diff options
Diffstat (limited to 'docs/htmldocs/profilemgmt.html')
| -rw-r--r-- | docs/htmldocs/profilemgmt.html | 1753 |
1 files changed, 1753 insertions, 0 deletions
diff --git a/docs/htmldocs/profilemgmt.html b/docs/htmldocs/profilemgmt.html new file mode 100644 index 0000000000..8a101049e0 --- /dev/null +++ b/docs/htmldocs/profilemgmt.html @@ -0,0 +1,1753 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> +<HTML +><HEAD +><TITLE +>Desktop Profile Management</TITLE +><META +NAME="GENERATOR" +CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK +REL="HOME" +TITLE="SAMBA Project Documentation" +HREF="samba-howto-collection.html"><LINK +REL="UP" +TITLE="Advanced Configuration" +HREF="optional.html"><LINK +REL="PREVIOUS" +TITLE="System and Account Policies" +HREF="policymgmt.html"><LINK +REL="NEXT" +TITLE="Interdomain Trust Relationships" +HREF="interdomaintrusts.html"></HEAD +><BODY +CLASS="CHAPTER" +BGCOLOR="#FFFFFF" +TEXT="#000000" +LINK="#0000FF" +VLINK="#840084" +ALINK="#0000FF" +><DIV +CLASS="NAVHEADER" +><TABLE +SUMMARY="Header navigation table" +WIDTH="100%" +BORDER="0" +CELLPADDING="0" +CELLSPACING="0" +><TR +><TH +COLSPAN="3" +ALIGN="center" +>SAMBA Project Documentation</TH +></TR +><TR +><TD +WIDTH="10%" +ALIGN="left" +VALIGN="bottom" +><A +HREF="policymgmt.html" +ACCESSKEY="P" +>Prev</A +></TD +><TD +WIDTH="80%" +ALIGN="center" +VALIGN="bottom" +></TD +><TD +WIDTH="10%" +ALIGN="right" +VALIGN="bottom" +><A +HREF="interdomaintrusts.html" +ACCESSKEY="N" +>Next</A +></TD +></TR +></TABLE +><HR +ALIGN="LEFT" +WIDTH="100%"></DIV +><DIV +CLASS="CHAPTER" +><H1 +><A +NAME="PROFILEMGMT" +></A +>Chapter 18. Desktop Profile Management</H1 +><DIV +CLASS="TOC" +><DL +><DT +><B +>Table of Contents</B +></DT +><DT +>18.1. <A +HREF="profilemgmt.html#AEN3096" +>Roaming Profiles</A +></DT +><DD +><DL +><DT +>18.1.1. <A +HREF="profilemgmt.html#AEN3103" +>Samba Configuration for Profile Handling</A +></DT +><DD +><DL +><DT +>18.1.1.1. <A +HREF="profilemgmt.html#AEN3106" +>NT4/200x User Profiles</A +></DT +><DT +>18.1.1.2. <A +HREF="profilemgmt.html#AEN3116" +>Windows 9x / Me User Profiles</A +></DT +><DT +>18.1.1.3. <A +HREF="profilemgmt.html#AEN3131" +>Mixed Windows 9x / Me and Windows NT4/200x User Profiles</A +></DT +></DL +></DD +><DT +>18.1.2. <A +HREF="profilemgmt.html#AEN3138" +>Windows Client Profile Configuration Information</A +></DT +><DD +><DL +><DT +>18.1.2.1. <A +HREF="profilemgmt.html#AEN3140" +>Windows 9x / Me Profile Setup</A +></DT +><DT +>18.1.2.2. <A +HREF="profilemgmt.html#AEN3176" +>Windows NT4 Workstation</A +></DT +><DT +>18.1.2.3. <A +HREF="profilemgmt.html#AEN3185" +>Windows 2000/XP Professional</A +></DT +></DL +></DD +><DT +>18.1.3. <A +HREF="profilemgmt.html#AEN3258" +>Sharing Profiles between W9x/Me and NT4/200x/XP workstations</A +></DT +><DT +>18.1.4. <A +HREF="profilemgmt.html#AEN3265" +>Profile Migration from Windows NT4/200x Server to Samba</A +></DT +><DD +><DL +><DT +>18.1.4.1. <A +HREF="profilemgmt.html#AEN3268" +>Windows NT4 Profile Management Tools</A +></DT +><DT +>18.1.4.2. <A +HREF="profilemgmt.html#AEN3291" +>Side bar Notes</A +></DT +><DT +>18.1.4.3. <A +HREF="profilemgmt.html#AEN3295" +>moveuser.exe</A +></DT +><DT +>18.1.4.4. <A +HREF="profilemgmt.html#AEN3298" +>Get SID</A +></DT +></DL +></DD +></DL +></DD +><DT +>18.2. <A +HREF="profilemgmt.html#AEN3303" +>Mandatory profiles</A +></DT +><DT +>18.3. <A +HREF="profilemgmt.html#AEN3310" +>Creating/Managing Group Profiles</A +></DT +><DT +>18.4. <A +HREF="profilemgmt.html#AEN3316" +>Default Profile for Windows Users</A +></DT +><DD +><DL +><DT +>18.4.1. <A +HREF="profilemgmt.html#AEN3319" +>MS Windows 9x/Me</A +></DT +><DT +>18.4.2. <A +HREF="profilemgmt.html#AEN3331" +>MS Windows NT4 Workstation</A +></DT +><DT +>18.4.3. <A +HREF="profilemgmt.html#AEN3385" +>MS Windows 200x/XP</A +></DT +></DL +></DD +></DL +></DIV +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN3096" +>18.1. Roaming Profiles</A +></H1 +><DIV +CLASS="WARNING" +><P +></P +><TABLE +CLASS="WARNING" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/warning.gif" +HSPACE="5" +ALT="Warning"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +>Roaming profiles support is different for Win9x / Me and Windows NT4/200x.</P +></TD +></TR +></TABLE +></DIV +><P +>Before discussing how to configure roaming profiles, it is useful to see how +Windows 9x / Me and Windows NT4/200x clients implement these features.</P +><P +>Windows 9x / Me clients send a NetUserGetInfo request to the server to get the user's +profiles location. However, the response does not have room for a separate +profiles location field, only the user's home share. This means that Win9X/Me +profiles are restricted to being stored in the user's home directory.</P +><P +>Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields, +including a separate field for the location of the user's profiles.</P +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN3103" +>18.1.1. Samba Configuration for Profile Handling</A +></H2 +><P +>This section documents how to configure Samba for MS Windows client profile support.