samba-pdc-faq.html [plain text]
<HTML
><HEAD
><TITLE
>The Samba 2.2 PDC FAQ</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
><BODY
CLASS="BOOK"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="BOOK"
><A
NAME="SAMBA-PDC-FAQ"
></A
><DIV
CLASS="TITLEPAGE"
><H1
CLASS="TITLE"
><A
NAME="SAMBA-PDC-FAQ"
>The Samba 2.2 PDC FAQ</A
></H1
><H3
CLASS="AUTHOR"
><A
NAME="AEN4"
>David Bannon</A
></H3
><DIV
CLASS="AFFILIATION"
><SPAN
CLASS="ORGNAME"
>La Trobe University<BR></SPAN
></DIV
><HR></DIV
><HR><H1
><A
NAME="AEN12"
></A
></H1
><P
> This is the FAQ for Samba 2.2 as an NTDomain controller.
This document is derived from the original FAQ that was built and
maintained by Gerald Carter from the early days of Samba NTDomain development
up until recently. It is now being updated as significant changes are
made to 2.2.0.
</P
><P
> Please note it does not apply to the SAMBA_TNG nor the HEAD branch.
</P
><P
> Also available is a Samba 2.2 PDC <A
HREF="samba-pdc-howto.html"
TARGET="_top"
>HOWTO</A
>
that takes you, step by step, over the process of setting up a very basic Samba
2.2 Primary Domain Controller
</P
><DIV
CLASS="TOC"
><DL
><DT
><B
>Table of Contents</B
></DT
><DT
>1. <A
HREF="#AEN19"
>Introduction</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN21"
>State of Play</A
></DT
><DT
><A
HREF="#AEN27"
>Introduction</A
></DT
></DL
></DD
><DT
>2. <A
HREF="#AEN33"
>General Information</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN35"
>What can we do ?</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN37"
>What can Samba 2.2.x Primary Domain Controller (PDC) do ?</A
></DT
><DT
><A
HREF="#AEN62"
>Can I have a Windows 2000 client logon to a Samba
controlled domain?</A
></DT
></DL
></DD
><DT
><A
HREF="#AEN65"
>CVS</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN68"
>What are the different Samba branches available in CVS ?</A
></DT
><DT
><A
HREF="#AEN91"
>What are the CVS commands ?</A
></DT
></DL
></DD
></DL
></DD
><DT
>3. <A
HREF="#AEN95"
>Establishing Connections</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN97"
></A
></DT
><DD
><DL
><DT
><A
HREF="#AEN99"
>How do I get my NT4 or W2000 Workstation to login to the Samba
controlled Domain?</A
></DT
><DT
><A
HREF="#AEN103"
>What is a 'machine account' ?</A
></DT
><DT
><A
HREF="#AEN110"
>"The machine account for this computer either does not
exist or is not accessible."</A
></DT
><DT
><A
HREF="#AEN116"
>How do I create machine accounts manually ?</A
></DT
><DT
><A
HREF="#AEN129"
>I cannot include a '$' in a machine name.</A
></DT
><DT
><A
HREF="#AEN135"
>I get told "You already have a connection to the Domain...."
when creating a machine account.</A
></DT
><DT
><A
HREF="#AEN139"
>I get told "Cannot join domain, the credentials supplied
conflict with an existing set.."</A
></DT
><DT
><A
HREF="#AEN143"
>"The system can not log you on (C000019B)...."</A
></DT
></DL
></DD
></DL
></DD
><DT
>4. <A
HREF="#AEN147"
>User Account Management</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN149"
>Domain Admins</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN151"
>How do I configure an account as a domain administrator?</A
></DT
></DL
></DD
><DT
><A
HREF="#AEN155"
>Profiles</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN157"
>Why is it bad to set "logon path = \\%N\%U\profile" in
smb.conf?</A
></DT
><DT
><A
HREF="#AEN169"
>Why are all the users listed in the "domain admin users" using the
same profile?</A
></DT
><DT
><A
HREF="#AEN172"
>The roaming profiles do not seem to be updating on the
server.</A
></DT
></DL
></DD
><DT
><A
HREF="#AEN180"
>Policies</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN182"
>What are 'Policies' ?</A
></DT
><DT
><A
HREF="#AEN188"
>I can't get system policies to work.</A
></DT
><DT
><A
HREF="#AEN203"
>What about Windows NT Policy Editor ?</A
></DT
><DT
><A
HREF="#AEN217"
>Can Win95 do Policies ?</A
></DT
></DL
></DD
><DT
><A
HREF="#AEN223"
>Passwords</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN225"
>What is password sync and should I use it ?</A
></DT
><DT
><A
HREF="#AEN239"
>How do I get remote password (unix and SMB) changing working ?</A
></DT
></DL
></DD
></DL
></DD
><DT
>5. <A
HREF="#AEN246"
>Miscellaneous</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN248"
></A
></DT
><DD
><DL
><DT
><A
HREF="#AEN250"
>What editor can I use in DOS/Windows that won't
mess with my unix EOF ?</A
></DT
><DT
><A
HREF="#AEN263"
>How do I get 'User Manager' and 'Server Manager' ?</A
></DT
><DT
><A
HREF="#AEN278"
>The time setting from a Samba server does not work.</A
></DT
><DT
><A
HREF="#AEN282"
>"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A
></DT
><DT
><A
HREF="#AEN286"
>How do I get my samba server to become a member ( not PDC ) of an NT domain ?</A
