- Timestamp:
- Mar 1, 2010, 3:05:48 PM (15 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.3.x/docs/htmldocs/Samba3-ByExample/ntmigration.html
r368 r411 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 5.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter 8. Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 9. Migrating NT4 Domain to Samba-3"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter 9. Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id2607394">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2607479">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2607534">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2607720">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2608043">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2608069">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2608210">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2610669">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2611075">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2611114">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter 8. Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter 9. Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id2601309">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2601394">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2601449">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2601635">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2601958">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2601984">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2602125">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2604584">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2604990">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2605028">Questions and Answers</a></span></dt></dl></div><p> 2 2 Ever since Microsoft announced that it was discontinuing support for Windows 3 3 NT4, Samba users started to ask for detailed instructions on how to migrate … … 7 7 One wonders how many NT4 systems will be left in service by the time you read this 8 8 book though. 9 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2607394"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2607401"></a>9 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2601309"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2601316"></a> 10 10 Network administrators who want to migrate off a Windows NT4 environment know 11 11 one thing with certainty. They feel that NT4 has been abandoned, and they want … … 14 14 failure, and much more. 15 15 </p><p> 16 <a class="indexterm" name="id260 7419"></a>17 <a class="indexterm" name="id260 7426"></a>18 <a class="indexterm" name="id260 7435"></a>19 <a class="indexterm" name="id260 7444"></a>16 <a class="indexterm" name="id2601334"></a> 17 <a class="indexterm" name="id2601341"></a> 18 <a class="indexterm" name="id2601350"></a> 19 <a class="indexterm" name="id2601359"></a> 20 20 The migration from NT4 to Samba-3 can involve a number of factors, including 21 21 migration of data to another server, migration of network environment controls … … 23 23 accounts. 24 24 </p><p> 25 <a class="indexterm" name="id260 7461"></a>25 <a class="indexterm" name="id2601376"></a> 26 26 It should be pointed out now that it is possible to migrate some systems from 27 27 a Windows NT4 domain environment to a Samba-3 domain environment. This is certainly … … 31 31 migration before an environment that is acceptable for immediate use 32 32 is obtained. 33 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id2607479"></a>Assignment Tasks</h3></div></div></div><p>34 <a class="indexterm" name="id260 7487"></a>35 <a class="indexterm" name="id260 7494"></a>36 <a class="indexterm" name="id260 7501"></a>33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601394"></a>Assignment Tasks</h3></div></div></div><p> 34 <a class="indexterm" name="id2601402"></a> 35 <a class="indexterm" name="id2601409"></a> 36 <a class="indexterm" name="id2601416"></a> 37 37 You are about to migrate an MS Windows NT4 domain accounts database to 38 38 a Samba-3 server. The Samba-3 server is using a … … 43 43 Your objective is to document the process of migrating user and group accounts 44 44 from several NT4 domains into a single Samba-3 LDAP backend database. 45 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2607534"></a>Dissection and Discussion</h2></div></div></div><p>46 <a class="indexterm" name="id260 7542"></a>47 <a class="indexterm" name="id260 7548"></a>48 <a class="indexterm" name="id260 7555"></a>49 <a class="indexterm" name="id260 7567"></a>50 <a class="indexterm" name="id260 7578"></a>51 <a class="indexterm" name="id260 7585"></a>45 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2601449"></a>Dissection and Discussion</h2></div></div></div><p> 46 <a class="indexterm" name="id2601456"></a> 47 <a class="indexterm" name="id2601463"></a> 48 <a class="indexterm" name="id2601470"></a> 49 <a class="indexterm" name="id2601482"></a> 50 <a class="indexterm" name="id2601493"></a> 51 <a class="indexterm" name="id2601500"></a> 52 52 The migration process takes a snapshot of information that is stored in the 53 53 Windows NT4 registry-based accounts database. That information resides in 54 54 the Security Account Manager (SAM) portion of the NT4 registry under keys called 55 55 <code class="constant">SAM</code> and <code class="constant">SECURITY</code>. 56 </p><div class="warning" title="Warning"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>57 <a class="indexterm" name="id260 7609"></a>58 <a class="indexterm" name="id260 7616"></a>56 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 57 <a class="indexterm" name="id2601524"></a> 58 <a class="indexterm" name="id2601531"></a> 59 59 The Windows NT4 registry keys called <code class="constant">SAM</code> and <code class="constant">SECURITY</code> 60 60 are protected so that you cannot view the contents. If you change the security setting … … 62 62 do this unless you are willing to render your domain controller inoperative. 63 63 </p></div><p> 64 <a class="indexterm" name="id260 7638"></a>65 <a class="indexterm" name="id260 7647"></a>64 <a class="indexterm" name="id2601553"></a> 65 <a class="indexterm" name="id2601562"></a> 66 66 Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are. 67 67 While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server, … … 71 71 interact with the network environment. 72 72 </p><p> 73 <a class="indexterm" name="id260 7666"></a>74 <a class="indexterm" name="id260 7675"></a>75 <a class="indexterm" name="id260 7682"></a>73 <a class="indexterm" name="id2601581"></a> 74 <a class="indexterm" name="id2601590"></a> 75 <a class="indexterm" name="id2601597"></a> 76 76 MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed 77 77 have done little to keep the NT4 server environment up to date with more recent Windows releases, … … 84 84 real disruption to users, but rather, with due diligence and care, should make their network experience 85 85 a much happier one. 86 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id2607720"></a>Technical Issues</h3></div></div></div><p>87 <a class="indexterm" name="id260 7728"></a>88 <a class="indexterm" name="id260 7735"></a>86 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601635"></a>Technical Issues</h3></div></div></div><p> 87 <a class="indexterm" name="id2601643"></a> 88 <a class="indexterm" name="id2601650"></a> 89 89 Migration of an NT4 domain user and group database to Samba-3 involves a certain strategic 90 90 element. Many sites have asked for instructions regarding merging of multiple NT4 … … 94 94 from a Windows NT4 domain to a Samba domain. 