diff options
| -rw-r--r-- | docs/docbook/projdoc/AdvancedNetworkAdmin.sgml | 759 | ||||
| -rw-r--r-- | docs/docbook/projdoc/PolicyMgmt.sgml | 261 | ||||
| -rw-r--r-- | docs/docbook/projdoc/ProfileMgmt.sgml | 631 | ||||
| -rw-r--r-- | docs/docbook/projdoc/samba-doc.sgml | 4 |
4 files changed, 914 insertions, 741 deletions
diff --git a/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml index 5180901fd3..18fda67123 100644 --- a/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml +++ b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml @@ -9,772 +9,49 @@ </address> </affiliation> </author> - - - <pubdate>April 1 2003</pubdate> + <pubdate>April 3 2003</pubdate> </chapterinfo> -<title>System Policies</title> +<title>Advanced Network Manangement Information</title> <sect1> -<title>Basic System Policy Info</title> - -<para> -Much of the information necessary to implement System Policies and -Roaming User Profiles in a Samba domain is the same as that for -implementing these same items in a Windows NT 4.0 domain. -You should read the white paper <ulink url="http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp">Implementing -Profiles and Policies in Windows NT 4.0</ulink> available from Microsoft. -</para> - -<para> -Here are some additional details: -</para> - -<itemizedlist> -<listitem> - <para> - <emphasis>What about Windows NT Policy Editor?</emphasis> - </para> - - <para> - To create or edit <filename>ntconfig.pol</filename> you must use - the NT Server Policy Editor, <command>poledit.exe</command> which - is included with NT Server but <emphasis>not NT Workstation</emphasis>. - There is a Policy Editor on a NTws - but it is not suitable for creating <emphasis>Domain Policies</emphasis>. - Further, although the Windows 95 - Policy Editor can be installed on an NT Workstation/Server, it will not - work with NT policies because the registry key that are set by the policy templates. - However, the files from the NT Server will run happily enough on an NTws. - You need <filename>poledit.exe, common.adm</filename> and <filename>winnt.adm</filename>. It is convenient - to put the two *.adm files in <filename>c:\winnt\inf</filename> which is where - the binary will look for them unless told otherwise. Note also that that - directory is 'hidden'. - </para> - - <para> - The Windows NT policy editor is also included with the Service Pack 3 (and - later) for Windows NT 4.0. Extract the files using <command>servicepackname /x</command>, - i.e. that's <command>Nt4sp6ai.exe /x</command> for service pack 6a. The policy editor, - <command>poledit.exe</command> and the associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible - location is with the Zero Administration Kit available for download from Microsoft. - </para> -</listitem> - -<listitem> - <para> - <emphasis>Can Win95 do Policies?</emphasis> - </para> - - <para> - Install the group policy handler for Win9x to pick up group - policies. Look on the Win98 CD in <filename>\tools\reskit\netadmin\poledit</filename>. - Install group policies on a Win9x client by double-clicking - <filename>grouppol.inf</filename>. Log off and on again a couple of - times and see if Win98 picks up group policies. Unfortunately this needs - to be done on every Win9x machine that uses group policies.... - </para> - - <para> - If group policies don't work one reports suggests getting the updated - (read: working) grouppol.dll for Windows 9x. The group list is grabbed - from /etc/group. - </para> -</listitem> - -<listitem> - <para> - <emphasis>How do I get 'User Manager' and 'Server Manager'</emphasis> - </para> - - <para> - Since I don't need to buy an NT Server CD now, how do I get - the 'User Manager for Domains', the 'Server Manager'? - </para> - - <para> - Microsoft distributes a version of these tools called nexus for - installation on Windows 95 systems. The tools set includes - </para> - - <itemizedlist> - <listitem><para>Server Manager</para></listitem> - - <listitem><para>User Manager for Domains</para></listitem> - - <listitem><para>Event Viewer</para></listitem> - </itemizedlist> - - <para> - Click here to download the archived file <ulink - url="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</ulink> - </para> - - <para> - The Windows NT 4.0 version of the 'User Manager for - Domains' and 'Server Manager' are available from Microsoft via ftp - from <ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</ulink> - </para> -</listitem> -</itemizedlist> - -<sect2> -<title>Creating Group Prolicy Files</title> - -<sect3> -<title>Windows '9x</title> -<para> -You need the Win98 Group Policy Editor to -set Group Profiles up under Windows '9x. It can be found on the Original -full product Win98 installation CD under -<filename>tools/reskit/netadmin/poledit</filename>. You install this -using the Add/Remove Programs facility and then click on the 'Have Disk' -tab. -</para> - -<para> -Use the Group Policy Editor to create a policy file that specifies the -location of user profiles and/or the <filename>My Documents</filename> etc. -stuff. You then save these settings in a file called -<filename>Config.POL</filename> that needs to be placed in -the root of the [NETLOGON] share. If your Win98 is configured to log onto -the Samba Domain, it will automatically read this file and update the -Win9x/Me registry of the machine that is logging on. -</para> - -<para> -All of this is covered in the Win98 Resource Kit documentation. -</para> - -<para> -If you do not do it this way, then every so often Win9x/Me will check the -integrity of the registry and will restore it's settings from the back-up -copy of the registry it stores on each Win9x/Me machine. Hence, you will -occasionally notice things changing back to the original settings. -</para> - -</sect3> -</sect2> -</sect1> - -<sect1> -<title>Roaming Profiles</title> - -<warning> -<para> -<emphasis>NOTE!</emphasis> Roaming profiles support is different for Win9X and WinNT. -</para> -</warning> - -<para> -Before discussing how to configure roaming profiles, it is useful to see how -Win9X and WinNT clients implement these features. -</para> - -<para> -Win9X clients send a NetUserGetInfo request to the server to get the user's -profiles location. However, the response does not have room for a separate -profiles location field, only the user's home share. This means that Win9X -profiles are restricted to being in the user's home directory. -</para> - - -<para> -WinNT clients send a NetSAMLogon RPC request, which contains many fields, -including a separate field for the location of the user's profiles. -This means that support for profiles is different for Win9X and WinNT. -</para> - -<sect2> -<title>Windows NT Configuration</title> - -<para> -To support WinNT clients, in the [global] section of smb.conf set the -following (for example): -</para> - -<para><programlisting> -logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath -</programlisting></para> - -<para> -The default for this option is \\%N\%U\profile, namely -\\sambaserver\username\profile. The \\N%\%U service is created -automatically by the [homes] service. -If you are using a samba server for the profiles, you _must_ make the -share specified in the logon path browseable. -</para> - -<note> -<para> -MS Windows NT/2K clients at times do not disconnect a connection to a server -between logons. It is recommended to NOT use the <emphasis>homes</emphasis> -meta-service name as part of the profile share path. -</para> -</note> - -</sect2> - -<sect2> -<title>Windows 9X Configuration</title> - -<para> -To support Win9X clients, you must use the "logon home" parameter. Samba has -now been fixed so that "net use /home" now works as well, and it, too, relies -on the "logon home" parameter. -</para> - -<para> -By using the logon home parameter, you are restricted to putting Win9X -profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your -smb.conf file: -</para> - -<para><programlisting> -logon home = \\%L\%U\.profiles -</programlisting></para> - -<para> -then your Win9X clients will dutifully put their clients in a subdirectory -of your home directory called .profiles (thus making them hidden). -</para> - -<para> -Not only that, but 'net use/home' will also work, because of a feature in -Win9X. It removes any directory stuff off the end of the home directory area -and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for "logon home". -</para> - - -</sect2> - -<sect2> -<title>Win9X and WinNT Configuration</title> - -<para> -You can support profiles for both Win9X and WinNT clients by setting both the -"logon home" and "logon path" parameters. For example: -</para> - -<para><programlisting> -logon home = \\%L\%U\.profiles -logon path = \\%L\profiles\%U -</programlisting></para> - -<note> -<para> -I have not checked what 'net use /home' does on NT when "logon home" is -set as above. -</para> -</note> -</sect2> - -<sect2> -<title>Windows 9X Profile Setup</title> - -<para> -When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders "Start Menu", "Desktop", "Programs" and "Nethood". -These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options "preserve case = yes", "short preserve case = yes" and -"case sensitive = no" in order to maintain capital letters in shortcuts -in any of the profile folders. -</para> - -<para> -The user.DAT file contains all the user's preferences. If you wish to -enforce a set of preferences, rename their user.DAT file to user.MAN, -and deny them write access to this file. -</para> - -<orderedlist> -<listitem> - <para> - On the Windows 95 machine, go to Control Panel | Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer - to reboot. - </para> -</listitem> - - -<listitem> - <para> - On the Windows 95 machine, go to Control Panel | Network | - Client for Microsoft Networks | Preferences. Select 'Log on to - NT Domain'. Then, ensure that the Primary Logon is 'Client for - Microsoft Networks'. Press OK, and this time allow the computer - to reboot. - </para> -</listitem> - -</orderedlist> - -<para> -Under Windows 95, Profiles are downloaded from the Primary Logon. -If you have the Primary Logon as 'Client for Novell Networks', then -the profiles and logon script will be downloaded from your Novell -Server. If you have the Primary Logon as 'Windows Logon', then the -profiles will be loaded from the local machine - a bit against the -concept of roaming profiles, if you ask me. -</para> - -<para> -You will now find that the Microsoft Networks Login box contains -[user, password, domain] instead of just [user, password]. Type in -the samba server's domain name (or any other domain known to exist, -but bear in mind that the user will be authenticated against this -domain and profiles downloaded from it, if that domain logon server -supports it), user name and user's password. -</para> - -<para> -Once the user has been successfully validated, the Windows 95 machine -will inform you that 'The user has not logged on before' and asks you -if you wish to save the user's preferences? Select 'yes'. -</para> - -<para> -Once the Windows 95 client comes up with the desktop, you should be able -to examine the contents of the directory specified in the "logon path" -on the samba server and verify that the "Desktop", "Start Menu", -"Programs" and "Nethood" folders have been created. -</para> - -<para> -These folders will be cached locally on the client, and updated when -the user logs off (if you haven't made them read-only by then :-). -You will find that if the user creates further folders or short-cuts, -that the client will merge the profile contents downloaded with the -contents of the profile directory already on the local client, taking -the newest folders and short-cuts from each set. -</para> - -<para> -If you have made the folders / files read-only on the samba server, -then you will get errors from the w95 machine on logon and logout, as -it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the w95 machine, check the Unix file -permissions and ownership rights on the profile directory contents, -on the samba server. -</para> - -<para> -If you have problems creating user profiles, you can reset the user's -local desktop cache, as shown below. When this user then next logs in, -they will be told that they are logging in "for the first time". -</para> - -<orderedlist> -<listitem> - <para> - instead of logging in under the [user, password, domain] dialog, - press escape. - </para> -</listitem> - -<listitem> - <para> - run the regedit.exe program, and look in: - </para> - - <para> - HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList - </para> - - <para> - you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), - then delete the key ProfilePath for the required user. - </para> +<title>Remote Server Administration</title> - <para> - [Exit the registry editor]. - </para> -</listitem> - -<listitem> - <para> - <emphasis>WARNING</emphasis> - before deleting the contents of the - directory listed in - the ProfilePath (this is likely to be c:\windows\profiles\username), - ask them if they have any important files stored on their desktop - or in their start menu. delete the contents of the directory - ProfilePath (making a backup if any of the files are needed). - </para> - - <para> - This will have the effect of removing the local (read-only hidden - system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. - </para> -</listitem> - -<listitem> - <para> - search for the user's .PWL password-caching file in the c:\windows - directory, and delete it. - </para> -</listitem> - - -<listitem> - <para> - log off the windows 95 client. - </para> -</listitem> - -<listitem> - <para> - check the contents of the profile path (see "logon path" described - above), and delete the user.DAT or user.MAN file for the user, - making a backup if required. - </para> -</listitem> - -</orderedlist> - -<para> -If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as tcpdump or netmon.exe, and -look for any error reports. -</para> - -<para> -If