Ignore:
Timestamp:
Sep 30, 2008, 7:14:08 AM (17 years ago)
Author:
Paul Smedley
Message:

Update source to 3.0.32

File:
1 edited

Legend:

Unmodified
Added
Removed

  • branches/samba-3.0/docs/htmldocs/Samba3-HOWTO/PolicyMgmt.html

    r134 r158  
    1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 26. System and Account Policies</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="AdvancedNetworkManagement.html" title="Chapter 25. Advanced Network Management"><link rel="next" href="ProfileMgmt.html" title="Chapter 27. Desktop Profile Management"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 26. System and Account Policies</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="AdvancedNetworkManagement.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="ProfileMgmt.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="PolicyMgmt"></a>Chapter 26. System and Account Policies</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>&gt;</code></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="PolicyMgmt.html#id440104">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id440199">Creating and Managing System Policies</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id440369">Windows 9x/ME Policies</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id440493">Windows NT4-Style Policy Files</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id440699">MS Windows 200x/XP Professional Policies</a></span></dt></dl></dd><dt><span class="sect1"><a href="PolicyMgmt.html#id441101">Managing Account/User Policies</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id441305">Management Tools</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id441316">Samba Editreg Toolset</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id441392">Windows NT4/200x</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id441429">Samba PDC</a></span></dt></dl></dd><dt><span class="sect1"><a href="PolicyMgmt.html#id441492">System Startup and Logon Processing Overview</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id441634">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id441644">Policy Does Not Work</a></span></dt></dl></dd></dl></div><p>
    2 <a class="indexterm" name="id440093"></a>
     1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 26. System and Account Policies</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="AdvancedNetworkManagement.html" title="Chapter 25. Advanced Network Management"><link rel="next" href="ProfileMgmt.html" title="Chapter 27. Desktop Profile Management"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 26. System and Account Policies</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="AdvancedNetworkManagement.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="ProfileMgmt.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="PolicyMgmt"></a>Chapter 26. System and Account Policies</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>&gt;</code></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="PolicyMgmt.html#id414360">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id414455">Creating and Managing System Policies</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id414625">Windows 9x/ME Policies</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id414749">Windows NT4-Style Policy Files</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id414955">MS Windows 200x/XP Professional Policies</a></span></dt></dl></dd><dt><span class="sect1"><a href="PolicyMgmt.html#id415356">Managing Account/User Policies</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id415561">Management Tools</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id415572">Samba Editreg Toolset</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id415648">Windows NT4/200x</a></span></dt><dt><span class="sect2"><a href="PolicyMgmt.html#id415685">Samba PDC</a></span></dt></dl></dd><dt><span class="sect1"><a href="PolicyMgmt.html#id415748">System Startup and Logon Processing Overview</a></span></dt><dt><span class="sect1"><a href="PolicyMgmt.html#id415889">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="PolicyMgmt.html#id415900">Policy Does Not Work</a></span></dt></dl></dd></dl></div><p>
     2<a class="indexterm" name="id414349"></a>
    33This chapter summarizes the current state of knowledge derived from personal
    44practice and knowledge from Samba mailing list subscribers. Before reproduction
    … …  
    66Where additional information was uncovered through this validation, it is provided
    77also.
    8 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id440104"></a>Features and Benefits</h2></div></div></div><p>
    9 <a class="indexterm" name="id440112"></a>
    10 <a class="indexterm" name="id440119"></a>
    11 <a class="indexterm" name="id440125"></a>
     8</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id414360"></a>Features and Benefits</h2></div></div></div><p>
     9<a class="indexterm" name="id414368"></a>
     10<a class="indexterm" name="id414374"></a>
     11<a class="indexterm" name="id414381"></a>
    1212When MS Windows NT 3.5 was introduced, the hot new topic was the ability to implement
    1313Group Policies for users and groups. Then along came MS Windows NT4 and a few sites
    … …  
    1515(or mistakes) administrators made and then requested help to resolve.