></DT
></DL
></DD
></DL
></DD
><DT
>6. <A
HREF="#AEN290"
>Troubleshooting and Bug Reporting</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN292"
>Diagnostic tools</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN294"
>What are some diagnostics tools I can use to debug the domain logon process and where can I
find them ?</A
></DT
><DT
><A
HREF="#AEN309"
>How do I install 'Network Monitor' on an NT Workstation
or a Windows 9x box ?</A
></DT
></DL
></DD
><DT
><A
HREF="#AEN338"
>What other help can I get ?</A
></DT
><DD
><DL
><DT
><A
HREF="#AEN341"
>URLs and similar</A
></DT
><DT
><A
HREF="#AEN374"
>How do I get help from the mailing lists ?</A
></DT
><DT
><A
HREF="#AEN403"
>How do I get off the mailing lists ?</A
></DT
></DL
></DD
></DL
></DD
></DL
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="AEN19"
>Chapter 1. Introduction</A
></H1
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN21"
>State of Play</A
></H1
><P
>Much of the related code does work. For example, if an NT is removed from the
domain and then rejoins, the <TT
CLASS="FILENAME"
>Create a Computer Account in the Domain</TT
> dialog
will let you reset the smbpasswd. That is you don't need to do it from
the unix box. However, at the present, you do need to have root as an
administrator and use the root username and password.</P
><P
><B
CLASS="COMMAND"
>Policies</B
> do work on a W2K machine. MS says that recent
builds of W2K don't observe an NT policy but it appears it does in 'legacy'
mode.</P
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN27"
>Introduction</A
></H1
><P
> This FAQ was originally compiled by Jerry Carter (gc) chiefly dealing
with the 'old HEAD' version of Samba and its NTDomain facilities. It is
being rewritten by David Bannon (drb) so that it addresses more
accurately the Samba 2.2.x release.
</P
><P
> This document probably still contains some material that does not apply
to Samba 2.2 but most (all?) of the really misleading stuff has been
removed. Some issues are not dealt with or are dealt with badly. Please
send corrections and additions to <A
HREF="mailto:D.Bannon@latrobe.edu.au"
TARGET="_top"
>David Bannon</A
>.
</P
><P
>Hopefully, as we all become familiar with the Samba 2.2 as a
PDC this document will become much more useful.</P
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="AEN33"
>Chapter 2. General Information</A
></H1
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN35"
>What can we do ?</A
></H1
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN37"
>What can Samba 2.2.x Primary Domain Controller (PDC) do ?</A
></H2
><P
> If you wish to have Samba act as a PDC for Windows NT 4.0/2000 client,
then you will need to obtain the 2.2.0 version. Release of a stable,
full featured Samba PDC is currently slated for version 3.0.
</P
><P
> The following is a list of included features currently in
Samba 2.2:
</P
><P
></P
><UL
><LI
><P
>The ability to act as a limited PDC for
Windows NT and W2000 clients. This includes adding NT and
W2K machines to the domain and authenticating users logging
into the domain.</P
></LI
><LI
><P
>Domain account can be viewed using the User
Manager for Domains</P
></LI
><LI
><P
>Viewing/adding/deleting resources on the Samba
PDC via the Server Manager for Domains from the NT client.
</P
></LI
><LI
><P
>Windows 95/98/ME clients will allow user
level security to be set and browsing of domain accounts.
</P
></LI
><LI
><P
>Machine account password updates.</P
></LI
><LI
><P
>Changing of user passwords from an NT client.
</P
></LI
><LI
><P
>Partial support for Windows NT username mapping.
Group name mapping is slated for a later release.</P
></LI
></UL
><P
> These things are not expected to work in the foreseeable future:
</P
><P
></P
><UL
><LI
><P
>Trust relationships</P
></LI
><LI
><P
>PDC and BDC integration</P
></LI
></UL
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN62"
>Can I have a Windows 2000 client logon to a Samba
controlled domain?</A
></H2
><P
> The 2.2 release branch of Samba supports Windows 2000 domain
clients in legacy mode, i.e. as if the PDC is a NTServer, not a
W2K server.
</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN65"
>CVS</A
></H1
><P
> CVS is a program (publicly available) that the Samba developers
use to maintain the central source code. Non developers can get
access to the source in a read only capacity. Many flavours of unix
now arrive with cvs installed.</P
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN68"
>What are the different Samba branches available in CVS ?</A
></H2
><P
>You can find out more about obtaining Samba's via anonymous
CVS from <A
HREF="http://pserver.samba.org/samba/cvs.html"
TARGET="_top"
> http://pserver.samba.org/samba/cvs.html</A
>.