you have access to an NT server, then first set up roaming profiles -and / or netlogons on the NT server. Make a packet trace, or examine -the example packet traces provided with NT server, and see what the -differences are with the equivalent samba trace. -</para> - -</sect2> - -<sect2> -<title>Windows NT Workstation 4.0</title> - -<para> -When a user first logs in to a Windows NT Workstation, the profile -NTuser.DAT is created. The profile location can be now specified -through the "logon path" parameter. -</para> - -<para> -There is a parameter that is now available for use with NT Profiles: -"logon drive". This should be set to "h:" or any other drive, and -should be used in conjunction with the new "logon home" parameter. -</para> - -<para> -The entry for the NT 4.0 profile is a _directory_ not a file. The NT -help on profiles mentions that a directory is also created with a .PDS -extension. The user, while logging in, must have write permission to -create the full profile path (and the folder with the .PDS extension -for those situations where it might be created.) -</para> <para> -In the profile directory, NT creates more folders than 95. It creates -"Application Data" and others, as well as "Desktop", "Nethood", -"Start Menu" and "Programs". The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and -its purpose is currently unknown. +<emphasis>How do I get 'User Manager' and 'Server Manager'</emphasis> </para> <para> -You can use the System Control Panel to copy a local profile onto -a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN -turns a profile into a mandatory one. +Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for Domains', +the 'Server Manager'? </para> <para> -The case of the profile is significant. The file must be called -NTuser.DAT or, for a mandatory profile, NTuser.MAN. -</para> - -</sect2> - -<sect2> -<title>Windows NT/200x Server</title> - -<para> -There is nothing to stop you specifying any path that you like for the -location of users' profiles. Therefore, you could specify that the -profile be stored on a samba server, or any other SMB server, as long as -that SMB server supports encrypted passwords. -</para> - -</sect2> - -<sect2> -<title>Sharing Profiles between W9x/Me and NT4/200x/XP workstations</title> - -<para> -Sharing of desktop profiles between Windows versions is NOT recommended. -Desktop profiles are an evolving phenomenon and profiles for later versions -of MS Windows clients add features that may interfere with earlier versions -of MS Windows clients. Probably the more salient reason to NOT mix profiles -is that when logging off an earlier version of MS Windows the older format -of profile contents may overwrite information that belongs to the newer -version resulting in loss of profile information content when that user logs -on again with the newer version of MS Windows. -</para> - -<para> -If you then want to share the same Start Menu / Desktop with W9x/Me, you will -need to specify a common location for the profiles. The smb.conf parameters -that need to be common are <emphasis>logon path</emphasis> and -<emphasis>logon home</emphasis>. -</para> - -<para> -If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory. -</para> - -</sect2> - - -<sect2> -<title>Windows NT 4</title> - -<para> -Unfortunately, the Resource Kit info is Win NT4 or 200x specific. -</para> - -<para> -Here is a quick guide: +Microsoft distributes a version of these tools called nexus for installation on Windows 95 +systems. The tools set includes: </para> <itemizedlist> + <listitem><para>Server Manager</para></listitem> + + <listitem><para>User Manager for Domains</para></listitem> -<listitem><para> -On your NT4 Domain Controller, right click on 'My Computer', then -select the tab labelled 'User Profiles'. -</para></listitem> - -<listitem><para> -Select a user profile you want to migrate and click on it. -</para> - -<note><para>I am using the term "migrate" lossely. You can copy a profile to -create a group profile. You can give the user 'Everyone' rights to the -profile you copy this to. That is what you need to do, since your samba -domain is not a member of a trust relationship with your NT4 PDC.</para></note> -</listitem> - -<listitem><para>Click the 'Copy To' button.</para></listitem> - -<listitem><para>In the box labelled 'Copy Profile to' add your new path, eg: -<filename>c:\temp\foobar</filename></para></listitem> - -<listitem><para>Click on the button labelled 'Change' in the "Permitted to use" box.</para></listitem> - -<listitem><para>Click on the group 'Everyone' and then click OK. This closes the -'chose user' box.</para></listitem> - -<listitem><para>Now click OK.</para></listitem> -</itemizedlist> - -<para> -Follow the above for every profile you need to migrate. -</para> - -<sect3> -<title>Side bar Notes</title> - -<para> -You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page.</para> - -<para> -With Samba-3.0.0 alpha code you can import all you NT4 domain accounts -using the net samsync method. This way you can retain your profile -settings as well as all your users. -</para> - -</sect3> - -<sect3> -<title>Mandatory profiles</title> - -<para> -The above method can be used to create mandatory profiles also. To convert -a group profile into a mandatory profile simply locate the NTUser.DAT file -in the copied profile and rename it to NTUser.MAN. -</para> - -</sect3> - -<sect3> -<title>moveuser.exe</title> - -<para> -The W2K professional resource kit has moveuser.exe. moveuser.exe changes -the security of a profile from one user to another. This allows the account -domain to change, and/or the user name to change. -</para> - -</sect3> - -<sect3> -<title>Get SID</title> - -<para> -You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 -Resource Kit. -</para> - -<para> -Windows NT 4.0 stores the local profile information in the registry under -the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList -</para> - -<para> -Under the ProfileList key, there will be subkeys named with the SIDs of the -users who have logged on to this computer. (To find the profile information -for the user whose locally cached profile you want to move, find the SID for -the user with the GetSID.exe utility.) Inside of the appropriate user's -subkey, you will see a string value named ProfileImagePath. -</para> - -</sect3> - -</sect2> - -<sect2> -<title>Windows 2000/XP</title> - -<para> -You must first convert the profile from a local profile to a domain -profile on the MS Windows workstation as follows: -</para> - -<itemizedlist> -<listitem><para> -Log on as the LOCAL workstation administrator. -</para></listitem> - -<listitem><para> -Right click on the 'My Computer' Icon, select 'Properties' -</para></listitem> - -<listitem><para> -Click on the 'User Profiles' tab -</para></listitem> - -<listitem><para> -Select the profile you wish to convert (click on it once) -</para></listitem> - -<listitem><para> -Click on the button 'Copy To' -</para></listitem> - -<listitem><para> -In the "Permitted to use" box, click on the 'Change' button. -</para></listitem> - -<listitem><para> -Click on the 'Look in" area that lists the machine name, when you click -here it will open up a selection box. Click on the domain to which the -profile must be accessible. -</para> - -<note><para>You will need to log on if a logon box opens up. Eg: In the connect -as: MIDEARTH\root, password: mypassword.