first pass at updating head branch to be to be the same as the SAMBA_2_0 branch

(This used to be commit 453a822a76780063dff23526c35408866d0c0154)
author: Andrew Tridgell <tridge@samba.org> 1999-12-13 13:27:58 +0000
committer: Andrew Tridgell <tridge@samba.org> 1999-12-13 13:27:58 +0000
commit: 3db52feb1f3b2c07ce0b06ad4a7099fa6efe3fc7 (patch)
tree: 866dd15416c3d8554bb207709f433a87ad0c012d /docs
parent: f6276724bafdb6145c0c7b565172d80cb04516ea (diff)
download: samba-3db52feb1f3b2c07ce0b06ad4a7099fa6efe3fc7.tar.gz
samba-3db52feb1f3b2c07ce0b06ad4a7099fa6efe3fc7.tar.bz2
samba-3db52feb1f3b2c07ce0b06ad4a7099fa6efe3fc7.zip
74 files changed, 2776 insertions, 1686 deletions
diff --git a/docs/announce b/docs/announce
index 6548a51554..856fd00036 100644
--- a/docs/announce
+++ b/docs/announce
@@ -1,4 +1,4 @@
-		Announcing Samba version 1.9
+		Announcing Samba version 2.0
 		============================
 
 What is Samba?
@@ -47,10 +47,12 @@ umask support, guest connections, name mangling and hidden and system
 attribute mapping. Look at the FAQs included with the package for
 a full list of features.
 
-What's new since 1.8?
+What's new since 1.9?
 ---------------------
 
 Lots of stuff. See the change log and man pages for details.
+In particular, please check the WHATSNEW.txt file in the root directory
+of each release. This file has current change/update information.
 
 Where can I get a client for my PC?
 -----------------------------------
@@ -136,7 +138,7 @@ There is also often quite a bit of discussion about Samba on the
 newsgroup comp.protocols.smb.
 
 A WWW site with lots of Samba info can be found at 
-http://samba.org/
+http://samba.org/samba/
 
 The Samba Team (Contact: samba-bugs@samba.org)
 June 1996
diff --git a/docs/faq/sambafaq-2.html b/docs/faq/sambafaq-2.html
index dfababb66a..d78f5d627c 100644
--- a/docs/faq/sambafaq-2.html
+++ b/docs/faq/sambafaq-2.html
@@ -18,14 +18,11 @@
 <P>
 <A NAME="no_browse"></A> 
 
-See 
-<A HREF="ftp://samba.org/pub/samba/BROWSING.txt">BROWSING.txt</A>
-for more information on browsing.  Browsing.txt can also be found
-in the docs directory of the Samba source.</P>
-<P>If your GUI client does not permit you to select non-browsable
-servers, you may need to do so on the command line. For example, under
-Lan Manager you might connect to the above service as disk drive M:
-thusly:
+See BROWSING.txt for more information on browsing.  BROWSING.txt can
+be found in the docs directory of the Samba source.</P> <P>If your GUI
+client does not permit you to select non-browsable servers, you may
+need to do so on the command line. For example, under Lan Manager you
+might connect to the above service as disk drive M: thusly:
 <BLOCKQUOTE><CODE>
 <PRE>
    net use M: \\mary\fred
diff --git a/docs/htmldocs/DOMAIN_MEMBER.html b/docs/htmldocs/DOMAIN_MEMBER.html
index 6d9741f2f2..409534c99e 100644
--- a/docs/htmldocs/DOMAIN_MEMBER.html
+++ b/docs/htmldocs/DOMAIN_MEMBER.html
@@ -13,7 +13,7 @@
 
 <h1>Joining an NT Domain with Samba 2.0</h1>
 <h2>Jeremy Allison, Samba Team</h2>
-<h2>11th November 1998</h2>
+<h2>7th October 1999</h2>
 
     
  
@@ -23,7 +23,8 @@
 <p><br>In order for a Samba-2 server to join an NT domain, you must first add
 the NetBIOS name of the Samba server to the NT domain on the PDC using
 Server Manager for Domains.  This creates the machine account in the
-domain (PDC) SAM.
+domain (PDC) SAM. Note that you should add the Samba server as a "Windows
+NT Workstation or Server", <em>NOT</em> as a Primary or backup domain controller.
 <p><br>Assume you have a Samba-2 server with a NetBIOS name of <code>SERV1</code> and are
 joining an NT domain called <code>DOM</code>, which has a PDC with a NetBIOS name
 of <code>DOMPDC</code> and two backup domain controllers with NetBIOS names <code>DOMBDC1</code>
@@ -63,6 +64,9 @@ use domain security.
 <p><br>line in the <a href="smb.conf.5.html#global"><strong>[global]</strong></a> section to read: 
 <p><br><code>workgroup = DOM</code>
 <p><br>as this is the name of the domain we are joining. 
+<p><br>You must also have the parameter <a href="smb.conf.5.html#encryptpasswords"><strong>"encrypt passwords"</strong></a>
+set to <code>"yes"</code> in order for your users to authenticate to the
+NT PDC.
 <p><br>Finally, add (or modify) a:
 <p><br><a href="smb.conf.5.html#passwordserver"><strong>"password server ="</strong></a>
 <p><br>line in the <a href="smb.conf.5.html#global"><strong>[global]</strong></a> section to read: 
@@ -72,18 +76,13 @@ to contact in order to authenticate users. Samba will try to contact
 each of these servers in order, so you may want to rearrange this list
 in order to spread out the authentication load among domain
 controllers.
-<p><br>Currently, Samba requires that a defined list of domain controllers be
-listed in this parameter in order to authenticate with domain-level
-security. NT does not use this method, and will either broadcast or
-use a WINS database in order to find domain controllers to
+<p><br>Alternatively, if you want smbd to automatically determine the
+list of Domain controllers to use for authentication, you may set this line to be :
+<p><br><code>password server = *</code>
+<p><br>This method, which is new in Samba 2.0.6 and above, allows Samba
+to use exactly the same mechanism that NT does. This method either broadcasts or
+uses a WINS database in order to find domain controllers to
 authenticate against.
-<p><br>Originally, I considered this idea for Samba, but dropped it because
-it seemed so insecure.  However several Samba-2 alpha users have
-requested that this feature be added to make Samba more NT-like, so
-I'll probably add a special name of <code>'*'</code> (which means: act like NT
-when looking for domain controllers) in a future release of the
-code. At present, however, you need to know where your domain
-controllers are.
 <p><br>Finally, restart your Samba daemons and get ready for clients to begin
 using domain security!
 <p><br><center>Why is this better than security = server? </center>
diff --git a/docs/htmldocs/nmbd.8.html b/docs/htmldocs/nmbd.8.html
index 3139e90ad1..03fd3588e2 100644
--- a/docs/htmldocs/nmbd.8.html
+++ b/docs/htmldocs/nmbd.8.html
@@ -25,7 +25,7 @@ naming services to clients
 <p><br><a name="SYNOPSIS"></a>
 <h2>SYNOPSIS</h2>
     
-<p><br><strong>nmbd</strong> [<a href="nmbd.8.html#minusD">-D</a>] [<a href="nmbd.8.html#minuso">-o</a>] [<a href="nmbd.8.html#minusa">-a</a>] [<a href="nmbd.8.html#minusH">-H lmhosts file</a>] [<a href="nmbd.8.html#minusd">-d debuglevel</a>] [<a href="nmbd.8.html#minusl">-l log file basename</a>] [<a href="nmbd.8.html#minusn">-n primary NetBIOS name</a>] [<a href="nmbd.8.html#minusp">-p port number</a>] [<a href="nmbd.8.html#minuss">-s configuration file</a>] [<a href="nmbd.8.html#minusi">-i NetBIOS scope</a>] [<a href="nmbd.8.html#minush">-h</a>]
+<p><br><strong>nmbd</strong> [<a href="nmbd.8.html#minusD">-D</a>] [<a href="nmbd.8.html#minusa">-a</a>] [<a href="nmbd.8.html#minuso">-o</a>] [<a href="nmbd.8.html#minush">-h</a>] [<a href="nmbd.8.html#minusV">-V</a>] [<a href="nmbd.8.html#minusH">-H lmhosts file</a>] [<a href="nmbd.8.html#minusd">-d debuglevel</a>] [<a href="nmbd.8.html#minusl">-l log file basename</a>] [<a href="nmbd.8.html#minusn">-n primary NetBIOS name</a>] [<a href="nmbd.8.html#minusp">-p port number</a>] [<a href="nmbd.8.html#minuss">-s configuration file</a>] [<a href="nmbd.8.html#minusi">-i NetBIOS scope</a>]
 <p><br><a name="DESCRIPTION"></a>
 <h2>DESCRIPTION</h2>
     
@@ -70,6 +70,10 @@ append log messages to the log file.  This is the default.
 <li><strong><strong>-o</strong></strong> If this parameter is specified, the log files will be
 overwritten when opened.  By default, the log files will be appended
 to.
+<p><br><a name="minush"></a>
+<li><strong><strong>-h</strong></strong> Prints the help information (usage) for <strong>nmbd</strong>.
+<p><br><a name="minusV"></a>
+<li><strong><strong>-V</strong></strong> Prints the version number for <strong>nmbd</strong>.
 <p><br><a name="minusH"></a>
 <li><strong><strong>-H filename</strong></strong> NetBIOS lmhosts file.
 <p><br>The lmhosts file is a list of NetBIOS names to IP addresses that is
@@ -133,8 +137,6 @@ use of NetBIOS scopes, see rfc1001.txt and rfc1002.txt. NetBIOS scopes
 are <em>very</em> rarely used, only set this parameter if you are the
 system administrator in charge of all the NetBIOS systems you
 communicate with.
-<p><br><a name="minush"></a>
-<li><strong><strong>-h</strong></strong> Prints the help information (usage) for <strong>nmbd</strong>.
 <p><br></ul>
 <p><br><a name="FILES"></a>
 <h2>FILES</h2>
diff --git a/docs/htmldocs/nmblookup.1.html b/docs/htmldocs/nmblookup.1.html
index 5ff58e5b40..2c3e80c76e 100644
--- a/docs/htmldocs/nmblookup.1.html
+++ b/docs/htmldocs/nmblookup.1.html
@@ -24,7 +24,7 @@
 <p><br><a name="SYNOPSIS"></a>
 <h2>SYNOPSIS</h2>
      
-<p><br><strong>nmblookup</strong> [<a href="nmblookup.1.html#minusM">-M</a>] [<a href="nmblookup.1.html#minusR">-R</a>] [<a href="nmblookup.1.html#minusS">-S</a>] [<a href="nmblookup.1.html#minusr">-r</a>] [<a href="nmblookup.1.html#minusA">-A</a>] [<a href="nmblookup.1.html#minush">-h</a>] [<a href="nmblookup.1.html#minusB">-B broadcast address</a>] [<a href="nmblookup.1.html#minusU">-U unicast address</a>] [<a href="nmblookup.1.html#minusd">-d debuglevel</a>] [<a href="nmblookup.1.html#minuss">-s smb config file</a>] [<a href="nmblookup.1.html#minusi">-i NetBIOS scope</a>] <a href="nmblookup.1.html#name">name</a>
+<p><br><strong>nmblookup</strong> [<a href="nmblookup.1.html#minusM">-M</a>] [<a href="nmblookup.1.html#minusR">-R</a>] [<a href="nmblookup.1.html#minusS">-S</a>] [<a href="nmblookup.1.html#minusr">-r</a>] [<a href="nmblookup.1.html#minusA">-A</a>] [<a href="nmblookup.1.html#minush">-h</a>] [<a href="nmblookup.1.html#minusB">-B broadcast address</a>] [<a href="nmblookup.1.html#minusU">-U unicast address</a>] [<a href="nmblookup.1.html#minusd">-d debuglevel</a>] [<a href="nmblookup.1.html#minuss">-s smb config file</a>] [<a href="nmblookup.1.html#minusi">-i NetBIOS scope</a>] [<a href="nmblookup.1.html#minusT">-T</a>] <a href="nmblookup.1.html#name">name</a>
 <p><br><a name="DESCRIPTION"></a>
 <h2>DESCRIPTION</h2>
     
@@ -38,8 +38,9 @@ or to a particular machine. All queries are done over UDP.
     
 <p><br><ul>
 <p><br><a name="minusM"></a>
-<li><strong><strong>-M</strong></strong> Searches for a master browser. This is done by doing a
-broadcast lookup on the special name <code>__MSBROWSE__</code>.
+<li><strong><strong>-M</strong></strong> Searches for a master browser by looking up the 
+NetBIOS name <a href="nmblookup.1.html#name"><strong>name</strong></a> with a type of 0x1d. If <a href="nmblookup.1.html#name"><strong>name</strong></a>
+is <code>"-"</code> then it does a lookup on the special name <code>__MSBROWSE__</code>.
 <p><br><a name="minusR"></a>
 <li><strong><strong>-R</strong></strong> Set the recursion desired bit in the packet to do a
 recursive lookup. This is used when sending a name query to a machine
@@ -67,8 +68,8 @@ query on this address.
 <p><br><a name="minusB"></a>
 <li><strong><strong>-B broadcast address</strong></strong> Send the query to the given broadcast
 address. Without this option the default behavior of nmblookup is to
-send the query to the broadcast address of the primary network
-interface as either auto-detected or defined in the 
+send the query to the broadcast address of the network
+interfaces as either auto-detected or defined in the 
 <a href="smb.conf.5.html#interfaces"><strong>interfaces</strong></a> parameter of the 
 <a href="smb.conf.5.html"><strong>smb.conf (5)</strong></a> file.
 <p><br><a name="minusU"></a>
@@ -100,6 +101,11 @@ use of NetBIOS scopes, see rfc1001.txt and rfc1002.txt. NetBIOS scopes
 are <em>very</em> rarely used, only set this parameter if you are the
 system administrator in charge of all the NetBIOS systems you
 communicate with.
+<p><br><a name="minusT"></a>
+<li><strong><strong>-T</strong></strong> This causes any IP addresses found in the lookup to be
+looked up via a reverse DNS lookup into a DNS name, and printed out
+before each <code>"IP address   NetBIOS name"</code> pair that is the normal
+output.
 <p><br><a name="name"></a>
 <li><strong><strong>name</strong></strong> This is the NetBIOS name being queried. Depending upon
 the previous options this may be a NetBIOS name or IP address. If a
diff --git a/docs/htmldocs/samba.7.html b/docs/htmldocs/samba.7.html
index 2fc86fd65a..f197ccfa32 100644
--- a/docs/htmldocs/samba.7.html
+++ b/docs/htmldocs/samba.7.html
@@ -56,14 +56,6 @@ client. This is useful for accessing SMB shares on other compatible
 servers (such as Windows NT), and can also be used to allow a UNIX box
 to print to a printer attached to any SMB server (such as a PC running
 Windows NT).
-<p><br><li><strong><a href="rpcclient.1.html"><strong>rpcclient</strong></a></strong> <br> <br> The <a href="rpcclient.1.html"><strong>rpcclient</strong>
-(1)</a> program is a client that can 'talk' to an
-SMB/CIFS MSRPC server.  Operations include things like managing a SAM
-Database (users, groups and aliases) in the same way as the Windows NT
-programs <strong>User Manager for Domains</strong> and <strong>Server Manager for Domains</strong>;
-managing a remote registry in the same way as the Windows NT programs
-<strong>REGEDT32.EXE</strong> and <strong>REGEDIT.EXE</strong>; viewing a remote event log (same
-as <strong>EVENTVWR.EXE</strong>).
 <p><br><li><strong><a href="testparm.1.html"><strong>testparm</strong></a></strong> <br> <br> The <a href="testparm.1.html"><strong>testparm
 (1)</strong></a> utility allows you to test your <a href="smb.conf.5.html"><strong>smb.conf
 (5)</strong></a> configuration file.
diff --git a/docs/htmldocs/smb.conf.5.html b/docs/htmldocs/smb.conf.5.html
index f2f75170f8..521c70d653 100644
--- a/docs/htmldocs/smb.conf.5.html
+++ b/docs/htmldocs/smb.conf.5.html
@@ -204,6 +204,7 @@ would look like this:
 
  	[printers]
  		path = /usr/spool/public
+ 		writeable = no
  		guest ok = yes
  		printable = yes 
 
@@ -400,6 +401,8 @@ password.
 <p><br>Here is a list of all global parameters. See the section of each
 parameter for details.  Note that some are synonyms.
 <p><br><ul>
+<p><br><li > <a href="smb.conf.5.html#adduserscript"><strong>add user script</strong></a>
+<p><br><li > <a href="smb.conf.5.html#allowtrusteddomains"><strong>allow trusted domains</strong></a>
 <p><br><li > <a href="smb.conf.5.html#announceas"><strong>announce as</strong></a>
 <p><br><li > <a href="smb.conf.5.html#announceversion"><strong>announce version</strong></a>
 <p><br><li > <a href="smb.conf.5.html#autoservices"><strong>auto services</strong></a>
@@ -411,22 +414,24 @@ parameter for details.  Note that some are synonyms.
 <p><br><li > <a href="smb.conf.5.html#codingsystem"><strong>coding system</strong></a>
 <p><br><li > <a href="smb.conf.5.html#configfile"><strong>config file</strong></a>
 <p><br><li > <a href="smb.conf.5.html#deadtime"><strong>deadtime</strong></a>
+<p><br><li > <a href="smb.conf.5.html#debughirestimestamp"><strong>debug hires timestamp</strong></a>
+<p><br><li > <a href="smb.conf.5.html#debugpid"><strong>debug pid</strong></a>
 <p><br><li > <a href="smb.conf.5.html#debugtimestamp"><strong>debug timestamp</strong></a>
+<p><br><li > <a href="smb.conf.5.html#debuguid"><strong>debug uid</strong></a>
 <p><br><li > <a href="smb.conf.5.html#debuglevel"><strong>debuglevel</strong></a>
 <p><br><li > <a href="smb.conf.5.html#default"><strong>default</strong></a>
 <p><br><li > <a href="smb.conf.5.html#defaultservice"><strong>default service</strong></a>
+<p><br><li > <a href="smb.conf.5.html#deleteuserscript"><strong>delete user script</strong></a>
 <p><br><li > <a href="smb.conf.5.html#dfreecommand"><strong>dfree command</strong></a>
 <p><br><li > <a href="smb.conf.5.html#dnsproxy"><strong>dns proxy</strong></a>
 <p><br><li > <a href="smb.conf.5.html#domainadmingroup"><strong>domain admin group</strong></a>
 <p><br><li > <a href="smb.conf.5.html#domainadminusers"><strong>domain admin users</strong></a>
 <p><br><li > <a href="smb.conf.5.html#domaincontroller"><strong>domain controller</strong></a>
-<p><br><li > <a href="smb.conf.5.html#domaingroupmap"><strong>domain group map</strong></a>
 <p><br><li > <a href="smb.conf.5.html#domaingroups"><strong>domain groups</strong></a>
 <p><br><li > <a href="smb.conf.5.html#domainguestgroup"><strong>domain guest group</strong></a>
 <p><br><li > <a href="smb.conf.5.html#domainguestusers"><strong>domain guest users</strong></a>
 <p><br><li > <a href="smb.conf.5.html#domainlogons"><strong>domain logons</strong></a>
 <p><br><li > <a href="smb.conf.5.html#domainmaster"><strong>domain master</strong></a>
-<p><br><li > <a href="smb.conf.5.html#domainusermap"><strong>domain user map</strong></a>
 <p><br><li > <a href="smb.conf.5.html#encryptpasswords"><strong>encrypt passwords</strong></a>
 <p><br><li > <a href="smb.conf.5.html#getwdcache"><strong>getwd cache</strong></a>
 <p><br><li > <a href="smb.conf.5.html#homedirmap"><strong>homedir map</strong></a>
@@ -434,15 +439,15 @@ parameter for details.  Note that some are synonyms.
 <p><br><li > <a href="smb.conf.5.html#interfaces"><strong>interfaces</strong></a>
 <p><br><li > <a href="smb.conf.5.html#keepalive"><strong>keepalive</strong></a>
 <p><br><li > <a href="smb.conf.5.html#kerneloplocks"><strong>kernel oplocks</strong></a>
-<p><br><li > <a href="smb.conf.5.html#ldapbindas"><strong>ldap bind as</strong></a>
-<p><br><li > <a href="smb.conf.5.html#ldappasswdfile"><strong>ldap passwd file</strong></a>
+<p><br><li > <a href="smb.conf.5.html#ldapfilter"><strong>ldap filter</strong></a>
 <p><br><li > <a href="smb.conf.5.html#ldapport"><strong>ldap port</strong></a>
+<p><br><li > <a href="smb.conf.5.html#ldaproot"><strong>ldap root</strong></a>
+<p><br><li > <a href="smb.conf.5.html#ldaprootpasswd"><strong>ldap root passwd</strong></a>
 <p><br><li > <a href="smb.conf.5.html#ldapserver"><strong>ldap server</strong></a>
 <p><br><li > <a href="smb.conf.5.html#ldapsuffix"><strong>ldap suffix</strong></a>
 <p><br><li > <a href="smb.conf.5.html#lmannounce"><strong>lm announce</strong></a>
 <p><br><li > <a href="smb.conf.5.html#lminterval"><strong>lm interval</strong></a>
 <p><br><li > <a href="smb.conf.5.html#loadprinters"><strong>load printers</strong></a>
-<p><br><li > <a href="smb.conf.5.html#localgroupmap"><strong>local group map</strong></a>
 <p><br><li > <a href="smb.conf.5.html#localmaster"><strong>local master</strong></a>
 <p><br><li > <a href="smb.conf.5.html#lockdir"><strong>lock dir</strong></a>
 <p><br><li > <a href="smb.conf.5.html#lockdirectory"><strong>lock directory</strong></a>
@@ -455,6 +460,7 @@ parameter for details.  Note that some are synonyms.
 <p><br><li > <a href="smb.conf.5.html#lpqcachetime"><strong>lpq cache time</strong></a>
 <p><br><li > <a href="smb.conf.5.html#machinepasswordtimeout"><strong>machine password timeout</strong></a>
 <p><br><li > <a href="smb.conf.5.html#mangledstack"><strong>mangled stack</strong></a>
+<p><br><li > <a href="smb.conf.5.html#maptoguest"><strong>map to guest</strong></a>
 <p><br><li > <a href="smb.conf.5.html#maxdisksize"><strong>max disk size</strong></a>
 <p><br><li > <a href="smb.conf.5.html#maxlogsize"><strong>max log size</strong></a>
 <p><br><li > <a href="smb.conf.5.html#maxmux"><strong>max mux</strong></a>
@@ -464,15 +470,18 @@ parameter for details.  Note that some are synonyms.
 <p><br><li > <a href="smb.conf.5.html#maxwinsttl"><strong>max wins ttl</strong></a>
 <p><br><li > <a href="smb.conf.5.html#maxxmit"><strong>max xmit</strong></a>
 <p><br><li > <a href="smb.conf.5.html#messagecommand"><strong>message command</strong></a>
+<p><br><li > <a href="smb.conf.5.html#minpasswdlength"><strong>min passwd length</strong></a>
 <p><br><li > <a href="smb.conf.5.html#minwinsttl"><strong>min wins ttl</strong></a>
 <p><br><li > <a href="smb.conf.5.html#nameresolveorder"><strong>name resolve order</strong></a>
 <p><br><li > <a href="smb.conf.5.html#netbiosaliases"><strong>netbios aliases</strong></a>
 <p><br><li > <a href="smb.conf.5.html#netbiosname"><strong>netbios name</strong></a>
 <p><br><li > <a href="smb.conf.5.html#nishomedir"><strong>nis homedir</strong></a>
+<p><br><li > <a href="smb.conf.5.html#ntaclsupport"><strong>nt acl support</strong></a>
 <p><br><li > <a href="smb.conf.5.html#ntpipesupport"><strong>nt pipe support</strong></a>
 <p><br><li > <a href="smb.conf.5.html#ntsmbsupport"><strong>nt smb support</strong></a>
 <p><br><li > <a href="smb.conf.5.html#nullpasswords"><strong>null passwords</strong></a>
 <p><br><li > <a href="smb.conf.5.html#olelockingcompatibility"><strong>ole locking compatibility</strong></a>
+<p><br><li > <a href="smb.conf.5.html#oplockbreakwaittime"><strong>oplock break wait time</strong></a>
 <p><br><li > <a href="smb.conf.5.html#oslevel"><strong>os level</strong></a>
 <p><br><li > <a href="smb.conf.5.html#packetsize"><strong>packet size</strong></a>
 <p><br><li > <a href="smb.conf.5.html#panicaction"><strong>panic action</strong></a>
@@ -494,6 +503,7 @@ parameter for details.  Note that some are synonyms.
 <p><br><li > <a href="smb.conf.5.html#readsize"><strong>read size</strong></a>
 <p><br><li > <a href="smb.conf.5.html#remoteannounce"><strong>remote announce</strong></a>
 <p><br><li > <a href="smb.conf.5.html#remotebrowsesync"><strong>remote browse sync</strong></a>
+<p><br><li > <a href="smb.conf.5.html#restrictanonymous"><strong>restrict anonymous</strong></a>
 <p><br><li > <a href="smb.conf.5.html#root"><strong>root</strong></a>
 <p><br><li > <a href="smb.conf.5.html#rootdir"><strong>root dir</strong></a>
 <p><br><li > <a href="smb.conf.5.html#rootdirectory"><strong>root directory</strong></a>
@@ -535,6 +545,7 @@ parameter for details.  Note that some are synonyms.
 <p><br><li > <a href="smb.conf.5.html#validchars"><strong>valid chars</strong></a>
 <p><br><li > <a href="smb.conf.5.html#winsproxy"><strong>wins proxy</strong></a>
 <p><br><li > <a href="smb.conf.5.html#winsserver"><strong>wins server</strong></a>
+<p><br><li > <a href="smb.conf.5.html#winshook"><strong>wins hook</strong></a>
 <p><br><li > <a href="smb.conf.5.html#winssupport"><strong>wins support</strong></a>
 <p><br><li > <a href="smb.conf.5.html#workgroup"><strong>workgroup</strong></a>
 <p><br><li > <a href="smb.conf.5.html#writeraw"><strong>write raw</strong></a>
@@ -565,6 +576,7 @@ parameter for details. Note that some are synonyms.
 <p><br><li > <a href="smb.conf.5.html#directory"><strong>directory</strong></a>
 <p><br><li > <a href="smb.conf.5.html#directorymask"><strong>directory mask</strong></a>
 <p><br><li > <a href="smb.conf.5.html#directorymode"><strong>directory mode</strong></a>
+<p><br><li > <a href="smb.conf.5.html#directorysecuritymask"><strong>directory security mask</strong></a>
 <p><br><li > <a href="smb.conf.5.html#dontdescend"><strong>dont descend</strong></a>
 <p><br><li > <a href="smb.conf.5.html#dosfiletimeresolution"><strong>dos filetime resolution</strong></a>
 <p><br><li > <a href="smb.conf.5.html#dosfiletimes"><strong>dos filetimes</strong></a>
@@ -574,7 +586,9 @@ parameter for details. Note that some are synonyms.
 <p><br><li > <a href="smb.conf.5.html#followsymlinks"><strong>follow symlinks</strong></a>
 <p><br><li > <a href="smb.conf.5.html#forcecreatemode"><strong>force create mode</strong></a>
 <p><br><li > <a href="smb.conf.5.html#forcedirectorymode"><strong>force directory mode</strong></a>
+<p><br><li > <a href="smb.conf.5.html#forcedirectorysecuritymode"><strong>force directory security mode</strong></a>
 <p><br><li > <a href="smb.conf.5.html#forcegroup"><strong>force group</strong></a>
+<p><br><li > <a href="smb.conf.5.html#forcesecuritymode"><strong>force security mode</strong></a>
 <p><br><li > <a href="smb.conf.5.html#forceuser"><strong>force user</strong></a>
 <p><br><li > <a href="smb.conf.5.html#fstype"><strong>fstype</strong></a>
 <p><br><li > <a href="smb.conf.5.html#group"><strong>group</strong></a>
@@ -587,6 +601,7 @@ parameter for details. Note that some are synonyms.
 <p><br><li > <a href="smb.conf.5.html#hostsdeny"><strong>hosts deny</strong></a>
 <p><br><li > <a href="smb.conf.5.html#include"><strong>include</strong></a>
 <p><br><li > <a href="smb.conf.5.html#invalidusers"><strong>invalid users</strong></a>
+<p><br><li > <a href="smb.conf.5.html#level2oplocks"><strong>level2 oplocks</strong></a>
 <p><br><li > <a href="smb.conf.5.html#locking"><strong>locking</strong></a>
 <p><br><li > <a href="smb.conf.5.html#lppausecommand"><strong>lppause command</strong></a>
 <p><br><li > <a href="smb.conf.5.html#lpqcommand"><strong>lpq command</strong></a>
@@ -595,22 +610,24 @@ parameter for details. Note that some are synonyms.
 <p><br><li > <a href="smb.conf.5.html#magicoutput"><strong>magic output</strong></a>
 <p><br><li > <a href="smb.conf.5.html#magicscript"><strong>magic script</strong></a>
 <p><br><li > <a href="smb.conf.5.html#manglecase"><strong>mangle case</strong></a>
+<p><br><li > <a href="smb.conf.5.html#manglelocks"><strong>mangle locks</strong></a>
 <p><br><li > <a href="smb.conf.5.html#mangledmap"><strong>mangled map</strong></a>
 <p><br><li > <a href="smb.conf.5.html#manglednames"><strong>mangled names</strong></a>
 <p><br><li > <a href="smb.conf.5.html#manglingchar"><strong>mangling char</strong></a>
 <p><br><li > <a href="smb.conf.5.html#maparchive"><strong>map archive</strong></a>
 <p><br><li > <a href="smb.conf.5.html#maphidden"><strong>map hidden</strong></a>
 <p><br><li > <a href="smb.conf.5.html#mapsystem"><strong>map system</strong></a>
-<p><br><li > <a href="smb.conf.5.html#maptoguest"><strong>map to guest</strong></a>
 <p><br><li > <a href="smb.conf.5.html#maxconnections"><strong>max connections</strong></a>
 <p><br><li > <a href="smb.conf.5.html#minprintspace"><strong>min print space</strong></a>
 <p><br><li > <a href="smb.conf.5.html#onlyguest"><strong>only guest</strong></a>
 <p><br><li > <a href="smb.conf.5.html#onlyuser"><strong>only user</strong></a>
 <p><br><li > <a href="smb.conf.5.html#oplocks"><strong>oplocks</strong></a>
+<p><br><li > <a href="smb.conf.5.html#oplockcontentionlimit"><strong>oplock contention limit</strong></a>
 <p><br><li > <a href="smb.conf.5.html#path"><strong>path</strong></a>
 <p><br><li > <a href="smb.conf.5.html#postexec"><strong>postexec</strong></a>
 <p><br><li > <a href="smb.conf.5.html#postscript"><strong>postscript</strong></a>
 <p><br><li > <a href="smb.conf.5.html#preexec"><strong>preexec</strong></a>
+<p><br><li > <a href="smb.conf.5.html#preexecclose"><strong>preexec close</strong></a>
 <p><br><li > <a href="smb.conf.5.html#preservecase"><strong>preserve case</strong></a>
 <p><br><li > <a href="smb.conf.5.html#printcommand"><strong>print command</strong></a>
 <p><br><li > <a href="smb.conf.5.html#printok"><strong>print ok</strong></a>
@@ -628,6 +645,8 @@ parameter for details. Note that some are synonyms.
 <p><br><li > <a href="smb.conf.5.html#revalidate"><strong>revalidate</strong></a>
 <p><br><li > <a href="smb.conf.5.html#rootpostexec"><strong>root postexec</strong></a>
 <p><br><li > <a href="smb.conf.5.html#rootpreexec"><strong>root preexec</strong></a>
+<p><br><li > <a href="smb.conf.5.html#securitymask"><strong>security mask</strong></a>
+<p><br><li > <a href="smb.conf.5.html#rootpreexecclose"><strong>root preexec close</strong></a>
 <p><br><li > <a href="smb.conf.5.html#setdirectory"><strong>set directory</strong></a>
 <p><br><li > <a href="smb.conf.5.html#sharemodes"><strong>share modes</strong></a>
 <p><br><li > <a href="smb.conf.5.html#shortpreservecase"><strong>short preserve case</strong></a>
@@ -652,6 +671,46 @@ parameter for details. Note that some are synonyms.
 <h2>EXPLANATION OF EACH PARAMETER</h2>
     
 <p><br><ul>
+<p><br><a name="adduserscript"></a>
+<li><strong><strong>add user script (G)</strong></strong>
+<p><br>This is the full pathname to a script that will be run <em>AS ROOT</em> by
+<a href="smbd.8.html"><strong>smbd (8)</strong></a> under special circumstances decribed
+below.
+<p><br>Normally, a Samba server requires that UNIX users are created for all
+users accessing files on this server. For sites that use Windows NT
+account databases as their primary user database creating these users
+and keeping the user list in sync with the Windows NT PDC is an
+onerous task. This option allows <a href="smbd.8.html"><strong>smbd</strong></a> to create
+the required UNIX users <em>ON DEMAND</em> when a user accesses the Samba
+server.
+<p><br>In order to use this option, <a href="smbd.8.html"><strong>smbd</strong></a> must be set to
+<a href="smb.conf.5.html#securityequalserver"><strong>security=server</strong></a> or
+<a href="smb.conf.5.html#securityequaldomain"><strong>security=domain</strong></a> and <strong>"add user script"</strong>
+must be set to a full pathname for a script that will create a UNIX user
+given one argument of <strong>%u</strong>, which expands into the UNIX user name to
+create.
+<p><br>When the Windows user attempts to access the Samba server, at
+<em>"login"</em>(session setup in the SMB protocol) time,
+<a href="smbd.8.html"><strong>smbd</strong></a> contacts the <a href="smb.conf.5.html#passwordserver"><strong>password
+server</strong></a> and attempts to authenticate the given user
+with the given password. If the authentication succeeds then
+<a href="smbd.8.html"><strong>smbd</strong></a> attempts to find a UNIX user in the UNIX
+password database to map the Windows user into. If this lookup fails,
+and <strong>"add user script"</strong> is set then <a href="smbd.8.html"><strong>smbd</strong></a> will
+call the specified script <em>AS ROOT</em>, expanding any <strong>%u</strong> argument
+to be the user name to create.
+<p><br>If this script successfully creates the user then
+<a href="smbd.8.html"><strong>smbd</strong></a> will continue on as though the UNIX user
+already existed. In this way, UNIX users are dynamically created to
+match existing Windows NT accounts.
+<p><br>See also <a href="smb.conf.5.html#securityequalserver"><strong>security=server</strong></a>,
+<a href="smb.conf.5.html#securityequaldomain"><strong>security=domain</strong></a>, <a href="smb.conf.5.html#passwordserver"><strong>password
+server</strong></a>, <a href="smb.conf.5.html#deleteuserscript"><strong>delete user
+script</strong></a>.
+<p><br><strong>Default:</strong>
+<code>	add user script = &lt;empty string&gt;</code>
+<p><br><strong>Example:</strong>
+<code>	add user script = /usr/local/samba/bin/add_user %u</code>
 <p><br><a name="adminusers"></a>
 <li><strong><strong>admin users (S)</strong></strong>
 <p><br>This is a list of users who will be granted administrative privileges
@@ -666,46 +725,25 @@ file permissions.
 <code>	admin users = jason</code>
 <p><br><a name="allowhosts"></a>
 <li><strong><strong>allow hosts (S)</strong></strong>
-<p><br>A synonym for this parameter is <a href="smb.conf.5.html#hostsallow"><strong>'hosts allow'</strong></a>
-<p><br>This parameter is a comma, space, or tab delimited set of hosts which
-are permitted to access a service.
-<p><br>If specified in the <a href="smb.conf.5.html#global"><strong>[global]</strong></a> section then it will
-apply to all services, regardless of whether the individual service
-has a different setting.
-<p><br>You can specify the hosts by name or IP number. For example, you could
-restrict access to only the hosts on a Class C subnet with something
-like <code>"allow hosts = 150.203.5."</code>. The full syntax of the list is
-described in the man page <strong>hosts_access (5)</strong>. Note that this man
-page may not be present on your system, so a brief description will
-be given here also.
-<p><br><em>NOTE:</em> IF you wish to allow the <a href="smbpasswd.html.8"><strong>smbpasswd
-(8)</strong></a> program to be run by local users to change
-their Samba passwords using the local <a href="smbd.8.html"><strong>smbd (8)</strong></a>
-daemon, then you <em>MUST</em> ensure that the localhost is listed in your
-<strong>allow hosts</strong> list, as <a href="smbpasswd.html.8"><strong>smbpasswd (8)</strong></a> runs
-in client-server mode and is seen by the local
-<a href="smbd.8.html"><strong>smbd</strong></a> process as just another client.
-<p><br>You can also specify hosts by network/netmask pairs and by netgroup
-names if your system supports netgroups. The <em>EXCEPT</em> keyword can also
-be used to limit a wildcard list. The following examples may provide
-some help:
-<p><br><strong>Example 1</strong>: allow localhost and all IPs in 150.203.*.* except one
-<p><br><code>	hosts allow = localhost, 150.203. EXCEPT 150.203.6.66</code>
-<p><br><strong>Example 2</strong>: allow localhost and hosts that match the given network/netmask
-<p><br><code>	hosts allow = localhost, 150.203.15.0/255.255.255.0</code>
-<p><br><strong>Example 3</strong>: allow a localhost plus a couple of hosts
-<p><br><code>	hosts allow = localhost, lapland, arvidsjaur</code>
-<p><br><strong>Example 4</strong>: allow only hosts in NIS netgroup "foonet" or localhost, but 
-deny access from one particular host
-<p><br><code> 	hosts allow = @foonet, localhost</code>
-<code> 	hosts deny = pirate</code>
-<p><br>Note that access still requires suitable user-level passwords.
-<p><br>See <a href="testparm.1.html"><strong>testparm (1)</strong></a> for a way of testing your
-host access to see if it does what you expect.
-<p><br><strong>Default:</strong>
-<code>	none (i.e., all hosts permitted access)</code>
-<p><br><strong>Example:</strong>
-<code>	allow hosts = 150.203.5. localhost myhost.mynet.edu.au</code>
+<p><br>Synonym for <a href="smb.conf.5.html#hostsallow"><strong>hosts allow</strong></a>.
+<p><br><a name="allowtrusteddomains"></a>
+<li><strong><strong>allow trusted domains (G)</strong></strong>
+<p><br>This option only takes effect when the <a href="smb.conf.5.html#security"><strong>security</strong></a>
+option is set to <strong>server</strong> or <strong>domain</strong>.  If it is set to no,
+then attempts to connect to a resource from a domain or workgroup other than
+the one which smbd is running in will fail, even if that domain
+is trusted by the remote server doing the authentication.
+<p><br>This is useful if you only want your Samba server to serve resources
+to users in the domain it is a member of. As an example, suppose that there are
+two domains DOMA and DOMB.  DOMB is trusted by DOMA, which contains
+the Samba server.  Under normal circumstances, a user with an account
+in DOMB can then access the resources of a UNIX account with the same
+account name on the Samba server even if they do not have an account
+in DOMA.  This can make implementing a security boundary difficult.
+<p><br><strong>Default:</strong>
+<code>     allow trusted domains = Yes</code>
+<p><br><strong>Example:</strong>
+<code>     allow trusted domains = No</code>
 <p><br><a name="alternatepermissions"></a>
 <li><strong><strong>alternate permissions (S)</strong></strong>
 <p><br>This is a deprecated parameter. It no longer has any effect in Samba2.0.
@@ -717,13 +755,14 @@ regardless if the owner of the file is the currently logged on user or not.
 <li><strong><strong>announce as (G)</strong></strong>
 <p><br>This specifies what type of server <a href="nmbd.8.html"><strong>nmbd</strong></a> will
 announce itself as, to a network neighborhood browse list. By default
-this is set to Windows NT. The valid options are : "NT", "Win95" or
-"WfW" meaning Windows NT, Windows 95 and Windows for Workgroups
-respectively. Do not change this parameter unless you have a specific
-need to stop Samba appearing as an NT server as this may prevent Samba
-servers from participating as browser servers correctly.
-<p><br><strong>Default:</strong>
-<code>	announce as = NT</code>
+this is set to Windows NT. The valid options are : "NT", which is a
+synonym for "NT Server", "NT Server", "NT Workstation", "Win95" or
+"WfW" meaning Windows NT Server, Windows NT Workstation, Windows 95
+and Windows for Workgroups respectively. Do not change this parameter
+unless you have a specific need to stop Samba appearing as an NT server
+as this may prevent Samba servers from participating as browser servers correctly.
+<p><br><strong>Default:</strong>
+<code>	announce as = NT Server</code>
 <p><br><strong>Example</strong>
 <code>	announce as = Win95</code>
 <p><br><a name="announceversion"></a>
@@ -787,11 +826,15 @@ will serve to packets coming in those interfaces.  Note that you
 should not use this parameter for machines that are serving PPP or
 other intermittent or non-broadcast network interfaces as it will not
 cope with non-permanent interfaces.
-<p><br>In addition, to change a users SMB password, the
-<a href="smbpasswd.8.html"><strong>smbpasswd</strong></a> by default connects to the
-<em>"localhost" - 127.0.0.1</em> address as an SMB client to issue the
-password change request. If <strong>"bind interfaces only"</strong> is set then
-unless the network address <em>127.0.0.1</em> is added to the
+<p><br>If <strong>"bind interfaces only"</strong> is set then unless the network address
+<em>127.0.0.1</em> is added to the <a href="smb.conf.5.html#interfaces"><strong>'interfaces'</strong></a> parameter
+list <a href="smbpasswd.8.html"><strong>smbpasswd</strong></a> and
+<a href="swat.8.html"><strong>swat</strong></a> may not work as expected due to the
+reasons covered below.
+<p><br>To change a users SMB password, the <a href="smbpasswd.8.html"><strong>smbpasswd</strong></a>
+by default connects to the <em>"localhost" - 127.0.0.1</em> address as an SMB
+client to issue the password change request. If <strong>"bind interfaces only"</strong>
+is set then unless the network address <em>127.0.0.1</em> is added to the
 <a href="smb.conf.5.html#interfaces"><strong>'interfaces'</strong></a> parameter list then
 <a href="smbpasswd.8.html"><strong>smbpasswd</strong></a> will fail to connect in it's
 default mode. <a href="smbpasswd.8.html"><strong>smbpasswd</strong></a> can be forced to
@@ -799,6 +842,13 @@ use the primary IP interface of the local host by using its
 <a href="smbpasswd.8.html#minusr"><strong>"-r remote machine"</strong></a> parameter, with
 <strong>"remote machine"</strong> set to the IP name of the primary interface
 of the local host.
+<p><br>The <a href="swat.8.html"><strong>swat</strong></a> status page tries to connect with
+<a href="smbd.8.html"><strong>smbd</strong></a> and <a href="nmbd.8.html"><strong>nmbd</strong></a> at the address 
+<em>127.0.0.1</em> to determine if they are running.  Not adding <em>127.0.0.1</em>  will cause
+<a href="smbd.8.html"><strong>smbd</strong></a> and <a href="nmbd.8.html"><strong>nmbd</strong></a> to always show
+"not running" even if they really are.  This can prevent
+<a href="swat.8.html"><strong>swat</strong></a> from starting/stopping/restarting
+<a href="smbd.8.html"><strong>smbd</strong></a> and <a href="nmbd.8.html"><strong>nmbd</strong></a>.
 <p><br><strong>Default:</strong>
 <code>	bind interfaces only = False</code>
 <p><br><strong>Example:</strong>
@@ -839,10 +889,10 @@ shares in a net view and in the browse list.
 <p><br><strong>Example:</strong>
 <code>	browseable = No</code>
 <p><br><a name="casesensitive"></a>
-<li><strong><strong>case sensitive (S)</strong></strong>
+<li><strong><strong>case sensitive (G)</strong></strong>
 <p><br>See the discussion in the section <a href="smb.conf.5.html#NAMEMANGLING"><strong>NAME MANGLING</strong></a>.
 <p><br><a name="casesignames"></a>
-<li><strong><strong>casesignames (S)</strong></strong>
+<li><strong><strong>casesignames (G)</strong></strong>
 <p><br>Synonym for <a href="smb.conf.5.html#casesensitive"><strong>"case sensitive"</strong></a>.
 <p><br><a name="changenotifytimeout"></a>
 <li><strong><strong>change notify timeout (G)</strong></strong>
@@ -877,7 +927,12 @@ in order for the conversion to the UNIX character set to be done
 correctly. 
 <p><br><li > <strong>ISO8859-5</strong> Russian Cyrillic UNIX character set. The parameter
 <a href="smb.conf.5.html#clientcodepage"><strong>client code page</strong></a> <em>MUST</em> be set to code
-page 866 if the <strong>character set</strong> parameter is set to ISO8859-2
+page 866 if the <strong>character set</strong> parameter is set to ISO8859-5
+in order for the conversion to the UNIX character set to be done
+correctly. 
+<p><br><li > <strong>ISO8859-7</strong> Greek UNIX character set. The parameter
+<a href="smb.conf.5.html#clientcodepage"><strong>client code page</strong></a> <em>MUST</em> be set to code
+page 737 if the <strong>character set</strong> parameter is set to ISO8859-7
 in order for the conversion to the UNIX character set to be done
 correctly. 
 <p><br><li > <strong>KOI8-R</strong> Alternate mapping for Russian Cyrillic UNIX
@@ -1048,6 +1103,17 @@ performed.
 <code>	deadtime = 0</code>
 <p><br><strong>Example:</strong>
 <code>	deadtime = 15</code>
+<p><br><a name="debughirestimestamp"></a>
+<li><strong><strong>debug hires timestamp (G)</strong></strong>
+<p><br>Sometimes the timestamps in the log messages are needed with a
+resolution of higher that seconds, this boolean parameter adds
+microsecond resolution to the timestamp message header when turned on.
+<p><br>Note that the parameter <a href="smb.conf.5.html#debugtimestamp"><strong>debug timestamp</strong></a>
+must be on for this to have an effect.
+<p><br><strong>Default:</strong>
+<code> debug hires timestamp = No</code>
+<p><br><strong>Example:</strong>
+<code> debug hires timestamp = Yes</code>
 <p><br><a name="debugtimestamp"></a>
 <li><strong><strong>debug timestamp (G)</strong></strong>
 <p><br>Samba2.0 debug log messages are timestamped by default. If you are
@@ -1058,6 +1124,29 @@ off.
 <code>	debug timestamp = Yes</code>
 <p><br><strong>Example:</strong>
 <code>	debug timestamp = No</code>
+<p><br><a name="debugpid"></a>
+<li><strong><strong>debug pid (G)</strong></strong>
+<p><br>When using only one log file for more then one forked smbd-process
+there may be hard to follow which process outputs which message.
+This boolean parameter is adds the process-id to the timestamp message
+headers in the logfile when turned on.
+<p><br>Note that the parameter <a href="smb.conf.5.html#debugtimestamp"><strong>debug timestamp</strong></a>
+must be on for this to have an effect.
+<p><br><strong>Default:</strong>
+<code>	debug pid = No</code>
+<p><br><strong>Example:</strong>
+<code>	debug pid = Yes</code>
+<p><br><a name="debuguid"></a>
+<li><strong><strong>debug uid (G)</strong></strong>
+<p><br>Samba is sometimes run as root and sometime run as the connected
+user, this boolean parameter inserts the current euid, egid, uid
+and gid to the timestamp message headers in the log file if turned on.
+<p><br>Note that the parameter <a href="smb.conf.5.html#debugtimestamp"><strong>debug timestamp</strong></a>
+must be on for this to have an effect.
+<p><br><strong>Default:</strong>
+<code>	debug uid = No</code>
+<p><br><strong>Example:</strong>
+<code>	debug uid = Yes</code>
 <p><br><a name="debuglevel"></a>
 <li><strong><strong>debug level (G)</strong></strong>
 <p><br>The value of the parameter (an integer) allows the debug level
@@ -1101,6 +1190,51 @@ interesting things.
 