</P
><P
> There are basically four branches to watch at the moment :
</P
><P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
>HEAD</DT
><DD
><P
>Samba 3.0 ? This code boasts all the main
development work in Samba. Due to its developmental
nature, it's not really suitable for production work.
</P
></DD
><DT
>SAMBA_2_0</DT
><DD
><P
>This branch contains the previous stable
release. At the moment it contains 2.0.8, a version that
will do some limited PDC stuff. If you are really going to
do PDC things, you consider 2.2 instead.
</P
></DD
><DT
>SAMBA_2_2</DT
><DD
><P
>The 2.2.x release branch which is a subset
of the features of the HEAD branch. This document addresses
only SAMBA_2_2.
</P
></DD
><DT
>SAMBA_TNG</DT
><DD
><P
>This branch is no longer maintained from the Samba
sites. Please see <A
HREF="http://www.samba-tng.org/"
TARGET="_top"
> http://www.samba-tng.org/</A
>. It has been requested
that questions about TNG are not posted to the regular Samba
mailing lists including samba-ntdom and samba-technical.
</P
></DD
></DL
></DIV
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN91"
>What are the CVS commands ?</A
></H2
><P
> See <A
HREF="http://pserver.samba.org/samba/cvs.html"
TARGET="_top"
> http://pserver.samba.org/samba/cvs.html</A
> for instructions
on obtaining the SAMBA_2_2 or HEAD cvs code.
</P
></DIV
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="AEN95"
>Chapter 3. Establishing Connections</A
></H1
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN97"
></A
></H1
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN99"
>How do I get my NT4 or W2000 Workstation to login to the Samba
controlled Domain?</A
></H2
><P
> There is a comprehensive Samba PDC <A
HREF="samba-pdc-howto.html"
TARGET="_top"
>HOWTO</A
> accessible from the samba web
site under 'Documentation'. Read it.
</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN103"
>What is a 'machine account' ?</A
></H2
><P
> Every NT, W2K or Samba machine that joins a Samba controlled
domain must be known to the Samba PDC. There are two entries
required, one in (typically) <TT
CLASS="FILENAME"
>/etc/passwd</TT
>
and the other in (typically) <TT
CLASS="FILENAME"
>/usr/local/samba/private/smbpasswd</TT
>.
Under some circumstances these entries are made
<A
HREF="#AEN116"
>manually</A
>, the <A
HREF="samba-pdc-howto.html"
TARGET="_top"
>HOWTO</A
>
discusses ways of creating them automatically.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN110"
>"The machine account for this computer either does not
exist or is not accessible."</A
></H2
><P
> When I try to join the domain I get the message "The machine account
for this computer either does not exist or is not accessible". Whats
wrong ?
</P
><P
> This problem is caused by the PDC not having a suitable machine account.
If you are using the <B
CLASS="COMMAND"
>add user script =</B
> method to create
accounts then this would indicate that it has not worked. Ensure the domain
admin user system is working.
</P
><P
> Alternatively if you are creating account entries manually then they
have not been created correctly. Make sure that you have the entry
correct for the machine account in smbpasswd file on the Samba PDC.
If you added the account using an editor rather than using the smbpasswd
utility, make sure that the account name is the machine netbios name
with a '$' appended to it ( ie. computer_name$ ). There must be an entry
in both /etc/passwd and the smbpasswd file. Some people have reported
that inconsistent subnet masks between the Samba server and the NT
client have caused this problem. Make sure that these are consistent
for both client and server.
</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN116"
>How do I create machine accounts manually ?</A
></H2
><P
> This was the only option until recently, now in version 2.2 better
means are available. You might still need to do it manually for a
couple of reasons. A machine account consists of two entries (assuming
a standard install and /etc/passwd use), one in /etc/passwd and the
other in /usr/local/samba/private/smbpasswd. The /etc/passwd
entry will list the machine name with a $ appended, won't have a
passwd, will have a null shell and no home directory. For example
a machine called 'doppy' would have an /etc/passwd entry like this :</P
><P
> <B
CLASS="COMMAND"
>doppy$:x:505:501:NTMachine:/dev/null:/bin/false</B
>
</P
><P
> On a linux system for example, you would typically add it like
this :
</P
><P
> <B
CLASS="COMMAND"
>adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n
doppy$</B
>
</P
><P
> Then you need to add that entry to smbpasswd, assuming you have a suitable
path to the <B
CLASS="COMMAND"
>smbpasswd</B
> program, do this :
</P
><P
> <B
CLASS="COMMAND"
>smbpasswd -a -m doppy$</B
>
</P
><P
> The entry will be created with a well known password, so any machine that
says it's doppy could join the domain as long as it gets in first. So
don't create the accounts any earlier than you need them.
