From 536eda24033cadebb7db47e5affa9a6d118ea109 Mon Sep 17 00:00:00 2001 From: John Terpstra Date: Thu, 3 Apr 2003 09:50:33 +0000 Subject: More doco updates. Another few days and it will be cooked. (This used to be commit 79e66288f96b029208d11b3aa095002de9447020) --- docs/docbook/projdoc/ProfileMgmt.sgml | 631 ++++++++++++++++++++++++++++++++++ 1 file changed, 631 insertions(+) create mode 100644 docs/docbook/projdoc/ProfileMgmt.sgml (limited to 'docs/docbook/projdoc/ProfileMgmt.sgml') diff --git a/docs/docbook/projdoc/ProfileMgmt.sgml b/docs/docbook/projdoc/ProfileMgmt.sgml new file mode 100644 index 0000000000..ffbc65f767 --- /dev/null +++ b/docs/docbook/projdoc/ProfileMgmt.sgml @@ -0,0 +1,631 @@ + + + + John HTerpstra + + Samba Team +
+ jht@samba.org +
+ + + April 3 2003 + + +Profile Management + + +Roaming Profiles + + + +NOTE! Roaming profiles support is different for Win9X and WinNT. + + + + +Before discussing how to configure roaming profiles, it is useful to see how +Win9X and WinNT clients implement these features. + + + +Win9X clients send a NetUserGetInfo request to the server to get the user's +profiles location. However, the response does not have room for a separate +profiles location field, only the user's home share. This means that Win9X +profiles are restricted to being in the user's home directory. + + + + +WinNT clients send a NetSAMLogon RPC request, which contains many fields, +including a separate field for the location of the user's profiles. +This means that support for profiles is different for Win9X and WinNT. + + + +Windows NT Configuration + + +To support WinNT clients, in the [global] section of smb.conf set the +following (for example): + + + +logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath + + + +The default for this option is \\%N\%U\profile, namely +\\sambaserver\username\profile. The \\N%\%U service is created +automatically by the [homes] service. +If you are using a samba server for the profiles, you _must_ make the +share specified in the logon path browseable. + + + + +MS Windows NT/2K clients at times do not disconnect a connection to a server +between logons. It is recommended to NOT use the homes +meta-service name as part of the profile share path. + + + + + + +Windows 9X Configuration + + +To support Win9X clients, you must use the "logon home" parameter. Samba has +now been fixed so that "net use /home" now works as well, and it, too, relies +on the "logon home" parameter. + + + +By using the logon home parameter, you are restricted to putting Win9X +profiles in the user's home directory. But wait! There is a trick you +can use. If you set the following in the [global] section of your +smb.conf file: + + +logon home = \\%L\%U\.profiles + + + +then your Win9X clients will dutifully put their clients in a subdirectory +of your home directory called .profiles (thus making them hidden). + + + +Not only that, but 'net use/home' will also work, because of a feature in +Win9X. It removes any directory stuff off the end of the home directory area +and only uses the server and share portion. That is, it looks like you +specified \\%L\%U for "logon home". + + + + + + +Win9X and WinNT Configuration + + +You can support profiles for both Win9X and WinNT clients by setting both the +"logon home" and "logon path" parameters. For example: + + + +logon home = \\%L\%U\.profiles +logon path = \\%L\profiles\%U + + + + +I have not checked what 'net use /home' does on NT when "logon home" is +set as above. + + + + + +Windows 9X Profile Setup + + +When a user first logs in on Windows 9X, the file user.DAT is created, +as are folders "Start Menu", "Desktop", "Programs" and "Nethood". +These directories and their contents will be merged with the local +versions stored in c:\windows\profiles\username on subsequent logins, +taking the most recent from each. You will need to use the [global] +options "preserve case = yes", "short preserve case = yes" and +"case sensitive = no" in order to maintain capital letters in shortcuts +in any of the profile folders. + + + +The user.DAT file contains all the user's preferences. If you wish to +enforce a set of preferences, rename their user.DAT file to user.MAN, +and deny them write access to this file. + + + + + + On the Windows 95 machine, go to Control Panel | Passwords and + select the User Profiles tab. Select the required level of + roaming preferences. Press OK, but do _not_ allow the computer + to reboot. + + + + + + On the Windows 95 machine, go to Control Panel | Network | + Client for Microsoft Networks | Preferences. Select 'Log on to + NT Domain'. Then, ensure that the Primary Logon is 'Client for + Microsoft Networks'. Press OK, and this time allow the computer + to reboot. + + + + + + +Under Windows 95, Profiles are downloaded from the Primary Logon. +If you have the Primary Logon as 'Client for Novell Networks', then +the profiles and logon script will be downloaded from your Novell +Server. If you have the Primary Logon as 'Windows Logon', then the +profiles will be loaded from the local machine - a bit against the +concept of roaming profiles, if you ask me. + + + +You will now find that the Microsoft Networks Login box contains +[user, password, domain] instead of just [user, password]. Type in +the samba server's domain name (or any other domain known to exist, +but bear in mind that the user will be authenticated against this +domain and profiles downloaded from it, if that domain logon server +supports it), user name and user's