 </pre>
 
+<p><br><a name="deleteuserscript"></a>
+<li><strong><strong>delete user script (G)</strong></strong>
+<p><br>This is the full pathname to a script that will be run <em>AS ROOT</em> by
+<a href="smbd.8.html"><strong>smbd (8)</strong></a> under special circumstances decribed
+below.
+<p><br>Normally, a Samba server requires that UNIX users are created for all
+users accessing files on this server. For sites that use Windows NT
+account databases as their primary user database creating these users
+and keeping the user list in sync with the Windows NT PDC is an
+onerous task. This option allows <a href="smbd.8.html"><strong>smbd</strong></a> to delete
+the required UNIX users <em>ON DEMAND</em> when a user accesses the Samba
+server and the Windows NT user no longer exists.
+<p><br>In order to use this option, <a href="smbd.8.html"><strong>smbd</strong></a> must be set to
+<a href="smb.conf.5.html#securityequaldomain"><strong>security=domain</strong></a> and <strong>"delete user
+script"</strong> must be set to a full pathname for a script that will delete
+a UNIX user given one argument of <strong>%u</strong>, which expands into the UNIX
+user name to delete. <em>NOTE</em> that this is different to the
+<a href="smb.conf.5.html#adduserscript"><strong>add user script</strong></a> which will work with the
+<a href="smb.conf.5.html#securityequalserver"><strong>security=server</strong></a> option as well as
+<a href="smb.conf.5.html#securityequaldomain"><strong>security=domain</strong></a>. The reason for this
+is only when Samba is a domain member does it get the information
+on an attempted user logon that a user no longer exists. In the
+<a href="smb.conf.5.html#securityequalserver"><strong>security=server</strong></a> mode a missing user
+is treated the same as an invalid password logon attempt. Deleting
+the user in this circumstance would not be a good idea.
+<p><br>When the Windows user attempts to access the Samba server, at
+<em>"login"</em>(session setup in the SMB protocol) time,
+<a href="smbd.8.html"><strong>smbd</strong></a> contacts the <a href="smb.conf.5.html#passwordserver"><strong>password
+server</strong></a> and attempts to authenticate the given user
+with the given password. If the authentication fails with the specific
+Domain error code meaning that the user no longer exists then
+<a href="smbd.8.html"><strong>smbd</strong></a> attempts to find a UNIX user in the UNIX
+password database that matches the Windows user account. If this lookup succeeds,
+and <strong>"delete user script"</strong> is set then <a href="smbd.8.html"><strong>smbd</strong></a> will
+call the specified script <em>AS ROOT</em>, expanding any <strong>%u</strong> argument
+to be the user name to delete.
+<p><br>This script should delete the given UNIX username. In this way, UNIX
+users are dynamically deleted to match existing Windows NT accounts.
+<p><br>See also <a href="smb.conf.5.html#securityequaldomain"><strong>security=domain</strong></a>,
+<a href="smb.conf.5.html#passwordserver"><strong>password server</strong></a>, <a href="smb.conf.5.html#adduserscript"><strong>add user
+script</strong></a>.
+<p><br><strong>Default:</strong>
+<code>	delete user script = &lt;empty string&gt;</code>
+<p><br><strong>Example:</strong>
+<code>	delete user script = /usr/local/samba/bin/del_user %u</code>
 <p><br><a name="deletereadonly"></a>
 <li><strong><strong>delete readonly (S)</strong></strong>
 <p><br>This parameter allows readonly files to be deleted.  This is not
@@ -1135,14 +1269,7 @@ as the user has permissions to do so).
 <code>	delete veto files = True</code>
 <p><br><a name="denyhosts"></a>
 <li><strong><strong>deny hosts (S)</strong></strong>
-<p><br>The opposite of <a href="smb.conf.5.html#allowhosts"><strong>'allow hosts'</strong></a> - hosts listed
-here are <em>NOT</em> permitted access to services unless the specific
-services have their own lists to override this one. Where the lists
-conflict, the <a href="smb.conf.5.html#allowhosts"><strong>'allow'</strong></a> list takes precedence.
-<p><br><strong>Default:</strong>
-<code>	none (i.e., no hosts specifically excluded)</code>
-<p><br><strong>Example:</strong>
-<code>	deny hosts = 150.203.4. badhost.mynet.edu.au</code>
+<p><br>Synonym for <a href="smb.conf.5.html#hostsdeny"><strong>hosts deny</strong></a>.
 <p><br><a name="dfreecommand"></a>
 <li><strong><strong>dfree command (G)</strong></strong>
 <p><br>The dfree command setting should only be used on systems where a
@@ -1209,7 +1336,8 @@ bits are added).
 <p><br>See the <a href="smb.conf.5.html#forcedirectorymode"><strong>"force directory mode"</strong></a> parameter
 to cause particular mode bits to always be set on created directories.
 <p><br>See also the <a href="smb.conf.5.html#createmode"><strong>"create mode"</strong></a> parameter for masking
-mode bits on created files.
+mode bits on created files, and the <a href="smb.conf.5.html#directorysecuritymask"><strong>"directory security mask"</strong></a>
+parameter.
 <p><br><strong>Default:</strong>
 <code>	directory mask = 0755</code>
 <p><br><strong>Example:</strong>
@@ -1217,6 +1345,31 @@ mode bits on created files.
 <p><br><a name="directorymode"></a>
 <li><strong><strong>directory mode (S)</strong></strong>
 <p><br>Synonym for <a href="smb.conf.5.html#directorymask"><strong>directory mask</strong></a>.
+<p><br><a name="directorysecuritymask"></a>
+<li><strong><strong>directory security mask (S)</strong></strong>
+<p><br>This parameter controls what UNIX permission bits can be modified
+when a Windows NT client is manipulating the UNIX permission on a
+directory using the native NT security dialog box.
+<p><br>This parameter is applied as a mask (AND'ed with) to the changed
+permission bits, thus preventing any bits not in this mask from
+being modified. Essentially, zero bits in this mask may be treated
+as a set of bits the user is not allowed to change.
+<p><br>If not set explicitly this parameter is set to the same value as the
+<a href="smb.conf.5.html#directorymask"><strong>directory mask</strong></a> parameter. To allow a user to
+modify all the user/group/world permissions on a directory, set this
+parameter to 0777.
+<p><br><em>Note</em> that users who can access the Samba server through other
+means can easily bypass this restriction, so it is primarily
+useful for standalone "appliance" systems.  Administrators of
+most normal systems will probably want to set it to 0777.
+<p><br>See also the <a href="smb.conf.5.html#forcedirectorysecuritymode"><strong>force directory security
+mode</strong></a>, <a href="smb.conf.5.html#securitymask"><strong>security
+mask</strong></a>, <a href="smb.conf.5.html#forcesecuritymode"><strong>force security mode</strong></a>
+parameters.
+<p><br><strong>Default:</strong>
+<code>	directory security mask = &lt;same as directory mask&gt;</code>
+<p><br><strong>Example:</strong>
+<code>	directory security mask = 0777</code>
 <p><br><a name="dnsproxy"></a>
 <li><strong><strong>dns proxy (G)</strong></strong>
 <p><br>Specifies that <a href="nmbd.8.html"><strong>nmbd</strong></a> when acting as a WINS
@@ -1235,7 +1388,7 @@ DNS name lookup requests, as doing a name lookup is a blocking action.
 <p><br><a name="domainadmingroup"></a>
 <strong>domain admin group (G)</strong>
 <p><br>This is an <strong>EXPERIMENTAL</strong> parameter that is part of the unfinished
-Samba NT Domain Controller Code.  It has been removed as of November 98.
+Samba NT Domain Controller Code. It may be removed in a later release.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list <strong>Samba-ntdom</strong> available by sending email to
@@ -1243,7 +1396,7 @@ mailing list <strong>Samba-ntdom</strong> available by sending email to
 <p><br><a name="domainadminusers"></a> 
 <li><strong><strong>domain admin users (G)</strong></strong>
 <p><br>This is an <strong>EXPERIMENTAL</strong> parameter that is part of the unfinished
-Samba NT Domain Controller Code. It has been removed as of November 98.
+Samba NT Domain Controller Code. It may be removed in a later release.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list <strong>Samba-ntdom</strong> available by sending email to
@@ -1253,70 +1406,10 @@ mailing list <strong>Samba-ntdom</strong> available by sending email to
 <p><br>This is a <strong>DEPRECATED</strong> parameter. It is currently not used within
 the Samba source and should be removed from all current smb.conf
 files. It is left behind for compatibility reasons.
-<p><br><a name="domaingroupmap"></a>
-<li><strong><strong>domain group map (G)</strong></strong>
-<p><br>This option allows you to specify a file containing unique mappings
-of individual NT Domain Group names (in any domain) to UNIX group
-names.  This allows NT domain groups to be presented correctly to
-NT users, despite the lack of native support for the NT Security model
-(based on VAX/VMS) in UNIX.  The reader is advised to become familiar
-with the NT Domain system and its administration.
-<p><br>This option is used in conjunction with <a href="smb.conf.5.html#localgroupmap"><strong>'local group map'</strong></a>
-and <a href="smb.conf.5.html#domainusermap"><strong>'domain user map'</strong></a>.  The use of these three
-options is trivial and often unnecessary in the case where Samba is
-not expected to interact with any other SAM databases (whether local
-workstations or Domain Controllers).
-<p><br>The map file is parsed line by line.  If any line begins with a <code>'#'</code>
-or a <code>';'</code> then it is ignored.  Each line should contain a single UNIX
-group name on the left then a single NT Domain Group name on the right,
-separated by a tabstop or <code>'='</code>.  If either name contains spaces then
-it should be enclosed in quotes.
-The line can be either of the form:
-<p><br><code>  UNIXgroupname	\\DOMAIN_NAME\\DomainGroupName </code>
-<p><br>or:
-<p><br><code>  UNIXgroupname	DomainGroupName </code>
-<p><br>In the case where Samba is either an <strong>EXPERIMENTAL</strong> Domain Controller
-or it is a member of a domain using <a href="smb.conf.5.html#security"><strong>"security = domain"</strong></a>,
-the latter format can be used: the default Domain name is the Samba Server's
-Domain name, specified by <a href="smb.conf.5.html#workgroup"><strong>"workgroup = MYGROUP"</strong></a>.
-<p><br>Any UNIX groups that are <em>NOT</em> specified in this map file are assumed to
-be either Local or Domain Groups, depending on the role of the Samba Server.
-<p><br>In the case when Samba is an <strong>EXPERIMENTAL</strong> Domain Controller, Samba
-will present <em>ALL</em> such unspecified UNIX groups as its own NT Domain
-Groups, with the same name.
-<p><br>In the case where Samba is member of a domain using
-<a href="smb.conf.5.html#security"><strong>"security = domain"</strong></a>, Samba will check the UNIX name with
-its Domain Controller (see <a href="smb.conf.5.html#passwordserver"><strong>"password server"</strong></a>)
-as if it was an NT Domain Group.  If the Domain Controller says that it is not,
-such unspecified (unmapped) UNIX groups which also are not NT Domain
-Groups are treated as Local Groups in the Samba Server's local SAM database.
-NT Administrators will recognise these as Workstation Local Groups,
-which are managed by running <strong>USRMGR.EXE</strong> and selecting a remote
-Domain named "\\WORKSTATION_NAME", or by running <strong>MUSRMGR.EXE</strong> on
-a local Workstation.
-<p><br>This may sound complicated, but it means that a Samba Server as
-either a member of a domain or as an <strong>EXPERIMENTAL</strong> Domain Controller
-will act like an NT Workstation (with a local SAM database) or an NT PDC
-(with a Domain SAM database) respectively, without the need for any of
-the map files at all.  If you <strong>want</strong> to get fancy, however, you can.
-<p><br>Note that adding an entry to map an arbitrary NT group in an arbitrary
-Domain to an arbitrary UNIX group <em>REQUIRES</em> the following:
-<p><br><ul>
-<p><br><li > that the UNIX group exists on the UNIX server.
-<p><br><li > that the NT Domain Group exists in the specified NT Domain
-<p><br><li > that the UNIX Server knows about the specified Domain; 
-<p><br><li > that all the UNIX users (who are expecting to access the Samba
-Server as the correct NT user and with the correct NT group permissions)
-in the UNIX group be mapped to the correct NT Domain users in the specified
-NT Domain using <a href="smb.conf.5.html#domainusermap"><strong>'domain user map'</strong></a>.
-<p><br></ul>
-<p><br>Failure to meet any of these requirements may result in either (or
-both) errors reported in the log files or (and) incorrect or missing
-access rights granted to users.
 <p><br><a name="domaingroups"></a>
 <li><strong><strong>domain groups (G)</strong></strong>
 <p><br>This is an <strong>EXPERIMENTAL</strong> parameter that is part of the unfinished
-Samba NT Domain Controller Code. It has been removed as of November 98.
+Samba NT Domain Controller Code. It may be removed in a later release.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list <strong>Samba-ntdom</strong> available by sending email to
@@ -1324,7 +1417,7 @@ mailing list <strong>Samba-ntdom</strong> available by sending email to
 <p><br><a name="domainguestgroup"></a>
 <li><strong><strong>domain guest group (G)</strong></strong>
 <p><br>This is an <strong>EXPERIMENTAL</strong> parameter that is part of the unfinished
-Samba NT Domain Controller Code. It has been removed as of November 98.
+Samba NT Domain Controller Code. It may be removed in a later release.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list <strong>Samba-ntdom</strong> available by sending email to
@@ -1332,7 +1425,7 @@ mailing list <strong>Samba-ntdom</strong> available by sending email to
 <p><br><a name="domainguestusers"></a>
 <li><strong><strong>domain guest users (G)</strong></strong>
 <p><br>This is an <strong>EXPERIMENTAL</strong> parameter that is part of the unfinished
-Samba NT Domain Controller Code. It has been removed as of November 98.
+Samba NT Domain Controller Code. It may be removed in a later release.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list <strong>Samba-ntdom</strong> available by sending email to
@@ -1372,72 +1465,8 @@ if this parameter is set and <a href="nmbd.8.html"><strong>nmbd</strong></a> cla
 special name for a <a href="smb.conf.5.html#workgroup"><strong>workgroup</strong></a> before a Windows NT
 PDC is able to do so then cross subnet browsing will behave strangely
 and may fail.
-<p><br>By default ("auto") Samba will attempt to become the domain master
-browser only if it is the Primary Domain Controller.
 <p><br><strong>Default:</strong>
-<code>	domain master = auto</code>
-<p><br><strong>Example:</strong>
 <code>	domain master = no</code>
-<p><br><a name="domainusermap"></a>
-<li><strong><strong>domain user map (G)</strong></strong>
-<p><br>This option allows you to specify a file containing unique mappings
-of individual NT Domain User names (in any domain) to UNIX user
-names.  This allows NT domain users to be presented correctly to
-NT systems, despite the lack of native support for the NT Security model
-(based on VAX/VMS) in UNIX.  The reader is advised to become familiar
-with the NT Domain system and its administration.
-<p><br>This option is used in conjunction with <a href="smb.conf.5.html#localgroupmap"><strong>'local group map'</strong></a>
-and <a href="smb.conf.5.html#domaingroupmap"><strong>'domain group map'</strong></a>.  The use of these three
-options is trivial and often unnecessary in the case where Samba is
-not expected to interact with any other SAM databases (whether local
-workstations or Domain Controllers).
-<p><br>This option, which provides (and maintains) a one-to-one link between
-UNIX and NT users, is <em>DIFFERENT</em> from <a href="smb.conf.5.html#usernamemap"><strong>'username map'</strong></a>, which does <em>NOT</em> maintain a distinction between the
-name(s) it can map to and the name it maps.
-<p><br>The map file is parsed line by line.  If any line begins with a <code>'#'</code>
-or a <code>';'</code> then the line is ignored.  Each line should contain a single UNIX
-user name on the left then a single NT Domain User name on the right,
-separated by a tabstop or <code>'='</code>.  If either name contains spaces then
-it should be enclosed in quotes.
-The line can be either of the form:
-<p><br><code>  UNIXusername	\\DOMAIN_NAME\\DomainUserName </code>
-<p><br>or:
-<p><br><code>  UNIXusername	DomainUserName </code>
-<p><br>In the case where Samba is either an <strong>EXPERIMENTAL</strong> Domain Controller
-or it is a member of a domain using <a href="smb.conf.5.html#security"><strong>"security = domain"</strong></a>,
-the latter format can be used: the default Domain name is the Samba Server's
-Domain name, specified by <a href="smb.conf.5.html#workgroup"><strong>"workgroup = MYGROUP"</strong></a>.
-<p><br>Any UNIX users that are <em>NOT</em> specified in this map file are assumed
-to be either Domain or Workstation Users, depending on the role of the
-Samba Server.
-<p><br>In the case when Samba is an <strong>EXPERIMENTAL</strong> Domain Controller, Samba
-will present <em>ALL</em> such unspecified UNIX users as its own NT Domain
-Users, with the same name.
-<p><br>In the case where Samba is a member of a domain using
-<a href="smb.conf.5.html#security"><strong>"security = domain"</strong></a>, Samba will check the UNIX name with
-its Domain Controller (see <a href="smb.conf.5.html#passwordserver"><strong>"password server"</strong></a>)
-as if it was an NT Domain User.  If the Domain Controller says that it is not,
-such unspecified (unmapped) UNIX users which also are not NT Domain
-Users are treated as Local Users in the Samba Server's local SAM database.
-NT Administrators will recognise these as Workstation Users,
-which are managed by running <strong>USRMGR.EXE</strong> and selecting a remote
-Domain named "\\WORKSTATION_NAME", or by running <strong>MUSRMGR.EXE</strong> on
-a local Workstation.
-<p><br>This may sound complicated, but it means that a Samba Server as
-either a member of a domain or as an <strong>EXPERIMENTAL</strong> Domain Controller
-will act like an NT Workstation (with a local SAM database) or an NT PDC
-(with a Domain SAM database) respectively, without the need for any of
-the map files at all.  If you <strong>want</strong> to get fancy, however, you can.
-<p><br>Note that adding an entry to map an arbitrary NT User in an arbitrary
-Domain to an arbitrary UNIX user <em>REQUIRES</em> the following:
-<p><br><ul>
-<p><br><li > that the UNIX user exists on the UNIX server.
-<p><br><li > that the NT Domain User exists in the specified NT Domain.
-<p><br><li > that the UNIX Server knows about the specified Domain.
-<p><br></ul>
-<p><br>Failure to meet any of these requirements may result in either (or
-both) errors reported in the log files or (and) incorrect or missing
-access rights granted to users.
 <p><br><a name="dontdescend"></a>
 <li><strong><strong>dont descend (S)</strong></strong>
 <p><br>There are certain directories on some systems (e.g., the <code>/proc</code> tree
@@ -1599,6 +1628,31 @@ details on masking mode bits on created directories.
 <p><br>would force all created directories to have read and execute
 permissions set for 'group' and 'other' as well as the
 read/write/execute bits set for the 'user'.
+<p><br><a name="forcedirectorysecuritymode"></a>
+<li><strong><strong>force directory security mode (S)</strong></strong>
+<p><br>This parameter controls what UNIX permission bits can be modified when
+a Windows NT client is manipulating the UNIX permission on a directory
+using the native NT security dialog box.
+<p><br>This parameter is applied as a mask (OR'ed with) to the changed
+permission bits, thus forcing any bits in this mask that the user may
+have modified to be on. Essentially, one bits in this mask may be
+treated as a set of bits that, when modifying security on a directory,
+the user has always set to be 'on'.
+<p><br>If not set explicitly this parameter is set to the same value as the
+<a href="smb.conf.5.html#forcedirectorymode"><strong>force directory mode</strong></a> parameter. To allow
+a user to modify all the user/group/world permissions on a directory,
+with restrictions set this parameter to 000.
+<p><br><em>Note</em> that users who can access the Samba server through other
+means can easily bypass this restriction, so it is primarily
+useful for standalone "appliance" systems.  Administrators of
+most normal systems will probably want to set it to 0000.
+<p><br>See also the <a href="smb.conf.5.html#directorysecuritymask"><strong>directory security mask</strong></a>,
+<a href="smb.conf.5.html#securitymask"><strong>security mask</strong></a>, <a href="smb.conf.5.html#forcesecuritymode"><strong>force security
+mode</strong></a> parameters.
+<p><br><strong>Default:</strong>
+<code>	force directory security mode = &lt;same as force directory mode&gt;</code>
+<p><br><strong>Example:</strong>
+<code>	force directory security mode = 0</code>
 <p><br><a name="forcegroup"></a>
 <li><strong><strong>force group (S)</strong></strong>
 <p><br>This specifies a UNIX group name that will be assigned as the default
@@ -1608,10 +1662,51 @@ use the named group for their permissions checking. Thus, by assigning
 permissions for this group to the files and directories within this
 service the Samba administrator can restrict or allow sharing of these
 files.
+<p><br>In Samba 2.0.5 and above this parameter has extended functionality in the following
+way. If the group name listed here has a '+' character prepended to it
+then the current user accessing the share only has the primary group 
+default assigned to this group if they are already assigned as a member
+of that group. This allows an administrator to decide that only users
+who are already in a particular group will create files with group 
+ownership set to that group. This gives a finer granularity of ownership
+assignment. For example, the setting <code>force group = +sys</code> means
+that only users who are already in group sys will have their default
+primary group assigned to sys when accessing this Samba share. All
+other users will retain their ordinary primary group.
+<p><br>If the <a href="smb.conf.5.html#forceuser"><strong>"force user"</strong></a> parameter is also set the
+group specified in <strong>force group</strong> will override the primary group
+set in <a href="smb.conf.5.html#forceuser"><strong>"force user"</strong></a>.
+<p><br>See also <a href="smb.conf.5.html#forceuser"><strong>"force user"</strong></a>
 <p><br><strong>Default:</strong>
 <code>	no forced group</code>
 <p><br><strong>Example:</strong>
 <code>	force group = agroup</code>
+<p><br><a name="forcesecuritymode"></a>
+<li><strong><strong>force security mode (S)</strong></strong>
+<p><br>This parameter controls what UNIX permission bits can be modified when
+a Windows NT client is manipulating the UNIX permission on a file
+using the native NT security dialog box.
+<p><br>This parameter is applied as a mask (OR'ed with) to the changed
+permission bits, thus forcing any bits in this mask that the user may
+have modified to be on. Essentially, one bits in this mask may be
+treated as a set of bits that, when modifying security on a file, the
+user has always set to be 'on'.
+<p><br>If not set explicitly this parameter is set to the same value as the
+<a href="smb.conf.5.html#forcecreatemode"><strong>force create mode</strong></a> parameter. To allow
+a user to modify all the user/group/world permissions on a file,
+with no restrictions set this parameter to 000.
+<p><br><em>Note</em> that users who can access the Samba server through other
+means can easily bypass this restriction, so it is primarily
+useful for standalone "appliance" systems.  Administrators of
+most normal systems will probably want to set it to 0000.
+<p><br>See also the <a href="smb.conf.5.html#forcedirectorysecuritymode"><strong>force directory security
+mode</strong></a>, <a href="smb.conf.5.html#directorysecuritymask"><strong>directory security
+mask</strong></a>, <a href="smb.conf.5.html#securitymask"><strong>security mask</strong></a>
+parameters.
+<p><br><strong>Default:</strong>
+<code>	force security mode = &lt;same as force create mode&gt;</code>
+<p><br><strong>Example:</strong>
+<code>	force security mode = 0</code>
 <p><br><a name="forceuser"></a>
 <li><strong><strong>force user (S)</strong></strong>
 <p><br>This specifies a UNIX user name that will be assigned as the default
@@ -1623,6 +1718,11 @@ clients still need to connect as a valid user and supply a valid
 password. Once connected, all file operations will be performed as the
 <code>"forced user"</code>, no matter what username the client connected as.
 <p><br>This can be very useful.
+<p><br>In Samba 2.0.5 and above this parameter also causes the primary
+group of the forced user to be used as the primary group for all
+file activity. Prior to 2.0.5 the primary group was left as the
+primary group of the connecting user (this was a bug).
+<p><br>See also <a href="smb.conf.5.html#forcegroup"><strong>"force group"</strong></a>
 <p><br><strong>Default:</strong>
 <code>	no forced user</code>
 <p><br><strong>Example:</strong>
@@ -1728,7 +1828,7 @@ files"</strong></a> and <a href="smb.conf.5.html#casesensitive"><strong>"case se
 <p><br><strong>Example</strong>
 <code>	hide files = /.*/DesktopFolderDB/TrashFor%m/resource.frk/</code>
 <p><br>The above example is based on files that the Macintosh SMB client
-(DAVE) available from <a href="www.thursby.com"><strong>Thursby</strong></a> creates for
+(DAVE) available from <a href="http://www.thursby.com"><strong>Thursby</strong></a> creates for
 internal use, and also still hides all files beginning with a dot.
 <p><br><a name="homedirmap"></a>
 <li><strong><strong>homedir map (G)</strong></strong>
@@ -1751,16 +1851,57 @@ logons</strong></a>.
 <code>	homedir map = amd.homedir</code>
 <p><br><a name="hostsallow"></a>
 <li><strong><strong>hosts allow (S)</strong></strong>
-<p><br>Synonym for <a href="smb.conf.5.html#allowhosts"><strong>allow hosts</strong></a>.
+<p><br>A synonym for this parameter is <a href="smb.conf.5.html#allowhosts"><strong>'allow hosts'</strong></a>
+<p><br>This parameter is a comma, space, or tab delimited set of hosts which
+are permitted to access a service.
+<p><br>If specified in the <a href="smb.conf.5.html#global"><strong>[global]</strong></a> section then it will
+apply to all services, regardless of whether the individual service
+has a different setting.
+<p><br>You can specify the hosts by name or IP number. For example, you could
+restrict access to only the hosts on a Class C subnet with something
+like <code>"allow hosts = 150.203.5."</code>. The full syntax of the list is
+described in the man page <strong>hosts_access (5)</strong>. Note that this man
+page may not be present on your system, so a brief description will
+be given here also.
+<p><br>Note that the localhost address 127.0.0.1 will always be allowed
+access unless specifically denied by a "hosts deny" option.
+<p><br>You can also specify hosts by network/netmask pairs and by netgroup
+names if your system supports netgroups. The <em>EXCEPT</em> keyword can also
+be used to limit a wildcard list. The following examples may provide
+some help:
+<p><br><strong>Example 1</strong>: allow all IPs in 150.203.*.* except one
+<p><br><code>	hosts allow = 150.203. EXCEPT 150.203.6.66</code>
+<p><br><strong>Example 2</strong>: allow hosts that match the given network/netmask
+<p><br><code>	hosts allow = 150.203.15.0/255.255.255.0</code>
+<p><br><strong>Example 3</strong>: allow a couple of hosts
+<p><br><code>	hosts allow = lapland, arvidsjaur</code>
+<p><br><strong>Example 4</strong>: allow only hosts in NIS netgroup "foonet", but 
+deny access from one particular host
+<p><br><code> 	hosts allow = @foonet</code>
+<p><br><code> 	hosts deny = pirate</code>
+<p><br>Note that access still requires suitable user-level passwords.
+<p><br>See <a href="testparm.1.html"><strong>testparm (1)</strong></a> for a way of testing your
+host access to see if it does what you expect.
+<p><br><strong>Default:</strong>
+<code>	none (i.e., all hosts permitted access)</code>
+<p><br><strong>Example:</strong>
+<code>	allow hosts = 150.203.5. myhost.mynet.edu.au</code>
 <p><br><a name="hostsdeny"></a>
 <li><strong><strong>hosts deny (S)</strong></strong>
-<p><br>Synonym for <a href="smb.conf.5.html#denyhosts"><strong>denyhosts</strong></a>.
+<p><br>The opposite of <a href="smb.conf.5.html#hostsallow"><strong>'hosts allow'</strong></a> - hosts listed
+here are <em>NOT</em> permitted access to services unless the specific
+services have their own lists to override this one. Where the lists
+conflict, the <a href="smb.conf.5.html#hostsallow"><strong>'allow'</strong></a> list takes precedence.
+<p><br><strong>Default:</strong>
+<code>	none (i.e., no hosts specifically excluded)</code>
+<p><br><strong>Example:</strong>
+<code>	hosts deny = 150.203.4. badhost.mynet.edu.au</code>
 <p><br><a name="hostsequiv"></a>
 <li><strong><strong>hosts equiv (G)</strong></strong>
 <p><br>If this global parameter is a non-null string, it specifies the name
 of a file to read for the names of hosts and users who will be allowed
 access without specifying a password.
-<p><br>This is not be confused with <a href="smb.conf.5.html#allowhosts"><strong>allow hosts</strong></a> which
+<p><br>This is not be confused with <a href="smb.conf.5.html#hostsallow"><strong>hosts allow</strong></a> which
 is about hosts access to services and is more useful for guest
 services. <strong>hosts equiv</strong> may be useful for NT clients which will not
 supply passwords to samba.
@@ -1782,20 +1923,32 @@ is included literally, as though typed in place.
 <a href="smb.conf.5.html#percentP"><strong>%P</strong></a> and <a href="smb.conf.5.html#percentS"><strong>%S</strong></a>.
 <p><br><a name="interfaces"></a>
 <li><strong><strong>interfaces (G)</strong></strong>
-<p><br>This option allows you to setup multiple network interfaces, so that
-Samba can properly handle browsing on all interfaces.
-<p><br>The option takes a list of ip/netmask pairs. The netmask may either be
-a bitmask, or a bitlength.
+<p><br>This option allows you to override the default network interfaces list
+that Samba will use for browsing, name registration and other NBT
+traffic. By default Samba will query the kernel for the list of all
+active interfaces and use any interfaces except 127.0.0.1 that are
+broadcast capable.
+<p><br>The option takes a list of interface strings. Each string can be in
+any of the following forms:
+<p><br><ul>
+<li > a network interface name (such as eth0). This may include
+     shell-like wildcards so eth* will match any interface starting
+     with the substring "eth"
+if() a IP address. In this case the netmask is determined
+     from the list of interfaces obtained from the kernel
+if() a IP/mask pair. 
+if() a broadcast/mask pair. 
+</ul>
+<p><br>The "mask" parameters can either be a bit length (such as 24 for a C
+class network) or a full netmask in dotted decmal form.
+<p><br>The "IP" parameters above can either be a full dotted decimal IP
+address or a hostname which will be looked up via the OSes normal
+hostname resolution mechanisms.
 <p><br>For example, the following line:
-<p><br><code>interfaces = 192.168.2.10/24 192.168.3.10/24</code>
-<p><br>would configure two network interfaces with IP addresses 192.168.2.10
-and 192.168.3.10. The netmasks of both interfaces would be set to
-255.255.255.0.
-<p><br>You could produce an equivalent result by using:
-<p><br><code>interfaces = 192.168.2.10/255.255.255.0 192.168.3.10/255.255.255.0</code>
-<p><br>if you prefer that format.
-<p><br>If this option is not set then Samba will attempt to find a primary
-interface, but won't attempt to configure more than one interface.
+<p><br><code>interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0</code>
+<p><br>would configure three network interfaces corresponding to the eth0
+device and IP addresses 192.168.2.10 and 192.168.3.10. The netmasks of
+the latter two interfaces would be set to 255.255.255.0.
 <p><br>See also <a href="smb.conf.5.html#bindinterfacesonly"><strong>"bind interfaces only"</strong></a>.
 <p><br><a name="invalidusers"></a>
 <li><strong><strong>invalid users (S)</strong></strong>
@@ -1833,9 +1986,9 @@ has the SO_KEEPALIVE attribute set on it (see <a href="smb.conf.5.html#socketopt
 options"</strong></a>). Basically you should only use this option
 if you strike difficulties.
 <p><br><strong>Default:</strong>
-<code>	keep alive = 0</code>
+<code>	keepalive = 0</code>
 <p><br><strong>Example:</strong>
-<code>	keep alive = 60</code>
+<code>	keepalive = 60</code>
 <p><br><a name="kerneloplocks"></a>
 <li><strong><strong>kernel oplocks (G)</strong></strong>
 <p><br>For UNIXs that support kernel based <a href="smb.conf.5.html#oplocks"><strong>oplocks</strong></a>
@@ -1849,42 +2002,57 @@ data consistency between SMB/CIFS, NFS and local file access (and is a
 <p><br>This parameter defaults to <em>"On"</em> on systems that have the support,
 and <em>"off"</em> on systems that don't. You should never need to touch
 this parameter.
-<p><br><a name="ldapbindas"></a>
-<li><strong><strong>ldap bind as (G)</strong></strong>
-<p><br>This parameter is part of the <em>EXPERIMENTAL</em> Samba support for a
-password database stored on an LDAP server. These options are only
-available if your version of Samba was configured with the <strong>--with-ldap</strong>
-option.
-<p><br>This parameter specifies the entity to bind to an LDAP directory as.
-Usually it should be safe to use the LDAP root account; for larger
-installations it may be preferable to restrict Samba's access. See also
-<a href="smb.conf.5.html#ldappasswdfile"><strong>ldap passwd file</strong></a>.
-<p><br><strong>Default:</strong>
-<code>	none (bind anonymously)</code>
-<p><br><strong>Example:</strong>
-<code>	ldap bind as = "uid=root, dc=mydomain, dc=org"</code>
-<p><br><a name="ldappasswdfile"></a>
-<li><strong><strong>ldap passwd file (G)</strong></strong>
+<p><br>See also the <a href="smb.conf.5.html#oplocks"><strong>"oplocks"</strong></a> and <a href="smb.conf.5.html#level2oplocks"><strong>"level2 oplocks"</strong></a>
+parameters.
+<p><br><a name="ldapfilter"></a>
+<li><strong><strong>ldap filter (G)</strong></strong>
 <p><br>This parameter is part of the <em>EXPERIMENTAL</em> Samba support for a
-password database stored on an LDAP server. These options are only
-available if your version of Samba was configured with the <strong>--with-ldap</strong>
-option.
-<p><br>This parameter specifies a file containing the password with which
-Samba should bind to an LDAP server. For obvious security reasons
-this file must be set to mode 700 or less.
+password database stored on an LDAP server back-end. These options
+are only available if your version of Samba was configured with
+the <strong>--with-ldap</strong> option.
+<p><br>This parameter specifies an LDAP search filter used to search for a
+user name in the LDAP database. It must contain the string
+<a href="smb.conf.5.html#percentU"><strong>%u</strong></a> which will be replaced with the user being
+searched for.
 <p><br><strong>Default:</strong>
-<code>	none (bind anonymously)</code>
-<p><br><strong>Example:</strong>
-<code>	ldap passwd file = /usr/local/samba/private/ldappasswd</code>
+<code>	empty string.</code>
 <p><br><a name="ldapport"></a>
 <li><strong><strong>ldap port (G)</strong></strong>
 <p><br>This parameter is part of the <em>EXPERIMENTAL</em> Samba support for a
-password database stored on an LDAP server. These options are only
-available if your version of Samba was configured with the <strong>--with-ldap</strong>
-option.
-<p><br>This parameter specifies the TCP port number of the LDAP server.
+password database stored on an LDAP server back-end. These options
+are only available if your version of Samba was configured with
+the <strong>--with-ldap</strong> option.
+<p><br>This parameter specifies the TCP port number to use to contact
+the LDAP server on.
 <p><br><strong>Default:</strong>
 <code>	ldap port = 389.</code>
+<p><br><a name="ldaproot"></a>
+<li><strong><strong>ldap root (G)</strong></strong>
+<p><br>This parameter is part of the <em>EXPERIMENTAL</em> Samba support for a
+password database stored on an LDAP server back-end. These options
+are only available if your version of Samba was configured with
+the <strong>--with-ldap</strong> option.
+<p><br>This parameter specifies the entity to bind to the LDAP server
+as (essentially the LDAP username) in order to be able to perform
+queries and modifications on the LDAP database.
+<p><br>See also <a href="smb.conf.5.html#ldaprootpasswd"><strong>ldap root passwd</strong></a>.
+<p><br><strong>Default:</strong>
+<code>	empty string (no user defined)</code>
+<p><br><a name="ldaprootpasswd"></a>
+<li><strong><strong>ldap root passwd (G)</strong></strong>
+<p><br>This parameter is part of the <em>EXPERIMENTAL</em> Samba support for a
+password database stored on an LDAP server back-end. These options
+are only available if your version of Samba was configured with
+the <strong>--with-ldap</strong> option.
+<p><br>This parameter specifies the password for the entity to bind to the
+LDAP server as (the password for this LDAP username) in order to be
+able to perform queries and modifications on the LDAP database.
+<p><br><em>BUGS:</em> This parameter should <em>NOT</em> be a readable parameter
+in the <strong>smb.conf</strong> file and will be removed once a correct
+storage place is found.
+<p><br>See also <a href="smb.conf.5.html#ldaproot"><strong>ldap root</strong></a>.
+<p><br><strong>Default:</strong>
+<code>	empty string.</code>
 <p><br><a name="ldapserver"></a>
 <li><strong><strong>ldap server (G)</strong></strong>
 <p><br>This parameter is part of the <em>EXPERIMENTAL</em> Samba support for a
@@ -1892,8 +2060,7 @@ password database stored on an LDAP server back-end. These options
 are only available if your version of Samba was configured with
 the <strong>--with-ldap</strong> option.
 <p><br>This parameter specifies the DNS name of the LDAP server to use
-when storing and retrieving information about Samba users and
-groups.
+for SMB/CIFS authentication purposes.
 <p><br><strong>Default:</strong>
 <code>	ldap server = localhost</code>
 <p><br><a name="ldapsuffix"></a>
@@ -1902,13 +2069,42 @@ groups.
 password database stored on an LDAP server back-end. These options
 are only available if your version of Samba was configured with
 the <strong>--with-ldap</strong> option.
-<p><br>This parameter specifies the node of the LDAP tree beneath which
-Samba should store its information. This parameter MUST be provided
-when using LDAP with Samba.
-<p><br><strong>Default:</strong>
-<code>	none</code>
-<p><br><strong>Example:</strong>
-<code>	ldap suffix = "dc=mydomain, dc=org"</code>
+<p><br>This parameter specifies the <code>"dn"</code> or LDAP <em>"distinguished name"</em>
+that tells <a href="smbd.8.html"><strong>smbd</strong></a> to start from when searching
+for an entry in the LDAP password database.
+<p><br><strong>Default:</strong>
+<code>	empty string.</code>
+<p><br><a name="level2oplocks"></a>
+<li><strong><strong>level2 oplocks (S)</strong></strong>
+<p><br>This parameter (new in Samba 2.0.5) controls whether Samba supports
+level2 (read-only) oplocks on a share. In Samba 2.0.4 this parameter
+defaults to "False" as the code is new, but will default to "True"
+in a later release.
+<p><br>Level2, or read-only oplocks allow Windows NT clients that have an
+oplock on a file to downgrade from a read-write oplock to a read-only
+oplock once a second client opens the file (instead of releasing all
+oplocks on a second open, as in traditional, exclusive oplocks). This
+allows all openers of the file that support level2 oplocks to cache
+the file for read-ahead only (ie. they may not cache writes or lock
+requests) and increases performance for many acesses of files that
+are not commonly written (such as application .EXE files).
+<p><br>Once one of the clients which have a read-only oplock writes to
+the file all clients are notified (no reply is needed or waited
+for) and told to break their oplocks to "none" and delete any
+read-ahead caches.
+<p><br>It is recommended that this parameter be turned on to speed access
+to shared executables (and also to test the code :-).
+<p><br>For more discussions on level2 oplocks see the CIFS spec.
+<p><br>Currently, if <a href="smb.conf.5.html#kerneloplocks"><strong>"kernel oplocks"</strong></a> are supported
+then level2 oplocks are not granted (even if this parameter is set
+to <code>"true"</code>). Note also, the <a href="smb.conf.5.html#oplocks"><strong>"oplocks"</strong></a> parameter must
+be set to "true" on this share in order for this parameter to have any
+effect.
+<p><br>See also the <a href="smb.conf.5.html#oplocks"><strong>"oplocks"</strong></a> and <a href="smb.conf.5.html#kerneloplocks"><strong>"kernel oplocks"</strong></a> parameters.
+<p><br><strong>Default:</strong>
+<code> level2 oplocks = False</code>
+<p><br><strong>Example:</strong>
+<code> level2 oplocks = True</code>
 <p><br><a name="lmannounce"></a>
 <li><strong><strong>lm announce (G)</strong></strong>
 <p><br>This parameter determines if <a href="nmbd.8.html"><strong>nmbd</strong></a> will produce
@@ -1949,66 +2145,6 @@ will be loaded for browsing by default. See the
 <code>	load printers = yes</code>
 <p><br><strong>Example:</strong>
 <code>	load printers = no</code>
-<p><br><a name="localgroupmap"></a>
-<li><strong><strong>local group map (G)</strong></strong>
-<p><br>This option allows you to specify a file containing unique mappings
-of individual NT Local Group names (in any domain) to UNIX group
-names.  This allows NT Local groups (aliases) to be presented correctly to
-NT users, despite the lack of native support for the NT Security model
-(based on VAX/VMS) in UNIX.  The reader is advised to become familiar
-with the NT Domain system and its administration.
-<p><br>This option is used in conjunction with <a href="smb.conf.5.html#domaingroupmap"><strong>'domain group map'</strong></a>
-and <a href="smb.conf.5.html#domainusermap"><strong>'domain name map'</strong></a>.  The use of these three
-options is trivial and often unnecessary in the case where Samba
-is not expected to interact with any other SAM databases (whether local
-workstations or Domain Controllers).
-<p><br>The map file is parsed line by line.  If any line begins with a <code>'#'</code>
-or a <code>';'</code> then it is ignored.  Each line should contain a single UNIX
-group name on the left then a single NT Local Group name on the right,
-separated by a tabstop or <code>'='</code>.  If either name contains spaces then
-it should be enclosed in quotes.
-The line can be either of the form:
-<p><br><code>  UNIXgroupname	\\DOMAIN_NAME\\LocalGroupName </code>
-<p><br>or:
-<p><br><code>  UNIXgroupname	LocalGroupName </code>
-<p><br>In the case where Samba is either an <strong>EXPERIMENTAL</strong> Domain Controller
-or it is a member of a domain using <a href="smb.conf.5.html#security"><strong>"security = domain"</strong></a>,
-the latter format can be used: the default Domain name is the Samba Server's
-Domain name, specified by <a href="smb.conf.5.html#workgroup"><strong>"workgroup = MYGROUP"</strong></a>.
-<p><br>Any UNIX groups that are <em>NOT</em> specified in this map file are treated
-as either Local or Domain Groups depending on the role of the Samba Server.
-<p><br>In the case when Samba is an <strong>EXPERIMENTAL</strong> Domain Controller, Samba
-will present <em>ALL</em> unspecified UNIX groups as its own NT Domain
-Groups, with the same name, and <em>NOT</em> as Local Groups.
-<p><br>In the case where Samba is member of a domain using
-<a href="smb.conf.5.html#security"><strong>"security = domain"</strong></a>, Samba will check the UNIX name with
-its Domain Controller (see <a href="smb.conf.5.html#passwordserver"><strong>"password server"</strong></a>)
-as if it was an NT Domain Group.  If the Domain Controller says that it is not,
-such unspecified (unmapped) UNIX groups which also are not NT Domain
-Groups are treated as Local Groups in the Samba Server's local SAM database.
-NT Administrators will recognise these as Workstation Local Groups,
-which are managed by running <strong>USRMGR.EXE</strong> and selecting a remote
-Domain named "\\WORKSTATION_NAME", or by running <strong>MUSRMGR.EXE</strong> on
-a local Workstation.
-<p><br>This may sound complicated, but it means that a Samba Server as
-either a member of a domain or as an <strong>EXPERIMENTAL</strong> Domain Controller
-will act like an NT Workstation (with a local SAM database) or an NT PDC
-(with a Domain SAM database) respectively, without the need for any of
-the map files at all.  If you <strong>want</strong> to get fancy, however, you can.
-<p><br>Note that adding an entry to map an arbitrary NT group in an arbitrary
-Domain to an arbitrary UNIX group <em>REQUIRES</em> the following:
-<p><br><ul>
-<p><br><li > that the UNIX group exists on the UNIX server.
-<p><br><li > that the NT Domain Group exists in the specified NT Domain
-<p><br><li > that the UNIX Server knows about the specified Domain; 
-<p><br><li > that all the UNIX users (who are expecting to access the Samba
-Server as the correct NT user and with the correct NT group permissions)
-in the UNIX group be mapped to the correct NT Domain users in the specified
-NT Domain using <a href="smb.conf.5.html#domainusermap"><strong>'domain user map'</strong></a>.
-<p><br></ul>
-<p><br>Failure to meet any of these requirements may result in either (or
-both) errors reported in the log files or (and) incorrect or missing
-access rights granted to users.
 <p><br><a name="localmaster"></a>
 <li><strong><strong>local master (G)</strong></strong>
 <p><br>This option allows <a href="nmbd.8.html"><strong>nmbd</strong></a> to try and become a
@@ -2308,6 +2444,11 @@ end.
 <p><br><a name="manglecase"></a>
 <li><strong><strong>mangle case (S)</strong></strong>
 <p><br>See the section on <a href="smb.conf.5.html#NAMEMANGLING"><strong>"NAME MANGLING"</strong></a>.
+<p><br><a name="manglelocks"></a>
+<li><strong><strong>mangle locks (S)</strong></strong>
+<p><br>This option is was introduced with Samba 2.0.4 and above and has been
+removed in Samba 2.0.6 as Samba now dynamically configures such things
+on 32 bit systems.
 <p><br><a name="mangledmap"></a>
 <li><strong><strong>mangled map (S)</strong></strong>
 <p><br>This is for those who want to directly map UNIX file names which can
@@ -2529,7 +2670,7 @@ never need to set this parameter.
 <p><br><strong>Default:</strong>
 <code>	max mux = 50</code>
 <p><br><a name="maxopenfiles"></a>
-<li><strong><strong>maxopenfiles (G)</strong></strong>
+<li><strong><strong>max open files (G)</strong></strong>
 <p><br>This parameter limits the maximum number of open files that one
 <a href="smbd.8.html"><strong>smbd</strong></a> file serving process may have open for
 a client at any one time. The default for this parameter is set
@@ -2620,6 +2761,15 @@ job.
 <code>	min print space = 0</code>
 <p><br><strong>Example:</strong>
 <code>	min print space = 2000</code>
+<p><br><a name="minpasswdlength"></a>
+<li><strong><strong>min passwd length (G)</strong></strong>
+<p><br>This option sets the minimum length in characters of a plaintext password
+than smbd will accept when performing UNIX password changing.
+<p><br>See also <a href="smb.conf.5.html#unixpasswordsync"><strong>"unix password sync"</strong></a>,
+<a href="smb.conf.5.html#passwdprogram"><strong>"passwd program"</strong></a> and <a href="smb.conf.5.html#passwdchatdebug"><strong>"passwd chat
+debug"</strong></a>.
+<p><br><strong>Default:</strong>
+<code>	min passwd length = 5</code>
 <p><br><a name="minwinsttl"></a>
 <li><strong><strong>min wins ttl (G)</strong></strong>
 <p><br>This option tells <a href="nmbd.8.html"><strong>nmbd</strong></a> when acting as a WINS
@@ -2639,10 +2789,15 @@ resolution options.
 names to be resolved as follows :
 <p><br><ul>
 <p><br><li > <strong>lmhosts</strong> : Lookup an IP address in the Samba lmhosts file.
+If the line in lmhosts has no name type attached to the NetBIOS
+name (see the <a href="lmhosts.5.html"><strong>lmhosts (5)</strong></a> for details) then
+any name type matches for lookup.
 <p><br><li > <strong>host</strong> : Do a standard host name to IP address resolution,
 using the system /etc/hosts, NIS, or DNS lookups. This method of name
 resolution is operating system depended for instance on IRIX or
 Solaris this may be controlled by the <em>/etc/nsswitch.conf</em> file).
+Note that this method is only used if the NetBIOS name type being
+queried is the 0x20 (server) name type, otherwise it is ignored.
 <p><br><li > <strong>wins</strong> : Query a name with the IP address listed in the
 <a href="smb.conf.5.html#winsserver"><strong>wins server</strong></a> parameter. If no WINS server has
 been specified this method will be ignored.
@@ -2709,6 +2864,14 @@ system and the Samba server with this option must also be a
 <code>	nis homedir = false</code>
 <p><br><strong>Example:</strong>
 <code>	nis homedir = true</code>
+<p><br><a name="ntaclsupport"></a>
+<li><strong><strong>nt acl support (G)</strong></strong>
+<p><br>This boolean parameter controls whether <a href="smbd.8.html"><strong>smbd</strong></a>
+will attempt to map UNIX permissions into Windows NT access control lists.
+<p><br><strong>Default:</strong>
+<code>	nt acl support = yes</code>
+<p><br><strong>Example:</strong>
+<code>	nt acl support = no</code>
 <p><br><a name="ntpipesupport"></a>
 <li><strong><strong>nt pipe support (G)</strong></strong>
 <p><br>This boolean parameter controls whether <a href="smbd.8.html"><strong>smbd</strong></a>
@@ -2787,21 +2950,47 @@ by the underlying operating system. This allows data synchronization between
 all access to oplocked files, whether it be via Samba or NFS or a local
 UNIX process. See the <a href="smb.conf.5.html#kerneloplocks"><strong>kernel oplocks</strong></a> parameter
 for details.
+<p><br>See also the <a href="smb.conf.5.html#kerneloplocks"><strong>"kernel oplocks"</strong></a> and
+<a href="smb.conf.5.html#level2oplocks"><strong>"level2 oplocks"</strong></a> parameters.
 <p><br><strong>Default:</strong>
 <code>	oplocks = True</code>
 <p><br><strong>Example:</strong>
 <code>	oplocks = False</code>
+<p><br><a name="oplockbreakwaittime"></a>
+<li><strong><strong>oplock break wait time (G)</strong></strong>
+<p><br>This is a tuning parameter added due to bugs in both Windows 9x and WinNT.
+If Samba responds to a client too quickly when that client issues an SMB that
+can cause an oplock break request, then the client redirector can fail and
+not respond to the break request. This tuning parameter (which is set in
+milliseconds) is the amount of time Samba will wait before sending an
+oplock break request to such (broken) clients.
+<p><br><em>DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA
+OPLOCK CODE</em>.
+<p><br><strong>Default:</strong>
+<code>	oplock break wait time = 10</code>
+<p><br><a name="oplockcontentionlimit"></a>
+<li><strong><strong>oplock contention limit (S)</strong></strong>
+<p><br>This is a <em>very</em> advanced <a href="smbd.8.html"><strong>smbd</strong></a> tuning option to improve
+the efficiency of the granting of oplocks under multiple client contention for the same file.
+<p><br>In brief it specifies a number, which causes smbd not to grant an oplock even
+when requested if the approximate number of clients contending for an oplock on
+the same file goes over this limit. This causes <a href="smbd.8.html"><strong>smbd</strong></a> to
+behave in a similar way to Windows NT.
+<p><br><em>DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA
+OPLOCK CODE</em>.
+<p><br><strong>Default:</strong>
+<code> oplock contention limit = 2</code>
 <p><br><a name="oslevel"></a>
 <li><strong><strong>os level (G)</strong></strong>
 <p><br>This integer value controls what level Samba advertises itself as for
 browse elections. The value of this parameter determines whether
 <a href="nmbd.8.html"><strong>nmbd</strong></a> has a chance of becoming a local master
 browser for the <a href="smb.conf.5.html#workgroup"><strong>WORKGROUP</strong></a> in the local broadcast
-area. Setting this to zero will cause <a href="nmbd.8.html"><strong>nmbd</strong></a> to
-always lose elections to Windows machines. See BROWSING.txt in the
-Samba docs/ directory for details.
+area. The default is zero, which means <a href="nmbd.8.html"><strong>nmbd</strong></a> will
+lose elections to Windows machines. See BROWSING.txt in the Samba
+docs/ directory for details.
 <p><br><strong>Default:</strong>
-<code>	os level = 32</code>
+<code>	os level = 20</code>
 <p><br><strong>Example:</strong>
 <code>	os level = 65    ; This will win against any NT Server</code>
 <p><br><a name="packetsize"></a>
@@ -2958,13 +3147,18 @@ better restrict them with hosts allow!
 <p><br>If the <a href="smb.conf.5.html#security"><strong>"security"</strong></a> parameter is set to
 <strong>"domain"</strong>, then the list of machines in this option must be a list
 of Primary or Backup Domain controllers for the
-<a href="smb.conf.5.html#workgroup"><strong>Domain</strong></a>, as the Samba server is cryptographicly
+<a href="smb.conf.5.html#workgroup"><strong>Domain</strong></a> or the character <code>*</code>, as the Samba server is cryptographicly
 in that domain, and will use cryptographicly authenticated RPC calls
 to authenticate the user logging on. The advantage of using
 <a href="smb.conf.5.html#securityequaldomain"><strong>"security=domain"</strong></a> is that if you list
 several hosts in the <strong>"password server"</strong> option then
 <a href="smbd.8.html"><strong>smbd</strong></a> will try each in turn till it finds one
 that responds. This is useful in case your primary server goes down.
+<p><br>If the <strong>"password server"</strong> option is set to the character <code>*</code>,
+then Samba will attempt to auto-locate the Primary or Backup Domain controllers
+to authenticate against by doing a query for the name <code>WORKGROUP&lt;1C&gt;</code>
+and then contacting each server returned in the list of IP addresses
+from the <a href="smb.conf.5.html#nameresolveorder"><strong>name resolution</strong></a> source.
 <p><br>If the <a href="smb.conf.5.html#security"><strong>"security"</strong></a> parameter is set to
 <a href="smb.conf.5.html#securityequalserver"><strong>"server"</strong></a>, then there are different
 restrictions that <a href="smb.conf.5.html#securityequaldomain"><strong>"security=domain"</strong></a>
@@ -2989,6 +3183,8 @@ workstation.
 <code>	password server = &lt;empty string&gt;</code>
 <p><br><strong>Example:</strong>
 <code>	password server = NT-PDC, NT-BDC1, NT-BDC2</code>
+<p><br><strong>Example:</strong>
+<code>	password server = *</code>
 <p><br><a name="path"></a>
 <li><strong><strong>path (S)</strong></strong>
 <p><br>This parameter specifies a directory to which the user of the service
@@ -3047,11 +3243,19 @@ time they log in. Maybe a message of the day? Here is an example:
 </pre>
 
