1 <chapter id="NT4Migration">
4 <pubdate>April 3, 2003</pubdate>
7 <title>Migration from NT4 PDC to Samba-3 PDC</title>
10 This is a rough guide to assist those wishing to migrate from NT4 domain control to
11 Samba-3 based domain control.
15 <title>Planning and Getting Started</title>
18 In the IT world there is often a saying that all problems are encountered because of
19 poor planning. The corollary to this saying is that not all problems can be anticipated
20 and planned for. Then again, good planning will anticipate most show stopper type situations.
24 Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control
25 environment would do well to develop a detailed migration plan. So here are a few pointers to
26 help migration get under way.
30 <title>Objectives</title>
33 The key objective for most organisations will be to make the migration from MS Windows NT4
34 to Samba-3 domain control as painless as possible. One of the challenges you may experience
35 in your migration process may well be one of convincing management that the new environment
36 should remain in place. Many who have introduced open source technologies have experienced
37 pressure to return to a Microsoft based platform solution at the first sign of trouble.
41 It is strongly advised that before attempting a migration to a Samba-3 controlled network
42 that every possible effort be made to gain all-round commitment to the change. Firstly, you
43 should know precisely <emphasis>why</emphasis> the change is important for the organisation.
44 Possible motivations to make a change include:
48 <member>Improve network manageability</member>
49 <member>Obtain better user level functionality</member>
50 <member>Reduce network operating costs</member>
51 <member>Reduce exposure caused by Microsoft withdrawal of NT4 support</member>
52 <member>Avoid MS License 6 implications</member>
53 <member>Reduce organisation's dependency on Microsoft</member>
57 It is vital that it be well recognised that Samba-3 is NOT MS Windows NT4. Samba-3 offers
58 an alternative solution that is both different from MS Windows NT4 and that offers some
59 advantages compared with it. It should also be recognised that Samba-3 lacks many of the
60 features that Microsoft has promoted as core values in migration from MS Windows NT4 to
61 MS Windows 2000 and beyond (with or without Active Directory services).
65 What are the features that Samba-3 can NOT provide?
69 <member>Active Directory Server</member>
70 <member>Group Policy Objects (in Active Directory)</member>
71 <member>Machine Policy objects</member>
72 <member>Logon Scripts in Active Directory</member>
73 <member>Software Application and Access Controls in Active Directory</member>
77 The features that Samba-3 DOES provide and that may be of compelling interest to your site
82 <member>Lower Cost of Ownership</member>
83 <member>Global availability of support with no strings attached</member>
84 <member>Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system)</member>
85 <member>Creation of on-the-fly logon scripts</member>
86 <member>Creation of on-the-fly Policy Files</member>
87 <member>Greater Stability, Reliability, Performance and Availability</member>
88 <member>Manageability via an ssh connection</member>
89 <member>Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam)</member>
90 <member>Ability to implement a full single-sign-on architecture</member>
91 <member>Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand</member>
95 Before migrating a network from MS Windows NT4 to Samba-3 it is vital that all necessary factors are
96 considered. Users should be educated about changes they may experience so that the change will be a
97 welcome one and not become an obstacle to the work they need to do. The following are some of the
98 factors that will go into a successful migration:
102 <title>Domain Layout</title>
105 Samba-3 can be configured as a domain controller, a back-up domain controller (probably best called
106 a secondary controller), a domain member, or as a stand-alone server. The Windows network security
107 domain context should be sized and scoped before implementation. Particular attention needs to be
108 paid to the location of the primary domain controller (PDC) as well as backup controllers (BDCs).
109 It should be noted that one way in which Samba-3 differs from Microsoft technology is that if one
110 chooses to use an LDAP authentication backend then the same database can be used by several different
111 domains. This means that in a complex organisation there can be a single LDAP database, that itself
112 can be distributed, that can simultaneously serve multiple domains (that can also be widely distributed).
116 It is recommended that from a design perspective, the number of users per server, as well as the number
117 of servers, per domain should be scaled according to needs and should also consider server capacity
118 and network bandwidth.
122 A physical network segment may house several domains, each of which may span multiple network segments.
123 Where domains span routed network segments it is most advisable to consider and test the performance
124 implications of the design and layout of a network. A Centrally located domain controller that is being
125 designed to serve multiple routed network segments may result in severe performance problems if the
126 response time (eg: ping timing) between the remote segment and the PDC is more than 100 ms. In situations
127 where the delay is too long it is highly recommended to locate a backup controller (BDC) to serve as
128 the local authentication and access control server.
133 <title>Server Share and Directory Layout</title>
136 There are few cardinal rules to effective network design that can be broken with impunity.
137 The most important rule of effective network management is that simplicity is king in every
138 well controlled network. Every part of the infrastructure must be managed, the more complex
139 it is, the greater will be the demand of keeping systems secure and functional.
