diff options
Diffstat (limited to 'docs/htmldocs')
| -rw-r--r-- | docs/htmldocs/samba-pdc-faq.html | 2157 | ||||
| -rw-r--r-- | docs/htmldocs/samba-pdc-howto.html | 2096 |
2 files changed, 4253 insertions, 0 deletions
diff --git a/docs/htmldocs/samba-pdc-faq.html b/docs/htmldocs/samba-pdc-faq.html new file mode 100644 index 0000000000..08301f8a40 --- /dev/null +++ b/docs/htmldocs/samba-pdc-faq.html @@ -0,0 +1,2157 @@ +<HTML +><HEAD +><TITLE +>The Samba 2.2 PDC FAQ</TITLE +><META +NAME="GENERATOR" +CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD +><BODY +CLASS="BOOK" +BGCOLOR="#FFFFFF" +TEXT="#000000" +LINK="#0000FF" +VLINK="#840084" +ALINK="#0000FF" +><DIV +CLASS="BOOK" +><A +NAME="SAMBA-PDC-FAQ" +></A +><DIV +CLASS="TITLEPAGE" +><H1 +CLASS="TITLE" +><A +NAME="SAMBA-PDC-FAQ" +>The Samba 2.2 PDC FAQ</A +></H1 +><H3 +CLASS="AUTHOR" +><A +NAME="AEN4" +>David Bannon</A +></H3 +><DIV +CLASS="AFFILIATION" +><SPAN +CLASS="ORGNAME" +>La Trobe University<BR></SPAN +></DIV +><HR></DIV +><HR><H1 +><A +NAME="AEN12" +></A +></H1 +><P +>Comments, corrections and additions to <TT +CLASS="EMAIL" +><<A +HREF="mailto:D.Bannon@latrobe.edu.au" +>D.Bannon@latrobe.edu.au</A +>></TT +></P +><P +>This is the FAQ for Samba 2.2 as an NTDomain controller. + This document is derived from the origional FAQ that was built and + maintained by Gerald Carter + from the early days of Samba NTDomain development up until recently. + It is now being updated as significent changes are made to 2.2.0.</P +><P +>Please note it does not apply to Samba2.2alpha0, Samba2.2alpha1, Samba 2.0.7, TNG nor HEAD branch. + </P +><P +>I'll repeat, it does not apply to the current snapshot [ftp mirror]:/pub/samba/alpha/samba-2.2.0-alpha1.tar.gz, only to the to the current cvs.</P +><P +> Also available is a Samba 2.2 PDC <A +HREF="samba-pdc-howto.html" +TARGET="_top" +>HowTo</A +> that takes you, step + by step, over the process of setting up a very basic Samba 2.2 Primary Domain Controller + </P +><DIV +CLASS="NOTE" +><BLOCKQUOTE +CLASS="NOTE" +><P +><B +>Note: </B +>Please read the Introduction for the current <A +HREF="#AEN27" +> state of play</A +>.</P +></BLOCKQUOTE +></DIV +><DIV +CLASS="TOC" +><DL +><DT +><B +>Table of Contents</B +></DT +><DT +>1. <A +HREF="#AEN25" +>Introduction</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN27" +>State of Play</A +></DT +><DT +><A +HREF="#AEN44" +>Introduction</A +></DT +></DL +></DD +><DT +>2. <A +HREF="#AEN49" +>General Information</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN51" +>What can we do ?</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN53" +>What can Samba Primary Domain Controller (PDC) do ?</A +></DT +><DT +><A +HREF="#AEN86" +>Can I have a Windows 2000 client logon to a Samba controlled domain?</A +></DT +><DT +><A +HREF="#AEN89" +>What's the status of print spool (spoolss) support in the NTDOM code?</A +></DT +></DL +></DD +><DT +><A +HREF="#AEN92" +>CVS</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN95" +>What are the different Samba branches available in CVS ?</A +></DT +><DT +><A +HREF="#AEN118" +>What are the CVS commands ?</A +></DT +></DL +></DD +></DL +></DD +><DT +>3. <A +HREF="#AEN149" +>Establishing Connections</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN151" +></A +></DT +><DD +><DL +><DT +><A +HREF="#AEN153" +>How do I get my NT4 or W2000 Workstation to login to the Samba controlled Domain?</A +></DT +><DT +><A +HREF="#AEN158" +>What is a 'machine account' ?</A +></DT +><DT +><A +HREF="#AEN165" +>"The machine account for this computer either does not exist or is not accessable."</A +></DT +><DT +><A +HREF="#AEN171" +>How do I create machine accounts manually ?</A +></DT +><DT +><A +HREF="#AEN184" +>I cannot include a '$' in a machine name.</A +></DT +><DT +><A +HREF="#AEN190" +>I get told "You already have a connection to the Domain...." when creating a + machine account.</A +></DT +><DT +><A +HREF="#AEN194" +>I get told "Cannot join domain, the credentials supplied conflict + with an existing set.."</A +></DT +><DT +><A +HREF="#AEN198" +>"The system can not log you on (C000019B)...."</A +></DT +></DL +></DD +></DL +></DD +><DT +>4. <A +HREF="#AEN202" +>User Account Management</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN204" +>Domain Admins</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN206" +>How do I configure an account as a domain administrator?</A +></DT +></DL +></DD +><DT +><A +HREF="#AEN210" +>Profiles</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN212" +>Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ?</A +></DT +><DT +><A +HREF="#AEN226" +>Why are all the users listed in the "domain admin users" using the same profile?</A +></DT +><DT +><A +HREF="#AEN229" +>The roaming profiles do not seem to be updating on the server.</A +></DT +></DL +></DD +><DT +><A +HREF="#AEN237" +>Policies</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN239" +>What are 'Policies' ?.</A +></DT +><DT +><A +HREF="#AEN246" +>I can't get system policies to work.</A +></DT +><DT +><A +HREF="#AEN260" +>What about Windows NT Policy Editor ?</A +></DT +><DT +><A +HREF="#AEN274" +>Can Win95 do Policies ?</A +></DT +></DL +></DD +><DT +><A +HREF="#AEN280" +>Passwords</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN282" +>What is password sync and should I use it ?</A +></DT +><DT +><A +HREF="#AEN295" +>How do I get remote password (unix and SMB) changing working ?</A +></DT +></DL +></DD +></DL +></DD +><DT +>5. <A +HREF="#AEN301" +>Miscellaneous</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN303" +></A +></DT +><DD +><DL +><DT +><A +HREF="#AEN305" +>What editor can I use in DOS/Windows that won't mess with my unix EOF</A +></DT +><DT +><A +HREF="#AEN318" +>How do I get 'User Manager' and 'Server Manager'</A +></DT +><DT +><A +HREF="#AEN333" +>The time setting from a Samba server does not work.</A +></DT +><DT +><A +HREF="#AEN337" +>"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A +></DT +><DT +><A +HREF="#AEN341" +>How do I get my samba server to become a member ( not PDC ) of an NT domain?</A +></DT +></DL +></DD +></DL +></DD +><DT +>6. <A +HREF="#AEN376" +>Troubleshooting and Bug Reporting</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN378" +>Diagnostic tools</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN380" +>What are some diagnostics tools I can use to debug the domain logon process and where can I + find them?</A +></DT +><DT +><A +HREF="#AEN394" +>How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box?</A +></DT +></DL +></DD +><DT +><A +HREF="#AEN423" +>What other help can I get ?</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN426" +>URLs and similar</A +></DT +><DT +><A +HREF="#AEN472" +>How do I get help from the mailing lists ?</A +></DT +><DT +><A +HREF="#AEN501" +>How do I get off the mailing lists ?</A +></DT +></DL +></DD +></DL +></DD +></DL +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="AEN25" +>Chapter 1. Introduction</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN27" +>State of Play</A +></H1 +><P +><I +CLASS="EMPHASIS" +>It should be noted that 2.2.0 in its pre-release form still has a few problems, + I'll try and keep this section current while things are still dynamic. + At the time of this update (November 13, 2000) the current state of play is :</I +></P +><P +>Comments here about W2K joining the domain apply only to Samba 2.2 from the CVS after November 27th. The + 'snapshot' release Samba2.2alpha1 does not work !!! See below on how to get a CVS tree.</P +><P +>Client Side creation of Machine accounts does work but is not complete. + Firstly, the <TT +CLASS="FILENAME" +>add user script</TT +> runs as the user who's + name was entered, not as root. Secondly, the machine name passed to the script (%U) + has an underscore at the end, not a '$'. One alternative is to use %m and add the $. + This method is documented in the <A +HREF="samba-pdc-howto.html" +TARGET="_top" +>HowTo</A +>. + And thirdly, it does not work with NT4ws. + </P +><P +>A W2K machine can join the domain. See the <A +HREF="samba-pdc-howto.html" +TARGET="_top" +>HowTo</A +> + which explains the process. The methods + described are 'work arounds' and should be regarded as temporary. Although I (drb) + have tested these procedures a number of people have had difficulty so there + may be other issues at work. JFM is aware of these + problems and will attend to them when he can.</P +><P +>A Domain Admin account is required and at present it appears that only root + is a suitable candidate.</P +><P +>Much of the related code does work. For example, if an NT is removed from the + domain and then rejoins, the <TT +CLASS="FILENAME" +>Create a Computer Account in the Domain</TT +> dialog + will let you reset the smbpasswd. That is you don't need to do it from + the unix box. However, at the present, you do need to have root as an + administrator and use the root user name and password.</P +><P +><I +CLASS="EMPHASIS" +>Actually I'm + not sure that last paragraph is correct ....</I +></P +><P +><B +CLASS="COMMAND" +>Policies</B +> do work on a W2K machine. MS says that recent builds of + W2K dont observe an NT policy but it appears it does in 'legacy' mode.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN44" +>Introduction</A +></H1 +><P +>This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing with the 'old head' + version of Samba and its NTDomain facilities. It is being rewritten by David Bannon (drb) + so that it addresses more accurately the Samba 2.2 planned for release late 2000. </P +><P +>This document probably still contains some material that does not apply to + Samba 2.2 but most (all?) of the really misleading stuff has been removed. Some + issues are not dealt with or are dealt with badly. Please send corrections and additions to + David Bannon at D.Bannon@latrobe.edu.au</P +><P +>Hopefully, as we all become familiar with the Samba 2.2 as a PDC this document will + become much more usefull.</P +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="AEN49" +>Chapter 2. General Information</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN51" +>What can we do ?</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN53" +>What can Samba Primary Domain Controller (PDC) do ?</A +></H2 +><P +>If you wish to have Samba act as a PDC for Windows NT 3.51.and 4.0 or W2000 client, then you + will need to obtain the 2.2.0 version, currently in pre-release. Release of a stable, + full featured Samba PDC is currently slated for version 3.0. </P +><P +>The following is a list of included features currently in Samba 2.2:</P +><P +></P +><UL +><LI +><P +>The ability to act as a limited PDC for Windows NT and W2000 clients. + This includes adding NT and W2K machines to the domain and authenticating users logging + into the domain.</P +></LI +><LI +><P +>Domain account can be viewed using the User Manager for + Domains ????</P +></LI +><LI +><P +>Viewing resources on the Samba PDC via the Server Manager for Domains + from the NT client. ??</P +></LI +><LI +><P +>Windows 95 clients will allow user level security to be set + but will not currently allow browsing of accounts.</P +></LI +><LI +><P +>Machine account password updates.</P +></LI +><LI +><P +>Changing of user passwords from an NT client.</P +></LI +><LI +><P +>Partial support for Windows NT group and username mapping.</P +></LI +><LI +><P +>Support for a LDAP password database backend.</P +></LI +><LI +><P +>Printing.</P +></LI +></UL +><P +></P +><P +><B +>These things are note expected to work in the forseeable future</B +></P +><UL +><LI +><P +>Trust relationships</P +></LI +><LI +><P +>PDC and BDC integration</P +></LI +><LI +><P +>Windows NT ACLs (on the Samba shares)</P +></LI +><LI +><P +>Offer a list of domain users to User Manager for Domains + (or the Security Tab etc).</P +></LI +></UL +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN86" +>Can I have a Windows 2000 client logon to a Samba controlled domain?</A +></H2 +><P +>The 2.2 release branch of Samba supports Windows 2000 domain + clients in legacy mode, ie as if the PDC is a NTServer, not a + W2K server.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN89" +>What's the status of print spool (spoolss) support in the NTDOM code?