1 <chapter id="samba-pdc">
7 <firstname>David</firstname><surname>Bannon</surname>
9 <orgname>Samba Team</orgname>
10 <address><email>dbannon@samba.org</email></address>
15 <title>Domain Control</title>
17 <formalpara><title><emphasis>The Essence of Learning:</emphasis></title>
19 There are many who approach MS Windows networking with incredible misconceptions.
20 That's OK, because it give the rest of us plenty of opportunity to be of assistance.
21 Those who really want help would be well advised to become familiar with information
22 that is already available.
27 The reader is advised NOT to tackle this section without having first understood
28 and mastered some basics. MS Windows networking is not particularly forgiving of
29 misconfiguration. Users of MS Windows networking are likely to complain bitterly
30 of persistent niggles that may be caused by broken network or system configuration.
31 To a great many people however, MS Windows networking starts with a domain controller
32 that in some magical way is expected to solve all ills.
36 From the Samba mailing list one can readilly identify many common networking issues.
37 If you are not clear on the following subjects, then it will do much good to read the
38 sections of this HOWTO that deal with it. These are the most common causes of MS Windows
43 <listitem><para>Basic TCP/IP configuration</para></listitem>
44 <listitem><para>NetBIOS name resolution</para></listitem>
45 <listitem><para>Authentication configuration</para></listitem>
46 <listitem><para>User and Group configuration</para></listitem>
47 <listitem><para>Basic File and Directory Permission Control in Unix/Linux</para></listitem>
48 <listitem><para>Understanding of how MS Windows clients interoperate in a network
49 environment</para></listitem>
53 Do not be put off, on the surface of it MS Windows networking seems so simple that any fool
54 can do it. In fact, it is not a good idea to set up an MS Windows network with
55 inadequate training and preparation. But let's get our first indelible principle out of the
56 way: <emphasis>It is perfectly OK to make mistakes!</emphasis> In the right place and at
57 the right time, mistakes are the essence of learning. It is <emphasis>very much</emphasis>
58 not Ok to make mistakes that cause loss of productivity and impose an avoidable financial
59 burden on an organisation.
63 Where is the right place to make mistakes? Only out of harms' way! If you are going to
64 make mistakes, then please do this on a test network, away from users and in such a way as
65 to not inflict pain on others. Do your learning on a test network.
69 <title>Features and Benefits</title>
72 The following functionalities are new to the Samba-3 release:
77 Windows NT4 domain trusts
81 Adding users via the User Manager for Domains or via the Windows 200x Microsoft
86 Introduces replaceable and multiple user account (authentication)
87 back ends. In the case where the back end is placed in an LDAP database
88 Samba-3 confers the benefits of a back end that can be distributed, replicated,
93 Implements full Unicode support. This simplifies cross locale internationalisation
94 support. It also opens up the use of protocols that samba-2.2.x had but could not use due
95 to the need to fully support Unicode.
100 The following functionalities are NOT provided by Samba-3:
105 SAM replication with Windows NT4 Domain Controllers
106 (i.e. a Samba PDC and a Windows NT BDC or vice versa)
110 Acting as a Windows 2000 Domain Controller (i.e. Kerberos and
111 Active Directory) - In point of fact, Samba-3 DOES have some
112 Active Directory Domain Control ability that is at this time
113 purely experimental <emphasis>AND</emphasis> that is certain
114 to change as it becomes a fully supported feature some time
115 during the samba-3 (or later) life cycle.
120 Windows 9x / Me / XP Home clients are not true members of a domain for reasons outlined
121 in this chapter. The protocol for support of Windows 9x / Me style network (domain) logons
122 is completely different from NT4 / Win2k type domain logons and has been officially supported
123 for some time. These clients use the old LanMan Network Logon facilities that are supported
124 in Samba since approximately the samba-1.9.15 series.
128 Samba-3 has an implementation of group mapping between Windows NT groups
129 and Unix groups (this is really quite complicated to explain in a short space) this is
130 discussed more fully in a chapter dedicated to this topic..
134 A Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store
135 user and machine trust account information in a suitable backend data store. With Samba-3
136 there can be multiple back-ends for this including:
141 <emphasis>smbpasswd</emphasis> - the plain ascii file stored used by
142 earlier versions of Samba. This file configuration option requires
143 a Unix/Linux system account for EVERY entry (ie: both for user and for
144 machine accounts). This file will be located in the <emphasis>private</emphasis>
145 directory (default is /usr/local/samba/lib/private or on linux /etc/samba).
