- Timestamp:
- Mar 1, 2010, 3:05:48 PM (15 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.3.x/docs/htmldocs/Samba3-HOWTO/ProfileMgmt.html
r368 r411 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 27. Desktop Profile Management</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 5.2"><link rel="home" href="index.html" title="The Official Samba 3.3.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="PolicyMgmt.html" title="Chapter 26. System and Account Policies"><link rel="next" href="pam.html" title="Chapter 28. PAM-Based Distributed Authentication"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 27. Desktop Profile Management</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="PolicyMgmt.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="pam.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 27. Desktop Profile Management"><div class="titlepage"><div><div><h2 class="title"><a name="ProfileMgmt"></a>Chapter 27. Desktop Profile Management</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ProfileMgmt.html#id2666639">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id2666688">Roaming Profiles</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id2666742">Samba Configuration for Profile Handling</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2667353">Windows Client Profile Configuration Information</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2668697">User Profile Hive Cleanup Service</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2668731">Sharing Profiles between Windows 9x/Me and NT4/200x/XP Workstations</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2668829">Profile Migration from Windows NT4/200x Server to Samba</a></span></dt></dl></dd><dt><span class="sect1"><a href="ProfileMgmt.html#id2669181">Mandatory Profiles</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id2669321">Creating and Managing Group Profiles</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id2669400">Default Profile for Windows Users</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id2669430">MS Windows 9x/Me</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2669587">MS Windows NT4 Workstation</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2670149">MS Windows 200x/XP</a></span></dt></dl></dd><dt><span class="sect1"><a href="ProfileMgmt.html#id2670655">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id2670666">Configuring Roaming Profiles for a Few Users or Groups</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2670727">Cannot Use Roaming Profiles</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2670898">Changing the Default Profile</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2671062">Debugging Roaming Profiles and NT4-style Domain Policies</a></span></dt></dl></dd></dl></div><div class="sect1" title="Features and Benefits"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2666639"></a>Features and Benefits</h2></div></div></div><p>2 <a class="indexterm" name="id266 6647"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 27. Desktop Profile Management</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.3.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="PolicyMgmt.html" title="Chapter 26. System and Account Policies"><link rel="next" href="pam.html" title="Chapter 28. PAM-Based Distributed Authentication"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 27. Desktop Profile Management</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="PolicyMgmt.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="pam.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ProfileMgmt"></a>Chapter 27. Desktop Profile Management</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">April 3 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ProfileMgmt.html#id2660554">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id2660603">Roaming Profiles</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id2660657">Samba Configuration for Profile Handling</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2661267">Windows Client Profile Configuration Information</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2662612">User Profile Hive Cleanup Service</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2662645">Sharing Profiles between Windows 9x/Me and NT4/200x/XP Workstations</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2662744">Profile Migration from Windows NT4/200x Server to Samba</a></span></dt></dl></dd><dt><span class="sect1"><a href="ProfileMgmt.html#id2663095">Mandatory Profiles</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id2663236">Creating and Managing Group Profiles</a></span></dt><dt><span class="sect1"><a href="ProfileMgmt.html#id2663314">Default Profile for Windows Users</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id2663345">MS