95 95 </p><div class="figure"><a name="ch8-migration"></a><p class="title"><b>Figure 9.1. Schematic Explaining the <code class="literal">net rpc vampire</code> Process</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch8-migration.png" width="297" alt="Schematic Explaining the net rpc vampire Process"></div></div></div><br class="figure-break"><p> 96 <a class="indexterm" name="id260 7808"></a>97 <a class="indexterm" name="id260 7815"></a>96 <a class="indexterm" name="id2601723"></a> 97 <a class="indexterm" name="id2601730"></a> 98 98 If you want to merge multiple NT4 domain account databases into one Samba domain, 99 99 you must now dump the contents of the first migration and edit it as appropriate. Now clean … … 101 101 files. You must start each migration with a new database into which you merge your NT4 102 102 domains. 103 </p><p><a class="indexterm" name="id260 7835"></a>103 </p><p><a class="indexterm" name="id2601750"></a> 104 104 At this point, you are ready to perform the second migration, following the same steps as 105 105 for the first. In other words, dump the database, edit it, and then you may merge the 106 106 dump for the first and second migrations. 107 </p><p><a class="indexterm" name="id260 7850"></a><a class="indexterm" name="id2607858"></a><a class="indexterm" name="id2607866"></a>107 </p><p><a class="indexterm" name="id2601765"></a><a class="indexterm" name="id2601773"></a><a class="indexterm" name="id2601781"></a> 108 108 You must be careful. If you choose to migrate to an LDAP backend, your dump file 109 109 now contains the full account information, including the domain SID. The domain SID for each … … 111 111 portion of the account SIDs so that all are the same. 112 112 </p><p> 113 <a class="indexterm" name="id260 7884"></a>114 <a class="indexterm" name="id260 7890"></a>115 <a class="indexterm" name="id260 7897"></a>116 <a class="indexterm" name="id260 7904"></a>117 <a class="indexterm" name="id260 7911"></a>118 <a class="indexterm" name="id260 7918"></a>119 <a class="indexterm" name="id260 7925"></a>120 <a class="indexterm" name="id260 7932"></a>121 <a class="indexterm" name="id260 7938"></a>122 <a class="indexterm" name="id260 7945"></a>123 <a class="indexterm" name="id260 7952"></a>124 <a class="indexterm" name="id260 7959"></a>113 <a class="indexterm" name="id2601798"></a> 114 <a class="indexterm" name="id2601805"></a> 115 <a class="indexterm" name="id2601812"></a> 116 <a class="indexterm" name="id2601819"></a> 117 <a class="indexterm" name="id2601826"></a> 118 <a class="indexterm" name="id2601833"></a> 119 <a class="indexterm" name="id2601840"></a> 120 <a class="indexterm" name="id2601846"></a> 121 <a class="indexterm" name="id2601853"></a> 122 <a class="indexterm" name="id2601860"></a> 123 <a class="indexterm" name="id2601867"></a> 124 <a class="indexterm" name="id2601874"></a> 125 125 If you choose to use a tdbsam (<code class="filename">passdb.tdb</code>) backend file, your best choice 126 126 is to use <code class="literal">pdbedit</code> to export the contents of the tdbsam file into an … … 132 132 may be exported or imported into either a tdbsam (<code class="filename">passdb.tdb</code>) or 133 133 an LDAP backend. 134 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure 9.2. View of Accounts in NT4 Domain User Manager</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><br class="figure-break"></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id2608043"></a>Political Issues</h3></div></div></div><p>134 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure 9.2. View of Accounts in NT4 Domain User Manager</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><br class="figure-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601958"></a>Political Issues</h3></div></div></div><p> 135 135 The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba-3 136 136 domain may be seen by those who had power over them as a loss of prestige or a loss of … … 142 142 Samba-3 domain is to promote (sell) the action as one that reduces costs and delivers 143 143 greater network interoperability and manageability. 144 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2608069"></a>Implementation</h2></div></div></div><p>144 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2601984"></a>Implementation</h2></div></div></div><p> 145 145 From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations 146 146 to Samba-3 are being performed using a new server or a new installation of a Linux or UNIX … … 161 161 </p><p> 162 162 The migration process involves the following steps: 163 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>163 </p><div class="itemizedlist"><ul type="disc"><li><p> 164 164 Prepare the target Samba-3 server. This involves configuring Samba-3 for 165 165 migration to either a tdbsam or an ldapsam backend. 166 </p></li><li class="listitem"><p>167 <a class="indexterm" name="id260 8156"></a>168 <a class="indexterm" name="id260 8163"></a>169 <a class="indexterm" name="id260 8169"></a>166 </p></li><li><p> 167 <a class="indexterm" name="id2602071"></a> 168 <a class="indexterm" name="id2602078"></a> 169 <a class="indexterm" name="id2602084"></a> 170 170 Clean up the source NT4 PDC. Delete all accounts that need not be migrated. 171 171 Delete all files that should not be migrated. Where possible, change NT group … … 173 173 the target UNIX host insists on POSIX-compliant all lowercase user and group 174 174 names. 175 </p></li><li class="listitem"><p>175 </p></li><li><p> 176 176 Step through the migration process. 177 </p></li><li class="listitem"><p><a class="indexterm" name="id2608190"></a>177 </p></li><li><p><a class="indexterm" name="id2602105"></a> 178 178 Remove the NT4 PDC from the network. 179 </p></li><li class="listitem"><p>179 </p></li><li><p> 180 180 Upgrade the Samba-3 server from a BDC to a PDC, and validate all account 181 181 information. 182 182 </p></li></ul></div><p> 183 183 It may help to use the above outline as a pre-migration checklist. 184 </p><div class="sect2" title="NT4 Migration Using LDAP Backend"><div class="titlepage"><div><div><h3 class="title"><a name="id2608210"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p>184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2602125"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p> 185 185 In this example, the migration is of an NT4 PDC to a Samba-3 PDC with an LDAP backend. The accounts about 186 186 to be migrated are shown in <a class="link" href="ntmigration.html#NT4DUM" title="Figure 9.2. View of Accounts in NT4 Domain User Manager">“View of Accounts in NT4 Domain User Manager”</a>. In this example use is made of the … … 195 195 that the deletion scripts must be commented out during migration. These should be uncommented 196 196 following successful migration of the NT4 Domain accounts. 