diff options
Diffstat (limited to 'docs/htmldocs/samba-pdc-faq.html')
| -rw-r--r-- | docs/htmldocs/samba-pdc-faq.html | 1954 |
1 files changed, 0 insertions, 1954 deletions
diff --git a/docs/htmldocs/samba-pdc-faq.html b/docs/htmldocs/samba-pdc-faq.html deleted file mode 100644 index 058a5d5f51..0000000000 --- a/docs/htmldocs/samba-pdc-faq.html +++ /dev/null @@ -1,1954 +0,0 @@ -<HTML -><HEAD -><TITLE ->The Samba 2.2 PDC FAQ</TITLE -><META -NAME="GENERATOR" -CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD -><BODY -CLASS="BOOK" -BGCOLOR="#FFFFFF" -TEXT="#000000" -LINK="#0000FF" -VLINK="#840084" -ALINK="#0000FF" -><DIV -CLASS="BOOK" -><A -NAME="SAMBA-PDC-FAQ" -></A -><DIV -CLASS="TITLEPAGE" -><H1 -CLASS="TITLE" -><A -NAME="SAMBA-PDC-FAQ" ->The Samba 2.2 PDC FAQ</A -></H1 -><H3 -CLASS="AUTHOR" -><A -NAME="AEN4" ->David Bannon</A -></H3 -><DIV -CLASS="AFFILIATION" -><SPAN -CLASS="ORGNAME" ->La Trobe University<BR></SPAN -></DIV -><HR></DIV -><HR><H1 -><A -NAME="AEN12" -></A -></H1 -><P -> This is the FAQ for Samba 2.2 as an NTDomain controller. - This document is derived from the origional FAQ that was built and - maintained by Gerald Carter from the early days of Samba NTDomain development - up until recently. It is now being updated as significent changes are - made to 2.2.0. - </P -><P -> Please note it does not apply to the SAMBA_TNG nor the HEAD branch. - </P -><P -> Also available is a Samba 2.2 PDC <A -HREF="samba-pdc-howto.html" -TARGET="_top" ->HOWTO</A -> - that takes you, step by step, over the process of setting up a very basic Samba - 2.2 Primary Domain Controller - </P -><DIV -CLASS="TOC" -><DL -><DT -><B ->Table of Contents</B -></DT -><DT ->1. <A -HREF="#AEN19" ->Introduction</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN21" ->State of Play</A -></DT -><DT -><A -HREF="#AEN27" ->Introduction</A -></DT -></DL -></DD -><DT ->2. <A -HREF="#AEN33" ->General Information</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN35" ->What can we do ?</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN37" ->What can Samba 2.2.x Primary Domain Controller (PDC) do ?</A -></DT -><DT -><A -HREF="#AEN62" ->Can I have a Windows 2000 client logon to a Samba -controlled domain?</A -></DT -></DL -></DD -><DT -><A -HREF="#AEN65" ->CVS</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN68" ->What are the different Samba branches available in CVS ?</A -></DT -><DT -><A -HREF="#AEN91" ->What are the CVS commands ?</A -></DT -></DL -></DD -></DL -></DD -><DT ->3. <A -HREF="#AEN95" ->Establishing Connections</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN97" -></A -></DT -><DD -><DL -><DT -><A -HREF="#AEN99" ->How do I get my NT4 or W2000 Workstation to login to the Samba -controlled Domain?</A -></DT -><DT -><A -HREF="#AEN103" ->What is a 'machine account' ?</A -></DT -><DT -><A -HREF="#AEN110" ->"The machine account for this computer either does not -exist or is not accessable."</A -></DT -><DT -><A -HREF="#AEN116" ->How do I create machine accounts manually ?</A -></DT -><DT -><A -HREF="#AEN129" ->I cannot include a '$' in a machine name.</A -></DT -><DT -><A -HREF="#AEN135" ->I get told "You already have a connection to the Domain...." -when creating a machine account.</A -></DT -><DT -><A -HREF="#AEN139" ->I get told "Cannot join domain, the credentials supplied -conflict with an existing set.."</A -></DT -><DT -><A -HREF="#AEN143" ->"The system can not log you on (C000019B)...."</A -></DT -></DL -></DD -></DL -></DD -><DT ->4. <A -HREF="#AEN147" ->User Account Management</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN149" ->Domain Admins</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN151" ->How do I configure an account as a domain administrator?</A -></DT -></DL -></DD -><DT -><A -HREF="#AEN155" ->Profiles</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN157" ->Why is it bad to set "logon path = \\%N\%U\profile" in -smb.conf?</A -></DT -><DT -><A -HREF="#AEN169" ->Why are all the users listed in the "domain admin users" using the -same profile?</A -></DT -><DT -><A -HREF="#AEN172" ->The roaming profiles do not seem to be updating on the -server.</A -></DT -></DL -></DD -><DT -><A -HREF="#AEN180" ->Policies</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN182" ->What are 'Policies' ?.</A -></DT -><DT -><A -HREF="#AEN188" ->I can't get system policies to work.</A -></DT -><DT -><A -HREF="#AEN203" ->What about Windows NT Policy Editor ?</A -></DT -><DT -><A -HREF="#AEN217" ->Can Win95 do Policies ?</A -></DT -></DL -></DD -><DT -><A -HREF="#AEN223" ->Passwords</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN225" ->What is password sync and should I use it ?</A -></DT -><DT -><A -HREF="#AEN239" ->How do I get remote password (unix and SMB) changing working ?</A -></DT -></DL -></DD -></DL -></DD -><DT ->5. <A -HREF="#AEN246" ->Miscellaneous</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN248" -></A -></DT -><DD -><DL -><DT -><A -HREF="#AEN250" ->What editor can I use in DOS/Windows that won't -mess with my unix EOF</A -></DT -><DT -><A -HREF="#AEN263" ->How do I get 'User Manager' and 'Server Manager'</A -></DT -><DT -><A -HREF="#AEN278" ->The time setting from a Samba server does not work.