</address>
</affiliation>
</author>
-
-
- <pubdate>April 1 2003</pubdate>
+ <pubdate>April 3 2003</pubdate>
</chapterinfo>
-<title>System Policies</title>
-
-<sect1>
-<title>Basic System Policy Info</title>
-
-<para>
-Much of the information necessary to implement System Policies and
-Roaming User Profiles in a Samba domain is the same as that for
-implementing these same items in a Windows NT 4.0 domain.
-You should read the white paper <ulink url="http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp">Implementing
-Profiles and Policies in Windows NT 4.0</ulink> available from Microsoft.
-</para>
-
-<para>
-Here are some additional details:
-</para>
-
-<itemizedlist>
-<listitem>
- <para>
- <emphasis>What about Windows NT Policy Editor?</emphasis>
- </para>
-
- <para>
- To create or edit <filename>ntconfig.pol</filename> you must use
- the NT Server Policy Editor, <command>poledit.exe</command> which
- is included with NT Server but <emphasis>not NT Workstation</emphasis>.
- There is a Policy Editor on a NTws
- but it is not suitable for creating <emphasis>Domain Policies</emphasis>.
- Further, although the Windows 95
- Policy Editor can be installed on an NT Workstation/Server, it will not
- work with NT policies because the registry key that are set by the policy templates.
- However, the files from the NT Server will run happily enough on an NTws.
- You need <filename>poledit.exe, common.adm</filename> and <filename>winnt.adm</filename>. It is convenient
- to put the two *.adm files in <filename>c:\winnt\inf</filename> which is where
- the binary will look for them unless told otherwise. Note also that that
- directory is 'hidden'.
- </para>
-
- <para>
- The Windows NT policy editor is also included with the Service Pack 3 (and
- later) for Windows NT 4.0. Extract the files using <command>servicepackname /x</command>,
- i.e. that's <command>Nt4sp6ai.exe /x</command> for service pack 6a. The policy editor,
- <command>poledit.exe</command> and the associated template files (*.adm) should
- be extracted as well. It is also possible to downloaded the policy template
- files for Office97 and get a copy of the policy editor. Another possible
- location is with the Zero Administration Kit available for download from Microsoft.
- </para>
-</listitem>
-
-<listitem>
- <para>
- <emphasis>Can Win95 do Policies?</emphasis>
- </para>
-
- <para>
- Install the group policy handler for Win9x to pick up group
- policies. Look on the Win98 CD in <filename>\tools\reskit\netadmin\poledit</filename>.
- Install group policies on a Win9x client by double-clicking
- <filename>grouppol.inf</filename>. Log off and on again a couple of
- times and see if Win98 picks up group policies. Unfortunately this needs
- to be done on every Win9x machine that uses group policies....
- </para>
-
- <para>
- If group policies don't work one reports suggests getting the updated
- (read: working) grouppol.dll for Windows 9x. The group list is grabbed
- from /etc/group.
- </para>
-</listitem>
-
-<listitem>
- <para>
- <emphasis>How do I get 'User Manager' and 'Server Manager'</emphasis>
- </para>
-
- <para>
- Since I don't need to buy an NT Server CD now, how do I get
- the 'User Manager for Domains', the 'Server Manager'?
- </para>
-
- <para>
- Microsoft distributes a version of these tools called nexus for
- installation on Windows 95 systems. The tools set includes
- </para>
-
- <itemizedlist>
- <listitem><para>Server Manager</para></listitem>
-
- <listitem><para>User Manager for Domains</para></listitem>
-
- <listitem><para>Event Viewer</para></listitem>
- </itemizedlist>
-
- <para>
- Click here to download the archived file <ulink
- url="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</ulink>
- </para>
-
- <para>
- The Windows NT 4.0 version of the 'User Manager for
- Domains' and 'Server Manager' are available from Microsoft via ftp
- from <ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</ulink>
- </para>
-</listitem>
-</itemizedlist>
-
-<sect2>
-<title>Creating Group Prolicy Files</title>
-
-<sect3>
-<title>Windows '9x</title>
-<para>
-You need the Win98 Group Policy Editor to
-set Group Profiles up under Windows '9x. It can be found on the Original
-full product Win98 installation CD under
-<filename>tools/reskit/netadmin/poledit</filename>. You install this
-using the Add/Remove Programs facility and then click on the 'Have Disk'
-tab.
