From 938982737509745b57152452a7983bed0fb2fd3b Mon Sep 17 00:00:00 2001 From: John Terpstra Date: Wed, 2 Apr 2003 00:05:38 +0000 Subject: And yet another doco update. Yet more to follow soon. (This used to be commit d309f39f6422aabd4ee95753d7cf5d07512dd345) --- docs/docbook/projdoc/AdvancedNetworkAdmin.sgml | 779 +++++++++++++++++++++++++ 1 file changed, 779 insertions(+) create mode 100644 docs/docbook/projdoc/AdvancedNetworkAdmin.sgml (limited to 'docs/docbook/projdoc/AdvancedNetworkAdmin.sgml') diff --git a/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml new file mode 100644 index 0000000000..c03acb4b90 --- /dev/null +++ b/docs/docbook/projdoc/AdvancedNetworkAdmin.sgml @@ -0,0 +1,779 @@ + + + + John HTerpstra + + Samba Team +
+ jht@samba.org +
+ + + + + April 1 2003 + + + +System Policies + + +Much of the information necessary to implement System Policies and +Roaming User Profiles in a Samba domain is the same as that for +implementing these same items in a Windows NT 4.0 domain. +You should read the white paper Implementing +Profiles and Policies in Windows NT 4.0 available from Microsoft. + + + +Here are some additional details: + + + + + + What about Windows NT Policy Editor? + + + + To create or edit ntconfig.pol you must use + the NT Server Policy Editor, poledit.exe which + is included with NT Server but not NT Workstation. + There is a Policy Editor on a NTws + but it is not suitable for creating Domain Policies. + Further, although the Windows 95 + Policy Editor can be installed on an NT Workstation/Server, it will not + work with NT policies because the registry key that are set by the policy templates. + However, the files from the NT Server will run happily enough on an NTws. + You need poledit.exe, common.adm and winnt.adm. It is convenient + to put the two *.adm files in c:\winnt\inf which is where + the binary will look for them unless told otherwise. Note also that that + directory is 'hidden'. + + + + The Windows NT policy editor is also included with the Service Pack 3 (and + later) for Windows NT 4.0. Extract the files using servicepackname /x, + i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, + poledit.exe and the associated template files (*.adm) should + be extracted as well. It is also possible to downloaded the policy template + files for Office97 and get a copy of the policy editor. Another possible + location is with the Zero Administration Kit available for download from Microsoft. + + + + + + Can Win95 do Policies? + + + + Install the group policy handler for Win9x to pick up group + policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. + Install group policies on a Win9x client by double-clicking + grouppol.inf. Log off and on again a couple of + times and see if Win98 picks up group policies. Unfortunately this needs + to be done on every Win9x machine that uses group policies.... + + + + If group policies don't work one reports suggests getting the updated + (read: working) grouppol.dll for Windows 9x. The group list is grabbed + from /etc/group. + + + + + + How do I get 'User Manager' and 'Server Manager' + + + + Since I don't need to buy an NT Server CD now, how do I get + the 'User Manager for Domains', the 'Server Manager'? + + + + Microsoft distributes a version of these tools called nexus for + installation on Windows 95 systems. The tools set includes + + + + Server Manager + + User Manager for Domains + + Event Viewer + + + + Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE + + + + The Windows NT 4.0 version of the 'User Manager for + Domains' and 'Server Manager' are available from Microsoft via ftp + from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE + + + + + +Creating Group Prolicy Files + + +Windows '9x + +You need the Win98 Group Policy Editor to +set Group Profiles up under Windows '9x. It can be found on the Original +full product Win98 installation CD under +tools/reskit/netadmin/poledit. You install this +using the Add/Remove Programs facility and then click on the 'Have Disk' +tab. + + + +Use the Group Policy Editor to create a policy file that specifies the +location of user profiles and/or the My Documents etc. +stuff. You then save these settings in a file called +Config.POL that needs to be placed in +the root of the [NETLOGON] share. If your Win98 is configured to log onto +the Samba Domain, it will automatically read this file and update the +Win9x/Me registry of the machine that is logging on. + + + +All of this is covered in the Win98 Resource Kit documentation. + + + +If you do not do it this way, then every so often Win9x/Me will check the +integrity of the registry and will restore it's settings from the back-up +copy of the registry it stores on each Win9x/Me machine. Hence, you will +occasionally notice things changing back to the original settings. + + + + + + +Roaming Profiles + + + +NOTE! Roaming profiles support is different for Win9X and WinNT. + + + + +Before discussing how to configure roaming profiles, it is useful to see how +Win9X and WinNT clients implement these features. + + + +Win9X clients send a NetUserGetInfo request to the server to get the