1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
You must first convert the profile from a local profile to a domain
profile on the MS Windows workstation as follows:
1. Log on as the LOCAL workstation administrator.
2. Right click on the 'My Computer' Icon, select 'Properties'
3. Click on the 'User Profiles' tab
4. Select the profile you wish to convert (click on it once)
5. Click on the button 'Copy To'
6. In the "Permitted to use" box, click on the 'Change' button.
7. Click on the 'Look in" area that lists the machine name, when you click
here it will open up a selection box. Click on the domain to which the
profile must be accessible.
Note: You will need to log on if a logon box opens up. Eg: In the connect
as: MIDEARTH\root, password: mypassword.
8. To make the profile capable of being used by anyone select 'Everyone'
9. Click OK. The Selection box will close.
10. Now click on the 'Ok' button to create the profile in the path you
nominated.
Done. You now have a profile that can be editted using the samba-3.0.0
profiles tool.
> Keep profiles clean and small by making them mandatory.
> See the Win2K/WinXP resource kits for details how to create a mandatory profile.
>
> Can you do this when using Samba as a PDC? I thought you could only do
> policies if you had a Win2K server?
No difference. Samba handles the profile ACLs the same way Win2K does.
But understand that it is the Win2K client that does all the processing
of the SIDs on the ACLs in the profile NTUser.DAT file.
Note:
-----
> Unless your users are using Outlook (or virtually any E-mail client for
> that matter) I have a few users with .PST files that are over 1Gig in
> size. This is due to the regular amount of data files that we are sent. I
> have discussed with them the need to trim those files down.
Under NT/2K the use of mandotory profiles forces the use of MS Exchange
storage of mail data. That keeps desktop profiles usable.
Note:
-----
Date: Tue, 19 Nov 2002 08:32:17 -0000
From: John Russell <apca72@dsl.pipex.com>
Reply-To: John Russell <j.c.russell@sussex.ac.uk>
To: samba@lists.samba.org
Subject: Re: [Samba] Samba and Windows XP
[ The following text is in the "iso-8859-1" character set. ]
[ Your display is set for the "US-ASCII" character set. ]
[ Some characters may be displayed incorrectly. ]
this is a security check new to Windows XP (or maybe only
Windows XP service pack 1). It can be disabled via a group policy in
Active Directory. The policy is:
"Computer Configuration\Administrative Templates\System\User
Profiles\Do not check for user ownership of Roaming Profile Folders"
...and it should be set to "Enabled".
Does the new version of samba have an Active Directory analogue? If so,
then you may be able to set the policy through this.
If you cannot set group policies in samba, then you may be able to set
the policy locally on each machine. If you want to try this, then do
the following (N.B. I don't know for sure that this will work in the
same way as a domain group policy):
On the XP workstation log in with an Administrator account.
Click: "Start", "Run"
Type: "mmc"
Click: "OK"
A Microsoft Management Console should appear.
Click: File, "Add/Remove Snap-in...", "Add"
Double-Click: "Group Policy"
Click: "Finish", "Close"
Click: "OK"
In the "Console Root" window:
Expand: "Local Computer Policy", "Computer Configuration",
"Administrative Templates", "System", "User Profiles"
Double-Click: "Do not check for user ownership of Roaming Profile
Folders"
Select: "Enabled"
Click: OK"
Close the whole console. You do not need to save the settings (this
refers to the console settings rather than the policies you have
changed).
Reboot.
|