-</para>
-
-<para>
-Use the Group Policy Editor to create a policy file that specifies the
-location of user profiles and/or the <filename>My Documents</filename> etc.
-stuff. You then save these settings in a file called
-<filename>Config.POL</filename> that needs to be placed in
-the root of the [NETLOGON] share. If your Win98 is configured to log onto
-the Samba Domain, it will automatically read this file and update the
-Win9x/Me registry of the machine that is logging on.
-</para>
+<title>Advanced Network Manangement</title>
<para>
-All of this is covered in the Win98 Resource Kit documentation.
+This section attempts to document peripheral issues that are of great importance to network
+administrators who want to improve network resource access control, to automate the user
+environment, and to make their lives a little easier.
</para>
-<para>
-If you do not do it this way, then every so often Win9x/Me will check the
-integrity of the registry and will restore it's settings from the back-up
-copy of the registry it stores on each Win9x/Me machine. Hence, you will
-occasionally notice things changing back to the original settings.
-</para>
-
-</sect3>
-</sect2>
-</sect1>
-
<sect1>
-<title>Roaming Profiles</title>
-
-<warning>
-<para>
-<emphasis>NOTE!</emphasis> Roaming profiles support is different for Win9X and WinNT.
-</para>
-</warning>
+<title>Configuring Samba Share Access Controls</title>
<para>
-Before discussing how to configure roaming profiles, it is useful to see how
-Win9X and WinNT clients implement these features.
+This section deals with how to configure Samba per share access control restrictions.
+By default samba sets no restrictions on the share itself. Restrictions on the share itself
+can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can
+connect to a share. In the absence of specific restrictions the default setting is to allow
+the global user <emphasis>Everyone</emphasis> Full Control (ie: Full control, Change and Read).
</para>
<para>
-Win9X clients send a NetUserGetInfo request to the server to get the user's
-profiles location. However, the response does not have room for a separate
-profiles location field, only the user's home share. This means that Win9X
-profiles are restricted to being in the user's home directory.
+At this time Samba does NOT provide a tool for configuring access control setting on the Share
+itself. Samba does have the capacity to store and act on access control settings, but the only
+way to create those settings is to use either the NT4 Server Manager or the Windows 200x MMC for
+Computer Management.
</para>
-
<para>
-WinNT clients send a NetSAMLogon RPC request, which contains many fields,
-including a separate field for the location of the user's profiles.
-This means that support for profiles is different for Win9X and WinNT.
+Samba stores the per share access control settings in a file called <filename>share_info.tdb</filename>.
+The location of this file on your system will depend on how samba was compiled. The default location
+for samba's tdb files is under <filename>/usr/local/samba/var</filename>. If the <filename>tdbdump</filename>
+utility has been compiled and installed on your system then you can examine the contents of this file
+by: <filename>tdbdump share_info.tdb</filename>.
</para>
<sect2>
-<title>Windows NT Configuration</title>
+<title>Share Permissions Management</title>
<para>
-To support WinNT clients, in the [global] section of smb.conf set the
-following (for example):
+The best tool for the task is platform dependant. Choose the best tool for your environmemt.
</para>
-<para><programlisting>
-logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath
-</programlisting></para>
-
-<para>
-The default for this option is \\%N\%U\profile, namely
-\\sambaserver\username\profile. The \\N%\%U service is created
-automatically by the [homes] service.
-If you are using a samba server for the profiles, you _must_ make the
-share specified in the logon path browseable.
-</para>
-
-<note>
-<para>
-MS Windows NT/2K clients at times do not disconnect a connection to a server
-between logons. It is recommended to NOT use the <emphasis>homes</emphasis>
-meta-service name as part of the profile share path.
