- Timestamp:
- May 23, 2008, 6:56:41 AM (17 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.0/docs/htmldocs/Samba3-HOWTO/ProfileMgmt.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 27. Desktop Profile Management</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="The Official Samba-3 HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="PolicyMgmt.html" title="Chapter 26. System and Account Policies"><link rel="next" href="pam.html" title="Chapter 28. PAM-Based Distributed Authentication"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 27. Desktop Profile Management</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="PolicyMgmt.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="pam.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ProfileMgmt"></a>Chapter 27. Desktop Profile Management</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ProfileMgmt.html#id417912">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id417955">Roaming Profiles</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id418003">Samba Configuration for Profile Handling</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id418557">Windows Client Profile Configuration Information</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id419796">User Profile Hive Cleanup Service</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id419824">Sharing Profiles between Windows 9x/Me and NT4/200x/XP Workstations</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id419907">Profile Migration from Windows NT4/200x Server to Samba</a></span></dt></dl></dd><dt><span class="sect1"><a href="ProfileMgmt.html#id420239">Mandatory Profiles</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id420367">Creating and Managing Group Profiles</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id420430">Default Profile for Windows Users</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id420460">MS Windows 9x/Me</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id420595">MS Windows NT4 Workstation</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id421121">MS Windows 200x/XP</a></span></dt></dl></dd><dt><span class="sect1"><a href="ProfileMgmt.html#id421583">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id421592">Configuring Roaming Profiles for a Few Users or Groups</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id421646">Cannot Use Roaming Profiles</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id421795">Changing the Default Profile</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id421954">Debugging Roaming Profiles and NT4-style Domain Policies</a></span></dt></dl></dd></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id417912"></a>Features and Benefits</h2></div></div></div><p>2 <a class="indexterm" name="id4 17920"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 27. Desktop Profile Management</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="PolicyMgmt.html" title="Chapter 26. System and Account Policies"><link rel="next" href="pam.html" title="Chapter 28. PAM-Based Distributed Authentication"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 27. Desktop Profile Management</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="PolicyMgmt.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="pam.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ProfileMgmt"></a>Chapter 27. Desktop Profile Management</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ProfileMgmt.html#id441723">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id441766">Roaming Profiles</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id441814">Samba Configuration for Profile Handling</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id442383">Windows Client Profile Configuration Information</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id443652">User Profile Hive Cleanup Service</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id443680">Sharing Profiles between Windows 9x/Me and NT4/200x/XP Workstations</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id443770">Profile Migration from Windows NT4/200x Server to Samba</a></span></dt></dl></dd><dt><span class="sect1"><a href="ProfileMgmt.html#id444102">Mandatory Profiles</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id444230">Creating and Managing Group Profiles</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id444297">Default Profile for Windows Users</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id444323">MS Windows 9x/Me</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id444459">MS Windows NT4 Workstation</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id444984">MS Windows 200x/XP</a></span></dt></dl></dd><dt><span class="sect1"><a href="ProfileMgmt.html#id445446">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id445456">Configuring Roaming Profiles for a Few Users or Groups</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id445509">Cannot Use Roaming Profiles</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id445658">Changing the Default Profile</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id445812">Debugging Roaming Profiles and NT4-style Domain Policies</a></span></dt></dl></dd></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id441723"></a>Features and Benefits</h2></div></div></div><p> 2 <a class="indexterm" name="id441731"></a> 3 3 Roaming profiles are feared by some, hated by a few, loved by many, and a godsend for 4 4 some administrators. 5 5 </p><p> 6 <a class="indexterm" name="id4 17931"></a>6 <a class="indexterm" name="id441742"></a> 7 7 Roaming profiles allow an administrator to make available a consistent user desktop 8 8 as the user moves from one machine to another. This chapter provides much information 9 9 regarding how to configure and manage roaming profiles. 10 10 </p><p> 11 <a class="indexterm" name="id4 17943"></a>11 <a class="indexterm" name="id441754"></a> 12 12 While roaming profiles might sound like nirvana to some, they are a real and tangible 13 13 problem to others. In particular, users of mobile computing tools, where often there may not … … 15 15 This chapter provides information to help the Samba administrator deal with those 16 16 situations. 17 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id4 17955"></a>Roaming Profiles</h2></div></div></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>17 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id441766"></a>Roaming Profiles</h2></div></div></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 18 18 Roaming profiles support is different for Windows 9x/Me and Windows NT4/200x. 19 19 </p></div><p> … … 21 21 Windows 9x/Me and Windows NT4/200x clients implement these features. 22 22 </p><p> 23 <a class="indexterm" name="id4 17974"></a>23 <a class="indexterm" name="id441785"></a> 24 24 Windows 9x/Me clients send a NetUserGetInfo request to the server to get the user's 25 25 profiles location. However, the response does not have room for a separate … … 27 27 profiles are restricted to being stored in the user's home directory. 28 28 </p><p> 29 <a class="indexterm" name="id4 17987"></a>30 <a class="indexterm" name="id4 17994"></a>29 <a class="indexterm" name="id441798"></a> 30 <a class="indexterm" name="id441805"></a> 31 31 Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields 32 32 including a separate field for the location of the user's profiles. 33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id4 18003"></a>Samba Configuration for Profile Handling</h3></div></div></div><p>33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id441814"></a>Samba Configuration for Profile Handling</h3></div></div></div><p> 34 34 This section documents how to configure Samba for MS Windows client profile support. 