| 1 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 27. Desktop Profile Management</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="The Official Samba-3 HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="PolicyMgmt.html" title="Chapter 26. System and Account Policies"><link rel="next" href="pam.html" title="Chapter 28. PAM-Based Distributed Authentication"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 27. Desktop Profile Management</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="PolicyMgmt.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="pam.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ProfileMgmt"></a>Chapter 27. Desktop Profile Management</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ProfileMgmt.html#id417912">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id417955">Roaming Profiles</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id418003">Samba Configuration for Profile Handling</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id418557">Windows Client Profile Configuration Information</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id419796">User Profile Hive Cleanup Service</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id419824">Sharing Profiles between Windows 9x/Me and NT4/200x/XP Workstations</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id419907">Profile Migration from Windows NT4/200x Server to Samba</a></span></dt></dl></dd><dt><span class="sect1"><a href="ProfileMgmt.html#id420239">Mandatory Profiles</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id420367">Creating and Managing Group Profiles</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id420430">Default Profile for Windows Users</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id420460">MS Windows 9x/Me</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id420595">MS Windows NT4 Workstation</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id421121">MS Windows 200x/XP</a></span></dt></dl></dd><dt><span class="sect1"><a href="ProfileMgmt.html#id421583">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id421592">Configuring Roaming Profiles for a Few Users or Groups</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id421646">Cannot Use Roaming Profiles</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id421795">Changing the Default Profile</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id421954">Debugging Roaming Profiles and NT4-style Domain Policies</a></span></dt></dl></dd></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id417912"></a>Features and Benefits</h2></div></div></div><p>
|
|---|
| 2 | <a class="indexterm" name="id417920"></a>
|
|---|
| 3 | Roaming profiles are feared by some, hated by a few, loved by many, and a godsend for
|
|---|
| 4 | some administrators.
|
|---|
| 5 | </p><p>
|
|---|
| 6 | <a class="indexterm" name="id417931"></a>
|
|---|
| 7 | Roaming profiles allow an administrator to make available a consistent user desktop
|
|---|
| 8 | as the user moves from one machine to another. This chapter provides much information
|
|---|
| 9 | regarding how to configure and manage roaming profiles.
|
|---|
| 10 | </p><p>
|
|---|
| 11 | <a class="indexterm" name="id417943"></a>
|
|---|
| 12 | While roaming profiles might sound like nirvana to some, they are a real and tangible
|
|---|
| 13 | problem to others. In particular, users of mobile computing tools, where often there may not
|
|---|
| 14 | be a sustained network connection, are often better served by purely local profiles.
|
|---|
| 15 | This chapter provides information to help the Samba administrator deal with those
|
|---|
| 16 | situations.
|
|---|
| 17 | </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id417955"></a>Roaming Profiles</h2></div></div></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
|
|---|
| 18 | Roaming profiles support is different for Windows 9x/Me and Windows NT4/200x.
|
|---|
| 19 | </p></div><p>
|
|---|
| 20 | Before discussing how to configure roaming profiles, it is useful to see how
|
|---|
| 21 | Windows 9x/Me and Windows NT4/200x clients implement these features.
|
|---|
| 22 | </p><p>
|
|---|
| 23 | <a class="indexterm" name="id417974"></a>
|
|---|
| 24 | Windows 9x/Me clients send a NetUserGetInfo request to the server to get the user's
|
|---|
| 25 | profiles location. However, the response does not have room for a separate
|
|---|
| 26 | profiles location field, only the user's home share. This means that Windows 9x/Me
|
|---|
| 27 | profiles are restricted to being stored in the user's home directory.
|
|---|
| 28 | </p><p>
|
|---|
| 29 | <a class="indexterm" name="id417987"></a>
|
|---|
| 30 | <a class="indexterm" name="id417994"></a>
|
|---|
| 31 | Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields
|
|---|
| 32 | including a separate field for the location of the user's profiles.
|
|---|
| 33 | </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id418003"></a>Samba Configuration for Profile Handling</h3></div></div></div><p>
|
|---|
| 34 | This section documents how to configure Samba for MS Windows client profile support.
|
|---|
| 35 | </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id418013"></a>NT4/200x User Profiles</h4></div></div></div><p>
|
|---|
| 36 | For example, to support Windows NT4/200x clients, set the following in the [global] section of the <code class="filename">smb.conf</code> file:
|
|---|
| 37 | </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id418034"></a><em class="parameter"><code>logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath</code></em></td></tr></table><p>
|
|---|
| 38 | This is typically implemented like:
|
|---|
| 39 | </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id418055"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr></table><p>
|
|---|
| 40 | where “<span class="quote">%L</span>” translates to the name of the Samba server and “<span class="quote">%U</span>” translates to the username.
|
|---|
| 41 | </p><p>
|
|---|
| 42 | The default for this option is <code class="filename">\\%N\%U\profile</code>, namely, <code class="filename">\\sambaserver\username\profile</code>.
|
|---|
| 43 | The <code class="filename">\\%N\%U</code> service is created automatically by the [homes] service. If you are using
|
|---|
| 44 | a Samba server for the profiles, you must make the share that is specified in the logon path
|
|---|
| 45 | browseable. Please refer to the man page for <code class="filename">smb.conf</code> regarding the different
|
|---|
| 46 | semantics of “<span class="quote">%L</span>” and “<span class="quote">%N</span>”, as well as “<span class="quote">%U</span>” and “<span class="quote">%u</span>”.
|
|---|
| 47 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 48 | <a class="indexterm" name="id418122"></a>
|
|---|
| 49 | <a class="indexterm" name="id418129"></a>
|
|---|
| 50 | MS Windows NT/200x clients at times do not disconnect a connection to a server between logons. It is recommended
|
|---|
| 51 | to not use the <em class="parameter"><code>homes</code></em> metaservice name as part of the profile share path.
|
|---|
| 52 | </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id418146"></a>Windows 9x/Me User Profiles</h4></div></div></div><p>
|
|---|
| 53 | <a class="indexterm" name="id418154"></a>
|
|---|
| 54 | <a class="indexterm" name="id418160"></a>
|
|---|
| 55 | To support Windows 9x/Me clients, you must use the <a class="indexterm" name="id418168"></a>logon home
|
|---|
| 56 | parameter. Samba has been fixed so <strong class="userinput"><code>net use /home</code></strong> now works as well and it, too, relies
|
|---|
| 57 | on the <em class="parameter"><code>logon home</code></em> parameter.
|
|---|
| 58 | </p><p>
|
|---|
| 59 | <a class="indexterm" name="id418190"></a>
|
|---|
| 60 | <a class="indexterm" name="id418197"></a>
|
|---|
| 61 | <a class="indexterm" name="id418204"></a>
|
|---|
| 62 | By using the <em class="parameter"><code>logon home</code></em> parameter, you are restricted to putting Windows 9x/Me profiles
|
|---|
| 63 | in the user's home directory. But wait! There is a trick you can use. If you set the following in the
|
|---|
| 64 | <em class="parameter"><code>[global]</code></em> section of your <code class="filename">smb.conf</code> file:
|
|---|
| 65 | </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id418236"></a><em class="parameter"><code>logon home = \\%L\%U\.profiles</code></em></td></tr></table><p>
|
|---|
| 66 | then your Windows 9x/Me clients will dutifully put their clients in a subdirectory
|
|---|
| 67 | of your home directory called <code class="filename">.profiles</code> (making them hidden).
|
|---|
| 68 | </p><p>
|
|---|
| 69 | <a class="indexterm" name="id418259"></a>
|
|---|
| 70 | Not only that, but <strong class="userinput"><code>net use /home</code></strong> will also work because of a feature in
|
|---|
| 71 | Windows 9x/Me. It removes any directory stuff off the end of the home directory area
|
|---|
| 72 | and only uses the server and share portion. That is, it looks like you
|
|---|
| 73 | specified <code class="filename">\\%L\%U</code> for <a class="indexterm" name="id418280"></a>logon home.
|
|---|
| 74 | </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id418289"></a>Mixed Windows Windows 9x/Me and NT4/200x User Profiles</h4></div></div></div><p>
|
|---|
| 75 | You can support profiles for Windows 9x and Windows NT clients by setting both the
|
|---|
| 76 | <a class="indexterm" name="id418298"></a>logon home and <a class="indexterm" name="id418305"></a>logon path parameters. For example,
|
|---|
| 77 | </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id418319"></a><em class="parameter"><code>logon home = \\%L\%U\.profiles</code></em></td></tr><tr><td><a class="indexterm" name="id418332"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr></table><p>
|
|---|
| 78 | <a class="indexterm" name="id418347"></a>
|
|---|
| 79 | Windows 9x/Me and NT4 and later profiles should not be stored in the same location because
|
|---|
| 80 | Windows NT4 and later will experience problems with mixed profile environments.