</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN129"
>I cannot include a '$' in a machine name.</A
></H2
><P
> A 'machine name' in (typically) <TT
CLASS="FILENAME"
>/etc/passwd</TT
> consists
of the machine name with a '$' appended. FreeBSD (and other BSD
systems ?) won't create a user with a '$' in their name.
</P
><P
> The problem is only in the program used to make the entry, once
made, it works perfectly. So create a user without the '$' and
use <B
CLASS="COMMAND"
>vipw</B
> to edit the entry, adding the '$'. Or create
the whole entry with vipw if you like, make sure you use a
unique uid !</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN135"
>I get told "You already have a connection to the Domain...."
when creating a machine account.</A
></H2
><P
> This happens if you try to create a machine account from the
machine itself and use a user name that does not work (for whatever
reason) and then try another (possibly valid) username.
Exit out of the network applet to close the initial connection
and try again.
</P
><P
> Further, if the machine is a already a 'member of a workgroup' that
is the same name as the domain you are joining (bad idea) you will
get this message. Change the workgroup name to something else, it
does not matter what, reboot, and try again.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN139"
>I get told "Cannot join domain, the credentials supplied
conflict with an existing set.."</A
></H2
><P
> This is the same basic problem as mentioned above, <A
HREF="#AEN135"
> "You already have a connection..."</A
>
</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN143"
>"The system can not log you on (C000019B)...."</A
></H2
><P
>I joined the domain successfully but after upgrading
to a newer version of the Samba code I get the message, "The system
can not log you on (C000019B), Please try again or consult your
system administrator" when attempting to logon.
</P
><P
> This occurs when the domain SID stored in private/WORKGROUP.SID is
changed. For example, you remove the file and smbd automatically
creates a new one. Or you are swapping back and forth between
versions 2.0.7, TNG and the HEAD branch code (not recommended). The
only way to correct the problem is to restore the original domain
SID or remove the domain client from the domain and rejoin.
</P
></DIV
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="AEN147"
>Chapter 4. User Account Management</A
></H1
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN149"
>Domain Admins</A
></H1
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN151"
>How do I configure an account as a domain administrator?</A
></H2
><P
> See the NTDom <A
HREF="samba-pdc-howto.html"
TARGET="_top"
>HowTo</A
>.
</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN155"
>Profiles</A
></H1
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN157"
>Why is it bad to set "logon path = \\%N\%U\profile" in
smb.conf?</A
></H2
><P
> Sometimes Windows clients will maintain a connection to
the \\homes\ ( or [%U] ) share even after the user has logged out.
Consider the following scenario.
</P
><P
></P
><UL
><LI
><P
> user1 logs into the Windows NT machine.
Therefore the [homes] share is set to \\server\user1.
</P
></LI
><LI
><P
> user1 works for a while and then logs
out. </P
></LI
><LI
><P
> user2 logs into the same Windows NT
machine.</P
></LI
></UL
><P
> However, since the NT box has maintained a connection to [homes]
which was previously set to \\server\user1, when the operating system
attempts to get the profile and if it can read users1's profile, will
get it otherwise it will return an error. You get the picture.
</P
><P
> A better solution is to use a separate [profiles] share and
set the "logon path = \\%N\profiles\%U"
</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN169"
>Why are all the users listed in the "domain admin users" using the
same profile?</A
></H2
><P
> You are using a very very old development version of Samba.
Upgrade.
</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN172"
>The roaming profiles do not seem to be updating on the
server.</A
></H2
><P
> There can be several reasons for this.
</P
><P
> Make sure that the time on the client and the PDC are synchronized. You
can accomplish this by executing a <B
CLASS="COMMAND"
>net time \\server /set /yes</B
>
replacing server with the name of your PDC (or another synchronized SMB server).
See <A
HREF="#AEN278"
> about Setting Time</A
>
</P
><P
> Make sure that the "logon path" is writable by the user and make sure
that the connection to the logon path location is by the current user.
Sometimes Windows clients do not drop the connection immediately upon
logoff.
</P
><P
> Some people have reported that the logon path location should
also be browseable. I (GC) have yet to empirically verify this,
but you can try.</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN180"
>Policies</A
></H1
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN182"
>What are 'Policies' ?</A
></H2
><P
> When a user logs onto the domain via a client machine, the PDC
sends the client machine a list of things contained in the
'policy' (if it exists). This list may do things like suppress
a splash screen, format the dates the way you like them or perhaps
remove locally stored profiles.
</P
><P
> On a samba PDC this list is obtained from a file called
<TT
CLASS="FILENAME"
>ntconfig.pol</TT
> and located in the [netlogon]
share. The file is created with a policy editor and must be readable
by anyone and writable by only root. See <A
HREF="#AEN203"
> below</A
> for how to get a suitable editor.
</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN188"
>I can't get system policies to work.</A
></H2
><P
> There are two possible reasons for system policies not
functioning correctly. Make sure that you have the following
parameters set in smb.conf
</P
><P
><PRE
CLASS="PROGRAMLISTING"
> [netlogon]
....
locking = no
public = no
browseable = yes
....