149 <emphasis>tdbsam</emphasis> - a binary database backend that will be
150 stored in the <emphasis>private</emphasis> directory in a file called
151 <emphasis>passwd.tdb</emphasis>. The key benefit of this binary format
152 file is that it can store binary objects that can not be accomodated
153 in the traditional plain text smbpasswd file. These permit the extended
154 account controls that MS Windows NT4 and later also have.
158 <emphasis>ldapsam</emphasis> - An LDAP based back-end. Permits the
159 LDAP server to be specified. eg: ldap://localhost or ldap://frodo.murphy.com.
160 Like the tdbsam, ldapsam permits the storing of extended account attributes
161 for control of things like: Permitted access times, password activation and
162 expiry, permitted points of access (workstation names), per user profile
163 location, and much more.
167 <emphasis>ldapsam_compat</emphasis> - An LDAP back-end that maintains backwards
168 compatibility with the behaviour of samba-2.2.x. You should use this in the process
169 of mirgrating from samba-2.2.x to samba-3 if you do not want to rebuild your LDAP
175 Read the chapter about the <link linkend="passdb">User Database</link> for details
176 regarding the choices available and how to configure them.
180 The new tdbsam and ldapsam account backends store substantially more information than
181 smbpasswd is capable of. The new backend database includes capacity to specify
182 per user settings for many parameters, over-riding global settings given in the
183 <filename>smb.conf</filename> file. eg: logon drive, logon home, logon path, etc.
184 Thus, with samba-3 it is possible to have a default system configuration for profiles,
185 and on a per user basis to over-ride this for those users who should not be subject
186 to the default configuration.
192 <title>Basics of Domain Control</title>
195 Over the years public perceptions of what Domain Control really is has taken on an
196 almost mystical nature. Before we branch into a brief overview of Domain Control
197 there are three basic types of domain controllers:
201 <title>Domain Controller Types</title>
204 <listitem><para>Primary Domain Controller</para></listitem>
205 <listitem><para>Backup Domain Controller</para></listitem>
206 <listitem><para>ADS Domain Controller</para></listitem>
210 The <emphasis>Primary Domain Controller</emphasis> or PDC plays an important role in the MS
211 Windows NT4 and Windows 200x Domain Control architecture, but not in the manner that so many
212 expect. There is folk lore that dictates that because of it's role in the MS Windows
213 network that the PDC should be the most powerful and most capable machine in the network.
214 As strange as it may seem to say this here, good over all network performance dictates that
215 the entire infrastructure needs to be balanced. It is advisable to invest more in the Backup
216 Domain Controllers and Stand-Alone (or Domain Member) servers than in the PDC.
220 In the case of MS Windows NT4 style domaines it is the PDC seeds the Domain Control database,
221 a part of the Windows registry called the SAM (Security Accounts Management). It plays a key
222 part in NT4 type domain user authentication and in synchronisation of the domain authentication
223 database with Backup Domain Controllers.
227 With MS Windows 200x Server based Active Directory domains, one domain controller seeds a potential
228 hierachy of domain controllers, each with their own area of delegated control. The master domain
229 controller has the ability to override any down-stream controller, but a down-line controller has
230 control only over it's down-line. With Samba-3 this functionality can be implemented using an
231 LDAP based user and machine account back end.
235 New to Samba-3 is the ability to use a back-end database that holds the same type of data as
236 the NT4 style SAM (Security Account Manager) database (one of the registry files).
237 The samba-3 SAM can be specified via the smb.conf file parameter
238 <emphasis>passwd backend</emphasis> and valid options include
239 <emphasis>smbpasswd, tdbsam, ldapsam, nisplussam, xmlsam, mysqlsam, plugin, guest</emphasis>.
243 The <emphasis>Backup Domain Controller</emphasis> or BDC plays a key role in servicing network
244 authentication requests. The BDC is biased to answer logon requests in preference to the PDC.
245 On a network segment that has a BDC and a PDC the BDC will be most likely to service network
246 logon requests. The PDC will answer network logon requests when the BDC is too busy (high load).
247 A BDC can be promoted to a PDC. If the PDC is on line at the time that the BDC is promoted to
248 PDC the previous PDC is automatically demoted to a BDC. With Samba-3 this is NOT an automatic
249 operation, the PDB and BDC must be manually configured and changes need to be made likewise.
