diff options
Diffstat (limited to 'docs/Samba3-HOWTO/TOSHARG-PolicyMgmt.xml')
| -rw-r--r-- | docs/Samba3-HOWTO/TOSHARG-PolicyMgmt.xml | 138 |
1 files changed, 69 insertions, 69 deletions
diff --git a/docs/Samba3-HOWTO/TOSHARG-PolicyMgmt.xml b/docs/Samba3-HOWTO/TOSHARG-PolicyMgmt.xml index c529963155..b4d6b68047 100644 --- a/docs/Samba3-HOWTO/TOSHARG-PolicyMgmt.xml +++ b/docs/Samba3-HOWTO/TOSHARG-PolicyMgmt.xml @@ -12,7 +12,7 @@ This chapter summarizes the current state of knowledge derived from personal practice and knowledge from Samba mailing list subscribers. Before reproduction of posted information, every effort has been made to validate the information given. -Where additional information was uncovered through this validation it is provided +Where additional information was uncovered through this validation, it is provided also. </para> @@ -35,7 +35,7 @@ got the message: Group Policies are a good thing! They can help reduce administr costs and actually make happier users. But adoption of the true potential of MS Windows 200x Active Directory and Group Policy Objects (GPOs) for users and machines were picked up on rather slowly. This was obvious from the Samba -mailing list as in 2000 and 2001 when there were few postings regarding GPOs and +mailing list back in 2000 and 2001 when there were few postings regarding GPOs and how to replicate them in a Samba environment. </para> @@ -49,7 +49,7 @@ network client workstations. <para> A tool new to Samba &smbmdash; the <command>editreg</command> tool &smbmdash; may become an important part of the future Samba administrators' -arsenal is described in this document. +arsenal and is described in this document. </para> </sect1> @@ -60,7 +60,7 @@ arsenal is described in this document. <para> Under MS Windows platforms, particularly those following the release of MS Windows NT4 and MS Windows 95, it is possible to create a type of file that would be placed -in the NETLOGON share of a Domain Controller. As the client logs onto the network, +in the NETLOGON share of a domain controller. As the client logs onto the network, this file is read and the contents initiate changes to the registry of the client machine. This file allows changes to be made to those parts of the registry that affect users, groups of users, or machines. @@ -68,17 +68,17 @@ affect users, groups of users, or machines. <para> <indexterm><primary>Config.POL</primary></indexterm> -For MS Windows 9x/ME, this file must be called <filename>Config.POL</filename> and may +For MS Windows 9x/Me, this file must be called <filename>Config.POL</filename> and may be generated using a tool called <filename>poledit.exe</filename>, better known as the -Policy Editor. The policy editor was provided on the Windows 98 installation CD, but -disappeared again with the introduction of MS Windows Me (Millennium Edition). From +Policy Editor. The policy editor was provided on the Windows 98 installation CD-ROM, but +disappeared again with the introduction of MS Windows Me. From comments of MS Windows network administrators, it would appear that this tool became a part of the MS Windows Me Resource Kit. </para> <para> <indexterm><primary>System Policy Editor</primary></indexterm> -MS Windows NT4 Server products include the <emphasis>System Policy Editor</emphasis> +MS Windows NT4 server products include the <emphasis>System Policy Editor</emphasis> under <guimenu>Start -> Programs -> Administrative Tools</guimenu>. For MS Windows NT4 and later clients, this file must be called <filename>NTConfig.POL</filename>. </para> @@ -96,7 +96,7 @@ be a step forward, but improved functionality comes at a great price. Before embarking on the configuration of network and system policies, it is highly advisable to read the documentation available from Microsoft's Web site regarding <ulink url="http://www.microsoft.com/ntserver/techresources/management/prof_policies.asp"> -Implementing Profiles and Policies in Windows NT 4.0</ulink> available from Microsoft. +Implementing Profiles and Policies in Windows NT 4.0</ulink>. There are a large number of documents in addition to this old one that should also be read and understood. Try searching on the Microsoft Web site for <quote>Group Policies</quote>. </para> @@ -110,10 +110,10 @@ here is incomplete &smbmdash; you are warned. <title>Windows 9x/ME Policies</title> <para> - You need the Windows 98 Group Policy Editor to set up Group Profiles under Windows 9x/ME. - It can be found on the original full product Windows 98 installation CD under + You need the Windows 98 