35 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id4 18013"></a>NT4/200x User Profiles</h4></div></div></div><p>35 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id441824"></a>NT4/200x User Profiles</h4></div></div></div><p> 36 36 For example, to support Windows NT4/200x clients, set the following in the [global] section of the <code class="filename">smb.conf</code> file: 37 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id4 18034"></a><em class="parameter"><code>logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath</code></em></td></tr></table><p>37 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id441845"></a><em class="parameter"><code>logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath</code></em></td></tr></table><p> 38 38 This is typically implemented like: 39 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id4 18055"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr></table><p>39 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id441865"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr></table><p> 40 40 where “<span class="quote">%L</span>” translates to the name of the Samba server and “<span class="quote">%U</span>” translates to the username. 41 41 </p><p> … … 46 46 semantics of “<span class="quote">%L</span>” and “<span class="quote">%N</span>”, as well as “<span class="quote">%U</span>” and “<span class="quote">%u</span>”. 47 47 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 48 <a class="indexterm" name="id4 18122"></a>49 <a class="indexterm" name="id4 18129"></a>48 <a class="indexterm" name="id441932"></a> 49 <a class="indexterm" name="id441938"></a> 50 50 MS Windows NT/200x clients at times do not disconnect a connection to a server between logons. It is recommended 51 51 to not use the <em class="parameter"><code>homes</code></em> metaservice name as part of the profile share path. 52 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id4 18146"></a>Windows 9x/Me User Profiles</h4></div></div></div><p>53 <a class="indexterm" name="id4 18154"></a>54 <a class="indexterm" name="id4 18160"></a>55 To support Windows 9x/Me clients, you must use the <a class=" indexterm" name="id418168"></a>logon home52 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id441955"></a>Windows 9x/Me User Profiles</h4></div></div></div><p> 53 <a class="indexterm" name="id441963"></a> 54 <a class="indexterm" name="id441970"></a> 55 To support Windows 9x/Me clients, you must use the <a class="link" href="smb.conf.5.html#LOGONHOME">logon home</a> 56 56 parameter. Samba has been fixed so <strong class="userinput"><code>net use /home</code></strong> now works as well and it, too, relies 57 57 on the <em class="parameter"><code>logon home</code></em> parameter. 58 58 </p><p> 59 <a class="indexterm" name="id4 18190"></a>60 <a class="indexterm" name="id4 18197"></a>61 <a class="indexterm" name="id4 18204"></a>59 <a class="indexterm" name="id442003"></a> 60 <a class="indexterm" name="id442010"></a> 61 <a class="indexterm" name="id442017"></a> 62 62 By using the <em class="parameter"><code>logon home</code></em> parameter, you are restricted to putting Windows 9x/Me profiles 63 63 in the user's home directory. But wait! There is a trick you can use. If you set the following in the 64 64 <em class="parameter"><code>[global]</code></em> section of your <code class="filename">smb.conf</code> file: 65 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id4 18236"></a><em class="parameter"><code>logon home = \\%L\%U\.profiles</code></em></td></tr></table><p>65 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id442048"></a><em class="parameter"><code>logon home = \\%L\%U\.profiles</code></em></td></tr></table><p> 66 66 then your Windows 9x/Me clients will dutifully put their clients in a subdirectory 67 67 of your home directory called <code class="filename">.profiles</code> (making them hidden). 68 68 </p><p> 69 <a class="indexterm" name="id4 18259"></a>69 <a class="indexterm" name="id442070"></a> 70 70 Not only that, but <strong class="userinput"><code>net use /home</code></strong> will also work because of a feature in 71 71 Windows 9x/Me. It removes any directory stuff off the end of the home directory area 72 72 and only uses the server and share portion. That is, it looks like you 73 specified <code class="filename">\\%L\%U</code> for <a class=" indexterm" name="id418280"></a>logon home.74 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id4 18289"></a>Mixed Windows Windows 9x/Me and NT4/200x User Profiles</h4></div></div></div><p>73 specified <code class="filename">\\%L\%U</code> for <a class="link" href="smb.conf.5.html#LOGONHOME">logon home</a>. 74 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id442104"></a>Mixed Windows Windows 9x/Me and NT4/200x User Profiles</h4></div></div></div><p> 75 75 You can support profiles for Windows 9x and Windows NT clients by setting both the 76 <a class=" indexterm" name="id418298"></a>logon home and <a class="indexterm" name="id418305"></a>logon pathparameters. For example,77 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id4 18319"></a><em class="parameter"><code>logon home = \\%L\%U\.profiles</code></em></td></tr><tr><td><a class="indexterm" name="id418332"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr></table><p>78 <a class="indexterm" name="id4 18347"></a>76 <a class="link" href="smb.conf.5.html#LOGONHOME">logon home</a> and <a class="link" href="smb.conf.5.html#LOGONPATH">logon path</a> parameters. For example, 77 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id442141"></a><em class="parameter"><code>logon home = \\%L\%U\.profiles</code></em></td></tr><tr><td><a class="indexterm" name="id442153"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr></table><p> 78 <a class="indexterm" name="id442166"></a> 79 79 Windows 9x/Me and NT4 and later profiles should not be stored in the same location because 80 80 Windows NT4 and later will experience problems with mixed profile environments. 81 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id4 18357"></a>Disabling Roaming Profile Support</h4></div></div></div><p>82 <a class="indexterm" name="id4 18365"></a>81 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id442177"></a>Disabling Roaming Profile Support</h4></div></div></div><p> 82 <a class="indexterm" name="id442185"></a> 83 83 The question often asked is, “<span class="quote">How may I enforce use of local profiles?</span>” or 84 84 “<span class="quote">How do I disable roaming profiles?</span>” 85 85 </p><p> 86 <a class="indexterm" name="id4 18383"></a>86 <a class="indexterm" name="id442203"></a> 87 87 There are three ways of doing this: 88 </p><a class="indexterm" name="id4 18392"></a><div class="variablelist"><dl><dt><span class="term">In <code class="filename">smb.conf</code></span></dt><dd><p>88 </p><a class="indexterm" name="id442211"></a><div class="variablelist"><dl><dt><span class="term">In <code class="filename">smb.conf</code></span></dt><dd><p> 89 89 Affect the following settings and ALL clients will be forced to use a local profile: 90 <a class=" indexterm" name="id418418"></a>logon home = and <a class="indexterm" name="id418425"></a>logon path =90 <a class="link" href="smb.conf.5.html#LOGONHOME">logon home = </a> and <a class="link" href="smb.conf.5.html#LOGONPATH">logon path = </a> 91 91 </p><p> 92 92 The arguments to these parameters must be left blank. It is necessary to include the <code class="constant">=</code> sign 93 93 to specifically assign the empty value. 94 94 </p></dd><dt><span class="term">MS Windows Registry:</span></dt><dd><p> 95 <a class="indexterm" name="id4 18450"></a>96 <a class="indexterm" name="id4 18457"></a>95 <a class="indexterm" name="id442277"></a> 96 <a class="indexterm" name="id442283"></a> 97 97 Use the Microsoft Management Console (MMC) <code class="literal">gpedit.msc</code> to instruct your MS Windows XP 98 98 machine to use only a local profile. This, of course, modifies registry settings. The full … … 117 117 about which registry keys to change to enforce use of only local user profiles. 