253 With MS Windows NT4 it is an install time decision what type of machine the server will be.
254 It is possible to change the promote a BDC to a PDC and vica versa only, but the only way
255 to convert a domain controller to a domain member server or a stand-alone server is to
256 reinstall it. The install time choices offered are:
260 <listitem><para>Primary Domain Controller - The one that seeds the domain SAM</para></listitem>
261 <listitem><para>Backup Domain Controller - One that obtains a copy of the domain SAM</para></listitem>
262 <listitem><para>Domain Controller - One that has NO copy of the domain SAM, rather it obtains authentication from a Domain Controller for all access controls.</para></listitem>
263 <listitem><para>Stand-Alone Server - One that plays NO part is SAM synchronisation, has it's own authentication database and plays no role in Domain security.</para></listitem>
267 With MS Windows 2000 the configuration of domain control is done after the server has been
268 installed. Samba-3 is capable of acting fully as a native member of a Windows 200x server
269 Active Directory domain.
273 New to Samba-3 is the ability to function fully as an MS Windows NT4 style Domain Controller,
274 excluding the SAM replication components. However, please be aware that Samba-3 support the
275 MS Windows 200x domain control protcols also.
279 At this time Samba-3 is capable of acting as an <emphasis>ADS Domain Controller</emphasis> but
280 in only a limited and experimental manner. This functionality should not be depended upon
281 until the samba-team offers formal support for it. At such a time, the documentation will
282 be revised to duely reflect all configuration and management requirements.
288 <title>Preparing for Domain Control</title>
291 The following are necessary for configuring Samba-3 as an MS Windows NT4 style PDC for MS Windows
292 NT4 / 200x / XP clients.
295 <orderedlist numeration="arabic">
297 Configuration of basic TCP/IP and MS Windows Networking
301 Correct designation of the Server Role (<emphasis>security = user</emphasis>)
305 Consistent configuration of Name Resolution (See chapter on Browsing and on
306 MS Windows network Integration)
310 Domain logons for Windows NT4 / 200x / XP Professional clients
314 Configuration of Roaming Profiles or explicit configuration to force local profile usage
318 Configuration of Network/System Policies
322 Adding and managing domain user accounts
326 Configuring MS Windows client machines to become domain members
331 The following provisions are required to serve MS Windows 9x / Me Clients:
336 Configuration of basic TCP/IP and MS Windows Networking
340 Correct designation of the Server Role (<emphasis>security = user</emphasis>)
344 Network Logon Configuration (Since Windows 9x / XP Home are not technically domain
345 members, they do not really particpate in the security aspects of Domain logons as such)
349 Roaming Profile Configuration
353 Configuration of System Policy handling
357 Installation of the Network driver "Client for MS Windows Networks" and configuration
358 to log onto the domain
362 Placing Windows 9x / Me clients in user level security - if it is desired to allow
363 all client share access to be controlled according to domain user / group identities.
367 Adding and managing domain user accounts
372 Roaming Profiles and System/Network policies are advanced network administration topics
373 that are covered separately in this document. However, these are not necessarily specific
374 to a Samba PDC as much as they are related to Windows NT networking concepts.
378 A Domain Controller is an SMB/CIFS server that:
383 Advertises and registers itself as a Domain Controller (Through NetBIOS broadcasts
384 as well as by way of name registrations either by Mailslot Broadcasts over UDP broadcast,
385 to a WINS server over UDP unicast, or via DNS and Active Directory)
389 Provides the NETLOGON service (actually a collection of services that runs over
390 a number of protocols. These include the LanMan Logon service, the Netlogon service,
391 the Local Security Account service, and variations of them)
395 Provides a share called NETLOGON
400 For samba to provide these is rather easy to configure. Each Samba Domain Controller must provide
401 the NETLOGON service which samba calls the <emphasis>domain logons</emphasis> functionality
402 (after the name of the parameter in the &smb.conf; file). Additionally, one (1) server in a Samba-3
403 Domain must advertise itself as the domain master browser. This causes the Primary Domain Controller
404 to claim domain specific NetBIOS name that identifies it as a domain master browser for its given
405 domain/workgroup. Local master browsers in the same domain/workgroup on broadcast-isolated subnets
406 then ask for a complete copy of the browse list for the whole wide area network. Browser clients
407 will then contact their local master browser, and will receive the domain-wide browse list,
408 instead of just the list for their broadcast-isolated subnet.
