diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/docbook/projdoc/AdvancedNetworkAdmin.sgml | 178 | ||||
| -rw-r--r-- | docs/docbook/projdoc/NT4Migration.sgml | 47 | ||||
| -rw-r--r-- | docs/docbook/projdoc/PolicyMgmt.sgml | 304 | ||||
| -rw-r--r-- | docs/docbook/projdoc/ProfileMgmt.sgml | 644 | ||||
| -rw-r--r-- | docs/docbook/projdoc/SWAT.sgml | 80 |
5 files changed, 1253 insertions, 0 deletions
diff --git a/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml new file mode 100644 index 0000000000..fe0774810b --- /dev/null +++ b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml @@ -0,0 +1,178 @@ +<chapter id="AdvancedNetworkManagement"> +<chapterinfo> + <author> + <firstname>John H</firstname><surname>Terpstra</surname> + <affiliation> + <orgname>Samba Team</orgname> + <address> + <email>jht@samba.org</email> + </address> + </affiliation> + </author> + <pubdate>April 3 2003</pubdate> +</chapterinfo> + +<title>Advanced Network Manangement</title> + +<para> +This section attempts to document peripheral issues that are of great importance to network +administrators who want to improve network resource access control, to automate the user +environment, and to make their lives a little easier. +</para> + +<sect1> +<title>Configuring Samba Share Access Controls</title> + +<para> +This section deals with how to configure Samba per share access control restrictions. +By default samba sets no restrictions on the share itself. Restrictions on the share itself +can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can +connect to a share. In the absence of specific restrictions the default setting is to allow +the global user <emphasis>Everyone</emphasis> Full Control (ie: Full control, Change and Read). +</para> + +<para> +At this time Samba does NOT provide a tool for configuring access control setting on the Share +itself. Samba does have the capacity to store and act on access control settings, but the only +way to create those settings is to use either the NT4 Server Manager or the Windows 200x MMC for +Computer Management. +</para> + +<para> +Samba stores the per share access control settings in a file called <filename>share_info.tdb</filename>. +The location of this file on your system will depend on how samba was compiled. The default location +for samba's tdb files is under <filename>/usr/local/samba/var</filename>. If the <filename>tdbdump</filename> +utility has been compiled and installed on your system then you can examine the contents of this file +by: <filename>tdbdump share_info.tdb</filename>. +</para> + +<sect2> +<title>Share Permissions Management</title> + +<para> +The best tool for the task is platform dependant. Choose the best tool for your environmemt. +</para> + +<sect3> +<title>Windows NT4 Workstation/Server</title> +<para> +The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. +Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. +You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below. +</para> + +<para> +Instructions: +</para> + + <para> + Launch the NT4 Server Manager, click on the Samba server you want to administer, then from the menu + select Computer, then click on the Shared Directories entry. + </para> + + <para> + Now click on the share that you wish to manage, then click on the Properties tab, next click on + the Permissions tab. Now you can Add or change access control settings as you wish. + </para> + +</sect3> + +<sect3> +<title>Windows 200x/XP</title> + +<para> +On MS Windows NT4/200x/XP system access control lists on the share itself are set using native +tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder, +then select 'Sharing', then click on 'Permissions'. The default Windows NT4/200x permission allows +<emphasis>Everyone</emphasis> Full Control on the Share. +</para> + +<para> +MS Windows 200x and later all comes with a tool called the 'Computer Management' snap-in for the +Microsoft Management Console (MMC). This tool is located by clicking on <filename>Control Panel -> +Administrative Tools -> Computer Management</filename>. +</para> + +<para> +Instructions: +</para> + <para> + After launching the MMC with the Computer Management snap-in, click on the menu item 'Action', + select 'Connect to another computer'. If you are not logged onto a domain you will be prompted + to enter a domain login user identifier and a password. This will authenticate you to the domain. + If you where already logged in with administrative privilidge this step is not offered. + </para> + + <para> + If the Samba server is not shown in the Select Computer box, then type in the name of the target + Samba server in the field 'Name:'. Now click on the [+] next to 'System Tools', then on the [+] + next to 'Shared Folders' in the left panel. + </para> + + <para> + Now in the right panel, double-click on the share you wish to set access control permissions on. + Then click on the tab 'Share Permissions'. It is now possible to add access control entities + to the shared folder. Do NOT forget to set what type of access (full control, change, read) you + wish to assign for each entry. + </para> + + <note> + <para> + Be careful. If you take away all permissions from the Everyone user without removing this user + then effectively no user will be able to access the share. This is a result of what is known as + ACL precidence. ie: Everyone with NO ACCESS means that MaryK who is part of the group Everyone + will have no access even if this user is given explicit full control access. + </para> + </note> + +</sect3> +</sect2> +</sect1> + +<sect1> +<title>Remote Server Administration</title> + +<para> +<emphasis>How do I get 'User Manager' and 'Server Manager'?