 <p><br>Of course, this could get annoying after a while :-)
-<p><br>See also <a href="smb.conf.5.html#postexec"><strong>postexec</strong></a>.
+<p><br>See also <a href="smb.conf.5.html#preexecclose"><strong>preexec close</strong></a> and <a href="smb.conf.5.html#postexec"><strong>postexec</strong></a>.
 <p><br><strong>Default:</strong>
 <code>	none (no command executed)</code>
 <p><br><strong>Example:</strong>
 <code>        preexec = echo \"%u connected to %S from %m (%I)\" &gt;&gt; /tmp/log</code>
+<p><br><a name="preexecclose"></a>
+<li><strong><strong>preexec close (S)</strong></strong>
+<p><br>This boolean option controls whether a non-zero return code from
+<a href="smb.conf.5.html#preexec"><strong>"preexec"</strong></a> should close the service being connected to.
+<p><br><strong>Default:</strong>
+<code> 	preexec close = no</code>
+<p><br><strong>Example:</strong>
+<code> 	preexec close = yes</code>
 <p><br><a name="preferredmaster"></a>
 <li><strong><strong>preferred master (G)</strong></strong>
 <p><br>This boolean parameter controls if <a href="nmbd.8.html"><strong>nmbd</strong></a> is a
@@ -3061,8 +3265,7 @@ force an election, and it will have a slight advantage in winning the
 election.  It is recommended that this parameter is used in
 conjunction with <a href="smb.conf.5.html#domainmaster"><strong>"domain master = yes"</strong></a>, so
 that <a href="nmbd.8.html"><strong>nmbd</strong></a> can guarantee becoming a domain
-master. Indeed the default ("auto") enables "preferred master" if
-Samba is configured as the domain master browser.
+master.
 <p><br>Use this option with caution, because if there are several hosts
 (whether Samba servers, Windows 95 or NT) that are preferred master
 browsers on the same subnet, they will each periodically and
@@ -3071,7 +3274,7 @@ result in unnecessary broadcast traffic and reduced browsing
 capabilities.
 <p><br>See also <a href="smb.conf.5.html#oslevel"><strong>os level</strong></a>.
 <p><br><strong>Default:</strong>
-<code> 	preferred master = auto</code>
+<code> 	preferred master = no</code>
 <p><br><strong>Example:</strong>
 <code> 	preferred master = yes</code>
 <p><br><a name="preferedmaster"></a>
@@ -3239,7 +3442,7 @@ in the docs/ directory, PRINTER_DRIVER.txt.
 find the printer driver files for the automatic installation of
 drivers for Windows 95 machines. If Samba is set up to serve printer
 drivers to Windows 95 machines, this should be set to
-<p><br><code>\\MACHINE\PRINTER$</code>
+<p><br><code>\\MACHINE\aPRINTER$</code>
 <p><br>Where MACHINE is the NetBIOS name of your Samba server, and PRINTER$
 is a share you set up for serving printer driver files. For more
 details on setting this up see the documentation file in the docs/
@@ -3391,13 +3594,13 @@ all the data has been read from disk.
 <p><br>This overlapping works best when the speeds of disk and network access
 are similar, having very little effect when the speed of one is much
 greater than the other.
-<p><br>The default value is 2048, but very little experimentation has been
+<p><br>The default value is 16384, but very little experimentation has been
 done yet to determine the optimal value, and it is likely that the
 best value will vary greatly between systems anyway. A value over
 65536 is pointless and will cause you to allocate memory
 unnecessarily.
 <p><br><strong>Default:</strong>
-<code>	read size = 2048</code>
+<code>	read size = 16384</code>
 <p><br><strong>Example:</strong>
 <code>	read size = 8192</code>
 <p><br><a name="remoteannounce"></a>
@@ -3450,6 +3653,32 @@ master on it's segment.
 <code>	remote browse sync = &lt;empty string&gt;</code>
 <p><br><strong>Example:</strong>
 <code>	remote browse sync = 192.168.2.255 192.168.4.255</code>
+<p><br><a name="restrictanonymous"></a>
+<li><strong><strong>restrict anonymous (G)</strong></strong>
+<p><br>This is a boolean parameter.  If it is true, then anonymous access
+to the server will be restricted, namely in the case where the server
+is expecting the client to send a username, but it doesn't.  Setting
+it to true will force these anonymous connections to be denied, and
+the client will be required to always supply a username and password
+when connecting. Use of this parameter is only recommened for homogenous 
+NT client environments.
+<p><br>This parameter makes the use of macro expansions that rely
+on the username (%U, %G, etc) consistant.  NT 4.0 likes to use
+anonymous connections when refreshing the share list, and this
+is a way to work around that.
+<p><br>When restrict anonymous is true, all anonymous connections are denied
+no matter what they are for.  This can effect the ability of a machine
+to access the samba Primary Domain Controller to revalidate it's machine
+account after someone else has logged on the client interactively.  The
+NT client will display a message saying that the machine's account in 
+the domain doesn't exist or the password is bad.  The best way to deal 
+with this is to reboot NT client machines between interactive logons, 
+using "Shutdown and Restart", rather than "Close all programs and logon 
+as a different user".
+<p><br><strong>Default:</strong>
+<code>     restrict anonymous = false</code>
+<p><br><strong>Example:</strong>
+<code>     restrict anonymous = true</code>
 <p><br><a name="revalidate"></a>
 <li><strong><strong>revalidate (S)</strong></strong>
 <p><br>Note that this option only works with
@@ -3506,7 +3735,13 @@ filesystems (such as cdroms) after a connection is closed.
 <p><br>This is the same as the <a href="smb.conf.5.html#preexec"><strong>"preexec"</strong></a> parameter except
 that the command is run as root. This is useful for mounting
 filesystems (such as cdroms) before a connection is finalized.
-<p><br>See also <a href="smb.conf.5.html#preexec"><strong>"preexec"</strong></a>.
+<p><br>See also <a href="smb.conf.5.html#preexec"><strong>"preexec"</strong></a>
+and <a href="smb.conf.5.html#rootpreexecclose"><strong>"root preexec close"</strong></a>.
+<p><br><a name="rootpreexecclose"></a>
+<li><strong><strong>root preexec close (S)</strong></strong>
+<p><br>This is the same as the <a href="smb.conf.5.html#preexecclose"><strong>"preexec close"</strong></a> parameter
+except that the command is run as root.
+<p><br>See also <a href="smb.conf.5.html#preexec"><strong>"preexec"</strong></a>, <a href="smb.conf.5.html#preexecclose"><strong>"preexec close"</strong></a>.
 <p><br><a name="security"></a>
 <li><strong><strong>security (G)</strong></strong>
 <p><br>This option affects how clients respond to Samba and is one of the most
@@ -3662,7 +3897,7 @@ level security without allowing the server to automatically map unknown
 users into the <a href="smb.conf.5.html#guestaccount"><strong>"guest account"</strong></a>. See the
 <a href="smb.conf.5.html#maptoguest"><strong>"map to guest"</strong></a> parameter for details on
 doing this.
-<p><br>e,(BUG:) There is currently a bug in the implementation of
+<p><br><em>BUG:</em> There is currently a bug in the implementation of
 <strong>"security=domain</strong> with respect to multi-byte character
 set usernames. The communication with a Domain Controller
 must be done in UNICODE and Samba currently does not widen
@@ -3678,6 +3913,31 @@ and the <a href="smb.conf.5.html#encryptpasswords"><strong>"encrypted passwords"
 <code> 	security = USER</code>
 <p><br><strong>Example:</strong>
 <code> 	security = DOMAIN</code>
+<p><br><a name="securitymask"></a>
+<li><strong><strong>security mask (S)</strong></strong>
+<p><br>This parameter controls what UNIX permission bits can be modified
+when a Windows NT client is manipulating the UNIX permission on a
+file using the native NT security dialog box.
+<p><br>This parameter is applied as a mask (AND'ed with) to the changed
+permission bits, thus preventing any bits not in this mask from
+being modified. Essentially, zero bits in this mask may be treated
+as a set of bits the user is not allowed to change.
+<p><br>If not set explicitly this parameter is set to the same value as the
+<a href="smb.conf.5.html#createmask"><strong>create mask</strong></a> parameter. To allow a user to
+modify all the user/group/world permissions on a file, set this
+parameter to 0777.
+<p><br><em>Note</em> that users who can access the Samba server through other
+means can easily bypass this restriction, so it is primarily
+useful for standalone "appliance" systems.  Administrators of
+most normal systems will probably want to set it to 0777.
+<p><br>See also the <a href="smb.conf.5.html#forcedirectorysecuritymode"><strong>force directory security
+mode</strong></a>, <a href="smb.conf.5.html#directorysecuritymask"><strong>directory security
+mask</strong></a>, <a href="smb.conf.5.html#forcesecuritymode"><strong>force security
+mode</strong></a> parameters.
+<p><br><strong>Default:</strong>
+<code>	security mask = &lt;same as create mask&gt;</code>
+<p><br><strong>Example:</strong>
+<code>	security mask = 0777</code>
 <p><br><a name="serverstring"></a>
 <li><strong><strong>server string (G)</strong></strong>
 <p><br>This controls what string will show up in the printer comment box in
@@ -3726,12 +3986,14 @@ increase this parameter. Signs that this parameter is set too low are
 users reporting strange problems trying to save files (locking errors)
 and error messages in the smbd log looking like <code>"ERROR
 smb_shm_alloc : alloc of XX bytes failed"</code>.
+<p><br>If your OS refuses the size that Samba asks for then Samba will try a
+smaller size, reducing by a factor of 0.8 until the OS accepts it.
 <p><br><strong>Default:</strong>
 <code>	shared mem size = 1048576</code>
 <p><br><strong>Example:</strong>
 <code>	shared mem size = 5242880 ; Set to 5mb for a large number of files.</code>
 <p><br><a name="shortpreservecase"></a>
-<li><strong><strong>short preserve case (S)</strong></strong>
+<li><strong><strong>short preserve case (G)</strong></strong>
 <p><br>This boolean parameter controls if new files which conform to 8.3
 syntax, that is all in upper case and of suitable length, are created
 upper case, or if they are forced to be the <code>"default"</code> case. This
@@ -4100,9 +4362,11 @@ set to <code>"yes"</code> in order for this parameter to have any affect.
 <p><br>This parameter maps how Samba debug messages are logged onto the
 system syslog logging levels. Samba debug level zero maps onto syslog
 LOG_ERR, debug level one maps onto LOG_WARNING, debug level two maps
-to LOG_NOTICE, debug level three maps onto LOG_INFO.  The parameter
-sets the threshold for doing the mapping, all Samba debug messages
-above this threshold are mapped to syslog LOG_DEBUG messages.
+onto LOG_NOTICE, debug level three maps onto LOG_INFO. All higher 
+levels are mapped to LOG_DEBUG.
+<p><br>This paramter sets the threshold for sending messages to syslog. 
+Only messages with debug level less than this value will be sent 
+to syslog.
 <p><br><strong>Default:</strong>
 <code>	syslog = 1</code>
 <p><br><a name="syslogonly"></a>
@@ -4283,15 +4547,6 @@ purposes. The most common is to map usernames that users use on DOS or
 Windows machines to those that the UNIX box uses. The other is to map
 multiple users to a single username so that they can more easily share
 files.
-<p><br>The use of this option, therefore, relates to UNIX usernames
-and not Windows (specifically NT Domain) usernames.  In other words,
-once a name has been mapped using this option, the Samba server uses
-the mapped name for internal <em>AND</em> external purposes.
-<p><br>This option is <em>DIFFERENT</em> from the <a href="smb.conf.5.html#domainusermap"><strong>"domain user map"</strong></a> 
-parameter, which maintains a one-to-one mapping between UNIX usernames
-and NT Domain Usernames: more specifically, the Samba server maintains
-a link between <em>BOTH</em> usernames, presenting the NT username to the
-external NT world, and using the UNIX username internally.
 <p><br>The map file is parsed line by line. Each line should contain a single
 UNIX username on the left then a <code>'='</code> followed by a list of
 usernames on the right. The list of usernames on the right may contain
@@ -4493,6 +4748,9 @@ may be followed by the server. Links that point to areas within the
 directory tree exported by the server are always allowed; this
 parameter controls access only to areas that are outside the directory
 tree being exported.
+<p><br>Note that setting this parameter can have a negative effect on your
+server performance due to the extra system calls that Samba has to
+do in order to perform the link checks.
 <p><br><strong>Default:</strong>
 <code> 	wide links = yes</code>
 <p><br><strong>Example:</strong>
@@ -4509,7 +4767,7 @@ need to set this to <code>"yes"</code> for some older clients.
 <p><br>This specifies the IP address (or DNS name: IP address for preference)
 of the WINS server that <a href="nmbd.8.html"><strong>nmbd</strong></a> should register with.
 If you have a WINS server on your network then you should set this to
-the WINS server's IP.
+the WINS server's IP.        
 <p><br>You should point this at your WINS server if you have a
 multi-subnetted network.
 <p><br><em>NOTE</em>. You need to set up Samba to point to a WINS server if you
@@ -4520,6 +4778,32 @@ Samba source distribution.
 <code>	wins server = </code>
 <p><br><strong>Example:</strong>
 <code>	wins server = 192.9.200.1</code>
+<p><br><a name="winshook"></a>
+<li><strong><strong>wins hook (G)</strong></strong>
+<p><br>When Samba is running as a WINS server this allows you to call an
+external program for all changes to the WINS database. The primary use
+for this option is to allow the dynamic update of external name
+resolution databases such as dynamic DNS.
+<p><br>The wins hook parameter specifies the name of a script or executable
+that will be called as follows:
+<p><br>wins_hook operation name nametype ttl IP_list
+<p><br>The first argument is the operation and is one of "add", "delete",
+or "refresh". In most cases the operation can be ignored as the rest
+of the parameters provide sufficient information. Note that "refresh"
+may sometimes be called when the name has not previously been added,
+in that case it should be treated as an add.
+<p><br>The second argument is the netbios name. If the name is not a legal
+name then the wins hook is not called. Legal names contain only
+letters, digits, hyphens, underscores and periods.
+<p><br>The third argument is the netbios name type as a 2 digit hexadecimal
+number. 
+<p><br>The fourth argument is the TTL (time to live) for the name in seconds.
+<p><br>The fifth and subsequent arguments are the IP addresses currently
+registered for that name. If this list is empty then the name should
+be deleted.
+<p><br>An example script that calls the BIND dynamic DNS update program
+"nsupdate" is provided in the examples directory of the Samba source
+code. 
 <p><br><a name="winssupport"></a>
 <li><strong><strong>wins support (G)</strong></strong>
 <p><br>This boolean controls if the <a href="nmbd.8.html"><strong>nmbd</strong></a> process in
@@ -4543,7 +4827,6 @@ setting.
 <p><br><a name="writable"></a>
 <li><strong><strong>writable (S)</strong></strong>
 <p><br>Synonym for <a href="smb.conf.5.html#writeable"><strong>"writeable"</strong></a> for people who can't spell :-).
-Pronounced "ritter-bull".
 <p><br><a name="writelist"></a>
 <li><strong><strong>write list (S)</strong></strong>
 <p><br>This is a list of users that are given read-write access to a
@@ -4587,6 +4870,7 @@ permitting), but only via spooling operations.
 
 </pre>
 
+<p><br></ul>
 <p><br><a name="WARNINGS"></a>
 <h2>WARNINGS</h2>
     
diff --git a/docs/htmldocs/smbclient.1.html b/docs/htmldocs/smbclient.1.html
index 45823a56f9..a68538aa15 100644
--- a/docs/htmldocs/smbclient.1.html
+++ b/docs/htmldocs/smbclient.1.html
@@ -24,7 +24,7 @@
 <p><br><a name="SYNOPSIS"></a>
 <h2>SYNOPSIS</h2>
     
-<p><br><strong>smbclient</strong> <a href="smbclient.1.html#servicename">servicename</a> [<a href="smbclient.1.html#password">password</a>] [<a href="smbclient.1.html#minuss">-s smb.conf</a>] [<a href="smbclient.1.html#minusB">-B IP addr</a>] [<a href="smbclient.1.html#minusO">-O socket options</a>][<a href="smbclient.1.html#minusR">-R name resolve order</a>] [<a href="smbclient.1.html#minusM">-M NetBIOS name</a>] [<a href="smbclient.1.html#minusi">-i scope</a>] [<a href="smbclient.1.html#minusN">-N</a>] [<a href="smbclient.1.html#minusn">-n NetBIOS name</a>] [<a href="smbclient.1.html#minusd">-d debuglevel</a>] [<a href="smbclient.1.html#minusP">-P</a>] [<a href="smbclient.1.html#minusp">-p port</a>] [<a href="smbclient.1.html#minusl">-l log basename</a>] [<a href="smbclient.1.html#minush">-h</a>] [<a href="smbclient.1.html#minusI">-I dest IP</a>] [<a href="smbclient.1.html#minusE">-E</a>] [<a href="smbclient.1.html#minusU">-U username</a>] [<a href="smbclient.1.html#minusL">-L NetBIOS name</a>] [<a href="smbclient.1.html#minust">-t terminal code</a>] [<a href="smbclient.1.html#minusm">-m max protocol</a>] [<a href="smbclient.1.html#minusW">-W workgroup</a>] [<a href="smbclient.1.html#minusT">-T&lt;c|x&gt;IXFqgbNan</a>] [<a href="smbclient.1.html#minusD">-D directory</a>] [<a href="smbclient.1.html#minusc">-c command string</a>]
+<p><br><strong>smbclient</strong> <a href="smbclient.1.html#servicename">servicename</a> [<a href="smbclient.1.html#minuss">-s smb.conf</a>] [<a href="smbclient.1.html#minusO">-O socket options</a>][<a href="smbclient.1.html#minusR">-R name resolve order</a>] [<a href="smbclient.1.html#minusM">-M NetBIOS name</a>] [<a href="smbclient.1.html#minusi">-i scope</a>] [<a href="smbclient.1.html#minusN">-N</a>] [<a href="smbclient.1.html#minusn">-n NetBIOS name</a>] [<a href="smbclient.1.html#minusd">-d debuglevel</a>] [<a href="smbclient.1.html#minusP">-P</a>] [<a href="smbclient.1.html#minusp">-p port</a>] [<a href="smbclient.1.html#minusl">-l log basename</a>] [<a href="smbclient.1.html#minush">-h</a>] [<a href="smbclient.1.html#minusI">-I dest IP</a>] [<a href="smbclient.1.html#minusE">-E</a>] [<a href="smbclient.1.html#minusU">-U username</a>] [<a href="smbclient.1.html#minusL">-L NetBIOS name</a>] [<a href="smbclient.1.html#minust">-t terminal code</a>] [<a href="smbclient.1.html#minusm">-m max protocol</a>] [<a href="smbclient.1.html#minusb">-b buffersize</a>] [<a href="smbclient.1.html#minusW">-W workgroup</a>] [<a href="smbclient.1.html#minusT">-T&lt;c|x&gt;IXFqgbNan</a>] [<a href="smbclient.1.html#minusD">-D directory</a>] [<a href="smbclient.1.html#minusc">-c command string</a>]
 <p><br><a name="DESCRIPTION"></a>
 <h2>DESCRIPTION</h2>
     
@@ -74,8 +74,6 @@ rejected by these servers.
 Samba configuration file, smb.conf. This file controls all aspects of
 the Samba setup on the machine and smbclient also needs to read this
 file.
-<p><br><a name="minusB"></a>
-<li><strong><strong>-B IP addr</strong></strong> The IP address to use when sending a broadcast packet.
 <p><br><a name="minusO"></a>
 <li><strong><strong>-O socket options</strong></strong> TCP socket options to set on the client
 socket. See the <a href="smb.conf.5.html#socketoptions">socket options</a>
@@ -102,8 +100,7 @@ no WINS server has been specified this method will be ignored.
 listed in the <a href="smb.conf.5.html#interfaces"><strong>interfaces</strong></a> parameter
 in the smb.conf file. This is the least reliable of the name resolution
 methods as it depends on the target host being on a locally connected
-subnet. To specify a particular broadcast address the <a href="smbclient.1.html#minusB"><strong>-B</strong></a> option 
-may be used.
+subnet. 
 <p><br></ul>
 <p><br>If this parameter is not set then the name resolve order defined
 in the <a href="smb.conf.5.html"><strong>smb.conf</strong></a> file parameter 
@@ -238,7 +235,7 @@ then the password as part of username will take precedence. Putting
 nothing before or nothing after the percent symbol will cause an empty
 username or an empty password to be used, respectively.
 <p><br>The password may also be specified by setting up an environment
-variable called <code>PASSWORD</code> that contains the users password. Note
+variable called <code>PASSWD</code> that contains the users password. Note
 that this may be very insecure on some systems but on others allows
 users to script smbclient commands without having a password appear in
 the command line of a process listing.
@@ -246,7 +243,7 @@ the command line of a process listing.
 on an uppercase password. Lowercase or mixed case passwords may be
 rejected by these servers.
 <p><br>Be cautious about including passwords in scripts or in the
-<code>PASSWORD</code> environment variable. Also, on many systems the command
+<code>PASSWD</code> environment variable. Also, on many systems the command
 line of a running process may be seen via the <code>ps</code> command to be
 safe always allow smbclient to prompt for a password and type it in
 directly.
@@ -273,6 +270,11 @@ Samba source code for the complete list.
 protocols level the server supports. This parameter is
 preserved for backwards compatibility, but any string
 following the <strong>-m</strong> will be ignored.
+<p><br><a name="minusb"></a>
+<li><strong><strong>-b buffersize</strong></strong> This option changes the transmit/send buffer
+size when getting or putting a file from/to the server. The default
+is 65520 bytes. Setting this value smaller (to 1200 bytes) has been
+observed to speed up file transfers to and from a Win9x server.
 <p><br><a name="minusW"></a>
 <li><strong><strong>-W WORKGROUP</strong></strong> Override the default workgroup specified in the
 <a href="smb.conf.5.html#workgroup"><strong>workgroup</strong></a> parameter of the
@@ -535,7 +537,7 @@ LANMAN2 protocol or above.
 <p><br>The variable <strong>USER</strong> may contain the username of the person using the
 client.  This information is used only if the protocol level is high
 enough to support session-level passwords.
-<p><br>The variable <strong>PASSWORD</strong> may contain the password of the person using
+<p><br>The variable <strong>PASSWD</strong> may contain the password of the person using
 the client.  This information is used only if the protocol level is
 high enough to support session-level passwords.
 <p><br><a name="INSTALLATION"></a>
diff --git a/docs/htmldocs/smbd.8.html b/docs/htmldocs/smbd.8.html
index 790c406394..8230d50f47 100644
--- a/docs/htmldocs/smbd.8.html
+++ b/docs/htmldocs/smbd.8.html
@@ -24,7 +24,7 @@
 <p><br><a name="SYNOPSIS"></a>
 <h2>SYNOPSIS</h2>
     
-<p><br><strong>smbd</strong> [<a href="smbd.8.html#minusD">-D</a>] [<a href="smbd.8.html#minusa">-a</a>] [<a href="smbd.8.html#minuso">-o</a>] [<a href="smbd.8.html#minusd">-d debuglevel</a>] [<a href="smbd.8.html#minusl">-l log file</a>] [<a href="smbd.8.html#minusp">-p port number</a>] [<a href="smbd.8.html#minusO">-O socket options</a>] [<a href="smbd.8.html#minuss">-s configuration file</a>] [<a href="smbd.8.html#minusi">-i scope</a>] [<a href="smbd.8.html#minusP">-P</a>] [<a href="smbd.8.html#minush">-h</a>]
+<p><br><strong>smbd</strong> [<a href="smbd.8.html#minusD">-D</a>] [<a href="smbd.8.html#minusa">-a</a>] [<a href="smbd.8.html#minuso">-o</a>] [<a href="smbd.8.html#minusP">-P</a>] [<a href="smbd.8.html#minush">-h</a>] [<a href="smbd.8.html#minusV">-V</a>] [<a href="smbd.8.html#minusd">-d debuglevel</a>] [<a href="smbd.8.html#minusl">-l log file</a>] [<a href="smbd.8.html#minusp">-p port number</a>] [<a href="smbd.8.html#minusO">-O socket options</a>] [<a href="smbd.8.html#minuss">-s configuration file</a>] [<a href="smbd.8.html#minusi">-i scope</a>]
 <p><br><a name="DESCRIPTION"></a>
 <h2>DESCRIPTION</h2>
     
@@ -75,6 +75,13 @@ append log messages to the log file.  This is the default.
 <li><strong><strong>-o</strong></strong> If this parameter is specified, the log files will be
 overwritten when opened.  By default, the log files will be appended
 to.
+<p><br><a name="minusP"></a>
+<li><strong><strong>-P</strong></strong> Passive option. Causes smbd not to send any network traffic
+out. Used for debugging by the developers only.
+<p><br><a name="minush"></a>
+<li><strong><strong>-h</strong></strong> Prints the help information (usage) for <strong>smbd</strong>.
+<p><br><a name="minusV"></a>
+<li><strong><strong>-V</strong></strong> Prints the version number for <strong>smbd</strong>.
 <p><br><a name="minusd"></a>
 <li><strong><strong>-d debuglevel</strong></strong> debuglevel is an integer from 0 to 10.
 <p><br>The default value if this parameter is not specified is zero.
@@ -133,11 +140,6 @@ use of NetBIOS scopes, see rfc1001.txt and rfc1002.txt. NetBIOS scopes
 are <em>very</em> rarely used, only set this parameter if you are the
 system administrator in charge of all the NetBIOS systems you
 communicate with.
-<p><br><a name="minush"></a>
-<li><strong><strong>-h</strong></strong> Prints the help information (usage) for smbd.
-<p><br><a name="minusP"></a>
-<li><strong><strong>-P</strong></strong> Passive option. Causes smbd not to send any network traffic
-out. Used for debugging by the developers only.
 <p><br></ul>
 <p><br><a name="FILES"></a>
 <h2>FILES</h2>
@@ -357,16 +359,11 @@ performance.
 <p><br><a name="SEEALSO"></a>
 <h2>SEE ALSO</h2>
     
-<p><br><strong>hosts_access (5)</strong>,
-<strong>inetd (8)</strong>,
-<a href="nmbd.8.html"><strong>nmbd (8)</strong></a>,
-<a href="smb.conf.5.html"><strong>smb.conf (5)</strong></a>,
-<a href="smbclient.1.html"><strong>smbclient (1)</strong></a>,
-<a href="testparm.1.html"><strong>testparm (1)</strong></a>,
-<a href="testprns.1.html"><strong>testprns (1)</strong></a>,
-<a href="rpcclient.1.html"><strong>rpcclient (1)</strong></a>,
-and the Internet RFC's <strong>rfc1001.txt</strong>, <strong>rfc1002.txt</strong>.
-In addition the CIFS (formerly SMB)
+<p><br><strong>hosts_access (5)</strong>, <strong>inetd (8)</strong>, <a href="nmbd.8.html"><strong>nmbd (8)</strong></a>,
+<a href="smb.conf.5.html"><strong>smb.conf (5)</strong></a>, <a href="smbclient.1.html"><strong>smbclient
+(1)</strong></a>, <a href="testparm.1.html"><strong>testparm (1)</strong></a>,
+<a href="testprns.1.html"><strong>testprns (1)</strong></a>, and the Internet RFC's
+<strong>rfc1001.txt</strong>, <strong>rfc1002.txt</strong>. In addition the CIFS (formerly SMB)
 specification is available as a link from the Web page :
 <a href="http://samba.org/cifs/">http://samba.org/cifs/</a>.
 <p><br><a name="AUTHOR"></a>
diff --git a/docs/htmldocs/smbstatus.1.html b/docs/htmldocs/smbstatus.1.html
index 4a854a5c4d..1cc65e8158 100644
--- a/docs/htmldocs/smbstatus.1.html
+++ b/docs/htmldocs/smbstatus.1.html
@@ -36,7 +36,7 @@ connections.
     
 <p><br><ul>
 <p><br><a name="minusP"></a>
-<li><strong><strong>-P</strong></strong> If samba has been compiled with the profiling option, 
+<li><strong><strong>-P</strong></strong> If samba has been compiled with the profiling option,
 print only the contents of the profiling shared memory area.
 <p><br><a name="minusb"></a>
 <li><strong><strong>-b</strong></strong> gives brief output.
diff --git a/docs/htmldocs/swat.8.html b/docs/htmldocs/swat.8.html
index 0d43dd494b..3a29f17ab5 100644
--- a/docs/htmldocs/swat.8.html
+++ b/docs/htmldocs/swat.8.html
@@ -20,7 +20,7 @@
     
 <p><br><a name="NAME"></a>
 <h2>NAME</h2>
-    swat - swat - Samba Web Administration Tool
+    swat - Samba Web Administration Tool
 <p><br><a name="SYNOPSIS"></a>
 <h2>SYNOPSIS</h2>
     
diff --git a/docs/htmldocs/testparm.1.html b/docs/htmldocs/testparm.1.html
index 00db231626..1e0396af33 100644
--- a/docs/htmldocs/testparm.1.html
+++ b/docs/htmldocs/testparm.1.html
@@ -24,7 +24,7 @@
 <p><br><a name="SYNOPSIS"></a>
 <h2>SYNOPSIS</h2>
      
-<p><br><strong>testparm</strong> [<a href="testparm.1.html#minuss">-s</a>] [<a href="testparm.1.html#configfilename">configfilename</a>] [<a href="testparm.1.html#hostname">hostname</a> <a href="testparm.1.html#hostIP">hostIP</a>]
+<p><br><strong>testparm</strong> [<a href="testparm.1.html#minuss">-s</a>] [<a href="testparm.1.html#minush">-h</a>] [<a href="testparm.1.html#minusL">-L servername</a>] [<a href="testparm.1.html#configfilename">configfilename</a>] [<a href="testparm.1.html#hostname">hostname</a> <a href="testparm.1.html#hostIP">hostIP</a>]
 <p><br><a name="DESCRIPTION"></a>
 <h2>DESCRIPTION</h2>
     
@@ -39,6 +39,10 @@ configuration file will be available or will operate as expected.
 <p><br>If the optional host name and host IP address are specified on the
 command line, this test program will run through the service entries
 reporting whether the specified host has access to each service.
+<p><br>If <strong>testparm</strong> finds an error in the <a href="smb.conf.5.html"><strong>smb.conf</strong></a>
+file it returns an exit code of 1 to the calling program, else it returns
+an exit code of 0. This allows shell scripts to test the output from
+<strong>testparm</strong>.
 <p><br><a name="OPTIONS"></a>
 <h2>OPTIONS</h2>
     
@@ -47,6 +51,11 @@ reporting whether the specified host has access to each service.
 <li><strong><strong>-s</strong></strong> Without this option, <strong>testparm</strong> will prompt for a
 carriage return after printing the service names and before dumping
 the service definitions.
+<p><br><a name="minush"></a>
+<li><strong><strong>-h</strong></strong> Print usage message
+<p><br><a name="minusL"></a>
+<li><strong><strong>-L servername</strong></strong> Sets the value of the %L macro to servername. This
+is useful for testing include files specified with the %L macro.
 <p><br><a name="configfilename"></a>
 <li><strong><strong>configfilename</strong></strong> This is the name of the configuration file to
 check. If this parameter is not present then the default
diff --git a/docs/manpages/nmbd.8 b/docs/manpages/nmbd.8
index 2c880faa42..72aeaf14a7 100644
--- a/docs/manpages/nmbd.8
+++ b/docs/manpages/nmbd.8
@@ -6,7 +6,7 @@ naming services to clients
 .PP 
 .SH "SYNOPSIS" 
 .PP 
-\fBnmbd\fP [-D] [-o] [-a] [-H lmhosts file] [-d debuglevel] [-l log file basename] [-n primary NetBIOS name] [-p port number] [-s configuration file] [-i NetBIOS scope] [-h]
+\fBnmbd\fP [-D] [-a] [-o] [-h] [-V] [-H lmhosts file] [-d debuglevel] [-l log file basename] [-n primary NetBIOS name] [-p port number] [-s configuration file] [-i NetBIOS scope]
 .PP 
 .SH "DESCRIPTION" 
 .PP 
@@ -59,6 +59,12 @@ If this parameter is specified, the log files will be
 overwritten when opened\&.  By default, the log files will be appended
 to\&.
 .IP 
+.IP "\fB-h\fP" 
+Prints the help information (usage) for \fBnmbd\fP\&.
+.IP 
+.IP "\fB-V\fP" 
+Prints the version number for \fBnmbd\fP\&.
+.IP 
 .IP "\fB-H filename\fP" 
 NetBIOS lmhosts file\&.
 .IP 
@@ -138,9 +144,6 @@ are \fIvery\fP rarely used, only set this parameter if you are the
 system administrator in charge of all the NetBIOS systems you
 communicate with\&.
 .IP 
-.IP "\fB-h\fP" 
-Prints the help information (usage) for \fBnmbd\fP\&.
-.IP 
 .PP 
 .SH "FILES" 
 .PP 
diff --git a/docs/manpages/nmblookup.1 b/docs/manpages/nmblookup.1
index 04f24d0ef5..a542e6d507 100644
--- a/docs/manpages/nmblookup.1
+++ b/docs/manpages/nmblookup.1
@@ -5,7 +5,7 @@ nmblookup \- NetBIOS over TCP/IP client used to lookup NetBIOS names
 .PP 
 .SH "SYNOPSIS" 
 .PP 
-\fBnmblookup\fP [-M] [-R] [-S] [-r] [-A] [-h] [-B broadcast address] [-U unicast address] [-d debuglevel] [-s smb config file] [-i NetBIOS scope] name
+\fBnmblookup\fP [-M] [-R] [-S] [-r] [-A] [-h] [-B broadcast address] [-U unicast address] [-d debuglevel] [-s smb config file] [-i NetBIOS scope] [-T] name
 .PP 
 .SH "DESCRIPTION" 
 .PP 
@@ -20,8 +20,9 @@ or to a particular machine\&. All queries are done over UDP\&.
 .PP 
 .IP 
 .IP "\fB-M\fP" 
-Searches for a master browser\&. This is done by doing a
-broadcast lookup on the special name \f(CW__MSBROWSE__\fP\&.
+Searches for a master browser by looking up the 
+NetBIOS name \fBname\fP with a type of 0x1d\&. If \fBname\fP
+is \f(CW"-"\fP then it does a lookup on the special name \f(CW__MSBROWSE__\fP\&.
 .IP 
 .IP "\fB-R\fP" 
 Set the recursion desired bit in the packet to do a
@@ -55,8 +56,8 @@ Print a help (usage) message\&.
 .IP "\fB-B broadcast address\fP" 
 Send the query to the given broadcast
 address\&. Without this option the default behavior of nmblookup is to
-send the query to the broadcast address of the primary network
-interface as either auto-detected or defined in the 
+send the query to the broadcast address of the network
+interfaces as either auto-detected or defined in the 
 \fBinterfaces\fP parameter of the 
 \fBsmb\&.conf (5)\fP file\&.
 .IP 
@@ -97,6 +98,12 @@ are \fIvery\fP rarely used, only set this parameter if you are the
 system administrator in charge of all the NetBIOS systems you
 communicate with\&.
 .IP 
+.IP "\fB-T\fP" 
+This causes any IP addresses found in the lookup to be
+looked up via a reverse DNS lookup into a DNS name, and printed out
+before each \f(CW"IP address   NetBIOS name"\fP pair that is the normal
+output\&.
+.IP 
 .IP "\fBname\fP" 
 This is the NetBIOS name being queried\&. Depending upon
 the previous options this may be a NetBIOS name or IP address\&. If a
diff --git a/docs/manpages/samba.7 b/docs/manpages/samba.7
index 03ab086340..96975f34c2 100644
--- a/docs/manpages/samba.7
+++ b/docs/manpages/samba.7
@@ -50,18 +50,6 @@ servers (such as Windows NT), and can also be used to allow a UNIX box
 to print to a printer attached to any SMB server (such as a PC running
 Windows NT)\&.
 .IP 
-.IP "\fBrpcclient\fP" 
-.br 
-.br 
-The \fBrpcclient\fP
-(1) program is a client that can \'talk\' to an
-SMB/CIFS MSRPC server\&.  Operations include things like managing a SAM
-Database (users, groups and aliases) in the same way as the Windows NT
-programs \fBUser Manager for Domains\fP and \fBServer Manager for Domains\fP;
-managing a remote registry in the same way as the Windows NT programs
-\fBREGEDT32\&.EXE\fP and \fBREGEDIT\&.EXE\fP; viewing a remote event log (same
-as \fBEVENTVWR\&.EXE\fP)\&.
-.IP 
 .IP "\fBtestparm\fP" 
 .br 
 .br 
diff --git a/docs/manpages/smb.conf.5 b/docs/manpages/smb.conf.5
index a3a58e3899..da87331769 100644
--- a/docs/manpages/smb.conf.5
+++ b/docs/manpages/smb.conf.5
@@ -242,6 +242,7 @@ would look like this:
 
  	[printers]
  		path = /usr/spool/public
+ 		writeable = no
  		guest ok = yes
  		printable = yes 
 