</P +><DIV +CLASS="SECT3" +><H3 +CLASS="SECT3" +><A +NAME="AEN3106" +>18.1.1.1. NT4/200x User Profiles</A +></H3 +><P +>To support Windowns NT4/200x clients, in the [global] section of smb.conf set the +following (for example):</P +><P +><PRE +CLASS="PROGRAMLISTING" +> logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath</PRE +> + + This is typically implemented like: + +<PRE +CLASS="PROGRAMLISTING" +> logon path = \\%L\Profiles\%u</PRE +> +where %L translates to the name of the Samba server and %u translates to the user name</P +><P +>The default for this option is \\%N\%U\profile, namely \\sambaserver\username\profile. +The \\N%\%U service is created automatically by the [homes] service. If you are using +a samba server for the profiles, you _must_ make the share specified in the logon path +browseable. Please refer to the man page for smb.conf in respect of the different +symantics of %L and %N, as well as %U and %u.</P +><DIV +CLASS="NOTE" +><P +></P +><TABLE +CLASS="NOTE" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" +HSPACE="5" +ALT="Note"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +>MS Windows NT/2K clients at times do not disconnect a connection to a server +between logons. It is recommended to NOT use the <B +CLASS="COMMAND" +>homes</B +> +meta-service name as part of the profile share path.</P +></TD +></TR +></TABLE +></DIV +></DIV +><DIV +CLASS="SECT3" +><H3 +CLASS="SECT3" +><A +NAME="AEN3116" +>18.1.1.2. Windows 9x / Me User Profiles</A +></H3 +><P +>To support Windows 9x / Me clients, you must use the "logon home" parameter. Samba has +now been fixed so that <KBD +CLASS="USERINPUT" +>net use /home</KBD +> now works as well, and it, too, relies +on the <B +CLASS="COMMAND" +>logon home</B +> parameter.</P +><P +>By using the logon home parameter, you are restricted to putting Win9x / Me +profiles in the user's home directory. But wait! There is a trick you +can use. If you set the following in the <B +CLASS="COMMAND" +>[global]</B +> section of your <TT +CLASS="FILENAME" +>smb.conf</TT +> file:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> logon home = \\%L\%U\.profiles</PRE +></P +><P +>then your Windows 9x / Me clients will dutifully put their clients in a subdirectory +of your home directory called <TT +CLASS="FILENAME" +>.profiles</TT +> (thus making them hidden).</P +><P +>Not only that, but <KBD +CLASS="USERINPUT" +>net use/home</KBD +> will also work, because of a feature in +Windows 9x / Me. It removes any directory stuff off the end of the home directory area +and only uses the server and share portion. That is, it looks like you +specified \\%L\%U for <B +CLASS="COMMAND" +>logon home</B +>.</P +></DIV +><DIV +CLASS="SECT3" +><H3 +CLASS="SECT3" +><A +NAME="AEN3131" +>18.1.1.3. Mixed Windows 9x / Me and Windows NT4/200x User Profiles</A +></H3 +><P +>You can support profiles for both Win9X and WinNT clients by setting both the +<B +CLASS="COMMAND" +>logon home</B +> and <B +CLASS="COMMAND" +>logon path</B +> parameters. For example:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> logon home = \\%L\%u\.profiles + logon path = \\%L\profiles\%u</PRE +></P +></DIV +></DIV +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN3138" +>18.1.2. Windows Client Profile Configuration Information</A +></H2 +><DIV +CLASS="SECT3" +><H3 +CLASS="SECT3" +><A +NAME="AEN3140" +>18.1.2.1. Windows 9x / Me Profile Setup</A +></H3 +><P +>When a user first logs in on Windows 9X, the file user.DAT is created, +as are folders "Start Menu", "Desktop", "Programs" and "Nethood". +These directories and their contents will be merged with the local +versions stored in c:\windows\profiles\username on subsequent logins, +taking the most recent from each. You will need to use the [global] +options "preserve case = yes", "short preserve case = yes" and +"case sensitive = no" in order to maintain capital letters in shortcuts +in any of the profile folders.</P +><P +>The user.DAT file contains all the user's preferences. If you wish to +enforce a set of preferences, rename their user.DAT file to user.MAN, +and deny them write access to this file.</P +><P +></P +><OL +TYPE="1" +><LI +><P +> On the Windows 9x / Me machine, go to Control Panel -> Passwords and + select the User Profiles tab. Select the required level of + roaming preferences. Press OK, but do _not_ allow the computer + to reboot. + </P +></LI +><LI +><P +> On the Windows 9x / Me machine, go to Control Panel -> Network -> + Client for Microsoft Networks -> Preferences. Select 'Log on to + NT Domain'. Then, ensure that the Primary Logon is 'Client for + Microsoft Networks'. Press OK, and this time allow the computer + to reboot. + </P +></LI +></OL +><P +>Under Windows 9x / Me Profiles are downloaded from the Primary Logon. +If you have the Primary Logon as 'Client for Novell Networks', then +the profiles and logon script will be downloaded from your Novell +Server. If you have the Primary Logon as 'Windows Logon', then the +profiles will be loaded from the local machine - a bit against the +concept of roaming profiles, it would seem!</P +><P +>You will now find that the Microsoft Networks Login box contains +[user, password, domain] instead of just [user, password]. Type in +the samba server's domain name (or any other domain known to exist, +but bear in mind that the user will be authenticated against this +domain and profiles downloaded from it, if that domain logon server +supports it), user name and user's password.