</A +></H2 +><P +>The implementation of support for SPOOLSS pipe is complete and it will be available + in the 2.2.0 release. This means that Samba will support the automatic downloading of printer + drivers for Windows NT clients just as it currently does for Windows 9x clients.</P +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN92" +>CVS</A +></H1 +><P +>CVS is a programme (publically available) that the Samba developers use to + maintain the central source code. Non developers can get access to the source in + a read only capacity. Many flavours of unix now arrive with cvs installed.</P +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN95" +>What are the different Samba branches available in CVS ?</A +></H2 +><P +>You can find out more about obtaining Samba's via + anonymous CVS from + <A +HREF="http://pserver.samba.org/samba/cvs.html" +TARGET="_top" +> http://pserver.samba.org/samba/cvs.html"</A +>. </P +><P +></P +><DIV +CLASS="VARIABLELIST" +><P +><B +>There are basically four branches to watch at the moment :</B +></P +><DL +><DT +>HEAD</DT +><DD +><P +>Samba 3.0 ? This code boasts all the main development + work in Samba. Two things that most people are not aware of + which live in the HEAD branch code are winbind NSS module and + Tim Potter's VFS implementation. Due to its developmental + nature, its not really suitable for production work. + </P +></DD +><DT +>SAMBA_2_0</DT +><DD +><P +>This branch contains the current stable release release. + At the moment it contains 2.0.7, a version that will do some + limited PDC stuff. If you are really going to do PDC things then + I (drb) suggest that you consider 2.2 instead. + </P +></DD +><DT +>SAMBA_2_2</DT +><DD +><P +>The next stable release, currently in a 'alpha' form. + It provides the Samba developers, testers and interested + people with an approximation of what is to come. This document + addresses only SAMBA_2_2. + </P +></DD +><DT +>SAMBA_TNG</DT +><DD +><P +>This branch is no longer maintained from the Samba sites. + Please see <A +HREF="http://www.samba-tng.org/" +TARGET="_top" +> http://www.samba-tng.org/</A +>. It has been requested + that questions about TNG are not posted to the regular Samba mailing + lists including samba-ntdom and samba-technical. + </P +></DD +></DL +></DIV +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN118" +>What are the CVS commands ?</A +></H2 +><P +>See <A +HREF="http://pserver.samba.org/samba/cvs.html" +TARGET="_top" +> http://pserver.samba.org/samba/cvs.html</A +></P +><P +></P +><P +><B +>To get the Samba 2.2 version, tag SAMBA_2_2 you would do :</B +></P +><UL +><LI +><P +> For example : <B +CLASS="COMMAND" +>cd /usr/local/src/</B +></P +></LI +><LI +><P +> <B +CLASS="COMMAND" +>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot + login</B +></P +></LI +><LI +><P +> When prompted enter a password of <B +CLASS="COMMAND" +>cvs</B +></P +></LI +><LI +><P +> <B +CLASS="COMMAND" +>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot + co -r SAMBA_2_2 samba</B +></P +></LI +></UL +><P +></P +><P +><B +>Then to update that directory at some later time,</B +></P +><UL +><LI +><P +> <B +CLASS="COMMAND" +>cd /usr/local/src/samba</B +></P +></LI +><LI +><P +> <B +CLASS="COMMAND" +>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot login</B +></P +></LI +><LI +><P +> When prompted enter a password of 'cvs'.</P +></LI +><LI +><P +> <B +CLASS="COMMAND" +>cvs update -d -P</B +></P +></LI +></UL +></DIV +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="AEN149" +>Chapter 3. Establishing Connections</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN151" +></A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN153" +>How do I get my NT4 or W2000 Workstation to login to the Samba controlled Domain?</A +></H2 +><P +>There is a comprehensive Samba PDC <A +HREF="samba-pdc-howto.html" +TARGET="_top" +>HowTo</A +> + accessable from the samba web site + under 'Documentation'. Its currently located at <A +HREF="http://bioserve.latrobe.edu.au/samba" +TARGET="_top" +> http://bioserve.latrobe.edu.au/samba</A +>. Read it.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN158" +>What is a 'machine account' ?</A +></H2 +><P +>Every NT, W2K or Samba machine that joins a Samba controlled domain must be known to + the Samba PDC. There are two entries required, one in (typically) <TT +CLASS="FILENAME" +>/etc/passwd</TT +> + and the other in (typically) <TT +CLASS="FILENAME" +>/usr/local/samba/private/smbpasswd</TT +>. Under + some circumstances these entries are made <A +HREF="#AEN171" +>manually</A +>, the + <A +HREF="samba-pdc-howto.html" +TARGET="_top" +>HowTo</A +> discusses ways of creating them automatically.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN165" +>"The machine account for this computer either does not exist or is not accessable."</A +></H2 +><P +>When I try to join the domain I get the message "The machine account for this computer + either does not exist or is not accessable". Whats wrong ?</P +><P +>This problem is caused by the PDC not having a suitable machine account. + If you are using the <B +CLASS="COMMAND" +>add user script =</B +> method to create accounts + then this would indicate that it has not worked. Ensure the domain admin user + system is working.</P +><P +>Alternatively if you are creating account entries manually then they have not been created + correctly. Make sure that you have the entry correct for the machine account in smbpasswd + file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, + make sure that the account name is the machine netbios name with a '$' appended to it + ( ie. computer_name$ ). There must be an entry in both /etc/passwd and + the smbpasswd file. Some people have reported that + inconsistent subnet masks between the Samba server and the NT client have caused this problem. + Make sure that these are consistent for both client and server.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN171" +>How do I create machine accounts manually ?</A +></H2 +><P +>This was the only option until recently, now in version 2.2 better means are available. + You might still need to do it manually for a couple of reasons. A machine account + consists of two entries (assuming a standard install and /etc/passwd use), + one in /etc/passwd and the other in /usr/local/samba/private/smbpasswd. The /etc/passwd + entry will list the machine name with a $ appended, won't have a passwd, will have a null + shell and no home directory. For example a machine called 'doppy' would have an /etc/passwd + entry like this :</P +><P +><B +CLASS="COMMAND" +>doppy$:x:505:501:NTMachine:/dev/null:/bin/false</B +></P +><P +>On a linux system for example, you would typically add it like this :</P +><P +><B +CLASS="COMMAND" +>adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n + doppy$</B +></P +><P +>Then you need to add that entry to smbpasswd, assuming you have a suitable + path to the <B +CLASS="COMMAND" +>smbpasswd</B +> programme, do this :</P +><P +><B +CLASS="COMMAND" +>smbpasswd -a -m doppy$</B +></P +><P +>The entry will be created with a well known password, so any machine that + says its doppy could join the domain as long as it gets in first. So don't create + the accounts any earlier than you need them.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN184" +>I cannot include a '$' in a machine name.</A +></H2 +><P +>A 'machine name' in (typically) <TT +CLASS="FILENAME" +>/etc/passwd</TT +> consists + of the machine name with a '$' appended. FreeBSD (and other BSD systems ?) + won't create a user with a '$' in their name.</P +><P +>The problem is only in the program used to make the entry, once made, it works + perfectly. So create a user without the '$' and use <B +CLASS="COMMAND" +>vipw</B +> to edit + the entry, adding the '$'. Or create the whole entry with vipw if you like, + make sure you use a unique uid !</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN190" +>I get told "You already have a connection to the Domain...." when creating a + machine account.</A +></H2 +><P +>This happens if you try to create a machine account from the machine itself + and use a user name that does not work (for whatever reason) and then try + another (possibly valid) user name. + Exit out of the network applet to close the initial connection and try again.</P +><P +>Further, if the machine is a already a 'member of a workgroup' that is the + same name as the domain you are joining (bad idea) you will get this message. + Change the workgroup name to something else, it does not matter what, reboot, + and try again.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN194" +>I get told "Cannot join domain, the credentials supplied conflict + with an existing set.."</A +></H2 +><P +>This is the same basic problem as mentioned above, <A +HREF="#AEN190" +> "You already have a connection..."</A +></P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN198" +>"The system can not log you on (C000019B)...."</A +></H2 +><P +>I joined the domain successfully but after upgrading to a newer version of the + Samba code I get the message, "The system can not log you on (C000019B), Please try a + gain or consult your system administrator" when attempting to logon.</P +><P +>This occurs when the domain SID stored in private/WORKGROUP.SID is changed. + For example, you remove the file and smbd automatically creates a new one. + Or you are swapping back and forth between versions 2.0.7, TNG and the HEAD branch + code (not recommended). The only way to correct the problem is to restore the + original domain SID or remove the domain client from the domain and rejoin.</P +></DIV +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="AEN202" +>Chapter 4. User Account Management</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN204" +>Domain Admins</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN206" +>How do I configure an account as a domain administrator?</A +></H2 +><P +>See the NTDom <A +HREF="samba-pdc-howto.html" +TARGET="_top" +>HowTo</A +>.</P +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN210" +>Profiles</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN212" +>Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ?</A +></H2 +><P +>Sometimes Windows clients will maintain a connection to the \\homes\ ( or [%U] ) share + even after the user has logged out. Consider the following scenario.</P +><P +></P +><UL +><LI +><P +> user1 logs into the Windows NT machine. Therefore the + [homes] share is set to \\server\user1.</P +></LI +><LI +><P +> user1 works for a while and then logs out. </P +></LI +><LI +><P +> user2 logs into the same Windows NT machine.</P +></LI +></UL +><P +>However, since the NT box has maintained a connection to [homes] which was + previously set to \\server\user1, when the operating system attempts to + get the profile and if it can read users1's profile, will get it otherwise it + will return an error. You get the picture.</P +><P +>A better solution is to use a separate [profiles] share and set the + "logon path = \\%N\profiles\%U" </P +><DIV +CLASS="NOTE" +><BLOCKQUOTE +CLASS="NOTE" +><P +><B +>Note: </B +>Is this still a problem ????</P +></BLOCKQUOTE +></DIV +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN226" +>Why are all the users listed in the "domain admin users" using the same profile?</A +></H2 +><P +>You are using a very very old development version of Samba. Upgrade.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN229" +>The roaming profiles do not seem to be updating on the server.</A +></H2 +><P +>There can be several reasons for this.</P +><P +>Make sure that the time on the client and the PDC are synchronized. You can accomplish + this by executing a <B +CLASS="COMMAND" +>net time \\server /set /yes</B +> replacing server with the + name of your PDC (or another synchronized SMB server). See <A +HREF="#AEN333" +> about Setting Time</A +></P +><P +>Make sure that the + logon path is writeable by the user and make sure that the connection to the logon + path location is by the current user. Sometimes Windows client do not drop the + connection immediately upon logoff.</P +><P +>Some people have reported that the logon path location should also be browseable. + I (GC) have yet to emperically verify this, but you can try.</P +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN237" +>Policies</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN239" +>What are 'Policies' ?.