@@ -490,6 +491,12 @@ parameter for details\&.  Note that some are synonyms\&.
 .PP 
 .IP 
 .IP o 
+\fBadd user script\fP
+.IP 
+.IP o 
+\fBallow trusted domains\fP
+.IP 
+.IP o 
 \fBannounce as\fP
 .IP 
 .IP o 
@@ -523,9 +530,18 @@ parameter for details\&.  Note that some are synonyms\&.
 \fBdeadtime\fP
 .IP 
 .IP o 
+\fBdebug hires timestamp\fP
+.IP 
+.IP o 
+\fBdebug pid\fP
+.IP 
+.IP o 
 \fBdebug timestamp\fP
 .IP 
 .IP o 
+\fBdebug uid\fP
+.IP 
+.IP o 
 \fBdebuglevel\fP
 .IP 
 .IP o 
@@ -535,6 +551,9 @@ parameter for details\&.  Note that some are synonyms\&.
 \fBdefault service\fP
 .IP 
 .IP o 
+\fBdelete user script\fP
+.IP 
+.IP o 
 \fBdfree command\fP
 .IP 
 .IP o 
@@ -550,9 +569,6 @@ parameter for details\&.  Note that some are synonyms\&.
 \fBdomain controller\fP
 .IP 
 .IP o 
-\fBdomain group map\fP
-.IP 
-.IP o 
 \fBdomain groups\fP
 .IP 
 .IP o 
@@ -568,9 +584,6 @@ parameter for details\&.  Note that some are synonyms\&.
 \fBdomain master\fP
 .IP 
 .IP o 
-\fBdomain user map\fP
-.IP 
-.IP o 
 \fBencrypt passwords\fP
 .IP 
 .IP o 
@@ -592,13 +605,16 @@ parameter for details\&.  Note that some are synonyms\&.
 \fBkernel oplocks\fP
 .IP 
 .IP o 
-\fBldap bind as\fP
+\fBldap filter\fP
 .IP 
 .IP o 
-\fBldap passwd file\fP
+\fBldap port\fP
 .IP 
 .IP o 
-\fBldap port\fP
+\fBldap root\fP
+.IP 
+.IP o 
+\fBldap root passwd\fP
 .IP 
 .IP o 
 \fBldap server\fP
@@ -616,9 +632,6 @@ parameter for details\&.  Note that some are synonyms\&.
 \fBload printers\fP
 .IP 
 .IP o 
-\fBlocal group map\fP
-.IP 
-.IP o 
 \fBlocal master\fP
 .IP 
 .IP o 
@@ -655,6 +668,9 @@ parameter for details\&.  Note that some are synonyms\&.
 \fBmangled stack\fP
 .IP 
 .IP o 
+\fBmap to guest\fP
+.IP 
+.IP o 
 \fBmax disk size\fP
 .IP 
 .IP o 
@@ -682,6 +698,9 @@ parameter for details\&.  Note that some are synonyms\&.
 \fBmessage command\fP
 .IP 
 .IP o 
+\fBmin passwd length\fP
+.IP 
+.IP o 
 \fBmin wins ttl\fP
 .IP 
 .IP o 
@@ -697,6 +716,9 @@ parameter for details\&.  Note that some are synonyms\&.
 \fBnis homedir\fP
 .IP 
 .IP o 
+\fBnt acl support\fP
+.IP 
+.IP o 
 \fBnt pipe support\fP
 .IP 
 .IP o 
@@ -709,6 +731,9 @@ parameter for details\&.  Note that some are synonyms\&.
 \fBole locking compatibility\fP
 .IP 
 .IP o 
+\fBoplock break wait time\fP
+.IP 
+.IP o 
 \fBos level\fP
 .IP 
 .IP o 
@@ -772,6 +797,9 @@ parameter for details\&.  Note that some are synonyms\&.
 \fBremote browse sync\fP
 .IP 
 .IP o 
+\fBrestrict anonymous\fP
+.IP 
+.IP o 
 \fBroot\fP
 .IP 
 .IP o 
@@ -895,6 +923,9 @@ parameter for details\&.  Note that some are synonyms\&.
 \fBwins server\fP
 .IP 
 .IP o 
+\fBwins hook\fP
+.IP 
+.IP o 
 \fBwins support\fP
 .IP 
 .IP o 
@@ -971,6 +1002,9 @@ parameter for details\&. Note that some are synonyms\&.
 \fBdirectory mode\fP
 .IP 
 .IP o 
+\fBdirectory security mask\fP
+.IP 
+.IP o 
 \fBdont descend\fP
 .IP 
 .IP o 
@@ -998,9 +1032,15 @@ parameter for details\&. Note that some are synonyms\&.
 \fBforce directory mode\fP
 .IP 
 .IP o 
+\fBforce directory security mode\fP
+.IP 
+.IP o 
 \fBforce group\fP
 .IP 
 .IP o 
+\fBforce security mode\fP
+.IP 
+.IP o 
 \fBforce user\fP
 .IP 
 .IP o 
@@ -1037,6 +1077,9 @@ parameter for details\&. Note that some are synonyms\&.
 \fBinvalid users\fP
 .IP 
 .IP o 
+\fBlevel2 oplocks\fP
+.IP 
+.IP o 
 \fBlocking\fP
 .IP 
 .IP o 
@@ -1061,6 +1104,9 @@ parameter for details\&. Note that some are synonyms\&.
 \fBmangle case\fP
 .IP 
 .IP o 
+\fBmangle locks\fP
+.IP 
+.IP o 
 \fBmangled map\fP
 .IP 
 .IP o 
@@ -1079,9 +1125,6 @@ parameter for details\&. Note that some are synonyms\&.
 \fBmap system\fP
 .IP 
 .IP o 
-\fBmap to guest\fP
-.IP 
-.IP o 
 \fBmax connections\fP
 .IP 
 .IP o 
@@ -1097,6 +1140,9 @@ parameter for details\&. Note that some are synonyms\&.
 \fBoplocks\fP
 .IP 
 .IP o 
+\fBoplock contention limit\fP
+.IP 
+.IP o 
 \fBpath\fP
 .IP 
 .IP o 
@@ -1109,6 +1155,9 @@ parameter for details\&. Note that some are synonyms\&.
 \fBpreexec\fP
 .IP 
 .IP o 
+\fBpreexec close\fP
+.IP 
+.IP o 
 \fBpreserve case\fP
 .IP 
 .IP o 
@@ -1160,6 +1209,12 @@ parameter for details\&. Note that some are synonyms\&.
 \fBroot preexec\fP
 .IP 
 .IP o 
+\fBsecurity mask\fP
+.IP 
+.IP o 
+\fBroot preexec close\fP
+.IP 
+.IP o 
 \fBset directory\fP
 .IP 
 .IP o 
@@ -1220,6 +1275,54 @@ parameter for details\&. Note that some are synonyms\&.
 .SH "EXPLANATION OF EACH PARAMETER" 
 .PP 
 .IP 
+.IP "\fBadd user script (G)\fP" 
+.IP 
+This is the full pathname to a script that will be run \fIAS ROOT\fP by
+\fBsmbd (8)\fP under special circumstances decribed
+below\&.
+.IP 
+Normally, a Samba server requires that UNIX users are created for all
+users accessing files on this server\&. For sites that use Windows NT
+account databases as their primary user database creating these users
+and keeping the user list in sync with the Windows NT PDC is an
+onerous task\&. This option allows \fBsmbd\fP to create
+the required UNIX users \fION DEMAND\fP when a user accesses the Samba
+server\&.
+.IP 
+In order to use this option, \fBsmbd\fP must be set to
+\fBsecurity=server\fP or
+\fBsecurity=domain\fP and \fB"add user script"\fP
+must be set to a full pathname for a script that will create a UNIX user
+given one argument of \fB%u\fP, which expands into the UNIX user name to
+create\&.
+.IP 
+When the Windows user attempts to access the Samba server, at
+\fI"login"\fP(session setup in the SMB protocol) time,
+\fBsmbd\fP contacts the \fBpassword
+server\fP and attempts to authenticate the given user
+with the given password\&. If the authentication succeeds then
+\fBsmbd\fP attempts to find a UNIX user in the UNIX
+password database to map the Windows user into\&. If this lookup fails,
+and \fB"add user script"\fP is set then \fBsmbd\fP will
+call the specified script \fIAS ROOT\fP, expanding any \fB%u\fP argument
+to be the user name to create\&.
+.IP 
+If this script successfully creates the user then
+\fBsmbd\fP will continue on as though the UNIX user
+already existed\&. In this way, UNIX users are dynamically created to
+match existing Windows NT accounts\&.
+.IP 
+See also \fBsecurity=server\fP,
+\fBsecurity=domain\fP, \fBpassword
+server\fP, \fBdelete user
+script\fP\&.
+.IP 
+\fBDefault:\fP
+\f(CW	add user script = <empty string>\fP
+.IP 
+\fBExample:\fP
+\f(CW	add user script = /usr/local/samba/bin/add_user %u\fP
+.IP 
 .IP "\fBadmin users (S)\fP" 
 .IP 
 This is a list of users who will be granted administrative privileges
@@ -1240,63 +1343,29 @@ file permissions\&.
 .IP 
 .IP "\fBallow hosts (S)\fP" 
 .IP 
-A synonym for this parameter is \fB\'hosts allow\'\fP
-.IP 
-This parameter is a comma, space, or tab delimited set of hosts which
-are permitted to access a service\&.
+Synonym for \fBhosts allow\fP\&.
 .IP 
-If specified in the \fB[global]\fP section then it will
-apply to all services, regardless of whether the individual service
-has a different setting\&.
+.IP "\fBallow trusted domains (G)\fP" 
 .IP 
-You can specify the hosts by name or IP number\&. For example, you could
-restrict access to only the hosts on a Class C subnet with something
-like \f(CW"allow hosts = 150\&.203\&.5\&."\fP\&. The full syntax of the list is
-described in the man page \fBhosts_access (5)\fP\&. Note that this man
-page may not be present on your system, so a brief description will
-be given here also\&.
+This option only takes effect when the \fBsecurity\fP
+option is set to \fBserver\fP or \fBdomain\fP\&.  If it is set to no,
+then attempts to connect to a resource from a domain or workgroup other than
+the one which smbd is running in will fail, even if that domain
+is trusted by the remote server doing the authentication\&.
 .IP 
-\fINOTE:\fP IF you wish to allow the \fBsmbpasswd
-(8)\fP program to be run by local users to change
-their Samba passwords using the local \fBsmbd (8)\fP
-daemon, then you \fIMUST\fP ensure that the localhost is listed in your
-\fBallow hosts\fP list, as \fBsmbpasswd (8)\fP runs
-in client-server mode and is seen by the local
-\fBsmbd\fP process as just another client\&.
-.IP 
-You can also specify hosts by network/netmask pairs and by netgroup
-names if your system supports netgroups\&. The \fIEXCEPT\fP keyword can also
-be used to limit a wildcard list\&. The following examples may provide
-some help:
-.IP 
-\fBExample 1\fP: allow localhost and all IPs in 150\&.203\&.*\&.* except one
-.IP 
-\f(CW	hosts allow = localhost, 150\&.203\&. EXCEPT 150\&.203\&.6\&.66\fP
-.IP 
-\fBExample 2\fP: allow localhost and hosts that match the given network/netmask
-.IP 
-\f(CW	hosts allow = localhost, 150\&.203\&.15\&.0/255\&.255\&.255\&.0\fP
-.IP 
-\fBExample 3\fP: allow a localhost plus a couple of hosts
-.IP 
-\f(CW	hosts allow = localhost, lapland, arvidsjaur\fP
-.IP 
-\fBExample 4\fP: allow only hosts in NIS netgroup "foonet" or localhost, but 
-deny access from one particular host
-.IP 
-\f(CW 	hosts allow = @foonet, localhost\fP
-\f(CW 	hosts deny = pirate\fP
-.IP 
-Note that access still requires suitable user-level passwords\&.
-.IP 
-See \fBtestparm (1)\fP for a way of testing your
-host access to see if it does what you expect\&.
+This is useful if you only want your Samba server to serve resources
+to users in the domain it is a member of\&. As an example, suppose that there are
+two domains DOMA and DOMB\&.  DOMB is trusted by DOMA, which contains
+the Samba server\&.  Under normal circumstances, a user with an account
+in DOMB can then access the resources of a UNIX account with the same
+account name on the Samba server even if they do not have an account
+in DOMA\&.  This can make implementing a security boundary difficult\&.
 .IP 
 \fBDefault:\fP
-\f(CW	none (i\&.e\&., all hosts permitted access)\fP
+\f(CW     allow trusted domains = Yes\fP
 .IP 
 \fBExample:\fP
-\f(CW	allow hosts = 150\&.203\&.5\&. localhost myhost\&.mynet\&.edu\&.au\fP
+\f(CW     allow trusted domains = No\fP
 .IP 
 .IP "\fBalternate permissions (S)\fP" 
 .IP 
@@ -1310,14 +1379,15 @@ regardless if the owner of the file is the currently logged on user or not\&.
 .IP 
 This specifies what type of server \fBnmbd\fP will
 announce itself as, to a network neighborhood browse list\&. By default
-this is set to Windows NT\&. The valid options are : "NT", "Win95" or
-"WfW" meaning Windows NT, Windows 95 and Windows for Workgroups
-respectively\&. Do not change this parameter unless you have a specific
-need to stop Samba appearing as an NT server as this may prevent Samba
-servers from participating as browser servers correctly\&.
+this is set to Windows NT\&. The valid options are : "NT", which is a
+synonym for "NT Server", "NT Server", "NT Workstation", "Win95" or
+"WfW" meaning Windows NT Server, Windows NT Workstation, Windows 95
+and Windows for Workgroups respectively\&. Do not change this parameter
+unless you have a specific need to stop Samba appearing as an NT server
+as this may prevent Samba servers from participating as browser servers correctly\&.
 .IP 
 \fBDefault:\fP
-\f(CW	announce as = NT\fP
+\f(CW	announce as = NT Server\fP
 .IP 
 \fBExample\fP
 \f(CW	announce as = Win95\fP
@@ -1396,11 +1466,16 @@ should not use this parameter for machines that are serving PPP or
 other intermittent or non-broadcast network interfaces as it will not
 cope with non-permanent interfaces\&.
 .IP 
-In addition, to change a users SMB password, the
-\fBsmbpasswd\fP by default connects to the
-\fI"localhost" - 127\&.0\&.0\&.1\fP address as an SMB client to issue the
-password change request\&. If \fB"bind interfaces only"\fP is set then
-unless the network address \fI127\&.0\&.0\&.1\fP is added to the
+If \fB"bind interfaces only"\fP is set then unless the network address
+\fI127\&.0\&.0\&.1\fP is added to the \fB\'interfaces\'\fP parameter
+list \fBsmbpasswd\fP and
+\fBswat\fP may not work as expected due to the
+reasons covered below\&.
+.IP 
+To change a users SMB password, the \fBsmbpasswd\fP
+by default connects to the \fI"localhost" - 127\&.0\&.0\&.1\fP address as an SMB
+client to issue the password change request\&. If \fB"bind interfaces only"\fP
+is set then unless the network address \fI127\&.0\&.0\&.1\fP is added to the
 \fB\'interfaces\'\fP parameter list then
 \fBsmbpasswd\fP will fail to connect in it\'s
 default mode\&. \fBsmbpasswd\fP can be forced to
@@ -1409,6 +1484,14 @@ use the primary IP interface of the local host by using its
 \fB"remote machine"\fP set to the IP name of the primary interface
 of the local host\&.
 .IP 
+The \fBswat\fP status page tries to connect with
+\fBsmbd\fP and \fBnmbd\fP at the address 
+\fI127\&.0\&.0\&.1\fP to determine if they are running\&.  Not adding \fI127\&.0\&.0\&.1\fP  will cause
+\fBsmbd\fP and \fBnmbd\fP to always show
+"not running" even if they really are\&.  This can prevent
+\fBswat\fP from starting/stopping/restarting
+\fBsmbd\fP and \fBnmbd\fP\&.
+.IP 
 \fBDefault:\fP
 \f(CW	bind interfaces only = False\fP
 .IP 
@@ -1462,11 +1545,11 @@ shares in a net view and in the browse list\&.
 \fBExample:\fP
 \f(CW	browseable = No\fP
 .IP 
-.IP "\fBcase sensitive (S)\fP" 
+.IP "\fBcase sensitive (G)\fP" 
 .IP 
 See the discussion in the section \fBNAME MANGLING\fP\&.
 .IP 
-.IP "\fBcasesignames (S)\fP" 
+.IP "\fBcasesignames (G)\fP" 
 .IP 
 Synonym for \fB"case sensitive"\fP\&.
 .IP 
@@ -1514,7 +1597,14 @@ correctly\&.
 .IP o 
 \fBISO8859-5\fP Russian Cyrillic UNIX character set\&. The parameter
 \fBclient code page\fP \fIMUST\fP be set to code
-page 866 if the \fBcharacter set\fP parameter is set to ISO8859-2
+page 866 if the \fBcharacter set\fP parameter is set to ISO8859-5
+in order for the conversion to the UNIX character set to be done
+correctly\&. 
+.IP 
+.IP o 
+\fBISO8859-7\fP Greek UNIX character set\&. The parameter
+\fBclient code page\fP \fIMUST\fP be set to code
+page 737 if the \fBcharacter set\fP parameter is set to ISO8859-7
 in order for the conversion to the UNIX character set to be done
 correctly\&. 
 .IP 
@@ -1766,6 +1856,21 @@ performed\&.
 \fBExample:\fP
 \f(CW	deadtime = 15\fP
 .IP 
+.IP "\fBdebug hires timestamp (G)\fP" 
+.IP 
+Sometimes the timestamps in the log messages are needed with a
+resolution of higher that seconds, this boolean parameter adds
+microsecond resolution to the timestamp message header when turned on\&.
+.IP 
+Note that the parameter \fBdebug timestamp\fP
+must be on for this to have an effect\&.
+.IP 
+\fBDefault:\fP
+\f(CW debug hires timestamp = No\fP
+.IP 
+\fBExample:\fP
+\f(CW debug hires timestamp = Yes\fP
+.IP 
 .IP "\fBdebug timestamp (G)\fP" 
 .IP 
 Samba2\&.0 debug log messages are timestamped by default\&. If you are
@@ -1779,6 +1884,37 @@ off\&.
 \fBExample:\fP
 \f(CW	debug timestamp = No\fP
 .IP 
+.IP "\fBdebug pid (G)\fP" 
+.IP 
+When using only one log file for more then one forked smbd-process
+there may be hard to follow which process outputs which message\&.
+This boolean parameter is adds the process-id to the timestamp message
+headers in the logfile when turned on\&.
+.IP 
+Note that the parameter \fBdebug timestamp\fP
+must be on for this to have an effect\&.
+.IP 
+\fBDefault:\fP
+\f(CW	debug pid = No\fP
+.IP 
+\fBExample:\fP
+\f(CW	debug pid = Yes\fP
+.IP 
+.IP "\fBdebug uid (G)\fP" 
+.IP 
+Samba is sometimes run as root and sometime run as the connected
+user, this boolean parameter inserts the current euid, egid, uid
+and gid to the timestamp message headers in the log file if turned on\&.
+.IP 
+Note that the parameter \fBdebug timestamp\fP
+must be on for this to have an effect\&.
+.IP 
+\fBDefault:\fP
+\f(CW	debug uid = No\fP
+.IP 
+\fBExample:\fP
+\f(CW	debug uid = Yes\fP
+.IP 
 .IP "\fBdebug level (G)\fP" 
 .IP 
 The value of the parameter (an integer) allows the debug level
@@ -1836,6 +1972,59 @@ interesting things\&.
  
 
 .IP 
+.IP "\fBdelete user script (G)\fP" 
+.IP 
+This is the full pathname to a script that will be run \fIAS ROOT\fP by
+\fBsmbd (8)\fP under special circumstances decribed
+below\&.
+.IP 
+Normally, a Samba server requires that UNIX users are created for all
+users accessing files on this server\&. For sites that use Windows NT
+account databases as their primary user database creating these users
+and keeping the user list in sync with the Windows NT PDC is an
+onerous task\&. This option allows \fBsmbd\fP to delete
+the required UNIX users \fION DEMAND\fP when a user accesses the Samba
+server and the Windows NT user no longer exists\&.
+.IP 
+In order to use this option, \fBsmbd\fP must be set to
+\fBsecurity=domain\fP and \fB"delete user
+script"\fP must be set to a full pathname for a script that will delete
+a UNIX user given one argument of \fB%u\fP, which expands into the UNIX
+user name to delete\&. \fINOTE\fP that this is different to the
+\fBadd user script\fP which will work with the
+\fBsecurity=server\fP option as well as
+\fBsecurity=domain\fP\&. The reason for this
+is only when Samba is a domain member does it get the information
+on an attempted user logon that a user no longer exists\&. In the
+\fBsecurity=server\fP mode a missing user
+is treated the same as an invalid password logon attempt\&. Deleting
+the user in this circumstance would not be a good idea\&.
+.IP 
+When the Windows user attempts to access the Samba server, at
+\fI"login"\fP(session setup in the SMB protocol) time,
+\fBsmbd\fP contacts the \fBpassword
+server\fP and attempts to authenticate the given user
+with the given password\&. If the authentication fails with the specific
+Domain error code meaning that the user no longer exists then
+\fBsmbd\fP attempts to find a UNIX user in the UNIX
+password database that matches the Windows user account\&. If this lookup succeeds,
+and \fB"delete user script"\fP is set then \fBsmbd\fP will
+call the specified script \fIAS ROOT\fP, expanding any \fB%u\fP argument
+to be the user name to delete\&.
+.IP 
+This script should delete the given UNIX username\&. In this way, UNIX
+users are dynamically deleted to match existing Windows NT accounts\&.
+.IP 
+See also \fBsecurity=domain\fP,
+\fBpassword server\fP, \fBadd user
+script\fP\&.
+.IP 
+\fBDefault:\fP
+\f(CW	delete user script = <empty string>\fP
+.IP 
+\fBExample:\fP
+\f(CW	delete user script = /usr/local/samba/bin/del_user %u\fP
+.IP 
 .IP "\fBdelete readonly (S)\fP" 
 .IP 
 This parameter allows readonly files to be deleted\&.  This is not
@@ -1880,16 +2069,7 @@ See also the \fBveto files\fP parameter\&.
 .IP 
 .IP "\fBdeny hosts (S)\fP" 
 .IP 
-The opposite of \fB\'allow hosts\'\fP - hosts listed
-here are \fINOT\fP permitted access to services unless the specific
-services have their own lists to override this one\&. Where the lists
-conflict, the \fB\'allow\'\fP list takes precedence\&.
-.IP 
-\fBDefault:\fP
-\f(CW	none (i\&.e\&., no hosts specifically excluded)\fP
-.IP 
-\fBExample:\fP
-\f(CW	deny hosts = 150\&.203\&.4\&. badhost\&.mynet\&.edu\&.au\fP
+Synonym for \fBhosts deny\fP\&.
 .IP 
 .IP "\fBdfree command (G)\fP" 
 .IP 
@@ -1980,7 +2160,8 @@ See the \fB"force directory mode"\fP parameter
 to cause particular mode bits to always be set on created directories\&.
 .IP 
 See also the \fB"create mode"\fP parameter for masking
-mode bits on created files\&.
+mode bits on created files, and the \fB"directory security mask"\fP
+parameter\&.
 .IP 
 \fBDefault:\fP
 \f(CW	directory mask = 0755\fP
@@ -1992,6 +2173,38 @@ mode bits on created files\&.
 .IP 
 Synonym for \fBdirectory mask\fP\&.
 .IP 
+.IP "\fBdirectory security mask (S)\fP" 
+.IP 
+This parameter controls what UNIX permission bits can be modified
+when a Windows NT client is manipulating the UNIX permission on a
+directory using the native NT security dialog box\&.
+.IP 
+This parameter is applied as a mask (AND\'ed with) to the changed
+permission bits, thus preventing any bits not in this mask from
+being modified\&. Essentially, zero bits in this mask may be treated
+as a set of bits the user is not allowed to change\&.
+.IP 
+If not set explicitly this parameter is set to the same value as the
+\fBdirectory mask\fP parameter\&. To allow a user to
+modify all the user/group/world permissions on a directory, set this
+parameter to 0777\&.
+.IP 
+\fINote\fP that users who can access the Samba server through other
+means can easily bypass this restriction, so it is primarily
+useful for standalone "appliance" systems\&.  Administrators of
+most normal systems will probably want to set it to 0777\&.
+.IP 
+See also the \fBforce directory security
+mode\fP, \fBsecurity
+mask\fP, \fBforce security mode\fP
+parameters\&.
+.IP 
+\fBDefault:\fP
+\f(CW	directory security mask = <same as directory mask>\fP
+.IP 
+\fBExample:\fP
+\f(CW	directory security mask = 0777\fP
+.IP 
 .IP "\fBdns proxy (G)\fP" 
 .IP 
 Specifies that \fBnmbd\fP when acting as a WINS
@@ -2015,7 +2228,7 @@ See also the parameter \fBwins support\fP\&.
 \fBdomain admin group (G)\fP
 .IP 
 This is an \fBEXPERIMENTAL\fP parameter that is part of the unfinished
-Samba NT Domain Controller Code\&.  It has been removed as of November 98\&.
+Samba NT Domain Controller Code\&. It may be removed in a later release\&.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list \fBSamba-ntdom\fP available by sending email to
@@ -2024,7 +2237,7 @@ mailing list \fBSamba-ntdom\fP available by sending email to
 .IP "\fBdomain admin users (G)\fP" 
 .IP 
 This is an \fBEXPERIMENTAL\fP parameter that is part of the unfinished
-Samba NT Domain Controller Code\&. It has been removed as of November 98\&.
+Samba NT Domain Controller Code\&. It may be removed in a later release\&.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list \fBSamba-ntdom\fP available by sending email to
@@ -2036,91 +2249,10 @@ This is a \fBDEPRECATED\fP parameter\&. It is currently not used within
 the Samba source and should be removed from all current smb\&.conf
 files\&. It is left behind for compatibility reasons\&.
 .IP 
-.IP "\fBdomain group map (G)\fP" 
-.IP 
-This option allows you to specify a file containing unique mappings
-of individual NT Domain Group names (in any domain) to UNIX group
-names\&.  This allows NT domain groups to be presented correctly to
-NT users, despite the lack of native support for the NT Security model
-(based on VAX/VMS) in UNIX\&.  The reader is advised to become familiar
-with the NT Domain system and its administration\&.
-.IP 
-This option is used in conjunction with \fB\'local group map\'\fP
-and \fB\'domain user map\'\fP\&.  The use of these three
-options is trivial and often unnecessary in the case where Samba is
-not expected to interact with any other SAM databases (whether local
-workstations or Domain Controllers)\&.
-.IP 
-The map file is parsed line by line\&.  If any line begins with a \f(CW\'#\'\fP
-or a \f(CW\';\'\fP then it is ignored\&.  Each line should contain a single UNIX
-group name on the left then a single NT Domain Group name on the right,
-separated by a tabstop or \f(CW\'=\'\fP\&.  If either name contains spaces then
-it should be enclosed in quotes\&.
-The line can be either of the form:
-.IP 
-\f(CW  UNIXgroupname	\e\eDOMAIN_NAME\e\eDomainGroupName \fP
-.IP 
-or:
-.IP 
-\f(CW  UNIXgroupname	DomainGroupName \fP
-.IP 
-In the case where Samba is either an \fBEXPERIMENTAL\fP Domain Controller
-or it is a member of a domain using \fB"security = domain"\fP,
-the latter format can be used: the default Domain name is the Samba Server\'s
-Domain name, specified by \fB"workgroup = MYGROUP"\fP\&.
-.IP 
-Any UNIX groups that are \fINOT\fP specified in this map file are assumed to
-be either Local or Domain Groups, depending on the role of the Samba Server\&.
-.IP 
-In the case when Samba is an \fBEXPERIMENTAL\fP Domain Controller, Samba
-will present \fIALL\fP such unspecified UNIX groups as its own NT Domain
-Groups, with the same name\&.
-.IP 
-In the case where Samba is member of a domain using
-\fB"security = domain"\fP, Samba will check the UNIX name with
-its Domain Controller (see \fB"password server"\fP)
-as if it was an NT Domain Group\&.  If the Domain Controller says that it is not,
-such unspecified (unmapped) UNIX groups which also are not NT Domain
-Groups are treated as Local Groups in the Samba Server\'s local SAM database\&.
-NT Administrators will recognise these as Workstation Local Groups,
-which are managed by running \fBUSRMGR\&.EXE\fP and selecting a remote
-Domain named "\e\eWORKSTATION_NAME", or by running \fBMUSRMGR\&.EXE\fP on
-a local Workstation\&.
-.IP 
-This may sound complicated, but it means that a Samba Server as
-either a member of a domain or as an \fBEXPERIMENTAL\fP Domain Controller
-will act like an NT Workstation (with a local SAM database) or an NT PDC
-(with a Domain SAM database) respectively, without the need for any of
-the map files at all\&.  If you \fBwant\fP to get fancy, however, you can\&.
-.IP 
-Note that adding an entry to map an arbitrary NT group in an arbitrary
-Domain to an arbitrary UNIX group \fIREQUIRES\fP the following:
-.IP 
-.IP 
-.IP o 
-that the UNIX group exists on the UNIX server\&.
-.IP 
-.IP o 
-that the NT Domain Group exists in the specified NT Domain
-.IP 
-.IP o 
-that the UNIX Server knows about the specified Domain; 
-.IP 
-.IP o 
-that all the UNIX users (who are expecting to access the Samba
-Server as the correct NT user and with the correct NT group permissions)
-in the UNIX group be mapped to the correct NT Domain users in the specified
-NT Domain using \fB\'domain user map\'\fP\&.
-.IP 
-.IP 
-Failure to meet any of these requirements may result in either (or
-both) errors reported in the log files or (and) incorrect or missing
-access rights granted to users\&.
-.IP 
 .IP "\fBdomain groups (G)\fP" 
 .IP 
 This is an \fBEXPERIMENTAL\fP parameter that is part of the unfinished
-Samba NT Domain Controller Code\&. It has been removed as of November 98\&.
+Samba NT Domain Controller Code\&. It may be removed in a later release\&.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list \fBSamba-ntdom\fP available by sending email to
@@ -2129,7 +2261,7 @@ mailing list \fBSamba-ntdom\fP available by sending email to
 .IP "\fBdomain guest group (G)\fP" 
 .IP 
 This is an \fBEXPERIMENTAL\fP parameter that is part of the unfinished
-Samba NT Domain Controller Code\&. It has been removed as of November 98\&.
+Samba NT Domain Controller Code\&. It may be removed in a later release\&.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list \fBSamba-ntdom\fP available by sending email to
@@ -2138,7 +2270,7 @@ mailing list \fBSamba-ntdom\fP available by sending email to
 .IP "\fBdomain guest users (G)\fP" 
 .IP 
 This is an \fBEXPERIMENTAL\fP parameter that is part of the unfinished
-Samba NT Domain Controller Code\&. It has been removed as of November 98\&.
+Samba NT Domain Controller Code\&. It may be removed in a later release\&.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list \fBSamba-ntdom\fP available by sending email to
@@ -2184,95 +2316,9 @@ special name for a \fBworkgroup\fP before a Windows NT
 PDC is able to do so then cross subnet browsing will behave strangely
 and may fail\&.
 .IP 
-By default ("auto") Samba will attempt to become the domain master
-browser only if it is the Primary Domain Controller\&.
-.IP 
 \fBDefault:\fP
-\f(CW	domain master = auto\fP
-.IP 
-\fBExample:\fP
 \f(CW	domain master = no\fP
 .IP 
-.IP "\fBdomain user map (G)\fP" 
-.IP 
-This option allows you to specify a file containing unique mappings
-of individual NT Domain User names (in any domain) to UNIX user
-names\&.  This allows NT domain users to be presented correctly to
-NT systems, despite the lack of native support for the NT Security model
-(based on VAX/VMS) in UNIX\&.  The reader is advised to become familiar
-with the NT Domain system and its administration\&.
-.IP 
-This option is used in conjunction with \fB\'local group map\'\fP
-and \fB\'domain group map\'\fP\&.  The use of these three
-options is trivial and often unnecessary in the case where Samba is
-not expected to interact with any other SAM databases (whether local
-workstations or Domain Controllers)\&.
-.IP 
-This option, which provides (and maintains) a one-to-one link between
-UNIX and NT users, is \fIDIFFERENT\fP from \fB\'username map\'\fP, which does \fINOT\fP maintain a distinction between the
-name(s) it can map to and the name it maps\&.
-.IP 
-The map file is parsed line by line\&.  If any line begins with a \f(CW\'#\'\fP
-or a \f(CW\';\'\fP then the line is ignored\&.  Each line should contain a single UNIX
-user name on the left then a single NT Domain User name on the right,
-separated by a tabstop or \f(CW\'=\'\fP\&.  If either name contains spaces then
-it should be enclosed in quotes\&.
-The line can be either of the form:
-.IP 
-\f(CW  UNIXusername	\e\eDOMAIN_NAME\e\eDomainUserName \fP
-.IP 
-or:
-.IP 
-\f(CW  UNIXusername	DomainUserName \fP
-.IP 
-In the case where Samba is either an \fBEXPERIMENTAL\fP Domain Controller
-or it is a member of a domain using \fB"security = domain"\fP,
-the latter format can be used: the default Domain name is the Samba Server\'s
-Domain name, specified by \fB"workgroup = MYGROUP"\fP\&.
-.IP 
-Any UNIX users that are \fINOT\fP specified in this map file are assumed
-to be either Domain or Workstation Users, depending on the role of the
-Samba Server\&.
-.IP 
-In the case when Samba is an \fBEXPERIMENTAL\fP Domain Controller, Samba
-will present \fIALL\fP such unspecified UNIX users as its own NT Domain
-Users, with the same name\&.
-.IP 
-In the case where Samba is a member of a domain using
-\fB"security = domain"\fP, Samba will check the UNIX name with
-its Domain Controller (see \fB"password server"\fP)
-as if it was an NT Domain User\&.  If the Domain Controller says that it is not,
-such unspecified (unmapped) UNIX users which also are not NT Domain
-Users are treated as Local Users in the Samba Server\'s local SAM database\&.
-NT Administrators will recognise these as Workstation Users,
-which are managed by running \fBUSRMGR\&.EXE\fP and selecting a remote
-Domain named "\e\eWORKSTATION_NAME", or by running \fBMUSRMGR\&.EXE\fP on
-a local Workstation\&.
-.IP 
-This may sound complicated, but it means that a Samba Server as
-either a member of a domain or as an \fBEXPERIMENTAL\fP Domain Controller
-will act like an NT Workstation (with a local SAM database) or an NT PDC
-(with a Domain SAM database) respectively, without the need for any of
-the map files at all\&.  If you \fBwant\fP to get fancy, however, you can\&.
-.IP 
-Note that adding an entry to map an arbitrary NT User in an arbitrary
-Domain to an arbitrary UNIX user \fIREQUIRES\fP the following:
-.IP 
-.IP 
-.IP o 
-that the UNIX user exists on the UNIX server\&.
-.IP 
-.IP o 
-that the NT Domain User exists in the specified NT Domain\&.
-.IP 
-.IP o 
-that the UNIX Server knows about the specified Domain\&.
-.IP 
-.IP 
-Failure to meet any of these requirements may result in either (or
-both) errors reported in the log files or (and) incorrect or missing
-access rights granted to users\&.
-.IP 
 .IP "\fBdont descend (S)\fP" 
 .IP 
 There are certain directories on some systems (e\&.g\&., the \f(CW/proc\fP tree
@@ -2470,6 +2516,38 @@ would force all created directories to have read and execute
 permissions set for \'group\' and \'other\' as well as the
 read/write/execute bits set for the \'user\'\&.
 .IP 
+.IP "\fBforce directory security mode (S)\fP" 
+.IP 
+This parameter controls what UNIX permission bits can be modified when
+a Windows NT client is manipulating the UNIX permission on a directory
+using the native NT security dialog box\&.
+.IP 
+This parameter is applied as a mask (OR\'ed with) to the changed
+permission bits, thus forcing any bits in this mask that the user may
+have modified to be on\&. Essentially, one bits in this mask may be
+treated as a set of bits that, when modifying security on a directory,
+the user has always set to be \'on\'\&.
+.IP 
+If not set explicitly this parameter is set to the same value as the
+\fBforce directory mode\fP parameter\&. To allow
+a user to modify all the user/group/world permissions on a directory,
+with restrictions set this parameter to 000\&.
+.IP 
+\fINote\fP that users who can access the Samba server through other
+means can easily bypass this restriction, so it is primarily
+useful for standalone "appliance" systems\&.  Administrators of
+most normal systems will probably want to set it to 0000\&.
+.IP 
+See also the \fBdirectory security mask\fP,
+\fBsecurity mask\fP, \fBforce security
+mode\fP parameters\&.
+.IP 
+\fBDefault:\fP
+\f(CW	force directory security mode = <same as force directory mode>\fP
+.IP 
+\fBExample:\fP
+\f(CW	force directory security mode = 0\fP
+.IP 
 .IP "\fBforce group (S)\fP" 
 .IP 
 This specifies a UNIX group name that will be assigned as the default
@@ -2480,12 +2558,63 @@ permissions for this group to the files and directories within this
 service the Samba administrator can restrict or allow sharing of these
 files\&.
 .IP 
+In Samba 2\&.0\&.5 and above this parameter has extended functionality in the following
+way\&. If the group name listed here has a \'+\' character prepended to it
+then the current user accessing the share only has the primary group 
+default assigned to this group if they are already assigned as a member
+of that group\&. This allows an administrator to decide that only users
+who are already in a particular group will create files with group 
+ownership set to that group\&. This gives a finer granularity of ownership
+assignment\&. For example, the setting \f(CWforce group = +sys\fP means
+that only users who are already in group sys will have their default
+primary group assigned to sys when accessing this Samba share\&. All
+other users will retain their ordinary primary group\&.
+.IP 
+If the \fB"force user"\fP parameter is also set the
+group specified in \fBforce group\fP will override the primary group
+set in \fB"force user"\fP\&.
+.IP 
+See also \fB"force user"\fP
+.IP 
 \fBDefault:\fP
 \f(CW	no forced group\fP
 .IP 
 \fBExample:\fP
 \f(CW	force group = agroup\fP
 .IP 
+.IP "\fBforce security mode (S)\fP" 
+.IP 
+This parameter controls what UNIX permission bits can be modified when
+a Windows NT client is manipulating the UNIX permission on a file
+using the native NT security dialog box\&.
+.IP 
+This parameter is applied as a mask (OR\'ed with) to the changed
+permission bits, thus forcing any bits in this mask that the user may
+have modified to be on\&. Essentially, one bits in this mask may be
+treated as a set of bits that, when modifying security on a file, the
+user has always set to be \'on\'\&.
+.IP 
+If not set explicitly this parameter is set to the same value as the
+\fBforce create mode\fP parameter\&. To allow
+a user to modify all the user/group/world permissions on a file,
+with no restrictions set this parameter to 000\&.
+.IP 
+\fINote\fP that users who can access the Samba server through other
+means can easily bypass this restriction, so it is primarily
+useful for standalone "appliance" systems\&.  Administrators of
+most normal systems will probably want to set it to 0000\&.
+.IP 
+See also the \fBforce directory security
+mode\fP, \fBdirectory security
+mask\fP, \fBsecurity mask\fP
+parameters\&.
+.IP 
+\fBDefault:\fP
+\f(CW	force security mode = <same as force create mode>\fP
+.IP 
+\fBExample:\fP
+\f(CW	force security mode = 0\fP
+.IP 
 .IP "\fBforce user (S)\fP" 
 .IP 
 This specifies a UNIX user name that will be assigned as the default
@@ -2500,6 +2629,13 @@ password\&. Once connected, all file operations will be performed as the
 .IP 
 This can be very useful\&.
 .IP 
+In Samba 2\&.0\&.5 and above this parameter also causes the primary
+group of the forced user to be used as the primary group for all
+file activity\&. Prior to 2\&.0\&.5 the primary group was left as the
+primary group of the connecting user (this was a bug)\&.
+.IP 
+See also \fB"force group"\fP
+.IP 
 \fBDefault:\fP
 \f(CW	no forced user\fP
 .IP 
@@ -2671,11 +2807,72 @@ logons\fP\&.
 .IP 
 .IP "\fBhosts allow (S)\fP" 
 .IP 
-Synonym for \fBallow hosts\fP\&.
+A synonym for this parameter is \fB\'allow hosts\'\fP
+.IP 
+This parameter is a comma, space, or tab delimited set of hosts which
+are permitted to access a service\&.
+.IP 
+If specified in the \fB[global]\fP section then it will
+apply to all services, regardless of whether the individual service
+has a different setting\&.
+.IP 
+You can specify the hosts by name or IP number\&. For example, you could
+restrict access to only the hosts on a Class C subnet with something
+like \f(CW"allow hosts = 150\&.203\&.5\&."\fP\&. The full syntax of the list is
+described in the man page \fBhosts_access (5)\fP\&. Note that this man
+page may not be present on your system, so a brief description will
+be given here also\&.
+.IP 
+Note that the localhost address 127\&.0\&.0\&.1 will always be allowed
+access unless specifically denied by a "hosts deny" option\&.
+.IP 
+You can also specify hosts by network/netmask pairs and by netgroup
+names if your system supports netgroups\&. The \fIEXCEPT\fP keyword can also
+be used to limit a wildcard list\&. The following examples may provide
+some help:
+.IP 
+\fBExample 1\fP: allow all IPs in 150\&.203\&.*\&.* except one
+.IP 
+\f(CW	hosts allow = 150\&.203\&. EXCEPT 150\&.203\&.6\&.66\fP
+.IP 
+\fBExample 2\fP: allow hosts that match the given network/netmask
+.IP 
+\f(CW	hosts allow = 150\&.203\&.15\&.0/255\&.255\&.255\&.0\fP
+.IP 
+\fBExample 3\fP: allow a couple of hosts
+.IP 
+\f(CW	hosts allow = lapland, arvidsjaur\fP
+.IP 
+\fBExample 4\fP: allow only hosts in NIS netgroup "foonet", but 
+deny access from one particular host
+.IP 
+\f(CW 	hosts allow = @foonet\fP
+.IP 
+\f(CW 	hosts deny = pirate\fP
+.IP 
+Note that access still requires suitable user-level passwords\&.
+.IP 
+See \fBtestparm (1)\fP for a way of testing your
+host access to see if it does what you expect\&.
+.IP 
+\fBDefault:\fP
+\f(CW	none (i\&.e\&., all hosts permitted access)\fP
+.IP 
+\fBExample:\fP
+\f(CW	allow hosts = 150\&.203\&.5\&. myhost\&.mynet\&.edu\&.au\fP
 .IP 
 .IP "\fBhosts deny (S)\fP" 
 .IP 
-Synonym for \fBdenyhosts\fP\&.
+The opposite of \fB\'hosts allow\'\fP - hosts listed
+here are \fINOT\fP permitted access to services unless the specific
+services have their own lists to override this one\&. Where the lists
+conflict, the \fB\'allow\'\fP list takes precedence\&.
+.IP 
+\fBDefault:\fP
+\f(CW	none (i\&.e\&., no hosts specifically excluded)\fP
+.IP 
+\fBExample:\fP
+\f(CW	hosts deny = 150\&.203\&.4\&. badhost\&.mynet\&.edu\&.au\fP
 .IP 
 .IP "\fBhosts equiv (G)\fP" 
 .IP 
@@ -2683,7 +2880,7 @@ If this global parameter is a non-null string, it specifies the name
 of a file to read for the names of hosts and users who will be allowed
 access without specifying a password\&.
 .IP 
-This is not be confused with \fBallow hosts\fP which
+This is not be confused with \fBhosts allow\fP which
 is about hosts access to services and is more useful for guest
 services\&. \fBhosts equiv\fP may be useful for NT clients which will not
 supply passwords to samba\&.
@@ -2711,28 +2908,38 @@ It takes the standard substitutions, except \fB%u\fP,
 .IP 
 .IP "\fBinterfaces (G)\fP" 
 .IP 
-This option allows you to setup multiple network interfaces, so that
-Samba can properly handle browsing on all interfaces\&.
+This option allows you to override the default network interfaces list
+that Samba will use for browsing, name registration and other NBT
+traffic\&. By default Samba will query the kernel for the list of all
+active interfaces and use any interfaces except 127\&.0\&.0\&.1 that are
+broadcast capable\&.
 .IP 
-The option takes a list of ip/netmask pairs\&. The netmask may either be
-a bitmask, or a bitlength\&.
+The option takes a list of interface strings\&. Each string can be in
+any of the following forms:
 .IP 
-For example, the following line:
-.IP 
-\f(CWinterfaces = 192\&.168\&.2\&.10/24 192\&.168\&.3\&.10/24\fP
+.IP o 
+a network interface name (such as eth0)\&. This may include
+shell-like wildcards so eth* will match any interface starting
+with the substring "eth"
+if() a IP address\&. In this case the netmask is determined
+from the list of interfaces obtained from the kernel
+if() a IP/mask pair\&. 
+if() a broadcast/mask pair\&. 
 .IP 
-would configure two network interfaces with IP addresses 192\&.168\&.2\&.10
-and 192\&.168\&.3\&.10\&. The netmasks of both interfaces would be set to
-255\&.255\&.255\&.0\&.
+The "mask" parameters can either be a bit length (such as 24 for a C
+class network) or a full netmask in dotted decmal form\&.
 .IP 
-You could produce an equivalent result by using:
+The "IP" parameters above can either be a full dotted decimal IP
+address or a hostname which will be looked up via the OSes normal
+hostname resolution mechanisms\&.
 .IP 
-\f(CWinterfaces = 192\&.168\&.2\&.10/255\&.255\&.255\&.0 192\&.168\&.3\&.10/255\&.255\&.255\&.0\fP
+For example, the following line:
 .IP 
-if you prefer that format\&.
+\f(CWinterfaces = eth0 192\&.168\&.2\&.10/24 192\&.168\&.3\&.10/255\&.255\&.255\&.0\fP
 .IP 
-If this option is not set then Samba will attempt to find a primary
-interface, but won\'t attempt to configure more than one interface\&.
+would configure three network interfaces corresponding to the eth0
+device and IP addresses 192\&.168\&.2\&.10 and 192\&.168\&.3\&.10\&. The netmasks of
+the latter two interfaces would be set to 255\&.255\&.255\&.0\&.
 .IP 
 See also \fB"bind interfaces only"\fP\&.
 .IP 
@@ -2781,10 +2988,10 @@ options"\fP)\&. Basically you should only use this option
 if you strike difficulties\&.
 .IP 
 \fBDefault:\fP
-\f(CW	keep alive = 0\fP
+\f(CW	keepalive = 0\fP
 .IP 
 \fBExample:\fP
-\f(CW	keep alive = 60\fP
+\f(CW	keepalive = 60\fP
 .IP 
 .IP "\fBkernel oplocks (G)\fP" 
 .IP 
@@ -2802,52 +3009,72 @@ This parameter defaults to \fI"On"\fP on systems that have the support,
 and \fI"off"\fP on systems that don\'t\&. You should never need to touch
 this parameter\&.
 .IP 
-.IP "\fBldap bind as (G)\fP" 
+See also the \fB"oplocks"\fP and \fB"level2 oplocks"\fP
+parameters\&.
+.IP 
+.IP "\fBldap filter (G)\fP" 
 .IP 
 This parameter is part of the \fIEXPERIMENTAL\fP Samba support for a
-password database stored on an LDAP server\&. These options are only
-available if your version of Samba was configured with the \fB--with-ldap\fP
-option\&.
+password database stored on an LDAP server back-end\&. These options
+are only available if your version of Samba was configured with
+the \fB--with-ldap\fP option\&.
 .IP 
-This parameter specifies the entity to bind to an LDAP directory as\&.
-Usually it should be safe to use the LDAP root account; for larger
-installations it may be preferable to restrict Samba\'s access\&. See also
-\fBldap passwd file\fP\&.
+This parameter specifies an LDAP search filter used to search for a
+user name in the LDAP database\&. It must contain the string
+\fB%u\fP which will be replaced with the user being
+searched for\&.
 .IP 
 \fBDefault:\fP
-\f(CW	none (bind anonymously)\fP
-.IP 
-\fBExample:\fP
-\f(CW	ldap bind as = "uid=root, dc=mydomain, dc=org"\fP
+\f(CW	empty string\&.\fP
 .IP 
-.IP "\fBldap passwd file (G)\fP" 
+.IP "\fBldap port (G)\fP" 
 .IP 
 This parameter is part of the \fIEXPERIMENTAL\fP Samba support for a
-password database stored on an LDAP server\&. These options are only
-available if your version of Samba was configured with the \fB--with-ldap\fP
-option\&.
+password database stored on an LDAP server back-end\&. These options
+are only available if your version of Samba was configured with
+the \fB--with-ldap\fP option\&.
 .IP 
-This parameter specifies a file containing the password with which
-Samba should bind to an LDAP server\&. For obvious security reasons
-this file must be set to mode 700 or less\&.
+This parameter specifies the TCP port number to use to contact
+the LDAP server on\&.
 .IP 
 \fBDefault:\fP
-\f(CW	none (bind anonymously)\fP
+\f(CW	ldap port = 389\&.\fP
 .IP 
-\fBExample:\fP
-\f(CW	ldap passwd file = /usr/local/samba/private/ldappasswd\fP
+.IP "\fBldap root (G)\fP" 
 .IP 
-.IP "\fBldap port (G)\fP" 
+This parameter is part of the \fIEXPERIMENTAL\fP Samba support for a
+password database stored on an LDAP server back-end\&. These options
+are only available if your version of Samba was configured with
+the \fB--with-ldap\fP option\&.
+.IP 
+This parameter specifies the entity to bind to the LDAP server
+as (essentially the LDAP username) in order to be able to perform
+queries and modifications on the LDAP database\&.
+.IP 
+See also \fBldap root passwd\fP\&.
+.IP 
+\fBDefault:\fP
+\f(CW	empty string (no user defined)\fP
+.IP 
+.IP "\fBldap root passwd (G)\fP" 
 .IP 
 This parameter is part of the \fIEXPERIMENTAL\fP Samba support for a
-password database stored on an LDAP server\&. These options are only
-available if your version of Samba was configured with the \fB--with-ldap\fP
-option\&.
+password database stored on an LDAP server back-end\&. These options
+are only available if your version of Samba was configured with
+the \fB--with-ldap\fP option\&.
+.IP 
+This parameter specifies the password for the entity to bind to the
+LDAP server as (the password for this LDAP username) in order to be
+able to perform queries and modifications on the LDAP database\&.
 .IP 
-This parameter specifies the TCP port number of the LDAP server\&.
+\fIBUGS:\fP This parameter should \fINOT\fP be a readable parameter
+in the \fBsmb\&.conf\fP file and will be removed once a correct
+storage place is found\&.
+.IP 
+See also \fBldap root\fP\&.
 .IP 
 \fBDefault:\fP
-\f(CW	ldap port = 389\&.\fP
+\f(CW	empty string\&.\fP
 .IP 
 .IP "\fBldap server (G)\fP" 
 .IP 
@@ -2857,8 +3084,7 @@ are only available if your version of Samba was configured with
 the \fB--with-ldap\fP option\&.
 .IP 
 This parameter specifies the DNS name of the LDAP server to use
-when storing and retrieving information about Samba users and
-groups\&.
+for SMB/CIFS authentication purposes\&.
 .IP 
 \fBDefault:\fP
 \f(CW	ldap server = localhost\fP
@@ -2870,15 +3096,52 @@ password database stored on an LDAP server back-end\&. These options
 are only available if your version of Samba was configured with
 the \fB--with-ldap\fP option\&.
 .IP 
-This parameter specifies the node of the LDAP tree beneath which
-Samba should store its information\&. This parameter MUST be provided
-when using LDAP with Samba\&.
+This parameter specifies the \f(CW"dn"\fP or LDAP \fI"distinguished name"\fP
+that tells \fBsmbd\fP to start from when searching
+for an entry in the LDAP password database\&.
 .IP 
 \fBDefault:\fP
-\f(CW	none\fP
+\f(CW	empty string\&.\fP
+.IP 
+.IP "\fBlevel2 oplocks (S)\fP" 
+.IP 
+This parameter (new in Samba 2\&.0\&.5) controls whether Samba supports
+level2 (read-only) oplocks on a share\&. In Samba 2\&.0\&.4 this parameter
+defaults to "False" as the code is new, but will default to "True"
+in a later release\&.
+.IP 
+Level2, or read-only oplocks allow Windows NT clients that have an
+oplock on a file to downgrade from a read-write oplock to a read-only
+oplock once a second client opens the file (instead of releasing all
+oplocks on a second open, as in traditional, exclusive oplocks)\&. This
+allows all openers of the file that support level2 oplocks to cache
+the file for read-ahead only (ie\&. they may not cache writes or lock
+requests) and increases performance for many acesses of files that
+are not commonly written (such as application \&.EXE files)\&.
+.IP 
+Once one of the clients which have a read-only oplock writes to
+the file all clients are notified (no reply is needed or waited
+for) and told to break their oplocks to "none" and delete any
+read-ahead caches\&.
+.IP 
+It is recommended that this parameter be turned on to speed access
+to shared executables (and also to test the code :-)\&.
+.IP 
+For more discussions on level2 oplocks see the CIFS spec\&.
+.IP 
+Currently, if \fB"kernel oplocks"\fP are supported
+then level2 oplocks are not granted (even if this parameter is set
+to \f(CW"true"\fP)\&. Note also, the \fB"oplocks"\fP parameter must
+be set to "true" on this share in order for this parameter to have any
+effect\&.
+.IP 
+See also the \fB"oplocks"\fP and \fB"kernel oplocks"\fP parameters\&.
+.IP 
+\fBDefault:\fP
+\f(CW level2 oplocks = False\fP
 .IP 
 \fBExample:\fP
-\f(CW	ldap suffix = "dc=mydomain, dc=org"\fP
+\f(CW level2 oplocks = True\fP
 .IP 
 .IP "\fBlm announce (G)\fP" 
 .IP 
@@ -2931,87 +3194,6 @@ will be loaded for browsing by default\&. See the
 \fBExample:\fP
 \f(CW	load printers = no\fP
 .IP 
-.IP "\fBlocal group map (G)\fP" 
-.IP 
-This option allows you to specify a file containing unique mappings
-of individual NT Local Group names (in any domain) to UNIX group
-names\&.  This allows NT Local groups (aliases) to be presented correctly to
-NT users, despite the lack of native support for the NT Security model
-(based on VAX/VMS) in UNIX\&.  The reader is advised to become familiar
-with the NT Domain system and its administration\&.
-.IP 
-This option is used in conjunction with \fB\'domain group map\'\fP
-and \fB\'domain name map\'\fP\&.  The use of these three
-options is trivial and often unnecessary in the case where Samba
-is not expected to interact with any other SAM databases (whether local
-workstations or Domain Controllers)\&.
-.IP 
-The map file is parsed line by line\&.  If any line begins with a \f(CW\'#\'\fP
-or a \f(CW\';\'\fP then it is ignored\&.  Each line should contain a single UNIX
-group name on the left then a single NT Local Group name on the right,
-separated by a tabstop or \f(CW\'=\'\fP\&.  If either name contains spaces then
-it should be enclosed in quotes\&.
-The line can be either of the form:
-.IP 
-\f(CW  UNIXgroupname	\e\eDOMAIN_NAME\e\eLocalGroupName \fP
-.IP 
-or:
-.IP 
-\f(CW  UNIXgroupname	LocalGroupName \fP
-.IP 
-In the case where Samba is either an \fBEXPERIMENTAL\fP Domain Controller
-or it is a member of a domain using \fB"security = domain"\fP,
-the latter format can be used: the default Domain name is the Samba Server\'s
-Domain name, specified by \fB"workgroup = MYGROUP"\fP\&.
-.IP 
-Any UNIX groups that are \fINOT\fP specified in this map file are treated
-as either Local or Domain Groups depending on the role of the Samba Server\&.
-.IP 
-In the case when Samba is an \fBEXPERIMENTAL\fP Domain Controller, Samba
-will present \fIALL\fP unspecified UNIX groups as its own NT Domain
-Groups, with the same name, and \fINOT\fP as Local Groups\&.
-.IP 
-In the case where Samba is member of a domain using
-\fB"security = domain"\fP, Samba will check the UNIX name with
-its Domain Controller (see \fB"password server"\fP)
-as if it was an NT Domain Group\&.  If the Domain Controller says that it is not,
-such unspecified (unmapped) UNIX groups which also are not NT Domain
-Groups are treated as Local Groups in the Samba Server\'s local SAM database\&.
-NT Administrators will recognise these as Workstation Local Groups,
-which are managed by running \fBUSRMGR\&.EXE\fP and selecting a remote
-Domain named "\e\eWORKSTATION_NAME", or by running \fBMUSRMGR\&.EXE\fP on
-a local Workstation\&.
-.IP 
-This may sound complicated, but it means that a Samba Server as
-either a member of a domain or as an \fBEXPERIMENTAL\fP Domain Controller
-will act like an NT Workstation (with a local SAM database) or an NT PDC
-(with a Domain SAM database) respectively, without the need for any of
-the map files at all\&.  If you \fBwant\fP to get fancy, however, you can\&.
-.IP 
-Note that adding an entry to map an arbitrary NT group in an arbitrary
-Domain to an arbitrary UNIX group \fIREQUIRES\fP the following:
-.IP 
-.IP 
-.IP o 
-that the UNIX group exists on the UNIX server\&.
-.IP 
-.IP o 
-that the NT Domain Group exists in the specified NT Domain
-.IP 
-.IP o 
-that the UNIX Server knows about the specified Domain; 
-.IP 
-.IP o 
-that all the UNIX users (who are expecting to access the Samba
-Server as the correct NT user and with the correct NT group permissions)
-in the UNIX group be mapped to the correct NT Domain users in the specified
-NT Domain using \fB\'domain user map\'\fP\&.
-.IP 
-.IP 
-Failure to meet any of these requirements may result in either (or
-both) errors reported in the log files or (and) incorrect or missing
-access rights granted to users\&.
-.IP 
 .IP "\fBlocal master (G)\fP" 
 .IP 
 This option allows \fBnmbd\fP to try and become a
@@ -3416,6 +3598,12 @@ Magic scripts are \fIEXPERIMENTAL\fP and should \fINOT\fP be relied upon\&.
 .IP 
 See the section on \fB"NAME MANGLING"\fP\&.
 .IP 
+.IP "\fBmangle locks (S)\fP" 
+.IP 
+This option is was introduced with Samba 2\&.0\&.4 and above and has been
+removed in Samba 2\&.0\&.6 as Samba now dynamically configures such things
+on 32 bit systems\&.
+.IP 
 .IP "\fBmangled map (S)\fP" 
 .IP 
 This is for those who want to directly map UNIX file names which can
@@ -3708,7 +3896,7 @@ never need to set this parameter\&.
 \fBDefault:\fP
 \f(CW	max mux = 50\fP
 .IP 
-.IP "\fBmaxopenfiles (G)\fP" 
+.IP "\fBmax open files (G)\fP" 
 .IP 
 This parameter limits the maximum number of open files that one
 \fBsmbd\fP file serving process may have open for
@@ -3837,6 +4025,18 @@ See also the \fBprinting\fP parameter\&.
 \fBExample:\fP
 \f(CW	min print space = 2000\fP
 .IP 
+.IP "\fBmin passwd length (G)\fP" 
+.IP 
+This option sets the minimum length in characters of a plaintext password
+than smbd will accept when performing UNIX password changing\&.
+.IP 
+See also \fB"unix password sync"\fP,
+\fB"passwd program"\fP and \fB"passwd chat
+debug"\fP\&.
+.IP 
+\fBDefault:\fP
+\f(CW	min passwd length = 5\fP
+.IP 
 .IP "\fBmin wins ttl (G)\fP" 
 .IP 
 This option tells \fBnmbd\fP when acting as a WINS
@@ -3861,12 +4061,17 @@ names to be resolved as follows :
 .IP 
 .IP o 
 \fBlmhosts\fP : Lookup an IP address in the Samba lmhosts file\&.
+If the line in lmhosts has no name type attached to the NetBIOS
+name (see the \fBlmhosts (5)\fP for details) then
+any name type matches for lookup\&.
 .IP 
 .IP o 
 \fBhost\fP : Do a standard host name to IP address resolution,
 using the system /etc/hosts, NIS, or DNS lookups\&. This method of name
 resolution is operating system depended for instance on IRIX or
 Solaris this may be controlled by the \fI/etc/nsswitch\&.conf\fP file)\&.
+Note that this method is only used if the NetBIOS name type being
+queried is the 0x20 (server) name type, otherwise it is ignored\&.
 .IP 
 .IP o 
 \fBwins\fP : Query a name with the IP address listed in the
@@ -3955,6 +4160,17 @@ system and the Samba server with this option must also be a
 \fBExample:\fP
 \f(CW	nis homedir = true\fP
 .IP 
+.IP "\fBnt acl support (G)\fP" 
+.IP 
+This boolean parameter controls whether \fBsmbd\fP
+will attempt to map UNIX permissions into Windows NT access control lists\&.
+.IP 
+\fBDefault:\fP
+\f(CW	nt acl support = yes\fP
+.IP 
+\fBExample:\fP
+\f(CW	nt acl support = no\fP
+.IP 
 .IP "\fBnt pipe support (G)\fP" 
 .IP 
 This boolean parameter controls whether \fBsmbd\fP
@@ -4052,24 +4268,58 @@ all access to oplocked files, whether it be via Samba or NFS or a local
 UNIX process\&. See the \fBkernel oplocks\fP parameter
 for details\&.
 .IP 
+See also the \fB"kernel oplocks"\fP and
+\fB"level2 oplocks"\fP parameters\&.
+.IP 
 \fBDefault:\fP
 \f(CW	oplocks = True\fP
 .IP 
 \fBExample:\fP
 \f(CW	oplocks = False\fP
 .IP 
+.IP "\fBoplock break wait time (G)\fP" 
+.IP 
+This is a tuning parameter added due to bugs in both Windows 9x and WinNT\&.
+If Samba responds to a client too quickly when that client issues an SMB that
+can cause an oplock break request, then the client redirector can fail and
+not respond to the break request\&. This tuning parameter (which is set in
+milliseconds) is the amount of time Samba will wait before sending an
+oplock break request to such (broken) clients\&.
+.IP 
+\fIDO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA
+OPLOCK CODE\fP\&.
+.IP 
+\fBDefault:\fP
+\f(CW	oplock break wait time = 10\fP
+.IP 
+.IP "\fBoplock contention limit (S)\fP" 
+.IP 
+This is a \fIvery\fP advanced \fBsmbd\fP tuning option to improve
+the efficiency of the granting of oplocks under multiple client contention for the same file\&.
+.IP 
+In brief it specifies a number, which causes smbd not to grant an oplock even
+when requested if the approximate number of clients contending for an oplock on
+the same file goes over this limit\&. This causes \fBsmbd\fP to
+behave in a similar way to Windows NT\&.
+.IP 
+\fIDO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA
+OPLOCK CODE\fP\&.
+.IP 
+\fBDefault:\fP
+\f(CW oplock contention limit = 2\fP
+.IP 
 .IP "\fBos level (G)\fP" 
 .IP 
 This integer value controls what level Samba advertises itself as for
 browse elections\&. The value of this parameter determines whether
 \fBnmbd\fP has a chance of becoming a local master
 browser for the \fBWORKGROUP\fP in the local broadcast
-area\&. Setting this to zero will cause \fBnmbd\fP to
-always lose elections to Windows machines\&. See BROWSING\&.txt in the
-Samba docs/ directory for details\&.
+area\&. The default is zero, which means \fBnmbd\fP will
+lose elections to Windows machines\&. See BROWSING\&.txt in the Samba
+docs/ directory for details\&.
 .IP 
 \fBDefault:\fP
-\f(CW	os level = 32\fP
+\f(CW	os level = 20\fP
 .IP 
 \fBExample:\fP
 \f(CW	os level = 65    ; This will win against any NT Server\fP
@@ -4276,7 +4526,7 @@ better restrict them with hosts allow!
 If the \fB"security"\fP parameter is set to
 \fB"domain"\fP, then the list of machines in this option must be a list
 of Primary or Backup Domain controllers for the
-\fBDomain\fP, as the Samba server is cryptographicly
+\fBDomain\fP or the character \f(CW*\fP, as the Samba server is cryptographicly
 in that domain, and will use cryptographicly authenticated RPC calls
 to authenticate the user logging on\&. The advantage of using
 \fB"security=domain"\fP is that if you list
@@ -4284,6 +4534,12 @@ several hosts in the \fB"password server"\fP option then
 \fBsmbd\fP will try each in turn till it finds one
 that responds\&. This is useful in case your primary server goes down\&.
 .IP 
+If the \fB"password server"\fP option is set to the character \f(CW*\fP,
+then Samba will attempt to auto-locate the Primary or Backup Domain controllers
+to authenticate against by doing a query for the name \f(CWWORKGROUP<1C>\fP
+and then contacting each server returned in the list of IP addresses
+from the \fBname resolution\fP source\&.
+.IP 
 If the \fB"security"\fP parameter is set to
 \fB"server"\fP, then there are different
 restrictions that \fB"security=domain"\fP
@@ -4316,6 +4572,9 @@ See also the \fB"security"\fP parameter\&.
 \fBExample:\fP
 \f(CW	password server = NT-PDC, NT-BDC1, NT-BDC2\fP
 .IP 
+\fBExample:\fP
+\f(CW	password server = *\fP
+.IP 
 .IP "\fBpath (S)\fP" 
 .IP 
 This parameter specifies a directory to which the user of the service
@@ -4397,7 +4656,7 @@ time they log in\&. Maybe a message of the day? Here is an example:
 .IP 
 Of course, this could get annoying after a while :-)
 .IP 
-See also \fBpostexec\fP\&.
+See also \fBpreexec close\fP and \fBpostexec\fP\&.
 .IP 
 \fBDefault:\fP
 \f(CW	none (no command executed)\fP
@@ -4405,6 +4664,17 @@ See also \fBpostexec\fP\&.
 \fBExample:\fP
 \f(CW        preexec = echo \e"%u connected to %S from %m (%I)\e" >> /tmp/log\fP
 .IP 
+.IP "\fBpreexec close (S)\fP" 
+.IP 
+This boolean option controls whether a non-zero return code from
+\fB"preexec"\fP should close the service being connected to\&.
+.IP 
+\fBDefault:\fP
+\f(CW 	preexec close = no\fP
+.IP 
+\fBExample:\fP
+\f(CW 	preexec close = yes\fP
+.IP 
 .IP "\fBpreferred master (G)\fP" 
 .IP 
 This boolean parameter controls if \fBnmbd\fP is a
@@ -4415,8 +4685,7 @@ force an election, and it will have a slight advantage in winning the
 election\&.  It is recommended that this parameter is used in
 conjunction with \fB"domain master = yes"\fP, so
 that \fBnmbd\fP can guarantee becoming a domain
-master\&. Indeed the default ("auto") enables "preferred master" if
-Samba is configured as the domain master browser\&.
+master\&.
 .IP 
 Use this option with caution, because if there are several hosts
 (whether Samba servers, Windows 95 or NT) that are preferred master
@@ -4428,7 +4697,7 @@ capabilities\&.
 See also \fBos level\fP\&.
 .IP 
 \fBDefault:\fP
-\f(CW 	preferred master = auto\fP
+\f(CW 	preferred master = no\fP
 .IP 
 \fBExample:\fP
 \f(CW 	preferred master = yes\fP
@@ -4648,7 +4917,7 @@ find the printer driver files for the automatic installation of
 drivers for Windows 95 machines\&. If Samba is set up to serve printer
 drivers to Windows 95 machines, this should be set to
 .IP 
-\f(CW\e\eMACHINE\ePRINTER$\fP
+\f(CW\e\eMACHINE\eaPRINTER$\fP
 .IP 
 Where MACHINE is the NetBIOS name of your Samba server, and PRINTER$
 is a share you set up for serving printer driver files\&. For more
@@ -4859,14 +5128,14 @@ This overlapping works best when the speeds of disk and network access
 are similar, having very little effect when the speed of one is much
 greater than the other\&.
 .IP 
-The default value is 2048, but very little experimentation has been
+The default value is 16384, but very little experimentation has been
 done yet to determine the optimal value, and it is likely that the
 best value will vary greatly between systems anyway\&. A value over
 65536 is pointless and will cause you to allocate memory
 unnecessarily\&.
 .IP 
 \fBDefault:\fP
-\f(CW	read size = 2048\fP
+\f(CW	read size = 16384\fP
 .IP 
 \fBExample:\fP
 \f(CW	read size = 8192\fP
@@ -4938,6 +5207,37 @@ master on it\'s segment\&.
 \fBExample:\fP
 \f(CW	remote browse sync = 192\&.168\&.2\&.255 192\&.168\&.4\&.255\fP
 .IP 
+.IP "\fBrestrict anonymous (G)\fP" 
+.IP 
+This is a boolean parameter\&.  If it is true, then anonymous access
+to the server will be restricted, namely in the case where the server
+is expecting the client to send a username, but it doesn\'t\&.  Setting
+it to true will force these anonymous connections to be denied, and
+the client will be required to always supply a username and password
+when connecting\&. Use of this parameter is only recommened for homogenous 
+NT client environments\&.
+.IP 
+This parameter makes the use of macro expansions that rely
+on the username (%U, %G, etc) consistant\&.  NT 4\&.0 likes to use
+anonymous connections when refreshing the share list, and this
+is a way to work around that\&.
+.IP 
+When restrict anonymous is true, all anonymous connections are denied
+no matter what they are for\&.  This can effect the ability of a machine
+to access the samba Primary Domain Controller to revalidate it\'s machine
+account after someone else has logged on the client interactively\&.  The
+NT client will display a message saying that the machine\'s account in 
+the domain doesn\'t exist or the password is bad\&.  The best way to deal 
+with this is to reboot NT client machines between interactive logons, 
+using "Shutdown and Restart", rather than "Close all programs and logon 
+as a different user"\&.
+.IP 
+\fBDefault:\fP
+\f(CW     restrict anonymous = false\fP
+.IP 
+\fBExample:\fP
+\f(CW     restrict anonymous = true\fP
+.IP 
 .IP "\fBrevalidate (S)\fP" 
 .IP 
 Note that this option only works with
@@ -5008,7 +5308,15 @@ This is the same as the \fB"preexec"\fP parameter except
 that the command is run as root\&. This is useful for mounting
 filesystems (such as cdroms) before a connection is finalized\&.
 .IP 
-See also \fB"preexec"\fP\&.
+See also \fB"preexec"\fP
+and \fB"root preexec close"\fP\&.
+.IP 
+.IP "\fBroot preexec close (S)\fP" 
+.IP 
+This is the same as the \fB"preexec close"\fP parameter
+except that the command is run as root\&.
+.IP 
+See also \fB"preexec"\fP, \fB"preexec close"\fP\&.
 .IP 
 .IP "\fBsecurity (G)\fP" 
 .IP 
@@ -5208,7 +5516,7 @@ users into the \fB"guest account"\fP\&. See the
 \fB"map to guest"\fP parameter for details on
 doing this\&.
 .IP 
-e,(BUG:) There is currently a bug in the implementation of
+\fIBUG:\fP There is currently a bug in the implementation of
 \fB"security=domain\fP with respect to multi-byte character
 set usernames\&. The communication with a Domain Controller
 must be done in UNICODE and Samba currently does not widen
@@ -5229,6 +5537,38 @@ and the \fB"encrypted passwords"\fP parameter\&.
 \fBExample:\fP
 \f(CW 	security = DOMAIN\fP
 .IP 
+.IP "\fBsecurity mask (S)\fP" 
+.IP 
+This parameter controls what UNIX permission bits can be modified
+when a Windows NT client is manipulating the UNIX permission on a
+file using the native NT security dialog box\&.
+.IP 
+This parameter is applied as a mask (AND\'ed with) to the changed
+permission bits, thus preventing any bits not in this mask from
+being modified\&. Essentially, zero bits in this mask may be treated
+as a set of bits the user is not allowed to change\&.
+.IP 
+If not set explicitly this parameter is set to the same value as the
+\fBcreate mask\fP parameter\&. To allow a user to
+modify all the user/group/world permissions on a file, set this
+parameter to 0777\&.
+.IP 
+\fINote\fP that users who can access the Samba server through other
+means can easily bypass this restriction, so it is primarily
+useful for standalone "appliance" systems\&.  Administrators of
+most normal systems will probably want to set it to 0777\&.
+.IP 
+See also the \fBforce directory security
+mode\fP, \fBdirectory security
+mask\fP, \fBforce security
+mode\fP parameters\&.
+.IP 
+\fBDefault:\fP
+\f(CW	security mask = <same as create mask>\fP
+.IP 
+\fBExample:\fP
+\f(CW	security mask = 0777\fP
+.IP 
 .IP "\fBserver string (G)\fP" 
 .IP 
 This controls what string will show up in the printer comment box in
@@ -5294,13 +5634,16 @@ users reporting strange problems trying to save files (locking errors)
 and error messages in the smbd log looking like \f(CW"ERROR
 smb_shm_alloc : alloc of XX bytes failed"\fP\&.
 .IP 
+If your OS refuses the size that Samba asks for then Samba will try a
+smaller size, reducing by a factor of 0\&.8 until the OS accepts it\&.
+.IP 
 \fBDefault:\fP
 \f(CW	shared mem size = 1048576\fP
 .IP 
 \fBExample:\fP
 \f(CW	shared mem size = 5242880 ; Set to 5mb for a large number of files\&.\fP
 .IP 
-.IP "\fBshort preserve case (S)\fP" 
+.IP "\fBshort preserve case (G)\fP" 
 .IP 
 This boolean parameter controls if new files which conform to 8\&.3
 syntax, that is all in upper case and of suitable length, are created
@@ -5796,9 +6139,12 @@ See also the \fB"strict sync"\fP parameter\&.
 This parameter maps how Samba debug messages are logged onto the
 system syslog logging levels\&. Samba debug level zero maps onto syslog
 LOG_ERR, debug level one maps onto LOG_WARNING, debug level two maps
-to LOG_NOTICE, debug level three maps onto LOG_INFO\&.  The parameter
-sets the threshold for doing the mapping, all Samba debug messages
-above this threshold are mapped to syslog LOG_DEBUG messages\&.
+onto LOG_NOTICE, debug level three maps onto LOG_INFO\&. All higher 
+levels are mapped to LOG_DEBUG\&.
+.IP 
+This paramter sets the threshold for sending messages to syslog\&. 
+Only messages with debug level less than this value will be sent 
+to syslog\&.
 .IP 
 \fBDefault:\fP
 \f(CW	syslog = 1\fP
@@ -6031,17 +6377,6 @@ Windows machines to those that the UNIX box uses\&. The other is to map
 multiple users to a single username so that they can more easily share
 files\&.
 .IP 
-The use of this option, therefore, relates to UNIX usernames
-and not Windows (specifically NT Domain) usernames\&.  In other words,
-once a name has been mapped using this option, the Samba server uses
-the mapped name for internal \fIAND\fP external purposes\&.
-.IP 
-This option is \fIDIFFERENT\fP from the \fB"domain user map"\fP 
-parameter, which maintains a one-to-one mapping between UNIX usernames
-and NT Domain Usernames: more specifically, the Samba server maintains
-a link between \fIBOTH\fP usernames, presenting the NT username to the
-external NT world, and using the UNIX username internally\&.
-.IP 
 The map file is parsed line by line\&. Each line should contain a single
 UNIX username on the left then a \f(CW\'=\'\fP followed by a list of
 usernames on the right\&. The list of usernames on the right may contain
@@ -6315,6 +6650,10 @@ directory tree exported by the server are always allowed; this
 parameter controls access only to areas that are outside the directory
 tree being exported\&.
 .IP 
+Note that setting this parameter can have a negative effect on your
+server performance due to the extra system calls that Samba has to
+do in order to perform the link checks\&.
+.IP 
 \fBDefault:\fP
 \f(CW 	wide links = yes\fP
 .IP 
@@ -6335,7 +6674,7 @@ need to set this to \f(CW"yes"\fP for some older clients\&.
 This specifies the IP address (or DNS name: IP address for preference)
 of the WINS server that \fBnmbd\fP should register with\&.
 If you have a WINS server on your network then you should set this to
-the WINS server\'s IP\&.
+the WINS server\'s IP\&.        
 .IP 
 You should point this at your WINS server if you have a
 multi-subnetted network\&.
@@ -6352,6 +6691,41 @@ Samba source distribution\&.
 \fBExample:\fP
 \f(CW	wins server = 192\&.9\&.200\&.1\fP
 .IP 
+.IP "\fBwins hook (G)\fP" 
+.IP 
+When Samba is running as a WINS server this allows you to call an
+external program for all changes to the WINS database\&. The primary use
+for this option is to allow the dynamic update of external name
+resolution databases such as dynamic DNS\&.
+.IP 
+The wins hook parameter specifies the name of a script or executable
+that will be called as follows:
+.IP 
+wins_hook operation name nametype ttl IP_list
+.IP 
+The first argument is the operation and is one of "add", "delete",
+or "refresh"\&. In most cases the operation can be ignored as the rest
+of the parameters provide sufficient information\&. Note that "refresh"
+may sometimes be called when the name has not previously been added,
+in that case it should be treated as an add\&.
+.IP 
+The second argument is the netbios name\&. If the name is not a legal
+name then the wins hook is not called\&. Legal names contain only
+letters, digits, hyphens, underscores and periods\&.
+.IP 
+The third argument is the netbios name type as a 2 digit hexadecimal
+number\&. 
+.IP 
+The fourth argument is the TTL (time to live) for the name in seconds\&.
+.IP 
+The fifth and subsequent arguments are the IP addresses currently
+registered for that name\&. If this list is empty then the name should
+be deleted\&.
+.IP 
+An example script that calls the BIND dynamic DNS update program
+"nsupdate" is provided in the examples directory of the Samba source
+code\&. 
+.IP 
 .IP "\fBwins support (G)\fP" 
 .IP 
 This boolean controls if the \fBnmbd\fP process in
@@ -6380,7 +6754,6 @@ workgroup = MYGROUP
 .IP "\fBwritable (S)\fP" 
 .IP 
 Synonym for \fB"writeable"\fP for people who can\'t spell :-)\&.
-Pronounced "ritter-bull"\&.
 .IP 
 .IP "\fBwrite list (S)\fP" 
 .IP 
@@ -6441,51 +6814,52 @@ permitting), but only via spooling operations\&.
  