-</para>
-</note>
-
-</sect2>
-
-<sect2>
-<title>Windows 9X Configuration</title>
-
-<para>
-To support Win9X clients, you must use the "logon home" parameter. Samba has
-now been fixed so that "net use /home" now works as well, and it, too, relies
-on the "logon home" parameter.
-</para>
-
-<para>
-By using the logon home parameter, you are restricted to putting Win9X
-profiles in the user's home directory. But wait! There is a trick you
-can use. If you set the following in the [global] section of your
-smb.conf file:
-</para>
-
-<para><programlisting>
-logon home = \\%L\%U\.profiles
-</programlisting></para>
-
-<para>
-then your Win9X clients will dutifully put their clients in a subdirectory
-of your home directory called .profiles (thus making them hidden).
-</para>
-
-<para>
-Not only that, but 'net use/home' will also work, because of a feature in
-Win9X. It removes any directory stuff off the end of the home directory area
-and only uses the server and share portion. That is, it looks like you
-specified \\%L\%U for "logon home".
-</para>
-
-
-</sect2>
-
-<sect2>
-<title>Win9X and WinNT Configuration</title>
-
-<para>
-You can support profiles for both Win9X and WinNT clients by setting both the
-"logon home" and "logon path" parameters. For example:
-</para>
-
-<para><programlisting>
-logon home = \\%L\%U\.profiles
-logon path = \\%L\profiles\%U
-</programlisting></para>
-
-<note>
-<para>
-I have not checked what 'net use /home' does on NT when "logon home" is
-set as above.
-</para>
-</note>
-</sect2>
-
-<sect2>
-<title>Windows 9X Profile Setup</title>
-
+<sect3>
+<title>Windows NT4 Workstation/Server</title>
<para>
-When a user first logs in on Windows 9X, the file user.DAT is created,
-as are folders "Start Menu", "Desktop", "Programs" and "Nethood".
-These directories and their contents will be merged with the local
-versions stored in c:\windows\profiles\username on subsequent logins,
-taking the most recent from each. You will need to use the [global]
-options "preserve case = yes", "short preserve case = yes" and
-"case sensitive = no" in order to maintain capital letters in shortcuts
-in any of the profile folders.
+The tool you need to use to manage share permissions on a Samba server is the NT Server Manager.
+Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation.
+You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below.
</para>
<para>
-The user.DAT file contains all the user's preferences. If you wish to
-enforce a set of preferences, rename their user.DAT file to user.MAN,
-and deny them write access to this file.
+Instructions:
</para>
-<orderedlist>
-<listitem>
<para>
- On the Windows 95 machine, go to Control Panel | Passwords and
- select the User Profiles tab. Select the required level of
- roaming preferences. Press OK, but do _not_ allow the computer
- to reboot.
+ Launch the NT4 Server Manager, click on the Samba server you want to administer, then from the menu
+ select Computer, then click on the Shared Directories entry.
</para>
-</listitem>
-
-<listitem>
<para>
- On the Windows 95 machine, go to Control Panel | Network |
- Client for Microsoft Networks | Preferences. Select 'Log on to
- NT Domain'. Then, ensure that the Primary Logon is 'Client for
- Microsoft Networks'. Press OK, and this time allow the computer
- to reboot.
+ Now click on the share that you wish to manage, then click on the Properties tab, next click on
+ the Permissions tab. Now you can Add or change access control settings as you wish.
</para>
-</listitem>
-
-</orderedlist>
-
-<para>
-Under Windows 95, Profiles are downloaded from the Primary Logon.
-If you have the Primary Logon as 'Client for Novell Networks', then
-the profiles and logon script will be downloaded from your Novell
-Server. If you have the Primary Logon as 'Windows Logon', then the
-profiles will be loaded from the local machine - a bit against the
-concept of roaming profiles, if you ask me.