</emphasis> +</para> + +<para> +Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains', +the 'Server Manager'? +</para> + +<para> +Microsoft distributes a version of these tools called nexus for installation on Windows 9x / Me +systems. The tools set includes: +</para> + +<itemizedlist> + <listitem><para>Server Manager</para></listitem> + + <listitem><para>User Manager for Domains</para></listitem> + + <listitem><para>Event Viewer</para></listitem> +</itemizedlist> + +<para> +Click here to download the archived file <ulink +url="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</ulink> +</para> + +<para> +The Windows NT 4.0 version of the 'User Manager for +Domains' and 'Server Manager' are available from Microsoft via ftp +from <ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</ulink> +</para> + +</sect1> +<sect1> +<title>Network Logon Script Magic</title> + +<para> +This section needs work. Volunteer contributions most welcome. Please send your patches or updates +to jht@samba.org. +</para> + +</chapter> + diff --git a/docs/docbook/projdoc/NT4Migration.sgml b/docs/docbook/projdoc/NT4Migration.sgml new file mode 100644 index 0000000000..1a4499038d --- /dev/null +++ b/docs/docbook/projdoc/NT4Migration.sgml @@ -0,0 +1,47 @@ +<chapter id="NT4Migration"> +<chapterinfo> + <author> + <firstname>John H</firstname><surname>Terpstra</surname> + </author> + <pubdate>April 3, 2003</pubdate> +</chapterinfo> + +<title>Migration from NT4 PDC to Samba-3 PDC</title> + +<para> +This is a rough guide to assist those wishing to migrate from NT4 domain control to +Samba-3 based domain control. +</para> + +<sect1> +<title>Planning and Getting Started</title> + +<para>You must use at least the following ...</para> + +<sect2> +<title>Objectives</title> + +<para> +Blah blah objectives here. +</para> + +</sect2> +<sect2> +<title>Steps In Migration Process</title> + +<para> +Document steps right here! +</para> + +</sect2> +</sect1> + +<sect1> +<title>Managing Samba-3 Domain Control</title> + +<para> +Lots of blah blah here. +</para> + +</sect1> +</chapter> diff --git a/docs/docbook/projdoc/PolicyMgmt.sgml b/docs/docbook/projdoc/PolicyMgmt.sgml new file mode 100644 index 0000000000..1dc4dd435d --- /dev/null +++ b/docs/docbook/projdoc/PolicyMgmt.sgml @@ -0,0 +1,304 @@ +<chapter id="PolicyMgmt"> +<chapterinfo> + <author> + <firstname>John H</firstname><surname>Terpstra</surname> + <affiliation> + <orgname>Samba Team</orgname> + <address> + <email>jht@samba.org</email> + </address> + </affiliation> + </author> + <pubdate>April 3 2003</pubdate> +</chapterinfo> +<title>System and Account Policies</title> + +<sect1> +<title>Creating and Managing System Policies</title> + +<para> +Under MS Windows platforms, particularly those following the release of MS Windows +NT4 and MS Windows 95) it is possible to create a type of file that would be placed +in the NETLOGON share of a domain controller. As the client logs onto the network +this file is read and the contents initiate changes to the registry of the client +machine. This file allows changes to be made to those parts of the registry that +affect users, groups of users, or machines. +</para> + +<para> +For MS Windows 9x/Me this file must be called <filename>Config.POL</filename> and may +be generated using a tool called <filename>poledit.exe</filename>, better known as the +Policy Editor. The policy editor was provided on the Windows 98 installation CD, but +dissappeared again with the introduction of MS Windows Me (Millenium Edition). From +comments from MS Windows network administrators it would appear that this tool became +a part of the MS Windows Me Resource Kit. +</para> + +<para> +MS Windows NT4 Server products include the <emphasis>System Policy Editor</emphasis> +under the <filename>Start -> Programs -> Administrative Tools</filename> menu item. +For MS Windows NT4 and later clients this file must be called <filename>NTConfig.POL</filename>. +</para> + +<para> +New with the introduction of MS Windows 2000 was the Microsoft Management Console +or MMC. This tool is the new wave in the ever changing landscape of Microsoft +methods for management of network access and security. Every new Microsoft product +or technology seems to obsolete the old rules and to introduce newer and more +complex tools and methods. To Microsoft's credit though, the MMC does appear to +be a step forward, but improved functionality comes at a great price. +</para> + +<para> +Before embarking on the configuration of network and system policies it is highly +advisable to read the documentation available from Microsoft's web site regarding +<ulink