</para></note> -</listitem> - -<listitem><para> -To make the profile capable of being used by anyone select 'Everyone' -</para></listitem> - -<listitem><para> -Click OK. The Selection box will close. -</para></listitem> - -<listitem><para> -Now click on the 'Ok' button to create the profile in the path you -nominated. -</para></listitem> + <listitem><para>Event Viewer</para></listitem> </itemizedlist> <para> -Done. You now have a profile that can be editted using the samba-3.0.0 -profiles tool. +Click here to download the archived file <ulink +url="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</ulink> </para> -<note> <para> -Under NT/2K the use of mandotory profiles forces the use of MS Exchange -storage of mail data. That keeps desktop profiles usable. +The Windows NT 4.0 version of the 'User Manager for +Domains' and 'Server Manager' are available from Microsoft via ftp +from <ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</ulink> </para> -</note> - -<note> -<itemizedlist> -<listitem><para> -This is a security check new to Windows XP (or maybe only -Windows XP service pack 1). It can be disabled via a group policy in -Active Directory. The policy is:</para> -<para>"Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders"</para> - -<para>...and it should be set to "Enabled". -Does the new version of samba have an Active Directory analogue? If so, -then you may be able to set the policy through this. -</para> - -<para> -If you cannot set group policies in samba, then you may be able to set -the policy locally on each machine. If you want to try this, then do -the following (N.B. I don't know for sure that this will work in the -same way as a domain group policy): -</para> - -</listitem> - -<listitem><para> -On the XP workstation log in with an Administrator account. -</para></listitem> - -<listitem><para>Click: "Start", "Run"</para></listitem> -<listitem><para>Type: "mmc"</para></listitem> -<listitem><para>Click: "OK"</para></listitem> - -<listitem><para>A Microsoft Management Console should appear.</para></listitem> -<listitem><para>Click: File, "Add/Remove Snap-in...", "Add"</para></listitem> -<listitem><para>Double-Click: "Group Policy"</para></listitem> -<listitem><para>Click: "Finish", "Close"</para></listitem> -<listitem><para>Click: "OK"</para></listitem> - -<listitem><para>In the "Console Root" window:</para></listitem> -<listitem><para>Expand: "Local Computer Policy", "Computer Configuration",</para></listitem> -<listitem><para>"Administrative Templates", "System", "User Profiles"</para></listitem> -<listitem><para>Double-Click: "Do not check for user ownership of Roaming Profile</para></listitem> -<listitem><para>Folders"</para></listitem> -<listitem><para>Select: "Enabled"</para></listitem> -<listitem><para>Click: OK"</para></listitem> - -<listitem><para>Close the whole console. You do not need to save the settings (this -refers to the console settings rather than the policies you have -changed).</para></listitem> - -<listitem><para>Reboot</para></listitem> -</itemizedlist> -</note> - -</sect2> </sect1> + </chapter> diff --git a/docs/docbook/projdoc/PolicyMgmt.sgml b/docs/docbook/projdoc/PolicyMgmt.sgml new file mode 100644 index 0000000000..d9d2495673 --- /dev/null +++ b/docs/docbook/projdoc/PolicyMgmt.sgml @@ -0,0 +1,261 @@ +<chapter id="PolicyMgmt"> +<chapterinfo> + <author> + <firstname>John H</firstname><surname>Terpstra</surname> + <affiliation> + <orgname>Samba Team</orgname> + <address> + <email>jht@samba.org</email> + </address> + </affiliation> + </author> + <pubdate>April 3 2003</pubdate> +</chapterinfo> +<title>Policy Management - Hows and Whys</title> + +<sect1> +<title>System Policies</title> + +<para> +Under MS Windows platforms, particularly those following the release of MS Windows +NT4 and MS Windows 95) it is possible to create a type of file that would be placed +in the NETLOGON share of a domain controller. As the client logs onto the network +this file is read and the contents initiate changes to the registry of the client +machine. This file allows changes to be made to those parts of the registry that +affect users, groups of users, or machines. +</para> + +<para> +For MS Windows 9x/Me this file must be called <filename>Config.POL</filename> and may +be generated using a tool called <filename>poledit.exe</filename>, better known as the +Policy Editor. The policy editor was provided on the Windows 98 installation CD, but +dissappeared again with the introduction of MS Windows Me (Millenium Edition). From +comments from MS Windows network administrators it would appear that this tool became +a part of the MS Windows Me Resource Kit. +</para> + +<para> +MS Windows NT4 Server products include the <emphasis>System Policy Editor</emphasis> +under the <filename>Start->Programs->Administrative Tools</filename> menu item. +For MS Windows NT4 and later clients this file must be called <filename>NTConfig.POL</filename>. +</para> + +<para> +New with the introduction of MS Windows 2000 was the Microsoft Management Console +or MMC. This tool is the new wave in the ever changing landscape of Microsoft +methods for management of network access and security. Every new Microsoft product +or technology seems to obsolete the old rules and to introduce newer and more +complex tools and methods. To Microsoft's credit though, the MMC does appear to +be a step forward, but improved functionality comes at a great price. +</para> + +<para> +Before embarking on the configuration of network and system policies it is highly +advisable to read the documentation available from Microsoft's web site from +<ulink url="http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp"> +Implementing Profiles and Policies in Windows NT 4.0</ulink> available from Microsoft. +There are a large number of documents in addition to this old one that should also +be read and understood. Try searching on the Microsoft web site for "Group Policies". +</para> + +<para> +What follows is a very discussion with some helpful notes. The information provided +here is incomplete - you are warned. +</para> + +<sect2> +<title>Creating and Managing Windows 9x/Me Policies</title> + +<para> +You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. +It can be found on the Original full product Win98 installation CD under +<filename>tools/reskit/netadmin/poledit</filename>. You install this using the +Add/Remove Programs facility and then click on the 'Have Disk' tab. +</para> + +<para> +Use the Group Policy Editor to create a policy file that specifies the location of +user profiles and/or