-</para>
-<para>
-You will now find that the Microsoft Networks Login box contains
-[user, password, domain] instead of just [user, password]. Type in
-the samba server's domain name (or any other domain known to exist,
-but bear in mind that the user will be authenticated against this
-domain and profiles downloaded from it, if that domain logon server
-supports it), user name and user's password.
-</para>
-
-<para>
-Once the user has been successfully validated, the Windows 95 machine
-will inform you that 'The user has not logged on before' and asks you
-if you wish to save the user's preferences? Select 'yes'.
-</para>
+</sect3>
-<para>
-Once the Windows 95 client comes up with the desktop, you should be able
-to examine the contents of the directory specified in the "logon path"
-on the samba server and verify that the "Desktop", "Start Menu",
-"Programs" and "Nethood" folders have been created.
-</para>
+<sect3>
+<title>Windows 200x/XP</title>
<para>
-These folders will be cached locally on the client, and updated when
-the user logs off (if you haven't made them read-only by then :-).
-You will find that if the user creates further folders or short-cuts,
-that the client will merge the profile contents downloaded with the
-contents of the profile directory already on the local client, taking
-the newest folders and short-cuts from each set.
+On MS Windows NT4/200x/XP system access control lists on the share itself are set using native
+tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder,
+then select 'Sharing', then click on 'Permissions'. The default Windows NT4/200x permission allows
+<emphasis>Everyone</emphasis> Full Control on the Share.
</para>
<para>
-If you have made the folders / files read-only on the samba server,
-then you will get errors from the w95 machine on logon and logout, as
-it attempts to merge the local and the remote profile. Basically, if
-you have any errors reported by the w95 machine, check the Unix file
-permissions and ownership rights on the profile directory contents,
-on the samba server.
+MS Windows 200x and later all comes with a tool called the 'Computer Management' snap-in for the
+Microsoft Management Console (MMC). This tool is located by clicking on <filename>Control Panel ->
+Administrative Tools -> Computer Management</filename>.
</para>
<para>
-If you have problems creating user profiles, you can reset the user's
-local desktop cache, as shown below. When this user then next logs in,
-they will be told that they are logging in "for the first time".
+Instructions:
</para>
-
-<orderedlist>
-<listitem>
- <para>
- instead of logging in under the [user, password, domain] dialog,
- press escape.
- </para>
-</listitem>
-
-<listitem>
- <para>
- run the regedit.exe program, and look in:
- </para>
-
- <para>
- HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList
- </para>
-
- <para>
- you will find an entry, for each user, of ProfilePath. Note the
- contents of this key (likely to be c:\windows\profiles\username),
- then delete the key ProfilePath for the required user.
- </para>
-
- <para>
- [Exit the registry editor].
- </para>
-</listitem>
-
-<listitem>
<para>
- <emphasis>WARNING</emphasis> - before deleting the contents of the
- directory listed in
- the ProfilePath (this is likely to be c:\windows\profiles\username),
- ask them if they have any important files stored on their desktop
- or in their start menu. delete the contents of the directory
- ProfilePath (making a backup if any of the files are needed).
+ After launching the MMC with the Computer Management snap-in, click on the menu item 'Action',
+ select 'Connect to another computer'. If you are not logged onto a domain you will be prompted
+ to enter a domain login user identifier and a password. This will authenticate you to the domain.
+ If you where already logged in with administrative privilidge this step is not offered.
</para>
<para>
- This will have the effect of removing the local (read-only hidden
- system file) user.DAT in their profile directory, as well as the
- local "desktop", "nethood", "start menu" and "programs" folders.
+ If the Samba server is not shown in the Select Computer box, then type in the name of the target
+ Samba server in the field 'Name:'. Now click on the [+] next to 'System Tools', then on the [+]
+ next to 'Shared Folders' in the left panel.
</para>
-</listitem>
-
-<listitem>
- <para>
- search for the user's .PWL password-caching file in the c:\windows
- directory, and delete it.
- </para>
-</listitem>
-
-<listitem>
<para>
- log off the windows 95 client.