    1616</p><p>
    17 <a class="indexterm" name="id440142"></a>
    18 <a class="indexterm" name="id440148"></a>
    19 <a class="indexterm" name="id440157"></a>
    20 <a class="indexterm" name="id440164"></a>
    21 <a class="indexterm" name="id440171"></a>
     17<a class="indexterm" name="id414397"></a>
     18<a class="indexterm" name="id414404"></a>
     19<a class="indexterm" name="id414413"></a>
     20<a class="indexterm" name="id414420"></a>
     21<a class="indexterm" name="id414426"></a>
    2222By the time that MS Windows 2000 and Active Directory was released, administrators
    2323got the message: Group Policies are a good thing! They can help reduce administrative
    … …  
    2828how to replicate them in a Samba environment.
    2929</p><p>
    30 <a class="indexterm" name="id440188"></a>
     30<a class="indexterm" name="id414443"></a>
    3131Judging by the traffic volume since mid 2002, GPOs have become a standard part of
    3232the deployment in many sites. This chapter reviews techniques and methods that can
    3333be used to exploit opportunities for automation of control over user desktops and
    3434network client workstations.
    35 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id440199"></a>Creating and Managing System Policies</h2></div></div></div><p>
    36 <a class="indexterm" name="id440207"></a>
    37 <a class="indexterm" name="id440214"></a>
    38 <a class="indexterm" name="id440220"></a>
    39 <a class="indexterm" name="id440227"></a>
     35</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id414455"></a>Creating and Managing System Policies</h2></div></div></div><p>
     36<a class="indexterm" name="id414463"></a>
     37<a class="indexterm" name="id414469"></a>
     38<a class="indexterm" name="id414476"></a>
     39<a class="indexterm" name="id414483"></a>
    4040Under MS Windows platforms, particularly those following the release of MS Windows
    4141NT4 and MS Windows 95, it is possible to create a type of file that would be placed
    … …  
    4545affect users, groups of users, or machines.
    4646</p><p>
    47 <a class="indexterm" name="id440241"></a>
    48 <a class="indexterm" name="id440248"></a>
    49 <a class="indexterm" name="id440255"></a>
     47<a class="indexterm" name="id414497"></a>
     48<a class="indexterm" name="id414504"></a>
     49<a class="indexterm" name="id414511"></a>
    5050For MS Windows 9x/Me, this file must be called <code class="filename">Config.POL</code> and may
    5151be generated using a tool called <code class="filename">poledit.exe</code>, better known as the
    … …  
    5555a part of the MS Windows Me Resource Kit.
    5656</p><p>
    57 <a class="indexterm" name="id440280"></a>
     57<a class="indexterm" name="id414536"></a>
    5858MS Windows NT4 server products include the <span class="emphasis"><em>System Policy Editor</em></span>
    5959under <span class="guimenu">Start -&gt; Programs -&gt; Administrative Tools</span>.
    6060For MS Windows NT4 and later clients, this file must be called <code class="filename">NTConfig.POL</code>.
    6161</p><p>
    62 <a class="indexterm" name="id440307"></a>
     62<a class="indexterm" name="id414563"></a>
    6363New with the introduction of MS Windows 2000 was the Microsoft Management Console
    6464or MMC. This tool is the new wave in the ever-changing landscape of Microsoft
    … …  
    6868be a step forward, but improved functionality comes at a great price.
    6969</p><p>
    70 <a class="indexterm" name="id440321"></a>
    71 <a class="indexterm" name="id440327"></a>
    72 <a class="indexterm" name="id440334"></a>
    73 <a class="indexterm" name="id440341"></a>
     70<a class="indexterm" name="id414576"></a>
     71<a class="indexterm" name="id414583"></a>
     72<a class="indexterm" name="id414590"></a>
     73<a class="indexterm" name="id414597"></a>
    7474Before embarking on the configuration of network and system policies, it is highly
    7575advisable to read the documentation available from Microsoft's Web site regarding
    … …  
    8181What follows is a brief discussion with some helpful notes. The information provided
    8282here is incomplete  you are warned.
