P
+> When prompted enter a password of 'cvs'.</P
+></LI
+><LI
+><P
+> <B
+CLASS="COMMAND"
+>cvs update -d -P</B
+></P
+></LI
+></UL
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="CHAPTER"
+><HR><H1
+><A
+NAME="AEN149"
+>Chapter 3. Establishing Connections</A
+></H1
+><DIV
+CLASS="SECT1"
+><H1
+CLASS="SECT1"
+><A
+NAME="AEN151"
+></A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN153"
+>How do I get my NT4 or W2000 Workstation to login to the Samba controlled Domain?</A
+></H2
+><P
+>There is a comprehensive Samba PDC <A
+HREF="samba-pdc-howto.html"
+TARGET="_top"
+>HowTo</A
+>
+     accessable from the samba web site 
+	under 'Documentation'. Its currently located at <A
+HREF="http://bioserve.latrobe.edu.au/samba"
+TARGET="_top"
+>	http://bioserve.latrobe.edu.au/samba</A
+>. Read it.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN158"
+>What is a 'machine account' ?</A
+></H2
+><P
+>Every NT, W2K or Samba machine that joins a Samba controlled domain must be known to
+    the Samba PDC. There are two entries required, one in (typically) <TT
+CLASS="FILENAME"
+>/etc/passwd</TT
+>
+    and the other in (typically) <TT
+CLASS="FILENAME"
+>/usr/local/samba/private/smbpasswd</TT
+>. Under 
+    some circumstances these entries are made <A
+HREF="#AEN171"
+>manually</A
+>, the 
+    <A
+HREF="samba-pdc-howto.html"
+TARGET="_top"
+>HowTo</A
+> discusses ways of creating them automatically.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN165"
+>"The machine account for this computer either does not exist or is not accessable."</A
+></H2
+><P
+>When I try to join the domain I get the message "The machine account for this computer
+	either does not exist or is not accessable". Whats wrong ?</P
+><P
+>This problem is caused by the PDC not having a suitable machine account. 
+	If you are using the <B
+CLASS="COMMAND"
+>add user script =</B
+> method to create accounts 
+	then this would indicate that it has not worked. Ensure the domain admin user 
+	system is working.</P
+><P
+>Alternatively if you are creating account entries manually then they have not been created
+	correctly. Make sure that you have the entry correct for the machine account in smbpasswd 
+	file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, 
+	make sure that the account name is the machine netbios name with a '$' appended to it 
+	( ie. computer_name$ ). There must be an entry in both /etc/passwd and 
+	the smbpasswd file. Some people have reported that 
+	inconsistent subnet masks between the Samba server and the NT client have caused this problem.  
+	Make sure that these are consistent for both client and server.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN171"
+>How do I create machine accounts manually ?</A
+></H2
+><P
+>This was the only option until recently, now in version 2.2 better means are available.
+	You might still need to do it manually for a couple of reasons. A machine account 
+	consists of two entries (assuming a standard install and /etc/passwd use), 
+	one in /etc/passwd and the other in /usr/local/samba/private/smbpasswd. The /etc/passwd
+	entry will list the machine name with a $ appended, won't have a passwd, will have a null
+	shell and no home directory. For example a machine called 'doppy' would have an /etc/passwd 
+	entry like this :</P
+><P
+><B
+CLASS="COMMAND"
+>doppy$:x:505:501:NTMachine:/dev/null:/bin/false</B
+></P
+><P
+>On a linux system for example, you would typically add it like this :</P
+><P
+><B
+CLASS="COMMAND"
+>adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n 
+		doppy$</B
+></P
+><P
+>Then you need to add that entry to smbpasswd, assuming you have a suitable
+	path to the <B
+CLASS="COMMAND"
+>smbpasswd</B
+> programme, do this :</P
+><P
+><B
+CLASS="COMMAND"
+>smbpasswd -a -m doppy$</B
+></P
+><P
+>The entry will be created with a well known password, so any machine that 
+	says its doppy could join the domain as long as it gets in first. So don't create
+	the accounts any earlier than you need them.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN184"
+>I cannot include a '$' in a machine name.</A
+></H2
+><P
+>A 'machine name' in (typically) <TT
+CLASS="FILENAME"
+>/etc/passwd</TT
+> consists 
+    of the machine name with a '$' appended. FreeBSD (and other BSD systems ?) 
+    won't create a user with a '$' in their name.</P
+><P
+>The problem is only in the program used to make the entry, once made, it works
+    perfectly. So create a user without the '$' and use <B
+CLASS="COMMAND"
+>vipw</B
+> to edit
+    the entry, adding the '$'. Or create the whole entry with vipw if you like,
+    make sure you use a unique uid !</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN190"
+>I get told "You already have a connection to the Domain...." when creating a
+	 machine account.</A
+></H2
+><P
+>This happens if you try to create a machine account from the machine itself 
+	and use a user	name that does not work (for whatever reason) and then try 
+	another (possibly valid) user name.
+	Exit out of the network applet to close the initial connection and try again.</P
+><P
+>Further, if the machine is a already a 'member of a workgroup' that is the 
+        same name as the domain you are joining (bad idea) you will get this message.
+        Change the workgroup name to something else, it does not matter what, reboot,
+        and try again.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN194"
+>I get told "Cannot join domain, the credentials supplied conflict
+                with an existing set.."</A
+></H2
+><P
+>This is the same basic problem as mentioned above, <A
+HREF="#AEN190"
+>        "You already have a connection..."</A
+></P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN198"
+>"The system can not log you on (C000019B)...."</A
+></H2
+><P
+>I joined the domain successfully but after upgrading to a newer version of the 
+	Samba code I get the message, "The system can not log you on (C000019B), Please try a
+	gain or consult your system administrator" when attempting to logon.</P
+><P
+>This occurs when the domain SID stored in private/WORKGROUP.SID is changed.  
+	For example, you remove the file and smbd automatically creates a new one.   
+	Or you are swapping back and forth between versions 2.0.7, TNG and the HEAD branch
+	code (not recommended).  The only way to correct the problem is to restore the 
+	original domain SID or 	remove the domain client from the domain and rejoin.</P
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="CHAPTER"
+><HR><H1
+><A
+NAME="AEN202"
+>Chapter 4. User Account Management</A
+></H1
+><DIV
+CLASS="SECT1"
+><H1
+CLASS="SECT1"
+><A
+NAME="AEN204"
+>Domain Admins</A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN206"
+>How do I configure an account as a domain administrator?</A
+></H2
+><P
+>See the NTDom <A
+HREF="samba-pdc-howto.html"
+TARGET="_top"
+>HowTo</A
+>.</P
+></DIV
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H1
+CLASS="SECT1"
+><A
+NAME="AEN210"
+>Profiles</A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN212"
+>Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ?</A
+></H2
+><P
+>Sometimes Windows clients will maintain a connection to the \\homes\ ( or [%U] ) share 
+	even after the user has logged out. Consider the following scenario.</P
+><P
+></P
+><UL
+><LI
+><P
+> user1 logs into the Windows NT machine.  Therefore the 
+		[homes] share is set to \\server\user1.</P
+></LI
+><LI
+><P
+> user1 works for a while and then logs out. </P
+></LI
+><LI
+><P
+> user2 logs into the same Windows NT  machine.</P
+></LI
+></UL
+><P
+>However, since the NT box has maintained a connection to [homes] which was 
+	previously set to \\server\user1, when the operating system attempts to 
+	get the profile and if it can read users1's profile, will get it otherwise it 
+	will return an error. You get the picture.</P
+><P
+>A better solution is to use a separate [profiles] share and set the 
+	"logon path = \\%N\profiles\%U" </P
+><DIV
+CLASS="NOTE"
+><BLOCKQUOTE
+CLASS="NOTE"
+><P
+><B
+>Note: </B
+>Is this still a problem ????</P
+></BLOCKQUOTE
+></DIV
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN226"
+>Why are all the users listed in the "domain admin users" using the same profile?</A
+></H2
+><P
+>You are using a very very old development version of Samba. Upgrade.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN229"
+>The roaming profiles do not seem to be updating on the server.</A
+></H2
+><P
+>There can be several reasons for this.</P
+><P
+>Make sure that the time on the client and the PDC are synchronized.  You can accomplish 
+	this by executing a <B
+CLASS="COMMAND"
+>net time  \\server /set /yes</B
+> replacing server with the 
+	name of your PDC (or another synchronized SMB server). See <A
+HREF="#AEN333"
+>    about Setting Time</A
+></P
+><P
+>Make sure that the 
+	logon path is writeable by the user and make sure that the connection to the logon 
+	path location is by the current user.   Sometimes Windows client do not drop the 
+	connection immediately upon logoff.</P
+><P
+>Some people have reported that the logon path location should also be browseable.   
+	I (GC) have yet to emperically verify this, but you can try.</P
+></DIV
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H1
+CLASS="SECT1"
+><A
+NAME="AEN237"
+>Policies</A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN239"
+>What are 'Policies' ?.</A
+></H2
+><P
+>When a user logs onto the domain via a client machine, the PDC sends  
+    the client machine a list of things contained in the 'policy' (if it exists).
+    This list may do things like suppress a splach screen, format the dates the way you 
+    like them or perhaps remove locally stored profiles.</P
+><P
+>On a samba PDC this list is obtained from a file called <B
+CLASS="COMMAND"
+>ntconfig.pol</B
+>
+    and located in the <B
+CLASS="COMMAND"
+>[netlogon]</B
+>share. The file is created with a policy editor
+    and must be readable by anyone and writeable by only root. See <A
+HREF="#AEN260"
+>    below</A
+> for how  to get a suitable editor.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN246"
+>I can't get system policies to work.</A
+></H2
+><P
+>There are two possible reasons for system policies not functioning correctly. 
+     Make sure that you have the following parameters set in smb.conf </P
+><PRE
+CLASS="PROGRAMLISTING"
+>	[netlogon]
+	....
+	locking = no
+	public = no
+	browseable = yes
+	....   
+    </PRE
+><P
+>A policy file must be in the <B
+CLASS="COMMAND"
+>[netlogon]</B
+> share and must be 
+    readable by everyone and writeable by only root. The file must be created
+    by an NTServer <A
+HREF="#AEN260"
+>Policy Editor</A
+>.</P
+><P
+>Last time I (drb) looked in the source, it was
+	looking for <TT
+CLASS="FILENAME"
+>ntconfig.pol</TT
+> first then several other combinations of upper
+	and lower case. People have reported success using <TT
+CLASS="FILENAME"
+>NTconfig.pol</TT
+>, 
+	<TT
+CLASS="FILENAME"
+>NTconfig.POL</TT
+> and <TT
+CLASS="FILENAME"
+>ntconfig.pol</TT
+>.   These are the case 
+    settings that I (GC) use with the
+	filename <TT
+CLASS="FILENAME"
+>ntconfig.pol</TT
+></P
+><PRE
+CLASS="PROGRAMLISTING"
+>        case sensitive = no
+        case preserve = yes
+        default case = yes
+    </PRE
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN260"
+>What about Windows NT Policy Editor ?</A
+></H2
+><P
+>To create or edit <B
+CLASS="COMMAND"
+>ntconfig.pol</B
+> you must use the NT Server 
+    Policy Editor, <B
+CLASS="COMMAND"
+>poledit.exe</B
+>	which is included with NT Server 
+    but <I
+CLASS="EMPHASIS"
+>not NT Workstation</I
+>. There is a Policy Editor on a NTws 
+    but it is not suitable for creating <I
+CLASS="EMPHASIS"
+>Domain Policies</I
+>. 