Windows 9x/Me</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2663502">MS Windows NT4 Workstation</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2664064">MS Windows 200x/XP</a></span></dt></dl></dd><dt><span class="sect1"><a href="ProfileMgmt.html#id2664569">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="ProfileMgmt.html#id2664580">Configuring Roaming Profiles for a Few Users or Groups</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2664641">Cannot Use Roaming Profiles</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2664813">Changing the Default Profile</a></span></dt><dt><span class="sect2"><a href="ProfileMgmt.html#id2664976">Debugging Roaming Profiles and NT4-style Domain Policies</a></span></dt></dl></dd></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2660554"></a>Features and Benefits</h2></div></div></div><p> 2 <a class="indexterm" name="id2660562"></a> 3 3 Roaming profiles are feared by some, hated by a few, loved by many, and a godsend for 4 4 some administrators. 5 5 </p><p> 6 <a class="indexterm" name="id266 6659"></a>6 <a class="indexterm" name="id2660574"></a> 7 7 Roaming profiles allow an administrator to make available a consistent user desktop 8 8 as the user moves from one machine to another. This chapter provides much information 9 9 regarding how to configure and manage roaming profiles. 10 10 </p><p> 11 <a class="indexterm" name="id266 6673"></a>11 <a class="indexterm" name="id2660588"></a> 12 12 While roaming profiles might sound like nirvana to some, they are a real and tangible 13 13 problem to others. In particular, users of mobile computing tools, where often there may not … … 15 15 This chapter provides information to help the Samba administrator deal with those 16 16 situations. 17 </p></div><div class="sect1" title="Roaming Profiles"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2666688"></a>Roaming Profiles</h2></div></div></div><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>17 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2660603"></a>Roaming Profiles</h2></div></div></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 18 18 Roaming profiles support is different for Windows 9x/Me and Windows NT4/200x. 19 19 </p></div><p> … … 21 21 Windows 9x/Me and Windows NT4/200x clients implement these features. 22 22 </p><p> 23 <a class="indexterm" name="id266 6710"></a>23 <a class="indexterm" name="id2660624"></a> 24 24 Windows 9x/Me clients send a NetUserGetInfo request to the server to get the user's 25 25 profiles location. However, the response does not have room for a separate … … 27 27 profiles are restricted to being stored in the user's home directory. 28 28 </p><p> 29 <a class="indexterm" name="id266 6725"></a>30 <a class="indexterm" name="id266 6732"></a>29 <a class="indexterm" name="id2660640"></a> 30 <a class="indexterm" name="id2660647"></a> 31 31 Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields 32 32 including a separate field for the location of the user's profiles. 33 </p><div class="sect2" title="Samba Configuration for Profile Handling"><div class="titlepage"><div><div><h3 class="title"><a name="id2666742"></a>Samba Configuration for Profile Handling</h3></div></div></div><p>33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2660657"></a>Samba Configuration for Profile Handling</h3></div></div></div><p> 34 34 This section documents how to configure Samba for MS Windows client profile support. 35 </p><div class="sect3" title="NT4/200x User Profiles"><div class="titlepage"><div><div><h4 class="title"><a name="id2666753"></a>NT4/200x User Profiles</h4></div></div></div><p>35 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2660668"></a>NT4/200x User Profiles</h4></div></div></div><p> 36 36 For example, to support Windows NT4/200x clients, set the following in the [global] section of the <code class="filename">smb.conf</code> file: 37 </p><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id2666776"></a><em class="parameter"><code>logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath</code></em></td></tr></table><p>37 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2660690"></a><em class="parameter"><code>logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath</code></em></td></tr></table><p> 38 38 This is typically implemented like: 39 </p><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id2666797"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr></table><p>40 where <span class="quote">“<span class="quote">%L</span>”</span> translates to the name of the Samba server and <span class="quote">“<span class="quote">%U</span>”</span>translates to the username.39 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2660711"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr></table><p> 40 where “<span class="quote">%L</span>” translates to the name of the Samba server and “<span class="quote">%U</span>” translates to the username. 