url="http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp"> +Implementing Profiles and Policies in Windows NT 4.0 from http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp</ulink> available from Microsoft. +There are a large number of documents in addition to this old one that should also +be read and understood. Try searching on the Microsoft web site for "Group Policies". +</para> + +<para> +What follows is a very discussion with some helpful notes. The information provided +here is incomplete - you are warned. +</para> + +<sect2> +<title>Windows 9x/Me Policies</title> + +<para> +You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. +It can be found on the Original full product Win98 installation CD under +<filename>tools/reskit/netadmin/poledit</filename>. Install this using the +Add/Remove Programs facility and then click on the 'Have Disk' tab. +</para> + +<para> +Use the Group Policy Editor to create a policy file that specifies the location of +user profiles and/or the <filename>My Documents</filename> etc. stuff. Then +save these settings in a file called <filename>Config.POL</filename> that needs to +be placed in the root of the [NETLOGON] share. If Win98 is configured to log onto +the Samba Domain, it will automatically read this file and update the Win9x/Me registry +of the machine as it logs on. +</para> + +<para> +Further details are covered in the Win98 Resource Kit documentation. +</para> + +<para> +If you do not take the right steps, then every so often Win9x/Me will check the +integrity of the registry and will restore it's settings from the back-up +copy of the registry it stores on each Win9x/Me machine. Hence, you will +occasionally notice things changing back to the original settings. +</para> + +<para> +Install the group policy handler for Win9x to pick up group policies. Look on the +Win98 CD in <filename>\tools\reskit\netadmin\poledit</filename>. +Install group policies on a Win9x client by double-clicking +<filename>grouppol.inf</filename>. Log off and on again a couple of times and see +if Win98 picks up group policies. Unfortunately this needs to be done on every +Win9x/Me machine that uses group policies. +</para> + +</sect2> +<sect2> +<title>Windows NT4 Style Policy Files</title> + +<para> +To create or edit <filename>ntconfig.pol</filename> you must use the NT Server +Policy Editor, <command>poledit.exe</command> which is included with NT4 Server +but <emphasis>not NT Workstation</emphasis>. There is a Policy Editor on a NT4 +Workstation but it is not suitable for creating <emphasis>Domain Policies</emphasis>. +Further, although the Windows 95 Policy Editor can be installed on an NT4 +Workstation/Server, it will not work with NT clients. However, the files from +the NT Server will run happily enough on an NT4 Workstation. +</para> + +<para> +You need <filename>poledit.exe, common.adm</filename> and <filename>winnt.adm</filename>. +It is convenient to put the two *.adm files in the <filename>c:\winnt\inf</filename> +directory which is where the binary will look for them unless told otherwise. Note also that that +directory is normally 'hidden'. +</para> + +<para> +The Windows NT policy editor is also included with the Service Pack 3 (and +later) for Windows NT 4.0. Extract the files using <command>servicepackname /x</command>, +i.e. that's <command>Nt4sp6ai.exe /x</command> for service pack 6a. The policy editor, +<command>poledit.exe</command> and the associated template files (*.adm) should +be extracted as well. It is also possible to downloaded the policy template +files for Office97 and get a copy of the policy editor. Another possible +location is with the Zero Administration Kit available for download from Microsoft. +</para> + +<sect3> +<title>Registry Tattoos</title> + + <para> + With NT4 style registry based policy changes, a large number of settings are not + automatically reversed as the user logs off. Since the settings that were in the + NTConfig.POL file were applied to the client machine registry and that apply to the + hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known + as tattooing. It can have serious consequences down-stream and the administrator must + be extremely careful not to lock out the ability to manage the machine at a later date. + </para> + + +</sect3> +</sect2> +<sect2> +<title>MS Windows 200x / XP Professional Policies</title> + +<para> +Windows NT4 System policies allows setting of registry parameters specific to +users, groups and computers (client workstations) that are members of the NT4 +style domain. Such policy file will work with MS Windows 2000 / XP clients also. +</para> + +<para> +New to MS Windows 2000 Microsoft introduced a new style of group policy that confers +a superset of capabilities compared with NT4 style policies. Obviously, the tool used +to create them is different, and the mechanism for implementing them is much changed. +</para> + +<para> +The older NT4 style registry based policies are known as <emphasis>Administrative Templates</emphasis> +in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security +configurations, enforce Internet Explorer browser settings, change and redirect aspects of the +users' desktop (including: the location of <emphasis>My Documents</emphasis> files (directory), as +well as intrinsics of where menu items will appear in the Start menu). An additional new +feature is the ability to make available particular software Windows applications to particular +users and/or groups. +</para> + +<para> +Remember: NT4 policy files are named <filename>NTConfig.POL</filename> and are stored in the root +of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password +and selects the domain name to which the logon will attempt to take place. During the logon +process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating +server, modifies the local registry values according to the settings in this file. +</para> + +<para> +Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of +a Windows 200x policy file is stored in the Active Directory itself and the other part is stored +in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active +Directory domain controllers. The part that is stored in the Active Directory itself is called the +group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is +known as the group policy template (GPT). +</para> + +<para> +With NT4 clients the policy file is read and executed upon only aas each user log onto the network. +MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine +startup (machine specific part) and when the user logs onto the network the user specific part +is applied. In MS Windows 200x style policy management each machine and/or user may be subject +to any number of concurently applicable (and applied) policy sets (GPOs). Active Directory allows +the administrator to also set filters over the policy settings. No such equivalent capability +exists with NT4 style policy files. +</para> + +<sect3> +<title>Administration of Win2K / XP Policies</title> + +<para> +Instead of using the tool called "The System Policy Editor", commonly called Poledit (from the +executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console +(MMC) snap-in as follows: +</para> + +<itemizedlist> + <listitem> + <para> + Go to the Windows 200x / XP menu <filename>Start->Programs->Administrative Tools</filename> + and select the MMC snap-in called "Active Directory Users and Computers" + <para> + </listitem> + + <listitem> + <para> + Select the domain or organizational unit (OU) that you wish to manage, then right click + to open the context menu for that object, select the properties item. + </para> + </listitem> + + <listitem> + <para> + Now left click on the Group Policy tab, then left click on the New tab. Type a name + for the new policy you will create. + </para> + </listitem> + + <listitem> + <para> + Now left click on the Edit tab to commence the steps needed to create the GPO. + </para> + </listitem> +</itemizedlist> + +<para> +All policy configuration options are controlled through the use of policy administrative +templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. +Beware however, since the .adm files are NOT interchangible across NT4 and Windows 200x. +The later introduces many new features as well as extended definition capabilities. It is +well beyond the scope of this documentation to explain how to program .adm files, for that +the adminsitrator is referred to the Microsoft Windows Resource Kit for your particular +version of MS Windows. +</para> + +<note> +<para> +The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used +to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you +use this powerful tool. Please refer to the resource kit manuals for specific usage information. +</para> +</note> + +</sect2> +</sect1> + +<sect1> +<title>Managing Account/User Policies</title> + +<para> +Document what are user policies (ie: Account Policies) here. +</para> + +<sect2> +<title>With Windows NT4/200x</title> + +<para> +Brief overview of the tools and how to use them. +</para> + +<sect3> +<title>Windows NT4 Tools</title> + +<para> +Blah, blah, blah ... +</para> + +</sect3> + +<sect3> +<title>Windows 200x Tools</title> + +<para> +Blah, blah, blah ... +</para> + +</sect3> +</sect2> + +<sect2> +<title>With a Samba PDC</title> + +<para> +Document the HOWTO here. +</para> + +</sect1> + +</chapter> diff --git a/docs/docbook/projdoc/ProfileMgmt.sgml b/docs/docbook/projdoc/ProfileMgmt.sgml new file mode 100644 index 0000000000..72eac8635a --- /dev/null +++ b/docs/docbook/projdoc/ProfileMgmt.sgml @@ -0,0 +1,644 @@ +<chapter id="ProfileMgmt"> +<chapterinfo> + <author> + <firstname>John H</firstname><surname>Terpstra</surname> + <affiliation> + <orgname>Samba Team</orgname> + <address> + <email>jht@samba.org</email> + </address> + </affiliation> + </author> + <pubdate>April 3 2003</pubdate> +</chapterinfo> + +<title>Desktop Profile Management</title> + +<sect1> +<title>Roaming Profiles</title> + +<warning> +<para> +<emphasis>NOTE!