1 <chapter id="ProfileMgmt">
4 <pubdate>April 3 2003</pubdate>
7 <title>Desktop Profile Management</title>
10 <title>Features and Benefits</title>
13 Roaming Profiles are feared by some, hated by a few, loved by many, and a Godsend for
18 Roaming Profiles allow an administrator to make available a consistent user desktop
19 as the user moves from one machine to another. This chapter provides much information
20 regarding how to configure and manage Roaming Profiles.
24 While Roaming Profiles might sound like nirvana to some, they are a real and tangible
25 problem to others. In particular, users of mobile computing tools, where often there may not
26 be a sustained network connection, are often better served by purely Local Profiles.
27 This chapter provides information to help the Samba administrator to deal with those
34 <title>Roaming Profiles</title>
38 Roaming profiles support is different for Win9x / Me and Windows NT4/200x.
43 Before discussing how to configure roaming profiles, it is useful to see how
44 Windows 9x / Me and Windows NT4/200x clients implement these features.
48 Windows 9x / Me clients send a NetUserGetInfo request to the server to get the user's
49 profiles location. However, the response does not have room for a separate
50 profiles location field, only the user's home share. This means that Win9X/Me
51 profiles are restricted to being stored in the user's home directory.
56 Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields,
57 including a separate field for the location of the user's profiles.
61 <title>Samba Configuration for Profile Handling</title>
64 This section documents how to configure Samba for MS Windows client profile support.
68 <title>NT4/200x User Profiles</title>
71 To support Windows NT4/200x clients, in the [global] section of smb.conf set the
72 following (for example):
77 logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath
80 This is typically implemented like:
83 logon path = \\%L\Profiles\%u
85 where %L translates to the name of the Samba server and %u translates to the user name
89 The default for this option is <filename>\\%N\%U\profile</filename>,
90 namely <filename>\\sambaserver\username\profile</filename>.
91 The <filename>\\N%\%U</filename> service is created automatically by the [homes] service. If you are using
92 a samba server for the profiles, you _must_ make the share specified in the logon path
93 browseable. Please refer to the man page for &smb.conf; in respect of the different
94 semantics of %L and %N, as well as %U and %u.
99 MS Windows NT/2K clients at times do not disconnect a connection to a server
100 between logons. It is recommended to NOT use the <parameter>homes</parameter>
101 meta-service name as part of the profile share path.
107 <title>Windows 9x / Me User Profiles</title>
110 To support Windows 9x / Me clients, you must use the <parameter>logon home</parameter> parameter. Samba has
111 now been fixed so that <userinput>net use /home</userinput> now works as well, and it, too, relies
112 on the <command>logon home</command> parameter.
116 By using the logon home parameter, you are restricted to putting Win9x / Me
117 profiles in the user's home directory. But wait! There is a trick you
118 can use. If you set the following in the <parameter>[global]</parameter> section of your &smb.conf; file:
120 <para><programlisting>
121 logon home = \\%L\%U\.profiles
122 </programlisting></para>
125 then your Windows 9x / Me clients will dutifully put their clients in a subdirectory
126 of your home directory called <filename>.profiles</filename> (thus making them hidden).
130 Not only that, but <userinput>net use /home</userinput> will also work, because of a feature in
131 Windows 9x / Me. It removes any directory stuff off the end of the home directory area
132 and only uses the server and share portion. That is, it looks like you
133 specified <filename>\\%L\%U</filename> for <parameter>logon home</parameter>.
138 <title>Mixed Windows 9x / Me and Windows NT4/200x User Profiles</title>
141 You can support profiles for both Win9X and WinNT clients by setting both the
142 <parameter>logon home</parameter> and <parameter>logon path</parameter> parameters. For example:
145 <para><programlisting>
146 logon home = \\%L\%u\.profiles
147 logon path = \\%L\profiles\%u
148 </programlisting></para>
152 <title>Disabling Roaming Profile Support</title>
155 A question often asked is <quote>How may I enforce use of local profiles?</quote> or
156 <quote>How do I disable Roaming Profiles?</quote>
160 There are three ways of doing this:
165 <term>In &smb.conf;</term>
167 Affect the following settings and ALL clients
168 will be forced to use a local profile:
177 <term>MS Windows Registry:</term>
179 By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP machine to use only a local profile. This of course modifies registry settings. The full path to the option is:
180 <!-- FIXME: Diagram for this ? -->
182 Local Computer Policy\
183 Computer Configuration\
184 Administrative Templates\
188 Disable: Only Allow Local User Profiles
189 Disable: Prevent Roaming Profile Change from Propagating to the Server
195 <term>Change of Profile Type:</term>
197 From the start menu right click on the
198 My Computer icon, select <guimenuitem>Properties</guimenuitem>, click on the <guilabel>User Profiles</guilabel>
199 tab, select the profile you wish to change from Roaming type to Local, click <guibutton>Change Type</guibutton>.