</P +><P +>Once the user has been successfully validated, the Windows 9x / Me machine +will inform you that 'The user has not logged on before' and asks you +if you wish to save the user's preferences? Select 'yes'.</P +><P +>Once the Windows 9x / Me client comes up with the desktop, you should be able +to examine the contents of the directory specified in the "logon path" +on the samba server and verify that the "Desktop", "Start Menu", +"Programs" and "Nethood" folders have been created.</P +><P +>These folders will be cached locally on the client, and updated when +the user logs off (if you haven't made them read-only by then). +You will find that if the user creates further folders or short-cuts, +that the client will merge the profile contents downloaded with the +contents of the profile directory already on the local client, taking +the newest folders and short-cuts from each set.</P +><P +>If you have made the folders / files read-only on the samba server, +then you will get errors from the Windows 9x / Me machine on logon and logout, as +it attempts to merge the local and the remote profile. Basically, if +you have any errors reported by the Windows 9x / Me machine, check the Unix file +permissions and ownership rights on the profile directory contents, +on the samba server.</P +><P +>If you have problems creating user profiles, you can reset the user's +local desktop cache, as shown below. When this user then next logs in, +they will be told that they are logging in "for the first time".</P +><P +></P +><OL +TYPE="1" +><LI +><P +> instead of logging in under the [user, password, domain] dialog, + press escape. + </P +></LI +><LI +><P +> run the regedit.exe program, and look in: + </P +><P +> HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList + </P +><P +> you will find an entry, for each user, of ProfilePath. Note the + contents of this key (likely to be c:\windows\profiles\username), + then delete the key ProfilePath for the required user. + + [Exit the registry editor]. + + </P +></LI +><LI +><P +> <SPAN +CLASS="emphasis" +><I +CLASS="EMPHASIS" +>WARNING</I +></SPAN +> - before deleting the contents of the + directory listed in the ProfilePath (this is likely to be + <TT +CLASS="FILENAME" +>c:\windows\profiles\username)</TT +>, ask them if they + have any important files stored on their desktop or in their start menu. + Delete the contents of the directory ProfilePath (making a backup if any + of the files are needed). + </P +><P +> This will have the effect of removing the local (read-only hidden + system file) user.DAT in their profile directory, as well as the + local "desktop", "nethood", "start menu" and "programs" folders. + </P +></LI +><LI +><P +> search for the user's .PWL password-caching file in the c:\windows + directory, and delete it. + </P +></LI +><LI +><P +> log off the windows 9x / Me client. + </P +></LI +><LI +><P +> check the contents of the profile path (see "logon path" described + above), and delete the user.DAT or user.MAN file for the user, + making a backup if required. + </P +></LI +></OL +><P +>If all else fails, increase samba's debug log levels to between 3 and 10, +and / or run a packet trace program such as ethereal or netmon.exe, and +look for error messages.</P +><P +>If you have access to an Windows NT4/200x server, then first set up roaming profiles +and / or netlogons on the Windows NT4/200x server. Make a packet trace, or examine +the example packet traces provided with Windows NT4/200x server, and see what the +differences are with the equivalent samba trace.</P +></DIV +><DIV +CLASS="SECT3" +><H3 +CLASS="SECT3" +><A +NAME="AEN3176" +>18.1.2.2. Windows NT4 Workstation</A +></H3 +><P +>When a user first logs in to a Windows NT Workstation, the profile +NTuser.DAT is created. The profile location can be now specified +through the "logon path" parameter.</P +><P +>There is a parameter that is now available for use with NT Profiles: +"logon drive". This should be set to <TT +CLASS="FILENAME" +>H:</TT +> or any other drive, and +should be used in conjunction with the new "logon home" parameter.</P +><P +>The entry for the NT4 profile is a _directory_ not a file. The NT +help on profiles mentions that a directory is also created with a .PDS +extension. The user, while logging in, must have write permission to +create the full profile path (and the folder with the .PDS extension +for those situations where it might be created.)</P +><P +>In the profile directory, Windows NT4 creates more folders than Windows 9x / Me. +It creates "Application Data" and others, as well as "Desktop", "Nethood", +"Start Menu" and "Programs". The profile itself is stored in a file +NTuser.DAT. Nothing appears to be stored in the .PDS directory, and +its purpose is currently unknown.</P +><P +>You can use the System Control Panel to copy a local profile onto +a samba server (see NT Help on profiles: it is also capable of firing +up the correct location in the System Control Panel for you). The +NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN +turns a profile into a mandatory one.</P +><P +>The case of the profile is significant. The file must be called +NTuser.DAT or, for a mandatory profile, NTuser.MAN.