|
|---|
| 81 | </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id418357"></a>Disabling Roaming Profile Support</h4></div></div></div><p>
|
|---|
| 82 | <a class="indexterm" name="id418365"></a>
|
|---|
| 83 | The question often asked is, “<span class="quote">How may I enforce use of local profiles?</span>” or
|
|---|
| 84 | “<span class="quote">How do I disable roaming profiles?</span>”
|
|---|
| 85 | </p><p>
|
|---|
| 86 | <a class="indexterm" name="id418383"></a>
|
|---|
| 87 | There are three ways of doing this:
|
|---|
| 88 | </p><a class="indexterm" name="id418392"></a><div class="variablelist"><dl><dt><span class="term">In <code class="filename">smb.conf</code></span></dt><dd><p>
|
|---|
| 89 | Affect the following settings and ALL clients will be forced to use a local profile:
|
|---|
| 90 | <a class="indexterm" name="id418418"></a>logon home = and <a class="indexterm" name="id418425"></a>logon path =
|
|---|
| 91 | </p><p>
|
|---|
| 92 | The arguments to these parameters must be left blank. It is necessary to include the <code class="constant">=</code> sign
|
|---|
| 93 | to specifically assign the empty value.
|
|---|
| 94 | </p></dd><dt><span class="term">MS Windows Registry:</span></dt><dd><p>
|
|---|
| 95 | <a class="indexterm" name="id418450"></a>
|
|---|
| 96 | <a class="indexterm" name="id418457"></a>
|
|---|
| 97 | Use the Microsoft Management Console (MMC) <code class="literal">gpedit.msc</code> to instruct your MS Windows XP
|
|---|
| 98 | machine to use only a local profile. This, of course, modifies registry settings. The full
|
|---|
| 99 | path to the option is:
|
|---|
| 100 | </p><pre class="screen">
|
|---|
| 101 | Local Computer Policy\
|
|---|
| 102 | Computer Configuration\
|
|---|
| 103 | Administrative Templates\
|
|---|
| 104 | System\
|
|---|
| 105 | User Profiles\
|
|---|
| 106 |
|
|---|
| 107 | Disable: Only Allow Local User Profiles
|
|---|
| 108 | Disable: Prevent Roaming Profile Change from Propagating to the Server
|
|---|
| 109 | </pre><p>
|
|---|
| 110 | </p></dd><dt><span class="term">Change of Profile Type:</span></dt><dd><p>From the start menu right-click on the <span class="guiicon">My Computer</span> icon,
|
|---|
| 111 | select <span class="guimenuitem">Properties</span>, click on the <span class="guilabel">User Profiles</span>
|
|---|
| 112 | tab, select the profile you wish to change from
|
|---|
| 113 | <span class="guimenu">Roaming</span> type to <span class="guimenu">Local</span>, and click on
|
|---|
| 114 | <span class="guibutton">Change Type</span>.
|
|---|
| 115 | </p></dd></dl></div><p>
|
|---|
| 116 | Consult the MS Windows registry guide for your particular MS Windows version for more information
|
|---|
| 117 | about which registry keys to change to enforce use of only local user profiles.
|
|---|
| 118 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 119 | <a class="indexterm" name="id418544"></a>
|
|---|
| 120 | The specifics of how to convert a local profile to a roaming profile, or a roaming profile
|
|---|
| 121 | to a local one, vary according to the version of MS Windows you are running. Consult the Microsoft MS
|
|---|
| 122 | Windows Resource Kit for your version of Windows for specific information.
|
|---|
| 123 | </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id418557"></a>Windows Client Profile Configuration Information</h3></div></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id418563"></a>Windows 9x/Me Profile Setup</h4></div></div></div><p>
|
|---|
| 124 | When a user first logs in on Windows 9x, the file user.DAT is created, as are folders <code class="filename">Start
|
|---|
| 125 | Menu</code>, <code class="filename">Desktop</code>, <code class="filename">Programs</code>, and
|
|---|
| 126 | <code class="filename">Nethood</code>. These directories and their contents will be merged with the local versions
|
|---|
| 127 | stored in <code class="filename">c:\windows\profiles\username</code> on subsequent logins, taking the most recent from
|
|---|
| 128 | each. You will need to use the <em class="parameter"><code>[global]</code></em> options <a class="indexterm" name="id418608"></a>preserve case = yes, <a class="indexterm" name="id418615"></a>short preserve case = yes, and <a class="indexterm" name="id418622"></a>case sensitive = no in order to maintain capital letters in shortcuts in any of the
|
|---|
| 129 | profile folders.
|
|---|
| 130 | </p><p>
|
|---|
| 131 | <a class="indexterm" name="id418633"></a>
|
|---|
| 132 | <a class="indexterm" name="id418640"></a>
|
|---|
| 133 | The <code class="filename">user.DAT</code> file contains all the user's preferences. If you wish to enforce a set of preferences,
|
|---|
| 134 | rename their <code class="filename">user.DAT</code> file to <code class="filename">user.MAN</code>, and deny them write access to this file.
|
|---|
| 135 | </p><div class="orderedlist"><ol type="1"><li><p>
|
|---|
| 136 | On the Windows 9x/Me machine, go to <span class="guimenu">Control Panel</span> ->
|
|---|
| 137 | <span class="guimenuitem">Passwords</span> and select the <span class="guilabel">User Profiles</span> tab.
|
|---|
| 138 | Select the required level of roaming preferences. Press <span class="guibutton">OK</span>, but do not
|
|---|
| 139 | allow the computer to reboot.
|
|---|
| 140 | </p></li><li><p>
|
|---|
| 141 | On the Windows 9x/Me machine, go to <span class="guimenu">Control Panel</span> ->
|
|---|
| 142 | <span class="guimenuitem">Network</span> -> <span class="guimenuitem">Client for Microsoft Networks</span>
|
|---|
| 143 | -> <span class="guilabel">Preferences</span>. Select <span class="guilabel">Log on to NT Domain</span>. Then,
|
|---|
| 144 | ensure that the Primary Logon is <span class="guilabel">Client for Microsoft Networks</span>. Press
|
|---|
| 145 | <span class="guibutton">OK</span>, and this time allow the computer to reboot.
|
|---|
| 146 | </p></li></ol></div><p>
|
|---|
| 147 | <a class="indexterm" name="id418758"></a>
|
|---|
| 148 | <a class="indexterm" name="id418764"></a>
|
|---|
| 149 | <a class="indexterm" name="id418771"></a>
|
|---|
| 150 | <a class="indexterm" name="id418778"></a>
|
|---|
| 151 | Under Windows 9x/Me, profiles are downloaded from the Primary Logon. If you have the Primary Logon
|
|---|
| 152 | as “<span class="quote">Client for Novell Networks</span>”, then the profiles and logon script will be downloaded from
|
|---|
| 153 | your Novell server. If you have the Primary Logon as “<span class="quote">Windows Logon</span>”, then the profiles will
|
|---|
| 154 | be loaded from the local machine a bit against the concept of roaming profiles, it would seem!
|
|---|
| 155 | </p><p>
|
|---|
| 156 | <a class="indexterm" name="id418801"></a>
|
|---|
| 157 | You will now find that the Microsoft Networks Login box contains <code class="constant">[user, password, domain]</code> instead
|
|---|
| 158 | of just <code class="constant">[user, password]</code>. Type in the Samba server's domain name (or any other domain known to exist,
|
|---|
| 159 | but bear in mind that the user will be authenticated against this domain and profiles downloaded from it
|
|---|
| 160 | if that domain logon server supports it), user name and user's password.
|
|---|
| 161 | </p><p>
|
|---|
| 162 | Once the user has been successfully validated, the Windows 9x/Me machine informs you that
|
|---|
| 163 | <code class="computeroutput">The user has not logged on before</code> and asks <code class="computeroutput">Do you
|
|---|
| 164 | wish to save the user's preferences?</code> Select <span class="guibutton">Yes</span>.
|
|---|
| 165 | </p><p>
|
|---|
| 166 | Once the Windows 9x/Me client comes up with the desktop, you should be able to examine the
|
|---|
| 167 | contents of the directory specified in the <a class="indexterm" name="id418844"></a>logon path on
|
|---|
| 168 | the Samba server and verify that the <code class="filename">Desktop</code>, <code class="filename">Start Menu</code>,
|
|---|
| 169 | <code class="filename">Programs</code>, and <code class="filename">Nethood</code> folders have been created.
|
|---|
| 170 | </p><p>
|
|---|
| 171 | <a class="indexterm" name="id418879"></a>
|
|---|
| 172 | <a class="indexterm" name="id418885"></a>
|
|---|
| 173 | <a class="indexterm" name="id418892"></a>
|
|---|
| 174 | These folders will be cached locally on the client and updated when the user logs off (if
|
|---|
| 175 | you haven't made them read-only by then). You will find that if the user creates further folders or
|
|---|
| 176 | shortcuts, the client will merge the profile contents downloaded with the contents of the profile
|
|---|
| 177 | directory already on the local client, taking the newest folders and shortcut from each set.