205 Consult the MS Windows registry guide for your particular MS Windows version for more
206 information about which registry keys to change to enforce use of only local user
211 The specifics of how to convert a local profile to a roaming profile, or a roaming profile
212 to a local one vary according to the version of MS Windows you are running. Consult the
213 Microsoft MS Windows Resource Kit for your version of Windows for specific information.
220 <title>Windows Client Profile Configuration Information</title>
223 <title>Windows 9x / Me Profile Setup</title>
226 When a user first logs in on Windows 9X, the file user.DAT is created,
227 as are folders <filename>Start Menu</filename>, <filename>Desktop</filename>,
228 <filename>Programs</filename> and <filename>Nethood</filename>.
229 These directories and their contents will be merged with the local
230 versions stored in <filename>c:\windows\profiles\username</filename> on subsequent logins,
231 taking the most recent from each. You will need to use the <parameter>[global]</parameter>
232 options <parameter>preserve case = yes</parameter>, <parameter>short preserve case = yes</parameter> and
233 <parameter>case sensitive = no</parameter> in order to maintain capital letters in shortcuts
234 in any of the profile folders.
238 The user.DAT file contains all the user's preferences. If you wish to
239 enforce a set of preferences, rename their user.DAT file to user.MAN,
240 and deny them write access to this file.
246 On the Windows 9x / Me machine, go to <guimenu>Control Panel</guimenu> -> <guimenuitem>Passwords</guimenuitem> and
247 select the <guilabel>User Profiles</guilabel> tab. Select the required level of
248 roaming preferences. Press <guibutton>OK</guibutton>, but do _not_ allow the computer
255 On the Windows 9x / Me machine, go to <guimenu>Control Panel</guimenu> -> <guimenuitem>Network</guimenuitem> ->
256 <guimenuitem>Client for Microsoft Networks</guimenuitem> -> <guilabel>Preferences</guilabel>. Select <guilabel>Log on to
257 NT Domain</guilabel>. Then, ensure that the Primary Logon is <guilabel>Client for
258 Microsoft Networks</guilabel>. Press <guibutton>OK</guibutton>, and this time allow the computer
265 Under Windows 9x / Me Profiles are downloaded from the Primary Logon.
266 If you have the Primary Logon as 'Client for Novell Networks', then
267 the profiles and logon script will be downloaded from your Novell
268 Server. If you have the Primary Logon as 'Windows Logon', then the
269 profiles will be loaded from the local machine - a bit against the
270 concept of roaming profiles, it would seem!
274 You will now find that the Microsoft Networks Login box contains
275 [user, password, domain] instead of just [user, password]. Type in
276 the samba server's domain name (or any other domain known to exist,
277 but bear in mind that the user will be authenticated against this
278 domain and profiles downloaded from it, if that domain logon server
279 supports it), user name and user's password.
283 Once the user has been successfully validated, the Windows 9x / Me machine
284 will inform you that <computeroutput>The user has not logged on before' and asks you
285 if you wish to save the user's preferences?</computeroutput> Select <guibutton>yes</guibutton>.
289 Once the Windows 9x / Me client comes up with the desktop, you should be able
290 to examine the contents of the directory specified in the <parameter>logon path</parameter>
291 on the samba server and verify that the <filename>Desktop</filename>, <filename>Start Menu</filename>,
292 <filename>Programs</filename> and <filename>Nethood</filename> folders have been created.
296 These folders will be cached locally on the client, and updated when
297 the user logs off (if you haven't made them read-only by then).
298 You will find that if the user creates further folders or short-cuts,
299 that the client will merge the profile contents downloaded with the
300 contents of the profile directory already on the local client, taking
301 the newest folders and short-cuts from each set.
305 If you have made the folders / files read-only on the samba server,
306 then you will get errors from the Windows 9x / Me machine on logon and logout, as
307 it attempts to merge the local and the remote profile. Basically, if
308 you have any errors reported by the Windows 9x / Me machine, check the Unix file
309 permissions and ownership rights on the profile directory contents,
314 If you have problems creating user profiles, you can reset the user's
315 local desktop cache, as shown below. When this user then next logs in,
316 they will be told that they are logging in "for the first time".
322 instead of logging in under the [user, password, domain] dialog,
323 press <guibutton>escape</guibutton>.
329 run the <command>regedit.exe</command> program, and look in:
333 <filename>HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList</filename>
337 you will find an entry, for each user, of ProfilePath. Note the
338 contents of this key (likely to be <filename>c:\windows\profiles\username</filename>),
339 then delete the key ProfilePath for the required user.
342 <para>[Exit the registry editor].</para>
347 Before deleting the contents of the
348 directory listed in the ProfilePath (this is likely to be
349 <filename>c:\windows\profiles\username)</filename>, ask them if they
350 have any important files stored on their desktop or in their start menu.
351 Delete the contents of the directory ProfilePath (making a backup if any
352 of the files are needed).
356 This will have the effect of removing the local (read-only hidden
357 system file) user.DAT in their profile directory, as well as the
358 local "desktop", "nethood", "start menu" and "programs" folders.