</P +></DIV +><DIV +CLASS="SECT3" +><H3 +CLASS="SECT3" +><A +NAME="AEN3185" +>18.1.2.3. Windows 2000/XP Professional</A +></H3 +><P +>You must first convert the profile from a local profile to a domain +profile on the MS Windows workstation as follows:</P +><P +></P +><UL +><LI +><P +> Log on as the LOCAL workstation administrator. + </P +></LI +><LI +><P +> Right click on the 'My Computer' Icon, select 'Properties' + </P +></LI +><LI +><P +> Click on the 'User Profiles' tab + </P +></LI +><LI +><P +> Select the profile you wish to convert (click on it once) + </P +></LI +><LI +><P +> Click on the button 'Copy To' + </P +></LI +><LI +><P +> In the "Permitted to use" box, click on the 'Change' button. + </P +></LI +><LI +><P +> Click on the 'Look in" area that lists the machine name, when you click + here it will open up a selection box. Click on the domain to which the + profile must be accessible. + </P +><DIV +CLASS="NOTE" +><P +></P +><TABLE +CLASS="NOTE" +WIDTH="90%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" +HSPACE="5" +ALT="Note"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +>You will need to log on if a logon box opens up. Eg: In the connect + as: MIDEARTH\root, password: mypassword.</P +></TD +></TR +></TABLE +></DIV +></LI +><LI +><P +> To make the profile capable of being used by anyone select 'Everyone' + </P +></LI +><LI +><P +> Click OK. The Selection box will close. + </P +></LI +><LI +><P +> Now click on the 'Ok' button to create the profile in the path you + nominated. + </P +></LI +></UL +><P +>Done. You now have a profile that can be editted using the samba-3.0.0 +<TT +CLASS="FILENAME" +>profiles</TT +> tool.</P +><DIV +CLASS="NOTE" +><P +></P +><TABLE +CLASS="NOTE" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" +HSPACE="5" +ALT="Note"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +>Under NT/2K the use of mandotory profiles forces the use of MS Exchange +storage of mail data. That keeps desktop profiles usable.</P +></TD +></TR +></TABLE +></DIV +><DIV +CLASS="NOTE" +><P +></P +><TABLE +CLASS="NOTE" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" +HSPACE="5" +ALT="Note"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +></P +><UL +><LI +><P +>This is a security check new to Windows XP (or maybe only +Windows XP service pack 1). It can be disabled via a group policy in +Active Directory. The policy is:</P +><P +>"Computer Configuration\Administrative Templates\System\User +Profiles\Do not check for user ownership of Roaming Profile Folders"</P +><P +>...and it should be set to "Enabled". +Does the new version of samba have an Active Directory analogue? If so, +then you may be able to set the policy through this.</P +><P +>If you cannot set group policies in samba, then you may be able to set +the policy locally on each machine. If you want to try this, then do +the following (N.B. I don't know for sure that this will work in the +same way as a domain group policy):</P +></LI +><LI +><P +>On the XP workstation log in with an Administrator account.</P +></LI +><LI +><P +>Click: "Start", "Run"</P +></LI +><LI +><P +>Type: "mmc"</P +></LI +><LI +><P +>Click: "OK"</P +></LI +><LI +><P +>A Microsoft Management Console should appear.</P +></LI +><LI +><P +>Click: File, "Add/Remove Snap-in...", "Add"</P +></LI +><LI +><P +>Double-Click: "Group Policy"</P +></LI +><LI +><P +>Click: "Finish", "Close"</P +></LI +><LI +><P +>Click: "OK"</P +></LI +><LI +><P +>In the "Console Root" window:</P +></LI +><LI +><P +>Expand: "Local Computer Policy", "Computer Configuration",</P +></LI +><LI +><P +>"Administrative Templates", "System", "User Profiles"</P +></LI +><LI +><P +>Double-Click: "Do not check for user ownership of Roaming Profile</P +></LI +><LI +><P +>Folders"</P +></LI +><LI +><P +>Select: "Enabled"</P +></LI +><LI +><P +>Click: OK"</P +></LI +><LI +><P +>Close the whole console. You do not need to save the settings (this + refers to the console settings rather than the policies you have + changed).</P +></LI +><LI +><P +>Reboot</P +></LI +></UL +></TD +></TR +></TABLE +></DIV +></DIV +></DIV +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN3258" +>18.1.3. Sharing Profiles between W9x/Me and NT4/200x/XP workstations</A +></H2 +><P +>Sharing of desktop profiles between Windows versions is NOT recommended. +Desktop profiles are an evolving phenomenon and profiles for later versions +of MS Windows clients add features that may interfere with earlier versions +of MS Windows clients. Probably the more salient reason to NOT mix profiles +is that when logging off an earlier version of MS Windows the older format +of profile contents may overwrite information that belongs to the newer +version resulting in loss of profile information content when that user logs +on again with the newer version of MS Windows.</P +><P +>If you then want to share the same Start Menu / Desktop with W9x/Me, you will +need to specify a common location for the profiles. The smb.conf parameters +that need to be common are <SPAN +CLASS="emphasis" +><I +CLASS="EMPHASIS" +>logon path</I +></SPAN +> and +<SPAN +CLASS="emphasis" +><I +CLASS="EMPHASIS" +>logon home</I +></SPAN +>.</P +><P +>If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory.</P +></DIV +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN3265" +>18.1.4. Profile Migration from Windows NT4/200x Server to Samba</A +></H2 +><P +>There is nothing to stop you specifying any path that you like for the +location of users' profiles. Therefore, you could specify that the +profile be stored on a samba server, or any other SMB server, as long as +that SMB server supports encrypted passwords.