</A -></DT -><DT -><A -HREF="#AEN282" ->"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A -></DT -><DT -><A -HREF="#AEN286" ->How do I get my samba server to become a member ( not PDC ) of an NT domain?</A -></DT -></DL -></DD -></DL -></DD -><DT ->6. <A -HREF="#AEN290" ->Troubleshooting and Bug Reporting</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN292" ->Diagnostic tools</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN294" ->What are some diagnostics tools I can use to debug the domain logon process and where can I - find them?</A -></DT -><DT -><A -HREF="#AEN309" ->How do I install 'Network Monitor' on an NT Workstation -or a Windows 9x box?</A -></DT -></DL -></DD -><DT -><A -HREF="#AEN338" ->What other help can I get ?</A -></DT -><DD -><DL -><DT -><A -HREF="#AEN341" ->URLs and similar</A -></DT -><DT -><A -HREF="#AEN374" ->How do I get help from the mailing lists ?</A -></DT -><DT -><A -HREF="#AEN403" ->How do I get off the mailing lists ?</A -></DT -></DL -></DD -></DL -></DD -></DL -></DIV -><DIV -CLASS="CHAPTER" -><HR><H1 -><A -NAME="AEN19" ->Chapter 1. Introduction</A -></H1 -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN21" ->State of Play</A -></H1 -><P ->Much of the related code does work. For example, if an NT is removed from the - domain and then rejoins, the <TT -CLASS="FILENAME" ->Create a Computer Account in the Domain</TT -> dialog - will let you reset the smbpasswd. That is you don't need to do it from - the unix box. However, at the present, you do need to have root as an - administrator and use the root user name and password.</P -><P -><B -CLASS="COMMAND" ->Policies</B -> do work on a W2K machine. MS says that recent - builds of W2K dont observe an NT policy but it appears it does in 'legacy' - mode.</P -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN27" ->Introduction</A -></H1 -><P -> This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing - with the 'old HEAD' version of Samba and its NTDomain facilities. It is - being rewritten by David Bannon (drb) so that it addresses more - accurately the Samba 2.2.x release. - </P -><P -> This document probably still contains some material that does not apply - to Samba 2.2 but most (all?) of the really misleading stuff has been - removed. Some issues are not dealt with or are dealt with badly. Please - send corrections and additions to <A -HREF="mailto:D.Bannon@latrobe.edu.au" -TARGET="_top" ->David Bannon</A ->. - </P -><P ->Hopefully, as we all become familiar with the Samba 2.2 as a - PDC this document will become much more usefull.</P -></DIV -></DIV -><DIV -CLASS="CHAPTER" -><HR><H1 -><A -NAME="AEN33" ->Chapter 2. General Information</A -></H1 -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN35" ->What can we do ?</A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN37" ->What can Samba 2.2.x Primary Domain Controller (PDC) do ?</A -></H2 -><P -> If you wish to have Samba act as a PDC for Windows NT 4.0/2000 client, - then you will need to obtain the 2.2.0 version. Release of a stable, - full featured Samba PDC is currently slated for version 3.0. - </P -><P -> The following is a list of included features currently in - Samba 2.2: - </P -><P -></P -><UL -><LI -><P ->The ability to act as a limited PDC for - Windows NT and W2000 clients. This includes adding NT and - W2K machines to the domain and authenticating users logging - into the domain.</P -></LI -><LI -><P ->Domain account can be viewed using the User - Manager for Domains</P -></LI -><LI -><P ->Viewing/adding/deleting resources on the Samba - PDC via the Server Manager for Domains from the NT client. - </P -></LI -><LI -><P ->Windows 95/98/ME clients will allow user - level security to be set and browsing of domain accounts. - </P -></LI -><LI -><P ->Machine account password updates.</P -></LI -><LI -><P ->Changing of user passwords from an NT client. - </P -></LI -><LI -><P ->Partial support for Windows NT username mapping. - Group name mapping is slated for a later release.</P -></LI -></UL -><P -> These things are note expected to work in the forseeable future: - </P -><P -></P -><UL -><LI -><P ->Trust relationships</P -></LI -><LI -><P ->PDC and BDC integration</P -></LI -></UL -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN62" ->Can I have a Windows 2000 client logon to a Samba -controlled domain?</A -></H2 -><P -> The 2.2 release branch of Samba supports Windows 2000 domain - clients in legacy mode, ie as if the PDC is a NTServer, not a - W2K server. - </P -></DIV -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN65" ->CVS</A -></H1 -><P -> CVS is a programme (publically available) that the Samba developers - use to maintain the central source code. Non developers can get - access to the source in a read only capacity. Many flavours of unix - now arrive with cvs installed.</P -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN68" ->What are the different Samba branches available in CVS ?