</emphasis> Roaming profiles support is different for Win9x / Me +and Windows NT4/200x. +</para> +</warning> + +<para> +Before discussing how to configure roaming profiles, it is useful to see how +Windows 9x / Me and Windows NT4/200x clients implement these features. +</para> + +<para> +Windows 9x / Me clients send a NetUserGetInfo request to the server to get the user's +profiles location. However, the response does not have room for a separate +profiles location field, only the user's home share. This means that Win9X/Me +profiles are restricted to being stored in the user's home directory. +</para> + + +<para> +Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields, +including a separate field for the location of the user's profiles. +</para> + +<sect2> +<title>Samba Configuration for Profile Handling</title> + +<para> +This section documents how to configure Samba for MS Windows client profile support. +</para> + +<sect3> +<title>NT4/200x User Profiles</title> + +<para> +To support Windowns NT4/200x clients, in the [global] section of smb.conf set the +following (for example): +</para> + +<para> +<programlisting> + logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath + + This is typically implemented like: + + logon path = \\%L\Profiles\%u + + where: + %L translates to the name of the Samba server + %u translates to the user name +</programlisting> +</para> + +<para> +The default for this option is \\%N\%U\profile, namely \\sambaserver\username\profile. +The \\N%\%U service is created automatically by the [homes] service. If you are using +a samba server for the profiles, you _must_ make the share specified in the logon path +browseable. Please refer to the man page for smb.conf in respect of the different +symantics of %L and %N, as well as %U and %u. +</para> + +<note> +<para> +MS Windows NT/2K clients at times do not disconnect a connection to a server +between logons. It is recommended to NOT use the <emphasis>homes</emphasis> +meta-service name as part of the profile share path. +</para> +</note> +</sect3> + +<sect3> +<title>Windows 9x / Me User Profiles</title> + +<para> +To support Windows 9x / Me clients, you must use the "logon home" parameter. Samba has +now been fixed so that "net use /home" now works as well, and it, too, relies +on the "logon home" parameter. +</para> + +<para> +By using the logon home parameter, you are restricted to putting Win9x / Me +profiles in the user's home directory. But wait! There is a trick you +can use. If you set the following in the [global] section of your smb.conf file: +</para> +<para><programlisting> + logon home = \\%L\%U\.profiles +</programlisting></para> + +<para> +then your Windows 9x / Me clients will dutifully put their clients in a subdirectory +of your home directory called .profiles (thus making them hidden). +</para> + +<para> +Not only that, but 'net use/home' will also work, because of a feature in +Windows 9x / Me. It removes any directory stuff off the end of the home directory area +and only uses the server and share portion. That is, it looks like you +specified \\%L\%U for "logon home". +</para> +</sect3> + +<sect3> +<title>Mixed Windows 9x / Me and Windows NT4/200x User Profiles</title> + +<para> +You can support profiles for both Win9X and WinNT clients by setting both the +"logon home" and "logon path" parameters. For example: +</para> + +<para><programlisting> + logon home = \\%L\%u\.profiles + logon path = \\%L\profiles\%u +</programlisting></para> + +</sect3> +</sect2> + +<sect2> +<title>Windows Client Profile Configuration Information</title> + +<sect3> +<title>Windows 9x / Me Profile Setup</title> + +<para> +When a user first logs in on Windows 9X, the file user.DAT is created, +as are folders "Start Menu", "Desktop", "Programs" and "Nethood". +These directories and their contents will be merged with the local +versions stored in c:\windows\profiles\username on subsequent logins, +taking the most recent from each. You will need to use the [global] +options "preserve case = yes", "short preserve case = yes" and +"case sensitive = no" in order to maintain capital letters in shortcuts +in any of the profile folders. +</para> + +<para> +The user.DAT file contains all the user's preferences. If you wish to +enforce a set of preferences, rename their user.DAT file to user.MAN, +and deny them write access to this file. +</para> + +<orderedlist> +<listitem> + <para> + On the Windows 9x / Me machine, go to Control Panel -> Passwords and + select the User Profiles tab. Select the required level of + roaming preferences. Press OK, but do _not_ allow the computer + to reboot. + </para> +</listitem> + +<listitem> + <para> + On the Windows 9x / Me machine, go to Control Panel -> Network -> + Client for Microsoft Networks -> Preferences. Select 'Log on to + NT Domain'. Then, ensure that the Primary Logon is 'Client for + Microsoft Networks'. Press OK, and this time allow the computer + to reboot. + </para> +</listitem> + +</orderedlist> + +<para> +Under Windows 9x / Me Profiles are downloaded from the Primary Logon. +If you have the Primary Logon as 'Client for Novell Networks', then +the profiles and logon script will be downloaded from your Novell +Server. If you have the Primary Logon as 'Windows Logon', then the +profiles will be loaded from the local machine - a bit against the +concept of roaming profiles, it would seem! +</para> + +<para> +You will now find that the Microsoft Networks Login box contains +[user, password, domain] instead of just [user, password]. Type in +the samba server's domain name (or any other domain known to exist, +but bear in mind that the user will be authenticated against this +domain and profiles downloaded from it, if that domain logon server +supports it), user name and user's password. +</para> + +<para> +Once the user has been successfully validated, the Windows 9x / Me machine +will inform you that 'The user has not logged on before' and asks you +if you wish to save the user's preferences? Select 'yes'. +</para> + +<para> +Once the Windows 9x / Me client comes up with the desktop, you should be able +to examine the contents of the directory specified in the "logon path" +on the samba server and verify that the "Desktop", "Start Menu", +"Programs" and "Nethood" folders have been created. +</para> + +<para> +These folders will be cached locally on the client, and updated when +the user logs off (if you haven't made them read-only by then). +You will find that if the user creates further folders or short-cuts, +that the client will merge the profile contents downloaded with the +contents of the profile directory already on the local client, taking +the newest folders and short-cuts from each set. +</para> + +<para> +If you have made the folders / files read-only on the samba server, +then you will get errors from the Windows 9x / Me machine on logon and logout, as +it attempts to merge the local and the remote profile. Basically, if +you have any errors reported by the Windows 9x / Me machine, check the Unix file +permissions and ownership rights on the profile directory contents, +on the samba server. +</para> + +<para> +If you have problems creating user profiles, you can reset the user's +local desktop cache, as shown below. When this user then next logs in, +they will be told that they are logging in "for the first time". +</para> + +<orderedlist> +<listitem> + <para> + instead of logging in under the [user, password, domain] dialog, + press escape. + </para> +</listitem> +<listitem> + <para> + run the regedit.exe program, and look in: + </para> + + <para> + HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList + </para> + + <para> + you will find an entry, for each user, of ProfilePath. Note the + contents of this key (likely to be c:\windows\profiles\username), + then delete the key ProfilePath for the required user. + + [Exit the registry editor]. + + </para> +</listitem> + + <listitem> + <para> + <emphasis>WARNING</emphasis> - before deleting the contents of the + directory listed in the ProfilePath (this is likely to be + <filename>c:\windows\profiles\username)</filename>, ask them if they + have any important files stored on their desktop or in their start menu. + Delete the contents of the directory ProfilePath (making a backup if any + of the files are needed). + </para> + + <para> + This will have the effect of removing the local (read-only hidden + system file) user.DAT in their profile directory, as well as the + local "desktop", "nethood", "start menu" and "programs" folders. + </para> + </listitem> + + <listitem> + <para> + search for the user's .PWL password-caching file in the c:\windows + directory, and delete it. + </para> + </listitem> + + <listitem> + <para> + log off the windows 9x / Me client. + </para> + </listitem> + + <listitem> + <para> + check the contents of the profile path (see "logon path" described + above), and delete the user.DAT or user.MAN file for the user, + making a backup if required. + </para> + </listitem> + +</orderedlist> + +<para> +If all else fails, increase samba's debug log levels to between 3 and 10, +and / or run a packet trace program such as ethereal or netmon.exe, and +look for error messages. +</para> + +<para> +If you have access to an Windows NT4/200x server, then first set up roaming profiles +and / or netlogons on the Windows NT4/200x server. Make a packet trace, or examine +the example packet traces provided with Windows NT4/200x server, and see what the +differences are with the equivalent samba trace. +</para> + +</sect3> + +<sect3> +<title>Windows NT4 Workstation</title> + +<para> +When a user first logs in to a Windows NT Workstation, the profile +NTuser.DAT is created. The profile location can be now specified +through the "logon path" parameter. +</para> + +<para> +There is a parameter that is now available for use with NT Profiles: +"logon drive". This should be set to <filename>H:</filename> or any other drive, and +should be used in conjunction with the new "logon home" parameter. +</para> + +<para> +The entry for the NT4 profile is a _directory_ not a file. The NT +help on profiles mentions that a directory is also created with a .PDS +extension. The user, while logging in, must have write permission to +create the full profile path (and the folder with the .PDS extension +for those situations where it might be created.) +</para> + +<para> +In the profile directory, Windows NT4 creates more folders than Windows 9x / Me. +It creates "Application Data" and others, as well as "Desktop", "Nethood", +"Start Menu" and "Programs". The profile itself is stored in a file +NTuser.DAT. Nothing