    83 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id440369"></a>Windows 9x/ME Policies</h3></div></div></div><p>
    84 <a class="indexterm" name="id440377"></a>
    85 <a class="indexterm" name="id440383"></a>
     83</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id414625"></a>Windows 9x/ME Policies</h3></div></div></div><p>
     84<a class="indexterm" name="id414633"></a>
     85<a class="indexterm" name="id414639"></a>
    8686        You need the Windows 98 Group Policy Editor to set up Group Profiles under Windows 9x/Me.
    8787        It can be found on the original full-product Windows 98 installation CD-ROM under
    … …  
    8989        Add/Remove Programs facility, and then click on <span class="guiicon">Have Disk</span>.
    9090        </p><p>
    91 <a class="indexterm" name="id440408"></a>
    92 <a class="indexterm" name="id440414"></a>
     91<a class="indexterm" name="id414663"></a>
     92<a class="indexterm" name="id414670"></a>
    9393        Use the Group Policy Editor to create a policy file that specifies the location of
    9494        user profiles and/or <code class="filename">My Documents</code>, and so on. Then save these
    … …  
    100100        Further details are covered in the Windows 98 Resource Kit documentation.
    101101        </p><p>
    102 <a class="indexterm" name="id440449"></a>
     102<a class="indexterm" name="id414705"></a>
    103103        If you do not take the correct steps, then every so often Windows 9x/Me will check the
    104104        integrity of the registry and restore its settings from the backup
    … …  
    106106        occasionally notice things changing back to the original settings.
    107107        </p><p>
    108 <a class="indexterm" name="id440462"></a>
    109 <a class="indexterm" name="id440469"></a>
     108<a class="indexterm" name="id414718"></a>
     109<a class="indexterm" name="id414725"></a>
    110110        Install the Group Policy handler for Windows 9x/Me to pick up Group Policies. Look on the
    111111        Windows 98 CD-ROM in <code class="filename">\tools\reskit\netadmin\poledit</code>.
    … …  
    114114        if Windows 98 picks up Group Policies. Unfortunately, this needs to be done on every
    115115        Windows 9x/Me machine that uses Group Policies.
    116         </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id440493"></a>Windows NT4-Style Policy Files</h3></div></div></div><p>
    117 <a class="indexterm" name="id440501"></a>
    118 <a class="indexterm" name="id440508"></a>
    119 <a class="indexterm" name="id440514"></a>
    120 <a class="indexterm" name="id440521"></a>
     116        </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id414749"></a>Windows NT4-Style Policy Files</h3></div></div></div><p>
     117<a class="indexterm" name="id414757"></a>
     118<a class="indexterm" name="id414763"></a>
     119<a class="indexterm" name="id414770"></a>
     120<a class="indexterm" name="id414777"></a>
    121121        To create or edit <code class="filename">ntconfig.pol</code>, you must use the NT Server
    122122        Policy Editor, <code class="literal">poledit.exe</code>, which is included with NT4 Server
    … …  
    127127        the NT Server will run happily enough on an NT4 workstation.
    128128        </p><p>
    129 <a class="indexterm" name="id440547"></a>
    130 <a class="indexterm" name="id440554"></a>
    131 <a class="indexterm" name="id440560"></a>
    132 <a class="indexterm" name="id440567"></a>
     129<a class="indexterm" name="id414803"></a>
     130<a class="indexterm" name="id414809"></a>
     131<a class="indexterm" name="id414816"></a>
     132<a class="indexterm" name="id414823"></a>
    133133        You need <code class="filename">poledit.exe</code>, <code class="filename">common.adm</code>, and <code class="filename">winnt.adm</code>.