</A -></H2 -><P ->You can find out more about obtaining Samba's via anonymous - CVS from <A -HREF="http://pserver.samba.org/samba/cvs.html" -TARGET="_top" -> http://pserver.samba.org/samba/cvs.html</A ->. - </P -><P -> There are basically four branches to watch at the moment : - </P -><P -></P -><DIV -CLASS="VARIABLELIST" -><DL -><DT ->HEAD</DT -><DD -><P ->Samba 3.0 ? This code boasts all the main - development work in Samba. Due to its developmental - nature, its not really suitable for production work. - </P -></DD -><DT ->SAMBA_2_0</DT -><DD -><P ->This branch contains the previous stable - release. At the moment it contains 2.0.8, a version that - will do some limited PDC stuff. If you are really going to - do PDC things, you consider 2.2 instead. - </P -></DD -><DT ->SAMBA_2_2</DT -><DD -><P ->The 2.2.x release branch which is a subset - of the features of the HEAD branch. This document addresses - only SAMBA_2_2. - </P -></DD -><DT ->SAMBA_TNG</DT -><DD -><P ->This branch is no longer maintained from the Samba - sites. Please see <A -HREF="http://www.samba-tng.org/" -TARGET="_top" -> http://www.samba-tng.org/</A ->. It has been requested - that questions about TNG are not posted to the regular Samba - mailing lists including samba-ntdom and samba-technical. - </P -></DD -></DL -></DIV -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN91" ->What are the CVS commands ?</A -></H2 -><P -> See <A -HREF="http://pserver.samba.org/samba/cvs.html" -TARGET="_top" -> http://pserver.samba.org/samba/cvs.html</A -> for instructions - on obtaining the SAMBA_2_2 or HEAD cvs code. - </P -></DIV -></DIV -></DIV -><DIV -CLASS="CHAPTER" -><HR><H1 -><A -NAME="AEN95" ->Chapter 3. Establishing Connections</A -></H1 -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN97" -></A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN99" ->How do I get my NT4 or W2000 Workstation to login to the Samba -controlled Domain?</A -></H2 -><P -> There is a comprehensive Samba PDC <A -HREF="samba-pdc-howto.html" -TARGET="_top" ->HOWTO</A -> accessable from the samba web - site under 'Documentation'. Read it. - </P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN103" ->What is a 'machine account' ?</A -></H2 -><P -> Every NT, W2K or Samba machine that joins a Samba controlled - domain must be known to the Samba PDC. There are two entries - required, one in (typically) <TT -CLASS="FILENAME" ->/etc/passwd</TT -> - and the other in (typically) <TT -CLASS="FILENAME" ->/usr/local/samba/private/smbpasswd</TT ->. - Under some circumstances these entries are made - <A -HREF="#AEN116" ->manually</A ->, the <A -HREF="samba-pdc-howto.html" -TARGET="_top" ->HOWTO</A -> - discusses ways of creating them automatically.</P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN110" ->"The machine account for this computer either does not -exist or is not accessable."</A -></H2 -><P -> When I try to join the domain I get the message "The machine account - for this computer either does not exist or is not accessable". Whats - wrong ? - </P -><P -> This problem is caused by the PDC not having a suitable machine account. - If you are using the <B -CLASS="COMMAND" ->add user script =</B -> method to create - accounts then this would indicate that it has not worked. Ensure the domain - admin user system is working. - </P -><P -> Alternatively if you are creating account entries manually then they - have not been created correctly. Make sure that you have the entry - correct for the machine account in smbpasswd file on the Samba PDC. - If you added the account using an editor rather than using the smbpasswd - utility, make sure that the account name is the machine netbios name - with a '$' appended to it ( ie. computer_name$ ). There must be an entry - in both /etc/passwd and the smbpasswd file. Some people have reported - that inconsistent subnet masks between the Samba server and the NT - client have caused this problem. Make sure that these are consistent - for both client and server. - </P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN116" ->How do I create machine accounts manually ?</A -></H2 -><P -> This was the only option until recently, now in version 2.2 better - means are available. You might still need to do it manually for a - couple of reasons. A machine account consists of two entries (assuming - a standard install and /etc/passwd use), one in /etc/passwd and the - other in /usr/local/samba/private/smbpasswd. The /etc/passwd - entry will list the machine name with a $ appended, won't have a - passwd, will have a null shell and no home directory. For example - a machine called 'doppy' would have an /etc/passwd entry like this :</P -><P -> <B -CLASS="COMMAND" ->doppy$:x:505:501:NTMachine:/dev/null:/bin/false</B -> - </P -><P -> On a linux system for example, you would typically add it like - this : - </P -><P -> <B -CLASS="COMMAND" ->adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n - doppy$</B -> - </P -><P -> Then you need to add that entry to smbpasswd, assuming you have a suitable - path to the <B -CLASS="COMMAND" ->smbpasswd</B -> programme, do this : - </P -><P -> <B -CLASS="COMMAND" ->smbpasswd -a -m doppy$</B -> - </P -><P -> The entry will be created with a well known password, so any machine that - says its doppy could join the domain as long as it gets in first. So - don't create the accounts any earlier than you need them. - </P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN129" ->I cannot include a '$' in a machine name.