|
|---|
| 178 | </p><p>
|
|---|
| 179 | <a class="indexterm" name="id418906"></a>
|
|---|
| 180 | <a class="indexterm" name="id418912"></a>
|
|---|
| 181 | <a class="indexterm" name="id418919"></a>
|
|---|
| 182 | <a class="indexterm" name="id418926"></a>
|
|---|
| 183 | If you have made the folders/files read-only on the Samba server, then you will get errors from
|
|---|
| 184 | the Windows 9x/Me machine on logon and logout as it attempts to merge the local and remote profile.
|
|---|
| 185 | Basically, if you have any errors reported by the Windows 9x/Me machine, check the UNIX file permissions
|
|---|
| 186 | and ownership rights on the profile directory contents, on the Samba server.
|
|---|
| 187 | </p><p>
|
|---|
| 188 | <a class="indexterm" name="id418939"></a>
|
|---|
| 189 | <a class="indexterm" name="id418946"></a>
|
|---|
| 190 | <a class="indexterm" name="id418953"></a>
|
|---|
| 191 | <a class="indexterm" name="id418960"></a>
|
|---|
| 192 | <a class="indexterm" name="id418967"></a>
|
|---|
| 193 | If you have problems creating user profiles, you can reset the user's local desktop cache, as shown below.
|
|---|
| 194 | When this user next logs in, the user will be told that he/she is logging in “<span class="quote">for the first
|
|---|
| 195 | time</span>”.
|
|---|
| 196 | </p><div class="orderedlist"><ol type="1"><li><p>
|
|---|
| 197 | Instead of logging in under the [user, password, domain] dialog, press <span class="guibutton">escape</span>.
|
|---|
| 198 | </p></li><li><p>
|
|---|
| 199 | Run the <code class="literal">regedit.exe</code> program, and look in:
|
|---|
| 200 | </p><p>
|
|---|
| 201 | <code class="filename">HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList</code>
|
|---|
| 202 | </p><p>
|
|---|
| 203 | You will find an entry for each user of ProfilePath. Note the contents of this key
|
|---|
| 204 | (likely to be <code class="filename">c:\windows\profiles\username</code>), then delete the key
|
|---|
| 205 | <em class="parameter"><code>ProfilePath</code></em> for the required user.
|
|---|
| 206 | </p></li><li><p>
|
|---|
| 207 | Exit the registry editor.
|
|---|
| 208 | </p></li><li><p>
|
|---|
| 209 | Search for the user's .PWL password-caching file in the <code class="filename">c:\windows</code> directory, and delete it.
|
|---|
| 210 | </p></li><li><p>
|
|---|
| 211 | Log off the Windows 9x/Me client.
|
|---|
| 212 | </p></li><li><p>
|
|---|
| 213 | Check the contents of the profile path (see <a class="indexterm" name="id419061"></a>logon path
|
|---|
| 214 | described above) and delete the <code class="filename">user.DAT</code> or <code class="filename">user.MAN</code>
|
|---|
| 215 | file for the user, making a backup if required.
|
|---|
| 216 | </p></li></ol></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
|
|---|
| 217 | <a class="indexterm" name="id419086"></a>
|
|---|
| 218 | Before deleting the contents of the directory listed in the <em class="parameter"><code>ProfilePath</code></em>
|
|---|
| 219 | (this is likely to be <code class="filename">c:\windows\profiles\username)</code>, ask whether the owner has
|
|---|
| 220 | any important files stored on his or her desktop or start menu. Delete the contents of the
|
|---|
| 221 | directory <em class="parameter"><code>ProfilePath</code></em> (making a backup if any of the files are needed).
|
|---|
| 222 | </p><p>
|
|---|
| 223 | This will have the effect of removing the local (read-only hidden system file) <code class="filename">user.DAT</code>
|
|---|
| 224 | in their profile directory, as well as the local “<span class="quote">desktop,</span>” “<span class="quote">nethood,</span>”
|
|---|
| 225 | “<span class="quote">start menu,</span>” and “<span class="quote">programs</span>” folders.
|
|---|
| 226 | </p></div><p>
|
|---|
| 227 | <a class="indexterm" name="id419141"></a>
|
|---|
| 228 | <a class="indexterm" name="id419148"></a>
|
|---|
| 229 | <a class="indexterm" name="id419154"></a>
|
|---|
| 230 | <a class="indexterm" name="id419161"></a>
|
|---|
| 231 | If all else fails, increase Samba's debug log levels to between 3 and 10, and/or run a packet
|
|---|
| 232 | sniffer program such as ethereal or <code class="literal">netmon.exe</code>, and look for error messages.
|
|---|
| 233 | </p><p>
|
|---|
| 234 | <a class="indexterm" name="id419179"></a>
|
|---|
| 235 | <a class="indexterm" name="id419185"></a>
|
|---|
| 236 | If you have access to an Windows NT4/200x server, then first set up roaming profiles and/or
|
|---|
| 237 | netlogons on the Windows NT4/200x server. Make a packet trace, or examine the example packet traces
|
|---|
| 238 | provided with Windows NT4/200x server, and see what the differences are with the equivalent Samba trace.
|
|---|
| 239 | </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id419197"></a>Windows NT4 Workstation</h4></div></div></div><p>
|
|---|
| 240 | When a user first logs in to a Windows NT workstation, the profile NTuser.DAT is created. The profile
|
|---|
| 241 | location can be now specified through the <a class="indexterm" name="id419206"></a>logon path parameter.
|
|---|
| 242 | </p><p>
|
|---|
| 243 | There is a parameter that is now available for use with NT Profiles: <a class="indexterm" name="id419217"></a>logon drive.
|
|---|
| 244 | This should be set to <code class="filename">H:</code> or any other drive, and should be used in conjunction with
|
|---|
| 245 | the new <a class="indexterm" name="id419230"></a>logon home parameter.
|
|---|
| 246 | </p><p>
|
|---|
| 247 | <a class="indexterm" name="id419241"></a>
|
|---|
| 248 | <a class="indexterm" name="id419247"></a>
|
|---|
| 249 | The entry for the NT4 profile is a directory, not a file. The NT help on profiles mentions that a
|
|---|
| 250 | directory is also created with a .PDS extension. The user, while logging in, must have write permission
|
|---|
| 251 | to create the full profile path (and the folder with the .PDS extension for those situations where it
|
|---|
| 252 | might be created).
|
|---|
| 253 | </p><p>
|
|---|
| 254 | <a class="indexterm" name="id419260"></a>
|
|---|
| 255 | In the profile directory, Windows NT4 creates more folders than Windows 9x/Me. It creates
|
|---|
| 256 | <code class="filename">Application Data</code> and others, as well as <code class="filename">Desktop</code>,
|
|---|
| 257 | <code class="filename">Nethood</code>, <code class="filename">Start Menu,</code> and <code class="filename">Programs</code>.
|
|---|
| 258 | The profile itself is stored in a file <code class="filename">NTuser.DAT</code>. Nothing appears to be stored
|
|---|
| 259 | in the .PDS directory, and its purpose is currently unknown.
|
|---|
| 260 | </p><p>
|
|---|
| 261 | <a class="indexterm" name="id419308"></a>
|
|---|
| 262 | <a class="indexterm" name="id419314"></a>
|
|---|
| 263 | You can use the <span class="application">System Control Panel</span> to copy a local profile onto
|
|---|
| 264 | a Samba server (see NT help on profiles; it is also capable of firing up the correct location in the
|
|---|
| 265 | <span class="application">System Control Panel</span> for you). The NT help file also mentions that renaming
|
|---|
| 266 | <code class="filename">NTuser.DAT</code> to <code class="filename">NTuser.MAN</code> turns a profile into a mandatory one.
|
|---|
| 267 | </p><p>
|
|---|
| 268 | The case of the profile is significant. The file must be called <code class="filename">NTuser.DAT</code>
|
|---|
| 269 | or, for a mandatory profile, <code class="filename">NTuser.MAN</code>.
|
|---|
| 270 | </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id419365"></a>Windows 2000/XP Professional</h4></div></div></div><p>
|
|---|
| 271 | You must first convert the profile from a local profile to a domain profile on the MS Windows
|
|---|
| 272 | workstation as follows: </p><div class="procedure"><ol type="1"><li><p> Log on as the <span class="emphasis"><em>local</em></span> workstation administrator. </p></li><li><p> Right-click on the <span class="guiicon">My Computer</span> icon, and select
|
|---|
| 273 | <span class="guimenuitem">Properties</span>.</p></li><li><p> Click on the <span class="guilabel">User Profiles</span> tab.</p></li><li><p> Select the profile you wish to convert (click it once).</p></li><li><p> Click on the <span class="guibutton">Copy To</span> button.</p></li><li><p> In the <span class="guilabel">Permitted to use</span> box, click on the
|
|---|
| 274 | <span class="guibutton">Change</span> button. </p></li><li><p> Click on the <span class="guilabel">Look in</span> area that lists the machine name. When you click here, it will
|
|---|
| 275 | open up a selection box. Click on the domain to which the profile must be accessible. </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>You will need to log on if a logon box opens up.