</A +></H2 +><P +>When a user logs onto the domain via a client machine, the PDC sends + the client machine a list of things contained in the 'policy' (if it exists). + This list may do things like suppress a splach screen, format the dates the way you + like them or perhaps remove locally stored profiles.</P +><P +>On a samba PDC this list is obtained from a file called <B +CLASS="COMMAND" +>ntconfig.pol</B +> + and located in the <B +CLASS="COMMAND" +>[netlogon]</B +>share. The file is created with a policy editor + and must be readable by anyone and writeable by only root. See <A +HREF="#AEN260" +> below</A +> for how to get a suitable editor.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN246" +>I can't get system policies to work.</A +></H2 +><P +>There are two possible reasons for system policies not functioning correctly. + Make sure that you have the following parameters set in smb.conf </P +><PRE +CLASS="PROGRAMLISTING" +> [netlogon] + .... + locking = no + public = no + browseable = yes + .... + </PRE +><P +>A policy file must be in the <B +CLASS="COMMAND" +>[netlogon]</B +> share and must be + readable by everyone and writeable by only root. The file must be created + by an NTServer <A +HREF="#AEN260" +>Policy Editor</A +>.</P +><P +>Last time I (drb) looked in the source, it was + looking for <TT +CLASS="FILENAME" +>ntconfig.pol</TT +> first then several other combinations of upper + and lower case. People have reported success using <TT +CLASS="FILENAME" +>NTconfig.pol</TT +>, + <TT +CLASS="FILENAME" +>NTconfig.POL</TT +> and <TT +CLASS="FILENAME" +>ntconfig.pol</TT +>. These are the case + settings that I (GC) use with the + filename <TT +CLASS="FILENAME" +>ntconfig.pol</TT +></P +><PRE +CLASS="PROGRAMLISTING" +> case sensitive = no + case preserve = yes + default case = yes + </PRE +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN260" +>What about Windows NT Policy Editor ?</A +></H2 +><P +>To create or edit <B +CLASS="COMMAND" +>ntconfig.pol</B +> you must use the NT Server + Policy Editor, <B +CLASS="COMMAND" +>poledit.exe</B +> which is included with NT Server + but <I +CLASS="EMPHASIS" +>not NT Workstation</I +>. There is a Policy Editor on a NTws + but it is not suitable for creating <I +CLASS="EMPHASIS" +>Domain Policies</I +>. + Further, although the Windows 95 + Policy Editor can be installed on an NT Workstation/Server, it will not + work with NT policies because the registry key that are set by the policy templates. + However, the files from the NT Server will run happily enough on an NTws. + You need <TT +CLASS="FILENAME" +>poledit.exe, common.adm</TT +> and <TT +CLASS="FILENAME" +>winnt.adm</TT +>. It is convenient + to put the two *.adm files in <TT +CLASS="FILENAME" +>c:\winnt\inf</TT +> which is where + the binary will look for them unless told otherwise. Note also that that + directory is 'hidden'.</P +><P +>The Windows NT policy editor is also included with the + Service Pack 3 (and later) for Windows NT 4.0. Extract the files using + <B +CLASS="COMMAND" +>servicepackname /x</B +>, ie thats <B +CLASS="COMMAND" +>Nt4sp6ai.exe /x</B +> + for service pack 6a. + The policy editor, <B +CLASS="COMMAND" +>poledt.exe</B +> and the associated template files (*.adm) should + be extracted as well. It is also possible to downloaded the policy template + files for Office97 and get a copy of the policy editor. Another possible + location is with the Zero Administration Kit available for download from Microsoft. + </P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN274" +>Can Win95 do Policies ?</A +></H2 +><P +>Install the group policy handler for Win9x to pick up group policies. + Look on the Win98 CD in <TT +CLASS="FILENAME" +> \tools\reskit\netadmin\poledit</TT +>. Install group policies on a Win9x client by double-clicking + <TT +CLASS="FILENAME" +>grouppol.inf</TT +>. Log off and on again a couple of times and see if + Win98 picks up group policies. + Unfortunately this needs to be done on every Win9x machine that uses group policies....</P +><P +>If group policies don't work one reports suggests getting the updated (read: working) + grouppol.dll for Windows 9x. The group list is grabbed from /etc/group.</P +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN280" +>Passwords</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN282" +>What is password sync and should I use it ?</A +></H2 +><P +>NTws users can change their domain password by pressing Ctrl-Alt-Del and + choosing 'Change Password'. By default however, this does not change the unix password + (typically in <TT +CLASS="FILENAME" +>/etc/passwd or /etc/shadow</TT +>). In lots of situations + thats OK, for example :</P +><P +></P +><UL +><LI +><P +>The server is only accessible to the user via samba.</P +></LI +><LI +><P +>Pam_smb or similar is installed so other applications + still refer to the samba password.</P +></LI +></UL +><P +>But sometimes you really do need to maintain two seperate password databases and + there are good reasons to keep then in sync. Trying to explain to users + that they need to change their passwords in two seperate places or use + two seperate passwords is not fun.</P +><P +>However do understand that setting up password sync is not without problems either. + The chief difficulty is the interface between Samba and the <B +CLASS="COMMAND" +>passwd</B +> command, + it can be a fiddle to set up and if the password the user has entered fails, + the resulting errors are ambiguously reported + and the user is confused. Further, you need to take steps to ensure that users + only ever change their passwords via samba (or use <B +CLASS="COMMAND" +>smbpasswd</B +>), + otherwise they will only be changing the unix password.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN295" +>How do I get remote password (unix and SMB) changing working ?</A +></H2 +><P +>Have a practice changing a user's password (as root) to see what + discussion takes place and change the text in the 'passwd chat' line below as necessary. The + line as shown works for recent RH Linux but most other systems seem to like to do something + different. The '*' is a wild card and will match anything (or nothing). + </P +><P +>Add these lines to smb.conf under [Global]</P +><PRE +CLASS="PROGRAMLISTING" +> + + unix password sync = true + passwd program = /usr/bin/passwd %u + passwd chat = *password* %n\n *password* %n\n *successful* + </PRE +><P +>As mentioned above, the change to the unix password + happens as root, not as the user, as is indicated in ~/smbd/chgpasswd.c If + you are using NIS, the Samba server must be running on the NIS master machine.</P +></DIV +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="AEN301" +>Chapter 5. Miscellaneous</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN303" +></A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN305" +>What editor can I use in DOS/Windows that won't mess with my unix EOF</A +></H2 +><P +>There are a number of Windows or DOS based editors that will understand, and + leave intact, the unix eof (as opposed to a DOS CL/LF). List members suggested :</P +><P +></P +><UL +><LI +><P +>UltraEdit at <A +HREF="http://www.ultraedit.com" +TARGET="_top" +>www.ultraedit.com</A +></P +></LI +><LI +><P +>VI for windows at <A +HREF="http://home.snafu.de/ramo/WinViEn.htm" +TARGET="_top" +> home.snafu.de/ramo/WinViEn.htm</A +></P +></LI +><LI +><P +>The author prefers PFE at <A +HREF="http://www.lancs.ac.uk/people/cpaap/pfe/" +TARGET="_top" +> www.lancs.ac.uk/people/cpaap/pfe/</A +> but its no longer being developed...</P +></LI +></UL +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN318" +>How do I get 'User Manager' and 'Server Manager'</A +></H2 +><P +>Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for + Domains', the 'Server Manager' ?</P +><P +></P +><P +><B +>Microsoft distributes a version of these tools called nexus + for installation on Windows 95 systems. The tools set includes</B +></P +><UL +><LI +><P +>Server Manager</P +></LI +><LI +><P +>User Manager for Domains</P +></LI +><LI +><P +>Event Viewer</P +></LI +></UL +><P +>Click here to download the archived file + <A +HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE" +TARGET="_top" +> ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A +></P +><P +>The Windows NT 4.0 version of the 'User Manager for Domains' + and 'Server Manager' are available from Microsoft via ftp from + <A +HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" +TARGET="_top" +> ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A +></P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN333" +>The time setting from a Samba server does not work.</A +></H2 +><P +>If it works OK when you log on as Domain Admin then the problem is that ordinary users + don't have permission to change the time. (The system is running with their permission + at logon time.) This is not a Samba problem, you will have the same problem where ever + you connect. You can give 'everyone' permission to change the time from the User Manager. + </P +><P +>Anyone know what the registry settings are so this could be done with a Policy ?</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN337" +>"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A +></H2 +><P +>I keep getting the message "trust account xxx should be in DOMAIN_GROUP_RID_USERS." + in the logs. What do I need to do?</P +><P +>You are using one of the old development versions. Upgrade. + (The message is unimportant, was a reminder to a developer)</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN341" +>How do I get my samba server to become a member ( not PDC ) of an NT domain?</A +></H2 +><P +>In a domain that has a number of servers you only need one password database. + The machines that don't have their own ask the PDC to check for them. + This will work fine for a domain controlled by either a Samba or NT machine. + The following lines in smb.conf are typical, 'password server' points to the + samba machine (or an NT) that has the password list : </P +><PRE +CLASS="PROGRAMLISTING" +> + + [global] + ... + security = domain + workgroup = { Put your domain name here } + password server = { Put the ip of the PDC here } + encrypt passwords = yes + ... + </PRE +><P +>The samba server in question will have to 'join the domain', that requires + the domain controller to have a machine account for it. This is no different + to the machine account requirements to allow a NTws to join the domain. For + example, if we want a unix box called <I +CLASS="EMPHASIS" +>sleepy</I +> to ask the PDC called <I +CLASS="EMPHASIS" +>grumpy</I +> + to do its authentication then <I +CLASS="EMPHASIS" +>grumpy</I +> will need an entry in its smbpasswd + (assuming it's also samba) that starts with <I +CLASS="EMPHASIS" +>sleepy$</I +>. It would have to be + created <A +HREF="#AEN171" +>manually</A +>. </P +><P +>If the domain is controlled by an NTServer then the "Server Manager for Domains" + tool must be used to add 'sleepy' to the domain list.</P +><P +>In either case we then join the domain. If the domain is called <I +CLASS="EMPHASIS" +>forest</I +> + then on sleepy we would join the domain by typing :</P +><P +><B +CLASS="COMMAND" +>smbpasswd -j forest</B +></P +><P +>Note that the directory where the smbpasswd file would be + located should exist as this is where smbd will generate the MACHINE.SID file. This + might be <TT +CLASS="FILENAME" +>/usr/local/samba/private/FOREST.SLEEPY.SID</TT +> and + it contains the trust account password for the domain member. The permissions are + (and should remain) "rw-------</P +><P +>Note the Samba Servers without the password list will most likely still need an account + for each user, this means a line in its <TT +CLASS="FILENAME" +>/etc/passwd</TT +>. Because authentication + is being handled at the domain level the + <TT +CLASS="FILENAME" +>/etc/passwd</TT +> line does not need a password. + If the shares being offered are not user specific, ie a common (read only ?) + area or perhaps just printing then the user's + <TT +CLASS="FILENAME" +>/etc/passwd</TT +> does not need a home directory. A typical + line in <TT +CLASS="FILENAME" +>/etc/passwd</TT +> for a server that allows domain users to + connect to the samba shares but does not offer a home share ('cos that's on the PDC) + and does not allow logon to the unix prompt would be like this :</P +><PRE +CLASS="PROGRAMLISTING" +>jblow:x:542:100:Joe Blow:/dev/null:/bin/false</PRE +><DIV +CLASS="NOTE" +><BLOCKQUOTE +CLASS="NOTE" +><P +></P +><UL +><LI +><P +>When removing those 'dummy' users, watch the 'remove user' scripts, + some OS think they should remove a users directory even when its not owned by the user ! + </P +></LI +><LI +><P +>The <TT +CLASS="FILENAME" +>username map = </TT +> parameter might help you to avoid having + all those accounts created.