</A -></H2 -><P -> A 'machine name' in (typically) <TT -CLASS="FILENAME" ->/etc/passwd</TT -> consists - of the machine name with a '$' appended. FreeBSD (and other BSD - systems ?) won't create a user with a '$' in their name. - </P -><P -> The problem is only in the program used to make the entry, once - made, it works perfectly. So create a user without the '$' and - use <B -CLASS="COMMAND" ->vipw</B -> to edit the entry, adding the '$'. Or create - the whole entry with vipw if you like, make sure you use a - unique uid !</P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN135" ->I get told "You already have a connection to the Domain...." -when creating a machine account.</A -></H2 -><P -> This happens if you try to create a machine account from the - machine itself and use a user name that does not work (for whatever - reason) and then try another (possibly valid) user name. - Exit out of the network applet to close the initial connection - and try again. - </P -><P -> Further, if the machine is a already a 'member of a workgroup' that - is the same name as the domain you are joining (bad idea) you will - get this message. Change the workgroup name to something else, it - does not matter what, reboot, and try again.</P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN139" ->I get told "Cannot join domain, the credentials supplied -conflict with an existing set.."</A -></H2 -><P -> This is the same basic problem as mentioned above, <A -HREF="#AEN135" -> "You already have a connection..."</A -> - </P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN143" ->"The system can not log you on (C000019B)...."</A -></H2 -><P ->I joined the domain successfully but after upgrading - to a newer version of the Samba code I get the message, "The system - can not log you on (C000019B), Please try a gain or consult your - system administrator" when attempting to logon. - </P -><P -> This occurs when the domain SID stored in private/WORKGROUP.SID is - changed. For example, you remove the file and smbd automatically - creates a new one. Or you are swapping back and forth between - versions 2.0.7, TNG and the HEAD branch code (not recommended). The - only way to correct the problem is to restore the original domain - SID or remove the domain client from the domain and rejoin. - </P -></DIV -></DIV -></DIV -><DIV -CLASS="CHAPTER" -><HR><H1 -><A -NAME="AEN147" ->Chapter 4. User Account Management</A -></H1 -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN149" ->Domain Admins</A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN151" ->How do I configure an account as a domain administrator?</A -></H2 -><P -> See the NTDom <A -HREF="samba-pdc-howto.html" -TARGET="_top" ->HowTo</A ->. - </P -></DIV -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN155" ->Profiles</A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN157" ->Why is it bad to set "logon path = \\%N\%U\profile" in -smb.conf?</A -></H2 -><P -> Sometimes Windows clients will maintain a connection to - the \\homes\ ( or [%U] ) share even after the user has logged out. - Consider the following scenario. - </P -><P -></P -><UL -><LI -><P -> user1 logs into the Windows NT machine. - Therefore the [homes] share is set to \\server\user1. - </P -></LI -><LI -><P -> user1 works for a while and then logs - out. </P -></LI -><LI -><P -> user2 logs into the same Windows NT - machine.</P -></LI -></UL -><P -> However, since the NT box has maintained a connection to [homes] - which was previously set to \\server\user1, when the operating system - attempts to get the profile and if it can read users1's profile, will - get it otherwise it will return an error. You get the picture. - </P -><P -> A better solution is to use a separate [profiles] share and - set the "logon path = \\%N\profiles\%U" - </P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN169" ->Why are all the users listed in the "domain admin users" using the -same profile?</A -></H2 -><P -> You are using a very very old development version of Samba. - Upgrade. - </P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN172" ->The roaming profiles do not seem to be updating on the -server.</A -></H2 -><P -> There can be several reasons for this. - </P -><P -> Make sure that the time on the client and the PDC are synchronized. You - can accomplish this by executing a <B -CLASS="COMMAND" ->net time \\server /set /yes</B -> - replacing server with the name of your PDC (or another synchronized SMB server). - See <A -HREF="#AEN278" -> about Setting Time</A -> - </P -><P -> Make sure that the "logon path" is writeable by the user and make sure - that the connection to the logon path location is by the current user. - Sometimes Windows client do not drop the connection immediately upon - logoff. - </P -><P -> Some people have reported that the logon path location should - also be browseable. I (GC) have yet to emperically verify this, - but you can try.</P -></DIV -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN180" ->Policies</A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN182" ->What are 'Policies' ?.