the <filename>My Documents</filename> etc. stuff. You then +save these settings in a file called <filename>Config.POL</filename> that needs to +be placed in the root of the [NETLOGON] share. If your Win98 is configured to log onto +the Samba Domain, it will automatically read this file and update the Win9x/Me registry +of the machine that is logging on. +</para> + +<para> +Further details are covered in the Win98 Resource Kit documentation. +</para> + +<para> +If you do not do it this way, then every so often Win9x/Me will check the +integrity of the registry and will restore it's settings from the back-up +copy of the registry it stores on each Win9x/Me machine. Hence, you will +occasionally notice things changing back to the original settings. +</para> + +<para> +Install the group policy handler for Win9x to pick up group policies. Look on the +Win98 CD in <filename>\tools\reskit\netadmin\poledit</filename>. +Install group policies on a Win9x client by double-clicking +<filename>grouppol.inf</filename>. Log off and on again a couple of times and see +if Win98 picks up group policies. Unfortunately this needs to be done on every +Win9x/Me machine that uses group policies. +</para> + +</sect2> +<sect2> +<title>Creating and Managing Windows NT4 Style Policy Files</title> + +<para> +To create or edit <filename>ntconfig.pol</filename> you must use the NT Server +Policy Editor, <command>poledit.exe</command> which is included with NT4 Server +but <emphasis>not NT Workstation</emphasis>. There is a Policy Editor on a NT4 +Workstation but it is not suitable for creating <emphasis>Domain Policies</emphasis>. +Further, although the Windows 95 Policy Editor can be installed on an NT4 +Workstation/Server, it will not work with NT clients. However, the files from +the NT Server will run happily enough on an NT4 Workstation. +</para> + +<para> +You need <filename>poledit.exe, common.adm</filename> and <filename>winnt.adm</filename>. +It is convenient to put the two *.adm files in the <filename>c:\winnt\inf</filename> +directory which is where the binary will look for them unless told otherwise. Note also that that +directory is normally 'hidden'. +</para> + +<para> +The Windows NT policy editor is also included with the Service Pack 3 (and +later) for Windows NT 4.0. Extract the files using <command>servicepackname /x</command>, +i.e. that's <command>Nt4sp6ai.exe /x</command> for service pack 6a. The policy editor, +<command>poledit.exe</command> and the associated template files (*.adm) should +be extracted as well. It is also possible to downloaded the policy template +files for Office97 and get a copy of the policy editor. Another possible +location is with the Zero Administration Kit available for download from Microsoft. +</para> + +<sect3> +<title>Registry Tattoos</title> + +<para> +With NT4 style registry based policy changes, a large number of settings are not +automatically reversed as the user logs off. Since the settings that were in the +NTConfig.POL file were applied to the client machine registry and that apply to the +hive key HKEY_LOCAL_MACHINE are permanent until explicitly reveresd. This is known +as tattooing. It can have serious consequences down-stream and the administrator must +be extreemly careful not to lock out the ability to manage the machine at a later date. +</para> + + +</sect3> +</sect2> +<sect2> +<title>Creating and Managing MS Windows 200x Policies</title> + +<para> +Windows NT4 System policies allows setting of registry parameters specific to +users, groups and computers (client workstations) that are members of the NT4 +style domain. Such policy file will work with MS Windows 2000 / XP clients also. +</para> + +<para> +New to MS Windows 2000 Microsoft introduced a new style of group policy that confers +a superset of capabilities compared with NT4 style policies. Obviously, the tool used +to create them is different, and the mechanism for implementing them is much changed. +</para> + +<para> +The older NT4 style registry based policies are known as <emphasis>Administrative Templates</emphasis> +in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security +configurations, enforce Internet Explorer browser settings, change and redirect aspects of the +users' desktop (including: the location of <emphasis>My Documents</emphasis> files (directory), as +well as intrinsics of where menu items will appear in the Start menu). An additional new +feature is the ability to make available particular software Windows applications to particular +users and/or groups. +</para> + +<para> +Remember: NT4 policy files are named <filename>NTConfig.POL</filename> and are stored in the root +of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password +and selects the domain name to which the logon will attempt to take place. During the logon +process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating +server, modifies the local registry values according to the settings in this file. +</para> + +<para> +Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of +a Windows 200x policy file is stored in the Active Directory itself and the other part is stored +in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active +Directory domain controllers. The part that is stored in the Active Directory itself is called the +group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is +known as the group policy template (GPT). +</para> + +<para> +With NT4 clients the policy file is read and executed upon only aas each user log onto the network. +MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine +startup (machine specific part) and when the user logs onto the network the user specific part +is applied. In MS Windows 200x style policy management each machine and/or user may be subject +to any number of concurently applicable (and applied) policy sets (GPOs). Active Directory allows +the administrator to also set filters over the policy settings. No such equivalent capability +exists with NT4 style policy files. +</para> + +<sect3> +<title>Administration of Win2K Policies</title> + +<para> +Instead of using the tool called "The System Policy Editor", commonly called Poledit (from the +executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console +(MMC) snap-in as follows: +</para> + +<itemizedlist> + <listitem> + <para> + Go to the Windows 200x / XP menu <filename>Start->Programs->Adminsitrative Tools</filename> + and select the MMC snap-in called "Active Directory Users and Computers" + <para> + </listitem> + + <listitem> + <para> + Select the domain or organizational unit (OU) that you wish to manage, then right click + to open the context menu for that object, select the properties item. + </para> + </listitem> + + <listitem> + <para> + Now left click on the Group Policy tab, then left click on the New tab. Type a name + for the new policy you will create. + </para> + </listitem> + + <listitem> + <para> + Now left click on the Edit tab to commence the steps needed to create