364 search for the user's .PWL password-caching file in the <filename>c:\windows</filename>
365 directory, and delete it.
371 log off the windows 9x / Me client.
377 check the contents of the profile path (see <parameter>logon path</parameter> described
378 above), and delete the <filename>user.DAT</filename> or <filename>user.MAN</filename> file for the user,
379 making a backup if required.
386 If all else fails, increase samba's debug log levels to between 3 and 10,
387 and / or run a packet trace program such as ethereal or <command>netmon.exe</command>, and
388 look for error messages.
392 If you have access to an Windows NT4/200x server, then first set up roaming profiles
393 and / or netlogons on the Windows NT4/200x server. Make a packet trace, or examine
394 the example packet traces provided with Windows NT4/200x server, and see what the
395 differences are with the equivalent samba trace.
401 <title>Windows NT4 Workstation</title>
404 When a user first logs in to a Windows NT Workstation, the profile
405 NTuser.DAT is created. The profile location can be now specified
406 through the <parameter>logon path</parameter> parameter.
410 There is a parameter that is now available for use with NT Profiles:
411 <parameter>logon drive</parameter>. This should be set to <filename>H:</filename> or any other drive, and
412 should be used in conjunction with the new "logon home" parameter.
416 The entry for the NT4 profile is a _directory_ not a file. The NT
417 help on profiles mentions that a directory is also created with a .PDS
418 extension. The user, while logging in, must have write permission to
419 create the full profile path (and the folder with the .PDS extension
420 for those situations where it might be created.)
424 In the profile directory, Windows NT4 creates more folders than Windows 9x / Me.
425 It creates <filename>Application Data</filename> and others, as well as <filename>Desktop</filename>, <filename>Nethood</filename>,
426 <filename>Start Menu</filename> and <filename>Programs</filename>. The profile itself is stored in a file
427 <filename>NTuser.DAT</filename>. Nothing appears to be stored in the .PDS directory, and
428 its purpose is currently unknown.
432 You can use the <application>System Control Panel</application> to copy a local profile onto
433 a samba server (see NT Help on profiles: it is also capable of firing
434 up the correct location in the <application>System Control Panel</application> for you). The
435 NT Help file also mentions that renaming <filename>NTuser.DAT</filename> to <filename>NTuser.MAN</filename>
436 turns a profile into a mandatory one.
440 The case of the profile is significant. The file must be called
441 <filename>NTuser.DAT</filename> or, for a mandatory profile, <filename>NTuser.MAN</filename>.
446 <title>Windows 2000/XP Professional</title>
449 You must first convert the profile from a local profile to a domain
450 profile on the MS Windows workstation as follows:
455 Log on as the <emphasis>LOCAL</emphasis> workstation administrator.
459 Right click on the <guiicon>My Computer</guiicon> Icon, select <guimenuitem>Properties</guimenuitem>
463 Click on the <guilabel>User Profiles</guilabel> tab
467 Select the profile you wish to convert (click on it once)
471 Click on the button <guibutton>Copy To</guibutton>
475 In the <guilabel>Permitted to use</guilabel> box, click on the <guibutton>Change</guibutton> button.
479 Click on the 'Look in" area that lists the machine name, when you click
480 here it will open up a selection box. Click on the domain to which the
481 profile must be accessible.
484 <note><para>You will need to log on if a logon box opens up. Eg: In the connect
485 as: <replaceable>MIDEARTH</replaceable>\root, password: <replaceable>mypassword</replaceable>.</para></note>
489 To make the profile capable of being used by anyone select 'Everyone'
493 Click <guibutton>OK</guibutton>. The Selection box will close.
497 Now click on the <guibutton>Ok</guibutton> button to create the profile in the path you
503 Done. You now have a profile that can be edited using the samba-3.0.0
504 <command>profiles</command> tool.
509 Under NT/2K the use of mandatory profiles forces the use of MS Exchange
510 storage of mail data. That keeps desktop profiles usable.
517 This is a security check new to Windows XP (or maybe only
518 Windows XP service pack 1). It can be disabled via a group policy in
519 Active Directory. The policy is:</para>
521 <para><filename>Computer Configuration\Administrative Templates\System\User
522 Profiles\Do not check for user ownership of Roaming Profile Folders</filename></para>
524 <para>...and it should be set to <constant>Enabled</constant>.
525 Does the new version of samba have an Active Directory analogue? If so,
526 then you may be able to set the policy through this.