</P +><DIV +CLASS="SECT3" +><H3 +CLASS="SECT3" +><A +NAME="AEN3268" +>18.1.4.1. Windows NT4 Profile Management Tools</A +></H3 +><P +>Unfortunately, the Resource Kit information is specific to the version of MS Windows +NT4/200x. The correct resource kit is required for each platform.</P +><P +>Here is a quick guide:</P +><P +></P +><UL +><LI +><P +>On your NT4 Domain Controller, right click on 'My Computer', then +select the tab labelled 'User Profiles'.</P +></LI +><LI +><P +>Select a user profile you want to migrate and click on it.</P +><DIV +CLASS="NOTE" +><P +></P +><TABLE +CLASS="NOTE" +WIDTH="90%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" +HSPACE="5" +ALT="Note"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +>I am using the term "migrate" lossely. You can copy a profile to +create a group profile. You can give the user 'Everyone' rights to the +profile you copy this to. That is what you need to do, since your samba +domain is not a member of a trust relationship with your NT4 PDC.</P +></TD +></TR +></TABLE +></DIV +></LI +><LI +><P +>Click the 'Copy To' button.</P +></LI +><LI +><P +>In the box labelled 'Copy Profile to' add your new path, eg: + <TT +CLASS="FILENAME" +>c:\temp\foobar</TT +></P +></LI +><LI +><P +>Click on the button labelled 'Change' in the "Permitted to use" box.</P +></LI +><LI +><P +>Click on the group 'Everyone' and then click OK. This closes the + 'chose user' box.</P +></LI +><LI +><P +>Now click OK.</P +></LI +></UL +><P +>Follow the above for every profile you need to migrate.</P +></DIV +><DIV +CLASS="SECT3" +><H3 +CLASS="SECT3" +><A +NAME="AEN3291" +>18.1.4.2. Side bar Notes</A +></H3 +><P +>You should obtain the SID of your NT4 domain. You can use smbpasswd to do +this. Read the man page.</P +><P +>With Samba-3.0.0 alpha code you can import all you NT4 domain accounts +using the net samsync method. This way you can retain your profile +settings as well as all your users.</P +></DIV +><DIV +CLASS="SECT3" +><H3 +CLASS="SECT3" +><A +NAME="AEN3295" +>18.1.4.3. moveuser.exe</A +></H3 +><P +>The W2K professional resource kit has moveuser.exe. moveuser.exe changes +the security of a profile from one user to another. This allows the account +domain to change, and/or the user name to change.</P +></DIV +><DIV +CLASS="SECT3" +><H3 +CLASS="SECT3" +><A +NAME="AEN3298" +>18.1.4.4. Get SID</A +></H3 +><P +>You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 +Resource Kit.</P +><P +>Windows NT 4.0 stores the local profile information in the registry under +the following key: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList</P +><P +>Under the ProfileList key, there will be subkeys named with the SIDs of the +users who have logged on to this computer. (To find the profile information +for the user whose locally cached profile you want to move, find the SID for +the user with the GetSID.exe utility.) Inside of the appropriate user's +subkey, you will see a string value named ProfileImagePath.</P +></DIV +></DIV +></DIV +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN3303" +>18.2. Mandatory profiles</A +></H1 +><P +>A Mandatory Profile is a profile that the user does NOT have the ability to overwrite. +During the user's session it may be possible to change the desktop environment, but +as the user logs out all changes made will be lost. If it is desired to NOT allow the +user any ability to change the desktop environment then this must be done through +policy settings. See previous chapter.</P +><DIV +CLASS="NOTE" +><P +></P +><TABLE +CLASS="NOTE" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" +HSPACE="5" +ALT="Note"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +>Under NO circumstances should the profile directory (or it's contents) be made read-only +as this may render the profile un-usable.</P +></TD +></TR +></TABLE +></DIV +><P +>For MS Windows NT4/200x/XP the above method can be used to create mandatory profiles +also. To convert a group profile into a mandatory profile simply locate the NTUser.DAT +file in the copied profile and rename it to NTUser.MAN.</P +><P +>For MS Windows 9x / Me it is the User.DAT file that must be renamed to User.MAN to +affect a mandatory profile.</P +></DIV +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN3310" +>18.3. Creating/Managing Group Profiles</A +></H1 +><P +>Most organisations are arranged into departments. There is a nice benenfit in +this fact since usually most users in a department will require the same desktop +applications and the same desktop layout. MS Windows NT4/200x/XP will allow the +use of Group Profiles. A Group Profile is a profile that is created firstly using +a template (example) user. Then using the profile migration tool (see above) the +profile is assigned access rights for the user group that needs to be given access +to the group profile.</P +><P +>The next step is rather important. PLEASE NOTE: Instead of assigning a group profile +to users (ie: Using User Manager) on a "per user" basis, the group itself is assigned +the now modified profile.