Group Policy Editor to set up Group Profiles under Windows 9x/Me. + It can be found on the original full-product Windows 98 installation CD-ROM under <filename>tools/reskit/netadmin/poledit</filename>. Install this using the - Add/Remove Programs facility and then click on <guiicon>Have Disk</guiicon>. + Add/Remove Programs facility, and then click on <guiicon>Have Disk</guiicon>. </para> @@ -123,7 +123,7 @@ here is incomplete &smbmdash; you are warned. user profiles and/or <filename>My Documents</filename>, and so on. Then save these settings in a file called <filename>Config.POL</filename> that needs to be placed in the root of the <smbconfsection name="[NETLOGON]"/> share. If Windows 98 is configured to log onto - the Samba Domain, it will automatically read this file and update the Windows 9x/Me registry + the Samba domain, it will automatically read this file and update the Windows 9x/Me registry of the machine as it logs on. </para> @@ -132,16 +132,16 @@ here is incomplete &smbmdash; you are warned. </para> <para> - If you do not take the correct steps, then every so often Windows 9x/ME will check the - integrity of the registry and restore its settings from the back-up - copy of the registry it stores on each Windows 9x/ME machine. So, you will + If you do not take the correct steps, then every so often Windows 9x/Me will check the + integrity of the registry and restore its settings from the backup + copy of the registry it stores on each Windows 9x/Me machine. So, you will occasionally notice things changing back to the original settings. </para> <para> - Install the group policy handler for Windows 9x/Me to pick up Group Policies. Look on the - Windows 98 CDROM in <filename>\tools\reskit\netadmin\poledit</filename>. - Install group policies on a Windows 9x/Me client by double-clicking on + Install the Group Policy handler for Windows 9x/Me to pick up Group Policies. Look on the + Windows 98 CD-ROM in <filename>\tools\reskit\netadmin\poledit</filename>. + Install Group Policies on a Windows 9x/Me client by double-clicking on <filename>grouppol.inf</filename>. Log off and on again a couple of times and see if Windows 98 picks up Group Policies. Unfortunately, this needs to be done on every Windows 9x/Me machine that uses Group Policies. @@ -152,28 +152,28 @@ here is incomplete &smbmdash; you are warned. <title>Windows NT4-Style Policy Files</title> <para> - To create or edit <filename>ntconfig.pol</filename> you must use the NT Server + To create or edit <filename>ntconfig.pol</filename>, you must use the NT Server Policy Editor, <command>poledit.exe</command>, which is included with NT4 Server - but not with NT Workstation. There is a Policy Editor on an NT4 + but not with NT workstation. There is a Policy Editor on an NT4 Workstation but it is not suitable for creating domain policies. Furthermore, although the Windows 95 Policy Editor can be installed on an NT4 - Workstation/Server, it will not work with NT clients. However, the files from - the NT Server will run happily enough on an NT4 Workstation. + workstation/server, it will not work with NT clients. However, the files from + the NT Server will run happily enough on an NT4 workstation. </para> <para> - You need <filename>poledit.exe</filename>, <filename>common.adm</filename> and <filename>winnt.adm</filename>. + You need <filename>poledit.exe</filename>, <filename>common.adm</filename>, and <filename>winnt.adm</filename>. It is convenient to put the two <filename>*.adm</filename> files in the <filename>c:\winnt\inf</filename> directory, which is where the binary will look for them unless told otherwise. This directory is normally <quote>hidden.</quote> </para> <para> - The Windows NT policy editor is also included with the Service Pack 3 (and - later) for Windows NT 4.0. Extract the files using <command>servicepackname /x</command>, - that's <command>Nt4sp6ai.exe /x</command> for service pack 6a. The Policy Editor, + The Windows NT Policy Editor is also included with the Service Pack 3 (and + later) for Windows NT 4.0. Extract the files using <command>servicepackname /x</command> + &smbmdash; that's <command>Nt4sp6ai.exe /x</command> for service pack 6a. The Policy Editor, <command>poledit.exe</command>, and the associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template + be extracted as well. It is also possible to download the policy template files for Office97 and get a copy of the Policy Editor. Another possible location is with the Zero Administration Kit available for download from Microsoft. </para> @@ -186,7 +186,7 @@ here is incomplete &smbmdash; you are warned. automatically reversed as the user logs off. The settings that were in the <filename>NTConfig.POL</filename> file were applied to the client machine registry and apply to the hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known - as tattooing. It can have serious consequences downstream and the administrator must + as tattooing. It can have serious consequences downstream, and the administrator must be extremely careful not to lock out the ability to manage the machine at a later date. </para> @@ -197,22 +197,22 @@ here is incomplete &smbmdash; you are warned. <para> Windows NT4 system policies allow the setting of registry parameters specific to - users, groups and computers (client workstations) that are members of the NT4-style + users, groups, and computers (client workstations) that are members of the NT4-style domain. Such policy files will work with MS Windows 200x/XP clients also. </para> <para> - New to MS Windows 2000, Microsoft recently introduced a style of group policy that confers + New to MS Windows 2000, Microsoft recently introduced a style of Group Policy that confers a superset of capabilities compared with NT4-style policies. Obviously, the tool used to create them is different, and the mechanism for implementing them is much improved. </para> <para> -<indexterm><primary>GPOs</primary></indexterm> + <indexterm><primary>GPOs</primary></indexterm> The older NT4-style registry-based policies are known as <emphasis>Administrative Templates</emphasis> - in MS Windows 2000/XP Group Policy Objects (GPOs). The latter includes the ability to set various security + in MS Windows 2000/XP GPOs. The latter includes the ability to set various security configurations, enforce Internet Explorer browser settings, change and redirect aspects of the - users desktop (including the location of <filename>My Documents</filename> files (directory), as + users desktop (including the location of <filename>My Documents</filename> files, as well as intrinsics of where menu items will appear in the Start menu). An additional new feature is the ability to make available particular software Windows applications to particular users and/or groups. @@ -220,7 +220,7 @@ here is incomplete &smbmdash; you are warned. <para> Remember, NT4 policy files are named <filename>NTConfig.POL</filename> and are stored in the root - of the NETLOGON share on the Domain Controllers. A Windows NT4 user enters a username, password + of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username and password and selects the domain name to which the logon will attempt to take place. During the logon process, the client machine reads the <filename>NTConfig.POL</filename> file from the NETLOGON share on the authenticating server and modifies the local registry values according to the settings in this file. @@ -230,7 +230,7 @@ here is incomplete &smbmdash; you are warned. Windows 200x GPOs are feature-rich. They are not stored in the NETLOGON share, but rather part of a Windows 200x policy file is stored in the Active Directory itself and the other part is stored in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active - Directory Domain Controllers. The part that is stored in the Active Directory itself is called the + Directory domain controllers. The part that is stored in the Active Directory itself is called the Group Policy Container (GPC), and the part that is stored in the replicated share called SYSVOL is known as the Group Policy Template (GPT). </para> @@ -238,7 +238,7 @@ here is incomplete &smbmdash; you are warned. <para> With NT4 clients, the policy file is read and executed only as each user logs onto the network. MS Windows 200x policies are much more complex &smbmdash; GPOs are processed and applied at client machine - startup (machine specific part) and when the user logs onto the network, the user-specific part + startup (machine specific part), and when the user logs onto the network, the user-specific part is applied. In MS Windows 200x-style policy management, each machine and/or user may be subject to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows the administrator to also set filters over the policy settings. No such equivalent capability @@ -249,9 +249,9 @@ here is incomplete &smbmdash; you are warned. <title>Administration of Windows 200x/XP Policies</title> <para> -<indexterm><primary>GPOs</primary></indexterm> -<indexterm><primary>System Policy Editor</primary></indexterm> - Instead of using the tool