197 </p><div class="warning" title="Warning"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>197 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 198 198 Under absolutely no circumstances should the Samba daemons be started until instructed to do so. 199 199 Delete the <code class="filename">/etc/samba/secrets.tdb</code> file and all Samba control tdb files 200 200 before commencing the following configuration steps. 201 </p></div><div class="table"><a name="ch8-vampire"></a><p class="title"><b>Table 9.1. Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</b></p><div class="table-contents"><table summary="Samba smb.conf Scripts Essential to Samba Operation" border="1"><colgroup><col align="left"><col align="center"><col align="center"></colgroup><thead><tr><th align="left">Entity</th><th align="center">ldapsam Script</th><th align="center">tdbsam Script</th></tr></thead><tbody><tr><td align="left">Add User Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr><tr><td align="left">Delete User Accounts</td><td align="center">smbldap-userdel</td><td align="center">userdel</td></tr><tr><td align="left">Add Group Accounts</td><td align="center">smbldap-groupadd</td><td align="center">groupadd</td></tr><tr><td align="left">Delete Group Accounts</td><td align="center">smbldap-groupdel</td><td align="center">groupdel</td></tr><tr><td align="left">Add User to Group</td><td align="center">smbldap-groupmod</td><td align="center">usermod (See Note)</td></tr><tr><td align="left">Add Machine Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr></tbody></table></div></div><br class="table-break"><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>202 <a class="indexterm" name="id260 8413"></a>203 <a class="indexterm" name="id260 8420"></a>204 <a class="indexterm" name="id260 8426"></a>201 </p></div><div class="table"><a name="ch8-vampire"></a><p class="title"><b>Table 9.1. Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</b></p><div class="table-contents"><table summary="Samba smb.conf Scripts Essential to Samba Operation" border="1"><colgroup><col align="left"><col align="center"><col align="center"></colgroup><thead><tr><th align="left">Entity</th><th align="center">ldapsam Script</th><th align="center">tdbsam Script</th></tr></thead><tbody><tr><td align="left">Add User Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr><tr><td align="left">Delete User Accounts</td><td align="center">smbldap-userdel</td><td align="center">userdel</td></tr><tr><td align="left">Add Group Accounts</td><td align="center">smbldap-groupadd</td><td align="center">groupadd</td></tr><tr><td align="left">Delete Group Accounts</td><td align="center">smbldap-groupdel</td><td align="center">groupdel</td></tr><tr><td align="left">Add User to Group</td><td align="center">smbldap-groupmod</td><td align="center">usermod (See Note)</td></tr><tr><td align="left">Add Machine Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr></tbody></table></div></div><br class="table-break"><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 202 <a class="indexterm" name="id2602328"></a> 203 <a class="indexterm" name="id2602334"></a> 204 <a class="indexterm" name="id2602341"></a> 205 205 The UNIX/Linux <code class="literal">usermod</code> utility does not permit simple user addition to (or deletion 206 206 of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this … … 209 209 The <code class="literal">groupmem</code> utility was contributed to the shadow package but has not surfaced 210 210 in the formal commands provided by Linux distributions (March 2004). 211 </p></div><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>212 <a class="indexterm" name="id260 8463"></a>211 </p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 212 <a class="indexterm" name="id2602378"></a> 213 213 The <code class="literal">tdbdump</code> utility is a utility that you can build from the Samba source-code tree. Not all Linux binary distributions include this tool. If it is missing from your 214 214 Linux distribution, you will need to build this yourself or else forgo its use. 215 215 </p></div><p> 216 <a class="indexterm" name="id260 8484"></a>216 <a class="indexterm" name="id2602398"></a> 217 217 Before starting the migration, all dead accounts were removed from the NT4 domain using the User Manager for Domains. 218 </p><div class="procedure" title="Procedure 9.1. User Migration Steps"><a name="id2608494"></a><p class="title"><b>Procedure 9.1. User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example 9.1. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2608554"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id2608565"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id2608577"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2608589"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2608601"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2608612"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2608624"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2608636"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id2608648"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2608660"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2608672"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2608685"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2608697"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2608710"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2608722"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2608736"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2608748"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2608761"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id2608773"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2608785"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2608796"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2608808"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2608820"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2608832"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2608843"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id2608855"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2608867"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2608879"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2608891"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2608903"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2608915"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2608927"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2608939"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id2608951"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2608963"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2608975"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2608986"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2608998"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2609010"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2609022"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example 9.2. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2609067"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id2609079"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id2609091"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2609111"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2609123"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id2609135"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2609146"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2609158"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2609178"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2609190"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2609202"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2609214"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2609225"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id2609237"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2609258"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2609269"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2609281"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2609293"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2609313"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2609325"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2609337"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2609349"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2609369"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2609381"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2609393"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2609405"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2609425"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2609437"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example 9.3. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><div class="example-contents"><pre class="screen">218 </p><div class="procedure"><a name="id2602409"></a><p class="title"><b>Procedure 9.1. User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example 9.1. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2602469"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id2602480"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id2602492"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2602504"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2602516"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2602527"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2602539"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2602551"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id2602563"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2602575"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2602587"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2602600"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2602612"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2602625"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2602637"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2602650"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2602663"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2602676"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id2602688"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2602700"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2602711"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2602723"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602735"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2602746"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602758"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id2602770"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2602782"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2602794"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2602806"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2602818"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602830"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2602842"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2602854"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id2602866"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2602878"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2602890"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2602901"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2602913"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602925"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602937"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example 9.2. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2602982"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id2602994"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id2603006"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2603026"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2603038"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id2603050"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2603061"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2603073"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2603093"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2603105"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2603117"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2603128"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2603140"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id2603152"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2603172"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2603184"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2603196"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2603208"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2603228"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2603240"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2603252"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2603264"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2603284"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2603296"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2603308"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2603320"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2603340"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2603352"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example 9.3. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><div class="example-contents"><pre class="screen"> 219 219 include /etc/openldap/schema/core.schema 220 220 include /etc/openldap/schema/cosine.schema … … 331 331 #passwd_compat: ldap #Not needed. 332 332 #group_compat: ldap #Not needed. 333 </pre></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>333 </pre></div></div><br class="example-break"><ol type="1"><li><p> 334 334 Configure the Samba <code class="filename">smb.conf</code> file to create a BDC. An example configuration is 335 335 given in <a class="link" href="ntmigration.html#sbent4smb" title="Example 9.1. NT4 Migration Samba-3 Server smb.conf Part: A">“NT4 Migration Samba-3 Server smb.conf Part: A”</a>. 336 336 The delete scripts are commented out so that during the process of migration 337 337 no account information can be deleted. 