 
 .IP 
+.PP 
 .SH "WARNINGS" 
-.IP 
+.PP 
 Although the configuration file permits service names to contain
 spaces, your client software may not\&. Spaces will be ignored in
 comparisons anyway, so it shouldn\'t be a problem - but be aware of the
 possibility\&.
-.IP 
+.PP 
 On a similar note, many clients - especially DOS clients - limit
 service names to eight characters\&. \fBSmbd\fP has no
 such limitation, but attempts to connect from such clients will fail
 if they truncate the service names\&.  For this reason you should
 probably keep your service names down to eight characters in length\&.
-.IP 
+.PP 
 Use of the \fB[homes]\fP and \fB[printers]\fP
 special sections make life for an administrator easy, but the various
 combinations of default attributes can be tricky\&. Take extreme care
 when designing these sections\&. In particular, ensure that the
 permissions on spool directories are correct\&.
-.IP 
+.PP 
 .SH "VERSION" 
-.IP 
+.PP 
 This man page is correct for version 2\&.0 of the Samba suite\&.
-.IP 
+.PP 
 .SH "SEE ALSO" 
-.IP 
+.PP 
 \fBsmbd (8)\fP, \fBsmbclient (1)\fP,
 \fBnmbd (8)\fP, \fBtestparm (1)\fP,
 \fBtestprns (1)\fP, \fBSamba\fP,
 \fBnmblookup (1)\fP, \fBsmbpasswd (5)\fP,
 \fBsmbpasswd (8)\fP\&.
-.IP 
+.PP 
 .SH "AUTHOR" 
-.IP 
+.PP 
 The original Samba software and related utilities were created by
 Andrew Tridgell \fIsamba-bugs@samba\&.org\fP\&. Samba is now developed
 by the Samba Team as an Open Source project similar to the way the
 Linux kernel is developed\&.
-.IP 
+.PP 
 The original Samba man pages were written by Karl Auer\&. The man page
 sources were converted to YODL format (another excellent piece of Open
 Source software, available at
 \fBftp://ftp\&.icce\&.rug\&.nl/pub/unix/\fP)
 and updated for the Samba2\&.0 release by Jeremy Allison\&.
 \fIsamba-bugs@samba\&.org\fP\&.
-.IP 
+.PP 
 See \fBsamba (7)\fP to find out how to get a full
 list of contributors and details on how to submit bug reports,
 comments etc\&.
diff --git a/docs/manpages/smbclient.1 b/docs/manpages/smbclient.1
index 6d93c3cd51..4346629adb 100644
--- a/docs/manpages/smbclient.1
+++ b/docs/manpages/smbclient.1
@@ -5,7 +5,7 @@ smbclient \- ftp-like client to access SMB/CIFS resources on servers
 .PP 
 .SH "SYNOPSIS" 
 .PP 
-\fBsmbclient\fP servicename [password] [-s smb\&.conf] [-B IP addr] [-O socket options][-R name resolve order] [-M NetBIOS name] [-i scope] [-N] [-n NetBIOS name] [-d debuglevel] [-P] [-p port] [-l log basename] [-h] [-I dest IP] [-E] [-U username] [-L NetBIOS name] [-t terminal code] [-m max protocol] [-W workgroup] [-T<c|x>IXFqgbNan] [-D directory] [-c command string]
+\fBsmbclient\fP servicename [-s smb\&.conf] [-O socket options][-R name resolve order] [-M NetBIOS name] [-i scope] [-N] [-n NetBIOS name] [-d debuglevel] [-P] [-p port] [-l log basename] [-h] [-I dest IP] [-E] [-U username] [-L NetBIOS name] [-t terminal code] [-m max protocol] [-b buffersize] [-W workgroup] [-T<c|x>IXFqgbNan] [-D directory] [-c command string]
 .PP 
 .SH "DESCRIPTION" 
 .PP 
@@ -65,9 +65,6 @@ Samba configuration file, smb\&.conf\&. This file controls all aspects of
 the Samba setup on the machine and smbclient also needs to read this
 file\&.
 .IP 
-.IP "\fB-B IP addr\fP" 
-The IP address to use when sending a broadcast packet\&.
-.IP 
 .IP "\fB-O socket options\fP" 
 TCP socket options to set on the client
 socket\&. See the socket options
@@ -104,8 +101,7 @@ no WINS server has been specified this method will be ignored\&.
 listed in the \fBinterfaces\fP parameter
 in the smb\&.conf file\&. This is the least reliable of the name resolution
 methods as it depends on the target host being on a locally connected
-subnet\&. To specify a particular broadcast address the \fB-B\fP option 
-may be used\&.
+subnet\&. 
 .IP 
 .IP 
 If this parameter is not set then the name resolve order defined
@@ -284,7 +280,7 @@ nothing before or nothing after the percent symbol will cause an empty
 username or an empty password to be used, respectively\&.
 .IP 
 The password may also be specified by setting up an environment
-variable called \f(CWPASSWORD\fP that contains the users password\&. Note
+variable called \f(CWPASSWD\fP that contains the users password\&. Note
 that this may be very insecure on some systems but on others allows
 users to script smbclient commands without having a password appear in
 the command line of a process listing\&.
@@ -294,7 +290,7 @@ on an uppercase password\&. Lowercase or mixed case passwords may be
 rejected by these servers\&.
 .IP 
 Be cautious about including passwords in scripts or in the
-\f(CWPASSWORD\fP environment variable\&. Also, on many systems the command
+\f(CWPASSWD\fP environment variable\&. Also, on many systems the command
 line of a running process may be seen via the \f(CWps\fP command to be
 safe always allow smbclient to prompt for a password and type it in
 directly\&.
@@ -326,6 +322,12 @@ protocols level the server supports\&. This parameter is
 preserved for backwards compatibility, but any string
 following the \fB-m\fP will be ignored\&.
 .IP 
+.IP "\fB-b buffersize\fP" 
+This option changes the transmit/send buffer
+size when getting or putting a file from/to the server\&. The default
+is 65520 bytes\&. Setting this value smaller (to 1200 bytes) has been
+observed to speed up file transfers to and from a Win9x server\&.
+.IP 
 .IP "\fB-W WORKGROUP\fP" 
 Override the default workgroup specified in the
 \fBworkgroup\fP parameter of the
@@ -717,7 +719,7 @@ The variable \fBUSER\fP may contain the username of the person using the
 client\&.  This information is used only if the protocol level is high
 enough to support session-level passwords\&.
 .PP 
-The variable \fBPASSWORD\fP may contain the password of the person using
+The variable \fBPASSWD\fP may contain the password of the person using
 the client\&.  This information is used only if the protocol level is
 high enough to support session-level passwords\&.
 .PP 
diff --git a/docs/manpages/smbd.8 b/docs/manpages/smbd.8
index 7e6c03b5ff..5efd679478 100644
--- a/docs/manpages/smbd.8
+++ b/docs/manpages/smbd.8
@@ -5,7 +5,7 @@ smbd \- server to provide SMB/CIFS services to clients
 .PP 
 .SH "SYNOPSIS" 
 .PP 
-\fBsmbd\fP [-D] [-a] [-o] [-d debuglevel] [-l log file] [-p port number] [-O socket options] [-s configuration file] [-i scope] [-P] [-h]
+\fBsmbd\fP [-D] [-a] [-o] [-P] [-h] [-V] [-d debuglevel] [-l log file] [-p port number] [-O socket options] [-s configuration file] [-i scope]
 .PP 
 .SH "DESCRIPTION" 
 .PP 
@@ -65,6 +65,16 @@ If this parameter is specified, the log files will be
 overwritten when opened\&.  By default, the log files will be appended
 to\&.
 .IP 
+.IP "\fB-P\fP" 
+Passive option\&. Causes smbd not to send any network traffic
+out\&. Used for debugging by the developers only\&.
+.IP 
+.IP "\fB-h\fP" 
+Prints the help information (usage) for \fBsmbd\fP\&.
+.IP 
+.IP "\fB-V\fP" 
+Prints the version number for \fBsmbd\fP\&.
+.IP 
 .IP "\fB-d debuglevel\fP" 
 debuglevel is an integer from 0 to 10\&.
 .IP 
@@ -135,13 +145,6 @@ are \fIvery\fP rarely used, only set this parameter if you are the
 system administrator in charge of all the NetBIOS systems you
 communicate with\&.
 .IP 
-.IP "\fB-h\fP" 
-Prints the help information (usage) for smbd\&.
-.IP 
-.IP "\fB-P\fP" 
-Passive option\&. Causes smbd not to send any network traffic
-out\&. Used for debugging by the developers only\&.
-.IP 
 .PP 
 .SH "FILES" 
 .PP 
@@ -409,16 +412,11 @@ performance\&.
 .PP 
 .SH "SEE ALSO" 
 .PP 
-\fBhosts_access (5)\fP,
-\fBinetd (8)\fP,
-\fBnmbd (8)\fP,
-\fBsmb\&.conf (5)\fP,
-\fBsmbclient (1)\fP,
-\fBtestparm (1)\fP,
-\fBtestprns (1)\fP,
-\fBrpcclient (1)\fP,
-and the Internet RFC\'s \fBrfc1001\&.txt\fP, \fBrfc1002\&.txt\fP\&.
-In addition the CIFS (formerly SMB)
+\fBhosts_access (5)\fP, \fBinetd (8)\fP, \fBnmbd (8)\fP,
+\fBsmb\&.conf (5)\fP, \fBsmbclient
+(1)\fP, \fBtestparm (1)\fP,
+\fBtestprns (1)\fP, and the Internet RFC\'s
+\fBrfc1001\&.txt\fP, \fBrfc1002\&.txt\fP\&. In addition the CIFS (formerly SMB)
 specification is available as a link from the Web page :
 http://samba\&.org/cifs/\&.
 .PP 
diff --git a/docs/manpages/smbmnt.8 b/docs/manpages/smbmnt.8
index e0db6edae3..e8cc1f2cd9 100644
--- a/docs/manpages/smbmnt.8
+++ b/docs/manpages/smbmnt.8
@@ -1,96 +1,37 @@
-.TH SMBMNT 8 "13 Nov 1998" "smbmnt 2.0.0-beta1"
-.SH NAME
-smbmnt \- mount smb file system
-.SH SYNOPSIS
-.B smbmnt
-.B mount-point
-[
-.B -u
-.I uid
-] [
-.B -g
-.I gid
-] [
-.B -f
-.I file mode
-] [
-.B -d
-.I dir mode
-]
-
-.SH DESCRIPTION
-.B smbmnt 
-is a helper application used by the 
-.BI smbmount (8)
-program to do the actual mounting.
-.B smbmnt
-is meant to be installed setuid root so that normal users can mount
-their smb shares. It checks whether the user has write permissions
-on the mount point and then mounts the directory.
-
-The
-.B smbmnt
-program is normally invoked by a mount command to
-.BI smbmount ,
-and the command line arguments are passed directly to
-.B smbmnt.
-
-.SH OPTIONS
-.B -u
-.I uid,
-.B -g
-.I gid
-.RS 3
-A Lan Manager server does not tell us anything about the owner of a
-file, but Unix requires that each file have an owner and a group it belongs
-to. With 
-.B -u
-and
-.B -g
-you can tell smbmount which id's it should assign to the files in the
-mounted directory.
-
-The defaults for these values are the current uid and gid.
-.RE
-
-.B -f
-.I file mode,
-.B -d
-.I dir mode
-.RS 3
-Like 
-.B -u
-and
-.B -g,
-these options are also used to bridge differences in concepts between
-Lan Manager and Unix. Lan Manager does not know anything about file
-permissions, so
-.B smbmnt
-must be told which permissions it should assign to the mounted files
-and directories.
-
-The values must be given as octal numbers. The default values are taken
-from the current umask, where the file mode is the current umask,
-and the dir mode adds execute permissions where the file mode gives
-read permissions.
-
-Note that these permissions can differ from the rights the server
-gives to us. If you do not have write permissions on the server,
-you should choose a file mode that matches your actual permissions.
-This certainly cannot override the restrictions imposed by the server.
-
-In addition to specifying the file mode, the
-.B -f
-argument can be used to specify certain bug-fix workarounds.
-This allows bug fixes to be enabled on a per mount-point basis,
-rather than being compiled into the kernel.
-The required bug fixes are specified by prepending an (octal) value
-to the file mode.
-For information on the available bug workarounds, refer to the
-.B smbfs.txt
-file in the Linux kernel Documentation directory. 
-.RE
-
-.SH SEE ALSO
-.B smbmount(8)
-
+.TH "smbmnt " "1" "25 September 1999" "Samba" "SAMBA" 
+.PP 
+.SH "NAME" 
+smbmnt \- helper utility for mounting SMB filesystems
+.PP 
+.SH "SYNOPSIS" 
+\fBsmbmnt\fP mount-point [ -s share ] [ -r ] [ -u uid ] [ -g gid ] [ -f mask ] [ -d mask ] 
+.PP 
+.SH "DESCRIPTION" 
+.PP 
+smbmnt is a helper application used by the smbmount program to do the
+actual mounting of SMB shares\&. smbmnt is meant to be installed setuid
+root so that normal users can mount their smb shares\&. It checks
+whether the user has write permissions on the mount point and then
+mounts the directory\&.
+.PP 
+The smbmnt program is normally invoked by smbmount\&. It should not be
+invoked directly by users\&.
+.PP 
+.IP "\fB-r\fP" 
+mount the filesystem read-only
+.PP 
+.IP "\fB-u uid\fP" 
+specify the uid that the files will be owned by
+.PP 
+.IP "\fB-g gid\fP" 
+specify the gid that the files will be owned by
+.PP 
+.IP "\fB-f mask\fP" 
+specify the octal file mask applied 
+.PP 
+.IP "\fB-d mask\fP" 
+specify the octal directory mask applied 
+.PP 
+.SH "AUTHOR" 
+The maintainer of smbfs, smbmnt and smbmount is Andrew Tridgell
+\fItridge@samba\&.org\fP
diff --git a/docs/manpages/smbmount.8 b/docs/manpages/smbmount.8
index 4ac7267395..457a940ddb 100644
--- a/docs/manpages/smbmount.8
+++ b/docs/manpages/smbmount.8
@@ -1,44 +1,87 @@
-.TH SMBMOUNT 8 "13 Nov 1998" "smbmount 2.0.0-beta1"
-.SH NAME
-smbmount \- mount smb file system
-.SH SYNOPSIS
-.B smbmount
-[
-.B options
-]
-
-.SH DESCRIPTION
-.B smbmount 
-is a stripped-down version of the 
-.BI smbclient (1)
-program used to mount smbfs shares. It implements only the mount command,
-which then calls the
-.BI smbmnt (8)
-program to do the actual mount.
-.B smbmount
-itself accepts most of the options that
-.B smbclient
-does. See the
-.BI smbclient (1)
-manpage for details.
-
-To mount an smb file system, I suggest using the option
-.B -c
-for smbmount to pass the mount command. For example, use
-
-smbmount '\\\\server\\tmp' -c 'mount /mnt -u 123 -g 456'
-
-to mount the tmp share of server on /mnt, giving it a local uid 123
-and a local gid 456.
-
-The arguments supplied to the mount command are passed directly to the
-.B smbmnt
-utility for processing.
-Refer to the
-.BI smbmnt (8)
-manpage for details.
-
-.SH SEE ALSO
-.BI smbmnt (8),
-.BI smbclient (1)
-
+.TH "smbmount " "1" "25 September 1999" "Samba" "SAMBA" 
+.PP 
+.SH "NAME" 
+smbmount \- mount an SMB filesystem
+.PP 
+.SH "SYNOPSIS" 
+\fBsmbmount\fP service mountpoint [ -o options ]
+.PP 
+.SH "DESCRIPTION" 
+.PP 
+smbmount mounts a SMB filesystem\&. It is usually invoked as mount\&.smb
+from the mount(8) command when using the "-t smb" option\&. The kernel
+must support the smbfs filesystem\&.
+.PP 
+Options to smbmount are specified as a comma separated list of
+key=value pairs\&. 
+.PP 
+NOTE: smbmount calls smbmnt to do the actual mount\&. You must make sure
+that smbmnt is in the path so that it can be found\&.
+.PP 
+.IP "\fBusername=<arg>\fP" 
+specifies the username to connect as\&. If this is
+not given then the environment variable USER is used\&. This option can
+also take the form user%password or user/workgroup or
+user/workgroup%password to allow the password and workgroup to be
+specified as part of the username\&.
+.IP 
+.IP "\fBpassword=<arg>\fP" 
+specifies the SMB password\&. If not given then
+smbmount will prompt for a passeword, unless the guest option is
+given\&.
+.IP 
+.IP "\fBnetbiosname=<arg>\fP" 
+sets the source NetBIOS name\&. It defaults to
+the local hostname\&.
+.IP 
+.IP "\fBuid=<arg>\fP" 
+sets the uid that files will be mounted as\&. It may be
+specified as either a username or a numeric uid\&.
+.IP 
+.IP "\fBgid=<arg>\fP" 
+sets the gid that files will be mounted as\&. It may be
+specified as either a groupname or a numeric gid\&.
+.IP 
+.IP "\fBport=<arg>\fP" 
+sets the remote SMB port number\&. The default is 139\&.
+.IP 
+.IP "\fBfmask=<arg>\fP" 
+sets the file mask\&. This deterines the permissions
+that remote files have in the local filesystem\&. The default is based
+on the current umask\&.
+.IP 
+.IP "\fBdmask=<arg>\fP" 
+sets the directory mask\&. This deterines the
+permissions that remote directories have in the local filesystem\&. The
+default is based on the current umask\&.
+.IP 
+.IP "\fBdebug=<arg>\fP" 
+sets the debug level\&. This is useful for tracking
+down SMB connection problems\&.
+.IP 
+.IP "\fBip=<arg>\fP" 
+sets the destination host or IP address\&.
+.IP 
+.IP "\fBworkgroup=<arg>\fP" 
+sets the workgroup on the destination
+.IP 
+.IP "\fBsockopt=<arg>\fP" 
+sets the TCP socket options\&. See the smb\&.conf
+"socket options" option\&.
+.IP 
+.IP "\fBscope=<arg>\fP" 
+sets the NetBIOS scope
+.IP 
+.IP "\fBguest\fP" 
+don\'t prompt for a password
+.IP 
+.IP "\fBro\fP" 
+mount read-only
+.IP 
+.IP "\fBrw\fP" 
+mount read-write
+.IP 
+.PP 
+.SH "AUTHOR" 
+The maintainer of smbfs, smbmnt and smbmount is Andrew Tridgell
+\fItridge@samba\&.org\fP
diff --git a/docs/manpages/smbstatus.1 b/docs/manpages/smbstatus.1
index 9013987b3f..7899344d7f 100644
--- a/docs/manpages/smbstatus.1
+++ b/docs/manpages/smbstatus.1
@@ -18,7 +18,7 @@ connections\&.
 .PP 
 .IP 
 .IP "\fB-P\fP" 
-If samba has been compiled with the profiling option, 
+If samba has been compiled with the profiling option,
 print only the contents of the profiling shared memory area\&.
 .IP 
 .IP "\fB-b\fP" 
diff --git a/docs/manpages/smbumount.8 b/docs/manpages/smbumount.8
index 4f9c6cbedb..724684a221 100644
--- a/docs/manpages/smbumount.8
+++ b/docs/manpages/smbumount.8
@@ -1,4 +1,4 @@
-.TH SMBUMOUNT 8 "13 Nov 1998" "smbumount 2.0.0-beta1"
+.TH SMBUMOUNT 8 "18 May 1999" "smbumount 2.0.4"
 .SH NAME
 smbumount \- umount for normal users
 .SH SYNOPSIS
diff --git a/docs/manpages/swat.8 b/docs/manpages/swat.8
index a9e876aaf2..8798c0a566 100644
--- a/docs/manpages/swat.8
+++ b/docs/manpages/swat.8
@@ -1,7 +1,7 @@
 .TH "swat " "8" "23 Oct 1998" "Samba" "SAMBA" 
 .PP 
 .SH "NAME" 
-swat \- swat - Samba Web Administration Tool
+swat \- Samba Web Administration Tool
 .PP 
 .SH "SYNOPSIS" 
 .PP 
diff --git a/docs/manpages/testparm.1 b/docs/manpages/testparm.1
index b75590aa9a..2d4c03a164 100644
--- a/docs/manpages/testparm.1
+++ b/docs/manpages/testparm.1
@@ -5,7 +5,7 @@ testparm \- check an smb\&.conf configuration file for internal correctness
 .PP 
 .SH "SYNOPSIS" 
 .PP 
-\fBtestparm\fP [-s] [configfilename] [hostname hostIP]
+\fBtestparm\fP [-s] [-h] [-L servername] [configfilename] [hostname hostIP]
 .PP 
 .SH "DESCRIPTION" 
 .PP 
@@ -24,6 +24,11 @@ If the optional host name and host IP address are specified on the
 command line, this test program will run through the service entries
 reporting whether the specified host has access to each service\&.
 .PP 
+If \fBtestparm\fP finds an error in the \fBsmb\&.conf\fP
+file it returns an exit code of 1 to the calling program, else it returns
+an exit code of 0\&. This allows shell scripts to test the output from
+\fBtestparm\fP\&.
+.PP 
 .SH "OPTIONS" 
 .PP 
 .IP 
@@ -32,6 +37,13 @@ Without this option, \fBtestparm\fP will prompt for a
 carriage return after printing the service names and before dumping
 the service definitions\&.
 .IP 
+.IP "\fB-h\fP" 
+Print usage message
+.IP 
+.IP "\fB-L servername\fP" 
+Sets the value of the %L macro to servername\&. This
+is useful for testing include files specified with the %L macro\&.
+.IP 
 .IP "\fBconfigfilename\fP" 
 This is the name of the configuration file to
 check\&. If this parameter is not present then the default
diff --git a/docs/samba.lsm b/docs/samba.lsm
index c69add4d8e..fa10333683 100644
--- a/docs/samba.lsm
+++ b/docs/samba.lsm
@@ -1,14 +1,14 @@
 Begin2
 Title        = Samba
-Version      = 2.0
+Version      = 1.8.0
 Desc1        = Samba is a SMB based file and print server for unix. It
 Desc2        = provides access to unix file and print services from
 Desc3        = SMB compatible clients such as WinNT, WfWg, OS/2
 Desc4        = and Pathworks. It also includes a ftp-style unix client
 Desc5        = and a netbios nameserver.
-Author       = Samba Team
+Author       = Andrew Tridgell
 AuthorEmail  = samba-bugs@samba.org
-Maintainer   = Samba Team
+Maintainer   = Andrew Tridgell
 MaintEmail   = samba-bugs@samba.org
 Site1        = samba.org
 Path1        = pub/samba/
@@ -18,8 +18,9 @@ Required1    = Ansi-C compiler and a TCP/IP network.
 CopyPolicy1  = GNU Public License
 Keywords     = LanManager, SMB, Networking
 Comment1     = To join the Samba mailing list send mail to 
-Comment2     = listproc@samba.org with a body of
+Comment2     = listproc@listproc.anu.edu.au with a body of
 Comment3     = "subscribe samba Your Name"
-Entered      = November 1998
+Entered      = October 1994
 EnteredBy    = Andrew Tridgell
 End
+
diff --git a/docs/textdocs/Application_Serving.txt b/docs/textdocs/Application_Serving.txt
index 0149b17e6d..be07cfe062 100644
--- a/docs/textdocs/Application_Serving.txt
+++ b/docs/textdocs/Application_Serving.txt
@@ -1,5 +1,5 @@
 !==
-!== Application_Serving.txt for Samba release 2.1.0prealpha 981204
+!== Application_Serving.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributed:	January 7, 1997
 Updated:	March 24, 1998
diff --git a/docs/textdocs/BROWSING-Config.txt b/docs/textdocs/BROWSING-Config.txt
index 2811f02659..a27cf7401d 100644
--- a/docs/textdocs/BROWSING-Config.txt
+++ b/docs/textdocs/BROWSING-Config.txt
@@ -1,5 +1,5 @@
 !==
-!== BROWSING-Config.txt for Samba release 2.1.0prealpha 981204
+!== BROWSING-Config.txt for Samba release 2.0.4 18 May 1999
 !==
 Date:		July 5, 1998
 Contributor:	John H Terpstra <jht@samba.org>
diff --git a/docs/textdocs/BROWSING.txt b/docs/textdocs/BROWSING.txt
index 2ed2369f08..ae18382bd9 100644
--- a/docs/textdocs/BROWSING.txt
+++ b/docs/textdocs/BROWSING.txt
@@ -1,5 +1,5 @@
 !==
-!== BROWSING.txt for Samba release 2.1.0prealpha 981204
+!== BROWSING.txt for Samba release 2.0.4 18 May 1999
 !==
 Author/s:	Many (Thanks to Luke, Jeremy, Andrew, etc.)
 Updated:	July 5, 1998
diff --git a/docs/textdocs/BUGS.txt b/docs/textdocs/BUGS.txt
index db3a548450..14a77f4cb4 100644
--- a/docs/textdocs/BUGS.txt
+++ b/docs/textdocs/BUGS.txt
@@ -1,5 +1,5 @@
 !==
-!== BUGS.txt for Samba release 2.1.0prealpha 981204
+!== BUGS.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:	Samba Team
 Updated:	June 27, 1997
diff --git a/docs/textdocs/CVS_ACCESS.txt b/docs/textdocs/CVS_ACCESS.txt
index 6fec05eae5..c854d3fe33 100644
--- a/docs/textdocs/CVS_ACCESS.txt
+++ b/docs/textdocs/CVS_ACCESS.txt
@@ -1,5 +1,5 @@
 !==
-!== CVS_ACCESS.txt for Samba release 2.1.0prealpha 981204
+!== CVS_ACCESS.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:    Modified from the Web pages by Jeremy Allison.
 Date:           23 Dec 1997
diff --git a/docs/textdocs/DHCP-Server-Configuration.txt b/docs/textdocs/DHCP-Server-Configuration.txt
index 52ecf2d9b0..72afd85e59 100644
--- a/docs/textdocs/DHCP-Server-Configuration.txt
+++ b/docs/textdocs/DHCP-Server-Configuration.txt
@@ -1,5 +1,5 @@
 !==
-!== DHCP-Server-Configuration.txt for Samba release 2.1.0prealpha 981204
+!== DHCP-Server-Configuration.txt for Samba release 2.0.4 18 May 1999
 !==
 Subject:	DHCP Server Configuration for SMB Clients
 Date:		March 1, 1998
diff --git a/docs/textdocs/DIAGNOSIS.txt b/docs/textdocs/DIAGNOSIS.txt
index e490fb81eb..ce51400464 100644
--- a/docs/textdocs/DIAGNOSIS.txt
+++ b/docs/textdocs/DIAGNOSIS.txt
@@ -1,8 +1,8 @@
 !==
-!== DIAGNOSIS.txt for Samba release 2.1.0prealpha 981204
+!== DIAGNOSIS.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:	Andrew Tridgell
-Updated:	October 14, 1997
+Updated:	November 1, 1999
 