password. + + + +Once the user has been successfully validated, the Windows 95 machine +will inform you that 'The user has not logged on before' and asks you +if you wish to save the user's preferences? Select 'yes'. + + + +Once the Windows 95 client comes up with the desktop, you should be able +to examine the contents of the directory specified in the "logon path" +on the samba server and verify that the "Desktop", "Start Menu", +"Programs" and "Nethood" folders have been created. + + + +These folders will be cached locally on the client, and updated when +the user logs off (if you haven't made them read-only by then :-). +You will find that if the user creates further folders or short-cuts, +that the client will merge the profile contents downloaded with the +contents of the profile directory already on the local client, taking +the newest folders and short-cuts from each set. + + + +If you have made the folders / files read-only on the samba server, +then you will get errors from the w95 machine on logon and logout, as +it attempts to merge the local and the remote profile. Basically, if +you have any errors reported by the w95 machine, check the Unix file +permissions and ownership rights on the profile directory contents, +on the samba server. + + + +If you have problems creating user profiles, you can reset the user's +local desktop cache, as shown below. When this user then next logs in, +they will be told that they are logging in "for the first time". + + + + + + instead of logging in under the [user, password, domain] dialog, + press escape. + + + + + run the regedit.exe program, and look in: + + + + HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList + + + + you will find an entry, for each user, of ProfilePath. Note the + contents of this key (likely to be c:\windows\profiles\username), + then delete the key ProfilePath for the required user. + + + + [Exit the registry editor]. + + + + + + WARNING - before deleting the contents of the + directory listed in + the ProfilePath (this is likely to be c:\windows\profiles\username), + ask them if they have any important files stored on their desktop + or in their start menu. delete the contents of the directory + ProfilePath (making a backup if any of the files are needed). + + + + This will have the effect of removing the local (read-only hidden + system file) user.DAT in their profile directory, as well as the + local "desktop", "nethood", "start menu" and "programs" folders. + + + + + + search for the user's .PWL password-caching file in the c:\windows + directory, and delete it. + + + + + + + log off the windows 95 client. + + + + + + check the contents of the profile path (see "logon path" described + above), and delete the user.DAT or user.MAN file for the user, + making a backup if required. + + + + + + +If all else fails, increase samba's debug log levels to between 3 and 10, +and / or run a packet trace program such as tcpdump or netmon.exe, and +look for any error reports. + + + +If you have access to an NT server, then first set up roaming profiles +and / or netlogons on the NT server. Make a packet trace, or examine +the example packet traces provided with NT server, and see what the +differences are with the equivalent samba trace. + + + + + +Windows NT Workstation 4.0 + + +When a user first logs in to a Windows NT Workstation, the profile +NTuser.DAT is created. The profile location can be now specified +through the "logon path" parameter. + + + +There is a parameter that is now available for use with NT Profiles: +"logon drive". This should be set to "h:" or any other drive, and +should be used in conjunction with the new "logon home" parameter. + + + +The entry for the NT 4.0 profile is a _directory_ not a file. The NT +help on profiles mentions that a directory is also created with a .PDS +extension. The user, while logging in, must have write permission to +create the full profile path (and the folder with the .PDS extension +for those situations where it might be created.) + + + +In the profile directory, NT creates more folders than 95. It creates +"Application Data" and others, as well as "Desktop", "Nethood", +"Start Menu" and "Programs". The profile itself is stored in a file +NTuser.DAT. Nothing appears to be stored in the .PDS directory, and +its purpose is currently unknown. + + + +You can use the System Control Panel to copy a local profile onto +a samba server (see NT Help on profiles: it is also capable of firing +up the correct location in the System Control Panel for you). The +NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN +turns a profile into a mandatory one. + + + +The case of the profile is significant. The file must be called +NTuser.DAT or, for a mandatory profile, NTuser.MAN. + + + + + +Windows NT/200x Server + + +There is nothing to stop you specifying any path that you like for the +location of users' profiles. Therefore, you could specify that the +profile be stored on a samba server, or any other SMB server, as long as +that SMB server supports encrypted passwords. + + + + + +Sharing Profiles between W9x/Me and NT4/200x/XP workstations + + +Sharing of desktop profiles between Windows versions is NOT recommended. +Desktop profiles are an evolving phenomenon and profiles for later versions +of MS Windows clients add features that may interfere with earlier versions +of MS Windows clients. Probably the more salient reason to NOT mix profiles +is that when logging off an earlier version of MS Windows the older