338 </p></li><li class="step" title="Step 2"><p>339 <a class="indexterm" name="id260 9455"></a>338 </p></li><li><p> 339 <a class="indexterm" name="id2603370"></a> 340 340 Configure OpenLDAP in preparation for the migration. An example 341 341 <code class="filename">sladp.conf</code> file is shown in <a class="link" href="ntmigration.html#sbentslapd" title="Example 9.3. NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A">“NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A”</a>. 342 342 The <code class="constant">rootpw</code> value is an encrypted password string that can 343 343 be obtained by executing the <code class="literal">slappasswd</code> command. 344 </p></li><li class="step" title="Step 3"><p>345 <a class="indexterm" name="id260 9569"></a>346 <a class="indexterm" name="id260 9576"></a>344 </p></li><li><p> 345 <a class="indexterm" name="id2603484"></a> 346 <a class="indexterm" name="id2603491"></a> 347 347 Install the PADL <code class="literal">nss_ldap</code> tool set, then configure the <code class="filename">/etc/ldap.conf</code> 348 348 as shown in <a class="link" href="ntmigration.html#sbrntldapconf" title="Example 9.5. NT4 Migration NSS LDAP File: /etc/ldap.conf">“NT4 Migration NSS LDAP File: /etc/ldap.conf”</a>. 349 </p></li><li class="step" title="Step 4"><p>350 <a class="indexterm" name="id260 9637"></a>349 </p></li><li><p> 350 <a class="indexterm" name="id2603552"></a> 351 351 Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown 352 352 in <a class="link" href="ntmigration.html#sbentnss" title="Example 9.6. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)">“NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)”</a>. Note that the LDAP entries have been commented out. … … 358 358 out, it is possible to avoid this gridlock situation and thus the overall 359 359 installation and configuration will progress more smoothly. 360 </p></li><li class="step" title="Step 5"><p>360 </p></li><li><p> 361 361 Validate the the target NT4 PDC name is being correctly resolved to its IP address by 362 362 executing the following: … … 374 374 Do not proceed to the next step if this step fails. It is imperative that the name of the PDC 375 375 can be resolved to its IP address. If this is broken, fix it. 376 </p></li><li class="step" title="Step 6"><p>376 </p></li><li><p> 377 377 Pull the domain SID from the NT4 domain that is being migrated as follows: 378 378 </p><pre class="screen"> … … 392 392 <code class="prompt">root# </code> net setlocalsid S-1-5-21-1385457007-882775198-1210191635 393 393 </pre><p> 394 </p></li><li class="step" title="Step 7"><p>395 <a class="indexterm" name="id260 9806"></a>396 <a class="indexterm" name="id260 9813"></a>397 <a class="indexterm" name="id260 9820"></a>398 <a class="indexterm" name="id260 9827"></a>394 </p></li><li><p> 395 <a class="indexterm" name="id2603721"></a> 396 <a class="indexterm" name="id2603728"></a> 397 <a class="indexterm" name="id2603735"></a> 398 <a class="indexterm" name="id2603742"></a> 399 399 Install the Idealx <code class="literal">smbldap-tools</code> software package, following 400 400 the instructions given in <a class="link" href="happy.html#sbeidealx" title="Install and Configure Idealx smbldap-tools Scripts">“Install and Configure Idealx smbldap-tools Scripts”</a>. The resulting perl scripts … … 490 490 /etc/smbldap-tools/smbldap_bind.conf done. 491 491 </pre><p> 492 <a class="indexterm" name="id260 9976"></a>493 <a class="indexterm" name="id260 9983"></a>494 <a class="indexterm" name="id260 9990"></a>495 <a class="indexterm" name="id260 9997"></a>492 <a class="indexterm" name="id2603891"></a> 493 <a class="indexterm" name="id2603898"></a> 494 <a class="indexterm" name="id2603905"></a> 495 <a class="indexterm" name="id2603912"></a> 496 496 Note that the NT4 domain SID that was previously obtained was entered above. Also, 497 497 the sambaUnixIdPooldn object was specified as sambaDomainName=DAMNATION. This is … … 502 502 are being upgraded to version 0.9.1 it is appropriate to update this to the new location 503 503 only if the directory information is also relocated. 504 </p></li><li class="step" title="Step 8"><p>504 </p></li><li><p> 505 505 Start the LDAP server using the system interface script. On Novell SLES9 506 506 this is done as shown here: … … 508 508 <code class="prompt">root# </code> rcldap start 509 509 </pre><p> 510 </p></li><li class="step" title="Step 9"><p>510 </p></li><li><p> 511 511 Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown in 512 512 <a class="link" href="ntmigration.html#sbentnss2" title="Example 9.7. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:2)">“NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:2)”</a>. Note that the LDAP entries have now been uncommented. 513 </p></li><li class="step" title="Step 10"><p>513 </p></li><li><p> 514 514 The LDAP management password must be installed into the <code class="filename">secrets.tdb</code> 515 515 file as follows: … … 519 519 "cn=Manager,dc=terpstra-world,dc=org" in secrets.tdb 520 520 </pre><p> 521 </p></li><li class="step" title="Step 11"><p>521 </p></li><li><p> 522 522 Populate the LDAP directory as shown here: 523 523 </p><pre class="screen"> … … 545 545 The script tries to add the ou=People container twice, hence the error message. 546 546 This is expected behavior. 547 </p></li><li class="step" title="Step 12"><p>548 <a class="indexterm" name="id26 10162"></a>547 </p></li><li><p> 548 <a class="indexterm" name="id2604077"></a> 549 549 Restart the LDAP server following initialization of the LDAP directory. Execute the 550 550 system control script provided on your system. The following steps can be used on … … 554 554 <code class="prompt">root# </code> chkconfig ldap on 555 555 </pre><p> 556 </p></li><li class="step" title="Step 13"><p>556 </p></li><li><p> 557 557 Verify that the new user accounts that have been added to the LDAP directory can be 558 558 resolved as follows: … … 585 585 Replicators:x:552: 586 586 </pre><p> 587 In both cases the LDAP accounts follow the <span class="quote">“<span class="quote">+::0:</span>”</span>entry.588 </p></li><li class="step" title="Step 14"><p>587 In both cases the LDAP accounts follow the “<span class="quote">+::0:</span>” entry. 588 </p></li><li><p> 589 589 Now it is time to join the Samba BDC to the target NT4 domain that is being 590 590 migrated to Samba-3 by executing the following: … … 595 595 Joined domain DAMNATION. 596 596 </pre><p> 597 </p></li><li class="step" title="Step 15"><p>597 </p></li><li><p> 598 598 Set the new domain administrator (root) password for both UNIX and Windows as shown here: 599 599 </p><pre class="screen"> … … 605 605 Note: During account migration, the Windows Administrator account will not be migrated 606 606 to the Samba server. 607 </p></li><li class="step" title="Step 16"><p>607 </p></li><li><p> 608 608 Now validate that these accounts can be resolved using Samba's tools as 609 609 shown here for user accounts: … … 633 633 </pre><p> 634 634 These are the expected results for a correctly configured system. 