</P +></LI +><LI +><P +>You should investigate the smb.conf parameter + <TT +CLASS="FILENAME" +>'add user script'</TT +>, it will be used to create accounts on + secondary servers when that account already exists on the PDC. Very nice. + Something like :</P +><PRE +CLASS="PROGRAMLISTING" +> [Global] + .... + add user script = /usr/sbin/adduser -n -g users -c User -d /dev/null -s /bin/false %U + .... + </PRE +></LI +></UL +></BLOCKQUOTE +></DIV +></DIV +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="AEN376" +>Chapter 6. Troubleshooting and Bug Reporting</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN378" +>Diagnostic tools</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN380" +>What are some diagnostics tools I can use to debug the domain logon process and where can I + find them?</A +></H2 +><P +>One of the best diagnostic tools for debugging problems is Samba itself. You can use the -d + option for both smbd and nmbd to specifiy what 'debug level' at which to run. See the man + pages on smbd, nmbd and smb.conf for more information on debugging options. The debug + level can range from 1 (the default) to around 100 but a debug level of about 20 will + normally help you find any errors that samba is encountering. Another helpful method + of debugging is to compile samba using the gcc -g flag. This will include debug + information in the binaries and allow you to attch gdb to the running smbd / nmbd + process. In order to attach gdb to an smbd process for an NT workstation, first + get the workstation to make the connection. Pressing ctrl-alt-delete and going down + to the domain box is sufficient (at least, on the first time you join the domain) to + generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation maintains an open + connection, and therefore there will be an smbd process running (assuming that you + haven't set a really short smbd idle timeout) So, in between pressing ctrl alt + delete, and actually typing in your password, you can gdb attach and continue.</P +><P +></P +><P +><B +>Some usefull samba commands worth investigating:</B +></P +><UL +><LI +><P +>testparam | more</P +></LI +><LI +><P +>smbclient -L //{netbios name of server}</P +></LI +></UL +><P +>An SMB enabled version of tcpdump is available from + <A +HREF="ftp://samba.org/pub/samba/tcpdump-smb/" +TARGET="_top" +>ftp://samba.org/pub/samba/tcpdump-smb/ + </A +></P +><P +>Capconvert is a small C program for translating output from tcpdump-smb to CAP format + that can be read by netmon. You will need to use the raw output from tcp dump + ( ie. <B +CLASS="COMMAND" +>tcpdump -w output.dump</B +> ). Good news! Now you can convert + Solaris' snoop output as well. The C source code for snoop2cap is available for download. + </P +><P +>For tracing things on the Microsoft Windows NT, Network Monitor (aka. netmon) is available + on the Microsoft Developer Network CD's, the Windows NT Server install CD and the SMS CD's. + The version of netmon that ships with SMS allows for dumping packets between any two + computers (ie. placing the network interface in promiscuous mode). The version + on the NT Server install CD will only allow monitoring of network traffic directed to the + local NT box and broadcasts on the local subnet.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN394" +>How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box?</A +></H2 +><P +>Installing netmon on an NT workstation requires a couple of steps. The following + are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server + 4.0, on Microsoft Windows NT Workstation 4.0. The process should be similar + for other version of Windows NT / Netmon. You will need both the Microsoft Windows + NT Server 4.0 Install CD and the Workstation 4.0 Install CD.</P +><P +>Initially you will need to install 'Network Monitor Tools and Agent' on the + NT Server. To do this </P +><P +></P +><UL +><LI +><P +>Goto Start - Settings - Control Panel - Network - Services - Add </P +></LI +><LI +><P +>Select the 'Network Monitor Tools and Agent' and click on 'OK'.</P +></LI +><LI +><P +>Click 'OK' on the Network Control Panel.</P +></LI +><LI +><P +>Insert the Windows NT Server 4.0 install CD when prompted.</P +></LI +></UL +><P +>At this point the Netmon files should exist in <TT +CLASS="FILENAME" +>%SYSTEMROOT%\System32\netmon\*.*</TT +>. + Two subdirectories exist as well, <TT +CLASS="FILENAME" +>parsers\</TT +> which contains the necessary DLL's + for parsing the netmon packet dump, and <TT +CLASS="FILENAME" +>captures\</TT +>.</P +><P +>In order to install the Netmon tools on an NT Workstation, you will first need to + install the 'Network Monitor Agent' from the Workstation install CD.</P +><P +></P +><UL +><LI +><P +>Goto Start - Settings - Control Panel - Network - Services - Add</P +></LI +><LI +><P +>Select the 'Network Monitor Agent' and click on 'OK'.</P +></LI +><LI +><P +>Click 'OK' on the Network Control Panel.</P +></LI +><LI +><P +>Insert the Windows NT Workstation 4.0 install CD when prompted.</P +></LI +></UL +><P +>Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* to + %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set permissions as + you deem appropriate for your site. You will need administrative rights on the + NT box to run netmon.</P +><P +>To install Netmon on a Windows 9x box install the network monitor agent from + the Windows 9x CD (\admin\nettools\netmon). + There is a readme file located with the netmon driver files on the CD if you need + information on how to do this. Copy the files from a working Netmon installation.</P +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN423" +>What other help can I get ?</A +></H1 +><P +>There are many sources of information available in the form of mailing lists, RFC's + and documentation. The docs that come with the samba distribution contain very + good explanations of general SMB topics such as browsing.</P +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN426" +>URLs and similar</A +></H2 +><P +></P +><UL +><LI +><P +>Home of Samba site <A +HREF="http://samba.org" +TARGET="_top" +> http://samba.org</A +>. We have a mirror near you !</P +></LI +><LI +><P +> The <I +CLASS="EMPHASIS" +>Development</I +> document + on the Samba mirrors might mention your problem. If so, + it might mean that the developers are working on it.</P +></LI +><LI +><P +> Ignacio Coupeau has a very comprehesive look at LDAP with Samba at + <A +HREF="http://www.unav.es/cti/ldap-smb-howto.html" +TARGET="_top" +> http://www.unav.es/cti/ldap-smb-howto.html</A +> + Be a little carefull however, I suspect that it does not specificly + address samba 2.2.x. The HEAD pre-2.1 may possibly be the best + stream to look at.</P +></LI +><LI +><P +> Lars Kneschke's site covers <A +HREF="http://www.samba-tng.org" +TARGET="_top" +> Samba-TNG</A +> at + <A +HREF="http://www.kneschke.de/projekte/samba_tng" +TARGET="_top" +> http://www.kneschke.de/projekte/samba_tng</A +>, but again, a + lot of it does not apply to the main stream Samba.</P +></LI +><LI +><P +>Although 2.0.7 has almost had its day as a PDC, I (drb) will + keep the 2.0.7 PDC pages at <A +HREF="http://bioserve.latrobe.edu.au/samba" +TARGET="_top" +> http://bioserve.latrobe.edu.au/samba</A +> going for a while yet.</P +></LI +><LI +><P +>Misc links to CIFS information + <A +HREF="http://samba.org/cifs/" +TARGET="_top" +>http://samba.org/cifs/</A +></P +></LI +><LI +><P +>NT Domains for Unix <A +HREF="http://mailhost.cb1.com/~lkcl/ntdom/" +TARGET="_top" +> http://mailhost.cb1.com/~lkcl/ntdom/</A +></P +></LI +><LI +><P +>FTP site for older SMB specs: + <A +HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/" +TARGET="_top" +> ftp://ftp.microsoft.com/developr/drg/CIFS/</A +></P +></LI +></UL +><P +></P +><P +><B +>There are a number of documents that no longer appear to live at their + origional home. Any one know where the following may be found ?</B +></P +><UL +><LI +><P +>CIFS/E Browser Protocol draft-leach-cifs-browser-spec-00.txt</P +></LI +><LI +><P +>CIFS Remote Administration Protocol draft-leach-cifs-rap-spec-00.txt</P +></LI +><LI +><P +>CIFS Logon and Pass Through Authentication draft-leach-cifs-logon-spec-00.txt</P +></LI +><LI +><P +>A Common Internet File System (CIFS/1.0) Protocol draft-leach-cifs-v1-spec-01.txt</P +></LI +><LI +><P +>CIFS Printing Specification draft-leach-cifs-print-spec-00.txt</P +></LI +><LI +><P +>RFC1001 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Concepts and methods. + http://ds.internic.net/rfc/rfc1001.txt </P +></LI +><LI +><P +>RFC1002 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Detailed specifications. + http://ds.internic.net/rfc/rfc1002.txt </P +></LI +><LI +><P +>Microsoft's main CIFS page: http://www.microsoft.com/workshop/networking/cifs/</P +></LI +></UL +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN472" +>How do I get help from the mailing lists ?</A +></H2 +><P +> There are a number of Samba related mailing lists. Go to <A +HREF="http://samba.org" +TARGET="_top" +>http://samba.org</A +>, click on your nearest mirror + and then click on <B +CLASS="COMMAND" +>Support</B +> and then click on <B +CLASS="COMMAND" +> Samba related mailing lists</B +>.</P +><P +>For questions relating to Samba TNG go to + <A +HREF="http://www.samba-tng.org/" +TARGET="_top" +>http://www.samba-tng.org/</A +> + It has been requested that you don't post questions about Samba-TNG to the + main stream Samba lists.</P +><P +></P +><P +><B +>If you post a message to one of the lists please + observe the following guide lines :</B +></P +><UL +><LI +><P +> Always remember that the developers are volunteers, they are + not paid and they never guarantee to produce a particular feature at + a particular time. Any time lines are 'best guess' and nothing more. + </P +></LI +><LI +><P +> Always mention what version of samba you are using and what + operating system its running under. You should probably list the + relevant sections of your smb.conf file, at least the options + in [global] that affect PDC support.</P +></LI +><LI +><P +>In addition to the version, if you obtained Samba via + CVS mention the date when you last checked it out.</P +></LI +><LI +><P +> Try and make your question clear and brief, lots of long, + convoluted questions get deleted before they are completely read ! + Don't post html encoded messages (if you can select colour or font + size its html).</P +></LI +><LI +><P +> If you run one of those niffy 'I'm on holidays' things when + you are away, make sure its configured to not answer mailing lists. + </P +></LI +><LI +><P +> Don't cross post. Work out which is the best list to post to + and see what happens, ie don't post to both samba-ntdom and samba-technical. + Many people active on the lists subscribe to more + than one list and get annoyed to see the same message two or more times. + Often someone will see a message and thinking it would be better dealt + with on another, will forward it on for you.</P +></LI +><LI +><P +>You might include <I +CLASS="EMPHASIS" +>partial</I +> + log files written at a debug level set to as much as 20. + Please don't send the entire log but enough to give the context of the + error messages.</P +></LI +><LI +><P +>(Possibly) If you have a complete netmon trace ( from the opening of + the pipe to the error ) you can send the *.CAP file as well.</P +></LI +><LI +><P +>Please think carefully before attaching a document to an email. + Consider pasting the relevant parts into the body of the message. The samba + mailing lists go to a huge number of people, do they all need a copy of your + smb.conf in their attach directory ?</P +></LI +></UL +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN501" +>How do I get off the mailing lists ?</A +></H2 +><P +>To have your name removed from a samba mailing list, go to the + same place you went to to get on it. Go to <A +HREF="http://samba.org" +TARGET="_top" +>http://samba.org</A +>, click on your nearest mirror + and then click on <B +CLASS="COMMAND" +>Support</B +> and then click on <B +CLASS="COMMAND" +> Samba related mailing lists</B +>. Or perhaps see + <A +HREF="http://lists.samba.org/mailman/roster/samba-ntdom" +TARGET="_top" +>here</A +></P +><P +>Please don't post messages to the list asking to be removed, you will just + be refered to the above address (unless that process failed in some way...) + </P +></DIV +></DIV +></DIV +></DIV +></BODY +></HTML +>