</P +><DIV +CLASS="NOTE" +><P +></P +><TABLE +CLASS="NOTE" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" +HSPACE="5" +ALT="Note"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +> Be careful with group profiles, if the user who is a member of a group also + has a personal profile, then the result will be a fusion (merge) of the two. + </P +></TD +></TR +></TABLE +></DIV +></DIV +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN3316" +>18.4. Default Profile for Windows Users</A +></H1 +><P +>MS Windows 9x / Me and NT4/200x/XP will use a default profile for any user for whom +a profile does not already exist. Armed with a knowledge of where the default profile +is located on the Windows workstation, and knowing which registry keys affect the path +from which the default profile is created, it is possible to modify the default profile +to one that has been optimised for the site. This has significant administrative +advantages.</P +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN3319" +>18.4.1. MS Windows 9x/Me</A +></H2 +><P +>To enable default per use profiles in Windows 9x / Me you can either use the Windows 98 System +Policy Editor or change the registry directly.</P +><P +>To enable default per user profiles in Windows 9x / Me, launch the System Policy Editor, then +select File -> Open Registry, then click on the Local Computer icon, click on Windows 98 System, +select User Profiles, click on the enable box. Do not forget to save the registry changes.</P +><P +>To modify the registry directly, launch the Registry Editor (regedit.exe), select the hive +<TT +CLASS="FILENAME" +>HKEY_LOCAL_MACHINE\Network\Logon</TT +>. Now add a DWORD type key with the name +"User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0.</P +><DIV +CLASS="SECT3" +><H3 +CLASS="SECT3" +><A +NAME="AEN3325" +>18.4.1.1. How User Profiles Are Handled in Windows 9x / Me?</A +></H3 +><P +>When a user logs on to a Windows 9x / Me machine, the local profile path, +<TT +CLASS="FILENAME" +>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList</TT +>, is checked +for an existing entry for that user:</P +><P +>If the user has an entry in this registry location, Windows 9x / Me checks for a locally cached +version of the user profile. Windows 9x / Me also checks the user's home directory (or other +specified directory if the location has been modified) on the server for the User Profile. +If a profile exists in both locations, the newer of the two is used. If the User Profile exists +on the server, but does not exist on the local machine, the profile on the server is downloaded +and used. If the User Profile only exists on the local machine, that copy is used.</P +><P +>If a User Profile is not found in either location, the Default User Profile from the Windows 9x / Me +machine is used and is copied to a newly created folder for the logged on user. At log off, any +changes that the user made are written to the user's local profile. If the user has a roaming +profile, the changes are written to the user's profile on the server.</P +></DIV +></DIV +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN3331" +>18.4.2. MS Windows NT4 Workstation</A +></H2 +><P +>On MS Windows NT4 the default user profile is obtained from the location +<TT +CLASS="FILENAME" +>%SystemRoot%\Profiles</TT +> which in a default installation will translate to +<TT +CLASS="FILENAME" +>C:\WinNT\Profiles</TT +>. Under this directory on a clean install there will be +three (3) directories: <TT +CLASS="FILENAME" +>Administrator, All Users, Default User</TT +>.</P +><P +>The <TT +CLASS="FILENAME" +>All Users</TT +> directory contains menu settings that are common across all +system users. The <TT +CLASS="FILENAME" +>Default User</TT +> directory contains menu entries that are +customisable per user depending on the profile settings chosen/created.</P +><P +>When a new user first logs onto an MS Windows NT4 machine a new profile is created from:</P +><P +></P +><TABLE +BORDER="0" +><TBODY +><TR +><TD +>All Users settings</TD +></TR +><TR +><TD +>Default User settings (contains the default NTUser.DAT file)</TD +></TR +></TBODY +></TABLE +><P +></P +><P +>When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain +the following steps are followed in respect of profile handling:</P +><P +></P +><OL +TYPE="1" +><LI +><P +> The users' account information which is obtained during the logon process contains + the location of the users' desktop profile. The profile path may be local to the + machine or it may be located on a network share. If there exists a profile at the location + of the path from the user account, then this profile is copied to the location + <TT +CLASS="FILENAME" +>%SystemRoot%\Profiles\%USERNAME%</TT +>. This profile then inherits the + settings in the <TT +CLASS="FILENAME" +>All Users</TT +> profile in the <TT +CLASS="FILENAME" +>%SystemRoot%\Profiles</TT +> + location. + </P +></LI +><LI +><P +> If the user account has a profile path, but at it's location a profile does not exist, + then a new profile is created in the <TT +CLASS="FILENAME" +>%SystemRoot%\Profiles\%USERNAME%</TT +> + directory from reading the <TT +CLASS="FILENAME" +>Default User</TT +> profile. + </P +></LI +><LI +><P +> If the NETLOGON share on the authenticating server (logon server) contains a policy file + (<TT +CLASS="FILENAME" +>NTConfig.POL</TT +>) then it's contents are applied to the <TT +CLASS="FILENAME" +>NTUser.DAT</TT +> + which is applied to the <TT +CLASS="FILENAME" +>HKEY_CURRENT_USER</TT +> part of the