the GPO. + </para> + </listitem> +</intemizedlist> + +<para> +All policy configuration options are controlled through the use of policy administrative +templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. +Beware however, since the .adm files are NOT interchangible across NT4 and Windows 200x. +The later introduces many new features as well as extended definition capabilities. It is +well beyond the scope of this documentation to explain how to program .adm files, for that +the adminsitrator is referred to the Microsoft Windows Resource Kit for your particular +version of MS Windows. +</para> + +<note> +<para> +The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used +to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you +use this powerful tool. Please refer to the resource kit manuals for specific usage information. +</para> +</note> + +</sect2> +</sect1> +</chapter> diff --git a/docs/docbook/projdoc/ProfileMgmt.sgml b/docs/docbook/projdoc/ProfileMgmt.sgml new file mode 100644 index 0000000000..ffbc65f767 --- /dev/null +++ b/docs/docbook/projdoc/ProfileMgmt.sgml @@ -0,0 +1,631 @@ +<chapter id="ProfileMgmt"> +<chapterinfo> + <author> + <firstname>John H</firstname><surname>Terpstra</surname> + <affiliation> + <orgname>Samba Team</orgname> + <address> + <email>jht@samba.org</email> + </address> + </affiliation> + </author> + <pubdate>April 3 2003</pubdate> +</chapterinfo> + +<title>Profile Management</title> + +<sect1> +<title>Roaming Profiles</title> + +<warning> +<para> +<emphasis>NOTE!</emphasis> Roaming profiles support is different for Win9X and WinNT. +</para> +</warning> + +<para> +Before discussing how to configure roaming profiles, it is useful to see how +Win9X and WinNT clients implement these features. +</para> + +<para> +Win9X clients send a NetUserGetInfo request to the server to get the user's +profiles location. However, the response does not have room for a separate +profiles location field, only the user's home share. This means that Win9X +profiles are restricted to being in the user's home directory. +</para> + + +<para> +WinNT clients send a NetSAMLogon RPC request, which contains many fields, +including a separate field for the location of the user's profiles. +This means that support for profiles is different for Win9X and WinNT. +</para> + +<sect2> +<title>Windows NT Configuration</title> + +<para> +To support WinNT clients, in the [global] section of smb.conf set the +following (for example): +</para> + +<para><programlisting> +logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath +</programlisting></para> + +<para> +The default for this option is \\%N\%U\profile, namely +\\sambaserver\username\profile. The \\N%\%U service is created +automatically by the [homes] service. +If you are using a samba server for the profiles, you _must_ make the +share specified in the logon path browseable. +</para> + +<note> +<para> +MS Windows NT/2K clients at times do not disconnect a connection to a server +between logons. It is recommended to NOT use the <emphasis>homes</emphasis> +meta-service name as part of the profile share path. +</para> +</note> + +</sect2> + +<sect2> +<title>Windows 9X Configuration</title> + +<para> +To support Win9X clients, you must use the "logon home" parameter. Samba has +now been fixed so that "net use /home" now works as well, and it, too, relies +on the "logon home" parameter. +</para> + +<para> +By using the logon home parameter, you are restricted to putting Win9X +profiles in the user's home directory. But wait! There is a trick you +can use. If you set the following in the [global] section of your +smb.conf file: +</para> +<para><programlisting> +logon home = \\%L\%U\.profiles +</programlisting></para> + +<para> +then your Win9X clients will dutifully put their clients in a subdirectory +of your home directory called .profiles (thus making them hidden). +</para> + +<para> +Not only that, but 'net use/home' will also work, because of a feature in +Win9X. It removes any directory stuff off the end of the home directory area +and only uses the server and share portion. That is, it looks like you +specified \\%L\%U for "logon home". +</para> + + +</sect2> + +<sect2> +<title>Win9X and WinNT Configuration</title> + +<para> +You can support profiles for both Win9X and WinNT clients by setting both the +"logon home" and "logon path" parameters. For example: +</para> + +<para><programlisting> +logon home = \\%L\%U\.profiles +logon path = \\%L\profiles\%U +</programlisting></para> + +<note> +<para> +I have not checked what 'net use /home' does on NT when "logon home" is +set as above. +</para> +</note> +</sect2> + +<sect2> +<title>Windows 9X Profile Setup</title> + +<para> +When a user first logs in on Windows 9X, the file user.DAT is created, +as are folders "Start Menu", "Desktop", "Programs" and "Nethood". +These directories and their contents will be merged with the local +versions stored in c:\windows\profiles\username on subsequent logins, +taking the most recent from each. You will need to use the [global] +options "preserve case = yes", "short preserve case = yes" and +"case sensitive = no" in order to maintain capital letters in shortcuts +in any of the profile folders. +</para> + +<para> +The user.DAT file contains all the user's preferences. If you wish to +enforce a set of preferences, rename their user.DAT file to user.MAN, +and deny them write access to this file. +</para> + +<orderedlist> +<listitem> + <para> + On the Windows 95 machine, go to Control Panel | Passwords and + select the User Profiles tab. Select the required level of + roaming preferences. Press OK, but do _not_ allow the computer + to reboot. + </para> +</listitem> + +<listitem> + <para> + On the Windows 95 machine, go to Control Panel | Network | + Client for Microsoft Networks | Preferences. Select 'Log on to + NT Domain'. Then, ensure that the Primary Logon is 'Client for + Microsoft Networks'. Press OK, and this time allow the computer + to reboot. + </para> +</listitem> + +</orderedlist> + +<para> +Under Windows 95, Profiles are downloaded from the Primary Logon. +If you have the Primary Logon as 'Client for Novell Networks', then +the profiles and logon script will be downloaded from your Novell +Server. If you have the Primary Logon as 'Windows Logon', then the +profiles will be loaded from the local machine - a bit against the +concept of roaming profiles, if you ask me. +</para> + +<para> +You will now find that the Microsoft Networks Login box contains +[user, password, domain] instead of just [user, password]. Type in +the samba server's domain name (or any other domain known to exist, +but bear in mind that the user will be authenticated against this +domain and profiles downloaded from it, if that domain logon server +supports it), user name and user's password. +</para> + +<para> +Once the user has been successfully validated, the Windows 95 machine +will inform you that 'The user has not logged on before' and asks you +if you wish to