\ No newline at end of file diff --git a/docs/htmldocs/samba-pdc-howto.html b/docs/htmldocs/samba-pdc-howto.html new file mode 100644 index 0000000000..760e2e73b8 --- /dev/null +++ b/docs/htmldocs/samba-pdc-howto.html @@ -0,0 +1,2096 @@ +<HTML +><HEAD +><TITLE +>The Samba 2.2 PDC FAQ</TITLE +><META +NAME="GENERATOR" +CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD +><BODY +CLASS="BOOK" +BGCOLOR="#FFFFFF" +TEXT="#000000" +LINK="#0000FF" +VLINK="#840084" +ALINK="#0000FF" +><DIV +CLASS="BOOK" +><A +NAME="SAMBA-PDC-FAQ" +></A +><DIV +CLASS="TITLEPAGE" +><H1 +CLASS="TITLE" +><A +NAME="SAMBA-PDC-FAQ" +>The Samba 2.2 PDC FAQ</A +></H1 +><H3 +CLASS="AUTHOR" +><A +NAME="AEN4" +>David Bannon</A +></H3 +><DIV +CLASS="AFFILIATION" +><SPAN +CLASS="ORGNAME" +>La Trobe University<BR></SPAN +></DIV +><HR></DIV +><HR><H1 +><A +NAME="AEN12" +></A +></H1 +><P +>Comments, corrections and additions to <TT +CLASS="EMAIL" +><<A +HREF="mailto:D.Bannon@latrobe.edu.au" +>D.Bannon@latrobe.edu.au</A +>></TT +></P +><P +>This is the FAQ for Samba 2.2 as an NTDomain controller. + This document is derived from the origional FAQ that was built and + maintained by Gerald Carter + from the early days of Samba NTDomain development up until recently. + It is now being updated as significent changes are made to 2.2.0.</P +><P +>Please note it does not apply to Samba2.2alpha0, Samba2.2alpha1, Samba 2.0.7, TNG nor HEAD branch. + </P +><P +>I'll repeat, it does not apply to the current snapshot [ftp mirror]:/pub/samba/alpha/samba-2.2.0-alpha1.tar.gz, only to the to the current cvs.</P +><P +> Also available is a Samba 2.2 PDC <A +HREF="samba-pdc-howto.html" +TARGET="_top" +>HowTo</A +> that takes you, step + by step, over the process of setting up a very basic Samba 2.2 Primary Domain Controller + </P +><DIV +CLASS="NOTE" +><BLOCKQUOTE +CLASS="NOTE" +><P +><B +>Note: </B +>Please read the Introduction for the current <A +HREF="#AEN27" +> state of play</A +>.</P +></BLOCKQUOTE +></DIV +><DIV +CLASS="TOC" +><DL +><DT +><B +>Table of Contents</B +></DT +><DT +>1. <A +HREF="#AEN25" +>Introduction</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN27" +>State of Play</A +></DT +><DT +><A +HREF="#AEN44" +>Introduction</A +></DT +></DL +></DD +><DT +>2. <A +HREF="#AEN49" +>General Information</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN51" +>What can we do ?</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN53" +>What can Samba Primary Domain Controller (PDC) do ?</A +></DT +><DT +><A +HREF="#AEN86" +>Can I have a Windows 2000 client logon to a Samba controlled domain?</A +></DT +><DT +><A +HREF="#AEN89" +>What's the status of print spool (spoolss) support in the NTDOM code?</A +></DT +></DL +></DD +><DT +><A +HREF="#AEN92" +>CVS</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN95" +>What are the different Samba branches available in CVS ?</A +></DT +><DT +><A +HREF="#AEN118" +>What are the CVS commands ?</A +></DT +></DL +></DD +></DL +></DD +><DT +>3. <A +HREF="#AEN149" +>Establishing Connections</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN151" +></A +></DT +><DD +><DL +><DT +><A +HREF="#AEN153" +>How do I get my NT4 or W2000 Workstation to login to the Samba controlled Domain?</A +></DT +><DT +><A +HREF="#AEN158" +>What is a 'machine account' ?</A +></DT +><DT +><A +HREF="#AEN165" +>"The machine account for this computer either does not exist or is not accessable."</A +></DT +><DT +><A +HREF="#AEN171" +>How do I create machine accounts manually ?</A +></DT +><DT +><A +HREF="#AEN184" +>I cannot include a '$' in a machine name.</A +></DT +><DT +><A +HREF="#AEN190" +>I get told "You already have a connection to the Domain...." when creating a + machine account.</A +></DT +><DT +><A +HREF="#AEN194" +>I get told "Cannot join domain, the credentials supplied conflict + with an existing set.."</A +></DT +><DT +><A +HREF="#AEN198" +>"The system can not log you on (C000019B)...."</A +></DT +></DL +></DD +></DL +></DD +><DT +>4. <A +HREF="#AEN202" +>User Account Management</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN204" +>Domain Admins</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN206" +>How do I configure an account as a domain administrator?</A +></DT +></DL +></DD +><DT +><A +HREF="#AEN210" +>Profiles</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN212" +>Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ?</A +></DT +><DT +><A +HREF="#AEN226" +>Why are all the users listed in the "domain admin users" using the same profile?</A +></DT +><DT +><A +HREF="#AEN229" +>The roaming profiles do not seem to be updating on the server.</A +></DT +></DL +></DD +><DT +><A +HREF="#AEN237" +>Policies</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN239" +>What are 'Policies' ?.</A +></DT +><DT +><A +HREF="#AEN246" +>I can't get system policies to work.</A +></DT +><DT +><A +HREF="#AEN260" +>What about Windows NT Policy Editor ?</A +></DT +><DT +><A +HREF="#AEN274" +>Can Win95 do Policies ?</A +></DT +></DL +></DD +><DT +><A +HREF="#AEN280" +>Passwords</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN282" +>What is password sync and should I use it ?</A +></DT +><DT +><A +HREF="#AEN295" +>How do I get remote password (unix and SMB) changing working ?</A +></DT +></DL +></DD +></DL +></DD +><DT +>5. <A +HREF="#AEN301" +>Miscellaneous</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN303" +></A +></DT +><DD +><DL +><DT +><A +HREF="#AEN305" +>How do I get 'User Manager' and 'Server Manager'</A +></DT +><DT +><A +HREF="#AEN320" +>The time setting from a Samba server does not work.</A +></DT +><DT +><A +HREF="#AEN324" +>"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A +></DT +><DT +><A +HREF="#AEN328" +>How do I get my samba server to become a member ( not PDC ) of an NT domain?</A +></DT +></DL +></DD +></DL +></DD +><DT +>6. <A +HREF="#AEN363" +>Troubleshooting and Bug Reporting</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN365" +>Diagnostic tools</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN367" +>What are some diagnostics tools I can use to debug the domain logon process and where can I + find them?</A +></DT +><DT +><A +HREF="#AEN375" +>How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box?</A +></DT +></DL +></DD +><DT +><A +HREF="#AEN404" +>What other help can I get ?</A +></DT +><DD +><DL +><DT +><A +HREF="#AEN407" +>URLs and similar</A +></DT +><DT +><A +HREF="#AEN453" +>How do I get help from the mailing lists ?</A +></DT +><DT +><A +HREF="#AEN482" +>How do I get off the mailing lists ?</A +></DT +></DL +></DD +></DL +></DD +></DL +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="AEN25" +>Chapter 1. Introduction</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN27" +>State of Play</A +></H1 +><P +><I +CLASS="EMPHASIS" +>It should be noted that 2.2.0 in its pre-release form still has a few problems, + I'll try and keep this section current while things are still dynamic. + At the time of this update (November 13, 2000) the current state of play is :</I +></P +><P +>Comments here about W2K joining the domain apply only to Samba 2.2 from the CVS after November 27th. The + 'snapshot' release Samba2.2alpha1 does not work !!! See below on how to get a CVS tree.</P +><P +>Client Side creation of Machine accounts does work but is not complete. + Firstly, the <TT +CLASS="FILENAME" +>add user script</TT +> runs as the user who's + name was entered, not as root. Secondly, the machine name passed to the script (%U) + has an underscore at the end, not a '$'. One alternative is to use %m and add the $. + This method is documented in the <A +HREF="samba-pdc-howto.html" +TARGET="_top" +>HowTo</A +>. + And thirdly, it does not work with NT4ws. + </P +><P +>A W2K machine can join the domain. See the <A +HREF="samba-pdc-howto.html" +TARGET="_top" +>HowTo</A +> + which explains the process. The methods + described are 'work arounds' and should be regarded as temporary. Although I (drb) + have tested these procedures a number of people have had difficulty so there + may be other issues at work. JFM is aware of these + problems and will attend to them when he can.</P +><P +>A Domain Admin account is required and at present it appears that only root + is a suitable candidate.</P +><P +>Much of the related code does work. For example, if an NT is removed from the + domain and then rejoins, the <TT +CLASS="FILENAME" +>Create a Computer Account in the Domain</TT +> dialog + will let you reset the smbpasswd. That is you don't need to do it from + the unix box. However, at the present, you do need to have root as an + administrator and use the root user name and password.</P +><P +><I +CLASS="EMPHASIS" +>Actually I'm + not sure that last paragraph is correct ....</I +></P +><P +><B +CLASS="COMMAND" +>Policies</B +> do work on a W2K machine. MS says that recent builds of + W2K dont observe an NT policy but it appears it does in 'legacy' mode.</P +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN44" +>Introduction</A +></H1 +><P +>This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing with the 'old head' + version of Samba and its NTDomain facilities. It is being rewritten by David Bannon (drb) + so that it addresses more accurately the Samba 2.2 planned for release late 2000. </P +><P +>This document probably still contains some material that does not apply to + Samba 2.2 but most (all?) of the really misleading stuff has been removed. Some + issues are not dealt with or are dealt with badly. Please send corrections and additions to + David Bannon at D.Bannon@latrobe.edu.au</P +><P +>Hopefully, as we all become familiar with the Samba 2.2 as a PDC this document will + become much more usefull.</P +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="AEN49" +>Chapter 2. General Information</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN51" +>What can we do ?</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN53" +>What can Samba Primary Domain Controller (PDC) do ?</A +></H2 +><P +>If you wish to have Samba act as a PDC for Windows NT 3.51.and 4.0 or W2000 client, then you + will need to obtain the 2.2.0 version, currently in pre-release. Release of a stable, + full featured Samba PDC is currently slated for version 3.0. </P +><P +>The following is a list of included features currently in Samba 2.2:</P +><P +></P +><UL +><LI +><P +>The ability to act as a limited PDC for Windows NT and W2000 clients. + This includes adding NT and W2K machines to the domain and authenticating users logging + into the domain.</P +></LI +><LI +><P +>Domain account can be viewed using the User Manager for + Domains ????</P +></LI +><LI +><P +>Viewing resources on the Samba PDC via the Server Manager for Domains + from the NT client. ??</P +></LI +><LI +><P +>Windows 95 clients will allow user level security to be set + but will not currently allow browsing of accounts.</P +></LI +><LI +><P +>Machine account password updates.</P +></LI +><LI +><P +>Changing of user passwords from an NT client.</P +></LI +><LI +><P +>Partial support for Windows NT group and username mapping.</P +></LI +><LI +><P +>Support for a LDAP password database backend.</P +></LI +><LI +><P +>Printing.</P +></LI +></UL +><P +></P +><P +><B +>These things are note expected to work in the forseeable future</B +></P +><UL +><LI +><P +>Trust relationships</P +></LI +><LI +><P +>PDC and BDC integration</P +></LI +><LI +><P +>Windows NT ACLs (on the Samba shares)</P +></LI +><LI +><P +>Offer a list of domain users to User Manager for Domains + (or the Security Tab etc).</P +></LI +></UL +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN86" +>Can I have a Windows 2000 client logon to a Samba controlled domain?</A +></H2 +><P +>The 2.2 release branch of Samba supports Windows 2000 domain + clients in legacy mode, ie as if the PDC is a NTServer, not a + W2K server.