118 118 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 119 <a class="indexterm" name="id4 18544"></a>119 <a class="indexterm" name="id442371"></a> 120 120 The specifics of how to convert a local profile to a roaming profile, or a roaming profile 121 121 to a local one, vary according to the version of MS Windows you are running. Consult the Microsoft MS 122 122 Windows Resource Kit for your version of Windows for specific information. 123 </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id4 18557"></a>Windows Client Profile Configuration Information</h3></div></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id418563"></a>Windows 9x/Me Profile Setup</h4></div></div></div><p>123 </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id442383"></a>Windows Client Profile Configuration Information</h3></div></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id442389"></a>Windows 9x/Me Profile Setup</h4></div></div></div><p> 124 124 When a user first logs in on Windows 9x, the file user.DAT is created, as are folders <code class="filename">Start 125 125 Menu</code>, <code class="filename">Desktop</code>, <code class="filename">Programs</code>, and 126 126 <code class="filename">Nethood</code>. These directories and their contents will be merged with the local versions 127 127 stored in <code class="filename">c:\windows\profiles\username</code> on subsequent logins, taking the most recent from 128 each. You will need to use the <em class="parameter"><code>[global]</code></em> options <a class=" indexterm" name="id418608"></a>preserve case = yes, <a class="indexterm" name="id418615"></a>short preserve case = yes, and <a class="indexterm" name="id418622"></a>case sensitive = noin order to maintain capital letters in shortcuts in any of the128 each. You will need to use the <em class="parameter"><code>[global]</code></em> options <a class="link" href="smb.conf.5.html#PRESERVECASE">preserve case = yes</a>, <a class="link" href="smb.conf.5.html#SHORTPRESERVECASE">short preserve case = yes</a>, and <a class="link" href="smb.conf.5.html#CASESENSITIVE">case sensitive = no</a> in order to maintain capital letters in shortcuts in any of the 129 129 profile folders. 130 130 </p><p> 131 <a class="indexterm" name="id4 18633"></a>132 <a class="indexterm" name="id4 18640"></a>131 <a class="indexterm" name="id442471"></a> 132 <a class="indexterm" name="id442478"></a> 133 133 The <code class="filename">user.DAT</code> file contains all the user's preferences. If you wish to enforce a set of preferences, 134 134 rename their <code class="filename">user.DAT</code> file to <code class="filename">user.MAN</code>, and deny them write access to this file. … … 145 145 <span class="guibutton">OK</span>, and this time allow the computer to reboot. 146 146 </p></li></ol></div><p> 147 <a class="indexterm" name="id4 18758"></a>148 <a class="indexterm" name="id4 18764"></a>149 <a class="indexterm" name="id4 18771"></a>150 <a class="indexterm" name="id4 18778"></a>147 <a class="indexterm" name="id442595"></a> 148 <a class="indexterm" name="id442602"></a> 149 <a class="indexterm" name="id442609"></a> 150 <a class="indexterm" name="id442616"></a> 151 151 Under Windows 9x/Me, profiles are downloaded from the Primary Logon. If you have the Primary Logon 152 152 as “<span class="quote">Client for Novell Networks</span>”, then the profiles and logon script will be downloaded from … … 154 154 be loaded from the local machine a bit against the concept of roaming profiles, it would seem! 155 155 </p><p> 156 <a class="indexterm" name="id4 18801"></a>156 <a class="indexterm" name="id442639"></a> 157 157 You will now find that the Microsoft Networks Login box contains <code class="constant">[user, password, domain]</code> instead 158 158 of just <code class="constant">[user, password]</code>. Type in the Samba server's domain name (or any other domain known to exist, … … 165 165 </p><p> 166 166 Once the Windows 9x/Me client comes up with the desktop, you should be able to examine the 167 contents of the directory specified in the <a class=" indexterm" name="id418844"></a>logon pathon167 contents of the directory specified in the <a class="link" href="smb.conf.5.html#LOGONPATH">logon path</a> on 168 168 the Samba server and verify that the <code class="filename">Desktop</code>, <code class="filename">Start Menu</code>, 169 169 <code class="filename">Programs</code>, and <code class="filename">Nethood</code> folders have been created. 170 170 </p><p> 171 <a class="indexterm" name="id4 18879"></a>172 <a class="indexterm" name="id4 18885"></a>173 <a class="indexterm" name="id4 18892"></a>171 <a class="indexterm" name="id442720"></a> 172 <a class="indexterm" name="id442726"></a> 173 <a class="indexterm" name="id442733"></a> 174 174 These folders will be cached locally on the client and updated when the user logs off (if 175 175 you haven't made them read-only by then). You will find that if the user creates further folders or … … 177 177 directory already on the local client, taking the newest folders and shortcut from each set. 178 178 </p><p> 179 <a class="indexterm" name="id4 18906"></a>180 <a class="indexterm" name="id4 18912"></a>181 <a class="indexterm" name="id4 18919"></a>182 <a class="indexterm" name="id4 18926"></a>179 <a class="indexterm" name="id442746"></a> 180 <a class="indexterm" name="id442753"></a> 181 <a class="indexterm" name="id442760"></a> 182 <a class="indexterm" name="id442767"></a> 183 183 If you have made the folders/files read-only on the Samba server, then you will get errors from 184 184 the Windows 9x/Me machine on logon and logout as it attempts to merge the local and remote profile. … … 186 186 and ownership rights on the profile directory contents, on the Samba server. 187 187 </p><p> 188 <a class="indexterm" name="id4 18939"></a>189 <a class="indexterm" name="id4 18946"></a>190 <a class="indexterm" name="id4 18953"></a>191 <a class="indexterm" name="id4 18960"></a>192 <a class="indexterm" name="id4 18967"></a>188 <a class="indexterm" name="id442780"></a> 189 <a class="indexterm" name="id442787"></a> 190 <a class="indexterm" name="id442794"></a> 191 <a class="indexterm" name="id442801"></a> 192 <a class="indexterm" name="id442808"></a> 193 193 If you have problems creating user profiles, you can reset the user's local desktop cache, as shown below. 194 194 When this user next logs in, the user will be told that he/she is logging in “<span class="quote">for the first … … 211 211 Log off the Windows 9x/Me client. 212 212 </p></li><li><p> 213 Check the contents of the profile path (see <a class=" indexterm" name="id419061"></a>logon path213 Check the contents of the profile path (see <a class="link" href="smb.conf.5.html#LOGONPATH">logon path</a> 214 214 described above) and delete the <code class="filename">user.DAT</code> or <code class="filename">user.MAN</code> 215 215 file for the user, making a backup if required. 216 216 </p></li></ol></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 217 <a class="indexterm" name="id4 19086"></a>217 <a class="indexterm" name="id442930"></a> 218 218 Before deleting the contents of the directory listed in the <em class="parameter"><code>ProfilePath</code></em> 219 219 (this is likely to be <code class="filename">c:\windows\profiles\username)</code>, ask whether the owner has … … 225 225 “<span class="quote">start menu,</span>” and “<span class="quote">programs</span>” folders. 