    134134        It is convenient to put the two <code class="filename">*.adm</code> files in  the <code class="filename">c:\winnt\inf</code>
    … …  
    136136        directory is normally &#8220;<span class="quote">hidden.</span>&#8221;
    137137        </p><p>
    138 <a class="indexterm" name="id440612"></a>
    139 <a class="indexterm" name="id440618"></a>
    140 <a class="indexterm" name="id440625"></a>
    141 <a class="indexterm" name="id440632"></a>
     138<a class="indexterm" name="id414867"></a>
     139<a class="indexterm" name="id414874"></a>
     140<a class="indexterm" name="id414881"></a>
     141<a class="indexterm" name="id414888"></a>
    142142        The Windows NT Policy Editor is also included with the Service Pack 3 (and
    143143        later) for Windows NT 4.0. Extract the files using <code class="literal">servicepackname /x</code>
    … …  
    147147        files for Office97 and get a copy of the Policy Editor. Another possible
    148148        location is with the Zero Administration Kit available for download from Microsoft.
    149         </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id440664"></a>Registry Spoiling</h4></div></div></div><p>
    150 <a class="indexterm" name="id440672"></a>
    151 <a class="indexterm" name="id440679"></a>
     149        </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id414920"></a>Registry Spoiling</h4></div></div></div><p>
     150<a class="indexterm" name="id414928"></a>
     151<a class="indexterm" name="id414934"></a>
    152152                        With NT4-style registry-based policy changes, a large number of settings are not
    153153                        automatically reversed as the user logs off. The settings that were in the
    … …  
    156156                        as tattooing. It can have serious consequences downstream, and the administrator must
    157157                        be extremely careful not to lock out the ability to manage the machine at a later date.
    158                         </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id440699"></a>MS Windows 200x/XP Professional Policies</h3></div></div></div><p>
    159 <a class="indexterm" name="id440707"></a>
     158                        </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id414955"></a>MS Windows 200x/XP Professional Policies</h3></div></div></div><p>
     159<a class="indexterm" name="id414963"></a>
    160160        Windows NT4 system policies allow the setting of registry parameters specific to
    161161        users, groups, and computers (client workstations) that are members of the NT4-style
    … …  
    166166        to create them is different, and the mechanism for implementing them is much improved.
    167167        </p><p>
    168         <a class="indexterm" name="id440725"></a>
    169 <a class="indexterm" name="id440731"></a>
     168        <a class="indexterm" name="id414980"></a>
     169<a class="indexterm" name="id414987"></a>
    170170        The older NT4-style registry-based policies are known as <span class="emphasis"><em>Administrative Templates</em></span>
    171171        in MS Windows 2000/XP GPOs. The latter includes the ability to set various security
    … …  
    176176        users and/or groups.
    177177        </p><p>
    178 <a class="indexterm" name="id440756"></a>
    179 <a class="indexterm" name="id440762"></a>
    180 <a class="indexterm" name="id440769"></a>
     178<a class="indexterm" name="id415011"></a>
     179<a class="indexterm" name="id415018"></a>
     180<a class="indexterm" name="id415025"></a>
    181181        Remember, NT4 policy files are named <code class="filename">NTConfig.POL</code> and are stored in the root
    182182        of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username and password
    … …  
    185185        the authenticating server and modifies the local registry values according to the settings in this file.
    186186        </p><p>
    187 <a class="indexterm" name="id440795"></a>
    188 <a class="indexterm" name="id440801"></a>
    189 <a class="indexterm" name="id440808"></a>
    190 <a class="indexterm" name="id440815"></a>
    191 <a class="indexterm" name="id440822"></a>
    192 <a class="indexterm" name="id440828"></a>
    193 <a class="indexterm" name="id440837"></a>
    194 <a class="indexterm" name="id440846"></a>
     187<a class="indexterm" name="id415050"></a>
     188<a class="indexterm" name="id415057"></a>
     189<a class="indexterm" name="id415064"></a>
     190<a class="indexterm" name="id415071"></a>
     191<a class="indexterm" name="id415077"></a>
     192<a class="indexterm" name="id415084"></a>
     193<a class="indexterm" name="id415093"></a>
     194<a class="indexterm" name="id415102"></a>
    195195        Windows 200x GPOs are feature-rich. They are not stored in the NETLOGON share, but rather part of
    196196        a Windows 200x policy file is stored in the Active Directory itself and the other part is stored
    … …  
    200200        known as the Group Policy Template (GPT).