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN89" +>What's the status of print spool (spoolss) support in the NTDOM code?</A +></H2 +><P +>The implementation of support for SPOOLSS pipe is complete and it will be available + in the 2.2.0 release. This means that Samba will support the automatic downloading of printer + drivers for Windows NT clients just as it currently does for Windows 9x clients.</P +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN92" +>CVS</A +></H1 +><P +>CVS is a programme (publically available) that the Samba developers use to + maintain the central source code. Non developers can get access to the source in + a read only capacity. Many flavours of unix now arrive with cvs installed.</P +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN95" +>What are the different Samba branches available in CVS ?</A +></H2 +><P +>You can find out more about obtaining Samba's via + anonymous CVS from + <A +HREF="http://pserver.samba.org/samba/cvs.html" +TARGET="_top" +> http://pserver.samba.org/samba/cvs.html"</A +>. </P +><P +></P +><DIV +CLASS="VARIABLELIST" +><P +><B +>There are basically four branches to watch at the moment :</B +></P +><DL +><DT +>HEAD</DT +><DD +><P +>Samba 3.0 ? This code boasts all the main development + work in Samba. Two things that most people are not aware of + which live in the HEAD branch code are winbind NSS module and + Tim Potter's VFS implementation. Due to its developmental + nature, its not really suitable for production work. + </P +></DD +><DT +>SAMBA_2_0</DT +><DD +><P +>This branch contains the current stable release release. + At the moment it contains 2.0.7, a version that will do some + limited PDC stuff. If you are really going to do PDC things then + I (drb) suggest that you consider 2.2 instead. + </P +></DD +><DT +>SAMBA_2_2</DT +><DD +><P +>The next stable release, currently in a 'alpha' form. + It provides the Samba developers, testers and interested + people with an approximation of what is to come. This document + addresses only SAMBA_2_2. + </P +></DD +><DT +>SAMBA_TNG</DT +><DD +><P +>This branch is no longer maintained from the Samba sites. + Please see <A +HREF="http://www.samba-tng.org/" +TARGET="_top" +> http://www.samba-tng.org/</A +>. It has been requested + that questions about TNG are not posted to the regular Samba mailing + lists including samba-ntdom and samba-technical. + </P +></DD +></DL +></DIV +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN118" +>What are the CVS commands ?</A +></H2 +><P +>See <A +HREF="http://pserver.samba.org/samba/cvs.html" +TARGET="_top" +> http://pserver.samba.org/samba/cvs.html</A +></P +><P +></P +><P +><B +>To get the Samba 2.2 version, tag SAMBA_2_2 you would do :</B +></P +><UL +><LI +><P +> For example : <B +CLASS="COMMAND" +>cd /usr/local/src/</B +></P +></LI +><LI +><P +> <B +CLASS="COMMAND" +>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot + login</B +></P +></LI +><LI +><P +> When prompted enter a password of <B +CLASS="COMMAND" +>cvs</B +></P +></LI +><LI +><P +> <B +CLASS="COMMAND" +>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot + co -r SAMBA_2_2 samba</B +></P +></LI +></UL +><P +></P +><P +><B +>Then to update that directory at some later time,</B +></P +><UL +><LI +><P +> <B +CLASS="COMMAND" +>cd /usr/local/src/samba</B +></P +></LI +><LI +><P +> <B +CLASS="COMMAND" +>cvs -d :pserver:cvs@pserver.samba.org:/cvsroot login</B +></P +></LI +><LI +><P +> When prompted enter a password of 'cvs'.</P +></LI +><LI +><P +> <B +CLASS="COMMAND" +>cvs update -d -P</B +></P +></LI +></UL +></DIV +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="AEN149" +>Chapter 3. Establishing Connections</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN151" +></A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN153" +>How do I get my NT4 or W2000 Workstation to login to the Samba controlled Domain?</A +></H2 +><P +>There is a comprehensive Samba PDC <A +HREF="samba-pdc-howto.html" +TARGET="_top" +>HowTo</A +> + accessable from the samba web site + under 'Documentation'. Its currently located at <A +HREF="http://bioserve.latrobe.edu.au/samba" +TARGET="_top" +> http://bioserve.latrobe.edu.au/samba</A +>. Read it.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN158" +>What is a 'machine account' ?</A +></H2 +><P +>Every NT, W2K or Samba machine that joins a Samba controlled domain must be known to + the Samba PDC. There are two entries required, one in (typically) <TT +CLASS="FILENAME" +>/etc/passwd</TT +> + and the other in (typically) <TT +CLASS="FILENAME" +>/usr/local/samba/private/smbpasswd</TT +>. Under + some circumstances these entries are made <A +HREF="#AEN171" +>manually</A +>, the + <A +HREF="samba-pdc-howto.html" +TARGET="_top" +>HowTo</A +> discusses ways of creating them automatically.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN165" +>"The machine account for this computer either does not exist or is not accessable."</A +></H2 +><P +>When I try to join the domain I get the message "The machine account for this computer + either does not exist or is not accessable". Whats wrong ?</P +><P +>This problem is caused by the PDC not having a suitable machine account. + If you are using the <B +CLASS="COMMAND" +>add user script =</B +> method to create accounts + then this would indicate that it has not worked. Ensure the domain admin user + system is working.</P +><P +>Alternatively if you are creating account entries manually then they have not been created + correctly. Make sure that you have the entry correct for the machine account in smbpasswd + file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, + make sure that the account name is the machine netbios name with a '$' appended to it + ( ie. computer_name$ ). There must be an entry in both /etc/passwd and + the smbpasswd file. Some people have reported that + inconsistent subnet masks between the Samba server and the NT client have caused this problem. + Make sure that these are consistent for both client and server.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN171" +>How do I create machine accounts manually ?</A +></H2 +><P +>This was the only option until recently, now in version 2.2 better means are available. + You might still need to do it manually for a couple of reasons. A machine account + consists of two entries (assuming a standard install and /etc/passwd use), + one in /etc/passwd and the other in /usr/local/samba/private/smbpasswd. The /etc/passwd + entry will list the machine name with a $ appended, won't have a passwd, will have a null + shell and no home directory. For example a machine called 'doppy' would have an /etc/passwd + entry like this :</P +><P +><B +CLASS="COMMAND" +>doppy$:x:505:501:NTMachine:/dev/null:/bin/false</B +></P +><P +>On a linux system for example, you would typically add it like this :</P +><P +><B +CLASS="COMMAND" +>adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n + doppy$</B +></P +><P +>Then you need to add that entry to smbpasswd, assuming you have a suitable + path to the <B +CLASS="COMMAND" +>smbpasswd</B +> programme, do this :</P +><P +><B +CLASS="COMMAND" +>smbpasswd -a -m doppy$</B +></P +><P +>The entry will be created with a well known password, so any machine that + says its doppy could join the domain as long as it gets in first. So don't create + the accounts any earlier than you need them.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN184" +>I cannot include a '$' in a machine name.</A +></H2 +><P +>A 'machine name' in (typically) <TT +CLASS="FILENAME" +>/etc/passwd</TT +> consists + of the machine name with a '$' appended. FreeBSD (and other BSD systems ?) + won't create a user with a '$' in their name.</P +><P +>The problem is only in the program used to make the entry, once made, it works + perfectly. So create a user without the '$' and use <B +CLASS="COMMAND" +>vipw</B +> to edit + the entry, adding the '$'. Or create the whole entry with vipw if you like, + make sure you use a unique uid !</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN190" +>I get told "You already have a connection to the Domain...." when creating a + machine account.</A +></H2 +><P +>This happens if you try to create a machine account from the machine itself + and use a user name that does not work (for whatever reason) and then try + another (possibly valid) user name. + Exit out of the network applet to close the initial connection and try again.</P +><P +>Further, if the machine is a already a 'member of a workgroup' that is the + same name as the domain you are joining (bad idea) you will get this message. + Change the workgroup name to something else, it does not matter what, reboot, + and try again.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN194" +>I get told "Cannot join domain, the credentials supplied conflict + with an existing set.."</A +></H2 +><P +>This is the same basic problem as mentioned above, <A +HREF="#AEN190" +> "You already have a connection..."</A +></P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN198" +>"The system can not log you on (C000019B)...."</A +></H2 +><P +>I joined the domain successfully but after upgrading to a newer version of the + Samba code I get the message, "The system can not log you on (C000019B), Please try a + gain or consult your system administrator" when attempting to logon.</P +><P +>This occurs when the domain SID stored in private/WORKGROUP.SID is changed. + For example, you remove the file and smbd automatically creates a new one. + Or you are swapping back and forth between versions 2.0.7, TNG and the HEAD branch + code (not recommended). The only way to correct the problem is to restore the + original domain SID or remove the domain client from the domain and rejoin.</P +></DIV +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="AEN202" +>Chapter 4. User Account Management</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN204" +>Domain Admins</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN206" +>How do I configure an account as a domain administrator?</A +></H2 +><P +>See the NTDom <A +HREF="samba-pdc-howto.html" +TARGET="_top" +>HowTo</A +>.</P +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN210" +>Profiles</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN212" +>Why is it bad to set "logon path = \\%N\%U\profile" in smb.conf? ?</A +></H2 +><P +>Sometimes Windows clients will maintain a connection to the \\homes\ ( or [%U] ) share + even after the user has logged out. Consider the following scenario.</P +><P +></P +><UL +><LI +><P +> user1 logs into the Windows NT machine. Therefore the + [homes] share is set to \\server\user1.</P +></LI +><LI +><P +> user1 works for a while and then logs out. </P +></LI +><LI +><P +> user2 logs into the same Windows NT machine.</P +></LI +></UL +><P +>However, since the NT box has maintained a connection to [homes] which was + previously set to \\server\user1, when the operating system attempts to + get the profile and if it can read users1's profile, will get it otherwise it + will return an error. You get the picture.</P +><P +>A better solution is to use a separate [profiles] share and set the + "logon path = \\%N\profiles\%U" </P +><DIV +CLASS="NOTE" +><BLOCKQUOTE +CLASS="NOTE" +><P +><B +>Note: </B +>Is this still a problem ????</P +></BLOCKQUOTE +></DIV +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN226" +>Why are all the users listed in the "domain admin users" using the same profile?</A +></H2 +><P +>You are using a very very old development version of Samba. Upgrade.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN229" +>The roaming profiles do not seem to be updating on the server.</A +></H2 +><P +>There can be several reasons for this.</P +><P +>Make sure that the time on the client and the PDC are synchronized. You can accomplish + this by executing a <B +CLASS="COMMAND" +>net time \\server /set /yes</B +> replacing server with the + name of your PDC (or another synchronized SMB server). See <A +HREF="#AEN320" +> about Setting Time</A +></P +><P +>Make sure that the + logon path is writeable by the user and make sure that the connection to the logon + path location is by the current user. Sometimes Windows client do not drop the + connection immediately upon logoff.