226 226 </p></div><p> 227 <a class="indexterm" name="id4 19141"></a>228 <a class="indexterm" name="id4 19148"></a>229 <a class="indexterm" name="id4 19154"></a>230 <a class="indexterm" name="id4 19161"></a>227 <a class="indexterm" name="id442985"></a> 228 <a class="indexterm" name="id442992"></a> 229 <a class="indexterm" name="id442999"></a> 230 <a class="indexterm" name="id443006"></a> 231 231 If all else fails, increase Samba's debug log levels to between 3 and 10, and/or run a packet 232 232 sniffer program such as ethereal or <code class="literal">netmon.exe</code>, and look for error messages. 233 233 </p><p> 234 <a class="indexterm" name="id4 19179"></a>235 <a class="indexterm" name="id4 19185"></a>234 <a class="indexterm" name="id443023"></a> 235 <a class="indexterm" name="id443030"></a> 236 236 If you have access to an Windows NT4/200x server, then first set up roaming profiles and/or 237 237 netlogons on the Windows NT4/200x server. Make a packet trace, or examine the example packet traces 238 238 provided with Windows NT4/200x server, and see what the differences are with the equivalent Samba trace. 239 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id4 19197"></a>Windows NT4 Workstation</h4></div></div></div><p>239 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id443041"></a>Windows NT4 Workstation</h4></div></div></div><p> 240 240 When a user first logs in to a Windows NT workstation, the profile NTuser.DAT is created. The profile 241 location can be now specified through the <a class=" indexterm" name="id419206"></a>logon pathparameter.242 </p><p> 243 There is a parameter that is now available for use with NT Profiles: <a class=" indexterm" name="id419217"></a>logon drive.241 location can be now specified through the <a class="link" href="smb.conf.5.html#LOGONPATH">logon path</a> parameter. 242 </p><p> 243 There is a parameter that is now available for use with NT Profiles: <a class="link" href="smb.conf.5.html#LOGONDRIVE">logon drive</a>. 244 244 This should be set to <code class="filename">H:</code> or any other drive, and should be used in conjunction with 245 the new <a class=" indexterm" name="id419230"></a>logon homeparameter.246 </p><p> 247 <a class="indexterm" name="id4 19241"></a>248 <a class="indexterm" name="id4 19247"></a>245 the new <a class="link" href="smb.conf.5.html#LOGONHOME">logon home</a> parameter. 246 </p><p> 247 <a class="indexterm" name="id443097"></a> 248 <a class="indexterm" name="id443103"></a> 249 249 The entry for the NT4 profile is a directory, not a file. The NT help on profiles mentions that a 250 250 directory is also created with a .PDS extension. The user, while logging in, must have write permission … … 252 252 might be created). 253 253 </p><p> 254 <a class="indexterm" name="id4 19260"></a>254 <a class="indexterm" name="id443116"></a> 255 255 In the profile directory, Windows NT4 creates more folders than Windows 9x/Me. It creates 256 256 <code class="filename">Application Data</code> and others, as well as <code class="filename">Desktop</code>, … … 259 259 in the .PDS directory, and its purpose is currently unknown. 260 260 </p><p> 261 <a class="indexterm" name="id4 19308"></a>262 <a class="indexterm" name="id4 19314"></a>261 <a class="indexterm" name="id443164"></a> 262 <a class="indexterm" name="id443170"></a> 263 263 You can use the <span class="application">System Control Panel</span> to copy a local profile onto 264 264 a Samba server (see NT help on profiles; it is also capable of firing up the correct location in the … … 268 268 The case of the profile is significant. The file must be called <code class="filename">NTuser.DAT</code> 269 269 or, for a mandatory profile, <code class="filename">NTuser.MAN</code>. 270 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id4 19365"></a>Windows 2000/XP Professional</h4></div></div></div><p>270 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id443221"></a>Windows 2000/XP Professional</h4></div></div></div><p> 271 271 You must first convert the profile from a local profile to a domain profile on the MS Windows 272 272 workstation as follows: </p><div class="procedure"><ol type="1"><li><p> Log on as the <span class="emphasis"><em>local</em></span> workstation administrator. </p></li><li><p> Right-click on the <span class="guiicon">My Computer</span> icon, and select … … 281 281 Under Windows NT/200x, the use of mandatory profiles forces the use of MS Exchange storage of mail 282 282 data and keeps it out of the desktop profile. That keeps desktop profiles from becoming unusable. 283 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id4 19538"></a>Windows XP Service Pack 1</h5></div></div></div><p>283 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id443394"></a>Windows XP Service Pack 1</h5></div></div></div><p> 284 284 There is a security check new to Windows XP (or maybe only Windows XP service pack 1). 285 285 It can be disabled via a group policy in the Active Directory. The policy is called: … … 297 297 <span class="guiicon">Computer Configuration</span> -> <span class="guiicon">Administrative Templates</span> -> 298 298 <span class="guiicon">System</span> -> <span class="guiicon">User Profiles</span>.</p></li><li><p>Double-click on <span class="guilabel">Do not check for user ownership of Roaming Profile Folders</span>.</p></li><li><p>Select <span class="guilabel">Enabled</span>.</p></li><li><p>Click on <span class="guibutton">OK</span>.</p></li><li><p>Close the whole console. You do not need to save the settings (this refers to the 299 console settings rather than the policies you have changed).</p></li><li><p>Reboot.</p></li></ol></div></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id4 19796"></a>User Profile Hive Cleanup Service</h3></div></div></div><p>299 console settings rather than the policies you have changed).</p></li><li><p>Reboot.</p></li></ol></div></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id443652"></a>User Profile Hive Cleanup Service</h3></div></div></div><p> 300 300 There are certain situations that cause a cached local copy of roaming profile not to be deleted on exit, even if 301 301 the policy to force such deletion is set. To deal with that situation, a special service was created. The application … … 304 304 </p><p> 305 305 The UPHClean software package can be downloaded from the User Profile Hive Cleanup 306 Service<sup>[<a name="id4 19817" href="#ftn.id419817">7</a>]</sup>306 Service<sup>[<a name="id443673" href="#ftn.id443673" class="footnote">7</a>]</sup> 307 307 web site. 308 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id4 19824"></a>Sharing Profiles between Windows 9x/Me and NT4/200x/XP Workstations</h3></div></div></div><p>309 <a class="indexterm" name="id4 19832"></a>310 <a class="indexterm" name="id4 19839"></a>308 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id443680"></a>Sharing Profiles between Windows 9x/Me and NT4/200x/XP Workstations</h3></div></div></div><p> 309 <a class="indexterm" name="id443688"></a> 310 <a class="indexterm" name="id443695"></a> 311 311 Sharing of desktop profiles between Windows versions is not recommended. Desktop profiles are an 312 312 evolving phenomenon, and profiles for later versions of MS Windows clients add features that may interfere … … 318 318 If you then want to share the same Start Menu and Desktop with Windows 9x/Me, you must specify a common 319 319 location for the profiles. The <code class="filename">smb.conf</code> parameters that need to be common are 320 <a class=" indexterm" name="id419861"></a>logon path and <a class="indexterm" name="id419868"></a>logon home.321 </p><p> 322 <a class="indexterm" name="id4 19879"></a>323 <a class="indexterm" name="id4 19886"></a>320 <a class="link" href="smb.conf.5.html#LOGONPATH">logon path</a> and <a class="link" href="smb.conf.5.html#LOGONHOME">logon home</a>. 321 </p><p> 322 <a class="indexterm" name="id443742"></a> 323 <a class="indexterm" name="id443748"></a> 324 324 If you have this set up correctly, you will find separate <code class="filename">user.DAT</code> and 325 325 <code class="filename">NTuser.DAT</code> files in the same profile directory. 