    201201        </p><p>
    202 <a class="indexterm" name="id440861"></a>
     202<a class="indexterm" name="id415117"></a>
    203203        With NT4 clients, the policy file is read and executed only as each user logs onto the network.
    204204        MS Windows 200x policies are much more complex  GPOs are processed and applied at client machine
    … …  
    208208        the administrator to also set filters over the policy settings. No such equivalent capability
    209209        exists with NT4-style policy files.
    210         </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id440878"></a>Administration of Windows 200x/XP Policies</h4></div></div></div><p>
    211                 <a class="indexterm" name="id440885"></a>
    212                 <a class="indexterm" name="id440892"></a>
    213 <a class="indexterm" name="id440899"></a>
    214 <a class="indexterm" name="id440905"></a>
    215 <a class="indexterm" name="id440912"></a>
     210        </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id415134"></a>Administration of Windows 200x/XP Policies</h4></div></div></div><p>
     211                <a class="indexterm" name="id415141"></a>
     212                <a class="indexterm" name="id415148"></a>
     213<a class="indexterm" name="id415154"></a>
     214<a class="indexterm" name="id415161"></a>
     215<a class="indexterm" name="id415168"></a>
    216216                Instead of using the tool called <span class="application">the System Policy Editor</span>, commonly called Poledit (from the
    217217                executable name <code class="literal">poledit.exe</code>), <acronym class="acronym">GPOs</acronym> are created and managed using a
    … …  
    220220                        and select the MMC snap-in called <span class="guimenuitem">Active Directory Users and Computers</span>
    221221                        </p></li><li><p>
    222 <a class="indexterm" name="id440973"></a>
     222<a class="indexterm" name="id415229"></a>
    223223                        Select the domain or organizational unit (OU) that you wish to manage, then right-click
    224224                        to open the context menu for that object, and select the <span class="guibutton">Properties</span>.
    … …  
    238238                version of MS Windows.
    239239                </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
    240 <a class="indexterm" name="id441030"></a>
    241 <a class="indexterm" name="id441037"></a>
    242 <a class="indexterm" name="id441044"></a>
     240<a class="indexterm" name="id415286"></a>
     241<a class="indexterm" name="id415293"></a>
     242<a class="indexterm" name="id415300"></a>
    243243                The MS Windows 2000 Resource Kit contains a tool called <code class="literal">gpolmig.exe</code>. This tool can be used
    244244                to migrate an NT4 <code class="filename">NTConfig.POL</code> file into a Windows 200x style GPO. Be VERY careful how you
    245245                use this powerful tool. Please refer to the resource kit manuals for specific usage information.
    246                 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id441068"></a>Custom System Policy Templates</h4></div></div></div><p>
     246                </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id415324"></a>Custom System Policy Templates</h4></div></div></div><p>
    247247                Over the past year, there has been a bit of talk regarding the creation of customized
    248248                templates for the Windows Sytem Policy Editor. A recent announcement on the Samba mailing
    … …  
    257257                For further information please see the <a class="ulink" href="http://www.pcc-services.com/custom_poledit.html" target="_top">Petersen</a> Computer Consulting web site. There is
    258258                a download link for the template file.
    259                 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id441101"></a>Managing Account/User Policies</h2></div></div></div><p>
    260 <a class="indexterm" name="id441109"></a>
    261 <a class="indexterm" name="id441115"></a>
    262 <a class="indexterm" name="id441122"></a>
     259                </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id415356"></a>Managing Account/User Policies</h2></div></div></div><p>
     260<a class="indexterm" name="id415364"></a>
     261<a class="indexterm" name="id415371"></a>
     262<a class="indexterm" name="id415378"></a>
    263263Policies can define a specific user's settings or the settings for a group of users. The resulting
    264264policy file contains the registry settings for all users, groups, and computers that will be using
    265265the policy file. Separate policy files for each user, group, or computer are not necessary.