143 The nature of the data that must be stored needs to be born in mind when deciding how many
144 shares must be created. The physical disk space layout should also be taken into account
145 when designing where share points will be created. Keep in mind that all data needs to be
146 backed up, thus the simpler the disk layout the easier it will be to keep track of what must
147 be backed up to tape or other off-line storage medium. Always plan and implement for minimum
148 maintenance. Leave nothing to chance in your design, above all, do not leave backups to chance:
149 Backup and test, validate every backup, create a disaster recovery plan and prove that it works.
153 Users should be grouped according to data access control needs. File and directory access
154 is best controlled via group permissions and the use of the "sticky bit" on group controlled
155 directories may substantially avoid file access complaints from samba share users.
159 Many network administrators who are new to the game will attempt to use elaborate techniques
160 to set access controls, on files, directories, shares, as well as in share definitions.
161 There is the ever present danger that that administrator's successor will not understand the
162 complex mess that has been inherited. Remember, apparent job security through complex design
163 and implementation may ultimately cause loss of operations and downtime to users as the new
164 administrator learns to untangle your web. Keep access controls simple and effective and
165 make sure that users will never be interrupted by the stupidity of complexity.
170 <title>Logon Scripts</title>
173 Please refer to the section of this document on Advanced Network Administration for information
174 regarding the network logon script options for Samba-3. Logon scripts can help to ensure that
175 all users gain share and printer connections they need.
179 Logon scripts can be created on-the-fly so that all commands executed are specific to the
180 rights and privileges granted to the user. The preferred controls should be affected through
181 group membership so that group information can be used to custom create a logon script using
182 the <parameter>root preexec</parameter> parameters to the <filename>NETLOGON</filename> share.
186 Some sites prefer to use a tool such as <command>kixstart</command> to establish a controlled
187 user environment. In any case you may wish to do a google search for logon script process controls.
188 In particular, you may wish to explore the use of the Microsoft knowledgebase article KB189105 that
189 deals with how to add printers without user intervention via the logon script process.
194 <title>Profile Migration/Creation</title>
197 User and Group Profiles may be migrated using the tools described in the section titled Desktop Profile
202 Profiles may also be managed using the Samba-3 tool <command>profiles</command>. This tool allows
203 the MS Windows NT style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file
204 to be changed to the SID of the Samba-3 domain.
209 <title>User and Group Accounts</title>
212 It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before
213 attempting to migrate user and group accounts it is STRONGLY advised to create in Samba-3 the
214 groups that are present on the MS Windows NT4 domain <emphasis>AND</emphasis> to connect these to
215 suitable Unix/Linux groups. Following this simple advice will mean that all user and group attributes
216 should migrate painlessly.
223 <title>Steps In Migration Process</title>
226 The approximate migration process is described below.
231 You will have an NT4 PDC that has the users, groups, policies and profiles to be migrated
235 Samba-3 set up as a DC with netlogon share, profile share, etc.
239 <procedure><title>The Account Migration Process</title>
240 <step><para>Create a BDC account for the samba server using NT Server Manager</para>
241 <substeps><step><para>Samba must NOT be running</para></step></substeps></step>
244 <para><userinput>rpcclient <replaceable>NT4PDC</replaceable> -U Administrator%<replaceable>passwd</replaceable></userinput></para>
245 <substeps><step><para>lsaquery</para></step>
246 <step><para>Note the SID returned</para></step>
250 <step><para><userinput>net getsid -S <replaceable>NT4PDC</replaceable> -w <replaceable>DOMNAME</replaceable> -U Administrator%<replaceable>passwd</replaceable></userinput></para>
251 <substeps><step><para>Note the SID</para></step></substeps>
254 <step><para><userinput>net getlocalsid</userinput></para>
256 <step><para>Note the SID, now check that all three SIDS reported are the same!</para></step>
260 <step><para><userinput>net rpc join -S <replaceable>NT4PDC</replaceable> -w <replaceable>DOMNAME</replaceable> -U Administrator%<replaceable>passwd</replaceable></userinput></para></step>
262 <step><para><userinput>net rpc vampire -S <replaceable>NT4PDC</replaceable> -U administrator%<replaceable>passwd</replaceable></userinput></para></step>
264 <step><para><userinput>pdbedit -L</userinput></para>
265 <substeps><step><para>Note - did the users migrate?</para></step></substeps>
268 <step><para><userinput>initGrps.sh <replaceable>DOMNAME</replaceable></userinput></para></step>
270 <step><para><userinput>net groupmap list</userinput></para>
271 <substeps><step><para>Now check that all groups are recognised</para></step></substeps>
274 <step><para><userinput>net rpc vampire -S <replaceable>NT4PDC</replaceable> -U administrator%<replaceable>passwd</replaceable></userinput></para></step>
276 <step><para><userinput>pdbedit -Lv</userinput></para>
278 <para>Note - check that all group membership has been migrated</para>
284 Now it is time to migrate all the profiles, then migrate all policy files.
292 <title>Migration Options</title>
295 Based on feedback from many sites as well as from actual installation and maintenance
296 experience sites that wish to migrate from MS Windows NT4 Domain Control to a Samba
297 based solution fit into three basic categories.