|
|---|
| 276 | For example, connect as <em class="replaceable"><code>DOMAIN</code></em>\root, password:
|
|---|
| 277 | <em class="replaceable"><code>mypassword</code></em>.</p></div></li><li><p> To make the profile capable of being used by anyone, select “<span class="quote">Everyone</span>”. </p></li><li><p> Click on <span class="guibutton">OK</span> and the Selection box will close. </p></li><li><p> Now click on <span class="guibutton">OK</span> to create the profile in the path
|
|---|
| 278 | you nominated. </p></li></ol></div><p>
|
|---|
| 279 | Done. You now have a profile that can be edited using the Samba <code class="literal">profiles</code> tool.
|
|---|
| 280 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 281 | Under Windows NT/200x, the use of mandatory profiles forces the use of MS Exchange storage of mail
|
|---|
| 282 | data and keeps it out of the desktop profile. That keeps desktop profiles from becoming unusable.
|
|---|
| 283 | </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id419538"></a>Windows XP Service Pack 1</h5></div></div></div><p>
|
|---|
| 284 | There is a security check new to Windows XP (or maybe only Windows XP service pack 1).
|
|---|
| 285 | It can be disabled via a group policy in the Active Directory. The policy is called:
|
|---|
| 286 | </p><pre class="screen">
|
|---|
| 287 | Computer Configuration\Administrative Templates\System\User Profiles\
|
|---|
| 288 | Do not check for user ownership of Roaming Profile Folders
|
|---|
| 289 | </pre><p>
|
|---|
| 290 | </p><p>
|
|---|
| 291 | This should be set to <code class="constant">Enabled</code>.
|
|---|
| 292 | </p><p>
|
|---|
| 293 | Does the new version of Samba have an Active Directory analogue? If so, then you may be able to set the policy through this.
|
|---|
| 294 | </p><p>If you cannot set group policies in Samba, then you may be able to set the policy locally on
|
|---|
| 295 | each machine. If you want to try this, then do the following:
|
|---|
| 296 | </p><div class="procedure"><ol type="1"><li><p>On the XP workstation, log in with an administrative account.</p></li><li><p>Click on <span class="guimenu">Start</span> -> <span class="guimenuitem">Run</span>.</p></li><li><p>Type <code class="literal">mmc</code>.</p></li><li><p>Click on <span class="guibutton">OK</span>.</p></li><li><p>A Microsoft Management Console should appear.</p></li><li><p>Click on <span class="guimenu">File</span> -> <span class="guimenuitem">Add/Remove Snap-in</span> -> <span class="guimenuitem">Add</span>.</p></li><li><p>Double-click on <span class="guiicon">Group Policy</span>.</p></li><li><p>Click on <span class="guibutton">Finish</span> -> <span class="guibutton">Close</span>.</p></li><li><p>Click on <span class="guibutton">OK</span>.</p></li><li><p>In the “<span class="quote">Console Root</span>” window expand <span class="guiicon">Local Computer Policy</span> ->
|
|---|
| 297 | <span class="guiicon">Computer Configuration</span> -> <span class="guiicon">Administrative Templates</span> ->
|
|---|
| 298 | <span class="guiicon">System</span> -> <span class="guiicon">User Profiles</span>.</p></li><li><p>Double-click on <span class="guilabel">Do not check for user ownership of Roaming Profile Folders</span>.</p></li><li><p>Select <span class="guilabel">Enabled</span>.</p></li><li><p>Click on <span class="guibutton">OK</span>.</p></li><li><p>Close the whole console. You do not need to save the settings (this refers to the
|
|---|
| 299 | console settings rather than the policies you have changed).</p></li><li><p>Reboot.</p></li></ol></div></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id419796"></a>User Profile Hive Cleanup Service</h3></div></div></div><p>
|
|---|
| 300 | There are certain situations that cause a cached local copy of roaming profile not to be deleted on exit, even if
|
|---|
| 301 | the policy to force such deletion is set. To deal with that situation, a special service was created. The application
|
|---|
| 302 | <code class="literal">UPHClean</code> (User Profile Hive Cleanup) can be installed as a service on Windows NT4/2000/XP Professional
|
|---|
| 303 | and Windows 2003.
|
|---|
| 304 | </p><p>
|
|---|
| 305 | The UPHClean software package can be downloaded from the User Profile Hive Cleanup
|
|---|
| 306 | Service<sup>[<a name="id419817" href="#ftn.id419817">7</a>]</sup>
|
|---|
| 307 | web site.
|
|---|
| 308 | </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id419824"></a>Sharing Profiles between Windows 9x/Me and NT4/200x/XP Workstations</h3></div></div></div><p>
|
|---|
| 309 | <a class="indexterm" name="id419832"></a>
|
|---|
| 310 | <a class="indexterm" name="id419839"></a>
|
|---|
| 311 | Sharing of desktop profiles between Windows versions is not recommended. Desktop profiles are an
|
|---|
| 312 | evolving phenomenon, and profiles for later versions of MS Windows clients add features that may interfere
|
|---|
| 313 | with earlier versions of MS Windows clients. Probably the more salient reason to not mix profiles is
|
|---|
| 314 | that when logging off an earlier version of MS Windows, the older format of profile contents may overwrite
|
|---|
| 315 | information that belongs to the newer version, resulting in loss of profile information content when that
|
|---|
| 316 | user logs on again with the newer version of MS Windows.
|
|---|
| 317 | </p><p>
|
|---|
| 318 | If you then want to share the same Start Menu and Desktop with Windows 9x/Me, you must specify a common
|
|---|
| 319 | location for the profiles. The <code class="filename">smb.conf</code> parameters that need to be common are
|
|---|
| 320 | <a class="indexterm" name="id419861"></a>logon path and <a class="indexterm" name="id419868"></a>logon home.
|
|---|
| 321 | </p><p>
|
|---|
| 322 | <a class="indexterm" name="id419879"></a>
|
|---|
| 323 | <a class="indexterm" name="id419886"></a>
|
|---|
| 324 | If you have this set up correctly, you will find separate <code class="filename">user.DAT</code> and
|
|---|
| 325 | <code class="filename">NTuser.DAT</code> files in the same profile directory.
|
|---|
| 326 | </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id419907"></a>Profile Migration from Windows NT4/200x Server to Samba</h3></div></div></div><p>
|
|---|
| 327 | <a class="indexterm" name="id419915"></a>
|
|---|
| 328 | There is nothing to stop you from specifying any path that you like for the location of users' profiles.
|
|---|
| 329 | Therefore, you could specify that the profile be stored on a Samba server or any other SMB server,
|
|---|
| 330 | as long as that SMB server supports encrypted passwords.
|
|---|
| 331 | </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="profilemigrn"></a>Windows NT4 Profile Management Tools</h4></div></div></div><p>
|
|---|
| 332 | <a class="indexterm" name="id419937"></a>
|
|---|
| 333 | Unfortunately, the resource kit information is specific to the version of MS Windows NT4/200x. The
|
|---|
| 334 | correct resource kit is required for each platform.
|
|---|
| 335 | </p><p>Here is a quick guide:</p><div class="procedure"><a name="id419949"></a><p class="title"><b>Procedure 27.1. Profile Migration Procedure</b></p><ol type="1"><li><p> On your NT4 domain controller, right-click on <span class="guiicon">My Computer</span>, then select
|
|---|
| 336 | <span class="guilabel">Properties</span>, then the tab labeled <span class="guilabel">User Profiles</span>. </p></li><li><p> Select a user profile you want to migrate and click on it. </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>I am using the term “<span class="quote">migrate</span>” loosely. You can copy a profile to create a group
|
|---|
| 337 | profile. You can give the user <em class="parameter"><code>Everyone</code></em> rights to the profile you copy this to. That
|
|---|
| 338 | is what you need to do, since your Samba domain is not a member of a trust relationship with your NT4
|
|---|
| 339 | PDC.</p></div></li><li><p>Click on the <span class="guibutton">Copy To</span> button.</p></li><li><p>In the box labeled <span class="guilabel">Copy Profile to</span> add your new path, such as,
|
|---|
| 340 | <code class="filename">c:\temp\foobar</code></p></li><li><p>Click on <span class="guibutton">Change</span> in the <span class="guilabel">Permitted to use</span> box.</p></li><li><p>Click on the group “<span class="quote">Everyone</span>”, click on <span class="guibutton">OK</span>. This
|
|---|
| 341 | closes the “<span class="quote">choose user</span>” box.</p></li><li><p>Now click on <span class="guibutton">OK</span>.</p></li></ol></div><p>
|
|---|
| 342 | Follow these steps for every profile you need to migrate.