41 41 </p><p> 42 42 The default for this option is <code class="filename">\\%N\%U\profile</code>, namely, <code class="filename">\\sambaserver\username\profile</code>. … … 44 44 a Samba server for the profiles, you must make the share that is specified in the logon path 45 45 browseable. Please refer to the man page for <code class="filename">smb.conf</code> regarding the different 46 semantics of <span class="quote">“<span class="quote">%L</span>”</span> and <span class="quote">“<span class="quote">%N</span>”</span>, as well as <span class="quote">“<span class="quote">%U</span>”</span> and <span class="quote">“<span class="quote">%u</span>”</span>.47 </p><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>48 <a class="indexterm" name="id266 6868"></a>49 <a class="indexterm" name="id266 6874"></a>46 semantics of “<span class="quote">%L</span>” and “<span class="quote">%N</span>”, as well as “<span class="quote">%U</span>” and “<span class="quote">%u</span>”. 47 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 48 <a class="indexterm" name="id2660782"></a> 49 <a class="indexterm" name="id2660789"></a> 50 50 MS Windows NT/200x clients at times do not disconnect a connection to a server between logons. It is recommended 51 51 to not use the <em class="parameter"><code>homes</code></em> metaservice name as part of the profile share path. 52 </p></div></div><div class="sect3" title="Windows 9x/Me User Profiles"><div class="titlepage"><div><div><h4 class="title"><a name="id2666893"></a>Windows 9x/Me User Profiles</h4></div></div></div><p>53 <a class="indexterm" name="id266 6901"></a>54 <a class="indexterm" name="id266 6908"></a>52 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2660807"></a>Windows 9x/Me User Profiles</h4></div></div></div><p> 53 <a class="indexterm" name="id2660815"></a> 54 <a class="indexterm" name="id2660822"></a> 55 55 To support Windows 9x/Me clients, you must use the <a class="link" href="smb.conf.5.html#LOGONHOME" target="_top">logon home</a> 56 56 parameter. Samba has been fixed so <strong class="userinput"><code>net use /home</code></strong> now works as well and it, too, relies 57 57 on the <em class="parameter"><code>logon home</code></em> parameter. 58 58 </p><p> 59 <a class="indexterm" name="id266 6943"></a>60 <a class="indexterm" name="id266 6950"></a>61 <a class="indexterm" name="id266 6957"></a>59 <a class="indexterm" name="id2660858"></a> 60 <a class="indexterm" name="id2660864"></a> 61 <a class="indexterm" name="id2660871"></a> 62 62 By using the <em class="parameter"><code>logon home</code></em> parameter, you are restricted to putting Windows 9x/Me profiles 63 63 in the user's home directory. But wait! There is a trick you can use. If you set the following in the 64 64 <em class="parameter"><code>[global]</code></em> section of your <code class="filename">smb.conf</code> file: 65 </p><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id2666990"></a><em class="parameter"><code>logon home = \\%L\%U\.profiles</code></em></td></tr></table><p>65 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2660905"></a><em class="parameter"><code>logon home = \\%L\%U\.profiles</code></em></td></tr></table><p> 66 66 then your Windows 9x/Me clients will dutifully put their clients in a subdirectory 67 67 of your home directory called <code class="filename">.profiles</code> (making them hidden). 68 68 </p><p> 69 <a class="indexterm" name="id266 7014"></a>69 <a class="indexterm" name="id2660928"></a> 70 70 Not only that, but <strong class="userinput"><code>net use /home</code></strong> will also work because of a feature in 71 71 Windows 9x/Me. It removes any directory stuff off the end of the home directory area 72 72 and only uses the server and share portion. That is, it looks like you 73 73 specified <code class="filename">\\%L\%U</code> for <a class="link" href="smb.conf.5.html#LOGONHOME" target="_top">logon home</a>. 74 </p></div><div class="sect3" title="Mixed Windows Windows 9x/Me and NT4/200x User Profiles"><div class="titlepage"><div><div><h4 class="title"><a name="id2667050"></a>Mixed Windows Windows 9x/Me and NT4/200x User Profiles</h4></div></div></div><p>74 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2660965"></a>Mixed Windows Windows 9x/Me and NT4/200x User Profiles</h4></div></div></div><p> 75 75 You can support profiles for Windows 9x and Windows NT clients by setting both the 76 76 <a class="link" href="smb.conf.5.html#LOGONHOME" target="_top">logon home</a> and <a class="link" href="smb.conf.5.html#LOGONPATH" target="_top">logon path</a> parameters. For example, 77 </p><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id2667090"></a><em class="parameter"><code>logon home = \\%L\%U\.profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2667102"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr></table><p>78 <a class="indexterm" name="id266 7116"></a>77 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2661005"></a><em class="parameter"><code>logon home = \\%L\%U\.profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2661016"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr></table><p> 78 <a class="indexterm" name="id2661030"></a> 79 79 Windows 9x/Me and NT4 and later profiles should not be stored in the same location because 80 80 Windows NT4 and later will experience problems with mixed profile environments. 