530 If you cannot set group policies in samba, then you may be able to set
531 the policy locally on each machine. If you want to try this, then do
532 the following (N.B. I don't know for sure that this will work in the
533 same way as a domain group policy):
539 On the XP workstation log in with an Administrator account.
542 <step><para>Click: <guimenu>Start</guimenu>, <guimenuitem>Run</guimenuitem></para></step>
543 <step><para>Type: <userinput>mmc</userinput></para></step>
544 <step><para>Click: <guibutton>OK</guibutton></para></step>
546 <step><para>A Microsoft Management Console should appear.</para></step>
547 <step><para>Click: <guimenu>File</guimenu>, <guimenuitem>Add/Remove Snap-in...</guimenuitem>, <guimenuitem>Add</guimenuitem></para></step>
548 <step><para>Double-Click: <guiicon>Group Policy</guiicon></para></step>
549 <step><para>Click: <guibutton>Finish</guibutton>, <guibutton>Close</guibutton></para></step>
550 <step><para>Click: <guibutton>OK</guibutton></para></step>
552 <step><para>In the "Console Root" window:</para></step>
553 <step><para>Expand: <guiicon>Local Computer Policy</guiicon>, <guiicon>Computer Configuration</guiicon>,
554 <guiicon>Administrative Templates</guiicon>, <guiicon>System</guiicon>, <guiicon>User Profiles</guiicon></para></step>
555 <step><para>Double-Click: <guilabel>Do not check for user ownership of Roaming Profile Folders</guilabel></para></step>
556 <step><para>Select: <guilabel>Enabled</guilabel></para></step>
557 <step><para>Click: <guibutton>OK</guibutton></para></step>
559 <step><para>Close the whole console. You do not need to save the settings (this
560 refers to the console settings rather than the policies you have
561 changed).</para></step>
563 <step><para>Reboot</para></step>
570 <title>Sharing Profiles between W9x/Me and NT4/200x/XP workstations</title>
573 Sharing of desktop profiles between Windows versions is NOT recommended.
574 Desktop profiles are an evolving phenomenon and profiles for later versions
575 of MS Windows clients add features that may interfere with earlier versions
576 of MS Windows clients. Probably the more salient reason to NOT mix profiles
577 is that when logging off an earlier version of MS Windows the older format
578 of profile contents may overwrite information that belongs to the newer
579 version resulting in loss of profile information content when that user logs
580 on again with the newer version of MS Windows.
584 If you then want to share the same Start Menu / Desktop with W9x/Me, you will
585 need to specify a common location for the profiles. The smb.conf parameters
586 that need to be common are <parameter>logon path</parameter> and
587 <parameter>logon home</parameter>.
591 If you have this set up correctly, you will find separate <filename>user.DAT</filename> and
592 <filename>NTuser.DAT</filename> files in the same profile directory.
598 <title>Profile Migration from Windows NT4/200x Server to Samba</title>
601 There is nothing to stop you specifying any path that you like for the
602 location of users' profiles. Therefore, you could specify that the
603 profile be stored on a samba server, or any other SMB server, as long as
604 that SMB server supports encrypted passwords.
608 <title>Windows NT4 Profile Management Tools</title>
611 Unfortunately, the Resource Kit information is specific to the version of MS Windows
612 NT4/200x. The correct resource kit is required for each platform.
616 Here is a quick guide:
622 On your NT4 Domain Controller, right click on <guiicon>My Computer</guiicon>, then
623 select the tab labelled <guilabel>User Profiles</guilabel>.
627 Select a user profile you want to migrate and click on it.
630 <note><para>I am using the term "migrate" loosely. You can copy a profile to
631 create a group profile. You can give the user 'Everyone' rights to the
632 profile you copy this to. That is what you need to do, since your samba
633 domain is not a member of a trust relationship with your NT4 PDC.</para></note>
636 <step><para>Click the <guibutton>Copy To</guibutton> button.</para></step>
638 <step><para>In the box labelled <guilabel>Copy Profile to</guilabel> add your new path, eg:
639 <filename>c:\temp\foobar</filename></para></step>
641 <step><para>Click on the button <guibutton>Change</guibutton> in the <guilabel>Permitted to use</guilabel> box.</para></step>
643 <step><para>Click on the group 'Everyone' and then click <guibutton>OK</guibutton>. This closes the
644 'choose user' box.</para></step>
646 <step><para>Now click <guibutton>OK</guibutton>.</para></step>
650 Follow the above for every profile you need to migrate.
656 <title>Side bar Notes</title>
659 You should obtain the SID of your NT4 domain. You can use smbpasswd to do
660 this. Read the man page.</para>
663 With Samba-3.0.0 alpha code you can import all you NT4 domain accounts
664 using the net samsync method. This way you can retain your profile
665 settings as well as all your users.
671 <title>moveuser.exe</title>
674 The W2K professional resource kit has moveuser.exe. moveuser.exe changes
675 the security of a profile from one user to another. This allows the account
676 domain to change, and/or the user name to change.
682 <title>Get SID</title>
685 You can identify the SID by using GetSID.exe from the Windows NT Server 4.0
690 Windows NT 4.0 stores the local profile information in the registry under
692 <filename>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList</filename>
696 Under the ProfileList key, there will be subkeys named with the SIDs of the
697 users who have logged on to this computer. (To find the profile information
698 for the user whose locally cached profile you want to move, find the SID for
699 the user with the GetSID.exe utility.) Inside of the appropriate user's
700 subkey, you will see a string value named ProfileImagePath.