415 <title>Domain Control - Example Configuration</title>
418 The first step in creating a working Samba PDC is to understand the parameters necessary
419 in &smb.conf;. Here we attempt to explain the parameters that are covered in
420 the &smb.conf; man page.
424 Here is an example &smb.conf; for acting as a PDC:
427 <para><programlisting>
429 ; Basic server settings
430 <ulink url="smb.conf.5.html#NETBIOSNAME">netbios name</ulink> = <replaceable>POGO</replaceable>
431 <ulink url="smb.conf.5.html#WORKGROUP">workgroup</ulink> = <replaceable>NARNIA</replaceable>
433 ; User and Machine Account Backends
434 ; Choices are: tdbsam, smbpasswd, ldapsam, mysqlsam, xmlsam, guest
435 <ulink url="smb.conf.5.html#PASSDBBACKEND">passdb backend</ulink> = ldapsam, guest
437 ; we should act as the domain and local master browser
438 <ulink url="smb.conf.5.html#OSLEVEL">os level</ulink> = 64
439 <ulink url="smb.conf.5.html#PERFERREDMASTER">preferred master</ulink> = yes
440 <ulink url="smb.conf.5.html#DOMAINMASTER">domain master</ulink> = yes
441 <ulink url="smb.conf.5.html#LOCALMASTER">local master</ulink> = yes
443 ; security settings (must user security = user)
444 <ulink url="smb.conf.5.html#SECURITYEQUALSUSER">security</ulink> = user
446 ; encrypted passwords are a requirement for a PDC
447 <ulink url="smb.conf.5.html#ENCRYPTPASSWORDS">encrypt passwords</ulink> = yes
449 ; support domain logons
450 <ulink url="smb.conf.5.html#DOMAINLOGONS">domain logons</ulink> = yes
452 ; where to store user profiles?
453 <ulink url="smb.conf.5.html#LOGONPATH">logon path</ulink> = \\%N\profiles\%u
455 ; where is a user's home directory and where should it be mounted at?
456 <ulink url="smb.conf.5.html#LOGONDRIVE">logon drive</ulink> = H:
457 <ulink url="smb.conf.5.html#LOGONHOME">logon home</ulink> = \\homeserver\%u\winprofile
459 ; specify a generic logon script for all users
460 ; this is a relative **DOS** path to the [netlogon] share
461 <ulink url="smb.conf.5.html#LOGONSCRIPT">logon script</ulink> = logon.cmd
463 ; necessary share for domain controller
465 <ulink url="smb.conf.5.html#PATH">path</ulink> = /usr/local/samba/lib/netlogon
466 <ulink url="smb.conf.5.html#READONLY">read only</ulink> = yes
467 <ulink url="smb.conf.5.html#WRITELIST">write list</ulink> = <replaceable>ntadmin</replaceable>
469 ; share for storing user profiles
471 <ulink url="smb.conf.5.html#PATH">path</ulink> = /export/smb/ntprofile
472 <ulink url="smb.conf.5.html#READONLY">read only</ulink> = no
473 <ulink url="smb.conf.5.html#CREATEMASK">create mask</ulink> = 0600
474 <ulink url="smb.conf.5.html#DIRECTORYMASK">directory mask</ulink> = 0700
475 </programlisting></para>
478 The above parameters make for a full set of parameters that may define the server's mode
479 of operation. The following parameters are the essentials alone:
488 The additional parameters shown in the longer listing above just makes for a
489 more complete environment.
493 There are a couple of points to emphasize in the above configuration.
498 Encrypted passwords must be enabled. For more details on how
499 to do this, refer to <link linkend="passdb">the User Database chapter</link>.
503 The server must support domain logons and have a
504 <filename>[netlogon]</filename> share
508 The server must be the domain master browser in order for Windows
509 client to locate the server as a DC. Please refer to the various
510 Network Browsing documentation included with this distribution for
518 <title>Samba ADS Domain Control</title>
521 Samba-3 can behave and appear to MS Windows 200x and XP clients as an Active Directory Server.
522 To do this, Configure samba as a Primary Domain Controller, use LDAP as the passdb backend,
523 and configure Kerberos5. The problem with doing this is that samba-3 is NOT, despite this
524 configuration, and Active Directory server and does NOT yet fully support all protocols needed
525 to make this a possibility.
529 The best advice we can give at this time is - DO NOT DO THIS yet as it is NOT ready for
530 production deployment.
536 <title>Domain and Network Logon Configuration</title>
539 The subject of Network or Domain Logons is discussed here because it rightly forms
540 an integral part of the essential functionality that is provided by a Domain Controller.
