From 536eda24033cadebb7db47e5affa9a6d118ea109 Mon Sep 17 00:00:00 2001 From: John Terpstra Date: Thu, 3 Apr 2003 09:50:33 +0000 Subject: More doco updates. Another few days and it will be cooked. (This used to be commit 79e66288f96b029208d11b3aa095002de9447020) --- docs/docbook/projdoc/AdvancedNetworkAdmin.sgml | 759 +------------------------ 1 file changed, 18 insertions(+), 741 deletions(-) (limited to 'docs/docbook/projdoc/AdvancedNetworkAdmin.sgml') diff --git a/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml index 5180901fd3..18fda67123 100644 --- a/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml +++ b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml @@ -9,772 +9,49 @@ - - - April 1 2003 + April 3 2003 -System Policies +Advanced Network Manangement Information -Basic System Policy Info - - -Much of the information necessary to implement System Policies and -Roaming User Profiles in a Samba domain is the same as that for -implementing these same items in a Windows NT 4.0 domain. -You should read the white paper Implementing -Profiles and Policies in Windows NT 4.0 available from Microsoft. - - - -Here are some additional details: - - - - - - What about Windows NT Policy Editor? - - - - To create or edit ntconfig.pol you must use - the NT Server Policy Editor, poledit.exe which - is included with NT Server but not NT Workstation. - There is a Policy Editor on a NTws - but it is not suitable for creating Domain Policies. - Further, although the Windows 95 - Policy Editor can be installed on an NT Workstation/Server, it will not - work with NT policies because the registry key that are set by the policy templates. - However, the files from the NT Server will run happily enough on an NTws. - You need poledit.exe, common.adm and winnt.adm. It is convenient - to put the two *.adm files in c:\winnt\inf which is where - the binary will look for them unless told otherwise. Note also that that - directory is 'hidden'. - - - - The Windows NT policy editor is also included with the Service Pack 3 (and - later) for Windows NT 4.0. Extract the files using servicepackname /x, - i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, - poledit.exe and the associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible - location is with the Zero Administration Kit available for download from Microsoft. - - - - - - Can Win95 do Policies? - - - - Install the group policy handler for Win9x to pick up group - policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. - Install group policies on a Win9x client by double-clicking - grouppol.inf. Log off and on again a couple of - times and see if Win98 picks up group policies. Unfortunately this needs - to be done on every Win9x machine that uses group policies.... - - - - If group policies don't work one reports suggests getting the updated - (read: working) grouppol.dll for Windows 9x. The group list is grabbed - from /etc/group. - - - - - - How do I get 'User Manager' and 'Server Manager' - - - - Since I don't need to buy an NT Server CD now, how do I get - the 'User Manager for Domains', the 'Server Manager'? - - - - Microsoft distributes a version of these tools called nexus for - installation on Windows 95 systems. The tools set includes - - - - Server Manager - - User Manager for Domains - - Event Viewer - - - - Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE - - - - The Windows NT 4.0 version of the 'User Manager for - Domains' and 'Server Manager' are available from Microsoft via ftp - from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE - - - - - -Creating Group Prolicy Files - - -Windows '9x - -You need the Win98 Group Policy Editor to -set Group Profiles up under Windows '9x. It can be found on the Original -full product Win98 installation CD under -tools/reskit/netadmin/poledit. You install this -using the Add/Remove Programs facility and then click on the 'Have Disk' -tab. - - - -Use the Group Policy Editor to create a policy file that specifies the -location of user profiles and/or the My Documents etc. -stuff. You then save these settings in a file called -Config.POL that needs to be placed in -the root of the [NETLOGON] share. If your Win98 is configured to log onto -the Samba Domain, it will automatically read this file and update the -Win9x/Me registry of the machine that is logging on. - - - -All of this is covered in the Win98 Resource Kit documentation. - - - -If you do not do it this way, then every so often Win9x/Me will check the -integrity of the registry and will restore it's settings from the back-up -copy of the registry it stores on each Win9x/Me machine. Hence, you will -occasionally notice things changing back to the original settings. - - - - - - - -Roaming Profiles - - - -NOTE! Roaming profiles support is different for Win9X and WinNT. - - - - -Before discussing how to configure roaming profiles, it is useful to see how -Win9X and WinNT clients implement these features. - - - -Win9X clients send a NetUserGetInfo request to the server