+    Further, although the Windows 95 
+	Policy Editor can be installed on an NT Workstation/Server, it will not
+	work with NT policies because the registry key that are set by the policy templates. 
+	However, the files from the NT Server will run happily enough on an NTws. 
+	You need <TT
+CLASS="FILENAME"
+>poledit.exe, common.adm</TT
+> and <TT
+CLASS="FILENAME"
+>winnt.adm</TT
+>. It is convenient
+    to put the two *.adm files in <TT
+CLASS="FILENAME"
+>c:\winnt\inf</TT
+> which is where
+    the binary will look for them unless told otherwise. Note also that that 
+    directory is 'hidden'.</P
+><P
+>The Windows NT policy editor is also included with the 
+	Service Pack 3 (and later) for Windows NT 4.0. Extract the files using 
+    <B
+CLASS="COMMAND"
+>servicepackname /x</B
+>, ie thats <B
+CLASS="COMMAND"
+>Nt4sp6ai.exe /x</B
+>
+    for service pack 6a.  
+	The policy editor, <B
+CLASS="COMMAND"
+>poledt.exe</B
+> and the associated template files (*.adm) should
+	be extracted as well.  It is also possible to downloaded the policy template 
+	files for Office97 and get a copy of the policy editor.  Another possible 
+	location is with the Zero Administration Kit available for download from Microsoft.
+    </P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN274"
+>Can Win95 do Policies ?</A
+></H2
+><P
+>Install the group policy handler for Win9x to pick up group policies. 
+    Look on the Win98 CD in <TT
+CLASS="FILENAME"
+>	\tools\reskit\netadmin\poledit</TT
+>. Install group policies on a Win9x client by double-clicking 
+	<TT
+CLASS="FILENAME"
+>grouppol.inf</TT
+>. Log off and on again a couple of times and see if 
+    Win98 picks up group policies. 
+	Unfortunately this needs to be done on every Win9x machine that uses group policies....</P
+><P
+>If group policies don't work one reports suggests getting the updated (read: working) 
+	grouppol.dll for Windows 9x. The group list is grabbed from /etc/group.</P
+></DIV
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H1
+CLASS="SECT1"
+><A
+NAME="AEN280"
+>Passwords</A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN282"
+>What is password sync and should I use it ?</A
+></H2
+><P
+>NTws users can change their domain password by pressing Ctrl-Alt-Del and
+    choosing 'Change Password'. By default however, this does not change the unix password 
+    (typically in <TT
+CLASS="FILENAME"
+>/etc/passwd or /etc/shadow</TT
+>). In lots of situations
+    thats OK, for example :</P
+><P
+></P
+><UL
+><LI
+><P
+>The server is only accessible to the user via samba.</P
+></LI
+><LI
+><P
+>Pam_smb or similar is installed so other applications 
+        still refer to the samba password.</P
+></LI
+></UL
+><P
+>But sometimes you really do need to maintain two seperate password databases and
+    there are good reasons to keep then in sync.  Trying to explain to users
+	that they need to change their passwords in two seperate places or use 
+    two seperate passwords is not fun.</P
+><P
+>However do understand that setting up password sync is not without problems either. 
+    The chief difficulty is the interface between Samba and the <B
+CLASS="COMMAND"
+>passwd</B
+> command, 
+	it can be a fiddle to set up and if the password the user has entered fails, 
+	the resulting errors are ambiguously reported
+	and the user is confused. Further, you need to take steps to ensure that users
+    only ever change their passwords via samba (or use <B
+CLASS="COMMAND"
+>smbpasswd</B
+>),
+    otherwise they will only be changing the unix password.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN295"
+>How do I get remote password (unix and SMB) changing working ?</A
+></H2
+><P
+>Have a practice changing a user's password (as root) to see what 
+	discussion takes place and change the text in the 'passwd chat' line below  as necessary. The
+    line as shown works for recent RH Linux but most other systems seem to like to do something
+    different. The '*' is a wild card and will match anything (or nothing).
+	</P
+><P
+>Add these lines to smb.conf under [Global]</P
+><PRE
+CLASS="PROGRAMLISTING"
+> 
+
+		unix password sync = true
+   		passwd program = /usr/bin/passwd %u
+   		passwd chat = *password* %n\n *password* %n\n *successful*
+	</PRE
+><P
+>As mentioned above, the change to the unix password 
+	happens as root, not as the user, as is indicated in ~/smbd/chgpasswd.c  If
+	you are using NIS, the Samba server must be running on the NIS master machine.</P
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="CHAPTER"
+><HR><H1
+><A
+NAME="AEN301"
+>Chapter 5. Miscellaneous</A
+></H1
+><DIV
+CLASS="SECT1"
+><H1
+CLASS="SECT1"
+><A
+NAME="AEN303"
+></A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN305"
+>What editor can I use in DOS/Windows that won't mess with my unix EOF</A
+></H2
+><P
+>There are a number of Windows or DOS based editors that will understand, and
+    leave intact, the unix eof (as opposed to a DOS CL/LF). List members suggested :</P
+><P
+></P
+><UL
+><LI
+><P
+>UltraEdit at <A
+HREF="http://www.ultraedit.com"
+TARGET="_top"
+>www.ultraedit.com</A
+></P
+></LI
+><LI
+><P
+>VI for windows at <A
+HREF="http://home.snafu.de/ramo/WinViEn.htm"
+TARGET="_top"
+>        home.snafu.de/ramo/WinViEn.htm</A
+></P
+></LI
+><LI
+><P
+>The author prefers PFE at <A
+HREF="http://www.lancs.ac.uk/people/cpaap/pfe/"
+TARGET="_top"
+>            www.lancs.ac.uk/people/cpaap/pfe/</A
+> but its no longer being developed...</P
+></LI
+></UL
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN318"
+>How do I get 'User Manager' and 'Server Manager'</A
+></H2
+><P
+>Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for
+	Domains', the 'Server Manager' ?</P
+><P
+></P
+><P
+><B
+>Microsoft distributes a version of these tools called nexus 
+    for installation on Windows 95 systems.  The tools set includes</B
+></P
+><UL
+><LI
+><P
+>Server Manager</P
+></LI
+><LI
+><P
+>User Manager for Domains</P
+></LI
+><LI
+><P
+>Event Viewer</P
+></LI
+></UL
+><P
+>Click here to download the archived file 
+        <A
+HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE"
+TARGET="_top"
+>        ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A
+></P
+><P
+>The Windows NT 4.0 version of the 'User Manager for Domains' 
+        and 'Server Manager' are available from Microsoft via ftp from 
+        <A
+HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE"
+TARGET="_top"
+>        ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A
+></P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN333"
+>The time setting from a Samba server does not work.</A
+></H2
+><P
+>If it works OK when you log on as Domain Admin then the problem is that ordinary users
+	don't have permission to change the time. (The system is running with their permission
+	at logon time.) This is not a Samba problem, you will have the same problem where ever
+	you connect. You can give 'everyone' permission to change the time from the User Manager.
+	</P
+><P
+>Anyone know what the registry settings are so this could be done with a Policy ?</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN337"
+>"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A
+></H2
+><P
+>I keep getting the message "trust account xxx should be in DOMAIN_GROUP_RID_USERS." 
+	in the logs. What do I need to do?</P
+><P
+>You are using one of the old development versions. Upgrade. 
+	(The message is unimportant, was a reminder to a developer)</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN341"
+>How do I get my samba server to become a member ( not PDC ) of an NT domain?</A
+></H2
+><P
+>In a domain that has a number of servers you only need one password database. 
+	The machines that don't have their own ask the PDC  to check for them.
+    This will work fine for a domain controlled by either a Samba or NT machine.
+	The following lines in smb.conf are typical, 'password server' points to the 
+	samba machine (or an NT) that has the password list : </P
+><PRE
+CLASS="PROGRAMLISTING"
+> 
+
+		[global]
+		...
+		security = domain
+		workgroup = { Put your domain name here }
+		password server = { Put the ip of the PDC here }
+		encrypt passwords = yes
+		...	
+	</PRE
+><P
+>The samba server in question will have to 'join the domain', that requires 
+	the domain controller to have a machine	account for it. This is no different 
+	to the machine account requirements to allow a NTws to join the domain. For
+	example, if we want a unix box called <I
+CLASS="EMPHASIS"
+>sleepy</I
+> to ask the PDC called <I
+CLASS="EMPHASIS"
+>grumpy</I
+> 
+	to do its authentication then <I
+CLASS="EMPHASIS"
+>grumpy</I
+> will need an entry in its smbpasswd 
+	(assuming it's also samba) that starts with <I
+CLASS="EMPHASIS"
+>sleepy$</I
+>. It would have to be
+    created <A
+HREF="#AEN171"
+>manually</A
+>. </P
+><P
+>If the domain is controlled by an NTServer then the "Server Manager for Domains"
+    tool must be used to add 'sleepy' to the domain list.</P
+><P
+>In either case we then join the domain. If the domain is called <I
+CLASS="EMPHASIS"
+>forest</I
+>
+	then on sleepy we would join the domain by typing :</P
+><P
+><B
+CLASS="COMMAND"
+>smbpasswd -j forest</B
+></P
+><P
+>Note that the directory where the smbpasswd file would be 
+	located should exist as this is where smbd will generate the MACHINE.SID file. This
+    might be <TT
+CLASS="FILENAME"
+>/usr/local/samba/private/FOREST.SLEEPY.SID</TT
+> and
+    it contains the trust account password for the domain member. The permissions are
+    (and should remain) "rw-------</P
+><P
+>Note the Samba Servers without the password list will most likely still need an account 
+	for each user, this means a line in its <TT
+CLASS="FILENAME"
+>/etc/passwd</TT
+>. Because authentication
+    is being handled at the domain level the 
+	<TT
+CLASS="FILENAME"
+>/etc/passwd</TT
+> line does not need a password.
+	If the shares being offered are not user specific, ie a common (read only ?) 
+	area or perhaps just printing then the user's
+	<TT
+CLASS="FILENAME"
+>/etc/passwd</TT
+> does not need a home directory. A typical 
+	line in <TT
+CLASS="FILENAME"
+>/etc/passwd</TT
+> for a server that allows domain users to
+	connect to the samba shares but does not offer a home share ('cos that's on the PDC) 
+	and does not allow logon to the unix prompt would be like this :</P
+><PRE
+CLASS="PROGRAMLISTING"
+>jblow:x:542:100:Joe Blow:/dev/null:/bin/false</PRE
+><DIV
+CLASS="NOTE"
+><BLOCKQUOTE
+CLASS="NOTE"
+><P
+></P
+><UL
+><LI
+><P
+>When removing those 'dummy' users, watch the 'remove user' scripts, 
+	some OS think they should remove a users directory even when its not owned by the user !