</PRE
></P
><P
> A policy file must be in the [netlogon] share and must be
readable by everyone and writable by only root. The file
must be created by an NTServer <A
HREF="#AEN203"
>Policy
Editor</A
>.
</P
><P
> Last time I (drb) looked in the source, it was looking for
<TT
CLASS="FILENAME"
>ntconfig.pol</TT
> first then several other
combinations of upper and lower case. People have reported
success using <TT
CLASS="FILENAME"
>NTconfig.pol</TT
>, <TT
CLASS="FILENAME"
>NTconfig.POL</TT
>
and <TT
CLASS="FILENAME"
>ntconfig.pol</TT
>. These are the case settings that
I (GC) use with the filename <TT
CLASS="FILENAME"
>ntconfig.pol</TT
>:
</P
><P
><PRE
CLASS="PROGRAMLISTING"
> case sensitive = no
case preserve = yes
short preserve case = no
default case = yes
</PRE
></P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN203"
>What about Windows NT Policy Editor ?</A
></H2
><P
> To create or edit <TT
CLASS="FILENAME"
>ntconfig.pol</TT
> you must use
the NT Server Policy Editor, <B
CLASS="COMMAND"
>poledit.exe</B
> which
is included with NT Server but <I
CLASS="EMPHASIS"
>not NT Workstation</I
>.
There is a Policy Editor on a NTws
but it is not suitable for creating <I
CLASS="EMPHASIS"
>Domain Policies</I
>.
Further, although the Windows 95
Policy Editor can be installed on an NT Workstation/Server, it will not
work with NT policies because of the registry keys that are set by the policy templates.
However, the files from the NT Server will run happily enough on an NTws.
You need <TT
CLASS="FILENAME"
>poledit.exe, common.adm</TT
> and <TT
CLASS="FILENAME"
>winnt.adm</TT
>. It is convenient
to put the two *.adm files in <TT
CLASS="FILENAME"
>c:\winnt\inf</TT
> which is where
the binary will look for them unless told otherwise. Note also that that
directory is 'hidden'.
</P
><P
>The Windows NT policy editor is also included with the
Service Pack 3 (and later) for Windows NT 4.0. Extract the files using
<B
CLASS="COMMAND"
>servicepackname /x</B
>, i.e. that's <B
CLASS="COMMAND"
>Nt4sp6ai.exe
/x</B
> for service pack 6a. The policy editor, <B
CLASS="COMMAND"
>poledt.exe</B
> and the
associated template files (*.adm) should
be extracted as well. It is also possible to download the policy template
files for Office97 and get a copy of the policy editor. Another possible
location is with the Zero Administration Kit available for download from Microsoft.
</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN217"
>Can Win95 do Policies ?</A
></H2
><P
> Install the group policy handler for Win9x to pick up group
policies. Look on the Win98 CD in <TT
CLASS="FILENAME"
>\tools\reskit\netadmin\poledit</TT
>.
Install group policies on a Win9x client by double-clicking
<TT
CLASS="FILENAME"
>grouppol.inf</TT
>. Log off and on again a couple of
times and see if Win98 picks up group policies. Unfortunately this needs
to be done on every Win9x machine that uses group policies....
</P
><P
> If group policies don't work one reports suggests getting the updated
(read: working) grouppol.dll for Windows 9x. The group list is grabbed
from /etc/group.
</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN223"
>Passwords</A
></H1
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN225"
>What is password sync and should I use it ?</A
></H2
><P
> NTws users can change their domain password by pressing Ctrl-Alt-Del
and choosing 'Change Password'. By default however, this does not change the unix password
(typically in <TT
CLASS="FILENAME"
>/etc/passwd</TT
> or <TT
CLASS="FILENAME"
>/etc/shadow</TT
>).
In lots of situations that's OK, for example :
</P
><P
></P
><UL
><LI
><P
>The server is only accessible to the user via
samba.</P
></LI
><LI
><P
>Pam_smb or similar is installed so other applications
still refer to the samba password.</P
></LI
></UL
><P
> But sometimes you really do need to maintain two separate password
databases and there are good reasons to keep then in sync. Trying
to explain to users that they need to change their passwords in two
separate places or use two separate passwords is not fun.
</P
><P
> However do understand that setting up password sync is not without
problems either. The chief difficulty is the interface between Samba
and the <B
CLASS="COMMAND"
>passwd</B
> command, it can be a fiddle to set
up and if the password the user has entered fails, the resulting errors
are ambiguously reported and the user is confused. Further, you need
to take steps to ensure that users only ever change their passwords
via samba (or use <B
CLASS="COMMAND"
>smbpasswd</B
>), otherwise they will
only be changing the unix password.</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN239"
>How do I get remote password (unix and SMB) changing working ?</A
></H2
><P
> Have a practice changing a user's password (as root) to see
what discussion takes place and change the text in the 'passwd chat'
line below as necessary. The line as shown works for recent RH Linux
but most other systems seem to like to do something different. The '*' is
a wild card and will match anything (or nothing).