635 </p></li><li class="step" title="Step 17"><p>635 </p></li><li><p> 636 636 Commence migration as shown here: 637 637 </p><pre class="screen"> … … 641 641 Check the vampire log to confirm that only expected errors have been 642 642 reported. See <a class="link" href="ntmigration.html#sbevam1" title="Migration Log Validation">“Migration Log Validation”</a>. 643 </p></li><li class="step" title="Step 18"><p>643 </p></li><li><p> 644 644 The migration of user accounts can be quickly validated as follows: 645 645 </p><pre class="screen"> … … 676 676 merlin$:27:820C50523F368C54AB9D85AE603AD09D:... 677 677 </pre><p> 678 </p></li><li class="step" title="Step 19"><p>678 </p></li><li><p> 679 679 The mapping of UNIX and Windows groups can be validated as show here: 680 680 </p><pre class="screen"> … … 708 708 It is of vital importance that the domain SID portions of all group 709 709 accounts are identical. 710 </p></li><li class="step" title="Step 20"><p>710 </p></li><li><p> 711 711 The final responsibility in the migration process is to create identical 712 712 shares and printing resources on the new Samba-3 server, copy all data 713 713 across, set up privileges, and set share and file/directory access controls. 714 </p></li><li class="step" title="Step 21"><p>715 <a class="indexterm" name="id26 10476"></a>716 <a class="indexterm" name="id26 10483"></a>714 </p></li><li><p> 715 <a class="indexterm" name="id2604391"></a> 716 <a class="indexterm" name="id2604398"></a> 717 717 Edit the <code class="filename">smb.conf</code> file to reset the parameter 718 718 <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = Yes</a> so that … … 737 737 Press enter to see a dump of your service definitions 738 738 </pre><p> 739 </p></li><li class="step" title="Step 22"><p>739 </p></li><li><p> 740 740 Now shut down the old NT4 PDC. Only when the old NT4 PDC and all 741 741 NT4 BDCs have been shut down can the Samba-3 PDC be started. 742 </p></li><li class="step" title="Step 23"><p>742 </p></li><li><p> 743 743 All workstations should function as they did with the old NT4 PDC. All 744 744 interdomain trust accounts should remain in place and fully functional. 745 745 All machine accounts and user logon accounts should also function correctly. 746 </p></li><li class="step" title="Step 24"><p>746 </p></li><li><p> 747 747 The configuration of Samba-3 BDC servers can be accomplished now or at any 748 748 convenient time in the future. Please refer to the carefully detailed process 749 749 for doing so is outlined in <a class="link" href="happy.html#sbehap-bldg1" title="Samba-3 BDC Configuration">“Samba-3 BDC Configuration”</a>. 750 </p></li></ol></div><div class="sect3" title="Migration Log Validation"><div class="titlepage"><div><div><h4 class="title"><a name="sbevam1"></a>Migration Log Validation</h4></div></div></div><p>750 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbevam1"></a>Migration Log Validation</h4></div></div></div><p> 751 751 The following <code class="filename">vampire.log</code> file is typical of a valid migration. 752 752 </p><pre class="screen"> … … 842 842 Creating unix group: 'Users' 843 843 </pre><p> 844 </p></div></div><div class="sect2" title="NT4 Migration Using tdbsam Backend"><div class="titlepage"><div><div><h3 class="title"><a name="id2610669"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p>844 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2604584"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p> 845 845 In this example, we change the domain name of the NT4 server from 846 846 <code class="constant">DRUGPREP</code> to <code class="constant">MEGANET</code> prior to the use … … 850 850 databases. These entries must therefore be present, and correct options specified, 851 851 in your <code class="filename">smb.conf</code> file, or else the migration does not work as it should. 852 </p><div class="procedure" title="Procedure 9.2. Migration Steps Using tdbsam"><a name="id2610716"></a><p class="title"><b>Procedure 9.2. Migration Steps Using tdbsam</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>852 </p><div class="procedure"><a name="id2604630"></a><p class="title"><b>Procedure 9.2. Migration Steps Using tdbsam</b></p><ol type="1"><li><p> 853 853 Prepare a Samba-3 server precisely per the instructions shown in <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a>. 854 854 Set the workgroup name to <code class="constant">MEGANET</code>. 855 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id2610744"></a><a class="indexterm" name="id2610752"></a>855 </p></li><li><p><a class="indexterm" name="id2604658"></a><a class="indexterm" name="id2604666"></a> 856 856 Edit the <code class="filename">smb.conf</code> file to temporarily change the parameter 857 857 <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = No</a> so 858 858 the Samba server functions as a BDC for the purpose of migration. 859 </p></li><li class="step" title="Step 3"><p>859 </p></li><li><p> 860 860 Start Samba as you have done previously. 861 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id2610794"></a>861 </p></li><li><p><a class="indexterm" name="id2604709"></a> 862 862 Join the NT4 Domain as a BDC, as shown here: 863 863 </p><pre class="screen"> … … 865 865 Joined domain MEGANET. 866 866 </pre><p> 867 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id2610829"></a>867 </p></li><li><p><a class="indexterm" name="id2604743"></a> 868 868 You may vampire the accounts from the NT4 PDC by executing the command, as shown here: 869 869 </p><pre class="screen"> … … 905 905 SAM_DELTA_DOMAIN_INFO not handled 906 906 </pre><p> 907 </p></li><li class="step" title="Step 6"><p><a class="indexterm" name="id2610883"></a>907 </p></li><li><p><a class="indexterm" name="id2604798"></a> 908 908 At this point, we can validate our migration. Let's look at the accounts 909 909 in the form in which they are seen in a smbpasswd file. This achieves that: … … 937 937 CF271B744F7A55AFDA277FF88D80C527:[UX ]:LCT-3E8B4270: 938 938 </pre><p> 939 </p></li><li class="step" title="Step 7"><p><a class="indexterm" name="id2610960"></a>939 </p></li><li><p><a class="indexterm" name="id2604874"></a> 940 940 An expanded view of a user account entry shows more of what was 941 941 obtained from the NT4 PDC: … … 963 963 Password must change: Mon, 18 Jan 2038 20:14:07 GMT 964 964 </pre><p> 965 </p></li><li class="step" title="Step 8"><p><a class="indexterm" name="id2610995"></a>965 </p></li><li><p><a class="indexterm" name="id2604910"></a> 966 966 The following command lists the long names of the groups that have been 967 967 imported (vampired) from the NT4 PDC: … … 980 980 </pre><p> 981 981 Everything looks well and in order. 982 </p></li><li class="step" title="Step 9"><p><a class="indexterm" name="id2611035"></a><a class="indexterm" name="id2611043"></a>982 </p></li><li><p><a class="indexterm" name="id2604949"></a><a class="indexterm" name="id2604957"></a> 983 983 Edit the <code class="filename">smb.conf</code> file to reset the parameter 984 984 <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = Yes</a> so 985 985 the Samba server functions as a PDC for the purpose of migration. 