+	</P
+></LI
+><LI
+><P
+>The <TT
+CLASS="FILENAME"
+>username map = </TT
+> parameter might help you to avoid having 
+    all those accounts created.</P
+></LI
+><LI
+><P
+>You should investigate the smb.conf parameter 
+	    <TT
+CLASS="FILENAME"
+>'add user script'</TT
+>, it will be used to create accounts on 
+	    secondary servers when that account already exists on the PDC. Very nice.
+        Something like :</P
+><PRE
+CLASS="PROGRAMLISTING"
+>    [Global]
+    ....
+    add user script = /usr/sbin/adduser -n -g users -c User -d /dev/null -s /bin/false %U	
+    ....
+        </PRE
+></LI
+></UL
+></BLOCKQUOTE
+></DIV
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="CHAPTER"
+><HR><H1
+><A
+NAME="AEN376"
+>Chapter 6. Troubleshooting and Bug Reporting</A
+></H1
+><DIV
+CLASS="SECT1"
+><H1
+CLASS="SECT1"
+><A
+NAME="AEN378"
+>Diagnostic tools</A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN380"
+>What are some diagnostics tools I can use to debug the domain logon process and where can I
+	find them?</A
+></H2
+><P
+>One of the best diagnostic tools for debugging problems is Samba itself.  You can use the -d 
+	option for both smbd and nmbd to specifiy what 'debug level' at which to run.  See the man 
+	pages on smbd, nmbd  and smb.conf for more information on debugging options.  The debug 
+	level can range from 1 (the default) to around 100 but a debug level of about 20 will 
+	normally help you find any errors that samba is encountering. Another helpful method 
+	of debugging is to compile samba using the gcc -g flag.   This will include debug 
+	information in the binaries and allow you to attch gdb to the running smbd / nmbd 
+	process.  In order to attach gdb to an smbd process for an NT workstation, first 
+	get the workstation to make the connection. Pressing ctrl-alt-delete and going down 
+	to the domain box is sufficient (at least, on the first time you join the domain) to 
+	generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation maintains an open 
+	connection, and therefore there will be an smbd process running (assuming that you 
+	haven't set a really short smbd idle timeout)  So, in between pressing ctrl alt 
+	delete, and actually typing in your password, you can gdb attach and continue.</P
+><P
+></P
+><P
+><B
+>Some usefull samba commands worth investigating:</B
+></P
+><UL
+><LI
+><P
+>testparam | more</P
+></LI
+><LI
+><P
+>smbclient -L //{netbios name of server}</P
+></LI
+></UL
+><P
+>An SMB enabled version of tcpdump is available from 
+    <A
+HREF="ftp://samba.org/pub/samba/tcpdump-smb/"
+TARGET="_top"
+>ftp://samba.org/pub/samba/tcpdump-smb/
+    </A
+></P
+><P
+>Capconvert is a small C program for translating output from tcpdump-smb to CAP format 
+	that can be read by netmon. You will need to use the raw output from tcp dump 
+	( ie. <B
+CLASS="COMMAND"
+>tcpdump -w output.dump</B
+> ).  Good news!  Now you can convert
+     Solaris' snoop output as well.   The C source code for snoop2cap is available for download.
+    </P
+><P
+>For tracing things on the Microsoft Windows NT, Network Monitor (aka. netmon) is available 
+	on the Microsoft Developer Network CD's, the Windows NT Server install CD and the SMS CD's.  
+	The version of netmon that ships with SMS allows for dumping packets between any two 
+	computers (ie. placing the network interface in promiscuous mode).  The version 
+	on the NT Server install CD will only allow monitoring of network traffic directed to the 
+	local NT box and broadcasts on the local subnet.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN394"
+>How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box?</A
+></H2
+><P
+>Installing netmon on an NT workstation requires a couple of steps.  The following 
+	are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server 
+	4.0, on Microsoft Windows NT Workstation 4.0.  The process should be similar
+	for other version of Windows NT / Netmon.  You will need both the Microsoft Windows 
+	NT Server 4.0 Install CD and the Workstation 4.0 Install CD.</P
+><P
+>Initially you will need to install 'Network Monitor Tools and Agent' on the 
+    NT Server.  To do this </P
+><P
+></P
+><UL
+><LI
+><P
+>Goto Start - Settings - Control Panel - Network - Services - Add </P
+></LI
+><LI
+><P
+>Select the 'Network Monitor Tools and Agent' and click on 'OK'.</P
+></LI
+><LI
+><P
+>Click 'OK' on the Network Control Panel.</P
+></LI
+><LI
+><P
+>Insert the Windows NT Server 4.0 install CD when prompted.</P
+></LI
+></UL
+><P
+>At this point the Netmon files should exist in <TT
+CLASS="FILENAME"
+>%SYSTEMROOT%\System32\netmon\*.*</TT
+>.    
+	Two subdirectories exist as well, <TT
+CLASS="FILENAME"
+>parsers\</TT
+> which contains the necessary DLL's 
+	for parsing the netmon packet dump, and <TT
+CLASS="FILENAME"
+>captures\</TT
+>.</P
+><P
+>In order to install the Netmon tools on an NT Workstation, you will first need to 
+	install the 'Network  Monitor Agent' from the Workstation install CD.</P
+><P
+></P
+><UL
+><LI
+><P
+>Goto Start - Settings - Control Panel - Network - Services - Add</P
+></LI
+><LI
+><P
+>Select the 'Network Monitor Agent' and click on 'OK'.</P
+></LI
+><LI
+><P
+>Click 'OK' on the Network Control Panel.</P
+></LI
+><LI
+><P
+>Insert the Windows NT Workstation 4.0 install CD when prompted.</P
+></LI
+></UL
+><P
+>Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* to
+	%SYSTEMROOT%\System32\netmon\*.* on the Workstation and set permissions as 
+	you deem appropriate for your site. You will need administrative rights on the 
+	NT box to run netmon.</P
+><P
+>To install Netmon on a Windows 9x box install the network monitor agent from 
+	the Windows 9x CD (\admin\nettools\netmon).   
+	There is a readme file located with the netmon driver files on the CD if you need 
+	information on how to do this.  Copy the files from a working Netmon installation.</P
+></DIV
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H1
+CLASS="SECT1"
+><A
+NAME="AEN423"
+>What other help can I get ?</A
+></H1
+><P
+>There are many sources of information available in the form of mailing lists, RFC's 
+	and documentation.  The docs that come with the samba distribution contain very 
+	good explanations of general SMB topics such as browsing.</P
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN426"
+>URLs and similar</A
+></H2
+><P
+></P
+><UL
+><LI
+><P
+>Home of Samba site <A
+HREF="http://samba.org"
+TARGET="_top"
+>        http://samba.org</A
+>. We have a mirror near you !</P
+></LI
+><LI
+><P
+> The <I
+CLASS="EMPHASIS"
+>Development</I
+> document 
+		on the Samba mirrors might mention your problem. If so,
+		it might mean that the developers are working on it.</P
+></LI
+><LI
+><P
+> Ignacio Coupeau has a very comprehesive look at LDAP with Samba at 
+		<A
+HREF="http://www.unav.es/cti/ldap-smb-howto.html"
+TARGET="_top"
+>		http://www.unav.es/cti/ldap-smb-howto.html</A
+> 
+		Be a little carefull however, I suspect that it does not specificly 
+		address samba 2.2.x. The HEAD pre-2.1 may possibly be the best
+		stream to look at.</P
+></LI
+><LI
+><P
+>  Lars Kneschke's site covers <A
+HREF="http://www.samba-tng.org"
+TARGET="_top"
+>        Samba-TNG</A
+> at 
+		<A
+HREF="http://www.kneschke.de/projekte/samba_tng"
+TARGET="_top"
+>		http://www.kneschke.de/projekte/samba_tng</A
+>, but again, a 
+		lot of it does not apply to the main stream Samba.</P
+></LI
+><LI
+><P
+>Although 2.0.7 has almost had its day as a PDC, I (drb) will
+        keep the 2.0.7 PDC pages at <A
+HREF="http://bioserve.latrobe.edu.au/samba"
+TARGET="_top"
+>        http://bioserve.latrobe.edu.au/samba</A
+> going for a while yet.</P
+></LI
+><LI
+><P
+>Misc links to CIFS information 
+        <A
+HREF="http://samba.org/cifs/"
+TARGET="_top"
+>http://samba.org/cifs/</A
+></P
+></LI
+><LI
+><P
+>NT Domains for Unix <A
+HREF="http://mailhost.cb1.com/~lkcl/ntdom/"
+TARGET="_top"
+>        http://mailhost.cb1.com/~lkcl/ntdom/</A
+></P
+></LI
+><LI
+><P
+>FTP site for older SMB specs: 
+        <A
+HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/"
+TARGET="_top"
+>        ftp://ftp.microsoft.com/developr/drg/CIFS/</A
+></P
+></LI
+></UL
+><P
+></P
+><P
+><B
+>There are a number of documents that no longer appear to live at their
+    origional home. Any one know where the following may be found ?</B
+></P
+><UL
+><LI
+><P
+>CIFS/E Browser Protocol draft-leach-cifs-browser-spec-00.txt</P
+></LI
+><LI
+><P
+>CIFS Remote Administration Protocol draft-leach-cifs-rap-spec-00.txt</P
+></LI
+><LI
+><P
+>CIFS Logon and Pass Through Authentication draft-leach-cifs-logon-spec-00.txt</P
+></LI
+><LI
+><P
+>A Common Internet File System (CIFS/1.0) Protocol draft-leach-cifs-v1-spec-01.txt</P
+></LI
+><LI
+><P
+>CIFS Printing Specification draft-leach-cifs-print-spec-00.txt</P
+></LI
+><LI
+><P
+>RFC1001 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Concepts and methods.
+     http://ds.internic.net/rfc/rfc1001.txt </P
+></LI
+><LI
+><P
+>RFC1002 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Detailed specifications.
+     http://ds.internic.net/rfc/rfc1002.txt </P
+></LI
+><LI
+><P
+>Microsoft's main CIFS page: http://www.microsoft.com/workshop/networking/cifs/</P
+></LI
+></UL
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN472"
+>How do I get help from the mailing lists ?</A
+></H2
+><P
+> There are a number of Samba related mailing lists. Go to <A
+HREF="http://samba.org"
+TARGET="_top"
+>http://samba.org</A
+>, click on your nearest mirror
+        and then click on <B
+CLASS="COMMAND"
+>Support</B
+> and then click on <B
+CLASS="COMMAND"
+>        Samba related mailing lists</B
+>.</P
+><P
+>For questions relating to Samba TNG go to
+        <A
+HREF="http://www.samba-tng.org/"
+TARGET="_top"
+>http://www.samba-tng.org/</A
+> 
+	    It has been requested that you don't post questions about Samba-TNG to the
+        main stream Samba lists.</P
+><P
+></P
+><P
+><B
+>If you post a message to one of the lists please
+	 observe the following guide lines :</B
+></P
+><UL
+><LI
+><P
+> Always remember that the developers are volunteers, they are 
+		not paid and they never guarantee to produce a particular feature at 
+		a particular time. Any time lines are 'best guess' and nothing more.