+ Now in the right panel, double-click on the share you wish to set access control permissions on.
+ Then click on the tab 'Share Permissions'. It is now possible to add access control entities
+ to the shared folder. Do NOT forget to set what type of access (full control, change, read) you
+ wish to assign for each entry.
</para>
-</listitem>
-<listitem>
+ <note>
<para>
- check the contents of the profile path (see "logon path" described
- above), and delete the user.DAT or user.MAN file for the user,
- making a backup if required.
+ Be careful. If you take away all permissions from the Everyone user without removing this user
+ then effectively no user will be able to access the share. This is a result of what is known as
+ ACL precidence. ie: Everyone with NO ACCESS means that MaryK who is part of the group Everyone
+ will have no access even if this user is given explicit full control access.
</para>
-</listitem>
-
-</orderedlist>
-
-<para>
-If all else fails, increase samba's debug log levels to between 3 and 10,
-and / or run a packet trace program such as tcpdump or netmon.exe, and
-look for any error reports.
-</para>
-
-<para>
-If you have access to an NT server, then first set up roaming profiles
-and / or netlogons on the NT server. Make a packet trace, or examine
-the example packet traces provided with NT server, and see what the
-differences are with the equivalent samba trace.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Windows NT Workstation 4.0</title>
-
-<para>
-When a user first logs in to a Windows NT Workstation, the profile
-NTuser.DAT is created. The profile location can be now specified
-through the "logon path" parameter.
-</para>
-
-<para>
-There is a parameter that is now available for use with NT Profiles:
-"logon drive". This should be set to "h:" or any other drive, and
-should be used in conjunction with the new "logon home" parameter.
-</para>
-
-<para>
-The entry for the NT 4.0 profile is a _directory_ not a file. The NT
-help on profiles mentions that a directory is also created with a .PDS
-extension. The user, while logging in, must have write permission to
-create the full profile path (and the folder with the .PDS extension
-for those situations where it might be created.)
-</para>
-
-<para>
-In the profile directory, NT creates more folders than 95. It creates
-"Application Data" and others, as well as "Desktop", "Nethood",
-"Start Menu" and "Programs". The profile itself is stored in a file
-NTuser.DAT. Nothing appears to be stored in the .PDS directory, and
-its purpose is currently unknown.
-</para>
-
-<para>
-You can use the System Control Panel to copy a local profile onto
-a samba server (see NT Help on profiles: it is also capable of firing
-up the correct location in the System Control Panel for you). The
-NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN
-turns a profile into a mandatory one.
-</para>
-
-<para>
-The case of the profile is significant. The file must be called
-NTuser.DAT or, for a mandatory profile, NTuser.MAN.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Windows NT/200x Server</title>
-
-<para>
-There is nothing to stop you specifying any path that you like for the
-location of users' profiles. Therefore, you could specify that the
-profile be stored on a samba server, or any other SMB server, as long as
-that SMB server supports encrypted passwords.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Sharing Profiles between W9x/Me and NT4/200x/XP workstations</title>
-
-<para>
-Sharing of desktop profiles between Windows versions is NOT recommended.
-Desktop profiles are an evolving phenomenon and profiles for later versions
-of MS Windows clients add features that may interfere with earlier versions
-of MS Windows clients. Probably the more salient reason to NOT mix profiles
-is that when logging off an earlier version of MS Windows the older format
-of profile contents may overwrite information that belongs to the newer
-version resulting in loss of profile information content when that user logs
-on again with the newer version of MS Windows.
-</para>
-
-<para>
-If you then want to share the same Start Menu / Desktop with W9x/Me, you will
-need to specify a common location for the profiles. The smb.conf parameters
-that need to be common are <emphasis>logon path</emphasis> and
-<emphasis>logon home</emphasis>.
-</para>
-
-<para>
-If you have this set up correctly, you will find separate user.DAT and
-NTuser.DAT files in the same profile directory.
-</para>
-
-</sect2>
-
-
-<sect2>
-<title>Windows NT 4</title>
-
-<para>
-Unfortunately, the Resource Kit info is Win NT4 or 200x specific.