81 </p></div><div class="sect3" title="Disabling Roaming Profile Support"><div class="titlepage"><div><div><h4 class="title"><a name="id2667128"></a>Disabling Roaming Profile Support</h4></div></div></div><p>82 <a class="indexterm" name="id266 7136"></a>83 The question often asked is, <span class="quote">“<span class="quote">How may I enforce use of local profiles?</span>”</span>or84 <span class="quote">“<span class="quote">How do I disable roaming profiles?</span>”</span> 85 </p><p> 86 <a class="indexterm" name="id266 7154"></a>81 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2661043"></a>Disabling Roaming Profile Support</h4></div></div></div><p> 82 <a class="indexterm" name="id2661051"></a> 83 The question often asked is, “<span class="quote">How may I enforce use of local profiles?</span>” or 84 “<span class="quote">How do I disable roaming profiles?</span>” 85 </p><p> 86 <a class="indexterm" name="id2661069"></a> 87 87 There are three ways of doing this: 88 </p><a class="indexterm" name="id266 7163"></a><div class="variablelist"><dl><dt><span class="term">In <code class="filename">smb.conf</code></span></dt><dd><p>88 </p><a class="indexterm" name="id2661078"></a><div class="variablelist"><dl><dt><span class="term">In <code class="filename">smb.conf</code></span></dt><dd><p> 89 89 Affect the following settings and ALL clients will be forced to use a local profile: 90 90 <a class="link" href="smb.conf.5.html#LOGONHOME" target="_top">logon home = </a> and <a class="link" href="smb.conf.5.html#LOGONPATH" target="_top">logon path = </a> … … 93 93 to specifically assign the empty value. 94 94 </p></dd><dt><span class="term">MS Windows Registry:</span></dt><dd><p> 95 <a class="indexterm" name="id266 7233"></a>96 <a class="indexterm" name="id266 7240"></a>95 <a class="indexterm" name="id2661148"></a> 96 <a class="indexterm" name="id2661154"></a> 97 97 Use the Microsoft Management Console (MMC) <code class="literal">gpedit.msc</code> to instruct your MS Windows XP 98 98 machine to use only a local profile. This, of course, modifies registry settings. The full … … 116 116 Consult the MS Windows registry guide for your particular MS Windows version for more information 117 117 about which registry keys to change to enforce use of only local user profiles. 118 </p><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>119 <a class="indexterm" name="id266 7333"></a>118 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 119 <a class="indexterm" name="id2661248"></a> 120 120 The specifics of how to convert a local profile to a roaming profile, or a roaming profile 121 121 to a local one, vary according to the version of MS Windows you are running. Consult the Microsoft MS 122 122 Windows Resource Kit for your version of Windows for specific information. 123 </p></div></div></div><div class="sect2" title="Windows Client Profile Configuration Information"><div class="titlepage"><div><div><h3 class="title"><a name="id2667353"></a>Windows Client Profile Configuration Information</h3></div></div></div><div class="sect3" title="Windows 9x/Me Profile Setup"><div class="titlepage"><div><div><h4 class="title"><a name="id2667359"></a>Windows 9x/Me Profile Setup</h4></div></div></div><p>123 </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2661267"></a>Windows Client Profile Configuration Information</h3></div></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2661273"></a>Windows 9x/Me Profile Setup</h4></div></div></div><p> 124 124 When a user first logs in on Windows 9x, the file user.DAT is created, as are folders <code class="filename">Start 125 125 Menu</code>, <code class="filename">Desktop</code>, <code class="filename">Programs</code>, and … … 129 129 profile folders. 130 130 </p><p> 131 <a class="indexterm" name="id266 7448"></a>132 <a class="indexterm" name="id266 7455"></a>131 <a class="indexterm" name="id2661363"></a> 132 <a class="indexterm" name="id2661369"></a> 133 133 The <code class="filename">user.DAT</code> file contains all the user's preferences. If you wish to enforce a set of preferences, 134 134 rename their <code class="filename">user.DAT</code> file to <code class="filename">user.MAN</code>, and deny them write access to this file. 135 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>135 </p><div class="orderedlist"><ol type="1"><li><p> 136 136 On the Windows 9x/Me machine, go to <span class="guimenu">Control Panel</span> -> 137 137 <span class="guimenuitem">Passwords</span> and select the <span class="guilabel">User Profiles</span> tab. 138 138 Select the required level of roaming preferences. Press <span class="guibutton">OK</span>, but do not 139 139 allow the computer to reboot. 