</A -></H2 -><P -> When a user logs onto the domain via a client machine, the PDC - sends the client machine a list of things contained in the - 'policy' (if it exists). This list may do things like suppress - a splach screen, format the dates the way you like them or perhaps - remove locally stored profiles. - </P -><P -> On a samba PDC this list is obtained from a file called - <TT -CLASS="FILENAME" ->ntconfig.pol</TT -> and located in the [netlogon] - share. The file is created with a policy editor and must be readable - by anyone and writeable by only root. See <A -HREF="#AEN203" -> below</A -> for how to get a suitable editor. - </P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN188" ->I can't get system policies to work.</A -></H2 -><P -> There are two possible reasons for system policies not - functioning correctly. Make sure that you have the following - parameters set in smb.conf - </P -><P -><PRE -CLASS="PROGRAMLISTING" -> [netlogon] - .... - locking = no - public = no - browseable = yes - .... - </PRE -></P -><P -> A policy file must be in the [netlogon] share and must be - readable by everyone and writeable by only root. The file - must be created by an NTServer <A -HREF="#AEN203" ->Policy - Editor</A ->. - </P -><P -> Last time I (drb) looked in the source, it was looking for - <TT -CLASS="FILENAME" ->ntconfig.pol</TT -> first then several other - combinations of upper and lower case. People have reported - success using <TT -CLASS="FILENAME" ->NTconfig.pol</TT ->, <TT -CLASS="FILENAME" ->NTconfig.POL</TT -> - and <TT -CLASS="FILENAME" ->ntconfig.pol</TT ->. These are the case settings that - I (GC) use with the filename <TT -CLASS="FILENAME" ->ntconfig.pol</TT ->: - </P -><P -><PRE -CLASS="PROGRAMLISTING" -> case sensitive = no - case preserve = yes - short preserve case = no - default case = yes - </PRE -></P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN203" ->What about Windows NT Policy Editor ?</A -></H2 -><P -> To create or edit <TT -CLASS="FILENAME" ->ntconfig.pol</TT -> you must use - the NT Server Policy Editor, <B -CLASS="COMMAND" ->poledit.exe</B -> which - is included with NT Server but <I -CLASS="EMPHASIS" ->not NT Workstation</I ->. - There is a Policy Editor on a NTws - but it is not suitable for creating <I -CLASS="EMPHASIS" ->Domain Policies</I ->. - Further, although the Windows 95 - Policy Editor can be installed on an NT Workstation/Server, it will not - work with NT policies because the registry key that are set by the policy templates. - However, the files from the NT Server will run happily enough on an NTws. - You need <TT -CLASS="FILENAME" ->poledit.exe, common.adm</TT -> and <TT -CLASS="FILENAME" ->winnt.adm</TT ->. It is convenient - to put the two *.adm files in <TT -CLASS="FILENAME" ->c:\winnt\inf</TT -> which is where - the binary will look for them unless told otherwise. Note also that that - directory is 'hidden'. - </P -><P ->The Windows NT policy editor is also included with the - Service Pack 3 (and later) for Windows NT 4.0. Extract the files using - <B -CLASS="COMMAND" ->servicepackname /x</B ->, ie thats <B -CLASS="COMMAND" ->Nt4sp6ai.exe - /x</B -> for service pack 6a. The policy editor, <B -CLASS="COMMAND" ->poledt.exe</B -> and the - associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible - location is with the Zero Administration Kit available for download from Microsoft. - </P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN217" ->Can Win95 do Policies ?</A -></H2 -><P -> Install the group policy handler for Win9x to pick up group - policies. Look on the Win98 CD in <TT -CLASS="FILENAME" ->\tools\reskit\netadmin\poledit</TT ->. - Install group policies on a Win9x client by double-clicking - <TT -CLASS="FILENAME" ->grouppol.inf</TT ->. Log off and on again a couple of - times and see if Win98 picks up group policies. Unfortunately this needs - to be done on every Win9x machine that uses group policies.... - </P -><P -> If group policies don't work one reports suggests getting the updated - (read: working) grouppol.dll for Windows 9x. The group list is grabbed - from /etc/group. - </P -></DIV -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN223" ->Passwords</A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN225" ->What is password sync and should I use it ?</A -></H2 -><P -> NTws users can change their domain password by pressing Ctrl-Alt-Del - and choosing 'Change Password'. By default however, this does not change the unix password - (typically in <TT -CLASS="FILENAME" ->/etc/passwd</TT -> or <TT -CLASS="FILENAME" ->/etc/shadow</TT ->). - In lots of situations thats OK, for example : - </P -><P -></P -><UL -><LI -><P ->The server is only accessible to the user via - samba.</P -></LI -><LI -><P ->Pam_smb or similar is installed so other applications - still refer to the samba password.</P -></LI -></UL -><P -> But sometimes you really do need to maintain two seperate password - databases and there are good reasons to keep then in sync. Trying - to explain to users that they need to change their passwords in two - seperate places or use two seperate passwords is not fun. - </P -><P -> However do understand that setting up password sync is not without - problems either. The chief difficulty is the interface between Samba - and the <B -CLASS="COMMAND" ->passwd</B -> command, it can be a fiddle to set - up and if the password the user has entered fails, the resulting errors - are ambiguously reported and the user is confused. Further, you need - to take steps to ensure that users only ever change their passwords - via samba (or use <B -CLASS="COMMAND" ->smbpasswd</B ->), otherwise they will - only be changing the unix password.