+		</P
+></LI
+><LI
+><P
+> Always mention what version of samba you are using and what 
+		operating system its running under. You should probably list the
+        relevant sections of your smb.conf file, at least the options 
+        in [global] that affect PDC support.</P
+></LI
+><LI
+><P
+>In addition to the version, if you obtained Samba via
+        CVS mention the date when you last checked it out.</P
+></LI
+><LI
+><P
+> Try and make your question clear and brief, lots of long, 
+		convoluted questions get deleted before	they are completely read ! 
+		Don't post html encoded messages (if you can select colour or font 
+		size its html).</P
+></LI
+><LI
+><P
+> If you run one of those niffy 'I'm on holidays' things when 
+		you are away, make sure its configured	to not answer mailing lists.
+		</P
+></LI
+><LI
+><P
+> Don't cross post. Work out which is the best list to post to 
+		and see what happens, ie don't post to both samba-ntdom and samba-technical.
+        Many people active on the lists subscribe to more 
+		than one list and get annoyed to see the same message two or more times. 
+		Often someone will see a message and thinking it would be better dealt 
+		with on another, will forward it on for you.</P
+></LI
+><LI
+><P
+>You might include <I
+CLASS="EMPHASIS"
+>partial</I
+>
+        log files written at a debug level set to as much as 20.  
+        Please don't send the entire log but enough to give the context of the 
+        error messages.</P
+></LI
+><LI
+><P
+>(Possibly) If you have a complete netmon trace ( from the opening of 
+        the pipe to the error ) you can send the *.CAP file as well.</P
+></LI
+><LI
+><P
+>Please think carefully before attaching a document to an email.
+        Consider pasting the relevant parts into the body of the message. The samba
+        mailing lists go to a huge number of people, do they all need a copy of your 
+        smb.conf in their attach directory ?</P
+></LI
+></UL
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN501"
+>How do I get off the mailing lists ?</A
+></H2
+><P
+>To have your name removed from a samba mailing list, go to the
+        same place you went to to get on it. Go to <A
+HREF="http://samba.org"
+TARGET="_top"
+>http://samba.org</A
+>, click on your nearest mirror
+        and then click on <B
+CLASS="COMMAND"
+>Support</B
+> and then click on <B
+CLASS="COMMAND"
+>        Samba related mailing lists</B
+>. Or perhaps see 
+        <A
+HREF="http://lists.samba.org/mailman/roster/samba-ntdom"
+TARGET="_top"
+>here</A
+></P
+><P
+>Please don't post messages to the list asking to be removed, you will just
+        be refered to the above address (unless that process failed in some way...)
+    </P
+></DIV
+></DIV
+></DIV
+></DIV
+></BODY
+></HTML
+>
+\ No newline at end of file
diff --git a/docs/htmldocs/samba-pdc-howto.html b/docs/htmldocs/samba-pdc-howto.html
new file mode 100644
index 0000000000..760e2e73b8
--- /dev/null
+++ b/docs/htmldocs/samba-pdc-howto.html
@@ -0,0 +1,2096 @@
+<HTML
+><HEAD
+><TITLE
+>The Samba 2.2 PDC FAQ</TITLE
+><META
+NAME="GENERATOR"
+CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
+><BODY
+CLASS="BOOK"
+BGCOLOR="#FFFFFF"
+TEXT="#000000"
+LINK="#0000FF"
+VLINK="#840084"
+ALINK="#0000FF"
+><DIV
+CLASS="BOOK"
+><A
+NAME="SAMBA-PDC-FAQ"
+></A
+><DIV
+CLASS="TITLEPAGE"
+><H1
+CLASS="TITLE"
+><A
+NAME="SAMBA-PDC-FAQ"
+>The Samba 2.2 PDC FAQ</A
+></H1
+><H3
+CLASS="AUTHOR"
+><A
+NAME="AEN4"
+>David Bannon</A
+></H3
+><DIV
+CLASS="AFFILIATION"
+><SPAN
+CLASS="ORGNAME"
+>La Trobe University<BR></SPAN
+></DIV
+><HR></DIV
+><HR><H1
+><A
+NAME="AEN12"
+></A
+></H1
+><P
+>Comments, corrections and additions to <TT
+CLASS="EMAIL"
+>&#60;<A
+HREF="mailto:D.Bannon@latrobe.edu.au"
+>D.Bannon@latrobe.edu.au</A
+>&#62;</TT
+></P
+><P
+>This is the FAQ for Samba 2.2 as an NTDomain controller. 
+	This document is derived from the origional FAQ that was built and 
+	maintained by Gerald Carter
+	from the early days of Samba NTDomain development up until recently. 
+	It is now being updated as significent changes are made to 2.2.0.</P
+><P
+>Please note it does not apply to Samba2.2alpha0, Samba2.2alpha1, Samba 2.0.7, TNG nor HEAD branch.
+    </P
+><P
+>I'll repeat, it does not apply to the current snapshot [ftp mirror]:/pub/samba/alpha/samba-2.2.0-alpha1.tar.gz, only to the to the current cvs.</P
+><P
+>	Also available is a Samba 2.2 PDC <A
+HREF="samba-pdc-howto.html"
+TARGET="_top"
+>HowTo</A
+> that takes you, step
+    by step, over the process of setting up a very basic Samba 2.2 Primary Domain Controller
+    </P
+><DIV
+CLASS="NOTE"
+><BLOCKQUOTE
+CLASS="NOTE"
+><P
+><B
+>Note: </B
+>Please read the Introduction for the current <A
+HREF="#AEN27"
+> state of play</A
+>.</P
+></BLOCKQUOTE
+></DIV
+><DIV
+CLASS="TOC"
+><DL
+><DT
+><B
+>Table of Contents</B
+></DT
+><DT
+>1. <A
+HREF="#AEN25"
+>Introduction</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN27"
+>State of Play</A
+></DT
+><DT
+><A
+HREF="#AEN44"
+>Introduction</A
+></DT
+></DL
+></DD
+><DT
+>2. <A
+HREF="#AEN49"
+>General Information</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN51"
+>What can we do ?</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN53"
+>What can Samba Primary Domain Controller (PDC) do ?</A
+></DT
+><DT
+><A
+HREF="#AEN86"
+>Can I have a Windows 2000 client logon to a Samba controlled domain?</A
+></DT
+><DT
+><A
+HREF="#AEN89"
+>What's the status of print spool (spoolss) support in the NTDOM code?</A
+></DT
+></DL
+></DD
+><DT
+><A
+HREF="#AEN92"
+>CVS</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN95"
+>What are the different Samba branches available in CVS ?</A
+></DT
+><DT
+><A
+HREF="#AEN118"
+>What are the CVS commands ?</A
+></DT
+></DL
+></DD
+></DL
+></DD
+><DT
+>3. <A
+HREF="#AEN149"
+>Establishing Connections</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN151"
+></A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN153"
+>How do I get my NT4 or W2000 Workstation to login to the Samba controlled Domain?</A
+></DT
+><DT
+><A
+HREF="#AEN158"
+>What is a 'machine account' ?</A
+></DT
+><DT
+><A
+HREF="#AEN165"
+>"The machine account for this computer either does not exist or is not accessable."</A
+></DT
+><DT
+><A
+HREF="#AEN171"
+>How do I create machine accounts manually ?</A
+></DT
+><DT
+><A
+HREF="#AEN184"
+>I cannot include a '$' in a machine name.</A
+></DT
+><DT
+><A
+HREF="#AEN190"
+>I get told "You already have a connection to the Domain...." when creating a
+	 machine account.</A
+></DT
+><DT
+><A
+HREF="#AEN194"
+>I get told "Cannot join domain, the credentials supplied conflict
+                with an existing set.."</A
+></DT
+><DT
+><A
+HREF="#AEN198"
+>"The system can not log you on (C000019B)...."</A
+></DT
+></DL
+></DD
+></DL
+></DD
+><DT
+>4. <A
+HREF="#AEN202"
+>User Account Management</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN204"
+>Domain Admins</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN206"
+>How do I configure an account as a domain administrator?</A
+></DT
+></DL
+></DD
+><DT
+><A
+HREF="#AEN210"
+>Profiles</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN212"
+>Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ?</A
+></DT
+><DT
+><A
+HREF="#AEN226"
+>Why are all the users listed in the "domain admin users" using the same profile?</A
+></DT
+><DT
+><A
+HREF="#AEN229"
+>The roaming profiles do not seem to be updating on the server.</A
+></DT
+></DL
+></DD
+><DT
+><A
+HREF="#AEN237"
+>Policies</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN239"
+>What are 'Policies' ?.</A
+></DT
+><DT
+><A
+HREF="#AEN246"
+>I can't get system policies to work.</A
+></DT
+><DT
+><A
+HREF="#AEN260"
+>What about Windows NT Policy Editor ?</A
+></DT
+><DT
+><A
+HREF="#AEN274"
+>Can Win95 do Policies ?</A
+></DT
+></DL
+></DD
+><DT
+><A
+HREF="#AEN280"
+>Passwords</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN282"
+>What is password sync and should I use it ?</A
+></DT
+><DT
+><A
+HREF="#AEN295"
+>How do I get remote password (unix and SMB) changing working ?</A
+></DT
+></DL
+></DD
+></DL
+></DD
+><DT
+>5. <A
+HREF="#AEN301"
+>Miscellaneous</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN303"
+></A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN305"
+>How do I get 'User Manager' and 'Server Manager'</A
+></DT
+><DT
+><A
+HREF="#AEN320"
+>The time setting from a Samba server does not work.</A
+></DT
+><DT
+><A
+HREF="#AEN324"
+>"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A
+></DT
+><DT
+><A
+HREF="#AEN328"
+>How do I get my samba server to become a member ( not PDC ) of an NT domain?</A
+></DT
+></DL
+></DD
+></DL
+></DD
+><DT
+>6. <A
+HREF="#AEN363"
+>Troubleshooting and Bug Reporting</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN365"
+>Diagnostic tools</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN367"
+>What are some diagnostics tools I can use to debug the domain logon process and where can I
+	find them?</A
+></DT
+><DT
+><A
+HREF="#AEN375"
+>How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box?</A
+></DT
+></DL
+></DD
+><DT
+><A
+HREF="#AEN404"
+>What other help can I get ?</A
+></DT
+><DD
+><DL
+><DT
+><A
+HREF="#AEN407"
+>URLs and similar</A
+></DT
+><DT
+><A
+HREF="#AEN453"
+>How do I get help from the mailing lists ?</A
+></DT
+><DT
+><A
+HREF="#AEN482"
+>How do I get off the mailing lists ?</A
+></DT
+></DL
+></DD
+></DL
+></DD
+></DL
+></DIV
+><DIV
+CLASS="CHAPTER"
+><HR><H1
+><A
+NAME="AEN25"
+>Chapter 1. Introduction</A
+></H1
+><DIV
+CLASS="SECT1"
+><H1
+CLASS="SECT1"
+><A
+NAME="AEN27"
+>State of Play</A
+></H1
+><P
+><I
+CLASS="EMPHASIS"
+>It should be noted that 2.2.0 in its pre-release form still has a few problems,
+	I'll try and keep this section current while things are still dynamic. 