140 </p></li><li class="listitem"><p>140 </p></li><li><p> 141 141 On the Windows 9x/Me machine, go to <span class="guimenu">Control Panel</span> -> 142 142 <span class="guimenuitem">Network</span> -> <span class="guimenuitem">Client for Microsoft Networks</span> … … 145 145 <span class="guibutton">OK</span>, and this time allow the computer to reboot. 146 146 </p></li></ol></div><p> 147 <a class="indexterm" name="id266 7576"></a>148 <a class="indexterm" name="id266 7583"></a>149 <a class="indexterm" name="id266 7590"></a>150 <a class="indexterm" name="id266 7597"></a>147 <a class="indexterm" name="id2661491"></a> 148 <a class="indexterm" name="id2661498"></a> 149 <a class="indexterm" name="id2661505"></a> 150 <a class="indexterm" name="id2661511"></a> 151 151 Under Windows 9x/Me, profiles are downloaded from the Primary Logon. If you have the Primary Logon 152 as <span class="quote">“<span class="quote">Client for Novell Networks</span>”</span>, then the profiles and logon script will be downloaded from153 your Novell server. If you have the Primary Logon as <span class="quote">“<span class="quote">Windows Logon</span>”</span>, then the profiles will152 as “<span class="quote">Client for Novell Networks</span>”, then the profiles and logon script will be downloaded from 153 your Novell server. If you have the Primary Logon as “<span class="quote">Windows Logon</span>”, then the profiles will 154 154 be loaded from the local machine a bit against the concept of roaming profiles, it would seem! 155 155 </p><p> 156 <a class="indexterm" name="id266 7624"></a>156 <a class="indexterm" name="id2661538"></a> 157 157 You will now find that the Microsoft Networks Login box contains <code class="constant">[user, password, domain]</code> instead 158 158 of just <code class="constant">[user, password]</code>. Type in the Samba server's domain name (or any other domain known to exist, … … 169 169 <code class="filename">Programs</code>, and <code class="filename">Nethood</code> folders have been created. 170 170 </p><p> 171 <a class="indexterm" name="id266 7710"></a>172 <a class="indexterm" name="id266 7717"></a>173 <a class="indexterm" name="id266 7724"></a>171 <a class="indexterm" name="id2661625"></a> 172 <a class="indexterm" name="id2661632"></a> 173 <a class="indexterm" name="id2661639"></a> 174 174 These folders will be cached locally on the client and updated when the user logs off (if 175 175 you haven't made them read-only by then). You will find that if the user creates further folders or … … 177 177 directory already on the local client, taking the newest folders and shortcut from each set. 178 178 </p><p> 179 <a class="indexterm" name="id266 7741"></a>180 <a class="indexterm" name="id266 7748"></a>181 <a class="indexterm" name="id266 7755"></a>182 <a class="indexterm" name="id266 7762"></a>179 <a class="indexterm" name="id2661655"></a> 180 <a class="indexterm" name="id2661662"></a> 181 <a class="indexterm" name="id2661669"></a> 182 <a class="indexterm" name="id2661676"></a> 183 183 If you have made the folders/files read-only on the Samba server, then you will get errors from 184 184 the Windows 9x/Me machine on logon and logout as it attempts to merge the local and remote profile. … … 186 186 and ownership rights on the profile directory contents, on the Samba server. 187 187 </p><p> 188 <a class="indexterm" name="id266 7778"></a>189 <a class="indexterm" name="id266 7785"></a>190 <a class="indexterm" name="id266 7792"></a>191 <a class="indexterm" name="id266 7799"></a>192 <a class="indexterm" name="id266 7806"></a>188 <a class="indexterm" name="id2661693"></a> 189 <a class="indexterm" name="id2661700"></a> 190 <a class="indexterm" name="id2661707"></a> 191 <a class="indexterm" name="id2661714"></a> 192 <a class="indexterm" name="id2661721"></a> 193 193 If you have problems creating user profiles, you can reset the user's local desktop cache, as shown below. 194 When this user next logs in, the user will be told that he/she is logging in <span class="quote">“<span class="quote">for the first195 time</span>” </span>.196 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>194 When this user next logs in, the user will be told that he/she is logging in “<span class="quote">for the first 195 time</span>”. 196 </p><div class="orderedlist"><ol type="1"><li><p> 197 197 Instead of logging in under the [user, password, domain] dialog, press <span class="guibutton">escape</span>. 