</P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN239" ->How do I get remote password (unix and SMB) changing working ?</A -></H2 -><P -> Have a practice changing a user's password (as root) to see - what discussion takes place and change the text in the 'passwd chat' - line below as necessary. The line as shown works for recent RH Linux - but most other systems seem to like to do something different. The '*' is - a wild card and will match anything (or nothing). - </P -><P -> Add these lines to smb.conf under [Global] - </P -><P -><PRE -CLASS="PROGRAMLISTING" -> - - unix password sync = true - passwd program = /usr/bin/passwd %u - passwd chat = *password* %n\n *password* %n\n *successful* - </PRE -></P -><P -> As mentioned above, the change to the unix password happens as root, - not as the user, as is indicated in ~/smbd/chgpasswd.c If - you are using NIS, the Samba server must be running on the NIS - master machine. - </P -></DIV -></DIV -></DIV -><DIV -CLASS="CHAPTER" -><HR><H1 -><A -NAME="AEN246" ->Chapter 5. Miscellaneous</A -></H1 -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN248" -></A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN250" ->What editor can I use in DOS/Windows that won't -mess with my unix EOF</A -></H2 -><P ->There are a number of Windows or DOS based editors that will - understand, and leave intact, the unix eof (as opposed to a DOS CL/LF). - List members suggested : - </P -><P -></P -><UL -><LI -><P ->UltraEdit at <A -HREF="http://www.ultraedit.com" -TARGET="_top" ->www.ultraedit.com</A -></P -></LI -><LI -><P ->VI for windows at <A -HREF="http://home.snafu.de/ramo/WinViEn.htm" -TARGET="_top" -> home.snafu.de/ramo/WinViEn.htm</A -></P -></LI -><LI -><P ->The author prefers PFE at <A -HREF="http://www.lancs.ac.uk/people/cpaap/pfe/" -TARGET="_top" -> www.lancs.ac.uk/people/cpaap/pfe/</A -> but its no longer being developed...</P -></LI -></UL -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN263" ->How do I get 'User Manager' and 'Server Manager'</A -></H2 -><P -> Since I don't need to buy an NT Server CD now, how do I get - the 'User Manager for Domains', the 'Server Manager' ? - </P -><P -> Microsoft distributes a version of - these tools called nexus for installation on Windows 95 systems. The - tools set includes - </P -><P -></P -><UL -><LI -><P ->Server Manager</P -></LI -><LI -><P ->User Manager for Domains</P -></LI -><LI -><P ->Event Viewer</P -></LI -></UL -><P -> Click here to download the archived file <A -HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE" -TARGET="_top" ->ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A -> - </P -><P -> The Windows NT 4.0 version of the 'User Manager for - Domains' and 'Server Manager' are available from Microsoft via ftp - from <A -HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" -TARGET="_top" ->ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A -> - </P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN278" ->The time setting from a Samba server does not work.</A -></H2 -><P ->If it works OK when you log on as Domain Admin then the problem is that ordinary users - don't have permission to change the time. (The system is running with their permission - at logon time.) This is not a Samba problem, you will have the same problem where ever - you connect. You can give 'everyone' permission to change the time from the User Manager. - </P -><P ->Anyone know what the registry settings are so this could be done with a Policy ?</P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN282" ->"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A -></H2 -><P ->I keep getting the message "trust account xxx should be in DOMAIN_GROUP_RID_USERS." - in the logs. What do I need to do?</P -><P ->You are using one of the old development versions. Upgrade. - (The message is unimportant, was a reminder to a developer)</P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN286" ->How do I get my samba server to become a member ( not PDC ) of an NT domain?</A -></H2 -><P -> Please refer to the <A -HREF="DOMAIN_MEMBER.html" -TARGET="_top" ->Domain Member - HOWTO</A -> for more information on this. - </P -></DIV -></DIV -></DIV -><DIV -CLASS="CHAPTER" -><HR><H1 -><A -NAME="AEN290" ->Chapter 6. Troubleshooting and Bug Reporting</A -></H1 -><DIV -CLASS="SECT1" -><H1 -CLASS="SECT1" -><A -NAME="AEN292" ->Diagnostic tools</A -></H1 -><DIV -CLASS="SECT2" -><H2 -CLASS="SECT2" -><A -NAME="AEN294" ->What are some diagnostics tools I can use to debug the domain logon process and where can I - find them?