diff options
Diffstat (limited to 'docs/Samba3-HOWTO/TOSHARG-TheNetCommand.xml')
| -rw-r--r-- | docs/Samba3-HOWTO/TOSHARG-TheNetCommand.xml | 78 |
1 files changed, 74 insertions, 4 deletions
diff --git a/docs/Samba3-HOWTO/TOSHARG-TheNetCommand.xml b/docs/Samba3-HOWTO/TOSHARG-TheNetCommand.xml index 2b73a06392..7231bdaf21 100644 --- a/docs/Samba3-HOWTO/TOSHARG-TheNetCommand.xml +++ b/docs/Samba3-HOWTO/TOSHARG-TheNetCommand.xml @@ -224,8 +224,8 @@ SupportEngrs (S-1-5-21-72630-4128915-11681869-3007) -> SupportEngrs </para> <para> - The operations that are permitted include: <constant>add</constant>, <constant>modify</constant>, and <constant>delete</constant>. An example - of each operation is shown here. + The operations that are permitted include: <constant>add</constant>, <constant>modify</constant>, + and <constant>delete</constant>. An example of each operation is shown here. </para> <para> @@ -296,7 +296,7 @@ SupportEngrs (S-1-5-21-72630-4128915-11681869-3007) -> SupportEngrs </sect2> - <sect2> + <sect2 id="grpmemshipchg"> <title>Manipulating Group Memberships</title> <para> @@ -409,7 +409,7 @@ MIDEARTH\vlendecke </sect2> - <sect2> + <sect2 id="nestedgrpmgmgt"> <title>Nested Group Support</title> <para> @@ -452,6 +452,9 @@ DOM\jht </screen> </para> + <sect3> + <title>Managing Nest Groups on Workstations from the Samba Server</title> + <para> Windows network administrators often ask on the Samba mailing list how it is possible to grant everyone administrative rights on their own workstation. This is of course a very bad practice, but commonly done @@ -462,6 +465,73 @@ DOM\jht </screen> </para> + <para> + This can be scripted, and can therefore be performed as a user logs onto the domain from a Windows + workstation. Here is a simple example that shows how this can be done. + </para> + + <procedure> + <title>Automating User Addition to the Workstation Power Users Group</title> + + <step><para> + Create the script shown in <link linkend="autopoweruserscript"></link> and locate it in + the directory <filename>/etc/samba/scripts</filename>, named as <filename>autopoweruser.sh</filename>. + </para></step> + +<example id="autopoweruserscript"> +<title>Script to Auto-add Domain Users to Workstation Power Users Group</title> +<procedure> +#!/bin/bash + +/usr/bin/net rpc group addmem "Power Users" "DOMAIN_NAME\$1" -UAdministrator%secret -S $2 + +exit 0 +</procedure> +</example> + + <step><para> + Set the permissions on this script to permit it to be executed as part of the logon process: +<screen> +&rootprompt; chown root:root /etc/samba/autopoweruser.sh +&rootprompt; chmod 755 /etc/samba/autopoweruser.sh +</screen> + </para></step> + + <step><para> + Modify the &smb.conf; file so the <literal>NETLOGON</literal> stanza contains the parameters + shown in <link linkend="magicnetlogon">the Netlogon Example smb.conf file</link>. + </para></step> + +<example id="magicnetlogon"> +<title>A Magic Netlogon Share</title> +<smbconfblock> +<smbconfsection name="[netlogon]"/> +<smbconfoption name="comment">Netlogon Share</smbconfoption> +<smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption> +<smbconfoption name="root preexec">/etc/samba/scripts/autopoweruser.sh %U %m</smbconfoption> +<smbconfoption name="read only">Yes</smbconfoption> +<smbconfoption name="guest ok">Yes</smbconfoption> +</smbconfblock> +</example> + + <step><para> + Ensure that every Windows workstation Adminsitrator account has the same password that you + have used in the script shown in <link linkend="magicnetlogon">the Netlogon Example smb.conf + file</link> + </para></step> + +</procedure> + + <para> + This script will be executed every time a user logs onto the network. Therefore every user will + have local Windows workstation management rights. This could of course be assigned using a group, + in which case there is little justification for the use of this procedure. The key justification + for the use of this method is that it will guarantee that all users have appropriate rights on + the workstation. + </para> + + </sect3> + </sect2> </sect1> |