|
|---|
| 343 | </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id420091"></a>Side Bar Notes</h4></div></div></div><p>
|
|---|
| 344 | <a class="indexterm" name="id420098"></a>
|
|---|
| 345 | <a class="indexterm" name="id420105"></a>
|
|---|
| 346 | You should obtain the SID of your NT4 domain. You can use the <code class="literal">net rpc info</code> to do this.
|
|---|
| 347 | See <a href="NetCommand.html" title="Chapter 13. Remote and Local Management: The Net Command">The Net Command Chapter</a>, <a href="NetCommand.html#netmisc1" title="Other Miscellaneous Operations">Other Miscellaneous Operations</a> for more information.
|
|---|
| 348 | </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id420140"></a>moveuser.exe</h4></div></div></div><p>
|
|---|
| 349 | <a class="indexterm" name="id420147"></a>
|
|---|
| 350 | The Windows 200x professional resource kit has <code class="literal">moveuser.exe</code>.
|
|---|
| 351 | <code class="literal">moveuser.exe</code> changes the security of a profile from one user to another. This allows the
|
|---|
| 352 | account domain to change and/or the username to change.
|
|---|
| 353 | </p><p>
|
|---|
| 354 | This command is like the Samba <code class="literal">profiles</code> tool.
|
|---|
| 355 | </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id420179"></a>Get SID</h4></div></div></div><p>
|
|---|
| 356 | <a class="indexterm" name="id420187"></a>
|
|---|
| 357 | <a class="indexterm" name="id420193"></a>
|
|---|
| 358 | You can identify the SID by using <code class="literal">GetSID.exe</code> from the Windows NT Server 4.0 Resource Kit.
|
|---|
| 359 | </p><p>
|
|---|
| 360 | Windows NT 4.0 stores the local profile information in the registry under the following key:
|
|---|
| 361 | <code class="filename">HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList</code>
|
|---|
| 362 | </p><p>
|
|---|
| 363 | Under the ProfileList key, there will be subkeys named with the SIDs of the users who have logged
|
|---|
| 364 | on to this computer. (To find the profile information for the user whose locally cached profile you want
|
|---|
| 365 | to move, find the SID for the user with the <code class="literal">GetSID.exe</code> utility.) Inside the appropriate user's subkey,
|
|---|
| 366 | you will see a string value named <em class="parameter"><code>ProfileImagePath</code></em>.
|
|---|
| 367 | </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id420239"></a>Mandatory Profiles</h2></div></div></div><p>
|
|---|
| 368 | <a class="indexterm" name="id420247"></a>
|
|---|
| 369 | A mandatory profile is a profile that the user does not have the ability to overwrite. During the
|
|---|
| 370 | user's session, it may be possible to change the desktop environment; however, as the user logs out, all changes
|
|---|
| 371 | made will be lost. If it is desired to not allow the user any ability to change the desktop environment,
|
|---|
| 372 | then this must be done through policy settings. See <a href="PolicyMgmt.html" title="Chapter 26. System and Account Policies">System and Account
|
|---|
| 373 | Policies</a>.
|
|---|
| 374 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 375 | <a class="indexterm" name="id420268"></a>
|
|---|
| 376 | <a class="indexterm" name="id420275"></a>
|
|---|
| 377 | <a class="indexterm" name="id420282"></a>
|
|---|
| 378 | Under NO circumstances should the profile directory (or its contents) be made read-only because this may
|
|---|
| 379 | render the profile unusable. Where it is essential to make a profile read-only within the UNIX file system,
|
|---|
| 380 | this can be done, but then you absolutely must use the <code class="literal">fake-permissions</code> VFS module to
|
|---|
| 381 | instruct MS Windows NT/200x/XP clients that the Profile has write permission for the user. See <a href="VFS.html#fakeperms" title="fake_perms">fake_perms VFS module</a>.
|
|---|
| 382 | </p></div><p>
|
|---|
| 383 | <a class="indexterm" name="id420308"></a>
|
|---|
| 384 | <a class="indexterm" name="id420315"></a>
|
|---|
| 385 | For MS Windows NT4/200x/XP, the procedure shown in <a href="ProfileMgmt.html#profilemigrn" title="Windows NT4 Profile Management Tools">Profile Migration from Windows
|
|---|
| 386 | NT4/200x Server to Samba</a> can also be used to create mandatory profiles. To convert a group profile into
|
|---|
| 387 | a mandatory profile, simply locate the <code class="filename">NTUser.DAT</code> file in the copied profile and rename
|
|---|
| 388 | it to <code class="filename">NTUser.MAN</code>.
|
|---|
| 389 | </p><p>
|
|---|
| 390 | <a class="indexterm" name="id420346"></a>
|
|---|
| 391 | For MS Windows 9x/Me, it is the <code class="filename">User.DAT</code> file that must be renamed to
|
|---|
| 392 | <code class="filename">User.MAN</code> to effect a mandatory profile.
|
|---|
| 393 | </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id420367"></a>Creating and Managing Group Profiles</h2></div></div></div><p>
|
|---|
| 394 | <a class="indexterm" name="id420375"></a>
|
|---|
| 395 | <a class="indexterm" name="id420382"></a>
|
|---|
| 396 | <a class="indexterm" name="id420389"></a>
|
|---|
| 397 | <a class="indexterm" name="id420396"></a>
|
|---|
| 398 | Most organizations are arranged into departments. There is a nice benefit in this fact, since usually
|
|---|
| 399 | most users in a department require the same desktop applications and the same desktop layout. MS
|
|---|
| 400 | Windows NT4/200x/XP will allow the use of group profiles. A group profile is a profile that is created
|
|---|
| 401 | first using a template (example) user. Then using the profile migration tool (see above), the profile is
|
|---|
| 402 | assigned access rights for the user group that needs to be given access to the group profile.
|
|---|
| 403 | </p><p>
|
|---|
| 404 | <a class="indexterm" name="id420410"></a>
|
|---|
| 405 | The next step is rather important. Instead of assigning a group profile to users (Using User Manager)
|
|---|
| 406 | on a “<span class="quote">per-user</span>” basis, the group itself is assigned the now modified profile.
|
|---|
| 407 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 408 | Be careful with group profiles. If the user who is a member of a group also has a personal
|
|---|
| 409 | profile, then the result will be a fusion (merge) of the two.
|
|---|
| 410 | </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id420430"></a>Default Profile for Windows Users</h2></div></div></div><p>
|
|---|
| 411 | <a class="indexterm" name="id420438"></a>
|
|---|
| 412 | <a class="indexterm" name="id420444"></a>
|
|---|
| 413 | MS Windows 9x/Me and NT4/200x/XP will use a default profile for any user for whom a profile
|
|---|
| 414 | does not already exist. Armed with a knowledge of where the default profile is located on the Windows
|
|---|
| 415 | workstation, and knowing which registry keys affect the path from which the default profile is created,
|
|---|
| 416 | it is possible to modify the default profile to one that has been optimized for the site. This has
|
|---|
| 417 | significant administrative advantages.
|
|---|
| 418 | </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id420460"></a>MS Windows 9x/Me</h3></div></div></div><p>
|
|---|
| 419 | <a class="indexterm" name="id420468"></a>
|
|---|
| 420 | <a class="indexterm" name="id420474"></a>
|
|---|
| 421 | To enable default per-use profiles in Windows 9x/Me, you can either use the <span class="application">Windows
|
|---|
| 422 | 98 System Policy Editor</span> or change the registry directly.
|
|---|
| 423 | </p><p>
|
|---|
| 424 | To enable default per-user profiles in Windows 9x/Me, launch the <span class="application">System Policy
|
|---|
| 425 | Editor</span>, then select <span class="guimenu">File</span> -> <span class="guimenuitem">Open Registry</span>.
|
|---|
| 426 | Next click on the <span class="guiicon">Local Computer</span> icon, click on <span class="guilabel">Windows 98 System</span>,
|
|---|
| 427 | select <span class="guilabel">User Profiles</span>, and click on the enable box. Remember to save the registry
|
|---|
| 428 | changes.
|
|---|
| 429 | </p><p>
|
|---|
| 430 | <a class="indexterm" name="id420532"></a>
|
|---|
| 431 | To modify the registry directly, launch the <span class="application">Registry Editor</span>
|
|---|
| 432 | (<code class="literal">regedit.exe</code>) and select the hive <code class="filename">HKEY_LOCAL_MACHINE\Network\Logon</code>.
|
|---|
| 433 | Now add a DWORD type key with the name “<span class="quote">User Profiles.</span>” To enable user profiles to set the value
|
|---|
| 434 | to 1; to disable user profiles set it to 0.