+	At the time of this update (November 13, 2000) the current state of play is :</I
+></P
+><P
+>Comments here about W2K joining the domain apply only to Samba 2.2 from the CVS after November 27th. The
+    'snapshot' release Samba2.2alpha1 does not work !!! See below on how to get a CVS tree.</P
+><P
+>Client Side creation of Machine accounts does work but is not complete. 
+    Firstly, the <TT
+CLASS="FILENAME"
+>add user script</TT
+> runs as the user who's
+    name was entered, not as root. Secondly, the machine name passed to the script (%U) 
+    has an underscore at the end, not a '$'. One alternative is to use  %m and add the $.
+    This method is documented in the <A
+HREF="samba-pdc-howto.html"
+TARGET="_top"
+>HowTo</A
+>.  
+    And thirdly, it does not work with NT4ws. 
+    </P
+><P
+>A W2K machine can join the domain. See the <A
+HREF="samba-pdc-howto.html"
+TARGET="_top"
+>HowTo</A
+>
+     which explains the process. The methods
+    described are 'work arounds' and should be regarded as temporary. Although I (drb) 
+    have tested these procedures a number  of people have had difficulty so there
+    may be other issues at work. JFM is aware of these 
+    problems and will attend to them when he can.</P
+><P
+>A Domain Admin account is required and at present it appears that only root
+	is a suitable candidate.</P
+><P
+>Much of the related code does work. For example, if an NT is removed from the 
+	domain and then rejoins, the <TT
+CLASS="FILENAME"
+>Create a Computer Account in the Domain</TT
+> dialog
+	will let you reset the smbpasswd. That is you don't need to do it from
+	the unix box. However, at the present, you do need to have root as an 
+	administrator and use the root user name and password.</P
+><P
+><I
+CLASS="EMPHASIS"
+>Actually I'm 
+    not sure that last paragraph is correct ....</I
+></P
+><P
+><B
+CLASS="COMMAND"
+>Policies</B
+> do work on a W2K machine. MS says that recent builds of 
+    W2K dont observe an NT policy but it appears it does in 'legacy' mode.</P
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H1
+CLASS="SECT1"
+><A
+NAME="AEN44"
+>Introduction</A
+></H1
+><P
+>This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing with the 'old head'
+	version of Samba and its NTDomain facilities. It is being rewritten by David Bannon (drb)
+	so that it addresses more accurately the Samba 2.2 planned for release late 2000. </P
+><P
+>This document probably still contains some material that does not apply to 
+	Samba 2.2 but most (all?) of the really misleading stuff has been removed. Some 
+    issues are not dealt with or are dealt with badly. Please send corrections and additions to
+	David Bannon at D.Bannon@latrobe.edu.au</P
+><P
+>Hopefully, as we all become familiar with the Samba 2.2 as a PDC this document will
+	become much more usefull.</P
+></DIV
+></DIV
+><DIV
+CLASS="CHAPTER"
+><HR><H1
+><A
+NAME="AEN49"
+>Chapter 2. General Information</A
+></H1
+><DIV
+CLASS="SECT1"
+><H1
+CLASS="SECT1"
+><A
+NAME="AEN51"
+>What can we do ?</A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN53"
+>What can Samba Primary Domain Controller (PDC) do ?</A
+></H2
+><P
+>If you wish to have Samba act as a PDC for Windows NT 3.51.and 4.0 or W2000 client, then you 
+	will need to obtain the 2.2.0 version, currently in pre-release. Release of a stable, 
+	full featured Samba PDC is currently slated for version 3.0. </P
+><P
+>The following is a list of included  features currently in Samba 2.2:</P
+><P
+></P
+><UL
+><LI
+><P
+>The ability to act as a limited PDC for Windows NT and W2000 clients.  
+	This includes adding NT and W2K machines to the domain and authenticating users logging 
+	into the domain.</P
+></LI
+><LI
+><P
+>Domain account can be viewed using the User Manager for 
+	Domains  ????</P
+></LI
+><LI
+><P
+>Viewing resources on the Samba PDC via the Server Manager for Domains 
+	from the NT client. ??</P
+></LI
+><LI
+><P
+>Windows 95 clients will allow user level security to be set 
+	but will not currently allow browsing of accounts.</P
+></LI
+><LI
+><P
+>Machine account password updates.</P
+></LI
+><LI
+><P
+>Changing of user passwords from an NT client.</P
+></LI
+><LI
+><P
+>Partial support for Windows NT group and username mapping.</P
+></LI
+><LI
+><P
+>Support for a LDAP password database backend.</P
+></LI
+><LI
+><P
+>Printing.</P
+></LI
+></UL
+><P
+></P
+><P
+><B
+>These things are note expected to work in the forseeable future</B
+></P
+><UL
+><LI
+><P
+>Trust relationships</P
+></LI
+><LI
+><P
+>PDC and BDC integration</P
+></LI
+><LI
+><P
+>Windows NT ACLs (on the Samba shares)</P
+></LI
+><LI
+><P
+>Offer a list of domain users to User Manager for Domains 
+	(or the Security Tab etc).</P
+></LI
+></UL
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN86"
+>Can I have a Windows 2000 client logon to a Samba controlled domain?</A
+></H2
+><P
+>The 2.2 release branch of Samba  supports Windows 2000 domain 
+		clients in legacy mode, ie as if the PDC is a NTServer, not a
+        W2K server.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN89"
+>What's the status of print spool (spoolss) support in the NTDOM code?</A
+></H2
+><P
+>The implementation of support for SPOOLSS pipe is complete and it will be available
+	in the 2.2.0 release. This means that Samba will support the automatic downloading of printer
+	drivers for Windows NT clients just as it currently does for Windows 9x clients.</P
+></DIV
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H1
+CLASS="SECT1"
+><A
+NAME="AEN92"
+>CVS</A
+></H1
+><P
+>CVS is a programme (publically available) that the Samba developers use to
+    maintain the central source code. Non developers can get access to the source in
+    a read only capacity. Many flavours of unix now arrive with cvs installed.</P
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN95"
+>What are the different Samba branches available in CVS ?</A
+></H2
+><P
+>You can find out more about obtaining Samba's  via 
+	anonymous CVS from 
+	<A
+HREF="http://pserver.samba.org/samba/cvs.html"
+TARGET="_top"
+>	http://pserver.samba.org/samba/cvs.html"</A
+>. </P
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><P
+><B
+>There are basically four branches to watch at the moment :</B
+></P
+><DL
+><DT
+>HEAD</DT
+><DD
+><P
+>Samba 3.0 ? This code boasts all the main development 
+		work in Samba. Two things that most people are not aware of 
+		which live in the HEAD branch code are winbind NSS module and
+		Tim Potter's VFS implementation. Due to its developmental
+		nature, its not really suitable for production work.
+	</P
+></DD
+><DT
+>SAMBA_2_0</DT
+><DD
+><P
+>This branch contains the current stable release release. 
+		At the moment it contains 2.0.7, a version that will do some 
+		limited PDC stuff. If you are really going to do PDC things then 
+		I (drb) suggest that you consider 2.2 instead.
+	</P
+></DD
+><DT
+>SAMBA_2_2</DT
+><DD
+><P
+>The next stable release, currently in a 'alpha' form.
+		It provides the Samba developers, testers and interested 
+		people with an approximation of what is to come. This document 
+		addresses only SAMBA_2_2.
+	</P
+></DD
+><DT
+>SAMBA_TNG</DT
+><DD
+><P
+>This branch is no longer maintained from the Samba sites. 
+		Please see <A
+HREF="http://www.samba-tng.org/"
+TARGET="_top"
+>		http://www.samba-tng.org/</A
+>.  It has been requested 
+		that questions about TNG are not posted to the regular Samba mailing 
+		lists including samba-ntdom and samba-technical.
+	</P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN118"
+>What are the CVS commands ?</A
+></H2
+><P
+>See <A
+HREF="http://pserver.samba.org/samba/cvs.html"
+TARGET="_top"
+>	http://pserver.samba.org/samba/cvs.html</A
+></P
+><P
+></P
+><P
+><B
+>To get the Samba 2.2 version, tag SAMBA_2_2 you would do :</B
+></P
+><UL
+><LI
+><P
+> For example : <B
+CLASS="COMMAND"
+>cd /usr/local/src/</B
+></P
+></LI
+><LI
+><P
+> <B
+CLASS="COMMAND"
+>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot 
+			login</B
+></P
+></LI
+><LI
+><P
+> When prompted enter a password of <B
+CLASS="COMMAND"
+>cvs</B
+></P
+></LI
+><LI
+><P
+> <B
+CLASS="COMMAND"
+>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot 
+			co -r SAMBA_2_2 samba</B
+></P
+></LI
+></UL
+><P
+></P
+><P
+><B
+>Then to update that directory at some later time,</B
+></P
+><UL
+><LI
+><P
+> <B
+CLASS="COMMAND"
+>cd /usr/local/src/samba</B
+></P
+></LI
+><LI
+><P
+> <B
+CLASS="COMMAND"
+>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot login</B
+></P
+></LI
+><LI
+><P
+> When prompted enter a password of 'cvs'.</P
+></LI
+><LI
+><P
+> <B
+CLASS="COMMAND"
+>cvs update -d -P</B
+></P
+></LI
+></UL
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="CHAPTER"
+><HR><H1
+><A
+NAME="AEN149"
+>Chapter 3. Establishing Connections</A
+></H1
+><DIV
+CLASS="SECT1"
+><H1
+CLASS="SECT1"
+><A
+NAME="AEN151"
+></A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN153"
+>How do I get my NT4 or W2000 Workstation to login to the Samba controlled Domain?</A
+></H2
+><P
+>There is a comprehensive Samba PDC <A
+HREF="samba-pdc-howto.html"
+TARGET="_top"
+>HowTo</A
+>
+     accessable from the samba web site 
+	under 'Documentation'. Its currently located at <A
+HREF="http://bioserve.latrobe.edu.au/samba"
+TARGET="_top"
+>	http://bioserve.latrobe.edu.au/samba</A
+>. Read it.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN158"
+>What is a 'machine account' ?</A
+></H2
+><P
+>Every NT, W2K or Samba machine that joins a Samba controlled domain must be known to
+    the Samba PDC. There are two entries required, one in (typically) <TT
+CLASS="FILENAME"
+>/etc/passwd</TT
+>
+    and the other in (typically) <TT
+CLASS="FILENAME"
+>/usr/local/samba/private/smbpasswd</TT
+>. Under 
+    some circumstances these entries are made <A
+HREF="#AEN171"
+>manually</A
+>, the 
+    <A
+HREF="samba-pdc-howto.html"
+TARGET="_top"
+>HowTo</A
+> discusses ways of creating them automatically.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN165"
+>"The machine account for this computer either does not exist or is not accessable."</A
+></H2
+><P
+>When I try to join the domain I get the message "The machine account for this computer
+	either does not exist or is not accessable". Whats wrong ?</P
+><P
+>This problem is caused by the PDC not having a suitable machine account. 