986 </p></li></ol></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id2611075"></a>Key Points Learned</h3></div></div></div><p>986 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2604990"></a>Key Points Learned</h3></div></div></div><p> 987 987 Migration of an NT4 PDC database to a Samba-3 PDC is possible. 988 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>988 </p><div class="itemizedlist"><ul type="disc"><li><p> 989 989 An LDAP backend is a suitable vehicle for NT4 migrations. 990 </p></li><li class="listitem"><p>990 </p></li><li><p> 991 991 A tdbsam backend can be used to perform a migration. 992 </p></li><li class="listitem"><p>992 </p></li><li><p> 993 993 Multiple NT4 domains can be merged into a single Samba-3 994 994 domain. 995 </p></li><li class="listitem"><p>995 </p></li><li><p> 996 996 The net Samba-3 domain most likely requires some 997 997 administration and updating before going live. 998 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2611114"></a>Questions and Answers</h2></div></div></div><p>999 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id2611123"></a><dl><dt> <a href="ntmigration.html#id2611129">998 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2605028"></a>Questions and Answers</h2></div></div></div><p> 999 </p><div class="qandaset"><dl><dt> <a href="ntmigration.html#id2605044"> 1000 1000 Why must I start each migration with a clean database? 1001 </a></dt><dt> <a href="ntmigration.html#id26 11169">1001 </a></dt><dt> <a href="ntmigration.html#id2605084"> 1002 1002 Is it possible to set my domain SID to anything I like? 1003 </a></dt><dt> <a href="ntmigration.html#id26 11226">1003 </a></dt><dt> <a href="ntmigration.html#id2605141"> 1004 1004 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1005 1005 in /etc/passwd and /etc/group? 1006 </a></dt><dt> <a href="ntmigration.html#id26 11406">1006 </a></dt><dt> <a href="ntmigration.html#id2605321"> 1007 1007 Why did you validate connectivity before attempting migration? 1008 </a></dt><dt> <a href="ntmigration.html#id26 11452">1008 </a></dt><dt> <a href="ntmigration.html#id2605367"> 1009 1009 How would you merge 10 tdbsam-based domains into an LDAP database? 1010 </a></dt><dt> <a href="ntmigration.html#id26 11574">1010 </a></dt><dt> <a href="ntmigration.html#id2605489"> 1011 1011 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1012 1012 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1013 </a></dt><dt> <a href="ntmigration.html#id26 11650">1013 </a></dt><dt> <a href="ntmigration.html#id2605565"> 1014 1014 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1015 </a></dt><dt> <a href="ntmigration.html#id26 11715">1015 </a></dt><dt> <a href="ntmigration.html#id2605630"> 1016 1016 How can I reset group membership after loading the account information into the LDAP database? 1017 </a></dt><dt> <a href="ntmigration.html#id26 11749">1017 </a></dt><dt> <a href="ntmigration.html#id2605664"> 1018 1018 What are the limits or constraints that apply to group names? 1019 </a></dt><dt> <a href="ntmigration.html#id26 11854">1019 </a></dt><dt> <a href="ntmigration.html#id2605769"> 1020 1020 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1021 1021 LDAP backend system using the vampire process? 1022 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id2611129"></a><a name="id2611131"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2611134"></a>1022 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2605044"></a><a name="id2605046"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605049"></a> 1023 1023 Why must I start each migration with a clean database? 1024 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id26 11150"></a>1024 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605065"></a> 1025 1025 This is a recommendation that permits the data from each NT4 domain to 1026 1026 be kept separate until you are ready to merge them. Also, if you do not start with a clean database, … … 1029 1029 without undue errors and then to handle the merging of vampired data under 1030 1030 proper supervision. 1031 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26 11169"></a><a name="id2611172"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2611175"></a>1031 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605084"></a><a name="id2605086"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605090"></a> 1032 1032 Is it possible to set my domain SID to anything I like? 1033 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id26 11190"></a><a class="indexterm" name="id2611198"></a><a class="indexterm" name="id2611206"></a>1033 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605105"></a><a class="indexterm" name="id2605113"></a><a class="indexterm" name="id2605121"></a> 1034 1034 Yes, so long as the SID you create has the same structure as an autogenerated SID. 1035 1035 The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where … … 1038 1038 You may want to set the SID to one that is already in use somewhere on your network, 1039 1039 but that is a little different from straight out creating your own domain SID. 1040 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26 11226"></a><a name="id2611229"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2611232"></a><a class="indexterm" name="id2611239"></a><a class="indexterm" name="id2611247"></a><a class="indexterm" name="id2611255"></a><a class="indexterm" name="id2611263"></a><a class="indexterm" name="id2611274"></a><a class="indexterm" name="id2611285"></a>1040 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605141"></a><a name="id2605143"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605147"></a><a class="indexterm" name="id2605154"></a><a class="indexterm" name="id2605162"></a><a class="indexterm" name="id2605169"></a><a class="indexterm" name="id2605177"></a><a class="indexterm" name="id2605189"></a><a class="indexterm" name="id2605200"></a> 1041 1041 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1042 1042 in <code class="filename">/etc/passwd</code> and <code class="filename">/etc/group</code>? 1043 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id26 11317"></a><a class="indexterm" name="id2611324"></a><a class="indexterm" name="id2611332"></a><a class="indexterm" name="id2611340"></a><a class="indexterm" name="id2611348"></a><a class="indexterm" name="id2611356"></a>1043 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605232"></a><a class="indexterm" name="id2605239"></a><a class="indexterm" name="id2605247"></a><a class="indexterm" name="id2605255"></a><a class="indexterm" name="id2605262"></a><a class="indexterm" name="id2605270"></a> 1044 1044 Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba 1045 1045 does not fabricate the UNIX IDs from thin air, but rather requires them to be located … … 1056 1056 In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in 1057 1057 LDAP, require UIDs/GIDs. 1058 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26 11406"></a><a name="id2611409"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2611412"></a><a class="indexterm" name="id2611420"></a><a class="indexterm" name="id2611428"></a>1058 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605321"></a><a name="id2605323"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605327"></a><a class="indexterm" name="id2605334"></a><a class="indexterm" name="id2605342"></a> 1059 1059 Why did you validate connectivity before attempting migration? 