</P
><P
> Add these lines to smb.conf under [Global]
</P
><P
><PRE
CLASS="PROGRAMLISTING"
>
unix password sync = true
passwd program = /usr/bin/passwd %u
passwd chat = *password* %n\n *password* %n\n *successful*
</PRE
></P
><P
> As mentioned above, the change to the unix password happens as root,
not as the user, as is indicated in ~/smbd/chgpasswd.c If
you are using NIS, the Samba server must be running on the NIS
master machine.
</P
></DIV
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="AEN246"
>Chapter 5. Miscellaneous</A
></H1
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN248"
></A
></H1
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN250"
>What editor can I use in DOS/Windows that won't
mess with my unix EOF ?</A
></H2
><P
>There are a number of Windows or DOS based editors that will
understand, and leave intact, the unix eof (as opposed to a DOS CR/LF).
List members suggested :
</P
><P
></P
><UL
><LI
><P
>UltraEdit at <A
HREF="http://www.ultraedit.com"
TARGET="_top"
>www.ultraedit.com</A
></P
></LI
><LI
><P
>VI for windows at <A
HREF="http://home.snafu.de/ramo/WinViEn.htm"
TARGET="_top"
> home.snafu.de/ramo/WinViEn.htm</A
></P
></LI
><LI
><P
>The author prefers PFE at <A
HREF="http://www.lancs.ac.uk/people/cpaap/pfe/"
TARGET="_top"
> www.lancs.ac.uk/people/cpaap/pfe/</A
> but it's no longer being developed...</P
></LI
></UL
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN263"
>How do I get 'User Manager' and 'Server Manager' ?</A
></H2
><P
> Since I don't need to buy an NT Server CD now, how do I get
the 'User Manager for Domains', the 'Server Manager' ?
</P
><P
> Microsoft distributes a version of
these tools called nexus for installation on Windows 95 systems. The
tool set includes
</P
><P
></P
><UL
><LI
><P
>Server Manager</P
></LI
><LI
><P
>User Manager for Domains</P
></LI
><LI
><P
>Event Viewer</P
></LI
></UL
><P
> Click here to download the archived file <A
HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE"
TARGET="_top"
>ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE</A
>
</P
><P
> The Windows NT 4.0 version of the 'User Manager for
Domains' and 'Server Manager' are available from Microsoft via ftp
from <A
HREF="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE"
TARGET="_top"
>ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE</A
>
</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN278"
>The time setting from a Samba server does not work.</A
></H2
><P
>If it works OK when you log on as Domain Admin then the problem is that ordinary users
don't have permission to change the time. (The system is running with their permission
at logon time.) This is not a Samba problem, you will have the same problem where ever
you connect. You can give 'everyone' permission to change the time from the User Manager.
</P
><P
>Anyone know what the registry settings are so this could be done with a Policy ?</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN282"
>"trust account xxx should be in DOMAIN_GROUP_RID_USERS"</A
></H2
><P
>I keep getting the message "trust account xxx should be in DOMAIN_GROUP_RID_USERS."
in the logs. What do I need to do?</P
><P
>You are using one of the old development versions. Upgrade.
(The message is unimportant, was a reminder to a developer)</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN286"
>How do I get my samba server to become a member ( not PDC ) of an NT domain ?</A
></H2
><P
> Please refer to the <A
HREF="DOMAIN_MEMBER.html"
TARGET="_top"
>Domain Member
HOWTO</A
> for more information on this.
</P
></DIV
></DIV
></DIV
><DIV
CLASS="CHAPTER"
><HR><H1
><A
NAME="AEN290"
>Chapter 6. Troubleshooting and Bug Reporting</A
></H1
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN292"
>Diagnostic tools</A
></H1
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN294"
>What are some diagnostics tools I can use to debug the domain logon process and where can I
find them ?</A
></H2
><P
> One of the best diagnostic tools for debugging problems is Samba itself.
You can use the -d option for both smbd and nmbd to specify what
'debug level' at which to run. See the man pages on smbd, nmbd and
smb.conf for more information on debugging options. The debug
level can range from 1 (the default) to 10 (100 for debugging passwords).
</P
><P
> Another helpful method of debugging is to compile samba using the
<B
CLASS="COMMAND"
>gcc -g </B
> flag. This will include debug
information in the binaries and allow you to attach gdb to the
running smbd / nmbd process. In order to attach gdb to an smbd
process for an NT workstation, first get the workstation to make the
connection. Pressing Ctrl-Alt-Del and going down to the domain box
is sufficient (at least, on the first time you join the domain) to
generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation
maintains an open connection, and therefore there will be an smbd
process running (assuming that you haven't set a really short smbd
idle timeout) So, in between pressing Ctrl-Alt-Del, and actually
typing in your password, you can gdb attach and continue.