appears to be stored in the .PDS directory, and +its purpose is currently unknown. +</para> + +<para> +You can use the System Control Panel to copy a local profile onto +a samba server (see NT Help on profiles: it is also capable of firing +up the correct location in the System Control Panel for you). The +NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN +turns a profile into a mandatory one. +</para> + +<para> +The case of the profile is significant. The file must be called +NTuser.DAT or, for a mandatory profile, NTuser.MAN. +</para> +</sect3> + +<sect3> +<title>Windows 2000/XP Professional</title> + +<para> +You must first convert the profile from a local profile to a domain +profile on the MS Windows workstation as follows: +</para> + +<itemizedlist> +<listitem><para> +Log on as the LOCAL workstation administrator. +</para></listitem> + +<listitem><para> +Right click on the 'My Computer' Icon, select 'Properties' +</para></listitem> + +<listitem><para> +Click on the 'User Profiles' tab +</para></listitem> + +<listitem><para> +Select the profile you wish to convert (click on it once) +</para></listitem> + +<listitem><para> +Click on the button 'Copy To' +</para></listitem> + +<listitem><para> +In the "Permitted to use" box, click on the 'Change' button. +</para></listitem> + +<listitem><para> +Click on the 'Look in" area that lists the machine name, when you click +here it will open up a selection box. Click on the domain to which the +profile must be accessible. +</para> + +<note><para>You will need to log on if a logon box opens up. Eg: In the connect +as: MIDEARTH\root, password: mypassword.</para></note> +</listitem> + +<listitem><para> +To make the profile capable of being used by anyone select 'Everyone' +</para></listitem> + +<listitem><para> +Click OK. The Selection box will close. +</para></listitem> + +<listitem><para> +Now click on the 'Ok' button to create the profile in the path you +nominated. +</para></listitem> +</itemizedlist> + +<para> +Done. You now have a profile that can be editted using the samba-3.0.0 +profiles tool. +</para> + +<note> +<para> +Under NT/2K the use of mandotory profiles forces the use of MS Exchange +storage of mail data. That keeps desktop profiles usable. +</para> +</note> + +<note> +<itemizedlist> +<listitem><para> +This is a security check new to Windows XP (or maybe only +Windows XP service pack 1). It can be disabled via a group policy in +Active Directory. The policy is:</para> + +<para>"Computer Configuration\Administrative Templates\System\User +Profiles\Do not check for user ownership of Roaming Profile Folders"</para> + +<para>...and it should be set to "Enabled". +Does the new version of samba have an Active Directory analogue? If so, +then you may be able to set the policy through this. +</para> + +<para> +If you cannot set group policies in samba, then you may be able to set +the policy locally on each machine. If you want to try this, then do +the following (N.B. I don't know for sure that this will work in the +same way as a domain group policy): +</para> + +</listitem> + +<listitem><para> +On the XP workstation log in with an Administrator account. +</para></listitem> + +<listitem><para>Click: "Start", "Run"</para></listitem> +<listitem><para>Type: "mmc"</para></listitem> +<listitem><para>Click: "OK"</para></listitem> + +<listitem><para>A Microsoft Management Console should appear.</para></listitem> +<listitem><para>Click: File, "Add/Remove Snap-in...", "Add"</para></listitem> +<listitem><para>Double-Click: "Group Policy"</para></listitem> +<listitem><para>Click: "Finish", "Close"</para></listitem> +<listitem><para>Click: "OK"</para></listitem> + +<listitem><para>In the "Console Root" window:</para></listitem> +<listitem><para>Expand: "Local Computer Policy", "Computer Configuration",</para></listitem> +<listitem><para>"Administrative Templates", "System", "User Profiles"</para></listitem> +<listitem><para>Double-Click: "Do not check for user ownership of Roaming Profile</para></listitem> +<listitem><para>Folders"</para></listitem> +<listitem><para>Select: "Enabled"</para></listitem> +<listitem><para>Click: OK"</para></listitem> + +<listitem><para>Close the whole console. You do not need to save the settings (this +refers to the console settings rather than the policies you have +changed).</para></listitem> + +<listitem><para>Reboot</para></listitem> +</itemizedlist> +</note> +</sect3> +</sect2> + +<sect2> +<title>Sharing Profiles between W9x/Me and NT4/200x/XP workstations</title> + +<para> +Sharing of desktop profiles between Windows versions is NOT recommended. +Desktop profiles are an evolving phenomenon and profiles for later versions +of MS Windows clients add features that may interfere with earlier versions +of MS Windows clients. Probably the more salient reason to NOT mix profiles +is that when logging off an earlier version of MS Windows the older format +of profile contents may overwrite information that belongs to the newer +version resulting in loss of profile information content when that user logs +on again with the newer version of MS Windows. +</para> + +<para> +If you then want to share the same Start