708 <title>Mandatory profiles</title>
711 A Mandatory Profile is a profile that the user does NOT have the ability to overwrite.
712 During the user's session it may be possible to change the desktop environment, but
713 as the user logs out all changes made will be lost. If it is desired to NOT allow the
714 user any ability to change the desktop environment then this must be done through
715 policy settings. See previous chapter.
720 Under NO circumstances should the profile directory (or it's contents) be made read-only
721 as this may render the profile un-usable.
726 For MS Windows NT4/200x/XP the above method can be used to create mandatory profiles
727 also. To convert a group profile into a mandatory profile simply locate the NTUser.DAT
728 file in the copied profile and rename it to NTUser.MAN.
732 For MS Windows 9x / Me it is the <filename>User.DAT</filename> file that must be renamed to <filename>User.MAN</filename> to
733 affect a mandatory profile.
739 <title>Creating/Managing Group Profiles</title>
742 Most organisations are arranged into departments. There is a nice benefit in
743 this fact since usually most users in a department will require the same desktop
744 applications and the same desktop layout. MS Windows NT4/200x/XP will allow the
745 use of Group Profiles. A Group Profile is a profile that is created firstly using
746 a template (example) user. Then using the profile migration tool (see above) the
747 profile is assigned access rights for the user group that needs to be given access
748 to the group profile.
752 The next step is rather important. <emphasis>Please note:</emphasis> Instead of assigning a group profile
753 to users (ie: Using User Manager) on a "per user" basis, the group itself is assigned
754 the now modified profile.
759 Be careful with group profiles, if the user who is a member of a group also
760 has a personal profile, then the result will be a fusion (merge) of the two.
767 <title>Default Profile for Windows Users</title>
770 MS Windows 9x / Me and NT4/200x/XP will use a default profile for any user for whom
771 a profile does not already exist. Armed with a knowledge of where the default profile
772 is located on the Windows workstation, and knowing which registry keys affect the path
773 from which the default profile is created, it is possible to modify the default profile
774 to one that has been optimised for the site. This has significant administrative
779 <title>MS Windows 9x/Me</title>
782 To enable default per use profiles in Windows 9x / Me you can either use the <application>Windows 98 System
783 Policy Editor</application> or change the registry directly.
787 To enable default per user profiles in Windows 9x / Me, launch the <application>System Policy Editor</application>, then
788 select <guimenu>File</guimenu> -> <guimenuitem>Open Registry</guimenuitem>, then click on the
789 <guiicon>Local Computer</guiicon> icon, click on <guilabel>Windows 98 System</guilabel>,
790 select <guilabel>User Profiles</guilabel>, click on the enable box. Do not forget to save the registry changes.
794 To modify the registry directly, launch the <application>Registry Editor</application> (<command>regedit.exe</command>), select the hive
795 <filename>HKEY_LOCAL_MACHINE\Network\Logon</filename>. Now add a DWORD type key with the name
796 "User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0.
800 <title>How User Profiles Are Handled in Windows 9x / Me?</title>
803 When a user logs on to a Windows 9x / Me machine, the local profile path,
804 <filename>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList</filename>, is checked
805 for an existing entry for that user:
809 If the user has an entry in this registry location, Windows 9x / Me checks for a locally cached
810 version of the user profile. Windows 9x / Me also checks the user's home directory (or other
811 specified directory if the location has been modified) on the server for the User Profile.
812 If a profile exists in both locations, the newer of the two is used. If the User Profile exists
813 on the server, but does not exist on the local machine, the profile on the server is downloaded
814 and used. If the User Profile only exists on the local machine, that copy is used.
818 If a User Profile is not found in either location, the Default User Profile from the Windows 9x / Me
819 machine is used and is copied to a newly created folder for the logged on user. At log off, any
820 changes that the user made are written to the user's local profile. If the user has a roaming
821 profile, the changes are written to the user's profile on the server.
828 <title>MS Windows NT4 Workstation</title>
831 On MS Windows NT4 the default user profile is obtained from the location
832 <filename>%SystemRoot%\Profiles</filename> which in a default installation will translate to
833 <filename>C:\WinNT\Profiles</filename>. Under this directory on a clean install there will be
834 three (3) directories: <filename>Administrator</filename>, <filename>All Users</filename>, <filename>Default User</filename>.
838 The <filename>All Users</filename> directory contains menu settings that are common across all
839 system users. The <filename>Default User</filename> directory contains menu entries that are
840 customisable per user depending on the profile settings chosen/created.
844 When a new user first logs onto an MS Windows NT4 machine a new profile is created from:
848 <member>All Users settings</member>
849 <member>Default User settings (contains the default NTUser.DAT file)</member>
853 When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain
854 the following steps are followed in respect of profile handling:
860 The users' account information which is obtained during the logon process contains
861 the location of the users' desktop profile. The profile path may be local to the
862 machine or it may be located on a network share. If there exists a profile at the location
863 of the path from the user account, then this profile is copied to the location
864 <filename>%SystemRoot%\Profiles\%USERNAME%</filename>. This profile then inherits the
865 settings in the <filename>All Users</filename> profile in the <filename>%SystemRoot%\Profiles</filename>
872 If the user account has a profile path, but at it's location a profile does not exist,
873 then a new profile is created in the <filename>%SystemRoot%\Profiles\%USERNAME%</filename>
874 directory from reading the <filename>Default User</filename> profile.