1060 1060 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1062 1062 potential problems that may otherwise affect or impede account migration. I am always 1063 1063 mindful of the 4 P's of migration: Planning Prevents Poor Performance. 1064 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26 11452"></a><a name="id2611454"></a></td><td align="left" valign="top"><p>1064 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605367"></a><a name="id2605369"></a></td><td align="left" valign="top"><p> 1065 1065 How would you merge 10 tdbsam-based domains into an LDAP database? 1066 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id26 11465"></a><a class="indexterm" name="id2611473"></a><a class="indexterm" name="id2611481"></a><a class="indexterm" name="id2611488"></a><a class="indexterm" name="id2611496"></a><a class="indexterm" name="id2611504"></a><a class="indexterm" name="id2611512"></a><a class="indexterm" name="id2611520"></a><a class="indexterm" name="id2611527"></a><a class="indexterm" name="id2611535"></a><a class="indexterm" name="id2611543"></a>1066 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605380"></a><a class="indexterm" name="id2605388"></a><a class="indexterm" name="id2605395"></a><a class="indexterm" name="id2605403"></a><a class="indexterm" name="id2605411"></a><a class="indexterm" name="id2605419"></a><a class="indexterm" name="id2605426"></a><a class="indexterm" name="id2605434"></a><a class="indexterm" name="id2605442"></a><a class="indexterm" name="id2605450"></a><a class="indexterm" name="id2605458"></a> 1067 1067 If you have 10 tdbsam Samba domains, there is considerable risk that there are a number of 1068 1068 accounts that have the same UNIX identifier (UID/GID). This means that you almost … … 1074 1074 you have migrated before handing over access to a user. After all, too many users with a bad 1075 1075 migration experience may threaten your career. 1076 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26 11574"></a><a name="id2611576"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2611580"></a><a class="indexterm" name="id2611588"></a>1076 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605489"></a><a name="id2605491"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605494"></a><a class="indexterm" name="id2605502"></a> 1077 1077 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1078 1078 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1079 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id26 11608"></a><a class="indexterm" name="id2611616"></a><a class="indexterm" name="id2611624"></a><a class="indexterm" name="id2611632"></a>1079 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605523"></a><a class="indexterm" name="id2605531"></a><a class="indexterm" name="id2605539"></a><a class="indexterm" name="id2605547"></a> 1080 1080 I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries 1081 1081 on each Windows NT4 and upward client that have a tattoo of the old domain name. If you 1082 1082 unjoin the domain and then rejoin the newly renamed Samba-3 domain, you can be certain to avoid 1083 1083 this tattooing effect. 1084 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26 11650"></a><a name="id2611652"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2611655"></a>1084 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605565"></a><a name="id2605567"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605570"></a> 1085 1085 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1086 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id26 11672"></a><a class="indexterm" name="id2611680"></a>1086 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605586"></a><a class="indexterm" name="id2605594"></a> 1087 1087 Samba-3 currently does not implement multiple group membership internally. If you use the Windows 1088 1088 NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group … … 1093 1093 and <code class="filename">/etc/group</code> information also. That is where the multiple group information 1094 1094 is most closely at your fingertips. 1095 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26 11715"></a><a name="id2611717"></a></td><td align="left" valign="top"><p>1095 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605630"></a><a name="id2605632"></a></td><td align="left" valign="top"><p> 1096 1096 How can I reset group membership after loading the account information into the LDAP database? 1097 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id26 11728"></a>1097 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605643"></a> 1098 1098 You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The 1099 1099 installation file is called <code class="filename">SRVTOOLS.EXE</code>. 1100 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26 11749"></a><a name="id2611751"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2611754"></a>1100 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605664"></a><a name="id2605666"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605669"></a> 1101 1101 What are the limits or constraints that apply to group names? 1102 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id26 11770"></a><a class="indexterm" name="id2611778"></a><a class="indexterm" name="id2611786"></a><a class="indexterm" name="id2611794"></a><a class="indexterm" name="id2611802"></a><a class="indexterm" name="id2611809"></a>1102 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2605685"></a><a class="indexterm" name="id2605693"></a><a class="indexterm" name="id2605701"></a><a class="indexterm" name="id2605708"></a><a class="indexterm" name="id2605716"></a><a class="indexterm" name="id2605724"></a> 1103 1103 A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group 1104 1104 name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows … … 1112 1112 or user account names. You have to experiment with your system to find what its 1113 1113 peculiarities are. 1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26 11854"></a><a name="id2611856"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2611859"></a>1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2605769"></a><a name="id2605771"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605774"></a> 1115 1115 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1116 1116 LDAP backend system using the vampire process? … … 1121 1121 integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts. 1122 1122 Please check this carefully before you attempt to effect a migration using the vampire process. 1123 </p><p><a class="indexterm" name="id26 11896"></a>1123 </p><p><a class="indexterm" name="id2605811"></a> 1124 1124 Migration speed depends much on the processor speed, the network speed, disk I/O capability, and 1125 1125 LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory that was mirroring LDAP
Note:
See TracChangeset
for help on using the changeset viewer.