300 <table frame="all"><title>The 3 Major Site Types</title>
303 <row><entry>Number of Users</entry><entry>Description</entry></row>
306 <row><entry>< 50</entry><entry><para>Want simple conversion with NO pain</para></entry></row>
307 <row><entry>50 - 250</entry><entry><para>Want new features, can manage some in-house complexity</para></entry></row>
308 <row><entry>> 250</entry><entry><para>Solution/Implementation MUST scale well, complex needs. Cross departmental decision process. Local expertise in most areas</para></entry></row>
314 <title>Planning for Success</title>
317 There are three basic choices for sites that intend to migrate from MS Windows NT4
323 Simple Conversion (total replacement)
327 Upgraded Conversion (could be one of integration)
331 Complete Redesign (completely new solution)
336 No matter what choice you make, the following rules will minimise down-stream problems:
353 Test full roll-out program, including workstation deployment
357 <table frame="top"><title>Nature of the Conversion Choices</title>
360 <row><entry>Simple</entry><entry>Upgraded</entry><entry>Redesign</entry></row>
364 <entry><para>Make use of minimal OS specific features</para></entry>
365 <entry><para>Translate NT4 features to new host OS features</para></entry>
366 <entry><para>Decide:</para></entry>
369 <entry><para>Suck all accounts from NT4 into Samba-3</para></entry>
370 <entry><para>Copy and improve:</para></entry>
371 <entry><para>Authentication Regime (database location and access)</para></entry>
374 <entry><para>Make least number of operational changes</para></entry>
375 <entry><para>Make progressive improvements</para></entry>
376 <entry><para>Desktop Management Methods</para></entry>
379 <entry><para>Take least amount of time to migrate</para></entry>
380 <entry><para>Minimise user impact</para></entry>
381 <entry><para>Better Control of Desktops / Users</para></entry>
384 <entry><para>Live versus Isolated Conversion</para></entry>
385 <entry><para>Maximise functionality</para></entry>
386 <entry><para>Identify Needs for: Manageability, Scalability, Security, Availability</para></entry>
389 <entry><para>Integrate Samba-3 then migrate while users are active, then Change of control (ie: swap out)</para></entry>
390 <entry><para>Take advantage of lower maintenance opportunity</para></entry>
391 <entry><para></para></entry>
399 <title>Samba Implementation Choices</title>
401 <!-- FIXME: Either a better layout or more written-out text-->
402 <para><programlisting>
403 Authentication database back end
404 Winbind (external Samba or NT4/200x server)
405 Can use pam_mkhomedir.so to auto-create home dirs
406 External server could use Active Directory or NT4 Domain
409 smbpasswd, tdbsam, ldapsam, mysqlsam
411 Access Control Points
412 On the Share itself (Use NT4 Server Manager)
414 Unix permissions on files and directories
415 Enable Posix ACLs in file system?
416 Through Samba share parameters
417 Not recommended - except as only resort
419 Policies (migrate or create new ones)
420 Group Policy Editor (NT4)
421 Watch out for Tattoo effect
423 User and Group Profiles
424 Platform specific so use platform tool to change from a Local
425 to a Roaming profile Can use new profiles tool to change SIDs
428 Logon Scripts (Know how they work)
430 User and Group mapping to Unix/Linux
431 username map facility may be needed
432 Use 'net groupmap' to connect NT4 groups to Unix groups
433 Use pdbedit to set/change user configuration
435 If migrating to LDAP back end it may be easier to dump initial LDAP database
436 to LDIF, then edit, then reload into LDAP
438 OS specific scripts / programs may be needed
440 Note OS limits on size of name (Linux 8 chars)
442 Add / delete machines
443 Applied only to domain members (note up to 16 chars)
445 Note OS limits on size and nature
446 Linux limit is 16 char,
447 no spaces and no upper case chars (groupadd)
450 Domain Control (NT4 Style)
451 Profiles, Policies, Access Controls, Security
454 Samba: net, rpcclient, smbpasswd, pdbedit, profiles
455 Windows: NT4 Domain User Manager, Server Manager (NEXUS)
458 New SAM back end (smbpasswd, tdbsam, ldapsam, mysqlsam)