326 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id4 19907"></a>Profile Migration from Windows NT4/200x Server to Samba</h3></div></div></div><p>327 <a class="indexterm" name="id4 19915"></a>326 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id443770"></a>Profile Migration from Windows NT4/200x Server to Samba</h3></div></div></div><p> 327 <a class="indexterm" name="id443778"></a> 328 328 There is nothing to stop you from specifying any path that you like for the location of users' profiles. 329 329 Therefore, you could specify that the profile be stored on a Samba server or any other SMB server, 330 330 as long as that SMB server supports encrypted passwords. 331 331 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="profilemigrn"></a>Windows NT4 Profile Management Tools</h4></div></div></div><p> 332 <a class="indexterm" name="id4 19937"></a>332 <a class="indexterm" name="id443800"></a> 333 333 Unfortunately, the resource kit information is specific to the version of MS Windows NT4/200x. The 334 334 correct resource kit is required for each platform. 335 </p><p>Here is a quick guide:</p><div class="procedure"><a name="id4 19949"></a><p class="title"><b>Procedure 27.1. Profile Migration Procedure</b></p><ol type="1"><li><p> On your NT4 domain controller, right-click on <span class="guiicon">My Computer</span>, then select335 </p><p>Here is a quick guide:</p><div class="procedure"><a name="id443812"></a><p class="title"><b>Procedure 27.1. Profile Migration Procedure</b></p><ol type="1"><li><p> On your NT4 domain controller, right-click on <span class="guiicon">My Computer</span>, then select 336 336 <span class="guilabel">Properties</span>, then the tab labeled <span class="guilabel">User Profiles</span>. </p></li><li><p> Select a user profile you want to migrate and click on it. </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>I am using the term “<span class="quote">migrate</span>” loosely. You can copy a profile to create a group 337 337 profile. You can give the user <em class="parameter"><code>Everyone</code></em> rights to the profile you copy this to. That … … 341 341 closes the “<span class="quote">choose user</span>” box.</p></li><li><p>Now click on <span class="guibutton">OK</span>.</p></li></ol></div><p> 342 342 Follow these steps for every profile you need to migrate. 343 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id4 20091"></a>Side Bar Notes</h4></div></div></div><p>344 <a class="indexterm" name="id4 20098"></a>345 <a class="indexterm" name="id4 20105"></a>343 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id443953"></a>Side Bar Notes</h4></div></div></div><p> 344 <a class="indexterm" name="id443961"></a> 345 <a class="indexterm" name="id443968"></a> 346 346 You should obtain the SID of your NT4 domain. You can use the <code class="literal">net rpc info</code> to do this. 347 See <a href="NetCommand.html" title="Chapter 13. Remote and Local Management: The Net Command">The Net Command Chapter</a>, <ahref="NetCommand.html#netmisc1" title="Other Miscellaneous Operations">Other Miscellaneous Operations</a> for more information.348 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id4 20140"></a>moveuser.exe</h4></div></div></div><p>349 <a class="indexterm" name="id4 20147"></a>347 See <a class="link" href="NetCommand.html" title="Chapter 13. Remote and Local Management: The Net Command">The Net Command Chapter</a>, <a class="link" href="NetCommand.html#netmisc1" title="Other Miscellaneous Operations">Other Miscellaneous Operations</a> for more information. 348 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id444002"></a>moveuser.exe</h4></div></div></div><p> 349 <a class="indexterm" name="id444010"></a> 350 350 The Windows 200x professional resource kit has <code class="literal">moveuser.exe</code>. 351 351 <code class="literal">moveuser.exe</code> changes the security of a profile from one user to another. This allows the … … 353 353 </p><p> 354 354 This command is like the Samba <code class="literal">profiles</code> tool. 355 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id4 20179"></a>Get SID</h4></div></div></div><p>356 <a class="indexterm" name="id4 20187"></a>357 <a class="indexterm" name="id4 20193"></a>355 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id444042"></a>Get SID</h4></div></div></div><p> 356 <a class="indexterm" name="id444049"></a> 357 <a class="indexterm" name="id444056"></a> 358 358 You can identify the SID by using <code class="literal">GetSID.exe</code> from the Windows NT Server 4.0 Resource Kit. 359 359 </p><p> … … 365 365 to move, find the SID for the user with the <code class="literal">GetSID.exe</code> utility.) Inside the appropriate user's subkey, 366 366 you will see a string value named <em class="parameter"><code>ProfileImagePath</code></em>. 367 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id4 20239"></a>Mandatory Profiles</h2></div></div></div><p>368 <a class="indexterm" name="id4 20247"></a>367 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id444102"></a>Mandatory Profiles</h2></div></div></div><p> 368 <a class="indexterm" name="id444110"></a> 369 369 A mandatory profile is a profile that the user does not have the ability to overwrite. During the 370 370 user's session, it may be possible to change the desktop environment; however, as the user logs out, all changes 371 371 made will be lost. If it is desired to not allow the user any ability to change the desktop environment, 372 then this must be done through policy settings. See <a href="PolicyMgmt.html" title="Chapter 26. System and Account Policies">System and Account372 then this must be done through policy settings. See <a class="link" href="PolicyMgmt.html" title="Chapter 26. System and Account Policies">System and Account 373 373 Policies</a>. 374 374 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 375 <a class="indexterm" name="id4 20268"></a>376 <a class="indexterm" name="id4 20275"></a>377 <a class="indexterm" name="id4 20282"></a>375 <a class="indexterm" name="id444131"></a> 376 <a class="indexterm" name="id444137"></a> 377 <a class="indexterm" name="id444144"></a> 378 378 Under NO circumstances should the profile directory (or its contents) be made read-only because this may 379 379 render the profile unusable. Where it is essential to make a profile read-only within the UNIX file system, 380 380 this can be done, but then you absolutely must use the <code class="literal">fake-permissions</code> VFS module to 381 instruct MS Windows NT/200x/XP clients that the Profile has write permission for the user. See <a href="VFS.html#fakeperms" title="fake_perms">fake_perms VFS module</a>.381 instruct MS Windows NT/200x/XP clients that the Profile has write permission for the user. See <a class="link" href="VFS.html#fakeperms" title="fake_perms">fake_perms VFS module</a>. 382 382 </p></div><p> 383 <a class="indexterm" name="id4 20308"></a>384 <a class="indexterm" name="id4 20315"></a>385 For MS Windows NT4/200x/XP, the procedure shown in <a href="ProfileMgmt.html#profilemigrn" title="Windows NT4 Profile Management Tools">Profile Migration from Windows383 <a class="indexterm" name="id444171"></a> 384 <a class="indexterm" name="id444177"></a> 385 For MS Windows NT4/200x/XP, the procedure shown in <a class="link" href="ProfileMgmt.html#profilemigrn" title="Windows NT4 Profile Management Tools">Profile Migration from Windows 386 386 NT4/200x Server to Samba</a> can also be used to create mandatory profiles. To convert a group profile into 387 387 a mandatory profile, simply locate the <code class="filename">NTUser.DAT</code> file in the copied profile and rename 388 388 it to <code class="filename">NTUser.MAN</code>. 389 389 </p><p> 390 <a class="indexterm" name="id4 20346"></a>390 <a class="indexterm" name="id444208"></a> 391 391 For MS Windows 9x/Me, it is the <code class="filename">User.DAT</code> file that must be renamed to 392 392 <code class="filename">User.MAN</code> to effect a mandatory profile. 