    266266</p><p>
    267 <a class="indexterm" name="id441135"></a>
     267<a class="indexterm" name="id415390"></a>
    268268If you create a policy that will be automatically downloaded from validating domain controllers,
    269269you should name the file <code class="filename">NTConfig.POL</code>. As system administrator, you have the option of renaming the
    … …  
    273273but if a change is necessary to all machines, it must be made individually to each workstation.
    274274</p><p>
    275 <a class="indexterm" name="id441156"></a>
    276 <a class="indexterm" name="id441162"></a>
     275<a class="indexterm" name="id415411"></a>
     276<a class="indexterm" name="id415418"></a>
    277277When a Windows NT4/200x/XP machine logs onto the network, the client looks in the NETLOGON share on
    278278the authenticating domain controller for the presence of the <code class="filename">NTConfig.POL</code> file. If one exists, it is
    279279downloaded, parsed, and then applied to the user's part of the registry.
    280280</p><p>
    281 <a class="indexterm" name="id441181"></a>
    282 <a class="indexterm" name="id441187"></a>
    283 <a class="indexterm" name="id441194"></a>
    284 <a class="indexterm" name="id441201"></a>
     281<a class="indexterm" name="id415436"></a>
     282<a class="indexterm" name="id415443"></a>
     283<a class="indexterm" name="id415450"></a>
     284<a class="indexterm" name="id415456"></a>
    285285MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally
    286286acquire policy settings through GPOs that are defined and stored in Active Directory
    … …  
    288288This has considerable advantage compared with the use of <code class="filename">NTConfig.POL</code> (NT4) style policy updates.
    289289</p><p>
    290 <a class="indexterm" name="id441224"></a>
    291 <a class="indexterm" name="id441230"></a>
     290<a class="indexterm" name="id415479"></a>
     291<a class="indexterm" name="id415486"></a>
    292292In addition to user access controls that may be imposed or applied via system and/or group policies
    293293in a manner that works in conjunction with user profiles, the user management environment under
    … …  
    295295Common restrictions that are frequently used include:
    296296</p><p>
    297 <a class="indexterm" name="id441243"></a>
     297<a class="indexterm" name="id415499"></a>
    298298</p><div class="itemizedlist"><ul type="disc"><li><p>Logon hours</p></li><li><p>Password aging</p></li><li><p>Permitted logon from certain machines only</p></li><li><p>Account type (local or global)</p></li><li><p>User rights</p></li></ul></div><p>
    299299</p><p>
    300 <a class="indexterm" name="id441280"></a>
    301 <a class="indexterm" name="id441286"></a>
     300<a class="indexterm" name="id415535"></a>
     301<a class="indexterm" name="id415542"></a>
    302302Samba-3.0.20 does not yet implement all account controls that are common to MS Windows NT4/200x/XP.
    303303While it is possible to set many controls using the Domain User Manager for MS Windows NT4, only password
    … …  
    305305that may eventually be completed to provide actual control. Do not be misled by the fact that a
    306306parameter can be set using the NT4 Domain User Manager or in the <code class="filename">NTConfig.POL</code>.
    307 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id441305"></a>Management Tools</h2></div></div></div><p>
     307</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id415561"></a>Management Tools</h2></div></div></div><p>
    308308Anyone who wishes to create or manage Group Policies will need to be familiar with a number of tools.
    309309The following sections describe a few key tools that will help you to create a low-maintenance user
    310310environment.
    311 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id441316"></a>Samba Editreg Toolset</h3></div></div></div><p>
    312         <a class="indexterm" name="id441324"></a>
    313         <a class="indexterm" name="id441330"></a>
    314         <a class="indexterm" name="id441337"></a>
     311</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id415572"></a>Samba Editreg Toolset</h3></div></div></div><p>
     312        <a class="indexterm" name="id415579"></a>
     313        <a class="indexterm" name="id415586"></a>
     314        <a class="indexterm" name="id415593"></a>
    315315        A new tool called <code class="literal">editreg</code> is under development. This tool can be used
    316316        to edit registry files (called <code class="filename">NTUser.DAT</code>) that are stored in user
    … …  
    321321        to realize this capability, so do not be surprised if this feature does not materialize. Formal
    322322        capabilities will be announced at the time that this tool is released for production use.