880 If the NETLOGON share on the authenticating server (logon server) contains a policy file
881 (<filename>NTConfig.POL</filename>) then it's contents are applied to the <filename>NTUser.DAT</filename>
882 which is applied to the <filename>HKEY_CURRENT_USER</filename> part of the registry.
888 When the user logs out, if the profile is set to be a roaming profile it will be written
889 out to the location of the profile. The <filename>NTuser.DAT</filename> file is then
890 re-created from the contents of the <filename>HKEY_CURRENT_USER</filename> contents.
891 Thus, should there not exist in the NETLOGON share an <filename>NTConfig.POL</filename> at the
892 next logon, the effect of the previous <filename>NTConfig.POL</filename> will still be held
893 in the profile. The effect of this is known as <emphasis>tatooing</emphasis>.
899 MS Windows NT4 profiles may be <emphasis>Local</emphasis> or <emphasis>Roaming</emphasis>. A Local profile
900 will stored in the <filename>%SystemRoot%\Profiles\%USERNAME%</filename> location. A roaming profile will
901 also remain stored in the same way, unless the following registry key is created:
906 HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\
907 "DeleteRoamingCache"=dword:00000001
910 In which case, the local copy (in <filename>%SystemRoot%\Profiles\%USERNAME%</filename>) will be
915 Under MS Windows NT4 default locations for common resources (like <filename>My Documents</filename>
916 may be redirected to a network share by modifying the following registry keys. These changes may be affected
917 via use of the System Policy Editor (to do so may require that you create your owns template extension
918 for the policy editor to allow this to be done through the GUI. Another way to do this is by way of first
919 creating a default user profile, then while logged in as that user, run regedt32 to edit the key settings.
923 The Registry Hive key that affects the behaviour of folders that are part of the default user profile
924 are controlled by entries on Windows NT4 is:
928 <filename>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\</filename>
932 The above hive key contains a list of automatically managed folders. The default entries are:
937 <title>User Shell Folder registry keys default values</title>
940 <row><entry>Name</entry><entry>Default Value</entry></row>
943 <row><entry>AppData</entry><entry>%USERPROFILE%\Application Data</entry></row>
944 <row><entry>Desktop</entry><entry>%USERPROFILE%\Desktop</entry></row>
945 <row><entry>Favorites</entry><entry>%USERPROFILE%\Favorites</entry></row>
946 <row><entry>NetHood</entry><entry>%USERPROFILE%\NetHood</entry></row>
947 <row><entry>PrintHood</entry><entry>%USERPROFILE%\PrintHood</entry></row>
948 <row><entry>Programs</entry><entry>%USERPROFILE%\Start Menu\Programs</entry></row>
949 <row><entry>Recent</entry><entry>%USERPROFILE%\Recent</entry></row>
950 <row><entry>SendTo</entry><entry>%USERPROFILE%\SendTo</entry></row>
951 <row><entry>Start Menu </entry><entry>%USERPROFILE%\Start Menu</entry></row>
952 <row><entry>Startup</entry><entry>%USERPROFILE%\Start Menu\Programs\Startup</entry></row>
959 The registry key that contains the location of the default profile settings is:
963 <filename>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</filename>
967 The default entries are:
970 <title>Defaults of profile settings registry keys</title>
973 <row><entry>Common Desktop</entry><entry>%SystemRoot%\Profiles\All Users\Desktop</entry></row>
974 <row><entry>Common Programs</entry><entry>%SystemRoot%\Profiles\All Users\Programs</entry></row>
975 <row><entry>Common Start Menu</entry><entry>%SystemRoot%\Profiles\All Users\Start Menu</entry></row>
976 <row><entry>Common Startup</entry><entry>%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup</entry></row>
985 <title>MS Windows 200x/XP</title>
989 MS Windows XP Home Edition does use default per user profiles, but can not participate
990 in domain security, can not log onto an NT/ADS style domain, and thus can obtain the profile
991 only from itself. While there are benefits in doing this the beauty of those MS Windows
992 clients that CAN participate in domain logon processes allows the administrator to create
993 a global default profile and to enforce it through the use of Group Policy Objects (GPOs).
998 When a new user first logs onto MS Windows 200x/XP machine the default profile is obtained from
999 <filename>C:\Documents and Settings\Default User</filename>. The administrator can modify (or change
1000 the contents of this location and MS Windows 200x/XP will gladly use it. This is far from the optimum
1001 arrangement since it will involve copying a new default profile to every MS Windows 200x/XP client
1006 When MS Windows 200x/XP participate in a domain security context, and if the default user
1007 profile is not found, then the client will search for a default profile in the NETLOGON share
1008 of the authenticating server. ie: In MS Windows parlance:
1009 <filename>%LOGONSERVER%\NETLOGON\Default User</filename> and if one exits there it will copy this
1010 to the workstation to the <filename>C:\Documents and Settings\</filename> under the Windows
1011 login name of the user.