393 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id4 20367"></a>Creating and Managing Group Profiles</h2></div></div></div><p>394 <a class="indexterm" name="id4 20375"></a>395 <a class="indexterm" name="id4 20382"></a>396 <a class="indexterm" name="id4 20389"></a>397 <a class="indexterm" name="id4 20396"></a>393 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id444230"></a>Creating and Managing Group Profiles</h2></div></div></div><p> 394 <a class="indexterm" name="id444238"></a> 395 <a class="indexterm" name="id444245"></a> 396 <a class="indexterm" name="id444252"></a> 397 <a class="indexterm" name="id444258"></a> 398 398 Most organizations are arranged into departments. There is a nice benefit in this fact, since usually 399 399 most users in a department require the same desktop applications and the same desktop layout. MS … … 402 402 assigned access rights for the user group that needs to be given access to the group profile. 403 403 </p><p> 404 <a class="indexterm" name="id4 20410"></a>404 <a class="indexterm" name="id444277"></a> 405 405 The next step is rather important. Instead of assigning a group profile to users (Using User Manager) 406 406 on a “<span class="quote">per-user</span>” basis, the group itself is assigned the now modified profile. … … 408 408 Be careful with group profiles. If the user who is a member of a group also has a personal 409 409 profile, then the result will be a fusion (merge) of the two. 410 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id4 20430"></a>Default Profile for Windows Users</h2></div></div></div><p>411 <a class="indexterm" name="id4 20438"></a>412 <a class="indexterm" name="id4 20444"></a>410 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id444297"></a>Default Profile for Windows Users</h2></div></div></div><p> 411 <a class="indexterm" name="id444305"></a> 412 <a class="indexterm" name="id444311"></a> 413 413 MS Windows 9x/Me and NT4/200x/XP will use a default profile for any user for whom a profile 414 414 does not already exist. Armed with a knowledge of where the default profile is located on the Windows … … 416 416 it is possible to modify the default profile to one that has been optimized for the site. This has 417 417 significant administrative advantages. 418 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id4 20460"></a>MS Windows 9x/Me</h3></div></div></div><p>419 <a class="indexterm" name="id4 20468"></a>420 <a class="indexterm" name="id4 20474"></a>418 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id444323"></a>MS Windows 9x/Me</h3></div></div></div><p> 419 <a class="indexterm" name="id444331"></a> 420 <a class="indexterm" name="id444338"></a> 421 421 To enable default per-use profiles in Windows 9x/Me, you can either use the <span class="application">Windows 422 422 98 System Policy Editor</span> or change the registry directly. … … 428 428 changes. 429 429 </p><p> 430 <a class="indexterm" name="id4 20532"></a>430 <a class="indexterm" name="id444395"></a> 431 431 To modify the registry directly, launch the <span class="application">Registry Editor</span> 432 432 (<code class="literal">regedit.exe</code>) and select the hive <code class="filename">HKEY_LOCAL_MACHINE\Network\Logon</code>. 433 433 Now add a DWORD type key with the name “<span class="quote">User Profiles.</span>” To enable user profiles to set the value 434 434 to 1; to disable user profiles set it to 0. 435 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id4 20562"></a>User Profile Handling with Windows 9x/Me</h4></div></div></div><p>435 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id444426"></a>User Profile Handling with Windows 9x/Me</h4></div></div></div><p> 436 436 When a user logs on to a Windows 9x/Me machine, the local profile path, 437 437 <code class="filename">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList</code>, is checked … … 449 449 changes that the user made are written to the user's local profile. If the user has a roaming profile, 450 450 the changes are written to the user's profile on the server. 451 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id4 20595"></a>MS Windows NT4 Workstation</h3></div></div></div><p>451 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id444459"></a>MS Windows NT4 Workstation</h3></div></div></div><p> 452 452 On MS Windows NT4, the default user profile is obtained from the location 453 453 <code class="filename">%SystemRoot%\Profiles</code>, which in a default installation will translate to … … 463 463 When a new user first logs onto an MS Windows NT4 machine, a new profile is created from: 464 464 </p><div class="itemizedlist"><ul type="disc"><li><p>All Users settings.</p></li><li><p>Default User settings (contains the default <code class="filename">NTUser.DAT</code> file).</p></li></ul></div><p> 465 <a class="indexterm" name="id4 20677"></a>465 <a class="indexterm" name="id444540"></a> 466 466 When a user logs on to an MS Windows NT4 machine that is a member of a Microsoft security domain, 467 467 the following steps are followed for profile handling: … … 475 475 exist, then a new profile is created in the <code class="filename">%SystemRoot%\Profiles\%USERNAME%</code> 476 476 directory from reading the <code class="filename">Default User</code> profile. </p></li><li><p> 477 <a class="indexterm" name="id4 20747"></a>478 <a class="indexterm" name="id4 20754"></a>479 <a class="indexterm" name="id4 20761"></a>480 <a class="indexterm" name="id4 20768"></a>481 <a class="indexterm" name="id4 20774"></a>477 <a class="indexterm" name="id444610"></a> 478 <a class="indexterm" name="id444617"></a> 479 <a class="indexterm" name="id444624"></a> 480 <a class="indexterm" name="id444631"></a> 481 <a class="indexterm" name="id444638"></a> 482 482 If the NETLOGON share on the authenticating server (logon server) contains 483 483 a policy file (<code class="filename">NTConfig.POL</code>), then its contents are applied to the … … 501 501 on logout. 502 502 </p><p> 503 <a class="indexterm" name="id4 20873"></a>503 <a class="indexterm" name="id444736"></a> 504 504 Under MS Windows NT4, default locations for common resources like <code class="filename">My Documents</code> 505 505 may be redirected to a network share by modifying the following registry keys. These changes may be … … 520 520 \User Shell Folders 521 521 </pre><p> 522 <a class="indexterm" name="id4 20906"></a>522 <a class="indexterm" name="id444770"></a> 523 523 </p><p> The above hive key contains a list of automatically managed 524 folders. The default entries are shown in <a href="ProfileMgmt.html#ProfileLocs" title="Table 27.1. User Shell Folder Registry Keys Default Values">the next table</a>.524 folders. The default entries are shown in <a class="link" href="ProfileMgmt.html#ProfileLocs" title="Table 27.1. User Shell Folder Registry Keys Default Values">the next table</a>. 