called <application>The System Policy Editor</application>, commonly called Poledit (from the + <indexterm><primary>GPOs</primary></indexterm> + <indexterm><primary>System Policy Editor</primary></indexterm> + Instead of using the tool called <application>the System Policy Editor</application>, commonly called Poledit (from the executable name <command>poledit.exe</command>), <acronym>GPOs</acronym> are created and managed using a <application>Microsoft Management Console</application> <acronym>(MMC)</acronym> snap-in as follows:</para> <procedure> @@ -281,8 +281,8 @@ here is incomplete &smbmdash; you are warned. templates. These files have an .adm extension, both in NT4 as well as in Windows 200x/XP. Beware, however, the .adm files are not interchangeable across NT4 and Windows 200x. The latter introduces many new features as well as extended definition capabilities. It is - well beyond the scope of this documentation to explain how to program .adm files; for that - the administrator is referred to the Microsoft Windows Resource Kit for your particular + well beyond the scope of this documentation to explain how to program .adm files; for that, + refer to the Microsoft Windows Resource Kit for your particular version of MS Windows. </para> @@ -309,7 +309,7 @@ the policy file. Separate policy files for each user, group, or computer are not <para> <indexterm><primary>NTConfig.POL</primary></indexterm> -If you create a policy that will be automatically downloaded from validating Domain Controllers, +If you create a policy that will be automatically downloaded from validating domain controllers, you should name the file <filename>NTConfig.POL</filename>. As system administrator, you have the option of renaming the policy file and, by modifying the Windows NT-based workstation, directing the computer to update the policy from a manual path. You can do this by either manually changing the registry or by using @@ -319,22 +319,22 @@ but if a change is necessary to all machines, it must be made individually to ea <para> When a Windows NT4/200x/XP machine logs onto the network, the client looks in the NETLOGON share on -the authenticating domain controller for the presence of the NTConfig.POL file. If one exists it is -downloaded, parsed and then applied to the user's part of the registry. +the authenticating domain controller for the presence of the NTConfig.POL file. If one exists, it is +downloaded, parsed, and then applied to the user's part of the registry. </para> <para> <indexterm><primary>GPOs</primary></indexterm> MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally -acquire policy settings through Group Policy Objects (GPOs) that are defined and stored in Active Directory -itself. The key benefit of using AS GPOs is that they impose no registry <emphasis>spoiling</emphasis> effect. +acquire policy settings through GPOs that are defined and stored in Active Directory +itself. The key benefit of using AD GPOs is that they impose no registry <emphasis>spoiling</emphasis> effect. This has considerable advantage compared with the use of <filename>NTConfig.POL</filename> (NT4) style policy updates. </para> <para> In addition to user access controls that may be imposed or applied via system and/or group policies in a manner that works in conjunction with user profiles, the user management environment under -MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied. +MS Windows NT4/200x/XP allows per-domain as well as per-user account restrictions to be applied. Common restrictions that are frequently used include: </para> @@ -363,17 +363,17 @@ parameter can be set using the NT4 Domain User Manager or in the <filename>NTCon <para> Anyone who wishes to create or manage Group Policies will need to be familiar with a number of tools. -The following sections describe a few key tools that will help you to create a low maintenance user +The following sections describe a few key tools that will help you to create a low-maintenance user environment. </para> <sect2> - <title>Samba Editreg Tool-set</title> + <title>Samba Editreg Toolset</title> <para> -<indexterm><primary>editreg</primary></indexterm> -<indexterm><primary>NTUser.DAT</primary></indexterm> -<indexterm><primary>NTConfig.POL</primary></indexterm> + <indexterm><primary>editreg</primary></indexterm> + <indexterm><primary>NTUser.DAT</primary></indexterm> + <indexterm><primary>NTConfig.POL</primary></indexterm> A new tool called <command>editreg</command> is under development. This tool can be used to edit registry files (called <filename>NTUser.DAT</filename>) that are stored in user and group profiles. <filename>NTConfig.POL</filename> files have the same structure as the @@ -390,9 +390,9 @@ environment. <title>Windows NT4/200x</title> <para> - The tools that may be used to configure these types of controls from the MS Windows environment are: + The tools that may be used to configure these types of controls from the MS Windows environment are the NT4 User Manager for Domains, the NT4 System and Group Policy Editor, and the Registry Editor (regedt32.exe). - Under MS Windows 200x/XP, this is done using the Microsoft Management Console (MMC) with appropriate + Under MS Windows 200x/XP, this is done using the MMC with appropriate <quote>snap-ins,</quote> the registry editor, and potentially also the NT4 System and Group Policy Editor. </para> </sect2> @@ -401,8 +401,8 @@ environment. <title>Samba PDC</title> <para> - With a Samba Domain Controller, the new tools for managing user account and policy information include: - <command>smbpasswd</command>, <command>pdbedit</command>, <command>net</command>, <command>rpcclient</command>. + With a Samba domain controller, the new tools for managing user account and policy information include: + <command>smbpasswd</command>, <command>pdbedit</command>, <command>net</command>, and <command>rpcclient</command>. The administrator should read the man pages for these tools and become familiar with their use. </para> @@ -419,15 +419,15 @@ reboot and as part of the user logon: <orderedlist> <listitem><para> - Network starts, then Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming - Convention Provider (MUP) start. + Network starts, then Remote Procedure Call System Service (RPCSS) and multiple universal naming + convention provider (MUP) start. </para></listitem> <listitem><para> - Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded + Where Active Directory is involved, an ordered list of GPOs is downloaded and applied. The list may include GPOs that: <itemizedlist> - <listitem><para>Apply to the location of machines in a Directory.</para></listitem> + <listitem><para>Apply to the location of machines in a directory.</para></listitem> <listitem><para>Apply only when settings have changed.</para></listitem> <listitem><para>Depend on configuration of the scope of applicability: local, site, domain, organizational unit, and so on.</para></listitem> @@ -436,7 +436,7 @@ reboot and as part of the user logon: </para></listitem> <listitem><para> - Execution of start-up scripts (hidden and synchronous by default). + Execution of startup scripts (hidden and synchronous by default). </para></listitem> <listitem><para> @@ -451,26 +451,26 @@ reboot and as part of the user logon: An ordered list of user GPOs is obtained. The list contents depends on what is configured in respect of: <itemizedlist> - <listitem><para>Is the user a Domain Member, thus subject to particular policies?</para></listitem> - <listitem><para>Loopback enablement, and the state of the loopback policy (Merge or Replace).</para></listitem> + <listitem><para>Is the user a domain member, thus subject to particular policies?</para></listitem> + <listitem><para>Loopback enablement, and the state of the loopback policy (merge or replace).</para></listitem> <listitem><para>Location of the Active Directory itself.</para></listitem> <listitem><para>Has the list of GPOs changed? No processing is needed if not changed.</para></listitem> </itemizedlist> </para></listitem> <listitem><para> - User Policies are applied from Active Directory. Note: There are several types. + User policies are applied from Active Directory. Note: There are several types. </para></listitem> <listitem><para> - Logon scripts are run. New to Windows 200x and Active Directory, logon scripts may be obtained based on Group - Policy objects (hidden and executed synchronously). NT4-style logon scripts are then run in a normal + Logon scripts are run. New to Windows 200x and Active Directory, logon scripts may be obtained based on GPOs + (hidden and executed synchronously). NT4-style logon scripts are then run in a normal window. </para></listitem> <listitem><para> - The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like an NT4 - Domain), machine (system) policies are applied at start-up; user policies are applied at logon. + The user interface as determined from the GPOs is presented. Note: In a Samba domain (like an NT4 + domain), machine (system) policies are applied at startup; user policies are applied at logon. </para></listitem> </orderedlist> |