544 <title>Domain Network Logon Service</title>
547 All Domain Controllers must run the netlogon service (<emphasis>domain logons</emphasis>
548 in Samba. One Domain Controller must be configured with <emphasis>domain master = Yes</emphasis>
549 (the Primary Domain Controller), on ALL Backup Domain Controllers <emphasis>domain master = No</emphasis>
553 <title>Example Configuration</title>
556 <title> A minimal configuration to support Domain Logons</title>
560 domain master = (Yes on PDC, No on BDCs)
563 comment = Network Logon Service
564 path = /var/lib/samba/netlogon
571 <title>The Special Case of Windows 9x / Me / XP Home</title>
574 A domain and a workgroup are exactly the same thing in terms of network
575 browsing. The difference is that a distributable authentication
576 database is associated with a domain, for secure login access to a
577 network. Also, different access rights can be granted to users if they
578 successfully authenticate against a domain logon server. Samba-3 does this
579 now in the same way that MS Windows NT/2K.
583 The SMB client logging on to a domain has an expectation that every other
584 server in the domain should accept the same authentication information.
585 Network browsing functionality of domains and workgroups is identical and
586 is explained in this documentation under the browsing discussions.
587 It should be noted, that browsing is totally orthogonal to logon support.
591 Issues related to the single-logon network model are discussed in this
592 section. Samba supports domain logons, network logon scripts, and user
593 profiles for MS Windows for workgroups and MS Windows 9X/ME clients
594 which are the focus of this section.
598 When an SMB client in a domain wishes to logon it broadcast requests for a
599 logon server. The first one to reply gets the job, and validates its
600 password using whatever mechanism the Samba administrator has installed.
601 It is possible (but very stupid) to create a domain where the user
602 database is not shared between servers, i.e. they are effectively workgroup
603 servers advertising themselves as participating in a domain. This
604 demonstrates how authentication is quite different from but closely
605 involved with domains.
609 Using these features you can make your clients verify their logon via
610 the Samba server; make clients run a batch file when they logon to
611 the network and download their preferences, desktop and start menu.
615 MS Windows XP Home edition is NOT able to join a domain and does not permit
616 the use of domain logons.
620 Before launching into the configuration instructions, it is
621 worthwhile to look at how a Windows 9x/ME client performs a logon:
627 The client broadcasts (to the IP broadcast address of the subnet it is in)
628 a NetLogon request. This is sent to the NetBIOS name DOMAIN<1c> at the
629 NetBIOS layer. The client chooses the first response it receives, which
630 contains the NetBIOS name of the logon server to use in the format of
637 The client then connects to that server, logs on (does an SMBsessetupX) and
638 then connects to the IPC$ share (using an SMBtconX).
644 The client then does a NetWkstaUserLogon request, which retrieves the name
645 of the user's logon script.
651 The client then connects to the NetLogon share and searches for this
652 and if it is found and can be read, is retrieved and executed by the client.
653 After this, the client disconnects from the NetLogon share.
659 The client then sends a NetUserGetInfo request to the server, to retrieve
660 the user's home share, which is used to search for profiles. Since the
661 response to the NetUserGetInfo request does not contain much more then
662 the user's home share, profiles for Win9X clients MUST reside in the user
669 The client then connects to the user's home share and searches for the
670 user's profile. As it turns out, you can specify the user's home share as
671 a sharename and path. For example, \\server\fred\.winprofile.
672 If the profiles are found, they are implemented.
678 The client then disconnects from the user's home share, and reconnects to
679 the NetLogon share and looks for CONFIG.POL, the policies file. If this is
680 found, it is read and implemented.
686 The main difference between a PDC and a Windows 9x logon server configuration is that
691 Password encryption is not required for a Windows 9x logon server.
695 Windows 9x/ME clients do not possess machine trust accounts.
700 A Samba PDC will also act as a Windows 9x logon server.
707 <title>Security Mode and Master Browsers</title>
710 There are a few comments to make in order to tie up some
711 loose ends. There has been much debate over the issue of whether
712 or not it is ok to configure Samba as a Domain Controller in security
713 modes other than <constant>USER</constant>. The only security mode
714 which will not work due to technical reasons is <constant>SHARE</constant>
715 mode security. <constant>DOMAIN</constant> and <constant>SERVER</constant>
716 mode security is really just a variation on SMB user level security.