525 525 </p><div class="table"><a name="ProfileLocs"></a><p class="title"><b>Table 27.1. User Shell Folder Registry Keys Default Values</b></p><div class="table-contents"><table summary="User Shell Folder Registry Keys Default Values" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Name</th><th align="left">Default Value</th></tr></thead><tbody><tr><td align="left">AppData</td><td align="left">%USERPROFILE%\Application Data</td></tr><tr><td align="left">Desktop</td><td align="left">%USERPROFILE%\Desktop</td></tr><tr><td align="left">Favorites</td><td align="left">%USERPROFILE%\Favorites</td></tr><tr><td align="left">NetHood</td><td align="left">%USERPROFILE%\NetHood</td></tr><tr><td align="left">PrintHood</td><td align="left">%USERPROFILE%\PrintHood</td></tr><tr><td align="left">Programs</td><td align="left">%USERPROFILE%\Start Menu\Programs</td></tr><tr><td align="left">Recent</td><td align="left">%USERPROFILE%\Recent</td></tr><tr><td align="left">SendTo</td><td align="left">%USERPROFILE%\SendTo</td></tr><tr><td align="left">Start Menu </td><td align="left">%USERPROFILE%\Start Menu</td></tr><tr><td align="left">Startup</td><td align="left">%USERPROFILE%\Start Menu\Programs\Startup</td></tr></tbody></table></div></div><br class="table-break"><p> The registry key that contains the location of the default profile settings is: 526 526 </p><pre class="screen"> … … 529 529 </pre><p> 530 530 </p><p> 531 The default entries are shown in <a href="ProfileMgmt.html#regkeys" title="Table 27.2. Defaults of Profile Settings Registry Keys">Defaults of Profile Settings Registry Keys</a>.532 </p><div class="table"><a name="regkeys"></a><p class="title"><b>Table 27.2. Defaults of Profile Settings Registry Keys</b></p><div class="table-contents"><table summary="Defaults of Profile Settings Registry Keys" border="1"><colgroup><col align="left"><col align="left"></colgroup><tbody><tr><td align="left">Common Desktop</td><td align="left">%SystemRoot%\Profiles\All Users\Desktop</td></tr><tr><td align="left">Common Programs</td><td align="left">%SystemRoot%\Profiles\All Users\Programs</td></tr><tr><td align="left">Common Start Menu</td><td align="left">%SystemRoot%\Profiles\All Users\Start Menu</td></tr><tr><td align="left">Common Startup</td><td align="left">%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id4 21121"></a>MS Windows 200x/XP</h3></div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>533 <a class="indexterm" name="id4 21130"></a>534 <a class="indexterm" name="id4 21136"></a>535 <a class="indexterm" name="id4 21143"></a>536 <a class="indexterm" name="id4 21150"></a>531 The default entries are shown in <a class="link" href="ProfileMgmt.html#regkeys" title="Table 27.2. Defaults of Profile Settings Registry Keys">Defaults of Profile Settings Registry Keys</a>. 532 </p><div class="table"><a name="regkeys"></a><p class="title"><b>Table 27.2. Defaults of Profile Settings Registry Keys</b></p><div class="table-contents"><table summary="Defaults of Profile Settings Registry Keys" border="1"><colgroup><col align="left"><col align="left"></colgroup><tbody><tr><td align="left">Common Desktop</td><td align="left">%SystemRoot%\Profiles\All Users\Desktop</td></tr><tr><td align="left">Common Programs</td><td align="left">%SystemRoot%\Profiles\All Users\Programs</td></tr><tr><td align="left">Common Start Menu</td><td align="left">%SystemRoot%\Profiles\All Users\Start Menu</td></tr><tr><td align="left">Common Startup</td><td align="left">%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id444984"></a>MS Windows 200x/XP</h3></div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 533 <a class="indexterm" name="id444993"></a> 534 <a class="indexterm" name="id445000"></a> 535 <a class="indexterm" name="id445006"></a> 536 <a class="indexterm" name="id445013"></a> 537 537 MS Windows XP Home Edition does use default per-user profiles, but cannot participate 538 538 in domain security, cannot log onto an NT/ADS-style domain, and thus can obtain the profile only … … 541 541 profile and enforce it through the use of Group Policy Objects (GPOs). 542 542 </p></div><p> 543 <a class="indexterm" name="id4 21164"></a>543 <a class="indexterm" name="id445027"></a> 544 544 When a new user first logs onto an MS Windows 200x/XP machine, the default profile is obtained from 545 545 <code class="filename">C:\Documents and Settings\Default User</code>. The administrator can modify or change the … … 547 547 since it will involve copying a new default profile to every MS Windows 200x/XP client workstation. 548 548 </p><p> 549 <a class="indexterm" name="id4 21183"></a>549 <a class="indexterm" name="id445046"></a> 550 550 When MS Windows 200x/XP participates in a domain security context, and if the default user profile is not 551 551 found, then the client will search for a default profile in the NETLOGON share of the authenticating server. … … 568 568 Folders\</code> </p><p> 569 569 This hive key contains a list of automatically managed folders. The default entries are shown 570 in <a href="ProfileMgmt.html#defregpthkeys" title="Table 27.3. Defaults of Default User Profile Paths Registry Keys">the next table</a>571 <a class="indexterm" name="id4 21303"></a>570 in <a class="link" href="ProfileMgmt.html#defregpthkeys" title="Table 27.3. Defaults of Default User Profile Paths Registry Keys">the next table</a> 571 <a class="indexterm" name="id445166"></a> 572 572 </p><div class="table"><a name="defregpthkeys"></a><p class="title"><b>Table 27.3. Defaults of Default User Profile Paths Registry Keys</b></p><div class="table-contents"><table summary="Defaults of Default User Profile Paths Registry Keys" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Name</th><th align="left">Default Value</th></tr></thead><tbody><tr><td align="left">AppData</td><td align="left">%USERPROFILE%\Application Data</td></tr><tr><td align="left">Cache</td><td align="left">%USERPROFILE%\Local Settings\Temporary Internet Files</td></tr><tr><td align="left">Cookies</td><td align="left">%USERPROFILE%\Cookies</td></tr><tr><td align="left">Desktop</td><td align="left">%USERPROFILE%\Desktop</td></tr><tr><td align="left">Favorites</td><td align="left">%USERPROFILE%\Favorites</td></tr><tr><td align="left">History</td><td align="left">%USERPROFILE%\Local Settings\History</td></tr><tr><td align="left">Local AppData</td><td align="left">%USERPROFILE%\Local Settings\Application Data</td></tr><tr><td align="left">Local Settings</td><td align="left">%USERPROFILE%\Local Settings</td></tr><tr><td align="left">My Pictures</td><td align="left">%USERPROFILE%\My Documents\My Pictures</td></tr><tr><td align="left">NetHood</td><td align="left">%USERPROFILE%\NetHood</td></tr><tr><td align="left">Personal</td><td align="left">%USERPROFILE%\My Documents</td></tr><tr><td align="left">PrintHood</td><td align="left">%USERPROFILE%\PrintHood</td></tr><tr><td align="left">Programs</td><td align="left">%USERPROFILE%\Start Menu\Programs</td></tr><tr><td align="left">Recent</td><td align="left">%USERPROFILE%\Recent</td></tr><tr><td align="left">SendTo</td><td align="left">%USERPROFILE%\SendTo</td></tr><tr><td align="left">Start Menu</td><td align="left">%USERPROFILE%\Start Menu</td></tr><tr><td align="left">Startup</td><td align="left">%USERPROFILE%\Start Menu\Programs\Startup</td></tr><tr><td align="left">Templates</td><td align="left">%USERPROFILE%\Templates</td></tr></tbody></table></div></div><br class="table-break"><p> There is also an entry called “<span class="quote">Default</span>” that has no value set. The default entry is 573 573 of type <code class="constant">REG_SZ</code>; all the others are of type <code class="constant">REG_EXPAND_SZ</code>. </p><p> It makes a huge difference to the speed of handling roaming user profiles if all the folders are … … 590 590 A roaming profile is cached locally unless the following registry key is created: 591 591 592 <a class="indexterm" name="id4 21560"></a>592 <a class="indexterm" name="id445423"></a> 593 593 </p><p> </p><pre class="programlisting"> HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\ 594 594 winlogon\"DeleteRoamingCache"=dword:00000001</pre><p> 595 595 In this case, the local cache copy is deleted on logout. 596 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id4 21583"></a>Common Errors</h2></div></div></div><p>596 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id445446"></a>Common Errors</h2></div></div></div><p> 597 597 The following are some typical errors, problems, and questions that have been asked on the Samba mailing lists. 