</P +><P +>Some people have reported that the logon path location should also be browseable. + I (GC) have yet to emperically verify this, but you can try.</P +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN237" +>Policies</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN239" +>What are 'Policies' ?.</A +></H2 +><P +>When a user logs onto the domain via a client machine, the PDC sends + the client machine a list of things contained in the 'policy' (if it exists). + This list may do things like suppress a splach screen, format the dates the way you + like them or perhaps remove locally stored profiles.</P +><P +>On a samba PDC this list is obtained from a file called <B +CLASS="COMMAND" +>ntconfig.pol</B +> + and located in the <B +CLASS="COMMAND" +>[netlogon]</B +>share. The file is created with a policy editor + and must be readable by anyone and writeable by only root. See <A +HREF="#AEN260" +> below</A +> for how to get a suitable editor.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN246" +>I can't get system policies to work.</A +></H2 +><P +>There are two possible reasons for system policies not functioning correctly. + Make sure that you have the following parameters set in smb.conf </P +><PRE +CLASS="PROGRAMLISTING" +> [netlogon] + .... + locking = no + public = no + browseable = yes + .... + </PRE +><P +>A policy file must be in the <B +CLASS="COMMAND" +>[netlogon]</B +> share and must be + readable by everyone and writeable by only root. The file must be created + by an NTServer <A +HREF="#AEN260" +>Policy Editor</A +>.</P +><P +>Last time I (drb) looked in the source, it was + looking for <TT +CLASS="FILENAME" +>ntconfig.pol</TT +> first then several other combinations of upper + and lower case. People have reported success using <TT +CLASS="FILENAME" +>NTconfig.pol</TT +>, + <TT +CLASS="FILENAME" +>NTconfig.POL</TT +> and <TT +CLASS="FILENAME" +>ntconfig.pol</TT +>. These are the case + settings that I (GC) use with the + filename <TT +CLASS="FILENAME" +>ntconfig.pol</TT +></P +><PRE +CLASS="PROGRAMLISTING" +> case sensitive = no + case preserve = yes + default case = yes + </PRE +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN260" +>What about Windows NT Policy Editor ?</A +></H2 +><P +>To create or edit <B +CLASS="COMMAND" +>ntconfig.pol</B +> you must use the NT Server + Policy Editor, <B +CLASS="COMMAND" +>poledit.exe</B +> which is included with NT Server + but <I +CLASS="EMPHASIS" +>not NT Workstation</I +>. There is a Policy Editor on a NTws + but it is not suitable for creating <I +CLASS="EMPHASIS" +>Domain Policies</I +>. + Further, although the Windows 95 + Policy Editor can be installed on an NT Workstation/Server, it will not + work with NT policies because the registry key that are set by the policy templates. + However, the files from the NT Server will run happily enough on an NTws. + You need <TT +CLASS="FILENAME" +>poledit.exe, common.adm</TT +> and <TT +CLASS="FILENAME" +>winnt.adm</TT +>. It is convenient + to put the two *.adm files in <TT +CLASS="FILENAME" +>c:\winnt\inf</TT +> which is where + the binary will look for them unless told otherwise. Note also that that + directory is 'hidden'.</P +><P +>The Windows NT policy editor is also included with the + Service Pack 3 (and later) for Windows NT 4.0. Extract the files using + <B +CLASS="COMMAND" +>servicepackname /x</B +>, ie thats <B +CLASS="COMMAND" +>Nt4sp6ai.exe /x</B +> + for service pack 6a. + The policy editor, <B +CLASS="COMMAND" +>poledt.exe</B +> and the associated template files (*.adm) should + be extracted as well. It is also possible to downloaded the policy template + files for Office97 and get a copy of the policy editor. Another possible + location is with the Zero Administration Kit available for download from Microsoft. + </P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN274" +>Can Win95 do Policies ?</A +></H2 +><P +>Install the group policy handler for Win9x to pick up group policies. + Look on the Win98 CD in <TT +CLASS="FILENAME" +> \tools\reskit\netadmin\poledit</TT +>. Install group policies on a Win9x client by double-clicking + <TT +CLASS="FILENAME" +>grouppol.inf</TT +>. Log off and on again a couple of times and see if + Win98 picks up group policies. + Unfortunately this needs to be done on every Win9x machine that uses group policies....</P +><P +>If group policies don't work one reports suggests getting the updated (read: working) + grouppol.dll for Windows 9x. The group list is grabbed from /etc/group.</P +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN280" +>Passwords</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN282" +>What is password sync and should I use it ?</A +></H2 +><P +>NTws users can change their domain password by pressing Ctrl-Alt-Del and + choosing 'Change Password'. By default however, this does not change the unix password + (typically in <TT +CLASS="FILENAME" +>/etc/passwd or /etc/shadow</TT +>). In lots of situations + thats OK, for example :</P +><P +></P +><UL +><LI +><P +>The server is only accessible to the user via samba.</P +></LI +><LI +><P +>Pam_smb or similar is installed so other applications + still refer to the samba password.</P +></LI +></UL +><P +>But sometimes you really do need to maintain two seperate password databases and + there are good reasons to keep then in sync. Trying to explain to users + that they need to change their passwords in two seperate places or use + two seperate passwords is not fun.</P +><P +>However do understand that setting up password sync is not without problems either. + The chief difficulty is the interface between Samba and the <B +CLASS="COMMAND" +>passwd</B +> command, + it can be a fiddle to set up and if the password the user has entered fails, + the resulting errors are ambiguously reported + and the user is confused. Further, you need to take steps to ensure that users + only ever change their passwords via samba (or use <B +CLASS="COMMAND" +>smbpasswd</B +>), + otherwise they will only be changing the unix password.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN295" +>How do I get remote password (unix and SMB) changing working ?</A +></H2 +><P +>Have a practice changing a user's password (as root) to see what + discussion takes place and change the text in the 'passwd chat' line below as necessary. The + line as shown works for recent RH Linux but most other systems seem to like to do something + different. The '*' is a wild card and will match anything (or nothing). + </P +><P +>Add these lines to smb.conf under [Global]</P +><PRE +CLASS="PROGRAMLISTING" +> + + unix password sync = true + passwd program = /usr/bin/passwd %u + passwd chat = *password* %n\n *password* %n\n *successful* + </PRE +><P +>As mentioned above, the change to the unix password + happens as root, not as the user, as is indicated in ~/smbd/chgpasswd.c If + you are using NIS, the Samba server must be running on the NIS master machine.</P +></DIV +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="AEN301" +>Chapter 5. Miscellaneous</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN303" +></A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN305" +>How do I get 'User Manager' and 'Server Manager'</A +></H2 +><P +>Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for + Domains', the 'Server Manager' ?</P +><P +></P +><P +><B +>Microsoft distributes a version of these tools called nexus + for installation on Windows 95 systems. The tools set includes</B +></P +><UL +><LI +><P +>Server Manager</P +></LI +><LI +><P +>User Manager for Domains</P +></LI +><LI +><P +>Event Viewer</P +></LI +></UL +><P +>Click here to download the archived file + <A +HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE" +TARGET="_top" +> ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A +></P +><P +>The Windows NT 4.0 version of the 'User Manager for Domains' + and 'Server Manager' are available from Microsoft via ftp from + <A +HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" +TARGET="_top" +> ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A +></P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN320" +>The time setting from a Samba server does not work.</A +></H2 +><P +>If it works OK when you log on as Domain Admin then the problem is that ordinary users + don't have permission to change the time. (The system is running with their permission + at logon time.) This is not a Samba problem, you will have the same problem where ever + you connect. You can give 'everyone' permission to change the time from the User Manager. + </P +><P +>Anyone know what the registry settings are so this could be done with a Policy ?</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN324" +>"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A +></H2 +><P +>I keep getting the message "trust account xxx should be in DOMAIN_GROUP_RID_USERS." + in the logs. What do I need to do?</P +><P +>You are using one of the old development versions. Upgrade. + (The message is unimportant, was a reminder to a developer)</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN328" +>How do I get my samba server to become a member ( not PDC ) of an NT domain?</A +></H2 +><P +>In a domain that has a number of servers you only need one password database. + The machines that don't have their own ask the PDC to check for them. + This will work fine for a domain controlled by either a Samba or NT machine. + The following lines in smb.conf are typical, 'password server' points to the + samba machine (or an NT) that has the password list : </P +><PRE +CLASS="PROGRAMLISTING" +> + + [global] + ... + security = domain + workgroup = { Put your domain name here } + password server = { Put the ip of the PDC here } + encrypt passwords = yes + ... + </PRE +><P +>The samba server in question will have to 'join the domain', that requires + the domain controller to have a machine account for it. This is no different + to the machine account requirements to allow a NTws to join the domain. For + example, if we want a unix box called <I +CLASS="EMPHASIS" +>sleepy</I +> to ask the PDC called <I +CLASS="EMPHASIS" +>grumpy</I +> + to do its authentication then <I +CLASS="EMPHASIS" +>grumpy</I +> will need an entry in its smbpasswd + (assuming it's also samba) that starts with <I +CLASS="EMPHASIS" +>sleepy$</I +>. It would have to be + created <A +HREF="#AEN171" +>manually</A +>. </P +><P +>If the domain is controlled by an NTServer then the "Server Manager for Domains" + tool must be used to add 'sleepy' to the domain list.</P +><P +>In either case we then join the domain. If the domain is called <I +CLASS="EMPHASIS" +>forest</I +> + then on sleepy we would join the domain by typing :</P +><P +><B +CLASS="COMMAND" +>smbpasswd -j forest</B +></P +><P +>Note that the directory where the smbpasswd file would be + located should exist as this is where smbd will generate the MACHINE.SID file. This + might be <TT +CLASS="FILENAME" +>/usr/local/samba/private/FOREST.SLEEPY.SID</TT +> and + it contains the trust account password for the domain member. The permissions are + (and should remain) "rw-------</P +><P +>Note the Samba Servers without the password list will most likely still need an account + for each user, this means a line in its <TT +CLASS="FILENAME" +>/etc/passwd</TT +>. Because authentication + is being handled at the domain level the + <TT +CLASS="FILENAME" +>/etc/passwd</TT +> line does not need a password. + If the shares being offered are not user specific, ie a common (read only ?) + area or perhaps just printing then the user's + <TT +CLASS="FILENAME" +>/etc/passwd</TT +> does not need a home directory. A typical + line in <TT +CLASS="FILENAME" +>/etc/passwd</TT +> for a server that allows domain users to + connect to the samba shares but does not offer a home share ('cos that's on the PDC) + and does not allow logon to the unix prompt would be like this :</P +><PRE +CLASS="PROGRAMLISTING" +>jblow:x:542:100:Joe Blow:/dev/null:/bin/false</PRE +><DIV +CLASS="NOTE" +><BLOCKQUOTE +CLASS="NOTE" +><P +></P +><UL +><LI +><P +>When removing those 'dummy' users, watch the 'remove user' scripts, + some OS think they should remove a users directory even when its not owned by the user ! + </P +></LI +><LI +><P +>The <TT +CLASS="FILENAME" +>username map = </TT +> parameter might help you to avoid having + all those accounts created.