 Subject:	DIAGNOSING YOUR SAMBA SERVER
 ===========================================================================
@@ -16,9 +16,6 @@ You should do ALL the tests, in the order shown. I have tried to
 carefully choose them so later tests only use capabilities verified in
 the earlier tests.
 
-I would welcome additions to this set of tests. Please mail them to
-samba-bugs@samba.org
-
 If you send me an email saying "it doesn't work" and you have not
 followed this test procedure then you should not be surprised if I
 ignore your email.
@@ -28,9 +25,10 @@ ASSUMPTIONS
 -----------
 
 In all of the tests I assume you have a Samba server called BIGSERVER
-and a PC called ACLIENT. I also assume the PC is running windows for
-workgroups with a recent copy of the microsoft tcp/ip stack. Alternatively,
-your PC may be running Windows 95 or Windows NT (Workstation or Server).
+and a PC called ACLIENT both in workgroup TESTGROUP. I also assume the
+PC is running windows for workgroups with a recent copy of the
+microsoft tcp/ip stack. Alternatively, your PC may be running Windows
+95 or Windows NT (Workstation or Server).
 
 The procedure is similar for other types of clients.
 
@@ -44,7 +42,7 @@ smb.conf. I will assume this share is called "tmp". You can add a
  read only = yes
 
 
-THESE TESTS ASSUME VERSION 1.9.16 OR LATER OF THE SAMBA SUITE. SOME
+THESE TESTS ASSUME VERSION 2.0.6 OR LATER OF THE SAMBA SUITE. SOME
 COMMANDS SHOWN DID NOT EXIST IN EARLIER VERSIONS
 
 Please pay attention to the error messages you receive. If any error message
@@ -102,7 +100,7 @@ valid. Check what your guest account is using "testparm" and
 temporarily remove any "hosts allow", "hosts deny", "valid users" or
 "invalid users" lines.
 
-If you get a "connection refused" response then the smbd server could
+If you get a "connection refused" response then the smbd server may
 not be running. If you installed it in inetd.conf then you probably edited
 that file incorrectly. If you installed it as a daemon then check that
 it is running, and check that the netbios-ssn port is in a LISTEN
@@ -170,6 +168,9 @@ You should get the PCs IP address back. If you don't then the client
 software on the PC isn't installed correctly, or isn't started, or you
 got the name of the PC wrong. 
 
+If ACLIENT doesn't resolve via DNS then use the IP address of the
+client in the above test.
+
 
 TEST 6:
 -------
@@ -199,11 +200,15 @@ not correct. (Refer to TEST 3 notes above).
 TEST 7:
 -------
 
-Run the command "smbclient '\\BIGSERVER\TMP'". You should then be
+Run the command "smbclient //BIGSERVER/TMP". You should then be
 prompted for a password. You should use the password of the account
 you are logged into the unix box with. If you want to test with
-another account then add the -U <accountname> option to the command
-line. 
+another account then add the -U <accountname> option to the end of
+the command line.  eg: smbclient //bigserver/tmp -Ujohndoe
+
+Note: It is possible to specify the password along with the username
+as follows:
+	smbclient //bigserver/tmp -Ujohndoe%secret
 
 Once you enter the password you should get the "smb>" prompt. If you
 don't then look at the error message. If it says "invalid network
@@ -250,6 +255,12 @@ same fixes apply as they did for the "smbclient -L" test above. In
 particular, make sure your "hosts allow" line is correct (see the man
 pages)
 
+Also, do not overlook that fact that when the workstation requests the
+connection to the samba server it will attempt to connect using the 
+name with which you logged onto your Windows machine. You need to make
+sure that an account exists on your Samba server with that exact same
+name and password.
+
 If you get "specified computer is not receiving requests" or similar
 it probably means that the host is not contactable via tcp services.
 Check to see if the host is running tcp wrappers, and if so add an entry in
@@ -271,10 +282,23 @@ USERNAME" to the [tmp] section of smb.conf where "USERNAME" is the
 username corresponding to the password you typed. If you find this
 fixes things you may need the username mapping option.
 
-
 TEST 10:
 --------
 
+Run the command "nmblookup -M TESTGROUP" where TESTGROUP is the name
+of the workgroup that your Samba server and Windows PCs belong to. You
+should get back the IP address of the master browser for that
+workgroup.
+
+If you don't then the election process has failed. Wait a minute to
+see if it is just being slow then try again. If it still fails after
+that then look at the browsing options you have set in smb.conf. Make
+sure you have "preferred master = yes" to ensure that an election is
+held at startup.
+
+TEST 11:
+--------
+
 From file manager try to browse the server. Your samba server should
 appear in the browse list of your local workgroup (or the one you
 specified in smb.conf). You should be able to double click on the name
diff --git a/docs/textdocs/DNIX.txt b/docs/textdocs/DNIX.txt
index 4c1fcbde31..f209f04618 100644
--- a/docs/textdocs/DNIX.txt
+++ b/docs/textdocs/DNIX.txt
@@ -1,5 +1,5 @@
 !==
-!== DNIX.txt for Samba release 2.1.0prealpha 981204
+!== DNIX.txt for Samba release 2.0.4 18 May 1999
 !==
 DNIX has a problem with seteuid() and setegid(). These routines are
 needed for Samba to work correctly, but they were left out of the DNIX
diff --git a/docs/textdocs/DOMAIN.txt b/docs/textdocs/DOMAIN.txt
index f5b85ea28f..d16f3aa55d 100644
--- a/docs/textdocs/DOMAIN.txt
+++ b/docs/textdocs/DOMAIN.txt
@@ -1,5 +1,5 @@
 !==
-!== DOMAIN.txt for Samba release 2.1.0prealpha 981204
+!== DOMAIN.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:	Samba Team
 Updated:	December 4, 1998 (John H Terpstra)
diff --git a/docs/textdocs/DOMAIN_CONTROL.txt b/docs/textdocs/DOMAIN_CONTROL.txt
index ac3f618501..dd4afa3475 100644
--- a/docs/textdocs/DOMAIN_CONTROL.txt
+++ b/docs/textdocs/DOMAIN_CONTROL.txt
@@ -1,5 +1,5 @@
 !==
-!== DOMAIN_CONTROL.txt for Samba release 2.1.0prealpha 981204
+!== DOMAIN_CONTROL.txt for Samba release 2.0.4 18 May 1999
 !==
 Initial Release:	August 22, 1996
 Contributor:		John H Terpstra <samba-bugs@samba.org>
diff --git a/docs/textdocs/DOMAIN_MEMBER.txt b/docs/textdocs/DOMAIN_MEMBER.txt
index 3238fde179..53fd6d94f9 100644
--- a/docs/textdocs/DOMAIN_MEMBER.txt
+++ b/docs/textdocs/DOMAIN_MEMBER.txt
@@ -1,7 +1,7 @@
 
 TITLE INFORMATION: Joining an NT Domain with Samba 2.0 
 AUTHOR INFORMATION: Jeremy Allison, Samba Team 
-DATE INFORMATION: 11th November 1998 
+DATE INFORMATION: 7th October 1999 
 
 Contents 
 
@@ -11,7 +11,8 @@ Joining an NT Domain with Samba 2.0
 In order for a Samba-2 server to join an NT domain, you must first add
 the NetBIOS name of the Samba server to the NT domain on the PDC using
 Server Manager for Domains.  This creates the machine account in the
-domain (PDC) SAM.
+domain (PDC) SAM. Note that you should add the Samba server as a "Windows
+NT Workstation or Server", NOT as a Primary or backup domain controller.
 
 Assume you have a Samba-2 server with a NetBIOS name of SERV1 and are
 joining an NT domain called DOM, which has a PDC with a NetBIOS name
@@ -75,6 +76,10 @@ workgroup = DOM
 
 as this is the name of the domain we are joining. 
 
+You must also have the parameter "encrypt passwords"
+set to "yes" in order for your users to authenticate to the
+NT PDC.
+
 Finally, add (or modify) a:
 
 "password server ="
@@ -89,19 +94,15 @@ each of these servers in order, so you may want to rearrange this list
 in order to spread out the authentication load among domain
 controllers.
 
-Currently, Samba requires that a defined list of domain controllers be
-listed in this parameter in order to authenticate with domain-level
-security. NT does not use this method, and will either broadcast or
-use a WINS database in order to find domain controllers to
-authenticate against.
+Alternatively, if you want smbd to automatically determine the
+list of Domain controllers to use for authentication, you may set this line to be :
 
-Originally, I considered this idea for Samba, but dropped it because
-it seemed so insecure.  However several Samba-2 alpha users have
-requested that this feature be added to make Samba more NT-like, so
-I'll probably add a special name of '*' (which means: act like NT
-when looking for domain controllers) in a future release of the
-code. At present, however, you need to know where your domain
-controllers are.
+password server = *
+
+This method, which is new in Samba 2.0.6 and above, allows Samba
+to use exactly the same mechanism that NT does. This method either broadcasts or
+uses a WINS database in order to find domain controllers to
+authenticate against.
 
 Finally, restart your Samba daemons and get ready for clients to begin
 using domain security!
diff --git a/docs/textdocs/ENCRYPTION.txt b/docs/textdocs/ENCRYPTION.txt
index ace8ef88bd..89f30b0d53 100644
--- a/docs/textdocs/ENCRYPTION.txt
+++ b/docs/textdocs/ENCRYPTION.txt
@@ -1,8 +1,8 @@
 !==
-!== ENCRYPTION.txt for Samba release 2.1.0prealpha 981204
+!== ENCRYPTION.txt for Samba release 2.0.5a 22 Jul 1999
 !==
 Contributor:	Jeremy Allison <samba-bugs@samba.org>
-Updated:	March 19, 1998
+Updated:	April 19, 1999
 Note:		Please refer to WinNT.txt also
 
 Subject:	LanManager / Samba Password Encryption.
@@ -22,7 +22,7 @@ How does it work ?
 
 LanManager encryption is somewhat similar to UNIX password
 encryption. The server uses a file containing a hashed value of a
-users password.  This is created by taking the users plaintext
+user's password.  This is created by taking the user's plaintext
 password, capitalising it, and either truncating to 14 bytes (or
 padding to 14 bytes with null bytes). This 14 byte value is used as
 two 56 bit DES keys to encrypt a 'magic' eight byte value, forming a
@@ -30,7 +30,7 @@ two 56 bit DES keys to encrypt a 'magic' eight byte value, forming a
 be known as the *hashed password*.
 
 Windows NT encryption is a higher quality mechanism, consisting
-of doing an MD4 hash on a Unicode version of the users password. This
+of doing an MD4 hash on a Unicode version of the user's password. This
 also produces a 16 byte hash value that is non-reversible.
 
 When a client (LanManager, Windows for WorkGroups, Windows 95 or
@@ -51,10 +51,10 @@ In the SMB call SMBsessionsetupX (when user level security is
 selected) or the call SMBtconX (when share level security is selected)
 the 24 byte response is returned by the client to the Samba server.
 For Windows NT protocol levels the above calculation is done on
-both hashes of the users password and both responses are returned
+both hashes of the user's password and both responses are returned
 in the SMB call, giving two 24 byte values.
 
-The Samba server then reproduces the above calculation, using it's own
+The Samba server then reproduces the above calculation, using its own
 stored value of the 16 byte hashed password (read from the smbpasswd
 file - described later) and the challenge value that it kept from the
 negotiate protocol reply. It then checks to see if the 24 byte value it
@@ -62,11 +62,11 @@ calculates matches the 24 byte value returned to it from the client.
 
 If these values match exactly, then the client knew the correct
 password (or the 16 byte hashed value - see security note below) and
-is this allowed access. If not then the client did not know the
+is thus allowed access. If not, then the client did not know the
 correct password and is denied access.
 
 Note that the Samba server never knows or stores the cleartext of the
-users password - just the 16 byte hashed values derived from it. Also
+user's password - just the 16 byte hashed values derived from it. Also
 note that the cleartext password or 16 byte hashed values are never
 transmitted over the network - thus increasing security.
 
@@ -79,7 +79,7 @@ typically sends clear text passwords over the nextwork when logging
 in. This is bad. The SMB encryption scheme never sends the cleartext
 password over the network but it does store the 16 byte hashed values
 on disk. This is also bad. Why? Because the 16 byte hashed values are a
-"password equivalent". You cannot derive the users password from them,
+"password equivalent". You cannot derive the user's password from them,
 but they could potentially be used in a modified client to gain access
 to a server. This would require considerable technical knowledge on
 behalf of the attacker but is perfectly possible. You should thus
@@ -106,7 +106,7 @@ a network sniffer cannot just record passwords going to the SMB server.
 
 - WinNT doesn't like talking to a server that isn't using SMB
 encrypted passwords. It will refuse to browse the server if the server
-is also in user level security mode. It will insist on promting the
+is also in user level security mode. It will insist on prompting the
 user for the password on each connection, which is very annoying. The
 only things you can do to stop this is to use SMB encryption.
 
@@ -135,7 +135,7 @@ The smbpasswd file.
 In order for Samba to participate in the above protocol it must
 be able to look up the 16 byte hashed values given a user name.
 Unfortunately, as the UNIX password value is also a one way hash
-function (ie. it is impossible to retrieve the cleartext of the users
+function (ie. it is impossible to retrieve the cleartext of the user's
 password given the UNIX hash of it) then a separate password file
 containing this 16 byte value must be kept. To minimise problems with
 these two password files, getting out of sync, the UNIX /etc/passwd and
@@ -177,10 +177,11 @@ chmod 600 smbpasswd.
 
 The format of the smbpasswd file is
 
-username:uid:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:Long name:user home dir:user shell
+username:uid:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[Account type]:LCT-<last-change-time>:Long name
 
-Although only the username, uid, and XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-sections are significant and are looked at in the Samba code.
+Although only the username, uid, XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,
+[Account type] and last-change-time sections are significant and
+are looked at in the Samba code.
 
 It is *VITALLY* important that there by 32 'X' characters between the
 two ':' characters in the XXX sections - the smbpasswd and Samba code 
@@ -192,7 +193,7 @@ When the password file is created all users have password entries
 consisting of 32 'X' characters. By default this disallows any access
 as this user. When a user has a password set, the 'X' characters change
 to 32 ascii hexadecimal digits (0-9, A-F). These are an ascii
-representation of the 16 byte hashed value of a users password.
+representation of the 16 byte hashed value of a user's password.
 
 To set a user to have no password (not recommended), edit the file
 using vi, and replace the first 11 characters with the asci text
@@ -202,7 +203,7 @@ NO PASSWORD
 Eg. To clear the password for user bob, his smbpasswd file entry would
 look like :
 
-bob:100:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:Bob's full name:/bobhome:/bobshell
+bob:100:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[U          ]:LCT-00000000:Bob's full name:/bobhome:/bobshell
 
 If you are allowing users to use the smbpasswd command to set their own
 passwords, you may want to give users NO PASSWORD initially so they do
@@ -214,7 +215,7 @@ that user with no password. Enable this by adding the line :
 null passwords = true
 
 to the [global] section of the smb.conf file (this is why the
-above scenario is not recommended). Preferebly, allocate your
+above scenario is not recommended). Preferably, allocate your
 users a default password to begin with, so you do not have
 to enable this on your server.
 
@@ -236,16 +237,16 @@ setuid root (the new smbpasswd code enforces this restriction so
 it cannot be run this way by accident).
 
 smbpasswd now works in a client-server mode where it contacts
-the local smbd to change the users password on its behalf. This
+the local smbd to change the user's password on its behalf. This
 has enormous benefits - as follows.
 
-1). smbpasswd no longer has to be setuid root - an enourmous
+1). smbpasswd no longer has to be setuid root - an enormous
 range of potential security problems is eliminated.
 
 2). smbpasswd now has the capability to change passwords
 on Windows NT servers (this only works when the request is
 sent to the NT Primary Domain Controller if you are changing 
-an NT Domain users password).
+an NT Domain user's password).
 
 To run smbpasswd as a normal user just type :
 
@@ -313,7 +314,7 @@ If this fails then you will find that you will need entries that look
 like this:
 
 # SMB password file.
-tridge:148:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:Andrew Tridgell:/home/tridge:/bin/tcsh
+tridge:148:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[U          ]:LCT-00000000:Andrew Tridgell:/home/tridge:/bin/tcsh
 
 note that the uid and username fields must be right. Also, you must get
 the number of X's right (there should be 32).
diff --git a/docs/textdocs/Faxing.txt b/docs/textdocs/Faxing.txt
index 7c21e96c6f..426cbfcee3 100644
--- a/docs/textdocs/Faxing.txt
+++ b/docs/textdocs/Faxing.txt
@@ -1,5 +1,5 @@
 !==
-!== Faxing.txt for Samba release 2.1.0prealpha 981204
+!== Faxing.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:    Gerhard Zuber <zuber@berlin.snafu.de>
 Date:			August 5th 1997.
diff --git a/docs/textdocs/GOTCHAS.txt b/docs/textdocs/GOTCHAS.txt
index 356da2eeac..023e33b1ce 100644
--- a/docs/textdocs/GOTCHAS.txt
+++ b/docs/textdocs/GOTCHAS.txt
@@ -1,5 +1,5 @@
 !==
-!== GOTCHAS.txt for Samba release 2.1.0prealpha 981204
+!== GOTCHAS.txt for Samba release 2.0.4 18 May 1999
 !==
 This file lists Gotchas to watch out for:
 =========================================================================
diff --git a/docs/textdocs/HINTS.txt b/docs/textdocs/HINTS.txt
index 93a2263d97..87a77dacc1 100644
--- a/docs/textdocs/HINTS.txt
+++ b/docs/textdocs/HINTS.txt
@@ -1,5 +1,5 @@
 !==
-!== HINTS.txt for Samba release 2.1.0prealpha 981204
+!== HINTS.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:	Many
 Updated:	Not for a long time!
diff --git a/docs/textdocs/MIRRORS.txt b/docs/textdocs/MIRRORS.txt
index 9b7c8ab23a..a133f261c5 100755
--- a/docs/textdocs/MIRRORS.txt
+++ b/docs/textdocs/MIRRORS.txt
@@ -1,5 +1,5 @@
 !==
-!== MIRRORS.txt for Samba release 2.1.0prealpha 981204
+!== MIRRORS.txt for Samba release 2.0.4 18 May 1999
 !==
 
 For a list of web and ftp mirrors please see 
diff --git a/docs/textdocs/Macintosh_Clients.txt b/docs/textdocs/Macintosh_Clients.txt
index 15ccce829e..2af6e213d1 100644
--- a/docs/textdocs/Macintosh_Clients.txt
+++ b/docs/textdocs/Macintosh_Clients.txt
@@ -1,5 +1,5 @@
 !==
-!== Macintosh_Clients.txt for Samba release 2.1.0prealpha 981204
+!== Macintosh_Clients.txt for Samba release 2.0.4 18 May 1999
 !==
 > Are there any Macintosh clients for Samba?
 
diff --git a/docs/textdocs/NTDOMAIN.txt b/docs/textdocs/NTDOMAIN.txt
index f1207582bd..8408acb979 100644
--- a/docs/textdocs/NTDOMAIN.txt
+++ b/docs/textdocs/NTDOMAIN.txt
@@ -1,5 +1,5 @@
 !==
-!== NTDOMAIN.txt for Samba release 2.1.0prealpha 981204
+!== NTDOMAIN.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:	Luke Kenneth Casson Leighton (samba-bugs@samba.org)
 		Copyright (C) 1997 Luke Kenneth Casson Leighton
diff --git a/docs/textdocs/NetBIOS.txt b/docs/textdocs/NetBIOS.txt
index ff4acd5e98..9295f5c4bd 100644
--- a/docs/textdocs/NetBIOS.txt
+++ b/docs/textdocs/NetBIOS.txt
@@ -1,5 +1,5 @@
 !==
-!== NetBIOS.txt for Samba release 2.1.0prealpha 981204
+!== NetBIOS.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:    lkcl - samba-bugs@arvidsjaur.anu.edu.au
                 Copyright 1997  Luke Kenneth Casson Leighton 
diff --git a/docs/textdocs/OS2-Client-HOWTO.txt b/docs/textdocs/OS2-Client-HOWTO.txt
index bc687c22ce..4413d387eb 100644
--- a/docs/textdocs/OS2-Client-HOWTO.txt
+++ b/docs/textdocs/OS2-Client-HOWTO.txt
@@ -1,5 +1,5 @@
 !==
-!== OS2-Client-HOWTO.txt for Samba release 2.1.0prealpha 981204
+!== OS2-Client-HOWTO.txt for Samba release 2.0.4 18 May 1999
 !==
 
 
diff --git a/docs/textdocs/PRINTER_DRIVER.txt b/docs/textdocs/PRINTER_DRIVER.txt
index 63befa9e7f..5bf82e0cfe 100644
--- a/docs/textdocs/PRINTER_DRIVER.txt
+++ b/docs/textdocs/PRINTER_DRIVER.txt
@@ -1,5 +1,5 @@
 !==
-!== PRINTER_DRIVER.txt for Samba release 2.1.0prealpha 981204
+!== PRINTER_DRIVER.txt for Samba release 2.0.4 18 May 1999
 !==
 ==========================================================================
 	Supporting the famous PRINTER$ share
diff --git a/docs/textdocs/PROFILES.txt b/docs/textdocs/PROFILES.txt
index e0d271bd05..af9f99a002 100644
--- a/docs/textdocs/PROFILES.txt
+++ b/docs/textdocs/PROFILES.txt
@@ -1,5 +1,5 @@
 !==
-!== PROFILES.txt for Samba release 2.1.0prealpha 981204
+!== PROFILES.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributors:	Bruce Cook <BC3-AU@bigfoot.com>
 		Copyright (C) 1998 Bruce Cook
diff --git a/docs/textdocs/Passwords.txt b/docs/textdocs/Passwords.txt
index ec633ee1b5..f86827367f 100644
--- a/docs/textdocs/Passwords.txt
+++ b/docs/textdocs/Passwords.txt
@@ -1,8 +1,8 @@
 !==
-!== Passwords.txt for Samba release 2.1.0prealpha 981204
+!== Passwords.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:	Unknown
-Date:		Unknown
+Date:		Updated April 19th 1999.
 Status:		Current
 
 Subject:	NOTE ABOUT PASSWORDS
@@ -37,8 +37,8 @@ Unix password checking method you are using.  Note that the AFS code is
 only written and tested for AFS 3.3 and later.
 
 
-SECURITY = SERVER
-=================
+SECURITY = SERVER or DOMAIN
+===========================
 
 Samba can use a remote server to do its username/password
 validation. This allows you to have one central machine (for example a
diff --git a/docs/textdocs/Printing.txt b/docs/textdocs/Printing.txt
index 3e894e68e5..358eab3b60 100644
--- a/docs/textdocs/Printing.txt
+++ b/docs/textdocs/Printing.txt
@@ -1,5 +1,5 @@
 !==
-!== Printing.txt for Samba release 2.1.0prealpha 981204
+!== Printing.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:	Unknown <samba-bugs@samba.org>
 Date:		Unknown
@@ -54,7 +54,7 @@ might be:
 
 then you print a file and look at the /tmp/tmp.print file to see what
 is produced. Try printing this file with lpr. Does it work? If not
-then your problem with with your lpr system, not with Samba. Often
+then the problem is with your lpr system, not with Samba. Often
 people have problems with their /etc/printcap file or permissions on
 various print queues. 
 
@@ -95,18 +95,32 @@ If the above debug tips don't help, then maybe you need to bring in
 the bug gun, system tracing. See Tracing.txt in this directory.
 
 =====================================================================
-From Caldera Inc., the following documentation has been contributed:
+From Caldera Inc., the following documentation has been
+contributed. Note that it contains stuff that is only relevant on some
+systems (specifically Caldera OpenLinux systems).
 
 
 8.6 Setting up a raw SAMBA printer.
 
-Note: this is not a guide on setting up SAMBA. It merely addresses creating a printer configuration that will allow the output of regular (i.e. not PostScript) Windows printer drivers to print through SAMBA.
+Note: this is not a guide on setting up SAMBA. It merely addresses
+creating a printer configuration that will allow the output of regular
+(i.e. not PostScript) Windows printer drivers to print through SAMBA.
 
-Regular Windows printer drivers can be used to print via SAMBA, but you must set up a raw printer entry in "/etc/printcap" to accomplish this. Also, a print command will need to be specified in "/etc/smb.conf" that forces binary printing.
+Regular Windows printer drivers can be used to print via SAMBA, but
+you must set up a raw printer entry in "/etc/printcap" to accomplish
+this. Also, a print command will need to be specified in
+"/etc/smb.conf" that forces binary printing.
 
-The best way to start is to use printtool under X to create a new entry specifically for this printer. All you really need for it to do is create the necessary directories and set the permissions correctly, so don't worry about setting up a filter for a specific printer.  Filters are not going to be used at all for this entry.
+The best way to start is to use printtool under X to create a new
+entry specifically for this printer. All you really need for it to do
+is create the necessary directories and set the permissions correctly,
+so don't worry about setting up a filter for a specific printer.
+Filters are not going to be used at all for this entry.
 
-Next, go into "/etc" and edit the printcap entry you just created, changing it to look like this (if you named it something other than raw, the entry name and spool directory should be changed here to match):
+Next, go into "/etc" and edit the printcap entry you just created,
+changing it to look like this (if you named it something other than
+raw, the entry name and spool directory should be changed here to
+match):
 
 raw:\
 	:rw:sh: \
@@ -114,12 +128,15 @@ raw:\
 	:sd=/var/spool/lpd/raw: \
 	:fx=flp:
 
-When this is done and saved, edit the section of the smb.conf file that applies to the printer. Make sure the name of the section (enclosed in brackets) matches the name of the raw printer you just set up, then go down a line or two and add this line:
+When this is done and saved, edit the section of the smb.conf file
+that applies to the printer. Make sure the name of the section
+(enclosed in brackets) matches the name of the raw printer you just
+set up, then go down a line or two and add this line:
  
 print command = lpr -b -P%p %s
 
-Save the file, change to "/etc/rc.d/init.d", and type the following commands
-to restart the necessary daemons:
+Save the file, change to "/etc/rc.d/init.d", and type the following
+commands to restart the necessary daemons:
 
 ./lpd stop
 ./lpd start
diff --git a/docs/textdocs/Recent-FAQs.txt b/docs/textdocs/Recent-FAQs.txt
index b0e96d3c96..64af51a7a8 100644
--- a/docs/textdocs/Recent-FAQs.txt
+++ b/docs/textdocs/Recent-FAQs.txt
@@ -1,5 +1,5 @@
 !==
-!== Recent-FAQs.txt for Samba release 2.1.0prealpha 981204
+!== Recent-FAQs.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:	Samba-bugs@samba.org
 Date:		July 5, 1998
diff --git a/docs/textdocs/RoutedNetworks.txt b/docs/textdocs/RoutedNetworks.txt
index fb170319d8..35a185052f 100644
--- a/docs/textdocs/RoutedNetworks.txt
+++ b/docs/textdocs/RoutedNetworks.txt
@@ -1,5 +1,5 @@
 !==
-!== RoutedNetworks.txt for Samba release 2.1.0prealpha 981204
+!== RoutedNetworks.txt for Samba release 2.0.4 18 May 1999
 !==
 #NOFNR Flag in LMHosts to Communicate Across Routers
 
diff --git a/docs/textdocs/SCO.txt b/docs/textdocs/SCO.txt
index b9d1240306..d723a14889 100644
--- a/docs/textdocs/SCO.txt
+++ b/docs/textdocs/SCO.txt
@@ -1,5 +1,5 @@
 !==
-!== SCO.txt for Samba release 2.1.0prealpha 981204
+!== SCO.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:	Geza Makay <makayg@math.u-szeged.hu>
 Date:		Unknown
diff --git a/docs/textdocs/SSLeay.txt b/docs/textdocs/SSLeay.txt
index 99ce214e3f..981e35e4ef 100644
--- a/docs/textdocs/SSLeay.txt
+++ b/docs/textdocs/SSLeay.txt
@@ -1,5 +1,5 @@
 !==
-!== SSLeay.txt for Samba release 2.1.0prealpha 981204
+!== SSLeay.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor: Christian Starkjohann <cs@obdev.at>
 Date:        May 29, 1998
diff --git a/docs/textdocs/Speed.txt b/docs/textdocs/Speed.txt
index 73681f1ce2..b2fcd15cda 100644
--- a/docs/textdocs/Speed.txt
+++ b/docs/textdocs/Speed.txt
@@ -1,9 +1,6 @@
 !==
-!== Speed.txt for Samba release 2.1.0prealpha 981204
+!== Speed.txt for Samba release 2.0.4b 20 May 1999
 !==
-Contributor:	Andrew Tridgell
-Date:		January 1995
-Status:		Current
 
 Subject:	Samba performance issues
 ============================================================================
@@ -63,6 +60,21 @@ option has been left in the code for backwards compatibility reasons
 but it's use is now deprecated. A short summary of what the old
 code did follows.
 
+LEVEL2 OPLOCKS
+--------------
+
+With Samba 2.0.5 a new capability - level2 (read only) oplocks is
+supported (although the option is off by default - see the smb.conf
+man page for details). Turning on level2 oplocks (on a share-by-share basis)
+by setting the parameter :
+
+level2 oplocks = true 
+
+should speed concurrent access to files that are not commonly written
+to, such as application serving shares (ie. shares that contain common
+.EXE files - such as a Microsoft Office share) as it allows clients to
+read-ahread cache copies of these files.
+
 Old 'fake oplocks' option - deprecated.
 ---------------------------------------
 
diff --git a/docs/textdocs/Speed2.txt b/docs/textdocs/Speed2.txt
index 2a5baa144a..057f8e6bf3 100644
--- a/docs/textdocs/Speed2.txt
+++ b/docs/textdocs/Speed2.txt
@@ -1,5 +1,5 @@
 !==
-!== Speed2.txt for Samba release 2.1.0prealpha 981204
+!== Speed2.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:	Paul Cochrane <paulc@dth.scot.nhs.uk>
 Organization: 	Dundee Limb Fitting Centre
diff --git a/docs/textdocs/Support.txt b/docs/textdocs/Support.txt
index af5a9e0c46..ff342e3eac 100644
--- a/docs/textdocs/Support.txt
+++ b/docs/textdocs/Support.txt
@@ -1,5 +1,5 @@
 !==
-!== Support.txt for Samba release 2.1.0prealpha 981204
+!== Support.txt for Samba release 2.0.4 18 May 1999
 !==
 The Samba Consultants List
 ==========================
diff --git a/docs/textdocs/Tracing.txt b/docs/textdocs/Tracing.txt
index 31aef9bfc1..d156b34633 100644
--- a/docs/textdocs/Tracing.txt
+++ b/docs/textdocs/Tracing.txt
@@ -1,5 +1,5 @@
 !==
-!== Tracing.txt for Samba release 2.1.0prealpha 981204
+!== Tracing.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:	Andrew Tridgell <samba-bugs@samba.org>
 Date:		Old
diff --git a/docs/textdocs/UNIX-SMB.txt b/docs/textdocs/UNIX-SMB.txt
index cea6001ff2..7d597af654 100644
--- a/docs/textdocs/UNIX-SMB.txt
+++ b/docs/textdocs/UNIX-SMB.txt
@@ -1,5 +1,5 @@
 !==
-!== UNIX-SMB.txt for Samba release 2.1.0prealpha 981204
+!== UNIX-SMB.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:	Andrew Tridgell <samba-bugs@samba.org>
 Date:		April 1995
diff --git a/docs/textdocs/UNIX_INSTALL.txt b/docs/textdocs/UNIX_INSTALL.txt
index bc9d1c50b4..1de821e152 100644
--- a/docs/textdocs/UNIX_INSTALL.txt
+++ b/docs/textdocs/UNIX_INSTALL.txt
@@ -1,14 +1,5 @@
-!==
-!== UNIX_INSTALL.txt for Samba release 2.1.0prealpha 981204
-!==
-Contributor:	Andrew Tridgell <samba-bugs@samba.org>
-Date:		Unknown
-Status:		Current
-Updated:	November 13, 1998	<jra@samba.org>
-
-Subject:	HOW TO INSTALL AND TEST SAMBA
-===============================================================================
-
+HOW TO INSTALL AND TEST SAMBA
+=============================
 
 STEP 0. Read the man pages. They contain lots of useful info that will
 help to get you started. If you don't know how to read man pages then
diff --git a/docs/textdocs/UNIX_SECURITY.txt b/docs/textdocs/UNIX_SECURITY.txt
index 59a955ff7e..1a610d8e4c 100644
--- a/docs/textdocs/UNIX_SECURITY.txt
+++ b/docs/textdocs/UNIX_SECURITY.txt
@@ -1,5 +1,5 @@
 !==
-!== UNIX_SECURITY.txt for Samba release 2.1.0prealpha 981204
+!== UNIX_SECURITY.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:	John H Terpstra <jht@samba.org>
 Date:		July 5, 1998
diff --git a/docs/textdocs/Win95.txt b/docs/textdocs/Win95.txt
index c75edeefdd..417fe01220 100644
--- a/docs/textdocs/Win95.txt
+++ b/docs/textdocs/Win95.txt
@@ -1,5 +1,5 @@
 !==
-!== Win95.txt for Samba release 2.1.0prealpha 981204
+!== Win95.txt for Samba release 2.0.4 18 May 1999
 !==
 Copyright (C) 1997 - Samba-Team
 Contributed Date:	August 20, 1997
diff --git a/docs/textdocs/WinNT.txt b/docs/textdocs/WinNT.txt
index b0f614bbad..4894936aa9 100644
--- a/docs/textdocs/WinNT.txt
+++ b/docs/textdocs/WinNT.txt
@@ -1,5 +1,5 @@
 !==
-!== WinNT.txt for Samba release 2.1.0prealpha 981204
+!== WinNT.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributors:	Various
 		Password Section - Copyright (C) 1997 - John H Terpstra
diff --git a/docs/textdocs/cifsntdomain.txt b/docs/textdocs/cifsntdomain.txt
index 782267b780..ba6e0c46be 100644
--- a/docs/textdocs/cifsntdomain.txt
+++ b/docs/textdocs/cifsntdomain.txt
@@ -1,5 +1,5 @@
 !==
-!== cifsntdomain.txt for Samba release 2.1.0prealpha 981204
+!== cifsntdomain.txt for Samba release 2.0.4 18 May 1999
 !==
 NT Domain Authentication
 ------------------------
diff --git a/docs/textdocs/security_level.txt b/docs/textdocs/security_level.txt
index 87e0e38d48..9c4680ebe1 100644
--- a/docs/textdocs/security_level.txt
+++ b/docs/textdocs/security_level.txt
@@ -1,5 +1,5 @@
 !==
-!== security_level.txt for Samba release 2.1.0prealpha 981204
+!== security_level.txt for Samba release 2.0.4 18 May 1999
 !==
 Contributor:	Andrew Tridgell
 Updated:	June 27, 1997
@@ -59,16 +59,16 @@ maintain multiple authentication contexts in this way (WinDD is an
 example of an application that does this)
 
 
-Ok, now for share level security. In share level security (the default
-with samba) the client authenticates itself separately for each
-share. It will send a password along with each "tree connection"
-(share mount). It does not explicitly send a username with this
-operation. The client is expecting a password to be associated with
-each share, independent of the user. This means that samba has to work
-out what username the client probably wants to use. It is never
-explicitly sent the username. Some commercial SMB servers such as NT actually
-associate passwords directly with shares in share level security, but
-samba always uses the unix authentication scheme where it is a
+Ok, now for share level security. In share level security the client
+authenticates itself separately for each share. It will send a
+password along with each "tree connection" (share mount). It does not
+explicitly send a username with this operation. The client is
+expecting a password to be associated with each share, independent of
+the user. This means that samba has to work out what username the
+client probably wants to use. It is never explicitly sent the
+username. Some commercial SMB servers such as NT actually associate
+passwords directly with shares in share level security, but samba
+always uses the unix authentication scheme where it is a
 username/password that is authenticated, not a "share/password".
 
 Many clients send a "session setup" even if the server is in share
diff --git a/docs/yodldocs/DOMAIN_MEMBER.yo b/docs/yodldocs/DOMAIN_MEMBER.yo
index 2b05c0e814..f52b6ab97c 100644
--- a/docs/yodldocs/DOMAIN_MEMBER.yo
+++ b/docs/yodldocs/DOMAIN_MEMBER.yo
@@ -1,6 +1,6 @@
 mailto(samba-bugs@samba.org)
 
-article(Joining an NT Domain with Samba 2.0)(Jeremy Allison, Samba Team)(11th November 1998)
+article(Joining an NT Domain with Samba 2.0)(Jeremy Allison, Samba Team)(7th October 1999)
 
 center(Joining an NT Domain with Samba 2.0)
 center(-----------------------------------)
@@ -8,7 +8,8 @@ center(-----------------------------------)
 In order for a Samba-2 server to join an NT domain, you must first add
 the NetBIOS name of the Samba server to the NT domain on the PDC using
 Server Manager for Domains.  This creates the machine account in the
-domain (PDC) SAM.
+domain (PDC) SAM. Note that you should add the Samba server as a "Windows
+NT Workstation or Server", em(NOT) as a Primary or backup domain controller.
 
 Assume you have a Samba-2 server with a NetBIOS name of tt(SERV1) and are
 joining an NT domain called tt(DOM), which has a PDC with a NetBIOS name
@@ -21,7 +22,7 @@ command
 tt(smbpasswd -j DOM -r DOMPDC)
 
 as we are joining the domain DOM and the PDC for that domain (the only
-machine that has write access to the domain SAM database). If this is
+machine that has write access to the domain SAM database) is DOMPDC. If this is
 successful you will see the message:
 
 tt(smbpasswd: Joined domain DOM.)
@@ -31,8 +32,8 @@ man page for more details.
 
 This command goes through the machine account password change
 protocol, then writes the new (random) machine account password for
-this Samba server into the a file in the same directory in which an
-smbpasswd file would be stored (normally :
+this Samba server into a file in the same directory in which an
+smbpasswd file would be stored - normally :
 
 tt(/usr/local/samba/private)
 
@@ -72,6 +73,10 @@ tt(workgroup = DOM)
 
 as this is the name of the domain we are joining. 
 