598 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id4 21592"></a>Configuring Roaming Profiles for a Few Users or Groups</h3></div></div></div><p>598 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id445456"></a>Configuring Roaming Profiles for a Few Users or Groups</h3></div></div></div><p> 599 599 With Samba-2.2.x, the choice you have is to enable or disable roaming profiles support. It is a 600 600 global-only setting. The default is to have roaming profiles, and the default path will locate them in … … 606 606 </p><p> 607 607 With Samba-3, you can have a global profile setting in <code class="filename">smb.conf</code>, and you can override this by 608 per-user settings using the Domain User Manager (as with MS Windows NT4/200x). </p><p> In any case, you can configure only one profile per user. That profile can be either: </p><div class="itemizedlist"><ul type="disc"><li><p>A profile unique to that user.</p></li><li><p>A mandatory profile (one the user cannot change).</p></li><li><p>A group profile (really should be mandatory that is, unchangable).</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id4 21646"></a>Cannot Use Roaming Profiles</h3></div></div></div><p> A user requested the following: “<span class="quote"> I do not want roaming profiles to be implemented. I want608 per-user settings using the Domain User Manager (as with MS Windows NT4/200x). </p><p> In any case, you can configure only one profile per user. That profile can be either: </p><div class="itemizedlist"><ul type="disc"><li><p>A profile unique to that user.</p></li><li><p>A mandatory profile (one the user cannot change).</p></li><li><p>A group profile (really should be mandatory that is, unchangable).</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id445509"></a>Cannot Use Roaming Profiles</h3></div></div></div><p> A user requested the following: “<span class="quote"> I do not want roaming profiles to be implemented. I want 609 609 to give users a local profile alone. I am totally lost with this error. For the past 610 610 two days I tried everything, I googled around but found no useful pointers. Please help me. </span>”</p><p> The choices are: </p><div class="variablelist"><dl><dt><span class="term">Local profiles</span></dt><dd><p> I know of no registry keys that will allow … … 626 626 removes the need for a PST file. </p><p>Local profiles mean: </p><div class="itemizedlist"><ul type="disc"><li><p>If each machine is used by many users, then much local disk storage is needed 627 627 for local profiles.</p></li><li><p>Every workstation the user logs into has 628 its own profile; these can be very different from machine to machine.</p></li></ul></div><p> On the other hand, use of roaming profiles means: </p><div class="itemizedlist"><ul type="disc"><li><p>The network administrator can control the desktop environment of all users.</p></li><li><p>Use of mandatory profiles drastically reduces network management overheads.</p></li><li><p>In the long run, users will experience fewer problems.</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id4 21795"></a>Changing the Default Profile</h3></div></div></div><p>“<span class="quote">When the client logs onto the domain controller, it searches628 its own profile; these can be very different from machine to machine.</p></li></ul></div><p> On the other hand, use of roaming profiles means: </p><div class="itemizedlist"><ul type="disc"><li><p>The network administrator can control the desktop environment of all users.</p></li><li><p>Use of mandatory profiles drastically reduces network management overheads.</p></li><li><p>In the long run, users will experience fewer problems.</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id445658"></a>Changing the Default Profile</h3></div></div></div><p>“<span class="quote">When the client logs onto the domain controller, it searches 629 629 for a profile to download. Where do I put this default profile?</span>”</p><p> 630 <a class="indexterm" name="id4 21808"></a>630 <a class="indexterm" name="id445672"></a> 631 631 First, the Samba server needs to be configured as a domain controller. This can be done by 632 setting in <code class="filename">smb.conf</code>: </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id4 21828"></a><em class="parameter"><code>security = user</code></em></td></tr><tr><td><a class="indexterm" name="id421841"></a><em class="parameter"><code>os level = 32 (or more)</code></em></td></tr><tr><td><a class="indexterm" name="id421853"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr></table><p> There must be a <em class="parameter"><code>[netlogon]</code></em> share that is world readable. It is632 setting in <code class="filename">smb.conf</code>: </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id445692"></a><em class="parameter"><code>security = user</code></em></td></tr><tr><td><a class="indexterm" name="id445703"></a><em class="parameter"><code>os level = 32 (or more)</code></em></td></tr><tr><td><a class="indexterm" name="id445714"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr></table><p> There must be a <em class="parameter"><code>[netlogon]</code></em> share that is world readable. It is 633 633 a good idea to add a logon script to preset printer and drive connections. There is also a facility 634 634 for automatically synchronizing the workstation time clock with that of the logon server (another good … … 637 637 with the appropriate entries. This file needs to be located in the <em class="parameter"><code>netlogon</code></em> 638 638 share root directory.</p></div><p> Windows clients need to be members of the domain. Workgroup machines do not use network logons, 639 so they do not interoperate with domain profiles. </p><p> For roaming profiles, add to <code class="filename">smb.conf</code>: </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id4 21920"></a><em class="parameter"><code>logon path = \\%N\profiles\%U</code></em></td></tr><tr><td># Default logon drive is Z:</td></tr><tr><td><a class="indexterm" name="id421937"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td># This requires a PROFILES share that is world writable.</td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id421954"></a>Debugging Roaming Profiles and NT4-style Domain Policies</h3></div></div></div><p>639 so they do not interoperate with domain profiles. </p><p> For roaming profiles, add to <code class="filename">smb.conf</code>: </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id445780"></a><em class="parameter"><code>logon path = \\%N\profiles\%U</code></em></td></tr><tr><td># Default logon drive is Z:</td></tr><tr><td><a class="indexterm" name="id445796"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td># This requires a PROFILES share that is world writable.</td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id445812"></a>Debugging Roaming Profiles and NT4-style Domain Policies</h3></div></div></div><p> 640 640 Roaming profiles and domain policies are implemented via <code class="literal">USERENV.DLL</code>. 641 Microsoft Knowledge Base articles <a href="http://support.microsoft.com/default.aspx?scid=kb;en-us;221833" target="_top">221833</a> and642 <a href="http://support.microsoft.com/default.aspx?scid=kb;en-us;154120" target="_top">154120</a>641 Microsoft Knowledge Base articles <a class="ulink" href="http://support.microsoft.com/default.aspx?scid=kb;en-us;221833" target="_top">221833</a> and 642 <a class="ulink" href="http://support.microsoft.com/default.aspx?scid=kb;en-us;154120" target="_top">154120</a> 643 643 describe how to instruct that DLL to debug the login process. 644 644 </p></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="PolicyMgmt.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="pam.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 26. System and Account Policies </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 28. PAM-Based Distributed Authentication</td></tr></table></div></body></html>
Note:
See TracChangeset
for help on using the changeset viewer.