-</para>
-
-<para>
-Here is a quick guide:
-</para>
-
-<itemizedlist>
-
-<listitem><para>
-On your NT4 Domain Controller, right click on 'My Computer', then
-select the tab labelled 'User Profiles'.
-</para></listitem>
-
-<listitem><para>
-Select a user profile you want to migrate and click on it.
-</para>
-
-<note><para>I am using the term "migrate" lossely. You can copy a profile to
-create a group profile. You can give the user 'Everyone' rights to the
-profile you copy this to. That is what you need to do, since your samba
-domain is not a member of a trust relationship with your NT4 PDC.</para></note>
-</listitem>
-
-<listitem><para>Click the 'Copy To' button.</para></listitem>
-
-<listitem><para>In the box labelled 'Copy Profile to' add your new path, eg:
-<filename>c:\temp\foobar</filename></para></listitem>
-
-<listitem><para>Click on the button labelled 'Change' in the "Permitted to use" box.</para></listitem>
-
-<listitem><para>Click on the group 'Everyone' and then click OK. This closes the
-'chose user' box.</para></listitem>
-
-<listitem><para>Now click OK.</para></listitem>
-</itemizedlist>
-
-<para>
-Follow the above for every profile you need to migrate.
-</para>
-
-<sect3>
-<title>Side bar Notes</title>
-
-<para>
-You should obtain the SID of your NT4 domain. You can use smbpasswd to do
-this. Read the man page.</para>
-
-<para>
-With Samba-3.0.0 alpha code you can import all you NT4 domain accounts
-using the net samsync method. This way you can retain your profile
-settings as well as all your users.
-</para>
-
-</sect3>
-
-<sect3>
-<title>Mandatory profiles</title>
-
-<para>
-The above method can be used to create mandatory profiles also. To convert
-a group profile into a mandatory profile simply locate the NTUser.DAT file
-in the copied profile and rename it to NTUser.MAN.
-</para>
+ </note>
</sect3>
+</sect2>
+</sect1>
-<sect3>
-<title>moveuser.exe</title>
-
-<para>
-The W2K professional resource kit has moveuser.exe. moveuser.exe changes
-the security of a profile from one user to another. This allows the account
-domain to change, and/or the user name to change.
-</para>
-
-</sect3>
-
-<sect3>
-<title>Get SID</title>
-
-<para>
-You can identify the SID by using GetSID.exe from the Windows NT Server 4.0
-Resource Kit.
-</para>
+<sect1>
+<title>Remote Server Administration</title>
<para>
-Windows NT 4.0 stores the local profile information in the registry under
-the following key:
-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
+<emphasis>How do I get 'User Manager' and 'Server Manager'?</emphasis>
</para>
<para>
-Under the ProfileList key, there will be subkeys named with the SIDs of the
-users who have logged on to this computer. (To find the profile information
-for the user whose locally cached profile you want to move, find the SID for
-the user with the GetSID.exe utility.) Inside of the appropriate user's
-subkey, you will see a string value named ProfileImagePath.
+Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains',
+the 'Server Manager'?
</para>
-</sect3>
-
-</sect2>
-
-<sect2>
-<title>Windows 2000/XP</title>
-
<para>
-You must first convert the profile from a local profile to a domain
-profile on the MS Windows workstation as follows:
+Microsoft distributes a version of these tools called nexus for installation on Windows 9x / Me
+systems. The tools set includes:
</para>
<itemizedlist>
-<listitem><para>
-Log on as the LOCAL workstation administrator.
-</para></listitem>
-
-<listitem><para>
-Right click on the 'My Computer' Icon, select 'Properties'
-</para></listitem>
-
-<listitem><para>
-Click on the 'User Profiles' tab
-</para></listitem>
-
-<listitem><para>
-Select the profile you wish to convert (click on it once)
-</para></listitem>
-
-<listitem><para>
-Click on the button 'Copy To'
-</para></listitem>
-
-<listitem><para>
-In the "Permitted to use" box, click on the 'Change' button.