registry. + </P +></LI +><LI +><P +> When the user logs out, if the profile is set to be a roaming profile it will be written + out to the location of the profile. The <TT +CLASS="FILENAME" +>NTuser.DAT</TT +> file is then + re-created from the contents of the <TT +CLASS="FILENAME" +>HKEY_CURRENT_USER</TT +> contents. + Thus, should there not exist in the NETLOGON share an <TT +CLASS="FILENAME" +>NTConfig.POL</TT +> at the + next logon, the effect of the provious <TT +CLASS="FILENAME" +>NTConfig.POL</TT +> will still be held + in the profile. The effect of this is known as <SPAN +CLASS="emphasis" +><I +CLASS="EMPHASIS" +>tatooing</I +></SPAN +>. + </P +></LI +></OL +><P +>MS Windows NT4 profiles may be <SPAN +CLASS="emphasis" +><I +CLASS="EMPHASIS" +>Local</I +></SPAN +> or <SPAN +CLASS="emphasis" +><I +CLASS="EMPHASIS" +>Roaming</I +></SPAN +>. A Local profile +will stored in the <TT +CLASS="FILENAME" +>%SystemRoot%\Profiles\%USERNAME%</TT +> location. A roaming profile will +also remain stored in the same way, unless the following registry key is created:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\ + "DeleteRoamingCache"=dword:00000001</PRE +> + +In which case, the local copy (in <TT +CLASS="FILENAME" +>%SystemRoot%\Profiles\%USERNAME%</TT +>) will be +deleted on logout.</P +><P +>Under MS Windows NT4 default locations for common resources (like <TT +CLASS="FILENAME" +>My Documents</TT +> +may be redirected to a network share by modifying the following registry keys. These changes may be affected +via use of the System Policy Editor (to do so may require that you create your owns template extension +for the policy editor to allow this to be done through the GUI. Another way to do this is by way of first +creating a default user profile, then while logged in as that user, run regedt32 to edit the key settings.</P +><P +>The Registry Hive key that affects the behaviour of folders that are part of the default user profile +are controlled by entries on Windows NT4 is:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> HKEY_CURRENT_USER + \Software + \Microsoft + \Windows + \CurrentVersion + \Explorer + \User Shell Folders\</PRE +></P +><P +>The above hive key contains a list of automatically managed folders. The default entries are:</P +><P +> <PRE +CLASS="PROGRAMLISTING" +> Name Default Value + -------------- ----------------------------------------- + AppData %USERPROFILE%\Application Data + Desktop %USERPROFILE%\Desktop + Favorites %USERPROFILE%\Favorites + NetHood %USERPROFILE%\NetHood + PrintHood %USERPROFILE%\PrintHood + Programs %USERPROFILE%\Start Menu\Programs + Recent %USERPROFILE%\Recent + SendTo %USERPROFILE%\SendTo + Start Menu %USERPROFILE%\Start Menu + Startup %USERPROFILE%\Start Menu\Programs\Startup + </PRE +> + </P +><P +>The registry key that contains the location of the default profile settings is: + +<PRE +CLASS="PROGRAMLISTING" +> HKEY_LOCAL_MACHINE + \SOFTWARE + \Microsoft + \Windows + \CurrentVersion + \Explorer + \User Shell Folders</PRE +> + +The default entries are: + +<PRE +CLASS="PROGRAMLISTING" +> Common Desktop %SystemRoot%\Profiles\All Users\Desktop + Common Programs %SystemRoot%\Profiles\All Users\Programs + Common Start Menu %SystemRoot%\Profiles\All Users\Start Menu + Common Startu p %SystemRoot%\Profiles\All Users\Start Menu\Progams\Startup</PRE +></P +></DIV +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN3385" +>18.4.3. MS Windows 200x/XP</A +></H2 +><DIV +CLASS="NOTE" +><P +></P +><TABLE +CLASS="NOTE" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" +HSPACE="5" +ALT="Note"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +> MS Windows XP Home Edition does use default per user profiles, but can not participate + in domain security, can not log onto an NT/ADS style domain, and thus can obtain the profile + only from itself. While there are benefits in doing this the beauty of those MS Windows + clients that CAN participate in domain logon processes allows the administrator to create + a global default profile and to enforce it through the use of Group Policy Objects (GPOs). + </P +></TD +></TR +></TABLE +></DIV +><P +>When a new user first logs onto MS Windows 200x/XP machine the default profile is obtained from +<TT +CLASS="FILENAME" +>C:\Documents and Settings\Default User</TT +>. The administrator can modify (or change +the contents of this location and MS Windows 200x/XP will gladly user it. This is far from the optimum +arrangement since it will involve copying a new default profile to every MS Windows 200x/XP client +workstation. </P +><P +>When MS Windows 200x/XP participate in a domain security context, and if the default user +profile is not found, then the client will search for a default profile in the NETLOGON share +of the authenticating server. ie: In MS Windows parlance: +<TT +CLASS="FILENAME" +>%LOGONSERVER%\NETLOGON\Default User</TT +> and if one exits there it will copy this +to the workstation to the <TT +CLASS="FILENAME" +>C:\Documents and Settings\</TT +> under the Windows +login name of the user.