198 </p></li><li class="listitem"><p>198 </p></li><li><p> 199 199 Run the <code class="literal">regedit.exe</code> program, and look in: 200 200 </p><p> … … 204 204 (likely to be <code class="filename">c:\windows\profiles\username</code>), then delete the key 205 205 <em class="parameter"><code>ProfilePath</code></em> for the required user. 206 </p></li><li class="listitem"><p>206 </p></li><li><p> 207 207 Exit the registry editor. 208 </p></li><li class="listitem"><p>208 </p></li><li><p> 209 209 Search for the user's .PWL password-caching file in the <code class="filename">c:\windows</code> directory, and delete it. 210 </p></li><li class="listitem"><p>210 </p></li><li><p> 211 211 Log off the Windows 9x/Me client. 212 </p></li><li class="listitem"><p>212 </p></li><li><p> 213 213 Check the contents of the profile path (see <a class="link" href="smb.conf.5.html#LOGONPATH" target="_top">logon path</a> 214 214 described above) and delete the <code class="filename">user.DAT</code> or <code class="filename">user.MAN</code> 215 215 file for the user, making a backup if required. 216 </p></li></ol></div><div class="warning" title="Warning"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>217 <a class="indexterm" name="id266 7937"></a>216 </p></li></ol></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 217 <a class="indexterm" name="id2661852"></a> 218 218 Before deleting the contents of the directory listed in the <em class="parameter"><code>ProfilePath</code></em> 219 219 (this is likely to be <code class="filename">c:\windows\profiles\username)</code>, ask whether the owner has … … 222 222 </p><p> 223 223 This will have the effect of removing the local (read-only hidden system file) <code class="filename">user.DAT</code> 224 in their profile directory, as well as the local <span class="quote">“<span class="quote">desktop,</span>”</span> <span class="quote">“<span class="quote">nethood,</span>”</span>225 <span class="quote">“<span class="quote">start menu,</span>”</span> and <span class="quote">“<span class="quote">programs</span>”</span>folders.224 in their profile directory, as well as the local “<span class="quote">desktop,</span>” “<span class="quote">nethood,</span>” 225 “<span class="quote">start menu,</span>” and “<span class="quote">programs</span>” folders. 226 226 </p></div><p> 227 <a class="indexterm" name="id266 7996"></a>228 <a class="indexterm" name="id266 8002"></a>229 <a class="indexterm" name="id266 8009"></a>230 <a class="indexterm" name="id266 8016"></a>227 <a class="indexterm" name="id2661910"></a> 228 <a class="indexterm" name="id2661917"></a> 229 <a class="indexterm" name="id2661924"></a> 230 <a class="indexterm" name="id2661931"></a> 231 231 If all else fails, increase Samba's debug log levels to between 3 and 10, and/or run a packet 232 232 sniffer program such as ethereal or <code class="literal">netmon.exe</code>, and look for error messages. 233 233 </p><p> 234 <a class="indexterm" name="id266 8035"></a>235 <a class="indexterm" name="id266 8042"></a>234 <a class="indexterm" name="id2661949"></a> 235 <a class="indexterm" name="id2661956"></a> 236 236 If you have access to an Windows NT4/200x server, then first set up roaming profiles and/or 237 237 netlogons on the Windows NT4/200x server. Make a packet trace, or examine the example packet traces 238 238 provided with Windows NT4/200x server, and see what the differences are with the equivalent Samba trace. 239 </p></div><div class="sect3" title="Windows NT4 Workstation"><div class="titlepage"><div><div><h4 class="title"><a name="id2668056"></a>Windows NT4 Workstation</h4></div></div></div><p>239 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2661970"></a>Windows NT4 Workstation</h4></div></div></div><p> 240 240 When a user first logs in to a Windows NT workstation, the profile NTuser.DAT is created. The profile 241 241 location can be now specified through the <a class="link" href="smb.conf.5.html#LOGONPATH" target="_top">logon path</a> parameter. … … 245 245 the new <a class="link" href="smb.conf.5.html#LOGONHOME" target="_top">logon home</a> parameter. 246 246 </p><p> 247 <a class="indexterm" name="id266 8116"></a>248 <a class="indexterm" name="id266 8123"></a>247 <a class="indexterm" name="id2662030"></a> 248 <a class="indexterm" name="id2662037"></a> 249 249 The entry for the NT4 profile is a directory, not a file. The NT help on profiles mentions that a 250 250 directory is also created with a .PDS extension. The user, while logging in, must have write permission … … 252 252 might be created). 253 253 </p><p> 254 <a class="indexterm" name="id266 8138"></a>254 <a class="indexterm" name="id2662053"></a> 255 255 In the profile directory, Windows NT4 creates more folders than Windows 9x/Me. It creates 256 256 <code class="filename">Application Data</code> and others, as well as <code class="filename">Desktop</code>, … … 259 259 in the .PDS directory, and its purpose is currently unknown. 