|
|---|
| 435 | </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id420562"></a>User Profile Handling with Windows 9x/Me</h4></div></div></div><p>
|
|---|
| 436 | When a user logs on to a Windows 9x/Me machine, the local profile path,
|
|---|
| 437 | <code class="filename">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList</code>, is checked
|
|---|
| 438 | for an existing entry for that user.
|
|---|
| 439 | </p><p>
|
|---|
| 440 | If the user has an entry in this registry location, Windows 9x/Me checks for a locally cached
|
|---|
| 441 | version of the user profile. Windows 9x/Me also checks the user's home directory (or other specified
|
|---|
| 442 | directory if the location has been modified) on the server for the user profile. If a profile exists
|
|---|
| 443 | in both locations, the newer of the two is used. If the user profile exists on the server but does not
|
|---|
| 444 | exist on the local machine, the profile on the server is downloaded and used. If the user profile only
|
|---|
| 445 | exists on the local machine, that copy is used.
|
|---|
| 446 | </p><p>
|
|---|
| 447 | If a user profile is not found in either location, the default user profile from the Windows
|
|---|
| 448 | 9x/Me machine is used and copied to a newly created folder for the logged on user. At log off, any
|
|---|
| 449 | changes that the user made are written to the user's local profile. If the user has a roaming profile,
|
|---|
| 450 | the changes are written to the user's profile on the server.
|
|---|
| 451 | </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id420595"></a>MS Windows NT4 Workstation</h3></div></div></div><p>
|
|---|
| 452 | On MS Windows NT4, the default user profile is obtained from the location
|
|---|
| 453 | <code class="filename">%SystemRoot%\Profiles</code>, which in a default installation will translate to
|
|---|
| 454 | <code class="filename">C:\Windows NT\Profiles</code>. Under this directory on a clean install, there will be three
|
|---|
| 455 | directories: <code class="filename">Administrator</code>, <code class="filename">All
|
|---|
| 456 | Users,</code> and <code class="filename">Default
|
|---|
| 457 | User</code>.
|
|---|
| 458 | </p><p>
|
|---|
| 459 | The <code class="filename">All Users</code> directory contains menu settings that are common across all
|
|---|
| 460 | system users. The <code class="filename">Default User</code> directory contains menu entries that are customizable
|
|---|
| 461 | per user depending on the profile settings chosen/created.
|
|---|
| 462 | </p><p>
|
|---|
| 463 | When a new user first logs onto an MS Windows NT4 machine, a new profile is created from:
|
|---|
| 464 | </p><div class="itemizedlist"><ul type="disc"><li><p>All Users settings.</p></li><li><p>Default User settings (contains the default <code class="filename">NTUser.DAT</code> file).</p></li></ul></div><p>
|
|---|
| 465 | <a class="indexterm" name="id420677"></a>
|
|---|
| 466 | When a user logs on to an MS Windows NT4 machine that is a member of a Microsoft security domain,
|
|---|
| 467 | the following steps are followed for profile handling:
|
|---|
| 468 | </p><div class="procedure"><ol type="1"><li><p> The user's account information that is obtained during the logon process
|
|---|
| 469 | contains the location of the user's desktop profile. The profile path may be local to
|
|---|
| 470 | the machine or it may be located on a network share. If there exists a profile at the
|
|---|
| 471 | location of the path from the user account, then this profile is copied to the location
|
|---|
| 472 | <code class="filename">%SystemRoot%\Profiles\%USERNAME%</code>. This profile then inherits the settings
|
|---|
| 473 | in the <code class="filename">All Users</code> profile in the <code class="filename">%SystemRoot%\Profiles</code>
|
|---|
| 474 | location. </p></li><li><p> If the user account has a profile path, but at its location a profile does not
|
|---|
| 475 | exist, then a new profile is created in the <code class="filename">%SystemRoot%\Profiles\%USERNAME%</code>
|
|---|
| 476 | directory from reading the <code class="filename">Default User</code> profile. </p></li><li><p>
|
|---|
| 477 | <a class="indexterm" name="id420747"></a>
|
|---|
| 478 | <a class="indexterm" name="id420754"></a>
|
|---|
| 479 | <a class="indexterm" name="id420761"></a>
|
|---|
| 480 | <a class="indexterm" name="id420768"></a>
|
|---|
| 481 | <a class="indexterm" name="id420774"></a>
|
|---|
| 482 | If the NETLOGON share on the authenticating server (logon server) contains
|
|---|
| 483 | a policy file (<code class="filename">NTConfig.POL</code>), then its contents are applied to the
|
|---|
| 484 | <code class="filename">NTUser.DAT</code>, which is applied to the <code class="filename">HKEY_CURRENT_USER</code>
|
|---|
| 485 | part of the registry.
|
|---|
| 486 | </p></li><li><p> When the user logs out, if the profile is set to be a roaming profile, it will be
|
|---|
| 487 | written out to the location of the profile. The <code class="filename">NTuser.DAT</code> file is then
|
|---|
| 488 | re-created from the contents of the <code class="filename">HKEY_CURRENT_USER</code> contents. Thus,
|
|---|
| 489 | should there not exist in the NETLOGON share an <code class="filename">NTConfig.POL</code> at the next
|
|---|
| 490 | logon, the effect of the previous <code class="filename">NTConfig.POL</code> will still be held in the
|
|---|
| 491 | profile. The effect of this is known as tattooing.
|
|---|
| 492 | </p></li></ol></div><p>
|
|---|
| 493 | MS Windows NT4 profiles may be <span class="emphasis"><em>local</em></span> or <span class="emphasis"><em>roaming</em></span>. A local
|
|---|
| 494 | profile is stored in the <code class="filename">%SystemRoot%\Profiles\%USERNAME%</code> location. A roaming
|
|---|
| 495 | profile will also remain stored in the same way, unless the following registry key is created:
|
|---|
| 496 | </p><pre class="screen">
|
|---|
| 497 | HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\
|
|---|
| 498 | winlogon\"DeleteRoamingCache"=dword:0000000
|
|---|
| 499 | </pre><p>
|
|---|
| 500 | In this case, the local copy (in <code class="filename">%SystemRoot%\Profiles\%USERNAME%</code>) will be deleted
|
|---|
| 501 | on logout.
|
|---|
| 502 | </p><p>
|
|---|
| 503 | <a class="indexterm" name="id420873"></a>
|
|---|
| 504 | Under MS Windows NT4, default locations for common resources like <code class="filename">My Documents</code>
|
|---|
| 505 | may be redirected to a network share by modifying the following registry keys. These changes may be
|
|---|
| 506 | made via use of the System Policy Editor. To do so may require that you create your own template
|
|---|
| 507 | extension for the Policy Editor to allow this to be done through the GUI. Another way to do this is by
|
|---|
| 508 | first creating a default user profile, then while logged in as that user, running <code class="literal">regedt32</code> to edit
|
|---|
| 509 | the key settings.
|
|---|
| 510 | </p><p>
|
|---|
| 511 | The Registry Hive key that affects the behavior of folders that are part of the default user
|
|---|
| 512 | profile are controlled by entries on Windows NT4 is:
|
|---|
| 513 | </p><pre class="screen">
|
|---|
| 514 | HKEY_CURRENT_USER
|
|---|
| 515 | \Software
|
|---|
| 516 | \Microsoft
|
|---|
| 517 | \Windows
|
|---|
| 518 | \CurrentVersion
|
|---|
| 519 | \Explorer
|
|---|
| 520 | \User Shell Folders
|
|---|
| 521 | </pre><p>
|
|---|
| 522 | <a class="indexterm" name="id420906"></a>
|
|---|
| 523 | </p><p> The above hive key contains a list of automatically managed
|
|---|
| 524 | folders. The default entries are shown in <a href="ProfileMgmt.html#ProfileLocs" title="Table 27.1. User Shell Folder Registry Keys Default Values">the next table</a>.
|
|---|
| 525 | </p><div class="table"><a name="ProfileLocs"></a><p class="title"><b>Table 27.1. User Shell Folder Registry Keys Default Values</b></p><div class="table-contents"><table summary="User Shell Folder Registry Keys Default Values" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Name</th><th align="left">Default Value</th></tr></thead><tbody><tr><td align="left">AppData</td><td align="left">%USERPROFILE%\Application Data</td></tr><tr><td align="left">Desktop</td><td align="left">%USERPROFILE%\Desktop</td></tr><tr><td align="left">Favorites</td><td align="left">%USERPROFILE%\Favorites</td></tr><tr><td align="left">NetHood</td><td align="left">%USERPROFILE%\NetHood</td></tr><tr><td align="left">PrintHood</td><td align="left">%USERPROFILE%\PrintHood</td></tr><tr><td align="left">Programs</td><td align="left">%USERPROFILE%\Start Menu\Programs</td></tr><tr><td align="left">Recent</td><td align="left">%USERPROFILE%\Recent</td></tr><tr><td align="left">SendTo</td><td align="left">%USERPROFILE%\SendTo</td></tr><tr><td align="left">Start Menu </td><td align="left">%USERPROFILE%\Start Menu</td></tr><tr><td align="left">Startup</td><td align="left">%USERPROFILE%\Start Menu\Programs\Startup</td></tr></tbody></table></div></div><br class="table-break"><p> The registry key that contains the location of the default profile settings is:
|
|---|
| 526 | </p><pre class="screen">
|
|---|
| 527 | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
|
|---|
| 528 | User Shell Folders
|
|---|
| 529 | </pre><p>
|
|---|
| 530 | </p><p>
|
|---|
| 531 | The default entries are shown in <a href="ProfileMgmt.html#regkeys" title="Table 27.2. Defaults of Profile Settings Registry Keys">Defaults of Profile Settings Registry Keys</a>.