720 Actually, this issue is also closely tied to the debate on whether
721 or not Samba must be the domain master browser for its workgroup
722 when operating as a DC. While it may technically be possible
723 to configure a server as such (after all, browsing and domain logons
724 are two distinctly different functions), it is not a good idea to do
725 so. You should remember that the DC must register the DOMAIN#1b NetBIOS
726 name. This is the name used by Windows clients to locate the DC.
727 Windows clients do not distinguish between the DC and the DMB.
728 For this reason, it is very wise to configure the Samba DC as the DMB.
732 Now back to the issue of configuring a Samba DC to use a mode other
733 than "security = user". If a Samba host is configured to use
734 another SMB server or DC in order to validate user connection
735 requests, then it is a fact that some other machine on the network
736 (the "password server") knows more about the user than the Samba host.
737 99% of the time, this other host is a domain controller. Now
738 in order to operate in domain mode security, the "workgroup" parameter
739 must be set to the name of the Windows NT domain (which already
740 has a domain controller, right?)
744 Therefore configuring a Samba box as a DC for a domain that
745 already by definition has a PDC is asking for trouble.
746 Therefore, you should always configure the Samba DC to be the DMB
747 for its domain and set <emphasis>security = user</emphasis>. This is the only
748 officially supported mode of operation.
756 <title>Common Problems and Errors</title>
759 <title>I cannot include a '$' in a machine name</title>
761 A 'machine name' in (typically) <filename>/etc/passwd</filename>
762 of the machine name with a '$' appended. FreeBSD (and other BSD
763 systems?) won't create a user with a '$' in their name.
767 The problem is only in the program used to make the entry. Once made, it works perfectly.
768 Create a user without the '$' using <command>vipw</command> to edit the entry, adding
769 the '$'. Or create the whole entry with vipw if you like, make sure you use a unique User ID!
774 <title>I get told "You already have a connection to the Domain...."
775 or "Cannot join domain, the credentials supplied conflict with an
776 existing set.." when creating a machine trust account.</title>
779 This happens if you try to create a machine trust account from the
780 machine itself and already have a connection (e.g. mapped drive)
781 to a share (or IPC$) on the Samba PDC. The following command
782 will remove all network drive connections:
786 <prompt>C:\WINNT\></prompt> <command>net use * /d</command>
790 Further, if the machine is already a 'member of a workgroup' that
791 is the same name as the domain you are joining (bad idea) you will
792 get this message. Change the workgroup name to something else, it
793 does not matter what, reboot, and try again.
798 <title>The system can not log you on (C000019B)....</title>
800 <para>I joined the domain successfully but after upgrading
801 to a newer version of the Samba code I get the message, "The system
802 can not log you on (C000019B), Please try again or consult your
803 system administrator" when attempting to logon.
807 This occurs when the domain SID stored in the secrets.tdb database
808 is changed. The most common cause of a change in domain SID is when
809 the domain name and/or the server name (netbios name) is changed.
810 The only way to correct the problem is to restore the original domain
811 SID or remove the domain client from the domain and rejoin. The domain
812 SID may be reset using either the net or rpcclient utilities.
816 The reset or change the domain SID you can use the net command as follows:
819 net getlocalsid 'OLDNAME'
820 net setlocalsid 'SID'
827 <title>The machine trust account for this computer either does not
828 exist or is not accessible.</title>
831 When I try to join the domain I get the message "The machine account
832 for this computer either does not exist or is not accessible". What's
837 This problem is caused by the PDC not having a suitable machine trust account.
838 If you are using the <parameter>add machine script</parameter> method to create
839 accounts then this would indicate that it has not worked. Ensure the domain
840 admin user system is working.
844 Alternatively if you are creating account entries manually then they
845 have not been created correctly. Make sure that you have the entry
846 correct for the machine trust account in smbpasswd file on the Samba PDC.
847 If you added the account using an editor rather than using the smbpasswd
848 utility, make sure that the account name is the machine NetBIOS name
849 with a '$' appended to it ( i.e. computer_name$ ). There must be an entry
850 in both /etc/passwd and the smbpasswd file. Some people have reported
851 that inconsistent subnet masks between the Samba server and the NT
852 client have caused this problem. Make sure that these are consistent
853 for both client and server.
858 <title>When I attempt to login to a Samba Domain from a NT4/W2K workstation,
859 I get a message about my account being disabled.</title>
862 At first be ensure to enable the useraccounts with <command>smbpasswd -e
863 %user%</command>, this is normally done, when you create an account.