+	If you are using the <B
+CLASS="COMMAND"
+>add user script =</B
+> method to create accounts 
+	then this would indicate that it has not worked. Ensure the domain admin user 
+	system is working.</P
+><P
+>Alternatively if you are creating account entries manually then they have not been created
+	correctly. Make sure that you have the entry correct for the machine account in smbpasswd 
+	file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, 
+	make sure that the account name is the machine netbios name with a '$' appended to it 
+	( ie. computer_name$ ). There must be an entry in both /etc/passwd and 
+	the smbpasswd file. Some people have reported that 
+	inconsistent subnet masks between the Samba server and the NT client have caused this problem.  
+	Make sure that these are consistent for both client and server.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN171"
+>How do I create machine accounts manually ?</A
+></H2
+><P
+>This was the only option until recently, now in version 2.2 better means are available.
+	You might still need to do it manually for a couple of reasons. A machine account 
+	consists of two entries (assuming a standard install and /etc/passwd use), 
+	one in /etc/passwd and the other in /usr/local/samba/private/smbpasswd. The /etc/passwd
+	entry will list the machine name with a $ appended, won't have a passwd, will have a null
+	shell and no home directory. For example a machine called 'doppy' would have an /etc/passwd 
+	entry like this :</P
+><P
+><B
+CLASS="COMMAND"
+>doppy$:x:505:501:NTMachine:/dev/null:/bin/false</B
+></P
+><P
+>On a linux system for example, you would typically add it like this :</P
+><P
+><B
+CLASS="COMMAND"
+>adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n 
+		doppy$</B
+></P
+><P
+>Then you need to add that entry to smbpasswd, assuming you have a suitable
+	path to the <B
+CLASS="COMMAND"
+>smbpasswd</B
+> programme, do this :</P
+><P
+><B
+CLASS="COMMAND"
+>smbpasswd -a -m doppy$</B
+></P
+><P
+>The entry will be created with a well known password, so any machine that 
+	says its doppy could join the domain as long as it gets in first. So don't create
+	the accounts any earlier than you need them.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN184"
+>I cannot include a '$' in a machine name.</A
+></H2
+><P
+>A 'machine name' in (typically) <TT
+CLASS="FILENAME"
+>/etc/passwd</TT
+> consists 
+    of the machine name with a '$' appended. FreeBSD (and other BSD systems ?) 
+    won't create a user with a '$' in their name.</P
+><P
+>The problem is only in the program used to make the entry, once made, it works
+    perfectly. So create a user without the '$' and use <B
+CLASS="COMMAND"
+>vipw</B
+> to edit
+    the entry, adding the '$'. Or create the whole entry with vipw if you like,
+    make sure you use a unique uid !</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN190"
+>I get told "You already have a connection to the Domain...." when creating a
+	 machine account.</A
+></H2
+><P
+>This happens if you try to create a machine account from the machine itself 
+	and use a user	name that does not work (for whatever reason) and then try 
+	another (possibly valid) user name.
+	Exit out of the network applet to close the initial connection and try again.</P
+><P
+>Further, if the machine is a already a 'member of a workgroup' that is the 
+        same name as the domain you are joining (bad idea) you will get this message.
+        Change the workgroup name to something else, it does not matter what, reboot,
+        and try again.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN194"
+>I get told "Cannot join domain, the credentials supplied conflict
+                with an existing set.."</A
+></H2
+><P
+>This is the same basic problem as mentioned above, <A
+HREF="#AEN190"
+>        "You already have a connection..."</A
+></P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN198"
+>"The system can not log you on (C000019B)...."</A
+></H2
+><P
+>I joined the domain successfully but after upgrading to a newer version of the 
+	Samba code I get the message, "The system can not log you on (C000019B), Please try a
+	gain or consult your system administrator" when attempting to logon.</P
+><P
+>This occurs when the domain SID stored in private/WORKGROUP.SID is changed.  
+	For example, you remove the file and smbd automatically creates a new one.   
+	Or you are swapping back and forth between versions 2.0.7, TNG and the HEAD branch
+	code (not recommended).  The only way to correct the problem is to restore the 
+	original domain SID or 	remove the domain client from the domain and rejoin.</P
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="CHAPTER"
+><HR><H1
+><A
+NAME="AEN202"
+>Chapter 4. User Account Management</A
+></H1
+><DIV
+CLASS="SECT1"
+><H1
+CLASS="SECT1"
+><A
+NAME="AEN204"
+>Domain Admins</A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN206"
+>How do I configure an account as a domain administrator?</A
+></H2
+><P
+>See the NTDom <A
+HREF="samba-pdc-howto.html"
+TARGET="_top"
+>HowTo</A
+>.</P
+></DIV
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H1
+CLASS="SECT1"
+><A
+NAME="AEN210"
+>Profiles</A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN212"
+>Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ?</A
+></H2
+><P
+>Sometimes Windows clients will maintain a connection to the \\homes\ ( or [%U] ) share 
+	even after the user has logged out. Consider the following scenario.</P
+><P
+></P
+><UL
+><LI
+><P
+> user1 logs into the Windows NT machine.  Therefore the 
+		[homes] share is set to \\server\user1.</P
+></LI
+><LI
+><P
+> user1 works for a while and then logs out. </P
+></LI
+><LI
+><P
+> user2 logs into the same Windows NT  machine.</P
+></LI
+></UL
+><P
+>However, since the NT box has maintained a connection to [homes] which was 
+	previously set to \\server\user1, when the operating system attempts to 
+	get the profile and if it can read users1's profile, will get it otherwise it 
+	will return an error. You get the picture.</P
+><P
+>A better solution is to use a separate [profiles] share and set the 
+	"logon path = \\%N\profiles\%U" </P
+><DIV
+CLASS="NOTE"
+><BLOCKQUOTE
+CLASS="NOTE"
+><P
+><B
+>Note: </B
+>Is this still a problem ????</P
+></BLOCKQUOTE
+></DIV
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN226"
+>Why are all the users listed in the "domain admin users" using the same profile?</A
+></H2
+><P
+>You are using a very very old development version of Samba. Upgrade.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN229"
+>The roaming profiles do not seem to be updating on the server.</A
+></H2
+><P
+>There can be several reasons for this.</P
+><P
+>Make sure that the time on the client and the PDC are synchronized.  You can accomplish 
+	this by executing a <B
+CLASS="COMMAND"
+>net time  \\server /set /yes</B
+> replacing server with the 
+	name of your PDC (or another synchronized SMB server). See <A
+HREF="#AEN320"
+>    about Setting Time</A
+></P
+><P
+>Make sure that the 
+	logon path is writeable by the user and make sure that the connection to the logon 
+	path location is by the current user.   Sometimes Windows client do not drop the 
+	connection immediately upon logoff.</P
+><P
+>Some people have reported that the logon path location should also be browseable.   
+	I (GC) have yet to emperically verify this, but you can try.</P
+></DIV
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H1
+CLASS="SECT1"
+><A
+NAME="AEN237"
+>Policies</A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN239"
+>What are 'Policies' ?.</A
+></H2
+><P
+>When a user logs onto the domain via a client machine, the PDC sends  
+    the client machine a list of things contained in the 'policy' (if it exists).
+    This list may do things like suppress a splach screen, format the dates the way you 
+    like them or perhaps remove locally stored profiles.</P
+><P
+>On a samba PDC this list is obtained from a file called <B
+CLASS="COMMAND"
+>ntconfig.pol</B
+>
+    and located in the <B
+CLASS="COMMAND"
+>[netlogon]</B
+>share. The file is created with a policy editor
+    and must be readable by anyone and writeable by only root. See <A
+HREF="#AEN260"
+>    below</A
+> for how  to get a suitable editor.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN246"
+>I can't get system policies to work.</A
+></H2
+><P
+>There are two possible reasons for system policies not functioning correctly. 
+     Make sure that you have the following parameters set in smb.conf </P
+><PRE
+CLASS="PROGRAMLISTING"
+>	[netlogon]
+	....
+	locking = no
+	public = no
+	browseable = yes
+	....   
+    </PRE
+><P
+>A policy file must be in the <B
+CLASS="COMMAND"
+>[netlogon]</B
+> share and must be 
+    readable by everyone and writeable by only root. The file must be created
+    by an NTServer <A
+HREF="#AEN260"
+>Policy Editor</A
+>.</P
+><P
+>Last time I (drb) looked in the source, it was
+	looking for <TT
+CLASS="FILENAME"
+>ntconfig.pol</TT
+> first then several other combinations of upper
+	and lower case. People have reported success using <TT
+CLASS="FILENAME"
+>NTconfig.pol</TT
+>, 
+	<TT
+CLASS="FILENAME"
+>NTconfig.POL</TT
+> and <TT
+CLASS="FILENAME"
+>ntconfig.pol</TT
+>.   These are the case 
+    settings that I (GC) use with the
+	filename <TT
+CLASS="FILENAME"
+>ntconfig.pol</TT
+></P
+><PRE
+CLASS="PROGRAMLISTING"
+>        case sensitive = no
+        case preserve = yes
+        default case = yes
+    </PRE
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN260"
+>What about Windows NT Policy Editor ?</A
+></H2
+><P
+>To create or edit <B
+CLASS="COMMAND"
+>ntconfig.pol</B
+> you must use the NT Server 
+    Policy Editor, <B
+CLASS="COMMAND"
+>poledit.exe</B
+>	which is included with NT Server 
+    but <I
+CLASS="EMPHASIS"
+>not NT Workstation</I
+>. There is a Policy Editor on a NTws 
+    but it is not suitable for creating <I
+CLASS="EMPHASIS"
+>Domain Policies</I
+>. 
+    Further, although the Windows 95 
+	Policy Editor can be installed on an NT Workstation/Server, it will not
+	work with NT policies because the registry key that are set by the policy templates. 
+	However, the files from the NT Server will run happily enough on an NTws. 
+	You need <TT
+CLASS="FILENAME"
+>poledit.exe, common.adm</TT
+> and <TT
+CLASS="FILENAME"
+>winnt.adm</TT
+>. It is convenient
+    to put the two *.adm files in <TT
+CLASS="FILENAME"
+>c:\winnt\inf</TT
+> which is where
+    the binary will look for them unless told otherwise. Note also that that 
+    directory is 'hidden'.</P
+><P
+>The Windows NT policy editor is also included with the 
+	Service Pack 3 (and later) for Windows NT 4.0. Extract the files using 
+    <B
+CLASS="COMMAND"
+>servicepackname /x</B
+>, ie thats <B
+CLASS="COMMAND"
+>Nt4sp6ai.exe /x</B
+>
+    for service pack 6a.  
+	The policy editor, <B
+CLASS="COMMAND"
+>poledt.exe</B
+> and the associated template files (*.adm) should
+	be extracted as well.  It is also possible to downloaded the policy template 
+	files for Office97 and get a copy of the policy editor.  Another possible 
+	location is with the Zero Administration Kit available for download from Microsoft.
+    </P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN274"
+>Can Win95 do Policies ?</A
+></H2
+><P
+>Install the group policy handler for Win9x to pick up group policies. 
+    Look on the Win98 CD in <TT
+CLASS="FILENAME"
+>	\tools\reskit\netadmin\poledit</TT
+>. Install group policies on a Win9x client by double-clicking 
+	<TT
+CLASS="FILENAME"
+>grouppol.inf</TT
+>. Log off and on again a couple of times and see if 
+    Win98 picks up group policies. 