user's +profiles location. However, the response does not have room for a separate +profiles location field, only the user's home share. This means that Win9X +profiles are restricted to being in the user's home directory. + + + + +WinNT clients send a NetSAMLogon RPC request, which contains many fields, +including a separate field for the location of the user's profiles. +This means that support for profiles is different for Win9X and WinNT. + + + +Windows NT Configuration + + +To support WinNT clients, in the [global] section of smb.conf set the +following (for example): + + + +logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath + + + +The default for this option is \\%N\%U\profile, namely +\\sambaserver\username\profile. The \\N%\%U service is created +automatically by the [homes] service. +If you are using a samba server for the profiles, you _must_ make the +share specified in the logon path browseable. + + + + +MS Windows NT/2K clients at times do not disconnect a connection to a server +between logons. It is recommended to NOT use the homes +meta-service name as part of the profile share path. + + + + + + +Windows 9X Configuration + + +To support Win9X clients, you must use the "logon home" parameter. Samba has +now been fixed so that "net use /home" now works as well, and it, too, relies +on the "logon home" parameter. + + + +By using the logon home parameter, you are restricted to putting Win9X +profiles in the user's home directory. But wait! There is a trick you +can use. If you set the following in the [global] section of your +smb.conf file: + + + +logon home = \\%L\%U\.profiles + + + +then your Win9X clients will dutifully put their clients in a subdirectory +of your home directory called .profiles (thus making them hidden). + + + +Not only that, but 'net use/home' will also work, because of a feature in +Win9X. It removes any directory stuff off the end of the home directory area +and only uses the server and share portion. That is, it looks like you +specified \\%L\%U for "logon home". + + + + + + +Win9X and WinNT Configuration + + +You can support profiles for both Win9X and WinNT clients by setting both the +"logon home" and "logon path" parameters. For example: + + + +logon home = \\%L\%U\.profiles +logon path = \\%L\profiles\%U + + + + +I have not checked what 'net use /home' does on NT when "logon home" is +set as above. + + + + + +Windows 9X Profile Setup + + +When a user first logs in on Windows 9X, the file user.DAT is created, +as are folders "Start Menu", "Desktop", "Programs" and "Nethood". +These directories and their contents will be merged with the local +versions stored in c:\windows\profiles\username on subsequent logins, +taking the most recent from each. You will need to use the [global] +options "preserve case = yes", "short preserve case = yes" and +"case sensitive = no" in order to maintain capital letters in shortcuts +in any of the profile folders. + + + +The user.DAT file contains all the user's preferences. If you wish to +enforce a set of preferences, rename their user.DAT file to user.MAN, +and deny them write access to this file. + + + + + + On the Windows 95 machine, go to Control Panel | Passwords and + select the User Profiles tab. Select the required level of + roaming preferences. Press OK, but do _not_ allow the computer + to reboot. + + + + + + + On the Windows 95 machine, go to Control Panel | Network | + Client for Microsoft Networks | Preferences. Select 'Log on to + NT Domain'. Then, ensure that the Primary Logon is 'Client for + Microsoft Networks'. Press OK, and this time allow the computer + to reboot. + + + + + + +Under Windows 95, Profiles are downloaded from the Primary Logon. +If you have the Primary Logon as 'Client for Novell Networks', then +the profiles and logon script will be downloaded from your Novell +Server. If you have the Primary Logon as 'Windows Logon', then the +profiles will be loaded from the local machine - a bit against the +concept of roaming profiles, if you ask me. + + + +You will now find that the Microsoft Networks Login box contains +[user, password, domain] instead of just [user, password]. Type in +the samba server's domain name (or any other domain known to exist, +but bear in mind that the user will be authenticated against this +domain and profiles downloaded from it, if that domain logon server +supports it), user name and user's password. + + + +Once the user has been successfully validated, the Windows 95 machine +will inform you that 'The user has not logged on before' and asks you +if you wish to save the user's preferences? Select 'yes'. + + + +Once the Windows 95 client comes up with the desktop, you should be able +to examine the contents of the directory specified in the "logon path" +on the samba server and verify that the "Desktop", "Start Menu", +"Programs" and "Nethood" folders have been created. + + + +These folders will be cached locally on the client, and updated when +the user logs off (if you haven't made them read-only by then :-). +You will find that if the user creates further folders or short-cuts, +that the client will merge the profile