    323         </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id441392"></a>Windows NT4/200x</h3></div></div></div><p>
    324 <a class="indexterm" name="id441400"></a>
    325 <a class="indexterm" name="id441407"></a>
    326 <a class="indexterm" name="id441414"></a>
     323        </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id415648"></a>Windows NT4/200x</h3></div></div></div><p>
     324<a class="indexterm" name="id415656"></a>
     325<a class="indexterm" name="id415663"></a>
     326<a class="indexterm" name="id415669"></a>
    327327        The tools that may be used to configure these types of controls from the MS Windows environment are
    328328        the NT4 User Manager for Domains, the NT4 System and Group Policy Editor, and the Registry Editor (regedt32.exe).
    329329        Under MS Windows 200x/XP, this is done using the MMC with appropriate
    330330        &#8220;<span class="quote">snap-ins,</span>&#8221; the registry editor, and potentially also the NT4 System and Group Policy Editor.
    331         </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id441429"></a>Samba PDC</h3></div></div></div><p>
    332 <a class="indexterm" name="id441437"></a>
    333 <a class="indexterm" name="id441444"></a>
    334 <a class="indexterm" name="id441450"></a>
    335 <a class="indexterm" name="id441457"></a>
     331        </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id415685"></a>Samba PDC</h3></div></div></div><p>
     332<a class="indexterm" name="id415693"></a>
     333<a class="indexterm" name="id415699"></a>
     334<a class="indexterm" name="id415706"></a>
     335<a class="indexterm" name="id415713"></a>
    336336        With a Samba domain controller, the new tools for managing user account and policy information include:
    337337        <code class="literal">smbpasswd</code>, <code class="literal">pdbedit</code>, <code class="literal">net</code>, and <code class="literal">rpcclient</code>.
    338338        The administrator should read the man pages for these tools and become familiar with their use.
    339         </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id441492"></a>System Startup and Logon Processing Overview</h2></div></div></div><p>
     339        </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id415748"></a>System Startup and Logon Processing Overview</h2></div></div></div><p>
    340340The following attempts to document the order of processing the system and user policies following a system
    341341reboot and as part of the user logon:
    342342</p><div class="orderedlist"><ol type="1"><li><p>
    343 <a class="indexterm" name="id441512"></a>
    344 <a class="indexterm" name="id441522"></a>
     343<a class="indexterm" name="id415768"></a>
     344<a class="indexterm" name="id415778"></a>
    345345        Network starts, then Remote Procedure Call System Service (RPCSS) and multiple universal naming
    346346        convention provider (MUP) start.
    347347        </p></li><li><p>
    348 <a class="indexterm" name="id441536"></a>
    349 <a class="indexterm" name="id441543"></a>
     348<a class="indexterm" name="id415792"></a>
     349<a class="indexterm" name="id415799"></a>
    350350        Where Active Directory is involved, an ordered list of GPOs is downloaded
    351351        and applied. The list may include GPOs that:
    … …  
    372372        The user interface as determined from the GPOs is presented. Note: In a Samba domain (like an NT4
    373373        domain), machine (system) policies are applied at startup; user policies are applied at logon.
    374         </p></li></ol></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id441634"></a>Common Errors</h2></div></div></div><p>
     374        </p></li></ol></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id415889"></a>Common Errors</h2></div></div></div><p>
    375375Policy-related problems can be quite difficult to diagnose and even more difficult to rectify. The following
    376376collection demonstrates only basic issues.
    377 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id441644"></a>Policy Does Not Work</h3></div></div></div><p>
     377</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id415900"></a>Policy Does Not Work</h3></div></div></div><p>
    378378&#8220;<span class="quote">We have created the <code class="filename">Config.POL</code> file and put it in the <span class="emphasis"><em>NETLOGON</em></span> share.
    379379It has made no difference to our Win XP Pro machines, they just do not see it. It worked fine with Win 98 but does not
Note: See TracChangeset for help on using the changeset viewer.