1016 This path translates, in Samba parlance, to the &smb.conf; <parameter>[NETLOGON]</parameter> share. The directory
1017 should be created at the root of this share and must be called <filename>Default Profile</filename>.
1022 If a default profile does not exist in this location then MS Windows 200x/XP will use the local
1027 On logging out, the users' desktop profile will be stored to the location specified in the registry
1028 settings that pertain to the user. If no specific policies have been created, or passed to the client
1029 during the login process (as Samba does automatically), then the user's profile will be written to
1030 the local machine only under the path <filename>C:\Documents and Settings\%USERNAME%</filename>.
1034 Those wishing to modify the default behaviour can do so through three methods:
1040 Modify the registry keys on the local machine manually and place the new default profile in the
1041 NETLOGON share root - NOT recommended as it is maintenance intensive.
1047 Create an NT4 style NTConfig.POL file that specified this behaviour and locate this file
1048 in the root of the NETLOGON share along with the new default profile.
1054 Create a GPO that enforces this through Active Directory, and place the new default profile
1055 in the NETLOGON share.
1061 The Registry Hive key that affects the behaviour of folders that are part of the default user profile
1062 are controlled by entries on Windows 200x/XP is:
1066 <filename>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\</filename>
1070 The above hive key contains a list of automatically managed folders. The default entries are:
1075 <title>Defaults of default user profile paths registry keys</title>
1077 <thead><row><entry>Name</entry><entry>Default Value</entry></row></thead>
1079 <row><entry>AppData</entry><entry>%USERPROFILE%\Application Data</entry></row>
1080 <row><entry>Cache</entry><entry>%USERPROFILE%\Local Settings\Temporary Internet Files</entry></row>
1081 <row><entry>Cookies</entry><entry>%USERPROFILE%\Cookies</entry></row>
1082 <row><entry>Desktop</entry><entry>%USERPROFILE%\Desktop</entry></row>
1083 <row><entry>Favorites</entry><entry>%USERPROFILE%\Favorites</entry></row>
1084 <row><entry>History</entry><entry>%USERPROFILE%\Local Settings\History</entry></row>
1085 <row><entry>Local AppData</entry><entry>%USERPROFILE%\Local Settings\Application Data</entry></row>
1086 <row><entry>Local Settings</entry><entry>%USERPROFILE%\Local Settings</entry></row>
1087 <row><entry>My Pictures</entry><entry>%USERPROFILE%\My Documents\My Pictures</entry></row>
1088 <row><entry>NetHood</entry><entry>%USERPROFILE%\NetHood</entry></row>
1089 <row><entry>Personal</entry><entry>%USERPROFILE%\My Documents</entry></row>
1090 <row><entry>PrintHood</entry><entry>%USERPROFILE%\PrintHood</entry></row>
1091 <row><entry>Programs</entry><entry>%USERPROFILE%\Start Menu\Programs</entry></row>
1092 <row><entry>Recent</entry><entry>%USERPROFILE%\Recent</entry></row>
1093 <row><entry>SendTo</entry><entry>%USERPROFILE%\SendTo</entry></row>
1094 <row><entry>Start Menu</entry><entry>%USERPROFILE%\Start Menu</entry></row>
1095 <row><entry>Startup</entry><entry>%USERPROFILE%\Start Menu\Programs\Startup</entry></row>
1096 <row><entry>Templates</entry><entry>%USERPROFILE%\Templates</entry></row>
1097 </tbody></tgroup></table>
1101 There is also an entry called "Default" that has no value set. The default entry is of type <constant>REG_SZ</constant>, all
1102 the others are of type <constant>REG_EXPAND_SZ</constant>.
1106 It makes a huge difference to the speed of handling roaming user profiles if all the folders are
1107 stored on a dedicated location on a network server. This means that it will NOT be necessary to
1108 write the Outlook PST file over the network for every login and logout.
1112 To set this to a network location you could use the following examples:
1115 <para><filename>%LOGONSERVER%\%USERNAME%\Default Folders</filename></para>
1118 This would store the folders in the user's home directory under a directory called <filename>Default Folders</filename>
1122 <para><filename>\\<replaceable>SambaServer</replaceable>\<replaceable>FolderShare</replaceable>\%USERNAME%</filename></para>
1125 in which case the default folders will be stored in the server named <replaceable>SambaServer</replaceable>
1126 in the share called <replaceable>FolderShare</replaceable> under a directory that has the name of the MS Windows
1127 user as seen by the Linux/Unix file system.
1131 Please note that once you have created a default profile share, you MUST migrate a user's profile
1132 (default or custom) to it.