+	Unfortunately this needs to be done on every Win9x machine that uses group policies....</P
+><P
+>If group policies don't work one reports suggests getting the updated (read: working) 
+	grouppol.dll for Windows 9x. The group list is grabbed from /etc/group.</P
+></DIV
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H1
+CLASS="SECT1"
+><A
+NAME="AEN280"
+>Passwords</A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN282"
+>What is password sync and should I use it ?</A
+></H2
+><P
+>NTws users can change their domain password by pressing Ctrl-Alt-Del and
+    choosing 'Change Password'. By default however, this does not change the unix password 
+    (typically in <TT
+CLASS="FILENAME"
+>/etc/passwd or /etc/shadow</TT
+>). In lots of situations
+    thats OK, for example :</P
+><P
+></P
+><UL
+><LI
+><P
+>The server is only accessible to the user via samba.</P
+></LI
+><LI
+><P
+>Pam_smb or similar is installed so other applications 
+        still refer to the samba password.</P
+></LI
+></UL
+><P
+>But sometimes you really do need to maintain two seperate password databases and
+    there are good reasons to keep then in sync.  Trying to explain to users
+	that they need to change their passwords in two seperate places or use 
+    two seperate passwords is not fun.</P
+><P
+>However do understand that setting up password sync is not without problems either. 
+    The chief difficulty is the interface between Samba and the <B
+CLASS="COMMAND"
+>passwd</B
+> command, 
+	it can be a fiddle to set up and if the password the user has entered fails, 
+	the resulting errors are ambiguously reported
+	and the user is confused. Further, you need to take steps to ensure that users
+    only ever change their passwords via samba (or use <B
+CLASS="COMMAND"
+>smbpasswd</B
+>),
+    otherwise they will only be changing the unix password.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN295"
+>How do I get remote password (unix and SMB) changing working ?</A
+></H2
+><P
+>Have a practice changing a user's password (as root) to see what 
+	discussion takes place and change the text in the 'passwd chat' line below  as necessary. The
+    line as shown works for recent RH Linux but most other systems seem to like to do something
+    different. The '*' is a wild card and will match anything (or nothing).
+	</P
+><P
+>Add these lines to smb.conf under [Global]</P
+><PRE
+CLASS="PROGRAMLISTING"
+> 
+
+		unix password sync = true
+   		passwd program = /usr/bin/passwd %u
+   		passwd chat = *password* %n\n *password* %n\n *successful*
+	</PRE
+><P
+>As mentioned above, the change to the unix password 
+	happens as root, not as the user, as is indicated in ~/smbd/chgpasswd.c  If
+	you are using NIS, the Samba server must be running on the NIS master machine.</P
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="CHAPTER"
+><HR><H1
+><A
+NAME="AEN301"
+>Chapter 5. Miscellaneous</A
+></H1
+><DIV
+CLASS="SECT1"
+><H1
+CLASS="SECT1"
+><A
+NAME="AEN303"
+></A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN305"
+>How do I get 'User Manager' and 'Server Manager'</A
+></H2
+><P
+>Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for
+	Domains', the 'Server Manager' ?</P
+><P
+></P
+><P
+><B
+>Microsoft distributes a version of these tools called nexus 
+    for installation on Windows 95 systems.  The tools set includes</B
+></P
+><UL
+><LI
+><P
+>Server Manager</P
+></LI
+><LI
+><P
+>User Manager for Domains</P
+></LI
+><LI
+><P
+>Event Viewer</P
+></LI
+></UL
+><P
+>Click here to download the archived file 
+        <A
+HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE"
+TARGET="_top"
+>        ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A
+></P
+><P
+>The Windows NT 4.0 version of the 'User Manager for Domains' 
+        and 'Server Manager' are available from Microsoft via ftp from 
+        <A
+HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE"
+TARGET="_top"
+>        ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A
+></P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN320"
+>The time setting from a Samba server does not work.</A
+></H2
+><P
+>If it works OK when you log on as Domain Admin then the problem is that ordinary users
+	don't have permission to change the time. (The system is running with their permission
+	at logon time.) This is not a Samba problem, you will have the same problem where ever
+	you connect. You can give 'everyone' permission to change the time from the User Manager.
+	</P
+><P
+>Anyone know what the registry settings are so this could be done with a Policy ?</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN324"
+>"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A
+></H2
+><P
+>I keep getting the message "trust account xxx should be in DOMAIN_GROUP_RID_USERS." 
+	in the logs. What do I need to do?</P
+><P
+>You are using one of the old development versions. Upgrade. 
+	(The message is unimportant, was a reminder to a developer)</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN328"
+>How do I get my samba server to become a member ( not PDC ) of an NT domain?</A
+></H2
+><P
+>In a domain that has a number of servers you only need one password database. 
+	The machines that don't have their own ask the PDC  to check for them.
+    This will work fine for a domain controlled by either a Samba or NT machine.
+	The following lines in smb.conf are typical, 'password server' points to the 
+	samba machine (or an NT) that has the password list : </P
+><PRE
+CLASS="PROGRAMLISTING"
+> 
+
+		[global]
+		...
+		security = domain
+		workgroup = { Put your domain name here }
+		password server = { Put the ip of the PDC here }
+		encrypt passwords = yes
+		...	
+	</PRE
+><P
+>The samba server in question will have to 'join the domain', that requires 
+	the domain controller to have a machine	account for it. This is no different 
+	to the machine account requirements to allow a NTws to join the domain. For
+	example, if we want a unix box called <I
+CLASS="EMPHASIS"
+>sleepy</I
+> to ask the PDC called <I
+CLASS="EMPHASIS"
+>grumpy</I
+> 
+	to do its authentication then <I
+CLASS="EMPHASIS"
+>grumpy</I
+> will need an entry in its smbpasswd 
+	(assuming it's also samba) that starts with <I
+CLASS="EMPHASIS"
+>sleepy$</I
+>. It would have to be
+    created <A
+HREF="#AEN171"
+>manually</A
+>. </P
+><P
+>If the domain is controlled by an NTServer then the "Server Manager for Domains"
+    tool must be used to add 'sleepy' to the domain list.</P
+><P
+>In either case we then join the domain. If the domain is called <I
+CLASS="EMPHASIS"
+>forest</I
+>
+	then on sleepy we would join the domain by typing :</P
+><P
+><B
+CLASS="COMMAND"
+>smbpasswd -j forest</B
+></P
+><P
+>Note that the directory where the smbpasswd file would be 
+	located should exist as this is where smbd will generate the MACHINE.SID file. This
+    might be <TT
+CLASS="FILENAME"
+>/usr/local/samba/private/FOREST.SLEEPY.SID</TT
+> and
+    it contains the trust account password for the domain member. The permissions are
+    (and should remain) "rw-------</P
+><P
+>Note the Samba Servers without the password list will most likely still need an account 
+	for each user, this means a line in its <TT
+CLASS="FILENAME"
+>/etc/passwd</TT
+>. Because authentication
+    is being handled at the domain level the 
+	<TT
+CLASS="FILENAME"
+>/etc/passwd</TT
+> line does not need a password.
+	If the shares being offered are not user specific, ie a common (read only ?) 
+	area or perhaps just printing then the user's
+	<TT
+CLASS="FILENAME"
+>/etc/passwd</TT
+> does not need a home directory. A typical 
+	line in <TT
+CLASS="FILENAME"
+>/etc/passwd</TT
+> for a server that allows domain users to
+	connect to the samba shares but does not offer a home share ('cos that's on the PDC) 
+	and does not allow logon to the unix prompt would be like this :</P
+><PRE
+CLASS="PROGRAMLISTING"
+>jblow:x:542:100:Joe Blow:/dev/null:/bin/false</PRE
+><DIV
+CLASS="NOTE"
+><BLOCKQUOTE
+CLASS="NOTE"
+><P
+></P
+><UL
+><LI
+><P
+>When removing those 'dummy' users, watch the 'remove user' scripts, 
+	some OS think they should remove a users directory even when its not owned by the user !
+	</P
+></LI
+><LI
+><P
+>The <TT
+CLASS="FILENAME"
+>username map = </TT
+> parameter might help you to avoid having 
+    all those accounts created.</P
+></LI
+><LI
+><P
+>You should investigate the smb.conf parameter 
+	    <TT
+CLASS="FILENAME"
+>'add user script'</TT
+>, it will be used to create accounts on 
+	    secondary servers when that account already exists on the PDC. Very nice.
+        Something like :</P
+><PRE
+CLASS="PROGRAMLISTING"
+>    [Global]
+    ....
+    add user script = /usr/sbin/adduser -n -g users -c User -d /dev/null -s /bin/false %U	
+    ....
+        </PRE
+></LI
+></UL
+></BLOCKQUOTE
+></DIV
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="CHAPTER"
+><HR><H1
+><A
+NAME="AEN363"
+>Chapter 6. Troubleshooting and Bug Reporting</A
+></H1
+><DIV
+CLASS="SECT1"
+><H1
+CLASS="SECT1"
+><A
+NAME="AEN365"
+>Diagnostic tools</A
+></H1
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="AEN367"
+>What are some diagnostics tools I can use to debug the domain logon process and where can I
+	find them?</A
+></H2
+><P
+>One of the best diagnostic tools for debugging problems is Samba itself.  You can use the -d 
+	option for both smbd and nmbd to specifiy what 'debug level' at which to run.  See the man 
+	pages on smbd, nmbd  and smb.conf for more information on debugging options.  The debug 
+	level can range from 1 (the default) to around 100 but a debug level of about 20 will 
+	normally help you find any errors that samba is encountering. Another helpful method 
+	of debugging is to compile samba using the gcc -g flag.   This will include debug 
+	information in the binaries and allow you to attch gdb to the running smbd / nmbd 
+	process.  In order to attach gdb to an smbd process for an NT workstation, first 
+	get the workstation to make the connection. Pressing ctrl-alt-delete and going down 
+	to the domain box is sufficient (at least, on the first time you join the domain) to 
+	generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation maintains an open 
+	connection, and therefore there will be an smbd process running (assuming that you 
+	haven't set a really short smbd idle timeout)  So, in between pressing ctrl alt 
+	delete, and actually typing in your password, you can gdb attach and continue.</P
+><P
+>An SMB enabled version of tcpdump is available from 
+    <A
+HREF="ftp://samba.org/pub/samba/tcpdump-smb/"
+TARGET="_top"
+>ftp://samba.org/pub/samba/tcpdump-smb/
+    </A
+></P
+><P
+>Capconvert is a small C program for translating output from tcpdump-smb to CAP format 
+	that can be read by netmon. You will need to use the raw output from tcp dump 
+	( ie. <B
+CLASS="COMMAND"
+>tcpdump -w output.dump</B
+> ).  Good news!  Now you can convert
+     Solaris' snoop output as well.   The C source code for snoop2cap is available for download.
+    </P
+><P
+>For tracing things on the Microsoft Windows NT, Network Monitor (aka. netmon) is available 
+	on the Microsoft Developer Network CD's, the Windows NT Server install CD and the SMS CD's.  