+You must also have the parameter url(bf("encrypt passwords"))(smb.conf.5.html#encryptpasswords)
+set to tt("yes") in order for your users to authenticate to the
+NT PDC.
+
 Finally, add (or modify) a:
 
 url(bf("password server ="))(smb.conf.5.html#passwordserver)
@@ -86,19 +91,15 @@ each of these servers in order, so you may want to rearrange this list
 in order to spread out the authentication load among domain
 controllers.
 
-Currently, Samba requires that a defined list of domain controllers be
-listed in this parameter in order to authenticate with domain-level
-security. NT does not use this method, and will either broadcast or
-use a WINS database in order to find domain controllers to
-authenticate against.
+Alternatively, if you want smbd to automatically determine the
+list of Domain controllers to use for authentication, you may set this line to be :
 
-Originally, I considered this idea for Samba, but dropped it because
-it seemed so insecure.  However several Samba-2 alpha users have
-requested that this feature be added to make Samba more NT-like, so
-I'll probably add a special name of tt('*') (which means: act like NT
-when looking for domain controllers) in a future release of the
-code. At present, however, you need to know where your domain
-controllers are.
+tt(password server = *)
+
+This method, which is new in Samba 2.0.6 and above, allows Samba
+to use exactly the same mechanism that NT does. This method either broadcasts or
+uses a WINS database in order to find domain controllers to
+authenticate against.
 
 Finally, restart your Samba daemons and get ready for clients to begin
 using domain security!
diff --git a/docs/yodldocs/nmbd.8.yo b/docs/yodldocs/nmbd.8.yo
index bf9a5f8b78..596b42dd69 100644
--- a/docs/yodldocs/nmbd.8.yo
+++ b/docs/yodldocs/nmbd.8.yo
@@ -9,7 +9,7 @@ naming services to clients)
 label(SYNOPSIS)
 manpagesynopsis()
 
-bf(nmbd) [link(-D)(minusD)] [link(-o)(minuso)] [link(-a)(minusa)] [link(-H lmhosts file)(minusH)] [link(-d debuglevel)(minusd)] [link(-l log file basename)(minusl)] [link(-n primary NetBIOS name)(minusn)] [link(-p port number)(minusp)] [link(-s configuration file)(minuss)] [link(-i NetBIOS scope)(minusi)] [link(-h)(minush)]
+bf(nmbd) [link(-D)(minusD)] [link(-a)(minusa)] [link(-o)(minuso)] [link(-h)(minush)] [link(-V)(minusV)] [link(-H lmhosts file)(minusH)] [link(-d debuglevel)(minusd)] [link(-l log file basename)(minusl)] [link(-n primary NetBIOS name)(minusn)] [link(-p port number)(minusp)] [link(-s configuration file)(minuss)] [link(-i NetBIOS scope)(minusi)]
 
 label(DESCRIPTION)
 manpagedescription()
@@ -65,6 +65,12 @@ dit(bf(-o)) If this parameter is specified, the log files will be
 overwritten when opened.  By default, the log files will be appended
 to.
 
+label(minush)
+dit(bf(-h)) Prints the help information (usage) for bf(nmbd).
+
+label(minusV)
+dit(bf(-V)) Prints the version number for bf(nmbd).
+
 label(minusH)
 dit(bf(-H filename)) NetBIOS lmhosts file.
 
@@ -144,9 +150,6 @@ are em(very) rarely used, only set this parameter if you are the
 system administrator in charge of all the NetBIOS systems you
 communicate with.
 
-label(minush)
-dit(bf(-h)) Prints the help information (usage) for bf(nmbd).
-
 endit()
 
 label(FILES)
diff --git a/docs/yodldocs/nmblookup.1.yo b/docs/yodldocs/nmblookup.1.yo
index 6293fd01e5..80ec850be2 100644
--- a/docs/yodldocs/nmblookup.1.yo
+++ b/docs/yodldocs/nmblookup.1.yo
@@ -8,7 +8,7 @@ manpagename(nmblookup)(NetBIOS over TCP/IP client used to lookup NetBIOS names)
 label(SYNOPSIS)
 manpagesynopsis() 
 
-bf(nmblookup) [link(-M)(minusM)] [link(-R)(minusR)] [link(-S)(minusS)] [link(-r)(minusr)] [link(-A)(minusA)] [link(-h)(minush)] [link(-B broadcast address)(minusB)] [link(-U unicast address)(minusU)] [link(-d debuglevel)(minusd)] [link(-s smb config file)(minuss)] [link(-i NetBIOS scope)(minusi)] link(name)(name)
+bf(nmblookup) [link(-M)(minusM)] [link(-R)(minusR)] [link(-S)(minusS)] [link(-r)(minusr)] [link(-A)(minusA)] [link(-h)(minush)] [link(-B broadcast address)(minusB)] [link(-U unicast address)(minusU)] [link(-d debuglevel)(minusd)] [link(-s smb config file)(minuss)] [link(-i NetBIOS scope)(minusi)] [link(-T)(minusT)] link(name)(name)
 
 label(DESCRIPTION)
 manpagedescription()
@@ -26,8 +26,9 @@ manpageoptions()
 startdit()
 
 label(minusM)
-dit(bf(-M)) Searches for a master browser. This is done by doing a
-broadcast lookup on the special name tt(__MSBROWSE__).
+dit(bf(-M)) Searches for a master browser by looking up the 
+NetBIOS name link(bf(name))(name) with a type of 0x1d. If link(bf(name))(name)
+is tt("-") then it does a lookup on the special name tt(__MSBROWSE__).
 
 label(minusR)
 dit(bf(-R)) Set the recursion desired bit in the packet to do a
@@ -61,8 +62,8 @@ dit(bf(-h)) Print a help (usage) message.
 label(minusB)
 dit(bf(-B broadcast address)) Send the query to the given broadcast
 address. Without this option the default behavior of nmblookup is to
-send the query to the broadcast address of the primary network
-interface as either auto-detected or defined in the 
+send the query to the broadcast address of the network
+interfaces as either auto-detected or defined in the 
 url(bf(interfaces))(smb.conf.5.html#interfaces) parameter of the 
 url(bf(smb.conf (5)))(smb.conf.5.html) file.
 
@@ -103,6 +104,12 @@ are em(very) rarely used, only set this parameter if you are the
 system administrator in charge of all the NetBIOS systems you
 communicate with.
 
+label(minusT)
+dit(bf(-T)) This causes any IP addresses found in the lookup to be
+looked up via a reverse DNS lookup into a DNS name, and printed out
+before each tt("IP address   NetBIOS name") pair that is the normal
+output.
+
 label(name)
 dit(bf(name)) This is the NetBIOS name being queried. Depending upon
 the previous options this may be a NetBIOS name or IP address. If a
diff --git a/docs/yodldocs/samba.7.yo b/docs/yodldocs/samba.7.yo
index ff4ff2796b..dc238bd0fc 100644
--- a/docs/yodldocs/samba.7.yo
+++ b/docs/yodldocs/samba.7.yo
@@ -47,15 +47,6 @@ servers (such as Windows NT), and can also be used to allow a UNIX box
 to print to a printer attached to any SMB server (such as a PC running
 Windows NT).
 
-dit(url(bf(rpcclient))(rpcclient.1.html)) nl() nl() The url(bf(rpcclient)
-(1))(rpcclient.1.html) program is a client that can 'talk' to an
-SMB/CIFS MSRPC server.  Operations include things like managing a SAM
-Database (users, groups and aliases) in the same way as the Windows NT
-programs bf(User Manager for Domains) and bf(Server Manager for Domains);
-managing a remote registry in the same way as the Windows NT programs
-bf(REGEDT32.EXE) and bf(REGEDIT.EXE); viewing a remote event log (same
-as bf(EVENTVWR.EXE)).
-
 dit(url(bf(testparm))(testparm.1.html)) nl() nl() The url(bf(testparm
 (1)))(testparm.1.html) utility allows you to test your url(bf(smb.conf
 (5)))(smb.conf.5.html) configuration file.
diff --git a/docs/yodldocs/smb.conf.5.yo b/docs/yodldocs/smb.conf.5.yo
index 05352bb883..abb26f5ec1 100644
--- a/docs/yodldocs/smb.conf.5.yo
+++ b/docs/yodldocs/smb.conf.5.yo
@@ -478,6 +478,10 @@ parameter for details.  Note that some are synonyms.
 
 startit()
 
+it() link(bf(add user script))(adduserscript)
+
+it() link(bf(allow trusted domains))(allowtrusteddomains)
+
 it() link(bf(announce as))(announceas)
 
 it() link(bf(announce version))(announceversion)
@@ -500,14 +504,22 @@ it() link(bf(config file))(configfile)
 
 it() link(bf(deadtime))(deadtime)
 
+it() link(bf(debug hires timestamp))(debughirestimestamp)
+
+it() link(bf(debug pid))(debugpid)
+
 it() link(bf(debug timestamp))(debugtimestamp)
 
+it() link(bf(debug uid))(debuguid)
+
 it() link(bf(debuglevel))(debuglevel)
 
 it() link(bf(default))(default)
 
 it() link(bf(default service))(defaultservice)
 
+it() link(bf(delete user script))(deleteuserscript)
+
 it() link(bf(dfree command))(dfreecommand)
 
 it() link(bf(dns proxy))(dnsproxy)
@@ -518,8 +530,6 @@ it() link(bf(domain admin users))(domainadminusers)
 
 it() link(bf(domain controller))(domaincontroller)
 
-it() link(bf(domain group map))(domaingroupmap)
-
 it() link(bf(domain groups))(domaingroups)
 
 it() link(bf(domain guest group))(domainguestgroup)
@@ -530,8 +540,6 @@ it() link(bf(domain logons))(domainlogons)
 
 it() link(bf(domain master))(domainmaster)
 
-it() link(bf(domain user map))(domainusermap)
-
 it() link(bf(encrypt passwords))(encryptpasswords)
 
 it() link(bf(getwd cache))(getwdcache)
@@ -546,12 +554,14 @@ it() link(bf(keepalive))(keepalive)
 
 it() link(bf(kernel oplocks))(kerneloplocks)
 
-it() link(bf(ldap bind as))(ldapbindas)
-
-it() link(bf(ldap passwd file))(ldappasswdfile)
+it() link(bf(ldap filter))(ldapfilter)
 
 it() link(bf(ldap port))(ldapport)
 
+it() link(bf(ldap root))(ldaproot)
+
+it() link(bf(ldap root passwd))(ldaprootpasswd)
+
 it() link(bf(ldap server))(ldapserver)
 
 it() link(bf(ldap suffix))(ldapsuffix)
@@ -562,8 +572,6 @@ it() link(bf(lm interval))(lminterval)
 
 it() link(bf(load printers))(loadprinters)
 
-it() link(bf(local group map))(localgroupmap)
-
 it() link(bf(local master))(localmaster)
 
 it() link(bf(lock dir))(lockdir)
@@ -588,6 +596,8 @@ it() link(bf(machine password timeout))(machinepasswordtimeout)
 
 it() link(bf(mangled stack))(mangledstack)
 
+it() link(bf(map to guest))(maptoguest)
+
 it() link(bf(max disk size))(maxdisksize)
 
 it() link(bf(max log size))(maxlogsize)
@@ -606,6 +616,8 @@ it() link(bf(max xmit))(maxxmit)
 
 it() link(bf(message command))(messagecommand)
 
+it() link(bf(min passwd length))(minpasswdlength)
+
 it() link(bf(min wins ttl))(minwinsttl)
 
 it() link(bf(name resolve order))(nameresolveorder)
@@ -616,6 +628,8 @@ it() link(bf(netbios name))(netbiosname)
 
 it() link(bf(nis homedir))(nishomedir)
 
+it() link(bf(nt acl support))(ntaclsupport)
+
 it() link(bf(nt pipe support))(ntpipesupport)
 
 it() link(bf(nt smb support))(ntsmbsupport)
@@ -624,6 +638,8 @@ it() link(bf(null passwords))(nullpasswords)
 
 it() link(bf(ole locking compatibility))(olelockingcompatibility)
 
+it() link(bf(oplock break wait time))(oplockbreakwaittime)
+
 it() link(bf(os level))(oslevel)
 
 it() link(bf(packet size))(packetsize)
@@ -666,6 +682,8 @@ it() link(bf(remote announce))(remoteannounce)
 
 it() link(bf(remote browse sync))(remotebrowsesync)
 
+it() link(bf(restrict anonymous))(restrictanonymous)
+
 it() link(bf(root))(root)
 
 it() link(bf(root dir))(rootdir)
@@ -748,6 +766,8 @@ it() link(bf(wins proxy))(winsproxy)
 
 it() link(bf(wins server))(winsserver)
 
+it() link(bf(wins hook))(winshook)
+
 it() link(bf(wins support))(winssupport)
 
 it() link(bf(workgroup))(workgroup)
@@ -804,6 +824,8 @@ it() link(bf(directory mask))(directorymask)
 
 it() link(bf(directory mode))(directorymode)
 
+it() link(bf(directory security mask))(directorysecuritymask)
+
 it() link(bf(dont descend))(dontdescend)
 
 it() link(bf(dos filetime resolution))(dosfiletimeresolution)
@@ -822,8 +844,12 @@ it() link(bf(force create mode))(forcecreatemode)
 
 it() link(bf(force directory mode))(forcedirectorymode)
 
+it() link(bf(force directory security mode))(forcedirectorysecuritymode)
+
 it() link(bf(force group))(forcegroup)
 
+it() link(bf(force security mode))(forcesecuritymode)
+
 it() link(bf(force user))(forceuser)
 
 it() link(bf(fstype))(fstype)
@@ -848,6 +874,8 @@ it() link(bf(include))(include)
 
 it() link(bf(invalid users))(invalidusers)
 
+it() link(bf(level2 oplocks))(level2oplocks)
+
 it() link(bf(locking))(locking)
 
 it() link(bf(lppause command))(lppausecommand)
@@ -864,6 +892,8 @@ it() link(bf(magic script))(magicscript)
 
 it() link(bf(mangle case))(manglecase)
 
+it() link(bf(mangle locks))(manglelocks)
+
 it() link(bf(mangled map))(mangledmap)
 
 it() link(bf(mangled names))(manglednames)
@@ -876,8 +906,6 @@ it() link(bf(map hidden))(maphidden)
 
 it() link(bf(map system))(mapsystem)
 
-it() link(bf(map to guest))(maptoguest)
-
 it() link(bf(max connections))(maxconnections)
 
 it() link(bf(min print space))(minprintspace)
@@ -888,6 +916,8 @@ it() link(bf(only user))(onlyuser)
 
 it() link(bf(oplocks))(oplocks)
 
+it() link(bf(oplock contention limit))(oplockcontentionlimit)
+
 it() link(bf(path))(path)
 
 it() link(bf(postexec))(postexec)
@@ -896,6 +926,8 @@ it() link(bf(postscript))(postscript)
 
 it() link(bf(preexec))(preexec)
 
+it() link(bf(preexec close))(preexecclose)
+
 it() link(bf(preserve case))(preservecase)
 
 it() link(bf(print command))(printcommand)
@@ -930,6 +962,10 @@ it() link(bf(root postexec))(rootpostexec)
 
 it() link(bf(root preexec))(rootpreexec)
 
+it() link(bf(security mask))(securitymask)
+
+it() link(bf(root preexec close))(rootpreexecclose)
+
 it() link(bf(set directory))(setdirectory)
 
 it() link(bf(share modes))(sharemodes)
@@ -975,6 +1011,55 @@ manpagesection(EXPLANATION OF EACH PARAMETER)
 
 startdit()
 
+label(adduserscript)
+dit(bf(add user script (G)))
+
+This is the full pathname to a script that will be run em(AS ROOT) by
+url(bf(smbd (8)))(smbd.8.html) under special circumstances decribed
+below.
+
+Normally, a Samba server requires that UNIX users are created for all
+users accessing files on this server. For sites that use Windows NT
+account databases as their primary user database creating these users
+and keeping the user list in sync with the Windows NT PDC is an
+onerous task. This option allows url(bf(smbd))(smbd.8.html) to create
+the required UNIX users em(ON DEMAND) when a user accesses the Samba
+server.
+
+In order to use this option, url(bf(smbd))(smbd.8.html) must be set to
+link(bf(security=server))(securityequalserver) or
+link(bf(security=domain))(securityequaldomain) and bf("add user script")
+must be set to a full pathname for a script that will create a UNIX user
+given one argument of bf(%u), which expands into the UNIX user name to
+create.
+
+When the Windows user attempts to access the Samba server, at
+em("login")(session setup in the SMB protocol) time,
+url(bf(smbd))(smbd.8.html) contacts the link(bf(password
+server))(passwordserver) and attempts to authenticate the given user
+with the given password. If the authentication succeeds then
+url(bf(smbd))(smbd.8.html) attempts to find a UNIX user in the UNIX
+password database to map the Windows user into. If this lookup fails,
+and bf("add user script") is set then url(bf(smbd))(smbd.8.html) will
+call the specified script em(AS ROOT), expanding any bf(%u) argument
+to be the user name to create.
+
+If this script successfully creates the user then
+url(bf(smbd))(smbd.8.html) will continue on as though the UNIX user
+already existed. In this way, UNIX users are dynamically created to
+match existing Windows NT accounts.
+
+See also link(bf(security=server))(securityequalserver),
+link(bf(security=domain))(securityequaldomain), link(bf(password
+server))(passwordserver), link(bf(delete user
+script))(deleteuserscript).
+
+  bf(Default:)
+tt(	add user script = <empty string>)
+
+  bf(Example:)
+tt(	add user script = /usr/local/samba/bin/add_user %u)
+
 label(adminusers)
 dit(bf(admin users (S)))
 
@@ -995,63 +1080,30 @@ tt(	admin users = jason)
 label(allow hosts)
 dit(bf(allow hosts (S)))
 
-A synonym for this parameter is link(bf('hosts allow'))(hostsallow)
+Synonym for link(bf(hosts allow))(hostsallow).
 
-This parameter is a comma, space, or tab delimited set of hosts which
-are permitted to access a service.
+label(allowtrusteddomains)
+dit(bf(allow trusted domains (G)))
 
-If specified in the link(bf([global]))(global) section then it will
-apply to all services, regardless of whether the individual service
-has a different setting.
+This option only takes effect when the link(bf(security))(security)
+option is set to bf(server) or bf(domain).  If it is set to no,
+then attempts to connect to a resource from a domain or workgroup other than
+the one which smbd is running in will fail, even if that domain
+is trusted by the remote server doing the authentication.
 
-You can specify the hosts by name or IP number. For example, you could
-restrict access to only the hosts on a Class C subnet with something
-like tt("allow hosts = 150.203.5."). The full syntax of the list is
-described in the man page bf(hosts_access (5)). Note that this man
-page may not be present on your system, so a brief description will
-be given here also.
-
-em(NOTE:) IF you wish to allow the url(bf(smbpasswd
-(8)))(smbpasswd.html.8) program to be run by local users to change
-their Samba passwords using the local url(bf(smbd (8)))(smbd.8.html)
-daemon, then you em(MUST) ensure that the localhost is listed in your
-bf(allow hosts) list, as url(bf(smbpasswd (8)))(smbpasswd.html.8) runs
-in client-server mode and is seen by the local
-url(bf(smbd))(smbd.8.html) process as just another client.
-
-You can also specify hosts by network/netmask pairs and by netgroup
-names if your system supports netgroups. The em(EXCEPT) keyword can also
-be used to limit a wildcard list. The following examples may provide
-some help:
-
-bf(Example 1): allow localhost and all IPs in 150.203.*.* except one
-
-tt(	hosts allow = localhost, 150.203. EXCEPT 150.203.6.66)
-
-bf(Example 2): allow localhost and hosts that match the given network/netmask
-
-tt(	hosts allow = localhost, 150.203.15.0/255.255.255.0)
-
-bf(Example 3): allow a localhost plus a couple of hosts
-
-tt(	hosts allow = localhost, lapland, arvidsjaur)
-
-bf(Example 4): allow only hosts in NIS netgroup "foonet" or localhost, but 
-deny access from one particular host
-
-tt( 	hosts allow = @foonet, localhost)
-tt( 	hosts deny = pirate)
-
-Note that access still requires suitable user-level passwords.
-
-See url(bf(testparm (1)))(testparm.1.html) for a way of testing your
-host access to see if it does what you expect.
+This is useful if you only want your Samba server to serve resources
+to users in the domain it is a member of. As an example, suppose that there are
+two domains DOMA and DOMB.  DOMB is trusted by DOMA, which contains
+the Samba server.  Under normal circumstances, a user with an account
+in DOMB can then access the resources of a UNIX account with the same
+account name on the Samba server even if they do not have an account
+in DOMA.  This can make implementing a security boundary difficult.
 
   bf(Default:)
-tt(	none (i.e., all hosts permitted access))
+tt(     allow trusted domains = Yes)
 
   bf(Example:)
-tt(	allow hosts = 150.203.5. localhost myhost.mynet.edu.au)
+tt(     allow trusted domains = No)
 
 label(alternatepermissions)
 dit(bf(alternate permissions (S)))
@@ -1067,14 +1119,15 @@ dit(bf(announce as (G)))
 
 This specifies what type of server url(bf(nmbd))(nmbd.8.html) will
 announce itself as, to a network neighborhood browse list. By default
-this is set to Windows NT. The valid options are : "NT", "Win95" or
-"WfW" meaning Windows NT, Windows 95 and Windows for Workgroups
-respectively. Do not change this parameter unless you have a specific
-need to stop Samba appearing as an NT server as this may prevent Samba
-servers from participating as browser servers correctly.
+this is set to Windows NT. The valid options are : "NT", which is a
+synonym for "NT Server", "NT Server", "NT Workstation", "Win95" or
+"WfW" meaning Windows NT Server, Windows NT Workstation, Windows 95
+and Windows for Workgroups respectively. Do not change this parameter
+unless you have a specific need to stop Samba appearing as an NT server
+as this may prevent Samba servers from participating as browser servers correctly.
 
   bf(Default:)
-tt(	announce as = NT)
+tt(	announce as = NT Server)
 
   bf(Example)
 tt(	announce as = Win95)
@@ -1158,11 +1211,16 @@ should not use this parameter for machines that are serving PPP or
 other intermittent or non-broadcast network interfaces as it will not
 cope with non-permanent interfaces.
 
-In addition, to change a users SMB password, the
-url(bf(smbpasswd))(smbpasswd.8.html) by default connects to the
-em("localhost" - 127.0.0.1) address as an SMB client to issue the
-password change request. If bf("bind interfaces only") is set then
-unless the network address em(127.0.0.1) is added to the
+If bf("bind interfaces only") is set then unless the network address
+em(127.0.0.1) is added to the link(bf('interfaces'))(interfaces) parameter
+list url(bf(smbpasswd))(smbpasswd.8.html) and
+url(bf(swat))(swat.8.html) may not work as expected due to the
+reasons covered below.
+
+To change a users SMB password, the url(bf(smbpasswd))(smbpasswd.8.html)
+by default connects to the em("localhost" - 127.0.0.1) address as an SMB
+client to issue the password change request. If bf("bind interfaces only")
+is set then unless the network address em(127.0.0.1) is added to the
 link(bf('interfaces'))(interfaces) parameter list then
 url(bf(smbpasswd))(smbpasswd.8.html) will fail to connect in it's
 default mode. url(bf(smbpasswd))(smbpasswd.8.html) can be forced to
@@ -1171,6 +1229,14 @@ url(bf("-r remote machine"))(smbpasswd.8.html#minusr) parameter, with
 bf("remote machine") set to the IP name of the primary interface
 of the local host.
 
+The url(bf(swat))(swat.8.html) status page tries to connect with
+url(bf(smbd))(smbd.8.html) and url(bf(nmbd))(nmbd.8.html) at the address 
+em(127.0.0.1) to determine if they are running.  Not adding em(127.0.0.1)  will cause
+url(bf(smbd))(smbd.8.html) and url(bf(nmbd))(nmbd.8.html) to always show
+"not running" even if they really are.  This can prevent
+url(bf(swat))(swat.8.html) from starting/stopping/restarting
+url(bf(smbd))(smbd.8.html) and url(bf(nmbd))(nmbd.8.html).
+
   bf(Default:)
 tt(	bind interfaces only = False)
 
@@ -1282,7 +1348,13 @@ correctly.
 
 it() bf(ISO8859-5) Russian Cyrillic UNIX character set. The parameter
 link(bf(client code page))(clientcodepage) em(MUST) be set to code
-page 866 if the bf(character set) parameter is set to ISO8859-2
+page 866 if the bf(character set) parameter is set to ISO8859-5
+in order for the conversion to the UNIX character set to be done
+correctly. 
+
+it() bf(ISO8859-7) Greek UNIX character set. The parameter
+link(bf(client code page))(clientcodepage) em(MUST) be set to code
+page 737 if the bf(character set) parameter is set to ISO8859-7
 in order for the conversion to the UNIX character set to be done
 correctly. 
 
@@ -1529,6 +1601,22 @@ tt(	deadtime = 0)
   bf(Example:)
 tt(	deadtime = 15)
 
+label(debughirestimestamp)
+dit(bf(debug hires timestamp (G)))
+
+Sometimes the timestamps in the log messages are needed with a
+resolution of higher that seconds, this boolean parameter adds
+microsecond resolution to the timestamp message header when turned on.
+
+Note that the parameter link(bf(debug timestamp))(debugtimestamp)
+must be on for this to have an effect.
+
+  bf(Default:)
+tt( debug hires timestamp = No)
+
+  bf(Example:)
+tt( debug hires timestamp = Yes)
+
 label(debugtimestamp)
 dit(bf(debug timestamp (G)))
 
@@ -1543,6 +1631,39 @@ tt(	debug timestamp = Yes)
   bf(Example:)
 tt(	debug timestamp = No)
 
+label(debugpid)
+dit(bf(debug pid (G)))
+
+When using only one log file for more then one forked smbd-process
+there may be hard to follow which process outputs which message.
+This boolean parameter is adds the process-id to the timestamp message
+headers in the logfile when turned on.
+
+Note that the parameter link(bf(debug timestamp))(debugtimestamp)
+must be on for this to have an effect.
+
+  bf(Default:)
+tt(	debug pid = No)
+
+  bf(Example:)
+tt(	debug pid = Yes)
+
+label(debuguid)
+dit(bf(debug uid (G)))
+
+Samba is sometimes run as root and sometime run as the connected
+user, this boolean parameter inserts the current euid, egid, uid
+and gid to the timestamp message headers in the log file if turned on.
+
+Note that the parameter link(bf(debug timestamp))(debugtimestamp)
+must be on for this to have an effect.
+
+  bf(Default:)
+tt(	debug uid = No)
+
+  bf(Example:)
+tt(	debug uid = Yes)
+
 label(debuglevel)
 dit(bf(debug level (G)))
 
@@ -1567,7 +1688,7 @@ dit(bf(default case (S)))
 See the section on link(bf("NAME MANGLING"))(NAMEMANGLING). Also note
 the link(bf("short preserve case"))(shortpreservecase) parameter.
 
-label(default service)
+label(defaultservice)
 dit(bf(default service (G)))
 
 This parameter specifies the name of a service which will be connected
@@ -1599,6 +1720,60 @@ verb(
 		path = /%S
 )
 
+label(deleteuserscript)
+dit(bf(delete user script (G)))
+
+This is the full pathname to a script that will be run em(AS ROOT) by
+url(bf(smbd (8)))(smbd.8.html) under special circumstances decribed
+below.
+
+Normally, a Samba server requires that UNIX users are created for all
+users accessing files on this server. For sites that use Windows NT
+account databases as their primary user database creating these users
+and keeping the user list in sync with the Windows NT PDC is an
+onerous task. This option allows url(bf(smbd))(smbd.8.html) to delete
+the required UNIX users em(ON DEMAND) when a user accesses the Samba
+server and the Windows NT user no longer exists.
+
+In order to use this option, url(bf(smbd))(smbd.8.html) must be set to
+link(bf(security=domain))(securityequaldomain) and bf("delete user
+script") must be set to a full pathname for a script that will delete
+a UNIX user given one argument of bf(%u), which expands into the UNIX
+user name to delete. em(NOTE) that this is different to the
+link(bf(add user script))(adduserscript) which will work with the
+link(bf(security=server))(securityequalserver) option as well as
+link(bf(security=domain))(securityequaldomain). The reason for this
+is only when Samba is a domain member does it get the information
+on an attempted user logon that a user no longer exists. In the
+link(bf(security=server))(securityequalserver) mode a missing user
+is treated the same as an invalid password logon attempt. Deleting
+the user in this circumstance would not be a good idea.
+
+When the Windows user attempts to access the Samba server, at
+em("login")(session setup in the SMB protocol) time,
+url(bf(smbd))(smbd.8.html) contacts the link(bf(password
+server))(passwordserver) and attempts to authenticate the given user
+with the given password. If the authentication fails with the specific
+Domain error code meaning that the user no longer exists then
+url(bf(smbd))(smbd.8.html) attempts to find a UNIX user in the UNIX
+password database that matches the Windows user account. If this lookup succeeds,
+and bf("delete user script") is set then url(bf(smbd))(smbd.8.html) will
+call the specified script em(AS ROOT), expanding any bf(%u) argument
+to be the user name to delete.
+
+This script should delete the given UNIX username. In this way, UNIX
+users are dynamically deleted to match existing Windows NT accounts.
+
+See also link(bf(security=domain))(securityequaldomain),
+link(bf(password server))(passwordserver), link(bf(add user
+script))(adduserscript).
+
+  bf(Default:)
+tt(	delete user script = <empty string>)
+
+  bf(Example:)
+tt(	delete user script = /usr/local/samba/bin/del_user %u)
+
 label(deletereadonly)
 dit(bf(delete readonly (S)))
 
@@ -1646,16 +1821,7 @@ tt(	delete veto files = True)
 label(denyhosts)
 dit(bf(deny hosts (S)))
 
-The opposite of link(bf('allow hosts'))(allowhosts) - hosts listed
-here are em(NOT) permitted access to services unless the specific
-services have their own lists to override this one. Where the lists
-conflict, the link(bf('allow'))(allowhosts) list takes precedence.
-
-  bf(Default:)
-tt(	none (i.e., no hosts specifically excluded))
-
-  bf(Example:)
-tt(	deny hosts = 150.203.4. badhost.mynet.edu.au)
+Synonym for link(bf(hosts deny))(hostsdeny).
 
 label(dfreecommand)
 dit(bf(dfree command (G)))
@@ -1737,7 +1903,8 @@ See the link(bf("force directory mode"))(forcedirectorymode) parameter
 to cause particular mode bits to always be set on created directories.
 
 See also the link(bf("create mode"))(createmode) parameter for masking
-mode bits on created files.
+mode bits on created files, and the link(bf("directory security mask"))(directorysecuritymask)
+parameter.
 
   bf(Default:)
 tt(	directory mask = 0755)
@@ -1750,6 +1917,39 @@ dit(bf(directory mode (S)))
 
 Synonym for link(bf(directory mask))(directorymask).
 
+label(directorysecuritymask)
+dit(bf(directory security mask (S)))
+
+This parameter controls what UNIX permission bits can be modified
+when a Windows NT client is manipulating the UNIX permission on a
+directory using the native NT security dialog box.
+
+This parameter is applied as a mask (AND'ed with) to the changed
+permission bits, thus preventing any bits not in this mask from
+being modified. Essentially, zero bits in this mask may be treated
+as a set of bits the user is not allowed to change.
+
+If not set explicitly this parameter is set to the same value as the
+link(bf(directory mask))(directorymask) parameter. To allow a user to
+modify all the user/group/world permissions on a directory, set this
+parameter to 0777.
+
+em(Note) that users who can access the Samba server through other
+means can easily bypass this restriction, so it is primarily
+useful for standalone "appliance" systems.  Administrators of
+most normal systems will probably want to set it to 0777.
+
+See also the link(bf(force directory security
+mode))(forcedirectorysecuritymode), link(bf(security
+mask))(securitymask), link(bf(force security mode))(forcesecuritymode)
+parameters.
+
+  bf(Default:)
+tt(	directory security mask = <same as directory mask>)
+
+  bf(Example:)
+tt(	directory security mask = 0777)
+
 label(dnsproxy)
 dit(bf(dns proxy (G)))
 
@@ -1775,7 +1975,7 @@ label(domainadmingroup)
 bf(domain admin group (G))
 
 This is an bf(EXPERIMENTAL) parameter that is part of the unfinished
-Samba NT Domain Controller Code.  It has been removed as of November 98.
+Samba NT Domain Controller Code. It may be removed in a later release.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list bf(Samba-ntdom) available by sending email to
@@ -1785,7 +1985,7 @@ label(domainadminusers)
 dit(bf(domain admin users (G)))
 
 This is an bf(EXPERIMENTAL) parameter that is part of the unfinished
-Samba NT Domain Controller Code. It has been removed as of November 98.
+Samba NT Domain Controller Code. It may be removed in a later release.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list bf(Samba-ntdom) available by sending email to
@@ -1798,93 +1998,11 @@ This is a bf(DEPRECATED) parameter. It is currently not used within
 the Samba source and should be removed from all current smb.conf
 files. It is left behind for compatibility reasons.
 
-label(domaingroupmap)
-dit(bf(domain group map (G)))
-
-This option allows you to specify a file containing unique mappings
-of individual NT Domain Group names (in any domain) to UNIX group
-names.  This allows NT domain groups to be presented correctly to
-NT users, despite the lack of native support for the NT Security model
-(based on VAX/VMS) in UNIX.  The reader is advised to become familiar
-with the NT Domain system and its administration.
-
-This option is used in conjunction with link(bf('local group map'))(localgroupmap)
-and link(bf('domain user map'))(domainusermap).  The use of these three
-options is trivial and often unnecessary in the case where Samba is
-not expected to interact with any other SAM databases (whether local
-workstations or Domain Controllers).
-
-
-The map file is parsed line by line.  If any line begins with a tt('#')
-or a tt(';') then it is ignored.  Each line should contain a single UNIX
-group name on the left then a single NT Domain Group name on the right,
-separated by a tabstop or tt('=').  If either name contains spaces then
-it should be enclosed in quotes.
-The line can be either of the form:
-
-tt(  UNIXgroupname	\\DOMAIN_NAME\\DomainGroupName )
-
-or:
-
-tt(  UNIXgroupname	DomainGroupName )
-
-In the case where Samba is either an bf(EXPERIMENTAL) Domain Controller
-or it is a member of a domain using link(bf("security = domain"))(security),
-the latter format can be used: the default Domain name is the Samba Server's
-Domain name, specified by link(bf("workgroup = MYGROUP"))(workgroup).
-
-Any UNIX groups that are em(NOT) specified in this map file are assumed to
-be either Local or Domain Groups, depending on the role of the Samba Server.
-
-In the case when Samba is an bf(EXPERIMENTAL) Domain Controller, Samba
-will present em(ALL) such unspecified UNIX groups as its own NT Domain
-Groups, with the same name.
-
-In the case where Samba is member of a domain using
-link(bf("security = domain"))(security), Samba will check the UNIX name with
-its Domain Controller (see link(bf("password server"))(passwordserver))
-as if it was an NT Domain Group.  If the Domain Controller says that it is not,
-such unspecified (unmapped) UNIX groups which also are not NT Domain
-Groups are treated as Local Groups in the Samba Server's local SAM database.
-NT Administrators will recognise these as Workstation Local Groups,
-which are managed by running bf(USRMGR.EXE) and selecting a remote
-Domain named "\\WORKSTATION_NAME", or by running bf(MUSRMGR.EXE) on
-a local Workstation.
-
-This may sound complicated, but it means that a Samba Server as
-either a member of a domain or as an bf(EXPERIMENTAL) Domain Controller
-will act like an NT Workstation (with a local SAM database) or an NT PDC
-(with a Domain SAM database) respectively, without the need for any of
-the map files at all.  If you bf(want) to get fancy, however, you can.
-
-Note that adding an entry to map an arbitrary NT group in an arbitrary
-Domain to an arbitrary UNIX group em(REQUIRES) the following:
-
-startit()
-
-it() that the UNIX group exists on the UNIX server.
-
-it() that the NT Domain Group exists in the specified NT Domain
-
-it() that the UNIX Server knows about the specified Domain; 
-
-it() that all the UNIX users (who are expecting to access the Samba
-Server as the correct NT user and with the correct NT group permissions)
-in the UNIX group be mapped to the correct NT Domain users in the specified
-NT Domain using link(bf('domain user map'))(domainusermap).
-
-endit()
-
-Failure to meet any of these requirements may result in either (or
-both) errors reported in the log files or (and) incorrect or missing
-access rights granted to users.
-
-
 label(domaingroups)
 dit(bf(domain groups (G)))
 
 This is an bf(EXPERIMENTAL) parameter that is part of the unfinished
-Samba NT Domain Controller Code. It has been removed as of November 98.
+Samba NT Domain Controller Code. It may be removed in a later release.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list bf(Samba-ntdom) available by sending email to
@@ -1894,7 +2012,7 @@ label(domainguestgroup)
 dit(bf(domain guest group (G)))
 
 This is an bf(EXPERIMENTAL) parameter that is part of the unfinished
-Samba NT Domain Controller Code. It has been removed as of November 98.
+Samba NT Domain Controller Code. It may be removed in a later release.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list bf(Samba-ntdom) available by sending email to
@@ -1904,7 +2022,7 @@ label(domainguestusers)
 dit(bf(domain guest users (G)))
 
 This is an bf(EXPERIMENTAL) parameter that is part of the unfinished
-Samba NT Domain Controller Code. It has been removed as of November 98.
+Samba NT Domain Controller Code. It may be removed in a later release.
 To work with the latest code builds that may have more support for
 Samba NT Domain Controller functionality please subscribe to the
 mailing list bf(Samba-ntdom) available by sending email to
@@ -1952,99 +2070,9 @@ special name for a link(bf(workgroup))(workgroup) before a Windows NT
 PDC is able to do so then cross subnet browsing will behave strangely
 and may fail.
 
-By default ("auto") Samba will attempt to become the domain master
-browser only if it is the Primary Domain Controller.
-
   bf(Default:)
-tt(	domain master = auto)
-
-  bf(Example:)
 tt(	domain master = no)
 
-
-label(domainusermap)
-dit(bf(domain user map (G)))
-
-This option allows you to specify a file containing unique mappings
-of individual NT Domain User names (in any domain) to UNIX user
-names.  This allows NT domain users to be presented correctly to
-NT systems, despite the lack of native support for the NT Security model
-(based on VAX/VMS) in UNIX.  The reader is advised to become familiar
-with the NT Domain system and its administration.
-
-This option is used in conjunction with link(bf('local group map'))(localgroupmap)
-and link(bf('domain group map'))(domaingroupmap).  The use of these three
-options is trivial and often unnecessary in the case where Samba is
-not expected to interact with any other SAM databases (whether local
-workstations or Domain Controllers).
-
-This option, which provides (and maintains) a one-to-one link between
-UNIX and NT users, is em(DIFFERENT) from link(bf('username map'))
-(usernamemap), which does em(NOT) maintain a distinction between the
-name(s) it can map to and the name it maps.
-
-
-The map file is parsed line by line.  If any line begins with a tt('#')
-or a tt(';') then the line is ignored.  Each line should contain a single UNIX
-user name on the left then a single NT Domain User name on the right,
-separated by a tabstop or tt('=').  If either name contains spaces then
-it should be enclosed in quotes.
-The line can be either of the form:
-
-tt(  UNIXusername	\\DOMAIN_NAME\\DomainUserName )
-
-or:
-
-tt(  UNIXusername	DomainUserName )
-
-In the case where Samba is either an bf(EXPERIMENTAL) Domain Controller
-or it is a member of a domain using link(bf("security = domain"))(security),
-the latter format can be used: the default Domain name is the Samba Server's
-Domain name, specified by link(bf("workgroup = MYGROUP"))(workgroup).
-
-Any UNIX users that are em(NOT) specified in this map file are assumed
-to be either Domain or Workstation Users, depending on the role of the
-Samba Server.
-
-In the case when Samba is an bf(EXPERIMENTAL) Domain Controller, Samba
-will present em(ALL) such unspecified UNIX users as its own NT Domain
-Users, with the same name.
-
-In the case where Samba is a member of a domain using
-link(bf("security = domain"))(security), Samba will check the UNIX name with
-its Domain Controller (see link(bf("password server"))(passwordserver))
-as if it was an NT Domain User.  If the Domain Controller says that it is not,
-such unspecified (unmapped) UNIX users which also are not NT Domain
-Users are treated as Local Users in the Samba Server's local SAM database.
-NT Administrators will recognise these as Workstation Users,
-which are managed by running bf(USRMGR.EXE) and selecting a remote
-Domain named "\\WORKSTATION_NAME", or by running bf(MUSRMGR.EXE) on
-a local Workstation.
-
-This may sound complicated, but it means that a Samba Server as
-either a member of a domain or as an bf(EXPERIMENTAL) Domain Controller
-will act like an NT Workstation (with a local SAM database) or an NT PDC
-(with a Domain SAM database) respectively, without the need for any of
-the map files at all.  If you bf(want) to get fancy, however, you can.
-
-Note that adding an entry to map an arbitrary NT User in an arbitrary
-Domain to an arbitrary UNIX user em(REQUIRES) the following:
-
-startit()
-
-it() that the UNIX user exists on the UNIX server.
-
-it() that the NT Domain User exists in the specified NT Domain.
-
-it() that the UNIX Server knows about the specified Domain.
-
-endit()
-
-Failure to meet any of these requirements may result in either (or
-both) errors reported in the log files or (and) incorrect or missing
-access rights granted to users.
-
-
 label(dont descend)
 dit(bf(dont descend (S)))
 
@@ -2209,14 +2237,15 @@ label(forcecreatemode)
 dit(bf(force create mode (S)))
 
 This parameter specifies a set of UNIX mode bit permissions that will
-em(*always*) be set on a file created by Samba. This is done by
-bitwise 'OR'ing these bits onto the mode bits of a file that is being
-created. The default for this parameter is (in octal) 000. The modes
-in this parameter are bitwise 'OR'ed onto the file mode after the mask
-set in the link(bf("create mask"))(createmask) parameter is applied.
+em(*always*) be set on a file by Samba. This is done by bitwise
+'OR'ing these bits onto the mode bits of a file that is being created
+or having its permissions changed. The default for this parameter is
+(in octal) 000. The modes in this parameter are bitwise 'OR'ed onto
+the file mode after the mask set in the link(bf("create
+mask"))(createmask) parameter is applied.
 
 See also the parameter link(bf("create mask"))(createmask) for details
-on masking mode bits on created files.
+on masking mode bits on files.
 
   bf(Default:)
 tt(	force create mode = 000)
@@ -2252,6 +2281,39 @@ would force all created directories to have read and execute
 permissions set for 'group' and 'other' as well as the
 read/write/execute bits set for the 'user'.
 
+label(forcedirectorysecuritymode)
+dit(bf(force directory security mode (S)))
+
+This parameter controls what UNIX permission bits can be modified when
+a Windows NT client is manipulating the UNIX permission on a directory
+using the native NT security dialog box.
+
+This parameter is applied as a mask (OR'ed with) to the changed
+permission bits, thus forcing any bits in this mask that the user may
+have modified to be on. Essentially, one bits in this mask may be
+treated as a set of bits that, when modifying security on a directory,
+the user has always set to be 'on'.
+
+If not set explicitly this parameter is set to the same value as the
+link(bf(force directory mode))(forcedirectorymode) parameter. To allow
+a user to modify all the user/group/world permissions on a directory,
+with restrictions set this parameter to 000.
+
+em(Note) that users who can access the Samba server through other
+means can easily bypass this restriction, so it is primarily
+useful for standalone "appliance" systems.  Administrators of
+most normal systems will probably want to set it to 0000.
+
+See also the link(bf(directory security mask))(directorysecuritymask),
+link(bf(security mask))(securitymask), link(bf(force security
+mode))(forcesecuritymode) parameters.
+
+  bf(Default:)
+tt(	force directory security mode = <same as force directory mode>)
+
+  bf(Example:)
+tt(	force directory security mode = 0)
+
 label(forcegroup)
 dit(bf(force group (S)))
 
@@ -2263,12 +2325,64 @@ permissions for this group to the files and directories within this
 service the Samba administrator can restrict or allow sharing of these
 files.
 
+In Samba 2.0.5 and above this parameter has extended functionality in the following
+way. If the group name listed here has a '+' character prepended to it
+then the current user accessing the share only has the primary group 
+default assigned to this group if they are already assigned as a member
+of that group. This allows an administrator to decide that only users
+who are already in a particular group will create files with group 
+ownership set to that group. This gives a finer granularity of ownership
+assignment. For example, the setting tt(force group = +sys) means
+that only users who are already in group sys will have their default
+primary group assigned to sys when accessing this Samba share. All
+other users will retain their ordinary primary group.
+
+If the link(bf("force user"))(forceuser) parameter is also set the
+group specified in bf(force group) will override the primary group
+set in link(bf("force user"))(forceuser).
+
+See also link(bf("force user"))(forceuser)
+
   bf(Default:)
 tt(	no forced group)
 
   bf(Example:)
 tt(	force group = agroup)
 
+label(forcesecuritymode)
+dit(bf(force security mode (S)))
+
+This parameter controls what UNIX permission bits can be modified when
+a Windows NT client is manipulating the UNIX permission on a file
+using the native NT security dialog box.
+
+This parameter is applied as a mask (OR'ed with) to the changed
+permission bits, thus forcing any bits in this mask that the user may
+have modified to be on. Essentially, one bits in this mask may be
+treated as a set of bits that, when modifying security on a file, the
+user has always set to be 'on'.
+
+If not set explicitly this parameter is set to the same value as the
+link(bf(force create mode))(forcecreatemode) parameter. To allow
+a user to modify all the user/group/world permissions on a file,
+with no restrictions set this parameter to 000.
+
+em(Note) that users who can access the Samba server through other
+means can easily bypass this restriction, so it is primarily
+useful for standalone "appliance" systems.  Administrators of
+most normal systems will probably want to set it to 0000.
+
+See also the link(bf(force directory security
+mode))(forcedirectorysecuritymode), link(bf(directory security
+mask))(directorysecuritymask), link(bf(security mask))(securitymask)
+parameters.
+
+  bf(Default:)
+tt(	force security mode = <same as force create mode>)
+
+  bf(Example:)
+tt(	force security mode = 0)
+
 label(forceuser)
 dit(bf(force user (S)))
 
@@ -2284,6 +2398,13 @@ tt("forced user"), no matter what username the client connected as.
 
 This can be very useful.
 