1136 MS Windows 200x/XP profiles may be <emphasis>Local</emphasis> or <emphasis>Roaming</emphasis>.
1137 A roaming profile will be cached locally unless the following registry key is created:
1140 <para><filename>HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\"DeleteRoamingCache"=dword:00000001</filename></para>
1143 In which case, the local cache copy will be deleted on logout.
1149 <title>Common Errors</title>
1152 The following are some typical errors/problems/questions that have been asked.
1156 <title>How does one set up roaming profiles for just one (or a few) user/s or group/s?</title>
1159 With samba-2.2.x the choice you have is to enable or disable roaming
1160 profiles support. It is a global only setting. The default is to have
1161 roaming profiles and the default path will locate them in the user's home
1166 If disabled globally then no-one will have roaming profile ability.
1167 If enabled and you want it to apply only to certain machines, then on
1168 those machines on which roaming profile support is NOT wanted it is then
1169 necessary to disable roaming profile handling in the registry of each such
1174 With samba-3.0.0 (soon to be released) you can have a global profile
1175 setting in smb.conf _AND_ you can over-ride this by per-user settings
1176 using the Domain User Manager (as with MS Windows NT4/ Win 2Kx).
1180 In any case, you can configure only one profile per user. That profile can
1185 <member>A profile unique to that user</member>
1186 <member>A mandatory profile (one the user can not change)</member>
1187 <member>A group profile (really should be mandatory ie:unchangable)</member>
1193 <title>Can NOT use Roaming Profiles</title>
1197 I dont want Roaming profile to be implemented, I just want to give users
1198 local profiles only.
1200 Please help me I am totally lost with this error from past two days I tried
1201 everything and googled around quite a bit but of no help. Please help me.
1206 <!-- FIXME: Write to whole sentences -->
1210 <term>Local profiles</term>
1212 I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out
1217 <term>Roaming profiles</term>
1220 <member>can use auto-delete on logout option</member>
1221 <member>requires a registry key change on workstation</member>
1228 <term>Personal Roaming profiles</term>
1230 - should be preserved on a central server
1231 - workstations 'cache' (store) a local copy
1232 - used in case the profile can not be downloaded
1238 <term>Group profiles</term>
1239 <listitem><para>- loaded from a central place</para></listitem>
1243 <term>Mandatory profiles</term>
1245 - can be personal or group
1246 - can NOT be changed (except by an administrator
1257 A WinNT4/2K/XP profile can vary in size from 130KB to off the scale.
1258 Outlook PST files are most often part of the profile and can be many GB in
1259 size. On average (in a well controlled environment) roaming profile size of
1260 2MB is a good rule of thumb to use for planning purposes. In an
1261 undisciplined environment I have seen up to 2GB profiles. Users tend to
1262 complain when it take an hour to log onto a workstation but they harvest
1263 the fruits of folly (and ignorance).
1267 The point of all the above is to show that roaming profiles and good
1268 controls of how they can be changed as well as good discipline make up for
1269 a problem free site.
1273 Microsoft's answer to the PST problem is to store all email in an MS
1274 Exchange Server back-end. But this is another story ...!
1278 So, having LOCAL profiles means:
1281 <member>If lots of users user each machine - lot's of local disk storage needed for local profiles</member>
1282 <member>Every workstation the user logs into has it's own profile - can be very different from machine to machine</member>
1285 On the other hand, having roaming profiles means:
1287 <member>The network administrator can control EVERY aspect of user profiles</member>
1288 <member>With the use of mandatory profiles - a drastic reduction in network management overheads</member>
1289 <member>User unhappiness about not being able to change their profiles soon fades as they get used to being able to work reliably</member>
1295 I have managed and installed MANY NT/2K networks and have NEVER found one
1296 where users who move from machine to machine are happy with local
1297 profiles. In the long run local profiles bite them.
1302 <!-- FIXME: Everything below this is a mess. I didn't quite understand it - Jelmer -->
1305 <title>Changing the default profile</title>
1308 When the client tries to logon to the PDC it looks for a profile to download
1309 where do I put this default profile.
1313 Firstly, your samba server need to be configured as a domain controller.
1318 os level = 32 (or more)
1323 Plus you need to have a <parameter>[netlogon]</parameter> share that is world readable.
1324 It is a good idea to add a logon script to pre-set printer and
1325 drive connections. There is also a facility for automatically
1326 synchronizing the workstation time clock with that of the logon
1327 server (another good thing to do).
1331 To invoke auto-deletion of roaming profile from the local
1332 workstation cache (disk storage) you need to use the <application>Group Policy Editor</application>
1333 to create a file called <filename>NTConfig.POL</filename> with the appropriate entries. This
1334 file needs to be located in the <parameter>netlogon</parameter> share root directory.</para></note>
1337 Oh, of course the windows clients need to be members of the domain.
1338 Workgroup machines do NOT do network logons - so they never see domain
1343 Secondly, for roaming profiles you need:
1345 logon path = \\%N\profiles\%U (with some such path)
1346 logon drive = H: (Z: is the default)
1348 Plus you need a PROFILES share that is world writable.