</P
><P
> Some useful samba commands worth investigating:
</P
><P
></P
><UL
><LI
><P
>testparam | more</P
></LI
><LI
><P
>smbclient -L //{netbios name of server}</P
></LI
></UL
><P
> An SMB enabled version of tcpdump is available from
<A
HREF="http://www.tcpdump.org/"
TARGET="_top"
>http://www.tcpdump.org/</A
>.
Ethereal, another good packet sniffer for UNIX and Win32
hosts, can be downloaded from <A
HREF="http://www.ethereal.com/"
TARGET="_top"
>http://www.ethereal.com</A
>.
</P
><P
> For tracing things on Microsoft Windows NT, Network Monitor
(aka. netmon) is available on the Microsoft Developer Network CD's,
the Windows NT Server install CD and the SMS CD's. The version of
netmon that ships with SMS allows for dumping packets between any two
computers (i.e. placing the network interface in promiscuous mode).
The version on the NT Server install CD will only allow monitoring
of network traffic directed to the local NT box and broadcasts on the
local subnet. Be aware that Ethereal can read and write netmon
formatted files.
</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN309"
>How do I install 'Network Monitor' on an NT Workstation
or a Windows 9x box ?</A
></H2
><P
> Installing netmon on an NT workstation requires a couple
of steps. The following are for installing Netmon V4.00.349, which comes
with Microsoft Windows NT Server 4.0, on Microsoft Windows NT
Workstation 4.0. The process should be similar for other version of
Windows NT / Netmon. You will need both the Microsoft Windows
NT Server 4.0 Install CD and the Workstation 4.0 Install CD.
</P
><P
> Initially you will need to install 'Network Monitor Tools and Agent'
on the NT Server. To do this
</P
><P
></P
><UL
><LI
><P
>Goto Start - Settings - Control Panel -
Network - Services - Add </P
></LI
><LI
><P
>Select the 'Network Monitor Tools and Agent' and
click on 'OK'.</P
></LI
><LI
><P
>Click 'OK' on the Network Control Panel.
</P
></LI
><LI
><P
>Insert the Windows NT Server 4.0 install CD
when prompted.</P
></LI
></UL
><P
> At this point the Netmon files should exist in
<TT
CLASS="FILENAME"
>%SYSTEMROOT%\System32\netmon\*.*</TT
>.
Two subdirectories exist as well, <TT
CLASS="FILENAME"
>parsers\</TT
>
which contains the necessary DLL's for parsing the netmon packet
dump, and <TT
CLASS="FILENAME"
>captures\</TT
>.
</P
><P
> In order to install the Netmon tools on an NT Workstation, you will
first need to install the 'Network Monitor Agent' from the Workstation
install CD.
</P
><P
></P
><UL
><LI
><P
>Goto Start - Settings - Control Panel -
Network - Services - Add</P
></LI
><LI
><P
>Select the 'Network Monitor Agent' and click
on 'OK'.</P
></LI
><LI
><P
>Click 'OK' on the Network Control Panel.
</P
></LI
><LI
><P
>Insert the Windows NT Workstation 4.0 install
CD when prompted.</P
></LI
></UL
><P
> Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.*
to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set
permissions as you deem appropriate for your site. You will need
administrative rights on the NT box to run netmon.
</P
><P
> To install Netmon on a Windows 9x box install the network monitor agent
from the Windows 9x CD (\admin\nettools\netmon). There is a readme
file located with the netmon driver files on the CD if you need
information on how to do this. Copy the files from a working
Netmon installation.