+	The version of netmon that ships with SMS allows for dumping packets between any two 
+	computers (ie. placing the network interface in promiscuous mode).  The version 
+	on the NT Server install CD will only allow monitoring of network traffic directed to the 
+	local NT box and broadcasts on the local subnet.</P
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN375"
+>How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box?</A
+></H2
+><P
+>Installing netmon on an NT workstation requires a couple of steps.  The following 
+	are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server 
+	4.0, on Microsoft Windows NT Workstation 4.0.  The process should be similar
+	for other version of Windows NT / Netmon.  You will need both the Microsoft Windows 
+	NT Server 4.0 Install CD and the Workstation 4.0 Install CD.</P
+><P
+>Initially you will need to install 'Network Monitor Tools and Agent' on the 
+    NT Server.  To do this </P
+><P
+></P
+><UL
+><LI
+><P
+>Goto Start - Settings - Control Panel - Network - Services - Add </P
+></LI
+><LI
+><P
+>Select the 'Network Monitor Tools and Agent' and click on 'OK'.</P
+></LI
+><LI
+><P
+>Click 'OK' on the Network Control Panel.</P
+></LI
+><LI
+><P
+>Insert the Windows NT Server 4.0 install CD when prompted.</P
+></LI
+></UL
+><P
+>At this point the Netmon files should exist in <TT
+CLASS="FILENAME"
+>%SYSTEMROOT%\System32\netmon\*.*</TT
+>.    
+	Two subdirectories exist as well, <TT
+CLASS="FILENAME"
+>parsers\</TT
+> which contains the necessary DLL's 
+	for parsing the netmon packet dump, and <TT
+CLASS="FILENAME"
+>captures\</TT
+>.</P
+><P
+>In order to install the Netmon tools on an NT Workstation, you will first need to 
+	install the 'Network  Monitor Agent' from the Workstation install CD.</P
+><P
+></P
+><UL
+><LI
+><P
+>Goto Start - Settings - Control Panel - Network - Services - Add</P
+></LI
+><LI
+><P
+>Select the 'Network Monitor Agent' and click on 'OK'.</P
+></LI
+><LI
+><P
+>Click 'OK' on the Network Control Panel.</P
+></LI
+><LI
+><P
+>Insert the Windows NT Workstation 4.0 install CD when prompted.</P
+></LI
+></UL
+><P
+>Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* to
+	%SYSTEMROOT%\System32\netmon\*.* on the Workstation and set permissions as 
+	you deem appropriate for your site. You will need administrative rights on the 
+	NT box to run netmon.</P
+><P
+>To install Netmon on a Windows 9x box install the network monitor agent from 
+	the Windows 9x CD (\admin\nettools\netmon).   
+	There is a readme file located with the netmon driver files on the CD if you need 
+	information on how to do this.  Copy the files from a working Netmon installation.</P
+></DIV
+></DIV
+><DIV
+CLASS="SECT1"
+><HR><H1
+CLASS="SECT1"
+><A
+NAME="AEN404"
+>What other help can I get ?</A
+></H1
+><P
+>There are many sources of information available in the form of mailing lists, RFC's 
+	and documentation.  The docs that come with the samba distribution contain very 
+	good explanations of general SMB topics such as browsing.</P
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN407"
+>URLs and similar</A
+></H2
+><P
+></P
+><UL
+><LI
+><P
+>Home of Samba site <A
+HREF="http://samba.org"
+TARGET="_top"
+>        http://samba.org</A
+>. We have a mirror near you !</P
+></LI
+><LI
+><P
+> The <I
+CLASS="EMPHASIS"
+>Development</I
+> document 
+		on the Samba mirrors might mention your problem. If so,
+		it might mean that the developers are working on it.</P
+></LI
+><LI
+><P
+> Ignacio Coupeau has a very comprehesive look at LDAP with Samba at 
+		<A
+HREF="http://www.unav.es/cti/ldap-smb-howto.html"
+TARGET="_top"
+>		http://www.unav.es/cti/ldap-smb-howto.html</A
+> 
+		Be a little carefull however, I suspect that it does not specificly 
+		address samba 2.2.x. The HEAD pre-2.1 may possibly be the best
+		stream to look at.</P
+></LI
+><LI
+><P
+>  Lars Kneschke's site covers <A
+HREF="http://www.samba-tng.org"
+TARGET="_top"
+>        Samba-TNG</A
+> at 
+		<A
+HREF="http://www.kneschke.de/projekte/samba_tng"
+TARGET="_top"
+>		http://www.kneschke.de/projekte/samba_tng</A
+>, but again, a 
+		lot of it does not apply to the main stream Samba.</P
+></LI
+><LI
+><P
+>Although 2.0.7 has almost had its day as a PDC, I (drb) will
+        keep the 2.0.7 PDC pages at <A
+HREF="http://bioserve.latrobe.edu.au/samba"
+TARGET="_top"
+>        http://bioserve.latrobe.edu.au/samba</A
+> going for a while yet.</P
+></LI
+><LI
+><P
+>Misc links to CIFS information 
+        <A
+HREF="http://samba.org/cifs/"
+TARGET="_top"
+>http://samba.org/cifs/</A
+></P
+></LI
+><LI
+><P
+>NT Domains for Unix <A
+HREF="http://mailhost.cb1.com/~lkcl/ntdom/"
+TARGET="_top"
+>        http://mailhost.cb1.com/~lkcl/ntdom/</A
+></P
+></LI
+><LI
+><P
+>FTP site for older SMB specs: 
+        <A
+HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/"
+TARGET="_top"
+>        ftp://ftp.microsoft.com/developr/drg/CIFS/</A
+></P
+></LI
+></UL
+><P
+></P
+><P
+><B
+>There are a number of documents that no longer appear to live at their
+    origional home. Any one know where the following may be found ?</B
+></P
+><UL
+><LI
+><P
+>CIFS/E Browser Protocol draft-leach-cifs-browser-spec-00.txt</P
+></LI
+><LI
+><P
+>CIFS Remote Administration Protocol draft-leach-cifs-rap-spec-00.txt</P
+></LI
+><LI
+><P
+>CIFS Logon and Pass Through Authentication draft-leach-cifs-logon-spec-00.txt</P
+></LI
+><LI
+><P
+>A Common Internet File System (CIFS/1.0) Protocol draft-leach-cifs-v1-spec-01.txt</P
+></LI
+><LI
+><P
+>CIFS Printing Specification draft-leach-cifs-print-spec-00.txt</P
+></LI
+><LI
+><P
+>RFC1001 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Concepts and methods.
+     http://ds.internic.net/rfc/rfc1001.txt </P
+></LI
+><LI
+><P
+>RFC1002 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Detailed specifications.
+     http://ds.internic.net/rfc/rfc1002.txt </P
+></LI
+><LI
+><P
+>Microsoft's main CIFS page: http://www.microsoft.com/workshop/networking/cifs/</P
+></LI
+></UL
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN453"
+>How do I get help from the mailing lists ?</A
+></H2
+><P
+> There are a number of Samba related mailing lists. Go to <A
+HREF="http://samba.org"
+TARGET="_top"
+>http://samba.org</A
+>, click on your nearest mirror
+        and then click on <B
+CLASS="COMMAND"
+>Support</B
+> and then click on <B
+CLASS="COMMAND"
+>        Samba related mailing lists</B
+>.</P
+><P
+>For questions relating to Samba TNG go to
+        <A
+HREF="http://www.samba-tng.org/"
+TARGET="_top"
+>http://www.samba-tng.org/</A
+> 
+	    It has been requested that you don't post questions about Samba-TNG to the
+        main stream Samba lists.</P
+><P
+></P
+><P
+><B
+>If you post a message to one of the lists please
+	 observe the following guide lines :</B
+></P
+><UL
+><LI
+><P
+> Always remember that the developers are volunteers, they are 
+		not paid and they never guarantee to produce a particular feature at 
+		a particular time. Any time lines are 'best guess' and nothing more.
+		</P
+></LI
+><LI
+><P
+> Always mention what version of samba you are using and what 
+		operating system its running under. You should probably list the
+        relevant sections of your smb.conf file, at least the options 
+        in [global] that affect PDC support.</P
+></LI
+><LI
+><P
+>In addition to the version, if you obtained Samba via
+        CVS mention the date when you last checked it out.</P
+></LI
+><LI
+><P
+> Try and make your question clear and brief, lots of long, 
+		convoluted questions get deleted before	they are completely read ! 
+		Don't post html encoded messages (if you can select colour or font 
+		size its html).</P
+></LI
+><LI
+><P
+> If you run one of those niffy 'I'm on holidays' things when 
+		you are away, make sure its configured	to not answer mailing lists.
+		</P
+></LI
+><LI
+><P
+> Don't cross post. Work out which is the best list to post to 
+		and see what happens, ie don't post to both samba-ntdom and samba-technical.
+        Many people active on the lists subscribe to more 
+		than one list and get annoyed to see the same message two or more times. 
+		Often someone will see a message and thinking it would be better dealt 
+		with on another, will forward it on for you.</P
+></LI
+><LI
+><P
+>You might include <I
+CLASS="EMPHASIS"
+>partial</I
+>
+        log files written at a debug level set to as much as 20.  
+        Please don't send the entire log but enough to give the context of the 
+        error messages.</P
+></LI
+><LI
+><P
+>(Possibly) If you have a complete netmon trace ( from the opening of 
+        the pipe to the error ) you can send the *.CAP file as well.</P
+></LI
+><LI
+><P
+>Please think carefully before attaching a document to an email.
+        Consider pasting the relevant parts into the body of the message. The samba
+        mailing lists go to a huge number of people, do they all need a copy of your 
+        smb.conf in their attach directory ?</P
+></LI
+></UL
+></DIV
+><DIV
+CLASS="SECT2"
+><HR><H2
+CLASS="SECT2"
+><A
+NAME="AEN482"
+>How do I get off the mailing lists ?</A
+></H2
+><P
+>To have your name removed from a samba mailing list, go to the
+        same place you went to to get on it. Go to <A
+HREF="http://samba.org"
+TARGET="_top"
+>http://samba.org</A
+>, click on your nearest mirror
+        and then click on <B
+CLASS="COMMAND"
+>Support</B
+> and then click on <B
+CLASS="COMMAND"
+>        Samba related mailing lists</B
+>. Or perhaps see 
+        <A
+HREF="http://lists.samba.org/mailman/roster/samba-ntdom"
+TARGET="_top"
+>here</A
+></P
+><P
+>Please don't post messages to the list asking to be removed, you will just
+        be refered to the above address (unless that process failed in some way...)
+    </P
+></DIV
+></DIV
+></DIV
+></DIV
+></BODY
+></HTML
+>
+\ No newline at end of file
author	David Bannon <dbannon@samba.org>	2000-11-28 06:18:04 +0000
committer	David Bannon <dbannon@samba.org>	2000-11-28 06:18:04 +0000
commit	e28ad8f1d5a4c701d021f0e4a7893920eb021b6f (patch)
tree	ace499c5fa40e6287eb151145dae593500336479 /docs/htmldocs
parent	a149c6b02534e417e324fc58e79dcca4553e2fe1 (diff)
download	samba-e28ad8f1d5a4c701d021f0e4a7893920eb021b6f.tar.gz samba-e28ad8f1d5a4c701d021f0e4a7893920eb021b6f.tar.bz2 samba-e28ad8f1d5a4c701d021f0e4a7893920eb021b6f.zip