save the user's preferences? Select 'yes'. +</para> + +<para> +Once the Windows 95 client comes up with the desktop, you should be able +to examine the contents of the directory specified in the "logon path" +on the samba server and verify that the "Desktop", "Start Menu", +"Programs" and "Nethood" folders have been created. +</para> + +<para> +These folders will be cached locally on the client, and updated when +the user logs off (if you haven't made them read-only by then :-). +You will find that if the user creates further folders or short-cuts, +that the client will merge the profile contents downloaded with the +contents of the profile directory already on the local client, taking +the newest folders and short-cuts from each set. +</para> + +<para> +If you have made the folders / files read-only on the samba server, +then you will get errors from the w95 machine on logon and logout, as +it attempts to merge the local and the remote profile. Basically, if +you have any errors reported by the w95 machine, check the Unix file +permissions and ownership rights on the profile directory contents, +on the samba server. +</para> + +<para> +If you have problems creating user profiles, you can reset the user's +local desktop cache, as shown below. When this user then next logs in, +they will be told that they are logging in "for the first time". +</para> + +<orderedlist> +<listitem> + <para> + instead of logging in under the [user, password, domain] dialog, + press escape. + </para> +</listitem> +<listitem> + <para> + run the regedit.exe program, and look in: + </para> + + <para> + HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList + </para> + + <para> + you will find an entry, for each user, of ProfilePath. Note the + contents of this key (likely to be c:\windows\profiles\username), + then delete the key ProfilePath for the required user. + </para> + + <para> + [Exit the registry editor]. + </para> +</listitem> + +<listitem> + <para> + <emphasis>WARNING</emphasis> - before deleting the contents of the + directory listed in + the ProfilePath (this is likely to be c:\windows\profiles\username), + ask them if they have any important files stored on their desktop + or in their start menu. delete the contents of the directory + ProfilePath (making a backup if any of the files are needed). + </para> + + <para> + This will have the effect of removing the local (read-only hidden + system file) user.DAT in their profile directory, as well as the + local "desktop", "nethood", "start menu" and "programs" folders. + </para> +</listitem> + +<listitem> + <para> + search for the user's .PWL password-caching file in the c:\windows + directory, and delete it. + </para> +</listitem> + + +<listitem> + <para> + log off the windows 95 client. + </para> +</listitem> + +<listitem> + <para> + check the contents of the profile path (see "logon path" described + above), and delete the user.DAT or user.MAN file for the user, + making a backup if required. + </para> +</listitem> + +</orderedlist> + +<para> +If all else fails, increase samba's debug log levels to between 3 and 10, +and / or run a packet trace program such as tcpdump or netmon.exe, and +look for any error reports. +</para> + +<para> +If you have access to an NT server, then first set up roaming profiles +and / or netlogons on the NT server. Make a packet trace, or examine +the example packet traces provided with NT server, and see what the +differences are with the equivalent samba trace. +</para> + +</sect2> + +<sect2> +<title>Windows NT Workstation 4.0</title> + +<para> +When a user first logs in to a Windows NT Workstation, the profile +NTuser.DAT is created. The profile location can be now specified +through the "logon path" parameter. +</para> + +<para> +There is a parameter that is now available for use with NT Profiles: +"logon drive". This should be set to "h:" or any other drive, and +should be used in conjunction with the new "logon home" parameter. +</para> + +<para> +The entry for the NT 4.0 profile is a _directory_ not a file. The NT +help on profiles mentions that a directory is also created with a .PDS +extension. The user, while logging in, must have write permission to +create the full profile path (and the folder with the .PDS extension +for those situations where it might be created.) +</para> + +<para> +In the profile directory, NT creates more folders than 95. It creates +"Application Data" and others, as well as "Desktop", "Nethood", +"Start Menu" and "Programs". The profile itself is stored in a file +NTuser.DAT. Nothing appears to be stored in the .PDS directory, and +its purpose is currently unknown. +</para> + +<para> +You can use the System Control Panel to copy a local profile onto +a samba server (see NT Help on profiles: it is also capable of firing +up the correct location in the System Control Panel for you). The +NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN +turns a profile into a mandatory one. +</para> + +<para> +The case of the profile is significant. The file must be called +NTuser.DAT or, for a mandatory profile, NTuser.MAN. +</para> + +</sect2> + +<sect2> +<title>Windows NT/200x Server</title> + +<para> +There is nothing to stop you specifying any path that you like for the +location of users' profiles. Therefore, you could specify that the +profile be stored on a samba server, or any other SMB server, as long as +that SMB server supports encrypted passwords. +</para> + +</sect2> + +<sect2> +<title>Sharing Profiles between W9x/Me and NT4/200x/XP workstations</title> + +<para> +Sharing of desktop profiles between Windows versions is NOT recommended. +Desktop profiles are an evolving phenomenon and profiles for later versions +of MS Windows clients add features that may interfere with earlier versions +of MS Windows clients. Probably the more salient reason to NOT mix profiles +is that when logging off an earlier version of MS Windows the older format +of profile contents may overwrite information that belongs to the newer +version resulting in loss of profile information content when that user logs +on again with the newer version of MS Windows. +</para> + +<para> +If you then want to share the same Start Menu / Desktop with W9x/Me, you will +need to specify a common location for the profiles. The smb.conf parameters +that need to be common are <emphasis>logon path</emphasis> and +<emphasis>logon home</emphasis>. +</para> + +<para> +If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory. +</para> + +</sect2> + + +<sect2> +<title>Windows NT 4</title> + +<para> +Unfortunately, the Resource Kit info is Win NT4 or 200x specific. +</para> + +<para> +Here is a quick guide: +</para> + +<itemizedlist> + +<listitem><para> +On your NT4 Domain Controller, right click on 'My Computer', then +select the tab labelled 'User Profiles'. +</para></listitem> + +<listitem><para> +Select a user profile you want to migrate and click on it. +</para> + +<note><para>I am using the term "migrate" lossely. You can copy a profile to +create a group profile. You can give the user 'Everyone' rights to the +profile you copy this to. That is what you need to do, since your samba +domain is not a member of a trust relationship with your NT4 PDC.