+In Samba 2.0.5 and above this parameter also causes the primary
+group of the forced user to be used as the primary group for all
+file activity. Prior to 2.0.5 the primary group was left as the
+primary group of the connecting user (this was a bug).
+
+See also link(bf("force group"))(forcegroup)
+
   bf(Default:)
 tt(	no forced user)
 
@@ -2427,7 +2548,7 @@ verb(
 tt(	hide files = /.*/DesktopFolderDB/TrashFor%m/resource.frk/)
 
 The above example is based on files that the Macintosh SMB client
-(DAVE) available from url(bf(Thursby))(www.thursby.com) creates for
+(DAVE) available from url(bf(Thursby))(http://www.thursby.com) creates for
 internal use, and also still hides all files beginning with a dot.
 
 label(homedirmap)
@@ -2460,12 +2581,74 @@ tt(	homedir map = amd.homedir)
 label(hostsallow)
 dit(bf(hosts allow (S)))
 
-Synonym for link(bf(allow hosts))(allowhosts).
+A synonym for this parameter is link(bf('allow hosts'))(allowhosts)
+
+This parameter is a comma, space, or tab delimited set of hosts which
+are permitted to access a service.
+
+If specified in the link(bf([global]))(global) section then it will
+apply to all services, regardless of whether the individual service
+has a different setting.
+
+You can specify the hosts by name or IP number. For example, you could
+restrict access to only the hosts on a Class C subnet with something
+like tt("allow hosts = 150.203.5."). The full syntax of the list is
+described in the man page bf(hosts_access (5)). Note that this man
+page may not be present on your system, so a brief description will
+be given here also.
+
+Note that the localhost address 127.0.0.1 will always be allowed
+access unless specifically denied by a "hosts deny" option.
+
+You can also specify hosts by network/netmask pairs and by netgroup
+names if your system supports netgroups. The em(EXCEPT) keyword can also
+be used to limit a wildcard list. The following examples may provide
+some help:
+
+bf(Example 1): allow all IPs in 150.203.*.* except one
+
+tt(	hosts allow = 150.203. EXCEPT 150.203.6.66)
+
+bf(Example 2): allow hosts that match the given network/netmask
+
+tt(	hosts allow = 150.203.15.0/255.255.255.0)
+
+bf(Example 3): allow a couple of hosts
+
+tt(	hosts allow = lapland, arvidsjaur)
+
+bf(Example 4): allow only hosts in NIS netgroup "foonet", but 
+deny access from one particular host
+
+tt( 	hosts allow = @foonet)
+
+tt( 	hosts deny = pirate)
+
+Note that access still requires suitable user-level passwords.
+
+See url(bf(testparm (1)))(testparm.1.html) for a way of testing your
+host access to see if it does what you expect.
+
+  bf(Default:)
+tt(	none (i.e., all hosts permitted access))
+
+  bf(Example:)
+tt(	allow hosts = 150.203.5. myhost.mynet.edu.au)
+
 
 label(hostsdeny)
 dit(bf(hosts deny (S)))
 
-Synonym for link(bf(denyhosts))(denyhosts).
+The opposite of link(bf('hosts allow'))(hostsallow) - hosts listed
+here are em(NOT) permitted access to services unless the specific
+services have their own lists to override this one. Where the lists
+conflict, the link(bf('allow'))(hostsallow) list takes precedence.
+
+  bf(Default:)
+tt(	none (i.e., no hosts specifically excluded))
+
+  bf(Example:)
+tt(	hosts deny = 150.203.4. badhost.mynet.edu.au)
 
 label(hostsequiv)
 dit(bf(hosts equiv (G)))
@@ -2474,7 +2657,7 @@ If this global parameter is a non-null string, it specifies the name
 of a file to read for the names of hosts and users who will be allowed
 access without specifying a password.
 
-This is not be confused with link(bf(allow hosts))(allowhosts) which
+This is not be confused with link(bf(hosts allow))(hostsallow) which
 is about hosts access to services and is more useful for guest
 services. bf(hosts equiv) may be useful for NT clients which will not
 supply passwords to samba.
@@ -2504,28 +2687,39 @@ link(bf(%P))(percentP) and link(bf(%S))(percentS).
 label(interfaces)
 dit(bf(interfaces (G)))
 
-This option allows you to setup multiple network interfaces, so that
-Samba can properly handle browsing on all interfaces.
-
-The option takes a list of ip/netmask pairs. The netmask may either be
-a bitmask, or a bitlength.
+This option allows you to override the default network interfaces list
+that Samba will use for browsing, name registration and other NBT
+traffic. By default Samba will query the kernel for the list of all
+active interfaces and use any interfaces except 127.0.0.1 that are
+broadcast capable.
 
-For example, the following line:
+The option takes a list of interface strings. Each string can be in
+any of the following forms:
 
-tt(interfaces = 192.168.2.10/24 192.168.3.10/24)
+startit()
+it() a network interface name (such as eth0). This may include
+     shell-like wildcards so eth* will match any interface starting
+     with the substring "eth"
+if() a IP address. In this case the netmask is determined
+     from the list of interfaces obtained from the kernel
+if() a IP/mask pair. 
+if() a broadcast/mask pair. 
+endit()
 
-would configure two network interfaces with IP addresses 192.168.2.10
-and 192.168.3.10. The netmasks of both interfaces would be set to
-255.255.255.0.
+The "mask" parameters can either be a bit length (such as 24 for a C
+class network) or a full netmask in dotted decmal form.
 
-You could produce an equivalent result by using:
+The "IP" parameters above can either be a full dotted decimal IP
+address or a hostname which will be looked up via the OSes normal
+hostname resolution mechanisms.
 
-tt(interfaces = 192.168.2.10/255.255.255.0 192.168.3.10/255.255.255.0)
+For example, the following line:
 
-if you prefer that format.
+tt(interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0)
 
-If this option is not set then Samba will attempt to find a primary
-interface, but won't attempt to configure more than one interface.
+would configure three network interfaces corresponding to the eth0
+device and IP addresses 192.168.2.10 and 192.168.3.10. The netmasks of
+the latter two interfaces would be set to 255.255.255.0.
 
 See also link(bf("bind interfaces only"))(bindinterfacesonly).
 
@@ -2576,10 +2770,10 @@ options"))(socketoptions)). Basically you should only use this option
 if you strike difficulties.
 
   bf(Default:)
-tt(	keep alive = 0)
+tt(	keepalive = 0)
 
   bf(Example:)
-tt(	keep alive = 60)
+tt(	keepalive = 60)
 
 label(kerneloplocks)
 dit(bf(kernel oplocks (G)))
@@ -2598,55 +2792,76 @@ This parameter defaults to em("On") on systems that have the support,
 and em("off") on systems that don't. You should never need to touch
 this parameter.
 
-label(ldapbindas)
-dit(bf(ldap bind as (G)))
+See also the link(bf("oplocks"))(oplocks) and link(bf("level2 oplocks"))(level2oplocks)
+parameters.
+
+label(ldapfilter)
+dit(bf(ldap filter (G)))
 
 This parameter is part of the em(EXPERIMENTAL) Samba support for a
-password database stored on an LDAP server. These options are only
-available if your version of Samba was configured with the bf(--with-ldap)
-option.
+password database stored on an LDAP server back-end. These options
+are only available if your version of Samba was configured with
+the bf(--with-ldap) option.
 
-This parameter specifies the entity to bind to an LDAP directory as.
-Usually it should be safe to use the LDAP root account; for larger
-installations it may be preferable to restrict Samba's access. See also
-link(bf(ldap passwd file))(ldappasswdfile).
+This parameter specifies an LDAP search filter used to search for a
+user name in the LDAP database. It must contain the string
+link(bf(%u))(percentU) which will be replaced with the user being
+searched for.
 
   bf(Default:)
-tt(	none (bind anonymously))
+tt(	empty string.)
 
-  bf(Example:)
-tt(	ldap bind as = "uid=root, dc=mydomain, dc=org")
-
-label(ldappasswdfile)
-dit(bf(ldap passwd file (G)))
+label(ldapport)
+dit(bf(ldap port (G)))
 
 This parameter is part of the em(EXPERIMENTAL) Samba support for a
-password database stored on an LDAP server. These options are only
-available if your version of Samba was configured with the bf(--with-ldap)
-option.
+password database stored on an LDAP server back-end. These options
+are only available if your version of Samba was configured with
+the bf(--with-ldap) option.
 
-This parameter specifies a file containing the password with which
-Samba should bind to an LDAP server. For obvious security reasons
-this file must be set to mode 700 or less.
+This parameter specifies the TCP port number to use to contact
+the LDAP server on.
 
   bf(Default:)
-tt(	none (bind anonymously))
+tt(	ldap port = 389.)
 
-  bf(Example:)
-tt(	ldap passwd file = /usr/local/samba/private/ldappasswd)
+label(ldaproot)
+dit(bf(ldap root (G)))
 
-label(ldapport)
-dit(bf(ldap port (G)))
+This parameter is part of the em(EXPERIMENTAL) Samba support for a
+password database stored on an LDAP server back-end. These options
+are only available if your version of Samba was configured with
+the bf(--with-ldap) option.
+
+This parameter specifies the entity to bind to the LDAP server
+as (essentially the LDAP username) in order to be able to perform
+queries and modifications on the LDAP database.
+
+See also link(bf(ldap root passwd))(ldaprootpasswd).
+
+  bf(Default:)
+tt(	empty string (no user defined))
+
+label(ldaprootpasswd)
+dit(bf(ldap root passwd (G)))
 
 This parameter is part of the em(EXPERIMENTAL) Samba support for a
-password database stored on an LDAP server. These options are only
-available if your version of Samba was configured with the bf(--with-ldap)
-option.
+password database stored on an LDAP server back-end. These options
+are only available if your version of Samba was configured with
+the bf(--with-ldap) option.
+
+This parameter specifies the password for the entity to bind to the
+LDAP server as (the password for this LDAP username) in order to be
+able to perform queries and modifications on the LDAP database.
+
+em(BUGS:) This parameter should em(NOT) be a readable parameter
+in the bf(smb.conf) file and will be removed once a correct
+storage place is found.
 
-This parameter specifies the TCP port number of the LDAP server.
+See also link(bf(ldap root))(ldaproot).
 
   bf(Default:)
-tt(	ldap port = 389.)
+tt(	empty string.)
 
 label(ldapserver)
 dit(bf(ldap server (G)))
@@ -2657,8 +2872,7 @@ are only available if your version of Samba was configured with
 the bf(--with-ldap) option.
 
 This parameter specifies the DNS name of the LDAP server to use
-when storing and retrieving information about Samba users and
-groups.
+for SMB/CIFS authentication purposes.
 
   bf(Default:)
 tt(	ldap server = localhost)
@@ -2671,15 +2885,53 @@ password database stored on an LDAP server back-end. These options
 are only available if your version of Samba was configured with
 the bf(--with-ldap) option.
 
-This parameter specifies the node of the LDAP tree beneath which
-Samba should store its information. This parameter MUST be provided
-when using LDAP with Samba.
+This parameter specifies the tt("dn") or LDAP em("distinguished name")
+that tells url(bf(smbd))(smbd.8.html) to start from when searching
+for an entry in the LDAP password database.
 
   bf(Default:)
-tt(	none)
+tt(	empty string.)
+
+label(level2oplocks)
+dit(bf(level2 oplocks (S)))
+
+This parameter (new in Samba 2.0.5) controls whether Samba supports
+level2 (read-only) oplocks on a share. In Samba 2.0.4 this parameter
+defaults to "False" as the code is new, but will default to "True"
+in a later release.
+
+Level2, or read-only oplocks allow Windows NT clients that have an
+oplock on a file to downgrade from a read-write oplock to a read-only
+oplock once a second client opens the file (instead of releasing all
+oplocks on a second open, as in traditional, exclusive oplocks). This
+allows all openers of the file that support level2 oplocks to cache
+the file for read-ahead only (ie. they may not cache writes or lock
+requests) and increases performance for many acesses of files that
+are not commonly written (such as application .EXE files).
+
+Once one of the clients which have a read-only oplock writes to
+the file all clients are notified (no reply is needed or waited
+for) and told to break their oplocks to "none" and delete any
+read-ahead caches.
+
+It is recommended that this parameter be turned on to speed access
+to shared executables (and also to test the code :-).
+
+For more discussions on level2 oplocks see the CIFS spec.
+
+Currently, if link(bf("kernel oplocks"))(kerneloplocks) are supported
+then level2 oplocks are not granted (even if this parameter is set
+to tt("true")). Note also, the link(bf("oplocks"))(oplocks) parameter must
+be set to "true" on this share in order for this parameter to have any
+effect.
+
+See also the link(bf("oplocks"))(oplocks) and link(bf("kernel oplocks"))(kerneloplocks) parameters.
+
+  bf(Default:)
+tt( level2 oplocks = False)
 
   bf(Example:)
-tt(	ldap suffix = "dc=mydomain, dc=org")
+tt( level2 oplocks = True)
 
 label(lmannounce)
 dit(bf(lm announce (G)))
@@ -2735,88 +2987,6 @@ tt(	load printers = yes)
   bf(Example:)
 tt(	load printers = no)
 
-label(localgroupmap)
-dit(bf(local group map (G)))
-
-This option allows you to specify a file containing unique mappings
-of individual NT Local Group names (in any domain) to UNIX group
-names.  This allows NT Local groups (aliases) to be presented correctly to
-NT users, despite the lack of native support for the NT Security model
-(based on VAX/VMS) in UNIX.  The reader is advised to become familiar
-with the NT Domain system and its administration.
-
-This option is used in conjunction with link(bf('domain group map'))(domaingroupmap)
-and link(bf('domain name map'))(domainusermap).  The use of these three
-options is trivial and often unnecessary in the case where Samba
-is not expected to interact with any other SAM databases (whether local
-workstations or Domain Controllers).
-
-
-The map file is parsed line by line.  If any line begins with a tt('#')
-or a tt(';') then it is ignored.  Each line should contain a single UNIX
-group name on the left then a single NT Local Group name on the right,
-separated by a tabstop or tt('=').  If either name contains spaces then
-it should be enclosed in quotes.
-The line can be either of the form:
-
-tt(  UNIXgroupname	\\DOMAIN_NAME\\LocalGroupName )
-
-or:
-
-tt(  UNIXgroupname	LocalGroupName )
-
-In the case where Samba is either an bf(EXPERIMENTAL) Domain Controller
-or it is a member of a domain using link(bf("security = domain"))(security),
-the latter format can be used: the default Domain name is the Samba Server's
-Domain name, specified by link(bf("workgroup = MYGROUP"))(workgroup).
-
-Any UNIX groups that are em(NOT) specified in this map file are treated
-as either Local or Domain Groups depending on the role of the Samba Server.
-
-In the case when Samba is an bf(EXPERIMENTAL) Domain Controller, Samba
-will present em(ALL) unspecified UNIX groups as its own NT Domain
-Groups, with the same name, and em(NOT) as Local Groups.
-
-In the case where Samba is member of a domain using
-link(bf("security = domain"))(security), Samba will check the UNIX name with
-its Domain Controller (see link(bf("password server"))(passwordserver))
-as if it was an NT Domain Group.  If the Domain Controller says that it is not,
-such unspecified (unmapped) UNIX groups which also are not NT Domain
-Groups are treated as Local Groups in the Samba Server's local SAM database.
-NT Administrators will recognise these as Workstation Local Groups,
-which are managed by running bf(USRMGR.EXE) and selecting a remote
-Domain named "\\WORKSTATION_NAME", or by running bf(MUSRMGR.EXE) on
-a local Workstation.
-
-This may sound complicated, but it means that a Samba Server as
-either a member of a domain or as an bf(EXPERIMENTAL) Domain Controller
-will act like an NT Workstation (with a local SAM database) or an NT PDC
-(with a Domain SAM database) respectively, without the need for any of
-the map files at all.  If you bf(want) to get fancy, however, you can.
-
-Note that adding an entry to map an arbitrary NT group in an arbitrary
-Domain to an arbitrary UNIX group em(REQUIRES) the following:
-
-startit()
-
-it() that the UNIX group exists on the UNIX server.
-
-it() that the NT Domain Group exists in the specified NT Domain
-
-it() that the UNIX Server knows about the specified Domain; 
-
-it() that all the UNIX users (who are expecting to access the Samba
-Server as the correct NT user and with the correct NT group permissions)
-in the UNIX group be mapped to the correct NT Domain users in the specified
-NT Domain using link(bf('domain user map'))(domainusermap).
-
-endit()
-
-Failure to meet any of these requirements may result in either (or
-both) errors reported in the log files or (and) incorrect or missing
-access rights granted to users.
-
-
 label(localmaster)
 dit(bf(local master (G)))
 
@@ -3240,6 +3410,13 @@ dit(bf(mangle case (S)))
 
 See the section on link(bf("NAME MANGLING"))(NAMEMANGLING).
 
+label(manglelocks)
+dit(bf(mangle locks (S)))
+
+This option is was introduced with Samba 2.0.4 and above and has been
+removed in Samba 2.0.6 as Samba now dynamically configures such things
+on 32 bit systems.
+
 label(mangledmap)
 dit(bf(mangled map (S)))
 
@@ -3542,7 +3719,7 @@ never need to set this parameter.
 tt(	max mux = 50)
 
 label(maxopenfiles)
-dit(bf(maxopenfiles (G)))
+dit(bf(max open files (G)))
 
 This parameter limits the maximum number of open files that one
 url(bf(smbd))(smbd.8.html) file serving process may have open for
@@ -3676,6 +3853,20 @@ tt(	min print space = 0)
   bf(Example:)
 tt(	min print space = 2000)
 
+label(minpasswdlength)
+dit(bf(min passwd length (G)))
+
+This option sets the minimum length in characters of a plaintext password
+than smbd will accept when performing UNIX password changing.
+
+See also link(bf("unix password sync"))(unixpasswordsync),
+link(bf("passwd program"))(passwdprogram) and link(bf("passwd chat
+debug"))(passwdchatdebug).
+
+  bf(Default:)
+tt(	min passwd length = 5)
+
+
 label(minwinsttl)
 dit(bf(min wins ttl (G)))
 
@@ -3703,11 +3894,16 @@ names to be resolved as follows :
 startit()
 
 it() bf(lmhosts) : Lookup an IP address in the Samba lmhosts file.
+If the line in lmhosts has no name type attached to the NetBIOS
+name (see the url(bf(lmhosts (5)))(lmhosts.5.html) for details) then
+any name type matches for lookup.
 
 it() bf(host) : Do a standard host name to IP address resolution,
 using the system /etc/hosts, NIS, or DNS lookups. This method of name
 resolution is operating system depended for instance on IRIX or
 Solaris this may be controlled by the em(/etc/nsswitch.conf) file).
+Note that this method is only used if the NetBIOS name type being
+queried is the 0x20 (server) name type, otherwise it is ignored.
 
 it() bf(wins) : Query a name with the IP address listed in the
 link(bf(wins server))(winsserver) parameter. If no WINS server has
@@ -3798,6 +3994,18 @@ tt(	nis homedir = false)
   bf(Example:)
 tt(	nis homedir = true)
 
+label(ntaclsupport)
+dit(bf(nt acl support (G)))
+
+This boolean parameter controls whether url(bf(smbd))(smbd.8.html)
+will attempt to map UNIX permissions into Windows NT access control lists.
+
+  bf(Default:)
+tt(	nt acl support = yes)
+
+  bf(Example:)
+tt(	nt acl support = no)
+
 label(ntpipesupport)
 dit(bf(nt pipe support (G)))
 
@@ -3902,12 +4110,48 @@ all access to oplocked files, whether it be via Samba or NFS or a local
 UNIX process. See the link(bf(kernel oplocks))(kerneloplocks) parameter
 for details.
 
+See also the link(bf("kernel oplocks"))(kerneloplocks) and
+link(bf("level2 oplocks"))(level2oplocks) parameters.
+
   bf(Default:)
 tt(	oplocks = True)
 
   bf(Example:)
 tt(	oplocks = False)
 
+label(oplockbreakwaittime)
+dit(bf(oplock break wait time (G)))
+
+This is a tuning parameter added due to bugs in both Windows 9x and WinNT.
+If Samba responds to a client too quickly when that client issues an SMB that
+can cause an oplock break request, then the client redirector can fail and
+not respond to the break request. This tuning parameter (which is set in
+milliseconds) is the amount of time Samba will wait before sending an
+oplock break request to such (broken) clients.
+
+em(DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA
+OPLOCK CODE).
+
+  bf(Default:)
+tt(	oplock break wait time = 10)
+
+label(oplockcontentionlimit)
+dit(bf(oplock contention limit (S)))
+
+This is a em(very) advanced url(bf(smbd))(smbd.8.html) tuning option to improve
+the efficiency of the granting of oplocks under multiple client contention for the same file.
+
+In brief it specifies a number, which causes smbd not to grant an oplock even
+when requested if the approximate number of clients contending for an oplock on
+the same file goes over this limit. This causes url(bf(smbd))(smbd.8.html) to
+behave in a similar way to Windows NT.
+
+em(DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA
+OPLOCK CODE).
+
+  bf(Default:)
+tt( oplock contention limit = 2)
+
 label(oslevel)
 dit(bf(os level (G)))
 
@@ -3915,12 +4159,12 @@ This integer value controls what level Samba advertises itself as for
 browse elections. The value of this parameter determines whether
 url(bf(nmbd))(nmbd.8.html) has a chance of becoming a local master
 browser for the link(bf(WORKGROUP))(workgroup) in the local broadcast
-area. Setting this to zero will cause url(bf(nmbd))(nmbd.8.html) to
-always lose elections to Windows machines. See BROWSING.txt in the
-Samba docs/ directory for details.
+area. The default is zero, which means url(bf(nmbd))(nmbd.8.html) will
+lose elections to Windows machines. See BROWSING.txt in the Samba
+docs/ directory for details.
 
   bf(Default:)
-tt(	os level = 32)
+tt(	os level = 20)
 
   bf(Example:)
 tt(	os level = 65    ; This will win against any NT Server)
@@ -4123,7 +4367,7 @@ better restrict them with hosts allow!
 If the link(bf("security"))(security) parameter is set to
 bf("domain"), then the list of machines in this option must be a list
 of Primary or Backup Domain controllers for the
-link(bf(Domain))(workgroup), as the Samba server is cryptographicly
+link(bf(Domain))(workgroup) or the character tt(*), as the Samba server is cryptographicly
 in that domain, and will use cryptographicly authenticated RPC calls
 to authenticate the user logging on. The advantage of using
 link(bf("security=domain"))(securityequaldomain) is that if you list
@@ -4131,6 +4375,12 @@ several hosts in the bf("password server") option then
 url(bf(smbd))(smbd.8.html) will try each in turn till it finds one
 that responds. This is useful in case your primary server goes down.
 
+If the bf("password server") option is set to the character tt(*),
+then Samba will attempt to auto-locate the Primary or Backup Domain controllers
+to authenticate against by doing a query for the name tt(WORKGROUP<1C>)
+and then contacting each server returned in the list of IP addresses
+from the link(bf(name resolution))(nameresolveorder) source.
+
 If the link(bf("security"))(security) parameter is set to
 link(bf("server"))(securityequalserver), then there are different
 restrictions that link(bf("security=domain"))(securityequaldomain)
@@ -4163,6 +4413,9 @@ tt(	password server = <empty string>)
   bf(Example:)
 tt(	password server = NT-PDC, NT-BDC1, NT-BDC2)
 
+  bf(Example:)
+tt(	password server = *)
+
 label(path)
 dit(bf(path (S)))
 
@@ -4243,7 +4496,7 @@ verb(
 
 Of course, this could get annoying after a while :-)
 
-See also link(bf(postexec))(postexec).
+See also link(bf(preexec close))(preexecclose) and link(bf(postexec))(postexec).
 
   bf(Default:)
 tt(	none (no command executed))
@@ -4251,6 +4504,18 @@ tt(	none (no command executed))
   bf(Example:)
 tt(        preexec = echo \"%u connected to %S from %m (%I)\" >> /tmp/log)
 
+label(preexecclose)
+dit(bf(preexec close (S)))
+
+This boolean option controls whether a non-zero return code from
+link(bf("preexec"))(preexec) should close the service being connected to.
+
+  bf(Default:)
+tt( 	preexec close = no)
+
+  bf(Example:)
+tt( 	preexec close = yes)
+
 label(preferredmaster)
 dit(bf(preferred master (G)))
 
@@ -4262,8 +4527,7 @@ force an election, and it will have a slight advantage in winning the
 election.  It is recommended that this parameter is used in
 conjunction with link(bf("domain master = yes"))(domainmaster), so
 that url(bf(nmbd))(nmbd.8.html) can guarantee becoming a domain
-master. Indeed the default ("auto") enables "preferred master" if
-Samba is configured as the domain master browser.
+master.
 
 Use this option with caution, because if there are several hosts
 (whether Samba servers, Windows 95 or NT) that are preferred master
@@ -4275,7 +4539,7 @@ capabilities.
 See also link(bf(os level))(oslevel).
 
   bf(Default:)
-tt( 	preferred master = auto)
+tt( 	preferred master = no)
 
   bf(Example:)
 tt( 	preferred master = yes)
@@ -4314,16 +4578,11 @@ command you specify should remove the spool file when it has been
 processed, otherwise you will need to manually remove old spool files.
 
 The print command is simply a text string. It will be used verbatim,
-with two exceptions: All occurrences of tt("%s") will be replaced by
-the appropriate spool file name, and all occurrences of tt("%p") will
-be replaced by the appropriate printer name. The spool file name is
-generated automatically by the server, the printer name is discussed
-below.
-
-The full path name will be used for the filename if tt("%s") is not
-preceded by a tt('/'). If you don't like this (it can stuff up some
-lpq output) then use tt("%f") instead. Any occurrences of tt("%f") get
-replaced by the spool filename without the full path at the front.
+with two exceptions: All occurrences of tt("%s") and tt("%f") will be
+replaced by the appropriate spool file name, and all occurrences of
+tt("%p") will be replaced by the appropriate printer name. The spool
+file name is generated automatically by the server, the printer name
+is discussed below.
 
 The print command em(MUST) contain at least one occurrence of tt("%s")
 or tt("%f") - the tt("%p") is optional. At the time a job is
@@ -4721,14 +4980,14 @@ This overlapping works best when the speeds of disk and network access
 are similar, having very little effect when the speed of one is much
 greater than the other.
 
-The default value is 2048, but very little experimentation has been
+The default value is 16384, but very little experimentation has been
 done yet to determine the optimal value, and it is likely that the
 best value will vary greatly between systems anyway. A value over
 65536 is pointless and will cause you to allocate memory
 unnecessarily.
 
   bf(Default:)
-tt(	read size = 2048)
+tt(	read size = 16384)
 
   bf(Example:)
 tt(	read size = 8192)
@@ -4802,6 +5061,39 @@ tt(	remote browse sync = <empty string>)
   bf(Example:)
 tt(	remote browse sync = 192.168.2.255 192.168.4.255)
 
+
+label(restrict anonymous)
+dit(bf(restrict anonymous (G)))
+
+This is a boolean parameter.  If it is true, then anonymous access
+to the server will be restricted, namely in the case where the server
+is expecting the client to send a username, but it doesn't.  Setting
+it to true will force these anonymous connections to be denied, and
+the client will be required to always supply a username and password
+when connecting. Use of this parameter is only recommened for homogenous 
+NT client environments.
+
+This parameter makes the use of macro expansions that rely
+on the username (%U, %G, etc) consistant.  NT 4.0 likes to use
+anonymous connections when refreshing the share list, and this
+is a way to work around that.
+
+When restrict anonymous is true, all anonymous connections are denied
+no matter what they are for.  This can effect the ability of a machine
+to access the samba Primary Domain Controller to revalidate it's machine
+account after someone else has logged on the client interactively.  The
+NT client will display a message saying that the machine's account in 
+the domain doesn't exist or the password is bad.  The best way to deal 
+with this is to reboot NT client machines between interactive logons, 
+using "Shutdown and Restart", rather than "Close all programs and logon 
+as a different user".
+
+  bf(Default:)
+tt(     restrict anonymous = false)
+
+  bf(Example:)
+tt(     restrict anonymous = true)
+
 label(revalidate)
 dit(bf(revalidate (S)))
 
@@ -4878,7 +5170,16 @@ This is the same as the link(bf("preexec"))(preexec) parameter except
 that the command is run as root. This is useful for mounting
 filesystems (such as cdroms) before a connection is finalized.
 
-See also link(bf("preexec"))(preexec).
+See also link(bf("preexec"))(preexec)
+and link(bf("root preexec close"))(rootpreexecclose).
+
+label(rootpreexecclose)
+dit(bf(root preexec close (S)))
+
+This is the same as the link(bf("preexec close"))(preexecclose) parameter
+except that the command is run as root.
+
+See also link(bf("preexec"))(preexec), link(bf("preexec close"))(preexecclose).
 
 label(security)
 dit(bf(security (G)))
@@ -5079,7 +5380,7 @@ users into the link(bf("guest account"))(guestaccount). See the
 link(bf("map to guest"))(maptoguest) parameter for details on
 doing this.
 
-e,(BUG:) There is currently a bug in the implementation of
+em(BUG:) There is currently a bug in the implementation of
 bf("security=domain) with respect to multi-byte character
 set usernames. The communication with a Domain Controller
 must be done in UNICODE and Samba currently does not widen
@@ -5101,6 +5402,40 @@ tt( 	security = USER)
   bf(Example:)
 tt( 	security = DOMAIN)
 
+label(securitymask)
+dit(bf(security mask (S)))
+
+This parameter controls what UNIX permission bits can be modified
+when a Windows NT client is manipulating the UNIX permission on a
+file using the native NT security dialog box.
+
+This parameter is applied as a mask (AND'ed with) to the changed
+permission bits, thus preventing any bits not in this mask from
+being modified. Essentially, zero bits in this mask may be treated
+as a set of bits the user is not allowed to change.
+
+If not set explicitly this parameter is set to the same value as the
+link(bf(create mask))(createmask) parameter. To allow a user to
+modify all the user/group/world permissions on a file, set this
+parameter to 0777.
+
+em(Note) that users who can access the Samba server through other
+means can easily bypass this restriction, so it is primarily
+useful for standalone "appliance" systems.  Administrators of
+most normal systems will probably want to set it to 0777.
+
+See also the link(bf(force directory security
+mode))(forcedirectorysecuritymode), link(bf(directory security
+mask))(directorysecuritymask), link(bf(force security
+mode))(forcesecuritymode) parameters.
+
+  bf(Default:)
+tt(	security mask = <same as create mask>)
+
+  bf(Example:)
+tt(	security mask = 0777)
+
+
 label(serverstring)
 dit(bf(server string (G)))
 
@@ -5170,6 +5505,9 @@ users reporting strange problems trying to save files (locking errors)
 and error messages in the smbd log looking like tt("ERROR
 smb_shm_alloc : alloc of XX bytes failed").
 
+If your OS refuses the size that Samba asks for then Samba will try a
+smaller size, reducing by a factor of 0.8 until the OS accepts it.
+
   bf(Default:)
 tt(	shared mem size = 1048576)
 
@@ -5691,9 +6029,12 @@ dit(bf(syslog (G)))
 This parameter maps how Samba debug messages are logged onto the
 system syslog logging levels. Samba debug level zero maps onto syslog
 LOG_ERR, debug level one maps onto LOG_WARNING, debug level two maps
-to LOG_NOTICE, debug level three maps onto LOG_INFO.  The parameter
-sets the threshold for doing the mapping, all Samba debug messages
-above this threshold are mapped to syslog LOG_DEBUG messages.
+onto LOG_NOTICE, debug level three maps onto LOG_INFO. All higher 
+levels are mapped to LOG_DEBUG.
+
+This paramter sets the threshold for sending messages to syslog. 
+Only messages with debug level less than this value will be sent 
+to syslog.
 
   bf(Default:)
 tt(	syslog = 1)
@@ -5933,17 +6274,6 @@ Windows machines to those that the UNIX box uses. The other is to map
 multiple users to a single username so that they can more easily share
 files.
 
-The use of this option, therefore, relates to UNIX usernames
-and not Windows (specifically NT Domain) usernames.  In other words,
-once a name has been mapped using this option, the Samba server uses
-the mapped name for internal em(AND) external purposes.
-
-This option is em(DIFFERENT) from the link(bf("domain user map"))(domainusermap) 
-parameter, which maintains a one-to-one mapping between UNIX usernames
-and NT Domain Usernames: more specifically, the Samba server maintains
-a link between em(BOTH) usernames, presenting the NT username to the
-external NT world, and using the UNIX username internally.
-
 The map file is parsed line by line. Each line should contain a single
 UNIX username on the left then a tt('=') followed by a list of
 usernames on the right. The list of usernames on the right may contain
@@ -6020,7 +6350,7 @@ tt(	no username map)
 tt(	username map = /usr/local/samba/lib/users.map)
 
 label(validchars)
-dit(bf(valid chars (S)))
+dit(bf(valid chars (G)))
 
 The option allows you to specify additional characters that should be
 considered valid by the server in filenames. This is particularly
@@ -6194,6 +6524,10 @@ directory tree exported by the server are always allowed; this
 parameter controls access only to areas that are outside the directory
 tree being exported.
 
+Note that setting this parameter can have a negative effect on your
+server performance due to the extra system calls that Samba has to
+do in order to perform the link checks.
+
   bf(Default:)
 tt( 	wide links = yes)
 
@@ -6216,7 +6550,7 @@ dit(bf(wins server (G)))
 This specifies the IP address (or DNS name: IP address for preference)
 of the WINS server that url(bf(nmbd))(nmbd.8.html) should register with.
 If you have a WINS server on your network then you should set this to
-the WINS server's IP.
+the WINS server's IP.        
 
 You should point this at your WINS server if you have a
 multi-subnetted network.
@@ -6233,6 +6567,42 @@ tt(	wins server = )
   bf(Example:)
 tt(	wins server = 192.9.200.1)
 
+label(winshook)
+dit(bf(wins hook (G)))
+
+When Samba is running as a WINS server this allows you to call an
+external program for all changes to the WINS database. The primary use
+for this option is to allow the dynamic update of external name
+resolution databases such as dynamic DNS.
+
+The wins hook parameter specifies the name of a script or executable
+that will be called as follows:
+
+   wins_hook operation name nametype ttl IP_list
+
+The first argument is the operation and is one of "add", "delete",
+or "refresh". In most cases the operation can be ignored as the rest
+of the parameters provide sufficient information. Note that "refresh"
+may sometimes be called when the name has not previously been added,
+in that case it should be treated as an add.
+
+The second argument is the netbios name. If the name is not a legal
+name then the wins hook is not called. Legal names contain only
+letters, digits, hyphens, underscores and periods.
+
+The third argument is the netbios name type as a 2 digit hexadecimal
+number. 
+
+The fourth argument is the TTL (time to live) for the name in seconds.
+
+The fifth and subsequent arguments are the IP addresses currently
+registered for that name. If this list is empty then the name should
+be deleted.
+
+An example script that calls the BIND dynamic DNS update program
+"nsupdate" is provided in the examples directory of the Samba source
+code. 
+
 label(winssupport)
 dit(bf(wins support (G)))
 
@@ -6264,7 +6634,6 @@ label(writable)
 dit(bf(writable (S)))
 
 Synonym for link(bf("writeable"))(writeable) for people who can't spell :-).
-Pronounced "ritter-bull".
 
 label(writelist)
 dit(bf(write list (S)))
@@ -6323,6 +6692,8 @@ verb(
  	write ok = yes
 )
 
+endit()
+
 label(WARNINGS)
 manpagesection(WARNINGS)
 
diff --git a/docs/yodldocs/smbclient.1.yo b/docs/yodldocs/smbclient.1.yo
index 327e47c7a2..a2d14209b9 100644
--- a/docs/yodldocs/smbclient.1.yo
+++ b/docs/yodldocs/smbclient.1.yo
@@ -8,7 +8,7 @@ manpagename(smbclient)(ftp-like client to access SMB/CIFS resources on servers)
 label(SYNOPSIS)
 manpagesynopsis()
 
-bf(smbclient) link(servicename)(servicename) [link(password)(password)] [link(-s smb.conf)(minuss)] [link(-B IP addr)(minusB)] [link(-O socket options)(minusO)][link(-R name resolve order)(minusR)] [link(-M NetBIOS name)(minusM)] [link(-i scope)(minusi)] [link(-N)(minusN)] [link(-n NetBIOS name)(minusn)] [link(-d debuglevel)(minusd)] [link(-P)(minusP)] [link(-p port)(minusp)] [link(-l log basename)(minusl)] [link(-h)(minush)] [link(-I dest IP)(minusI)] [link(-E)(minusE)] [link(-U username)(minusU)] [link(-L NetBIOS name)(minusL)] [link(-t terminal code)(minust)] [link(-m max protocol)(minusm)] [link(-W workgroup)(minusW)] [link(-T<c|x>IXFqgbNan)(minusT)] [link(-D directory)(minusD)] [link(-c command string)(minusc)]
+bf(smbclient) link(servicename)(servicename) [link(-s smb.conf)(minuss)] [link(-O socket options)(minusO)][link(-R name resolve order)(minusR)] [link(-M NetBIOS name)(minusM)] [link(-i scope)(minusi)] [link(-N)(minusN)] [link(-n NetBIOS name)(minusn)] [link(-d debuglevel)(minusd)] [link(-P)(minusP)] [link(-p port)(minusp)] [link(-l log basename)(minusl)] [link(-h)(minush)] [link(-I dest IP)(minusI)] [link(-E)(minusE)] [link(-U username)(minusU)] [link(-L NetBIOS name)(minusL)] [link(-t terminal code)(minust)] [link(-m max protocol)(minusm)] [link(-b buffersize)(minusb)] [link(-W workgroup)(minusW)] [link(-T<c|x>IXFqgbNan)(minusT)] [link(-D directory)(minusD)] [link(-c command string)(minusc)]
 
 label(DESCRIPTION)
 manpagedescription()
@@ -71,9 +71,6 @@ Samba configuration file, smb.conf. This file controls all aspects of
 the Samba setup on the machine and smbclient also needs to read this
 file.
 
-label(minusB)
-dit(bf(-B IP addr)) The IP address to use when sending a broadcast packet.
-
 label(minusO)
 dit(bf(-O socket options)) TCP socket options to set on the client
 socket. See the url(socket options)(smb.conf.5.html#socketoptions)
@@ -107,8 +104,7 @@ it() bf(bcast) : Do a broadcast on each of the known local interfaces
 listed in the url(bf(interfaces))(smb.conf.5.html#interfaces) parameter
 in the smb.conf file. This is the least reliable of the name resolution
 methods as it depends on the target host being on a locally connected
-subnet. To specify a particular broadcast address the link(bf(-B))(minusB) option 
-may be used.
+subnet. 
 
 endit()
 
@@ -286,7 +282,7 @@ nothing before or nothing after the percent symbol will cause an empty
 username or an empty password to be used, respectively.
 
 The password may also be specified by setting up an environment
-variable called tt(PASSWORD) that contains the users password. Note
+variable called tt(PASSWD) that contains the users password. Note
 that this may be very insecure on some systems but on others allows
 users to script smbclient commands without having a password appear in
 the command line of a process listing.
@@ -296,7 +292,7 @@ on an uppercase password. Lowercase or mixed case passwords may be
 rejected by these servers.
 
 Be cautious about including passwords in scripts or in the
-tt(PASSWORD) environment variable. Also, on many systems the command
+tt(PASSWD) environment variable. Also, on many systems the command
 line of a running process may be seen via the tt(ps) command to be
 safe always allow smbclient to prompt for a password and type it in
 directly.
@@ -328,6 +324,12 @@ protocols level the server supports. This parameter is
 preserved for backwards compatibility, but any string
 following the bf(-m) will be ignored.
 
+label(minusb)
+dit(bf(-b buffersize)) This option changes the transmit/send buffer
+size when getting or putting a file from/to the server. The default
+is 65520 bytes. Setting this value smaller (to 1200 bytes) has been
+observed to speed up file transfers to and from a Win9x server.
+
 label(minusW)
 dit(bf(-W WORKGROUP)) Override the default workgroup specified in the
 url(bf(workgroup))(smb.conf.5.html#workgroup) parameter of the
@@ -683,7 +685,7 @@ The variable bf(USER) may contain the username of the person using the
 client.  This information is used only if the protocol level is high
 enough to support session-level passwords.
 
-The variable bf(PASSWORD) may contain the password of the person using
+The variable bf(PASSWD) may contain the password of the person using
 the client.  This information is used only if the protocol level is
 high enough to support session-level passwords.
 
diff --git a/docs/yodldocs/smbd.8.yo b/docs/yodldocs/smbd.8.yo
index b0ed9a6cff..d3fd08c445 100644
--- a/docs/yodldocs/smbd.8.yo
+++ b/docs/yodldocs/smbd.8.yo
@@ -8,7 +8,7 @@ manpagename(smbd)(server to provide SMB/CIFS services to clients)
 label(SYNOPSIS)
 manpagesynopsis()
 
-bf(smbd) [link(-D)(minusD)] [link(-a)(minusa)] [link(-o)(minuso)] [link(-d debuglevel)(minusd)] [link(-l log file)(minusl)] [link(-p port number)(minusp)] [link(-O socket options)(minusO)] [link(-s configuration file)(minuss)] [link(-i scope)(minusi)] [link(-P)(minusP)] [link(-h)(minush)]
+bf(smbd) [link(-D)(minusD)] [link(-a)(minusa)] [link(-o)(minuso)] [link(-P)(minusP)] [link(-h)(minush)] [link(-V)(minusV)] [link(-d debuglevel)(minusd)] [link(-l log file)(minusl)] [link(-p port number)(minusp)] [link(-O socket options)(minusO)] [link(-s configuration file)(minuss)] [link(-i scope)(minusi)]
 
 label(DESCRIPTION)
 manpagedescription()
@@ -71,6 +71,16 @@ dit(bf(-o)) If this parameter is specified, the log files will be
 overwritten when opened.  By default, the log files will be appended
 to.
 
+label(minusP)
+dit(bf(-P)) Passive option. Causes smbd not to send any network traffic
+out. Used for debugging by the developers only.
+
+label(minush)
+dit(bf(-h)) Prints the help information (usage) for bf(smbd).
+
+label(minusV)
+dit(bf(-V)) Prints the version number for bf(smbd).
+
 label(minusd)
 dit(bf(-d debuglevel)) debuglevel is an integer from 0 to 10.
 
@@ -142,13 +152,6 @@ are em(very) rarely used, only set this parameter if you are the
 system administrator in charge of all the NetBIOS systems you
 communicate with.
 
-label(minush)
-dit(bf(-h)) Prints the help information (usage) for smbd.
-
-label(minusP)
-dit(bf(-P)) Passive option. Causes smbd not to send any network traffic
-out. Used for debugging by the developers only.
-
 endit()
 
 label(FILES)
@@ -421,16 +424,11 @@ performance.
 label(SEEALSO)
 manpageseealso()
 
-bf(hosts_access (5)),
-bf(inetd (8)),
-url(bf(nmbd (8)))(nmbd.8.html),
-url(bf(smb.conf (5)))(smb.conf.5.html),
-url(bf(smbclient (1)))(smbclient.1.html),
-url(bf(testparm (1)))(testparm.1.html),
-url(bf(testprns (1)))(testprns.1.html),
-url(bf(rpcclient (1)))(rpcclient.1.html),
-and the Internet RFC's bf(rfc1001.txt), bf(rfc1002.txt).
-In addition the CIFS (formerly SMB)
+bf(hosts_access (5)), bf(inetd (8)), url(bf(nmbd (8)))(nmbd.8.html),
+url(bf(smb.conf (5)))(smb.conf.5.html), url(bf(smbclient
+(1)))(smbclient.1.html), url(bf(testparm (1)))(testparm.1.html),
+url(bf(testprns (1)))(testprns.1.html), and the Internet RFC's
+bf(rfc1001.txt), bf(rfc1002.txt). In addition the CIFS (formerly SMB)
 specification is available as a link from the Web page :
 url(http://samba.org/cifs/)(http://samba.org/cifs/).
 
diff --git a/docs/yodldocs/smbstatus.1.yo b/docs/yodldocs/smbstatus.1.yo
index 0d88bc7ef5..f412a00a15 100644
--- a/docs/yodldocs/smbstatus.1.yo
+++ b/docs/yodldocs/smbstatus.1.yo
@@ -24,7 +24,7 @@ manpageoptions()
 startdit()
 
 label(minusP)
-dit(bf(-P)) If samba has been compiled with the profiling option, 
+dit(bf(-P)) If samba has been compiled with the profiling option,
 print only the contents of the profiling shared memory area.
 
 label(minusb)
diff --git a/docs/yodldocs/swat.8.yo b/docs/yodldocs/swat.8.yo
index 5059e3f47c..145a919879 100644
--- a/docs/yodldocs/swat.8.yo
+++ b/docs/yodldocs/swat.8.yo
@@ -3,7 +3,7 @@ mailto(samba-bugs@samba.org)
 manpage(swat htmlcommand((8)))(8)(23 Oct 1998)(Samba)(SAMBA)
 
 label(NAME)
-manpagename(swat)(swat - Samba Web Administration Tool)
+manpagename(swat)(Samba Web Administration Tool)
 
 label(SYNOPSIS)
 manpagesynopsis()
diff --git a/docs/yodldocs/testparm.1.yo b/docs/yodldocs/testparm.1.yo
index 2c8e414bcd..35ebce9a98 100644
--- a/docs/yodldocs/testparm.1.yo
+++ b/docs/yodldocs/testparm.1.yo
@@ -8,7 +8,7 @@ manpagename(testparm)(check an smb.conf configuration file for internal correctn
 label(SYNOPSIS)
 manpagesynopsis() 
 
-bf(testparm) [link(-s)(minuss)] [link(configfilename)(configfilename)] [link(hostname)(hostname) link(hostIP)(hostIP)]
+bf(testparm) [link(-s)(minuss)] [link(-h)(minush)] [link(-L servername)(minusL)] [link(configfilename)(configfilename)] [link(hostname)(hostname) link(hostIP)(hostIP)]
 
 label(DESCRIPTION)
 manpagedescription()
@@ -28,6 +28,11 @@ If the optional host name and host IP address are specified on the
 command line, this test program will run through the service entries
 reporting whether the specified host has access to each service.
 
+If bf(testparm) finds an error in the url(bf(smb.conf))(smb.conf.5.html)
+file it returns an exit code of 1 to the calling program, else it returns
+an exit code of 0. This allows shell scripts to test the output from
+bf(testparm).
+
 label(OPTIONS)
 manpageoptions()
 
@@ -38,6 +43,13 @@ dit(bf(-s)) Without this option, bf(testparm) will prompt for a
 carriage return after printing the service names and before dumping
 the service definitions.
 
+label(minush)
+dit(bf(-h)) Print usage message
+
+label(minusL)
+dit(bf(-L servername)) Sets the value of the %L macro to servername. This
+is useful for testing include files specified with the %L macro.
+
 label(configfilename)
 dit(bf(configfilename)) This is the name of the configuration file to
 check. If this parameter is not present then the default
author	Andrew Tridgell <tridge@samba.org>	1999-12-13 13:27:58 +0000
committer	Andrew Tridgell <tridge@samba.org>	1999-12-13 13:27:58 +0000
commit	3db52feb1f3b2c07ce0b06ad4a7099fa6efe3fc7 (patch)
tree	866dd15416c3d8554bb207709f433a87ad0c012d /docs
parent	f6276724bafdb6145c0c7b565172d80cb04516ea (diff)
download	samba-3db52feb1f3b2c07ce0b06ad4a7099fa6efe3fc7.tar.gz samba-3db52feb1f3b2c07ce0b06ad4a7099fa6efe3fc7.tar.bz2 samba-3db52feb1f3b2c07ce0b06ad4a7099fa6efe3fc7.zip