</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><HR><H1
CLASS="SECT1"
><A
NAME="AEN338"
>What other help can I get ?</A
></H1
><P
> There are many sources of information available in the form
of mailing lists, RFC's and documentation. The docs that come
with the samba distribution contain very good explanations of
general SMB topics such as browsing.</P
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN341"
>URLs and similar</A
></H2
><P
></P
><UL
><LI
><P
>Home of Samba site <A
HREF="http://samba.org"
TARGET="_top"
> http://samba.org</A
>. We have a mirror near you !</P
></LI
><LI
><P
> The <I
CLASS="EMPHASIS"
>Development</I
> document
on the Samba mirrors might mention your problem. If so,
it might mean that the developers are working on it.</P
></LI
><LI
><P
> Ignacio Coupeau has a very comprehensive look at LDAP with Samba at
<A
HREF="http://www.unav.es/cti/ldap-smb-howto.html"
TARGET="_top"
> http://www.unav.es/cti/ldap-smb-howto.html</A
>
Be a little careful however, I suspect that it does not specifically
address samba 2.2.x. The HEAD pre-2.1 may possibly be the best
stream to look at.</P
></LI
><LI
><P
> Lars Kneschke's site covers <A
HREF="http://www.samba-tng.org"
TARGET="_top"
> Samba-TNG</A
> at
<A
HREF="http://www.kneschke.de/projekte/samba_tng"
TARGET="_top"
> http://www.kneschke.de/projekte/samba_tng</A
>, but again, a
lot of it does not apply to the mainstream Samba.</P
></LI
><LI
><P
>See how Scott Merrill simulates a BDC behaviour at
<A
HREF="http://www.skippy.net/linux/smb-howto.html"
TARGET="_top"
> http://www.skippy.net/linux/smb-howto.html</A
>. </P
></LI
><LI
><P
>Although 2.0.7 has almost had its day as a PDC, I (drb) will
keep the 2.0.7 PDC pages at <A
HREF="http://bioserve.latrobe.edu.au/samba"
TARGET="_top"
> http://bioserve.latrobe.edu.au/samba</A
> going for a while yet.</P
></LI
><LI
><P
>Misc links to CIFS information
<A
HREF="http://samba.org/cifs/"
TARGET="_top"
>http://samba.org/cifs/</A
></P
></LI
><LI
><P
>NT Domains for Unix <A
HREF="http://mailhost.cb1.com/~lkcl/ntdom/"
TARGET="_top"
> http://mailhost.cb1.com/~lkcl/ntdom/</A
></P
></LI
><LI
><P
>FTP site for older SMB specs:
<A
HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/"
TARGET="_top"
> ftp://ftp.microsoft.com/developr/drg/CIFS/</A
></P
></LI
></UL
><P
> You should also refer to the MS archives at
<A
HREF="ftp://ftp.microsoft.com/developr/drg/CIFS/"
TARGET="_top"
>ftp://ftp.microsoft.com/developr/drg/CIFS/"</A
>
</P
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN374"
>How do I get help from the mailing lists ?</A
></H2
><P
> There are a number of Samba related mailing lists. Go to <A
HREF="http://samba.org"
TARGET="_top"
>http://samba.org</A
>, click on your nearest mirror
and then click on <B
CLASS="COMMAND"
>Support</B
> and then click on <B
CLASS="COMMAND"
> Samba related mailing lists</B
>.</P
><P
>For questions relating to Samba TNG go to
<A
HREF="http://www.samba-tng.org/"
TARGET="_top"
>http://www.samba-tng.org/</A
>
It has been requested that you don't post questions about Samba-TNG to the
mainstream Samba lists.</P
><P
></P
><P
><B
>If you post a message to one of the lists please
observe the following guide lines :</B
></P
><UL
><LI
><P
> Always remember that the developers are volunteers, they are
not paid and they never guarantee to produce a particular feature at
a particular time. Any time lines are 'best guess' and nothing more.
</P
></LI
><LI
><P
> Always mention what version of samba you are using and what
operating system its running under. You should probably list the
relevant sections of your smb.conf file, at least the options
in [global] that affect PDC support.</P
></LI
><LI
><P
>In addition to the version, if you obtained Samba via
CVS mention the date when you last checked it out.</P
></LI
><LI
><P
> Try and make your question clear and brief, lots of long,
convoluted questions get deleted before they are completely read !
Don't post html encoded messages (if you can select colour or font
size it's html).</P
></LI
><LI
><P
> If you run one of those nifty 'I'm on holidays' things when
you are away, make sure its configured to not answer mailing lists.
</P
></LI
><LI
><P
> Don't cross post. Work out which is the best list to post to
and see what happens, i.e. don't post to both samba-ntdom and samba-technical.
Many people active on the lists subscribe to more
than one list and get annoyed to see the same message two or more times.
Often someone will see a message and thinking it would be better dealt
with on another, will forward it on for you.</P
></LI
><LI
><P
>You might include <I
CLASS="EMPHASIS"
>partial</I
>
log files written at a debug level set to as much as 20.
Please don't send the entire log but enough to give the context of the
error messages.</P
></LI
><LI
><P
>(Possibly) If you have a complete netmon trace ( from the opening of
the pipe to the error ) you can send the *.CAP file as well.</P
></LI
><LI
><P
>Please think carefully before attaching a document to an email.
Consider pasting the relevant parts into the body of the message. The samba
mailing lists go to a huge number of people, do they all need a copy of your
smb.conf in their attach directory ?</P
></LI
></UL
></DIV
><DIV
CLASS="SECT2"
><HR><H2
CLASS="SECT2"
><A
NAME="AEN403"
>How do I get off the mailing lists ?</A
></H2
><P
>To have your name removed from a samba mailing list, go to the
same place you went to to get on it. Go to <A
HREF="http://lists.samba.org/"
TARGET="_top"
>http://lists.samba.org</A
>, click
on your nearest mirror and then click on <B
CLASS="COMMAND"
>Support</B
> and
then click on <B
CLASS="COMMAND"
> Samba related mailing lists</B
>. Or perhaps see
<A
HREF="http://lists.samba.org/mailman/roster/samba-ntdom"
TARGET="_top"
>here</A
></P
><P
> Please don't post messages to the list asking to be removed, you will just
be referred to the above address (unless that process failed in some way...)
</P
></DIV
></DIV
></DIV
></DIV
></BODY
></HTML
>