</P +></LI +><LI +><P +>You should investigate the smb.conf parameter + <TT +CLASS="FILENAME" +>'add user script'</TT +>, it will be used to create accounts on + secondary servers when that account already exists on the PDC. Very nice. + Something like :</P +><PRE +CLASS="PROGRAMLISTING" +> [Global] + .... + add user script = /usr/sbin/adduser -n -g users -c User -d /dev/null -s /bin/false %U + .... + </PRE +></LI +></UL +></BLOCKQUOTE +></DIV +></DIV +></DIV +></DIV +><DIV +CLASS="CHAPTER" +><HR><H1 +><A +NAME="AEN363" +>Chapter 6. Troubleshooting and Bug Reporting</A +></H1 +><DIV +CLASS="SECT1" +><H1 +CLASS="SECT1" +><A +NAME="AEN365" +>Diagnostic tools</A +></H1 +><DIV +CLASS="SECT2" +><H2 +CLASS="SECT2" +><A +NAME="AEN367" +>What are some diagnostics tools I can use to debug the domain logon process and where can I + find them?</A +></H2 +><P +>One of the best diagnostic tools for debugging problems is Samba itself. You can use the -d + option for both smbd and nmbd to specifiy what 'debug level' at which to run. See the man + pages on smbd, nmbd and smb.conf for more information on debugging options. The debug + level can range from 1 (the default) to around 100 but a debug level of about 20 will + normally help you find any errors that samba is encountering. Another helpful method + of debugging is to compile samba using the gcc -g flag. This will include debug + information in the binaries and allow you to attch gdb to the running smbd / nmbd + process. In order to attach gdb to an smbd process for an NT workstation, first + get the workstation to make the connection. Pressing ctrl-alt-delete and going down + to the domain box is sufficient (at least, on the first time you join the domain) to + generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation maintains an open + connection, and therefore there will be an smbd process running (assuming that you + haven't set a really short smbd idle timeout) So, in between pressing ctrl alt + delete, and actually typing in your password, you can gdb attach and continue.</P +><P +>An SMB enabled version of tcpdump is available from + <A +HREF="ftp://samba.org/pub/samba/tcpdump-smb/" +TARGET="_top" +>ftp://samba.org/pub/samba/tcpdump-smb/ + </A +></P +><P +>Capconvert is a small C program for translating output from tcpdump-smb to CAP format + that can be read by netmon. You will need to use the raw output from tcp dump + ( ie. <B +CLASS="COMMAND" +>tcpdump -w output.dump</B +> ). Good news! Now you can convert + Solaris' snoop output as well. The C source code for snoop2cap is available for download. + </P +><P +>For tracing things on the Microsoft Windows NT, Network Monitor (aka. netmon) is available + on the Microsoft Developer Network CD's, the Windows NT Server install CD and the SMS CD's. + The version of netmon that ships with SMS allows for dumping packets between any two + computers (ie. placing the network interface in promiscuous mode). The version + on the NT Server install CD will only allow monitoring of network traffic directed to the + local NT box and broadcasts on the local subnet.</P +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN375" +>How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box?</A +></H2 +><P +>Installing netmon on an NT workstation requires a couple of steps. The following + are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server + 4.0, on Microsoft Windows NT Workstation 4.0. The process should be similar + for other version of Windows NT / Netmon. You will need both the Microsoft Windows + NT Server 4.0 Install CD and the Workstation 4.0 Install CD.</P +><P +>Initially you will need to install 'Network Monitor Tools and Agent' on the + NT Server. To do this </P +><P +></P +><UL +><LI +><P +>Goto Start - Settings - Control Panel - Network - Services - Add </P +></LI +><LI +><P +>Select the 'Network Monitor Tools and Agent' and click on 'OK'.</P +></LI +><LI +><P +>Click 'OK' on the Network Control Panel.</P +></LI +><LI +><P +>Insert the Windows NT Server 4.0 install CD when prompted.</P +></LI +></UL +><P +>At this point the Netmon files should exist in <TT +CLASS="FILENAME" +>%SYSTEMROOT%\System32\netmon\*.*</TT +>. + Two subdirectories exist as well, <TT +CLASS="FILENAME" +>parsers\</TT +> which contains the necessary DLL's + for parsing the netmon packet dump, and <TT +CLASS="FILENAME" +>captures\</TT +>.</P +><P +>In order to install the Netmon tools on an NT Workstation, you will first need to + install the 'Network Monitor Agent' from the Workstation install CD.</P +><P +></P +><UL +><LI +><P +>Goto Start - Settings - Control Panel - Network - Services - Add</P +></LI +><LI +><P +>Select the 'Network Monitor Agent' and click on 'OK'.</P +></LI +><LI +><P +>Click 'OK' on the Network Control Panel.</P +></LI +><LI +><P +>Insert the Windows NT Workstation 4.0 install CD when prompted.</P +></LI +></UL +><P +>Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* to + %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set permissions as + you deem appropriate for your site. You will need administrative rights on the + NT box to run netmon.</P +><P +>To install Netmon on a Windows 9x box install the network monitor agent from + the Windows 9x CD (\admin\nettools\netmon). + There is a readme file located with the netmon driver files on the CD if you need + information on how to do this. Copy the files from a working Netmon installation.</P +></DIV +></DIV +><DIV +CLASS="SECT1" +><HR><H1 +CLASS="SECT1" +><A +NAME="AEN404" +>What other help can I get ?</A +></H1 +><P +>There are many sources of information available in the form of mailing lists, RFC's + and documentation. The docs that come with the samba distribution contain very + good explanations of general SMB topics such as browsing.</P +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN407" +>URLs and similar</A +></H2 +><P +></P +><UL +><LI +><P +>Home of Samba site <A +HREF="http://samba.org" +TARGET="_top" +> http://samba.org</A +>. We have a mirror near you !</P +></LI +><LI +><P +> The <I +CLASS="EMPHASIS" +>Development</I +> document + on the Samba mirrors might mention your problem. If so, + it might mean that the developers are working on it.</P +></LI +><LI +><P +> Ignacio Coupeau has a very comprehesive look at LDAP with Samba at + <A +HREF="http://www.unav.es/cti/ldap-smb-howto.html" +TARGET="_top" +> http://www.unav.es/cti/ldap-smb-howto.html</A +> + Be a little carefull however, I suspect that it does not specificly + address samba 2.2.x. The HEAD pre-2.1 may possibly be the best + stream to look at.</P +></LI +><LI +><P +> Lars Kneschke's site covers <A +HREF="http://www.samba-tng.org" +TARGET="_top" +> Samba-TNG</A +> at + <A +HREF="http://www.kneschke.de/projekte/samba_tng" +TARGET="_top" +> http://www.kneschke.de/projekte/samba_tng</A +>, but again, a + lot of it does not apply to the main stream Samba.</P +></LI +><LI +><P +>Although 2.0.7 has almost had its day as a PDC, I (drb) will + keep the 2.0.7 PDC pages at <A +HREF="http://bioserve.latrobe.edu.au/samba" +TARGET="_top" +> http://bioserve.latrobe.edu.au/samba</A +> going for a while yet.</P +></LI +><LI +><P +>Misc links to CIFS information + <A +HREF="http://samba.org/cifs/" +TARGET="_top" +>http://samba.org/cifs/</A +></P +></LI +><LI +><P +>NT Domains for Unix <A +HREF="http://mailhost.cb1.com/~lkcl/ntdom/" +TARGET="_top" +> http://mailhost.cb1.com/~lkcl/ntdom/</A +></P +></LI +><LI +><P +>FTP site for older SMB specs: + <A +HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/" +TARGET="_top" +> ftp://ftp.microsoft.com/developr/drg/CIFS/</A +></P +></LI +></UL +><P +></P +><P +><B +>There are a number of documents that no longer appear to live at their + origional home. Any one know where the following may be found ?</B +></P +><UL +><LI +><P +>CIFS/E Browser Protocol draft-leach-cifs-browser-spec-00.txt</P +></LI +><LI +><P +>CIFS Remote Administration Protocol draft-leach-cifs-rap-spec-00.txt</P +></LI +><LI +><P +>CIFS Logon and Pass Through Authentication draft-leach-cifs-logon-spec-00.txt</P +></LI +><LI +><P +>A Common Internet File System (CIFS/1.0) Protocol draft-leach-cifs-v1-spec-01.txt</P +></LI +><LI +><P +>CIFS Printing Specification draft-leach-cifs-print-spec-00.txt</P +></LI +><LI +><P +>RFC1001 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Concepts and methods. + http://ds.internic.net/rfc/rfc1001.txt </P +></LI +><LI +><P +>RFC1002 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Detailed specifications. + http://ds.internic.net/rfc/rfc1002.txt </P +></LI +><LI +><P +>Microsoft's main CIFS page: http://www.microsoft.com/workshop/networking/cifs/</P +></LI +></UL +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN453" +>How do I get help from the mailing lists ?</A +></H2 +><P +> There are a number of Samba related mailing lists. Go to <A +HREF="http://samba.org" +TARGET="_top" +>http://samba.org</A +>, click on your nearest mirror + and then click on <B +CLASS="COMMAND" +>Support</B +> and then click on <B +CLASS="COMMAND" +> Samba related mailing lists</B +>.</P +><P +>For questions relating to Samba TNG go to + <A +HREF="http://www.samba-tng.org/" +TARGET="_top" +>http://www.samba-tng.org/</A +> + It has been requested that you don't post questions about Samba-TNG to the + main stream Samba lists.</P +><P +></P +><P +><B +>If you post a message to one of the lists please + observe the following guide lines :</B +></P +><UL +><LI +><P +> Always remember that the developers are volunteers, they are + not paid and they never guarantee to produce a particular feature at + a particular time. Any time lines are 'best guess' and nothing more. + </P +></LI +><LI +><P +> Always mention what version of samba you are using and what + operating system its running under. You should probably list the + relevant sections of your smb.conf file, at least the options + in [global] that affect PDC support.</P +></LI +><LI +><P +>In addition to the version, if you obtained Samba via + CVS mention the date when you last checked it out.</P +></LI +><LI +><P +> Try and make your question clear and brief, lots of long, + convoluted questions get deleted before they are completely read ! + Don't post html encoded messages (if you can select colour or font + size its html).</P +></LI +><LI +><P +> If you run one of those niffy 'I'm on holidays' things when + you are away, make sure its configured to not answer mailing lists. + </P +></LI +><LI +><P +> Don't cross post. Work out which is the best list to post to + and see what happens, ie don't post to both samba-ntdom and samba-technical. + Many people active on the lists subscribe to more + than one list and get annoyed to see the same message two or more times. + Often someone will see a message and thinking it would be better dealt + with on another, will forward it on for you.</P +></LI +><LI +><P +>You might include <I +CLASS="EMPHASIS" +>partial</I +> + log files written at a debug level set to as much as 20. + Please don't send the entire log but enough to give the context of the + error messages.</P +></LI +><LI +><P +>(Possibly) If you have a complete netmon trace ( from the opening of + the pipe to the error ) you can send the *.CAP file as well.</P +></LI +><LI +><P +>Please think carefully before attaching a document to an email. + Consider pasting the relevant parts into the body of the message. The samba + mailing lists go to a huge number of people, do they all need a copy of your + smb.conf in their attach directory ?</P +></LI +></UL +></DIV +><DIV +CLASS="SECT2" +><HR><H2 +CLASS="SECT2" +><A +NAME="AEN482" +>How do I get off the mailing lists ?</A +></H2 +><P +>To have your name removed from a samba mailing list, go to the + same place you went to to get on it. Go to <A +HREF="http://samba.org" +TARGET="_top" +>http://samba.org</A +>, click on your nearest mirror + and then click on <B +CLASS="COMMAND" +>Support</B +> and then click on <B +CLASS="COMMAND" +> Samba related mailing lists</B +>. Or perhaps see + <A +HREF="http://lists.samba.org/mailman/roster/samba-ntdom" +TARGET="_top" +>here</A +></P +><P +>Please don't post messages to the list asking to be removed, you will just + be refered to the above address (unless that process failed in some way...) + </P +></DIV +></DIV +></DIV +></DIV +></BODY +></HTML +>
\ No newline at end of file |