</P +><DIV +CLASS="NOTE" +><P +></P +><TABLE +CLASS="NOTE" +WIDTH="100%" +BORDER="0" +><TR +><TD +WIDTH="25" +ALIGN="CENTER" +VALIGN="TOP" +><IMG +SRC="/usr/share/sgml/docbook/stylesheet/dsssl/modular/images/note.gif" +HSPACE="5" +ALT="Note"></TD +><TD +ALIGN="LEFT" +VALIGN="TOP" +><P +> This path translates, in Samba parlance, to the smb.conf [NETLOGON] share. The directory + should be created at the root of this share and msut be called <TT +CLASS="FILENAME" +>Default Profile</TT +>. + </P +></TD +></TR +></TABLE +></DIV +><P +>If a default profile does not exist in this location then MS Windows 200x/XP will use the local +default profile.</P +><P +>On loging out, the users' desktop profile will be stored to the location specified in the registry +settings that pertain to the user. If no specific policies have been created, or passed to the client +during the login process (as Samba does automatically), then the user's profile will be written to +the local machine only under the path <TT +CLASS="FILENAME" +>C:\Documents and Settings\%USERNAME%</TT +>.</P +><P +>Those wishing to modify the default behaviour can do so through up to three methods:</P +><P +></P +><UL +><LI +><P +> Modify the registry keys on the local machine manually and place the new default profile in the + NETLOGON share root - NOT recommended as it is maintenance intensive. + </P +></LI +><LI +><P +> Create an NT4 style NTConfig.POL file that specified this behaviour and locate this file + in the root of the NETLOGON share along with the new default profile. + </P +></LI +><LI +><P +> Create a GPO that enforces this through Active Directory, and place the new default profile + in the NETLOGON share. + </P +></LI +></UL +><P +>The Registry Hive key that affects the behaviour of folders that are part of the default user profile +are controlled by entries on Windows 200x/XP is:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> HKEY_CURRENT_USER + \Software + \Microsoft + \Windows + \CurrentVersion + \Explorer + \User Shell Folders\</PRE +></P +><P +>The above hive key contains a list of automatically managed folders. The default entries are:</P +><P +> <PRE +CLASS="PROGRAMLISTING" +> Name Default Value + -------------- ----------------------------------------- + AppData %USERPROFILE%\Application Data + Cache %USERPROFILE%\Local Settings\Temporary Internet Files + Cookies %USERPROFILE%\Cookies + Desktop %USERPROFILE%\Desktop + Favorites %USERPROFILE%\Favorites + History %USERPROFILE%\Local Settings\History + Local AppData %USERPROFILE%\Local Settings\Application Data + Local Settings %USERPROFILE%\Local Settings + My Pictures %USERPROFILE%\My Documents\My Pictures + NetHood %USERPROFILE%\NetHood + Personal %USERPROFILE%\My Documents + PrintHood %USERPROFILE%\PrintHood + Programs %USERPROFILE%\Start Menu\Programs + Recent %USERPROFILE%\Recent + SendTo %USERPROFILE%\SendTo + Start Menu %USERPROFILE%\Start Menu + Startup %USERPROFILE%\Start Menu\Programs\Startup + Templates %USERPROFILE%\Templates + </PRE +> + </P +><P +>There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all +the others are of type REG_EXPAND_SZ.</P +><P +>It makes a huge difference to the speed of handling roaming user profiles if all the folders are +stored on a dedicated location on a network server. This means that it will NOT be necessary to +write Outlook PST file over the network for every login and logout.</P +><P +>To set this to a network location you could use the following examples: + +<PRE +CLASS="PROGRAMLISTING" +> %LOGONSERVER%\%USERNAME%\Default Folders</PRE +> + +This would store the folders in the user's home directory under a directory called "Default Folders" + +You could also use: + +<PRE +CLASS="PROGRAMLISTING" +> \\SambaServer\FolderShare\%USERNAME%</PRE +> + +in which case the default folders will be stored in the server named <SPAN +CLASS="emphasis" +><I +CLASS="EMPHASIS" +>SambaServer</I +></SPAN +> +in the share called <SPAN +CLASS="emphasis" +><I +CLASS="EMPHASIS" +>FolderShare</I +></SPAN +> under a directory that has the name of the MS Windows +user as seen by the Linux/Unix file system.</P +><P +>Please note that once you have created a default profile share, you MUST migrate a user's profile +(default or custom) to it.</P +><P +>MS Windows 200x/XP profiles may be <SPAN +CLASS="emphasis" +><I +CLASS="EMPHASIS" +>Local</I +></SPAN +> or <SPAN +CLASS="emphasis" +><I +CLASS="EMPHASIS" +>Roaming</I +></SPAN +>. +A roaming profile will be cached locally unless the following registry key is created:</P +><P +><PRE +CLASS="PROGRAMLISTING" +> HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\ + "DeleteRoamingCache"=dword:00000001</PRE +> + +In which case, the local cache copy will be deleted on logout.</P +></DIV +></DIV +></DIV +><DIV +CLASS="NAVFOOTER" +><HR +ALIGN="LEFT" +WIDTH="100%"><TABLE +SUMMARY="Footer navigation table" +WIDTH="100%" +BORDER="0" +CELLPADDING="0" +CELLSPACING="0" +><TR +><TD +WIDTH="33%" +ALIGN="left" +VALIGN="top" +><A +HREF="policymgmt.html" +ACCESSKEY="P" +>Prev</A +></TD +><TD +WIDTH="34%" +ALIGN="center" +VALIGN="top" +><A +HREF="samba-howto-collection.html" +ACCESSKEY="H" +>Home</A +></TD +><TD +WIDTH="33%" +ALIGN="right" +VALIGN="top" +><A +HREF="interdomaintrusts.html" +ACCESSKEY="N" +>Next</A +></TD +></TR +><TR +><TD +WIDTH="33%" +ALIGN="left" +VALIGN="top" +>System and Account Policies</TD +><TD +WIDTH="34%" +ALIGN="center" +VALIGN="top" +><A +HREF="optional.html" +ACCESSKEY="U" +>Up</A +></TD +><TD +WIDTH="33%" +ALIGN="right" +VALIGN="top" +>Interdomain Trust Relationships</TD +></TR +></TABLE +></DIV +></BODY +></HTML +>
\ No newline at end of file |