format +of profile contents may overwrite information that belongs to the newer +version resulting in loss of profile information content when that user logs +on again with the newer version of MS Windows. + + + +If you then want to share the same Start Menu / Desktop with W9x/Me, you will +need to specify a common location for the profiles. The smb.conf parameters +that need to be common are logon path and +logon home. + + + +If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory. + + + + + + +Windows NT 4 + + +Unfortunately, the Resource Kit info is Win NT4 or 200x specific. + + + +Here is a quick guide: + + + + + +On your NT4 Domain Controller, right click on 'My Computer', then +select the tab labelled 'User Profiles'. + + + +Select a user profile you want to migrate and click on it. + + +I am using the term "migrate" lossely. You can copy a profile to +create a group profile. You can give the user 'Everyone' rights to the +profile you copy this to. That is what you need to do, since your samba +domain is not a member of a trust relationship with your NT4 PDC. + + +Click the 'Copy To' button. + +In the box labelled 'Copy Profile to' add your new path, eg: +c:\temp\foobar + +Click on the button labelled 'Change' in the "Permitted to use" box. + +Click on the group 'Everyone' and then click OK. This closes the +'chose user' box. + +Now click OK. + + + +Follow the above for every profile you need to migrate. + + + +Side bar Notes + + +You should obtain the SID of your NT4 domain. You can use smbpasswd to do +this. Read the man page. + + +With Samba-3.0.0 alpha code you can import all you NT4 domain accounts +using the net samsync method. This way you can retain your profile +settings as well as all your users. + + + + + +Mandatory profiles + + +The above method can be used to create mandatory profiles also. To convert +a group profile into a mandatory profile simply locate the NTUser.DAT file +in the copied profile and rename it to NTUser.MAN. + + + + + +moveuser.exe + + +The W2K professional resource kit has moveuser.exe. moveuser.exe changes +the security of a profile from one user to another. This allows the account +domain to change, and/or the user name to change. + + + + + +Get SID + + +You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 +Resource Kit. + + + +Windows NT 4.0 stores the local profile information in the registry under +the following key: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList + + + +Under the ProfileList key, there will be subkeys named with the SIDs of the +users who have logged on to this computer. (To find the profile information +for the user whose locally cached profile you want to move, find the SID for +the user with the GetSID.exe utility.) Inside of the appropriate user's +subkey, you will see a string value named ProfileImagePath. + + + + + + + +Windows 2000/XP + + +You must first convert the profile from a local profile to a domain +profile on the MS Windows workstation as follows: + + + + +Log on as the LOCAL workstation administrator. + + + +Right click on the 'My Computer' Icon, select 'Properties' + + + +Click on the 'User Profiles' tab + + + +Select the profile you wish to convert (click on it once) + + + +Click on the button 'Copy To' + + + +In the "Permitted to use" box, click on the 'Change' button. + + + +Click on the 'Look in" area that lists the machine name, when you click +here it will open up a selection box. Click on the domain to which the +profile must be accessible. + + + +You will need to log on if a logon box opens up. Eg: In the connect +as: MIDEARTH\root, password: mypassword. + + + +To make the profile capable of being used by anyone select 'Everyone' + + + +Click OK. The Selection box will close. + + + +Now click on the 'Ok' button to create the profile in the path you +nominated. + + + + +Done. You now have a profile that can be editted using the samba-3.0.0 +profiles tool. + + + + +Under NT/2K the use of mandotory profiles forces the use of MS Exchange +storage of mail data. That keeps desktop profiles usable. + + + + + + +This is a security check new to Windows XP (or maybe only +Windows XP service pack 1). It can be disabled via a group policy in +Active Directory. The policy is: + +"Computer Configuration\Administrative Templates\System\User +Profiles\Do not check for user ownership of Roaming Profile Folders" + +...and it should be set to "Enabled". +Does the new version of samba have an Active Directory analogue? If so, +then you may be able to set the policy through this. + + + +If you cannot set group policies in samba, then you may be able to set +the policy locally on each machine. If you want to try this, then do +the following (N.B. I don't know for sure that this will work in the +same way as a domain group policy): + + + + + +On the XP workstation log in with an Administrator account. + + +Click: "Start", "Run" +Type: "mmc" +Click: "OK" + +A Microsoft Management Console should appear. +Click: File, "Add/Remove Snap-in...", "Add" +Double-Click: "Group Policy" +Click: "Finish", "Close" +Click: "OK" + +In the "Console Root" window: +Expand: "Local Computer Policy", "Computer Configuration", +"Administrative Templates", "System", "User Profiles" +Double-Click: "Do not check for user ownership of Roaming Profile +Folders" +Select: "Enabled" +Click: OK" + +Close the whole console. You do not need to save the settings (this +refers to the console settings rather than the policies you have +changed). + +Reboot + + + + + + -- cgit