contents downloaded with the +contents of the profile directory already on the local client, taking +the newest folders and short-cuts from each set. + + + +If you have made the folders / files read-only on the samba server, +then you will get errors from the w95 machine on logon and logout, as +it attempts to merge the local and the remote profile. Basically, if +you have any errors reported by the w95 machine, check the Unix file +permissions and ownership rights on the profile directory contents, +on the samba server. + + + +If you have problems creating user profiles, you can reset the user's +local desktop cache, as shown below. When this user then next logs in, +they will be told that they are logging in "for the first time". + + + + + + instead of logging in under the [user, password, domain] dialog, + press escape. + + + + + + run the regedit.exe program, and look in: + + + + HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList + + + + you will find an entry, for each user, of ProfilePath. Note the + contents of this key (likely to be c:\windows\profiles\username), + then delete the key ProfilePath for the required user. + + + + [Exit the registry editor]. + + + + + + WARNING - before deleting the contents of the + directory listed in + the ProfilePath (this is likely to be c:\windows\profiles\username), + ask them if they have any important files stored on their desktop + or in their start menu. delete the contents of the directory + ProfilePath (making a backup if any of the files are needed). + + + + This will have the effect of removing the local (read-only hidden + system file) user.DAT in their profile directory, as well as the + local "desktop", "nethood", "start menu" and "programs" folders. + + + + + + search for the user's .PWL password-caching file in the c:\windows + directory, and delete it. + + + + + + + log off the windows 95 client. + + + + + + check the contents of the profile path (see "logon path" described + above), and delete the user.DAT or user.MAN file for the user, + making a backup if required. + + + + + + +If all else fails, increase samba's debug log levels to between 3 and 10, +and / or run a packet trace program such as tcpdump or netmon.exe, and +look for any error reports. + + + +If you have access to an NT server, then first set up roaming profiles +and / or netlogons on the NT server. Make a packet trace, or examine +the example packet traces provided with NT server, and see what the +differences are with the equivalent samba trace. + + + + + +Windows NT Workstation 4.0 + + +When a user first logs in to a Windows NT Workstation, the profile +NTuser.DAT is created. The profile location can be now specified +through the "logon path" parameter. + + + +There is a parameter that is now available for use with NT Profiles: +"logon drive". This should be set to "h:" or any other drive, and +should be used in conjunction with the new "logon home" parameter. + + + +The entry for the NT 4.0 profile is a _directory_ not a file. The NT +help on profiles mentions that a directory is also created with a .PDS +extension. The user, while logging in, must have write permission to +create the full profile path (and the folder with the .PDS extension +for those situations where it might be created.) + + + +In the profile directory, NT creates more folders than 95. It creates +"Application Data" and others, as well as "Desktop", "Nethood", +"Start Menu" and "Programs". The profile itself is stored in a file +NTuser.DAT. Nothing appears to be stored in the .PDS directory, and +its purpose is currently unknown. + + + +You can use the System Control Panel to copy a local profile onto +a samba server (see NT Help on profiles: it is also capable of firing +up the correct location in the System Control Panel for you). The +NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN +turns a profile into a mandatory one. + + + +The case of the profile is significant. The file must be called +NTuser.DAT or, for a mandatory profile, NTuser.MAN. + + + + + + +Windows NT/200x Server + + +There is nothing to stop you specifying any path that you like for the +location of users' profiles. Therefore, you could specify that the +profile be stored on a samba server, or any other SMB server, as long as +that SMB server supports encrypted passwords. + + + + + +Sharing Profiles between W9x/Me and NT4/200x/XP workstations + + +Sharing of desktop profiles between Windows versions is NOT recommended. +Desktop profiles are an evolving phenomenon and profiles for later versions +of MS Windows clients add features that may interfere with earlier versions +of MS Windows clients. Probably the more salient reason to NOT mix profiles +is that when logging off an earlier version of MS Windows the older format +of profile contents may overwrite information that belongs to the newer +version resulting in loss of profile information content when that user logs +on again with the newer version of MS Windows. + + + +If you then want to share the same Start Menu / Desktop with W9x/Me, you will +need to specify a common location for the profiles. The smb.conf parameters +that need to be common are logon path and +logon home. + + + +If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory. + + + + + + +Windows NT 4 + + +Unfortunately, the Resource Kit info is Win NT4 or 200x specific. + + + +Here is a quick guide: + + + + + +On your NT4 Domain Controller, right click on 'My Computer', then +select the tab labelled 'User Profiles'. + + + +Select a user profile you want to migrate and click on it. + + +I am using the term "migrate" lossely. You can copy a profile to +create a group profile. You can give the user 'Everyone' rights to the +profile you copy this to. That is what you need to do, since your samba +domain is not a member of a trust relationship with your NT4 PDC. + + +Click the 'Copy To' button. + +In the box labelled 'Copy Profile to' add your new path, eg: +c:\temp\foobar + +Click on the button labelled 'Change' in the "Permitted to use" box. + +Click on the group 'Everyone' and then click OK. This closes the +'chose user' box. + +Now click OK. + + + +Follow the above for every profile you need to migrate. + + + +Side bar Notes + + +You should obtain the SID of your NT4 domain. You can use smbpasswd to do +this. Read the man page. + + +With Samba-3.0.0 alpha code you can import all you NT4 domain accounts +using the net samsync method. This way you can retain your profile +settings as well as all your users. + + + + + +Mandatory profiles + + +The above method can be used to create mandatory profiles also. To convert +a group profile into a mandatory profile simply locate the NTUser.DAT file +in the copied profile and rename it to NTUser.MAN. + + + + + +moveuser.exe + + +The W2K professional resource kit has moveuser.exe. moveuser.exe changes +the security of a profile from one user to another. This allows the account +domain to change, and/or the user name to change. + + + + + +Get SID + + +You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 +Resource Kit. + + + +Windows NT 4.0 stores the local profile information in the registry under +the following key: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList + + + +Under the ProfileList key, there will be subkeys named with the SIDs of the +users who have logged on to this computer. (To find the profile information +for the user whose locally cached profile you want to move, find the SID for +the user with the GetSID.exe utility.) Inside of the appropriate user's +subkey, you will see a string value named ProfileImagePath. + + + + + + + +Windows 2000/XP + + +You must first convert the profile from a local profile to a domain +profile on the MS Windows workstation as follows: + + + + +Log on as the LOCAL workstation administrator. + + + +Right click on the 'My Computer' Icon, select 'Properties' + + + +Click on the 'User Profiles' tab + + + +Select the profile you wish to convert (click on it once) + + + +Click on the button 'Copy To' + + + +In the "Permitted to use" box, click on the 'Change' button. + + + +Click on the 'Look in" area that lists the machine name, when you click +here it will open up a selection box. Click on the domain to which the +profile must be accessible. + + +You will need to log on if a logon box opens up. Eg: In the connect +as: MIDEARTH\root, password: mypassword. + + + +To make the profile capable of being used by anyone select 'Everyone' + + + +Click OK. The Selection box will close. + + + +Now click on the 'Ok' button to create the profile in the path you +nominated. + + + + +Done. You now have a profile that can be editted using the samba-3.0.0 +profiles tool. + + + + +Under NT/2K the use of mandotory profiles forces the use of MS Exchange +storage of mail data. That keeps desktop profiles usable. + + + + + + +This is a security check new to Windows XP (or maybe only +Windows XP service pack 1). It can be disabled via a group policy in +Active Directory. The policy is: + +"Computer Configuration\Administrative Templates\System\User +Profiles\Do not check for user ownership of Roaming Profile Folders" + +...and it should be set to "Enabled". +Does the new version of samba have an Active Directory analogue? If so, +then you may be able to set the policy through this. + + + +If you cannot set group policies in samba, then you may be able to set +the policy locally on each machine. If you want to try this, then do +the following (N.B. I don't know for sure that this will work in the +same way as a domain group policy): + + + + + +On the XP workstation log in with an Administrator account. + + +Click: "Start", "Run" +Type: "mmc" +Click: "OK" + +A Microsoft Management Console should appear. +Click: File, "Add/Remove Snap-in...", "Add" +Double-Click: "Group Policy" +Click: "Finish", "Close" +Click: "OK" + +In the "Console Root" window: +Expand: "Local Computer Policy", "Computer Configuration", +"Administrative Templates", "System", "User Profiles" +Double-Click: "Do not check for user ownership of Roaming Profile +Folders" +Select: "Enabled" +Click: OK" + +Close the whole console. You do not need to save the settings (this +refers to the console settings rather than the policies you have +changed). + +Reboot + + + + + + + -- cgit