-</para></listitem>
-
-<listitem><para>
-Click on the 'Look in" area that lists the machine name, when you click
-here it will open up a selection box. Click on the domain to which the
-profile must be accessible.
-</para>
-
-<note><para>You will need to log on if a logon box opens up. Eg: In the connect
-as: MIDEARTH\root, password: mypassword.</para></note>
-</listitem>
-
-<listitem><para>
-To make the profile capable of being used by anyone select 'Everyone'
-</para></listitem>
-
-<listitem><para>
-Click OK. The Selection box will close.
-</para></listitem>
+ <listitem><para>Server Manager</para></listitem>
+
+ <listitem><para>User Manager for Domains</para></listitem>
-<listitem><para>
-Now click on the 'Ok' button to create the profile in the path you
-nominated.
-</para></listitem>
+ <listitem><para>Event Viewer</para></listitem>
</itemizedlist>
<para>
-Done. You now have a profile that can be editted using the samba-3.0.0
-profiles tool.
+Click here to download the archived file <ulink
+url="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</ulink>
</para>
-<note>
<para>
-Under NT/2K the use of mandotory profiles forces the use of MS Exchange
-storage of mail data. That keeps desktop profiles usable.
+The Windows NT 4.0 version of the 'User Manager for
+Domains' and 'Server Manager' are available from Microsoft via ftp
+from <ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE">ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</ulink>
</para>
-</note>
-<note>
-<itemizedlist>
-<listitem><para>
-This is a security check new to Windows XP (or maybe only
-Windows XP service pack 1). It can be disabled via a group policy in
-Active Directory. The policy is:</para>
-
-<para>"Computer Configuration\Administrative Templates\System\User
-Profiles\Do not check for user ownership of Roaming Profile Folders"</para>
-
-<para>...and it should be set to "Enabled".
-Does the new version of samba have an Active Directory analogue? If so,
-then you may be able to set the policy through this.
-</para>
+</sect1>
+<sect1>
+<title>Network Logon Script Magic</title>
<para>
-If you cannot set group policies in samba, then you may be able to set
-the policy locally on each machine. If you want to try this, then do
-the following (N.B. I don't know for sure that this will work in the
-same way as a domain group policy):
+This section needs work. Volunteer contributions most welcome. Please send your patches or updates
+to jht@samba.org.
</para>
-</listitem>
-
-<listitem><para>
-On the XP workstation log in with an Administrator account.
-</para></listitem>
-
-<listitem><para>Click: "Start", "Run"</para></listitem>
-<listitem><para>Type: "mmc"</para></listitem>
-<listitem><para>Click: "OK"</para></listitem>
-
-<listitem><para>A Microsoft Management Console should appear.</para></listitem>
-<listitem><para>Click: File, "Add/Remove Snap-in...", "Add"</para></listitem>
-<listitem><para>Double-Click: "Group Policy"</para></listitem>
-<listitem><para>Click: "Finish", "Close"</para></listitem>
-<listitem><para>Click: "OK"</para></listitem>
-
-<listitem><para>In the "Console Root" window:</para></listitem>
-<listitem><para>Expand: "Local Computer Policy", "Computer Configuration",</para></listitem>
-<listitem><para>"Administrative Templates", "System", "User Profiles"</para></listitem>
-<listitem><para>Double-Click: "Do not check for user ownership of Roaming Profile</para></listitem>
-<listitem><para>Folders"</para></listitem>
-<listitem><para>Select: "Enabled"</para></listitem>
-<listitem><para>Click: OK"</para></listitem>
-
-<listitem><para>Close the whole console. You do not need to save the settings (this
-refers to the console settings rather than the policies you have
-changed).</para></listitem>
-
-<listitem><para>Reboot</para></listitem>
-</itemizedlist>
-</note>
-
-</sect2>
-</sect1>
</chapter>
git.samba.org / kai / samba.git / blobdiff