</A -></H2 -><P -> One of the best diagnostic tools for debugging problems is Samba itself. - You can use the -d option for both smbd and nmbd to specifiy what - 'debug level' at which to run. See the man pages on smbd, nmbd and - smb.conf for more information on debugging options. The debug - level can range from 1 (the default) to 10 (100 for debugging passwords). - </P -><P -> Another helpful method of debugging is to compile samba using the - <B -CLASS="COMMAND" ->gcc -g </B -> flag. This will include debug - information in the binaries and allow you to attch gdb to the - running smbd / nmbd process. In order to attach gdb to an smbd - process for an NT workstation, first get the workstation to make the - connection. Pressing ctrl-alt-delete and going down to the domain box - is sufficient (at least, on the first time you join the domain) to - generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation - maintains an open connection, and therefore there will be an smbd - process running (assuming that you haven't set a really short smbd - idle timeout) So, in between pressing ctrl alt delete, and actually - typing in your password, you can gdb attach and continue. - </P -><P -> Some usefull samba commands worth investigating: - </P -><P -></P -><UL -><LI -><P ->testparam | more</P -></LI -><LI -><P ->smbclient -L //{netbios name of server}</P -></LI -></UL -><P -> An SMB enabled version of tcpdump is available from - <A -HREF="http://www.tcpdump.org/" -TARGET="_top" ->http://www.tcpdup.org/</A ->. - Ethereal, another good packet sniffer for UNIX and Win32 - hosts, can be downloaded from <A -HREF="http://www.ethereal.com/" -TARGET="_top" ->http://www.ethereal.com</A ->. - </P -><P -> For tracing things on the Microsoft Windows NT, Network Monitor - (aka. netmon) is available on the Microsoft Developer Network CD's, - the Windows NT Server install CD and the SMS CD's. The version of - netmon that ships with SMS allows for dumping packets between any two - computers (ie. placing the network interface in promiscuous mode). - The version on the NT Server install CD will only allow monitoring - of network traffic directed to the local NT box and broadcasts on the - local subnet. Be aware that Ethereal can read and write netmon - formatted files. - </P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN309" ->How do I install 'Network Monitor' on an NT Workstation -or a Windows 9x box?</A -></H2 -><P -> Installing netmon on an NT workstation requires a couple - of steps. The following are for installing Netmon V4.00.349, which comes - with Microsoft Windows NT Server 4.0, on Microsoft Windows NT - Workstation 4.0. The process should be similar for other version of - Windows NT / Netmon. You will need both the Microsoft Windows - NT Server 4.0 Install CD and the Workstation 4.0 Install CD. - </P -><P -> Initially you will need to install 'Network Monitor Tools and Agent' - on the NT Server. To do this - </P -><P -></P -><UL -><LI -><P ->Goto Start - Settings - Control Panel - - Network - Services - Add </P -></LI -><LI -><P ->Select the 'Network Monitor Tools and Agent' and - click on 'OK'.</P -></LI -><LI -><P ->Click 'OK' on the Network Control Panel. - </P -></LI -><LI -><P ->Insert the Windows NT Server 4.0 install CD - when prompted.</P -></LI -></UL -><P -> At this point the Netmon files should exist in - <TT -CLASS="FILENAME" ->%SYSTEMROOT%\System32\netmon\*.*</TT ->. - Two subdirectories exist as well, <TT -CLASS="FILENAME" ->parsers\</TT -> - which contains the necessary DLL's for parsing the netmon packet - dump, and <TT -CLASS="FILENAME" ->captures\</TT ->. - </P -><P -> In order to install the Netmon tools on an NT Workstation, you will - first need to install the 'Network Monitor Agent' from the Workstation - install CD. - </P -><P -></P -><UL -><LI -><P ->Goto Start - Settings - Control Panel - - Network - Services - Add</P -></LI -><LI -><P ->Select the 'Network Monitor Agent' and click - on 'OK'.</P -></LI -><LI -><P ->Click 'OK' on the Network Control Panel. - </P -></LI -><LI -><P ->Insert the Windows NT Workstation 4.0 install - CD when prompted.</P -></LI -></UL -><P -> Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* - to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set - permissions as you deem appropriate for your site. You will need - administrative rights on the NT box to run netmon. - </P -><P -> To install Netmon on a Windows 9x box install the network monitor agent - from the Windows 9x CD (\admin\nettools\netmon). There is a readme - file located with the netmon driver files on the CD if you need - information on how to do this. Copy the files from a working - Netmon installation. - </P -></DIV -></DIV -><DIV -CLASS="SECT1" -><HR><H1 -CLASS="SECT1" -><A -NAME="AEN338" ->What other help can I get ?</A -></H1 -><P -> There are many sources of information available in the form - of mailing lists, RFC's and documentation. The docs that come - with the samba distribution contain very good explanations of - general SMB topics such as browsing.</P -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN341" ->URLs and similar</A -></H2 -><P -></P -><UL -><LI -><P ->Home of Samba site <A -HREF="http://samba.org" -TARGET="_top" -> http://samba.org</A ->. We have a mirror near you !</P -></LI -><LI -><P -> The <I -CLASS="EMPHASIS" ->Development</I -> document - on the Samba mirrors might mention your problem. If so, - it might mean that the developers are working on it.</P -></LI -><LI -><P -> Ignacio Coupeau has a very comprehesive look at LDAP with Samba at - <A -HREF="http://www.unav.es/cti/ldap-smb-howto.html" -TARGET="_top" -> http://www.unav.es/cti/ldap-smb-howto.html</A -> - Be a little carefull however, I suspect that it does not specificly - address samba 2.2.x. The HEAD pre-2.1 may possibly be the best - stream to look at.