Menu / Desktop with W9x/Me, you will +need to specify a common location for the profiles. The smb.conf parameters +that need to be common are <emphasis>logon path</emphasis> and +<emphasis>logon home</emphasis>. +</para> + +<para> +If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory. +</para> + +</sect2> + +<sect2> +<title>Profile Migration from Windows NT4/200x Server to Samba</title> + +<para> +There is nothing to stop you specifying any path that you like for the +location of users' profiles. Therefore, you could specify that the +profile be stored on a samba server, or any other SMB server, as long as +that SMB server supports encrypted passwords. +</para> + +<sect3> +<title>Windows NT4 Profile Management Tools</title> + +<para> +Unfortunately, the Resource Kit information is specific to the version of MS Windows +NT4/200x. The correct resource kit is required for each platform. +</para> + +<para> +Here is a quick guide: +</para> + +<itemizedlist> + +<listitem><para> +On your NT4 Domain Controller, right click on 'My Computer', then +select the tab labelled 'User Profiles'. +</para></listitem> + +<listitem><para> +Select a user profile you want to migrate and click on it. +</para> + +<note><para>I am using the term "migrate" lossely. You can copy a profile to +create a group profile. You can give the user 'Everyone' rights to the +profile you copy this to. That is what you need to do, since your samba +domain is not a member of a trust relationship with your NT4 PDC.</para></note> +</listitem> + + <listitem><para>Click the 'Copy To' button.</para></listitem> + + <listitem><para>In the box labelled 'Copy Profile to' add your new path, eg: + <filename>c:\temp\foobar</filename></para></listitem> + + <listitem><para>Click on the button labelled 'Change' in the "Permitted to use" box.</para></listitem> + + <listitem><para>Click on the group 'Everyone' and then click OK. This closes the + 'chose user' box.</para></listitem> + + <listitem><para>Now click OK.</para></listitem> +</itemizedlist> + +<para> +Follow the above for every profile you need to migrate. +</para> + +<sect3> +<title>Side bar Notes</title> + +<para> +You should obtain the SID of your NT4 domain. You can use smbpasswd to do +this. Read the man page.</para> + +<para> +With Samba-3.0.0 alpha code you can import all you NT4 domain accounts +using the net samsync method. This way you can retain your profile +settings as well as all your users. +</para> + +</sect3> + + +<sect3> +<title>moveuser.exe</title> + +<para> +The W2K professional resource kit has moveuser.exe. moveuser.exe changes +the security of a profile from one user to another. This allows the account +domain to change, and/or the user name to change. +</para> + +</sect3> + +<sect3> +<title>Get SID</title> + +<para> +You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 +Resource Kit. +</para> + +<para> +Windows NT 4.0 stores the local profile information in the registry under +the following key: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList +</para> + +<para> +Under the ProfileList key, there will be subkeys named with the SIDs of the +users who have logged on to this computer. (To find the profile information +for the user whose locally cached profile you want to move, find the SID for +the user with the GetSID.exe utility.) Inside of the appropriate user's +subkey, you will see a string value named ProfileImagePath. +</para> + +</sect3> +</sect2> +</sect1> + +<sect1> +<title>Mandatory profiles</title> + +<para> +The above method can be used to create mandatory profiles also. To convert +a group profile into a mandatory profile simply locate the NTUser.DAT file +in the copied profile and rename it to NTUser.MAN. +</para> + +</sect1> + +<sect1> +<title>Creating/Managing Group Profiles</title> + +<para> +Blah goes here. +</para> +</sect1> +</chapter> diff --git a/docs/docbook/projdoc/SWAT.sgml b/docs/docbook/projdoc/SWAT.sgml new file mode 100644 index 0000000000..9df94b9aee --- /dev/null +++ b/docs/docbook/projdoc/SWAT.sgml @@ -0,0 +1,80 @@ +<chapter id="SWAT"> +<chapterinfo> + <author> + <firstname>John H</firstname><surname>Terpstra</surname> + </author> + <pubdate>April 3, 2003</pubdate> +</chapterinfo> + +<title>SWAT - The Samba Web Admininistration Tool</title> + +<para> +This is a rough guide to SWAT. +</para> + +<sect1> +<title>SWAT Features and Benefits</title> + +<para>You must use at least the following ...</para> + +<sect2> +<title>The SWAT Home Page</title> + +<para> +Blah blah here. +</para> + +</sect2> +<sect2> +<title>Global Settings</title> + +<para> +Document steps right here! +</para> + +</sect2> +<sect2> +<title>The SWAT Wizard</title> + +<para> +Lots of blah blah here. +</para> + +</sect2> + +<sect2> +<title>Share Settings</title> + +<para> +Document steps right here! +</para> + +</sect2> + +<sect2> +<title>Printing Settings</title> + +<para> +Document steps right here! +</para> + +</sect2> +<sect2> +<title>The Status Page</title> + +<para> +Document steps right here! +</para> + +</sect2> + +<sect2> +<title>The Password Change Page</title> + +<para> +Document steps right here! +</para> + +</sect2> +</sect1> +</chapter> |