</para></note> +</listitem> + +<listitem><para>Click the 'Copy To' button.</para></listitem> + +<listitem><para>In the box labelled 'Copy Profile to' add your new path, eg: +<filename>c:\temp\foobar</filename></para></listitem> + +<listitem><para>Click on the button labelled 'Change' in the "Permitted to use" box.</para></listitem> + +<listitem><para>Click on the group 'Everyone' and then click OK. This closes the +'chose user' box.</para></listitem> + +<listitem><para>Now click OK.</para></listitem> +</itemizedlist> + +<para> +Follow the above for every profile you need to migrate. +</para> + +<sect3> +<title>Side bar Notes</title> + +<para> +You should obtain the SID of your NT4 domain. You can use smbpasswd to do +this. Read the man page.</para> + +<para> +With Samba-3.0.0 alpha code you can import all you NT4 domain accounts +using the net samsync method. This way you can retain your profile +settings as well as all your users. +</para> + +</sect3> + +<sect3> +<title>Mandatory profiles</title> + +<para> +The above method can be used to create mandatory profiles also. To convert +a group profile into a mandatory profile simply locate the NTUser.DAT file +in the copied profile and rename it to NTUser.MAN. +</para> + +</sect3> + +<sect3> +<title>moveuser.exe</title> + +<para> +The W2K professional resource kit has moveuser.exe. moveuser.exe changes +the security of a profile from one user to another. This allows the account +domain to change, and/or the user name to change. +</para> + +</sect3> + +<sect3> +<title>Get SID</title> + +<para> +You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 +Resource Kit. +</para> + +<para> +Windows NT 4.0 stores the local profile information in the registry under +the following key: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList +</para> + +<para> +Under the ProfileList key, there will be subkeys named with the SIDs of the +users who have logged on to this computer. (To find the profile information +for the user whose locally cached profile you want to move, find the SID for +the user with the GetSID.exe utility.) Inside of the appropriate user's +subkey, you will see a string value named ProfileImagePath. +</para> + +</sect3> + +</sect2> + +<sect2> +<title>Windows 2000/XP</title> + +<para> +You must first convert the profile from a local profile to a domain +profile on the MS Windows workstation as follows: +</para> + +<itemizedlist> +<listitem><para> +Log on as the LOCAL workstation administrator. +</para></listitem> + +<listitem><para> +Right click on the 'My Computer' Icon, select 'Properties' +</para></listitem> + +<listitem><para> +Click on the 'User Profiles' tab +</para></listitem> + +<listitem><para> +Select the profile you wish to convert (click on it once) +</para></listitem> + +<listitem><para> +Click on the button 'Copy To' +</para></listitem> + +<listitem><para> +In the "Permitted to use" box, click on the 'Change' button. +</para></listitem> + +<listitem><para> +Click on the 'Look in" area that lists the machine name, when you click +here it will open up a selection box. Click on the domain to which the +profile must be accessible. +</para> + + +<note><para>You will need to log on if a logon box opens up. Eg: In the connect +as: MIDEARTH\root, password: mypassword.</para></note> +</listitem> + +<listitem><para> +To make the profile capable of being used by anyone select 'Everyone' +</para></listitem> + +<listitem><para> +Click OK. The Selection box will close. +</para></listitem> + +<listitem><para> +Now click on the 'Ok' button to create the profile in the path you +nominated. +</para></listitem> +</itemizedlist> + +<para> +Done. You now have a profile that can be editted using the samba-3.0.0 +profiles tool. +</para> + +<note> +<para> +Under NT/2K the use of mandotory profiles forces the use of MS Exchange +storage of mail data. That keeps desktop profiles usable. +</para> +</note> + +<note> +<itemizedlist> +<listitem><para> +This is a security check new to Windows XP (or maybe only +Windows XP service pack 1). It can be disabled via a group policy in +Active Directory. The policy is:</para> + +<para>"Computer Configuration\Administrative Templates\System\User +Profiles\Do not check for user ownership of Roaming Profile Folders"</para> + +<para>...and it should be set to "Enabled". +Does the new version of samba have an Active Directory analogue? If so, +then you may be able to set the policy through this. +</para> + +<para> +If you cannot set group policies in samba, then you may be able to set +the policy locally on each machine. If you want to try this, then do +the following (N.B. I don't know for sure that this will work in the +same way as a domain group policy): +</para> + +</listitem> + +<listitem><para> +On the XP workstation log in with an Administrator account. +</para></listitem> + +<listitem><para>Click: "Start", "Run"</para></listitem> +<listitem><para>Type: "mmc"</para></listitem> +<listitem><para>Click: "OK"</para></listitem> + +<listitem><para>A Microsoft Management Console should appear.</para></listitem> +<listitem><para>Click: File, "Add/Remove Snap-in...", "Add"</para></listitem> +<listitem><para>Double-Click: "Group Policy"</para></listitem> +<listitem><para>Click: "Finish", "Close"</para></listitem> +<listitem><para>Click: "OK"</para></listitem> + +<listitem><para>In the "Console Root" window:</para></listitem> +<listitem><para>Expand: "Local Computer Policy", "Computer Configuration",</para></listitem> +<listitem><para>"Administrative Templates", "System", "User Profiles"</para></listitem> +<listitem><para>Double-Click: "Do not check for user ownership of Roaming Profile</para></listitem> +<listitem><para>Folders"</para></listitem> +<listitem><para>Select: "Enabled"</para></listitem> +<listitem><para>Click: OK"</para></listitem> + +<listitem><para>Close the whole console. You do not need to save the settings (this +refers to the console settings rather than the policies you have +changed).</para></listitem> + +<listitem><para>Reboot</para></listitem> +</itemizedlist> +</note> + +</sect2> +</sect1> +</chapter> diff --git a/docs/docbook/projdoc/samba-doc.sgml b/docs/docbook/projdoc/samba-doc.sgml index c002214b77..db421bc690 100644 --- a/docs/docbook/projdoc/samba-doc.sgml +++ b/docs/docbook/projdoc/samba-doc.sgml @@ -27,6 +27,8 @@ <!ENTITY unicode SYSTEM "unicode.sgml"> <!ENTITY CUPS SYSTEM "CUPS-printing.sgml"> <!ENTITY AdvancedNetworkAdmin SYSTEM "AdvancedNetworkAdmin.sgml"> +<!ENTITY PolicyMgmt SYSTEM "PolicyMgmt.sgml"> +<!ENTITY ProfileMgmt SYSTEM "ProfileMgmt.sgml"> ]> <book id="Samba-HOWTO-Collection"> @@ -115,6 +117,8 @@ part each cover one specific feature.</para> &PRINTER-DRIVER2; &CUPS; &WINBIND; +&PolicyMgmt; +&ProfileMgmt; &IntegratingWithWindows; &BROWSING; &MS-Dfs-Setup; |