</P -></LI -><LI -><P -> Lars Kneschke's site covers <A -HREF="http://www.samba-tng.org" -TARGET="_top" -> Samba-TNG</A -> at - <A -HREF="http://www.kneschke.de/projekte/samba_tng" -TARGET="_top" -> http://www.kneschke.de/projekte/samba_tng</A ->, but again, a - lot of it does not apply to the main stream Samba.</P -></LI -><LI -><P ->See how Scott Merrill simulates a BDC behaviour at - <A -HREF="http://www.skippy.net/linux/smb-howto.html" -TARGET="_top" -> http://www.skippy.net/linux/smb-howto.html</A ->. </P -></LI -><LI -><P ->Although 2.0.7 has almost had its day as a PDC, I (drb) will - keep the 2.0.7 PDC pages at <A -HREF="http://bioserve.latrobe.edu.au/samba" -TARGET="_top" -> http://bioserve.latrobe.edu.au/samba</A -> going for a while yet.</P -></LI -><LI -><P ->Misc links to CIFS information - <A -HREF="http://samba.org/cifs/" -TARGET="_top" ->http://samba.org/cifs/</A -></P -></LI -><LI -><P ->NT Domains for Unix <A -HREF="http://mailhost.cb1.com/~lkcl/ntdom/" -TARGET="_top" -> http://mailhost.cb1.com/~lkcl/ntdom/</A -></P -></LI -><LI -><P ->FTP site for older SMB specs: - <A -HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/" -TARGET="_top" -> ftp://ftp.microsoft.com/developr/drg/CIFS/</A -></P -></LI -></UL -><P -> You should also refer to the MS archives at - <A -HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/" -TARGET="_top" ->ftp://ftp.microsoft.com/developr/drg/CIFS/"</A -> - </P -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN374" ->How do I get help from the mailing lists ?</A -></H2 -><P -> There are a number of Samba related mailing lists. Go to <A -HREF="http://samba.org" -TARGET="_top" ->http://samba.org</A ->, click on your nearest mirror - and then click on <B -CLASS="COMMAND" ->Support</B -> and then click on <B -CLASS="COMMAND" -> Samba related mailing lists</B ->.</P -><P ->For questions relating to Samba TNG go to - <A -HREF="http://www.samba-tng.org/" -TARGET="_top" ->http://www.samba-tng.org/</A -> - It has been requested that you don't post questions about Samba-TNG to the - main stream Samba lists.</P -><P -></P -><P -><B ->If you post a message to one of the lists please - observe the following guide lines :</B -></P -><UL -><LI -><P -> Always remember that the developers are volunteers, they are - not paid and they never guarantee to produce a particular feature at - a particular time. Any time lines are 'best guess' and nothing more. - </P -></LI -><LI -><P -> Always mention what version of samba you are using and what - operating system its running under. You should probably list the - relevant sections of your smb.conf file, at least the options - in [global] that affect PDC support.</P -></LI -><LI -><P ->In addition to the version, if you obtained Samba via - CVS mention the date when you last checked it out.</P -></LI -><LI -><P -> Try and make your question clear and brief, lots of long, - convoluted questions get deleted before they are completely read ! - Don't post html encoded messages (if you can select colour or font - size its html).</P -></LI -><LI -><P -> If you run one of those niffy 'I'm on holidays' things when - you are away, make sure its configured to not answer mailing lists. - </P -></LI -><LI -><P -> Don't cross post. Work out which is the best list to post to - and see what happens, ie don't post to both samba-ntdom and samba-technical. - Many people active on the lists subscribe to more - than one list and get annoyed to see the same message two or more times. - Often someone will see a message and thinking it would be better dealt - with on another, will forward it on for you.</P -></LI -><LI -><P ->You might include <I -CLASS="EMPHASIS" ->partial</I -> - log files written at a debug level set to as much as 20. - Please don't send the entire log but enough to give the context of the - error messages.</P -></LI -><LI -><P ->(Possibly) If you have a complete netmon trace ( from the opening of - the pipe to the error ) you can send the *.CAP file as well.</P -></LI -><LI -><P ->Please think carefully before attaching a document to an email. - Consider pasting the relevant parts into the body of the message. The samba - mailing lists go to a huge number of people, do they all need a copy of your - smb.conf in their attach directory ?</P -></LI -></UL -></DIV -><DIV -CLASS="SECT2" -><HR><H2 -CLASS="SECT2" -><A -NAME="AEN403" ->How do I get off the mailing lists ?</A -></H2 -><P ->To have your name removed from a samba mailing list, go to the - same place you went to to get on it. Go to <A -HREF="http://lists.samba.org/" -TARGET="_top" ->http://lists.samba.org</A ->, click - on your nearest mirror and then click on <B -CLASS="COMMAND" ->Support</B -> and - then click on <B -CLASS="COMMAND" -> Samba related mailing lists</B ->. Or perhaps see - <A -HREF="http://lists.samba.org/mailman/roster/samba-ntdom" -TARGET="_top" ->here</A -></P -><P -> Please don't post messages to the list asking to be removed, you will just - be refered to the above address (unless that process failed in some way...) - </P -></DIV -></DIV -></DIV -></DIV -></BODY -></HTML ->
\ No newline at end of file |