|
|---|
| 532 | </p><div class="table"><a name="regkeys"></a><p class="title"><b>Table 27.2. Defaults of Profile Settings Registry Keys</b></p><div class="table-contents"><table summary="Defaults of Profile Settings Registry Keys" border="1"><colgroup><col align="left"><col align="left"></colgroup><tbody><tr><td align="left">Common Desktop</td><td align="left">%SystemRoot%\Profiles\All Users\Desktop</td></tr><tr><td align="left">Common Programs</td><td align="left">%SystemRoot%\Profiles\All Users\Programs</td></tr><tr><td align="left">Common Start Menu</td><td align="left">%SystemRoot%\Profiles\All Users\Start Menu</td></tr><tr><td align="left">Common Startup</td><td align="left">%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id421121"></a>MS Windows 200x/XP</h3></div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 533 | <a class="indexterm" name="id421130"></a>
|
|---|
| 534 | <a class="indexterm" name="id421136"></a>
|
|---|
| 535 | <a class="indexterm" name="id421143"></a>
|
|---|
| 536 | <a class="indexterm" name="id421150"></a>
|
|---|
| 537 | MS Windows XP Home Edition does use default per-user profiles, but cannot participate
|
|---|
| 538 | in domain security, cannot log onto an NT/ADS-style domain, and thus can obtain the profile only
|
|---|
| 539 | from itself. While there are benefits in doing this, the beauty of those MS Windows clients that
|
|---|
| 540 | can participate in domain logon processes is that they allow the administrator to create a global default
|
|---|
| 541 | profile and enforce it through the use of Group Policy Objects (GPOs).
|
|---|
| 542 | </p></div><p>
|
|---|
| 543 | <a class="indexterm" name="id421164"></a>
|
|---|
| 544 | When a new user first logs onto an MS Windows 200x/XP machine, the default profile is obtained from
|
|---|
| 545 | <code class="filename">C:\Documents and Settings\Default User</code>. The administrator can modify or change the
|
|---|
| 546 | contents of this location, and MS Windows 200x/XP will gladly use it. This is far from the optimum arrangement,
|
|---|
| 547 | since it will involve copying a new default profile to every MS Windows 200x/XP client workstation.
|
|---|
| 548 | </p><p>
|
|---|
| 549 | <a class="indexterm" name="id421183"></a>
|
|---|
| 550 | When MS Windows 200x/XP participates in a domain security context, and if the default user profile is not
|
|---|
| 551 | found, then the client will search for a default profile in the NETLOGON share of the authenticating server.
|
|---|
| 552 | In MS Windows parlance, it is <code class="filename">%LOGONSERVER%\NETLOGON\Default User,</code>
|
|---|
| 553 | and if one exists there, it will copy this to the workstation in the <code class="filename">C:\Documents and
|
|---|
| 554 | Settings\</code> under the Windows login name of the use.
|
|---|
| 555 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> This path translates, in Samba parlance, to the <code class="filename">smb.conf</code>
|
|---|
| 556 | <em class="parameter"><code>[NETLOGON]</code></em> share. The directory should be created at the root
|
|---|
| 557 | of this share and must be called <code class="filename">Default User</code>.
|
|---|
| 558 | </p></div><p> If a default profile does not exist in this location, then MS Windows 200x/XP will use the local
|
|---|
| 559 | default profile. </p><p> On logging out, the user's desktop profile is stored to the location specified in the registry
|
|---|
| 560 | settings that pertain to the user. If no specific policies have been created or passed to the client
|
|---|
| 561 | during the login process (as Samba does automatically), then the user's profile is written to the
|
|---|
| 562 | local machine only under the path <code class="filename">C:\Documents and Settings\%USERNAME%</code>. </p><p> Those wishing to modify the default behavior can do so through these three methods: </p><div class="itemizedlist"><ul type="disc"><li><p> Modify the registry keys on the local machine manually and place the new
|
|---|
| 563 | default profile in the NETLOGON share root. This is not recommended because it is maintenance intensive.
|
|---|
| 564 | </p></li><li><p> Create an NT4-style NTConfig.POL file that specifies this behavior and locate
|
|---|
| 565 | this file in the root of the NETLOGON share along with the new default profile. </p></li><li><p> Create a GPO that enforces this through Active Directory, and place the new
|
|---|
| 566 | default profile in the NETLOGON share. </p></li></ul></div><p>The registry hive key that affects the behavior of folders that are part of the default user
|
|---|
| 567 | profile are controlled by entries on Windows 200x/XP is: </p><p> <code class="filename">HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell
|
|---|
| 568 | Folders\</code> </p><p>
|
|---|
| 569 | This hive key contains a list of automatically managed folders. The default entries are shown
|
|---|
| 570 | in <a href="ProfileMgmt.html#defregpthkeys" title="Table 27.3. Defaults of Default User Profile Paths Registry Keys">the next table</a>
|
|---|
| 571 | <a class="indexterm" name="id421303"></a>
|
|---|
| 572 | </p><div class="table"><a name="defregpthkeys"></a><p class="title"><b>Table 27.3. Defaults of Default User Profile Paths Registry Keys</b></p><div class="table-contents"><table summary="Defaults of Default User Profile Paths Registry Keys" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Name</th><th align="left">Default Value</th></tr></thead><tbody><tr><td align="left">AppData</td><td align="left">%USERPROFILE%\Application Data</td></tr><tr><td align="left">Cache</td><td align="left">%USERPROFILE%\Local Settings\Temporary Internet Files</td></tr><tr><td align="left">Cookies</td><td align="left">%USERPROFILE%\Cookies</td></tr><tr><td align="left">Desktop</td><td align="left">%USERPROFILE%\Desktop</td></tr><tr><td align="left">Favorites</td><td align="left">%USERPROFILE%\Favorites</td></tr><tr><td align="left">History</td><td align="left">%USERPROFILE%\Local Settings\History</td></tr><tr><td align="left">Local AppData</td><td align="left">%USERPROFILE%\Local Settings\Application Data</td></tr><tr><td align="left">Local Settings</td><td align="left">%USERPROFILE%\Local Settings</td></tr><tr><td align="left">My Pictures</td><td align="left">%USERPROFILE%\My Documents\My Pictures</td></tr><tr><td align="left">NetHood</td><td align="left">%USERPROFILE%\NetHood</td></tr><tr><td align="left">Personal</td><td align="left">%USERPROFILE%\My Documents</td></tr><tr><td align="left">PrintHood</td><td align="left">%USERPROFILE%\PrintHood</td></tr><tr><td align="left">Programs</td><td align="left">%USERPROFILE%\Start Menu\Programs</td></tr><tr><td align="left">Recent</td><td align="left">%USERPROFILE%\Recent</td></tr><tr><td align="left">SendTo</td><td align="left">%USERPROFILE%\SendTo</td></tr><tr><td align="left">Start Menu</td><td align="left">%USERPROFILE%\Start Menu</td></tr><tr><td align="left">Startup</td><td align="left">%USERPROFILE%\Start Menu\Programs\Startup</td></tr><tr><td align="left">Templates</td><td align="left">%USERPROFILE%\Templates</td></tr></tbody></table></div></div><br class="table-break"><p> There is also an entry called “<span class="quote">Default</span>” that has no value set. The default entry is
|
|---|
| 573 | of type <code class="constant">REG_SZ</code>; all the others are of type <code class="constant">REG_EXPAND_SZ</code>. </p><p> It makes a huge difference to the speed of handling roaming user profiles if all the folders are
|
|---|
| 574 | stored on a dedicated location on a network server. This means that it will not be necessary to write
|
|---|
| 575 | the Outlook PST file over the network for every login and logout. </p><p>
|
|---|
| 576 | To set this to a network location, you could use the following examples:
|
|---|
| 577 | </p><pre class="screen">
|
|---|
| 578 | %LOGONSERVER%\%USERNAME%\Default Folders
|
|---|
| 579 | </pre><p>
|
|---|
| 580 | This stores the folders in the user's home directory under a directory called <code class="filename">Default
|
|---|
| 581 | Folders</code>. You could also use:
|
|---|
| 582 | </p><pre class="screen">
|
|---|
| 583 | \\<em class="replaceable"><code>SambaServer</code></em>\<em class="replaceable"><code>FolderShare</code></em>\%USERNAME%
|
|---|
| 584 | </pre><p>
|
|---|
| 585 | </p><p>
|
|---|
| 586 | in which case the default folders are stored in the server named <em class="replaceable"><code>SambaServer</code></em>
|
|---|
| 587 | in the share called <em class="replaceable"><code>FolderShare</code></em> under a directory that has the name of the
|
|---|
| 588 | MS Windows user as seen by the Linux/UNIX file system. </p><p> Please note that once you have created a default profile share, you <span class="emphasis"><em>must</em></span> migrate a user's profile
|
|---|
| 589 | (default or custom) to it. </p><p> MS Windows 200x/XP profiles may be <span class="emphasis"><em>local</em></span> or <span class="emphasis"><em>roaming</em></span>.