to get the user's -profiles location. However, the response does not have room for a separate -profiles location field, only the user's home share. This means that Win9X -profiles are restricted to being in the user's home directory. - - - - -WinNT clients send a NetSAMLogon RPC request, which contains many fields, -including a separate field for the location of the user's profiles. -This means that support for profiles is different for Win9X and WinNT. - - - -Windows NT Configuration - - -To support WinNT clients, in the [global] section of smb.conf set the -following (for example): - - - -logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath - - - -The default for this option is \\%N\%U\profile, namely -\\sambaserver\username\profile. The \\N%\%U service is created -automatically by the [homes] service. -If you are using a samba server for the profiles, you _must_ make the -share specified in the logon path browseable. - - - - -MS Windows NT/2K clients at times do not disconnect a connection to a server -between logons. It is recommended to NOT use the homes -meta-service name as part of the profile share path. - - - - - - -Windows 9X Configuration - - -To support Win9X clients, you must use the "logon home" parameter. Samba has -now been fixed so that "net use /home" now works as well, and it, too, relies -on the "logon home" parameter. - - - -By using the logon home parameter, you are restricted to putting Win9X -profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your -smb.conf file: - - - -logon home = \\%L\%U\.profiles - - - -then your Win9X clients will dutifully put their clients in a subdirectory -of your home directory called .profiles (thus making them hidden). - - - -Not only that, but 'net use/home' will also work, because of a feature in -Win9X. It removes any directory stuff off the end of the home directory area -and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for "logon home". - - - - - - -Win9X and WinNT Configuration - - -You can support profiles for both Win9X and WinNT clients by setting both the -"logon home" and "logon path" parameters. For example: - - - -logon home = \\%L\%U\.profiles -logon path = \\%L\profiles\%U - - - - -I have not checked what 'net use /home' does on NT when "logon home" is -set as above. - - - - - -Windows 9X Profile Setup - - -When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders "Start Menu", "Desktop", "Programs" and "Nethood". -These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options "preserve case = yes", "short preserve case = yes" and -"case sensitive = no" in order to maintain capital letters in shortcuts -in any of the profile folders. - - - -The user.DAT file contains all the user's preferences. If you wish to -enforce a set of preferences, rename their user.DAT file to user.MAN, -and deny them write access to this file. - - - - - - On the Windows 95 machine, go to Control Panel | Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer - to reboot. - - - - - - - On the Windows 95 machine, go to Control Panel | Network | - Client for Microsoft Networks | Preferences. Select 'Log on to - NT Domain'. Then, ensure that the Primary Logon is 'Client for - Microsoft Networks'. Press OK, and this time allow the computer - to reboot. - - - - - - -Under Windows 95, Profiles are downloaded from the Primary Logon. -If you have the Primary Logon as 'Client for Novell Networks', then -the profiles and logon script will be downloaded from your Novell -Server. If you have the Primary Logon as 'Windows Logon', then the -profiles will be loaded from the local machine - a bit against the -concept of roaming profiles, if you ask me. - - - -You will now find that the Microsoft Networks Login box contains -[user, password, domain] instead of just [user, password]. Type in -the samba server's domain name (or any other domain known to exist, -but bear in mind that the user will be authenticated against this -domain and profiles downloaded from it, if that domain logon server -supports it), user name and user's password. - - - -Once the user has been successfully validated, the Windows 95 machine -will inform you that 'The user has not logged on before' and asks you -if you wish to save the user's preferences? Select 'yes'. - - - -Once the Windows 95 client comes up with the desktop, you should be able -to examine the contents of the directory specified in the "logon path" -on the samba server and verify that the "Desktop", "Start Menu", -"Programs" and "Nethood" folders have been created. - - - -These folders will be cached locally on the client, and updated when -the user logs off (if you haven't made them read-only by then :-). -You will find that if the user creates further folders or short-cuts, -that the client will merge the profile contents downloaded with the -contents of the profile directory already on the local client, taking -the newest folders and short-cuts from each set. - - - -If you have made the folders / files read-only on the samba server, -then you will get errors from the w95 machine on logon and logout, as -it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the w95 machine, check the Unix file -permissions and ownership rights on the profile directory contents, -on the samba server. - - - -If you have problems creating user profiles, you can reset the user's -local desktop cache, as shown below. When this user then next logs in, -they will be told that they are logging in "for the first time". - - - - - - instead of logging in under the [user, password, domain] dialog, - press escape. - - - - - - run the regedit.exe program, and look in: - - - - HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList - - - - you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), - then delete the key ProfilePath for the required user. - +Remote Server Administration - - [Exit the registry editor]. - - - - - - WARNING - before deleting the contents of the - directory listed in - the ProfilePath (this is likely to be c:\windows\profiles\username), - ask them if they have any important files stored on their desktop - or in their start menu. delete the contents of the directory - ProfilePath (making a backup if any of the files are needed). - - - - This will have the effect of removing the local (read-only hidden - system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. - - - - - - search for the user's .PWL password-caching file in the c:\windows - directory, and delete it. - - - - - - - log off the windows 95 client. - - - - - - check the contents of the profile path (see "logon path" described - above), and delete the user.DAT or user.MAN file for the user, - making a backup if required. - - - - - - -If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as tcpdump or netmon.exe, and -look for any error reports. - - - -If you have access to an NT server, then first set up roaming profiles -and / or netlogons on the NT server. Make a packet trace, or examine -the example packet traces provided with NT server, and see what the -differences are with the equivalent samba trace. - - - - - -Windows NT Workstation 4.0 - - -When a user first logs in to a Windows NT Workstation, the profile -NTuser.DAT is created. The profile location can be now specified -through the "logon path" parameter. - - - -There is a parameter that is now available for use with NT Profiles: -"logon drive". This should be set to "h:" or any other drive, and -should be used in conjunction with the new "logon home" parameter. - - - -The entry for the NT 4.0 profile is a _directory_ not a file. The NT -help on profiles mentions that a directory is also created with a .PDS -extension. The user, while logging in, must have write permission to -create the full profile path (and the folder with the .PDS extension -for those situations where it might be created.) - -In the profile directory, NT creates more folders than 95. It creates -"Application Data" and others, as well as "Desktop", "Nethood", -"Start Menu" and "Programs". The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and -its purpose is currently unknown. +How do I get 'User Manager' and 'Server Manager' -You can use the System Control Panel to copy a local profile onto -a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN -turns a profile into a mandatory one. +Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for Domains', +the 'Server Manager'? -The case of the profile is significant. The file must be called -NTuser.DAT or, for a mandatory profile, NTuser.MAN. - - - - - -Windows NT/200x Server - - -There is nothing to stop you specifying any path that you like for the -location of users' profiles. Therefore, you could specify that the -profile be stored on a samba server, or any other SMB server, as long as -that SMB server supports encrypted passwords. - - - - - -Sharing Profiles between W9x/Me and NT4/200x/XP workstations - - -Sharing of desktop profiles between Windows versions is NOT recommended. -Desktop profiles are an evolving phenomenon and profiles for later versions -of MS Windows clients add features that may interfere with earlier versions -of MS Windows clients. Probably the more salient reason to NOT mix profiles -is that when logging off an earlier version of MS Windows the older format -of profile contents may overwrite information that belongs to the newer -version resulting in loss of profile information content when that user logs -on again with the newer version of MS Windows. - - - -If you then want to share the same Start Menu / Desktop with W9x/Me, you will -need to specify a common location for the profiles. The smb.conf parameters -that need to be common are logon path and -logon home. - - - -If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory. - - - - - - -Windows NT 4 - - -Unfortunately, the Resource Kit info is Win NT4 or 200x specific. - - - -Here is a quick guide: +Microsoft distributes a version of these tools called nexus for installation on Windows 95 +systems. The tools set includes: + Server Manager + + User Manager for Domains - -On your NT4 Domain Controller, right click on 'My Computer', then -select the tab labelled 'User Profiles'. - - - -Select a user profile you want to migrate and click on it. - - -I am using the term "migrate" lossely. You can copy a profile to -create a group profile. You can give the user 'Everyone' rights to the -profile you copy this to. That is what you need to do, since your samba -domain is not a member of a trust relationship with your NT4 PDC. - - -Click the 'Copy To' button. - -In the box labelled 'Copy Profile to' add your new path, eg: -c:\temp\foobar - -Click on the button labelled 'Change' in the "Permitted to use" box. - -Click on the group 'Everyone' and then click OK. This closes the -'chose user' box. - -Now click OK. - - - -Follow the above for every profile you need to migrate. - - - -Side bar Notes - - -You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page. - - -With Samba-3.0.0 alpha code you can import all you NT4 domain accounts -using the net samsync method. This way you can retain your profile -settings as well as all your users. - - - - - -Mandatory profiles - - -The above method can be used to create mandatory profiles also. To convert -a group profile into a mandatory profile simply locate the NTUser.DAT file -in the copied profile and rename it to NTUser.MAN. - - - - - -moveuser.exe - - -The W2K professional resource kit has moveuser.exe. moveuser.exe changes -the security of a profile from one user to another. This allows the account -domain to change, and/or the user name to change. - - - - - -Get SID - - -You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 -Resource Kit. - - - -Windows NT 4.0 stores the local profile information in the registry under -the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList - - - -Under the ProfileList key, there will be subkeys named with the SIDs of the -users who have logged on to this computer. (To find the profile information -for the user whose locally cached profile you want to move, find the SID for -the user with the GetSID.exe utility.) Inside of the appropriate user's -subkey, you will see a string value named ProfileImagePath. - - - - - - - -Windows 2000/XP - - -You must first convert the profile from a local profile to a domain -profile on the MS Windows workstation as follows: - - - - -Log on as the LOCAL workstation administrator. - - - -Right click on the 'My Computer' Icon, select 'Properties' - - - -Click on the 'User Profiles' tab - - - -Select the profile you wish to convert (click on it once) - - - -Click on the button 'Copy To' - - - -In the "Permitted to use" box, click on the 'Change' button. - - - -Click on the 'Look in" area that lists the machine name, when you click -here it will open up a selection box. Click on the domain to which the -profile must be accessible. - - -You will need to log on if a logon box opens up. Eg: In the connect -as: MIDEARTH\root, password: mypassword. - - - -To make the profile capable of being used by anyone select 'Everyone' - - - -Click OK. The Selection box will close. - - - -Now click on the 'Ok' button to create the profile in the path you -nominated. - + Event Viewer -Done. You now have a profile that can be editted using the samba-3.0.0 -profiles tool. +Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE - -Under NT/2K the use of mandotory profiles forces the use of MS Exchange -storage of mail data. That keeps desktop profiles usable. +The Windows NT 4.0 version of the 'User Manager for +Domains' and 'Server Manager' are available from Microsoft via ftp +from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE - - - - - -This is a security check new to Windows XP (or maybe only -Windows XP service pack 1). It can be disabled via a group policy in -Active Directory. The policy is: -"Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders" - -...and it should be set to "Enabled". -Does the new version of samba have an Active Directory analogue? If so, -then you may be able to set the policy through this. - - - -If you cannot set group policies in samba, then you may be able to set -the policy locally on each machine. If you want to try this, then do -the following (N.B. I don't know for sure that this will work in the -same way as a domain group policy): - - - - - -On the XP workstation log in with an Administrator account. - - -Click: "Start", "Run" -Type: "mmc" -Click: "OK" - -A Microsoft Management Console should appear. -Click: File, "Add/Remove Snap-in...", "Add" -Double-Click: "Group Policy" -Click: "Finish", "Close" -Click: "OK" - -In the "Console Root" window: -Expand: "Local Computer Policy", "Computer Configuration", -"Administrative Templates", "System", "User Profiles" -Double-Click: "Do not check for user ownership of Roaming Profile -Folders" -Select: "Enabled" -Click: OK" - -Close the whole console. You do not need to save the settings (this -refers to the console settings rather than the policies you have -changed). - -Reboot - - - - + -- cgit