|
|---|
| 590 | A roaming profile is cached locally unless the following registry key is created:
|
|---|
| 591 |
|
|---|
| 592 | <a class="indexterm" name="id421560"></a>
|
|---|
| 593 | </p><p> </p><pre class="programlisting"> HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\
|
|---|
| 594 | winlogon\"DeleteRoamingCache"=dword:00000001</pre><p>
|
|---|
| 595 | In this case, the local cache copy is deleted on logout.
|
|---|
| 596 | </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id421583"></a>Common Errors</h2></div></div></div><p>
|
|---|
| 597 | The following are some typical errors, problems, and questions that have been asked on the Samba mailing lists.
|
|---|
| 598 | </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id421592"></a>Configuring Roaming Profiles for a Few Users or Groups</h3></div></div></div><p>
|
|---|
| 599 | With Samba-2.2.x, the choice you have is to enable or disable roaming profiles support. It is a
|
|---|
| 600 | global-only setting. The default is to have roaming profiles, and the default path will locate them in
|
|---|
| 601 | the user's home directory.
|
|---|
| 602 | </p><p>
|
|---|
| 603 | If disabled globally, then no one will have roaming profile ability. If enabled and you want it
|
|---|
| 604 | to apply only to certain machines, then on those machines on which roaming profile support is not wanted,
|
|---|
| 605 | it is necessary to disable roaming profile handling in the registry of each such machine.
|
|---|
| 606 | </p><p>
|
|---|
| 607 | With Samba-3, you can have a global profile setting in <code class="filename">smb.conf</code>, and you can override this by
|
|---|
| 608 | per-user settings using the Domain User Manager (as with MS Windows NT4/200x). </p><p> In any case, you can configure only one profile per user. That profile can be either: </p><div class="itemizedlist"><ul type="disc"><li><p>A profile unique to that user.</p></li><li><p>A mandatory profile (one the user cannot change).</p></li><li><p>A group profile (really should be mandatory that is, unchangable).</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id421646"></a>Cannot Use Roaming Profiles</h3></div></div></div><p> A user requested the following: “<span class="quote"> I do not want roaming profiles to be implemented. I want
|
|---|
| 609 | to give users a local profile alone. I am totally lost with this error. For the past
|
|---|
| 610 | two days I tried everything, I googled around but found no useful pointers. Please help me. </span>”</p><p> The choices are: </p><div class="variablelist"><dl><dt><span class="term">Local profiles</span></dt><dd><p> I know of no registry keys that will allow
|
|---|
| 611 | autodeletion of LOCAL profiles on log out.</p></dd><dt><span class="term">Roaming profiles</span></dt><dd><p> As a user logs onto the network, a centrally
|
|---|
| 612 | stored profile is copied to the workstation to form a local profile. This local profile
|
|---|
| 613 | will persist (remain on the workstation disk) unless a registry key is changed that will
|
|---|
| 614 | cause this profile to be automatically deleted on logout. </p></dd></dl></div><p>The roaming profile choices are: </p><div class="variablelist"><dl><dt><span class="term">Personal roaming profiles</span></dt><dd><p> These are typically stored in
|
|---|
| 615 | a profile share on a central (or conveniently located local) server. </p><p> Workstations cache (store) a local copy of the profile. This cached
|
|---|
| 616 | copy is used when the profile cannot be downloaded at next logon. </p></dd><dt><span class="term">Group profiles</span></dt><dd><p>These are loaded from a central profile
|
|---|
| 617 | server.</p></dd><dt><span class="term">Mandatory profiles</span></dt><dd><p> Mandatory profiles can be created for
|
|---|
| 618 | a user as well as for any group that a user is a member of. Mandatory profiles cannot be
|
|---|
| 619 | changed by ordinary users. Only the administrator can change or reconfigure a mandatory
|
|---|
| 620 | profile. </p></dd></dl></div><p> A Windows NT4/200x/XP profile can vary in size from 130KB to very large. Outlook PST files are
|
|---|
| 621 | most often part of the profile and can be many gigabytes in size. On average (in a well controlled environment),
|
|---|
| 622 | roaming profile size of 2MB is a good rule of thumb to use for planning purposes. In an undisciplined
|
|---|
| 623 | environment, I have seen up to 2GB profiles. Users tend to complain when it takes an hour to log onto a
|
|---|
| 624 | workstation, but they harvest the fruits of folly (and ignorance). </p><p> The point of this discussion is to show that roaming profiles and good controls of how they can be
|
|---|
| 625 | changed as well as good discipline make for a problem-free site. </p><p> Microsoft's answer to the PST problem is to store all email in an MS Exchange Server backend. This
|
|---|
| 626 | removes the need for a PST file. </p><p>Local profiles mean: </p><div class="itemizedlist"><ul type="disc"><li><p>If each machine is used by many users, then much local disk storage is needed
|
|---|
| 627 | for local profiles.</p></li><li><p>Every workstation the user logs into has
|
|---|
| 628 | its own profile; these can be very different from machine to machine.</p></li></ul></div><p> On the other hand, use of roaming profiles means: </p><div class="itemizedlist"><ul type="disc"><li><p>The network administrator can control the desktop environment of all users.</p></li><li><p>Use of mandatory profiles drastically reduces network management overheads.</p></li><li><p>In the long run, users will experience fewer problems.</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id421795"></a>Changing the Default Profile</h3></div></div></div><p>“<span class="quote">When the client logs onto the domain controller, it searches
|
|---|
| 629 | for a profile to download. Where do I put this default profile?</span>”</p><p>
|
|---|
| 630 | <a class="indexterm" name="id421808"></a>
|
|---|
| 631 | First, the Samba server needs to be configured as a domain controller. This can be done by
|
|---|
| 632 | setting in <code class="filename">smb.conf</code>: </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id421828"></a><em class="parameter"><code>security = user</code></em></td></tr><tr><td><a class="indexterm" name="id421841"></a><em class="parameter"><code>os level = 32 (or more)</code></em></td></tr><tr><td><a class="indexterm" name="id421853"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr></table><p> There must be a <em class="parameter"><code>[netlogon]</code></em> share that is world readable. It is
|
|---|
| 633 | a good idea to add a logon script to preset printer and drive connections. There is also a facility
|
|---|
| 634 | for automatically synchronizing the workstation time clock with that of the logon server (another good
|
|---|
| 635 | thing to do). </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> To invoke autodeletion of roaming profiles from the local workstation cache (disk storage), use
|
|---|
| 636 | the <span class="application">Group Policy Editor</span> to create a file called <code class="filename">NTConfig.POL</code>
|
|---|
| 637 | with the appropriate entries. This file needs to be located in the <em class="parameter"><code>netlogon</code></em>
|
|---|
| 638 | share root directory.</p></div><p> Windows clients need to be members of the domain. Workgroup machines do not use network logons,
|
|---|
| 639 | so they do not interoperate with domain profiles. </p><p> For roaming profiles, add to <code class="filename">smb.conf</code>: </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id421920"></a><em class="parameter"><code>logon path = \\%N\profiles\%U</code></em></td></tr><tr><td># Default logon drive is Z:</td></tr><tr><td><a class="indexterm" name="id421937"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td># This requires a PROFILES share that is world writable.</td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id421954"></a>Debugging Roaming Profiles and NT4-style Domain Policies</h3></div></div></div><p>
|
|---|
| 640 | Roaming profiles and domain policies are implemented via <code class="literal">USERENV.DLL</code>.
|
|---|
| 641 | Microsoft Knowledge Base articles <a href="http://support.microsoft.com/default.aspx?scid=kb;en-us;221833" target="_top">221833</a> and
|
|---|
| 642 | <a href="http://support.microsoft.com/default.aspx?scid=kb;en-us;154120" target="_top">154120</a>
|
|---|
| 643 | describe how to instruct that DLL to debug the login process.
|
|---|
| 644 | </p></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="PolicyMgmt.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="pam.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 26. System and Account Policies </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 28. PAM-Based Distributed Authentication</td></tr></table></div></body></html>
|
|---|