260 260 </p><p> 261 <a class="indexterm" name="id266 8187"></a>262 <a class="indexterm" name="id266 8194"></a>261 <a class="indexterm" name="id2662102"></a> 262 <a class="indexterm" name="id2662108"></a> 263 263 You can use the <span class="application">System Control Panel</span> to copy a local profile onto 264 264 a Samba server (see NT help on profiles; it is also capable of firing up the correct location in the … … 268 268 The case of the profile is significant. The file must be called <code class="filename">NTuser.DAT</code> 269 269 or, for a mandatory profile, <code class="filename">NTuser.MAN</code>. 270 </p></div><div class="sect3" title="Windows 2000/XP Professional"><div class="titlepage"><div><div><h4 class="title"><a name="id2668248"></a>Windows 2000/XP Professional</h4></div></div></div><p>270 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2662162"></a>Windows 2000/XP Professional</h4></div></div></div><p> 271 271 You must first convert the profile from a local profile to a domain profile on the MS Windows 272 workstation as follows: </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> Log on as the <span class="emphasis"><em>local</em></span> workstation administrator. </p></li><li class="step" title="Step 2"><p> Right-click on the <span class="guiicon">My Computer</span> icon, and select273 <span class="guimenuitem">Properties</span>.</p></li><li class="step" title="Step 3"><p> Click on the <span class="guilabel">User Profiles</span> tab.</p></li><li class="step" title="Step 4"><p> Select the profile you wish to convert (click it once).</p></li><li class="step" title="Step 5"><p> Click on the <span class="guibutton">Copy To</span> button.</p></li><li class="step" title="Step 6"><p> In the <span class="guilabel">Permitted to use</span> box, click on the274 <span class="guibutton">Change</span> button. </p></li><li class="step" title="Step 7"><p> Click on the <span class="guilabel">Look in</span> area that lists the machine name. When you click here, it will275 open up a selection box. Click on the domain to which the profile must be accessible. </p><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>You will need to log on if a logon box opens up.272 workstation as follows: </p><div class="procedure"><ol type="1"><li><p> Log on as the <span class="emphasis"><em>local</em></span> workstation administrator. </p></li><li><p> Right-click on the <span class="guiicon">My Computer</span> icon, and select 273 <span class="guimenuitem">Properties</span>.</p></li><li><p> Click on the <span class="guilabel">User Profiles</span> tab.</p></li><li><p> Select the profile you wish to convert (click it once).</p></li><li><p> Click on the <span class="guibutton">Copy To</span> button.</p></li><li><p> In the <span class="guilabel">Permitted to use</span> box, click on the 274 <span class="guibutton">Change</span> button. </p></li><li><p> Click on the <span class="guilabel">Look in</span> area that lists the machine name. When you click here, it will 275 open up a selection box. Click on the domain to which the profile must be accessible. </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>You will need to log on if a logon box opens up. 276 276 For example, connect as <em class="replaceable"><code>DOMAIN</code></em>\root, password: 277 <em class="replaceable"><code>mypassword</code></em>.</p></div></li><li class="step" title="Step 8"><p> To make the profile capable of being used by anyone, select <span class="quote">“<span class="quote">Everyone</span>”</span>. </p></li><li class="step" title="Step 9"><p> Click on <span class="guibutton">OK</span> and the Selection box will close. </p></li><li class="step" title="Step 10"><p> Now click on <span class="guibutton">OK</span> to create the profile in the path277 <em class="replaceable"><code>mypassword</code></em>.</p></div></li><li><p> To make the profile capable of being used by anyone, select “<span class="quote">Everyone</span>”. </p></li><li><p> Click on <span class="guibutton">OK</span> and the Selection box will close. </p></li><li><p> Now click on <span class="guibutton">OK</span> to create the profile in the path 278 278 you nominated. </p></li></ol></div><p> 279 279 Done. You now have a profile that can be edited using the Samba <code class="literal">profiles</code> tool. 280 </p><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>280 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 281 281 Under Windows NT/200x, the use of mandatory profiles forces the use of MS Exchange storage of mail 282 282 data and keeps it out of the desktop profile. That keeps desktop profiles from becoming unusable. 283 </p></div><div class="sect4" title="Windows XP Service Pack 1"><div class="titlepage"><div><div><h5 class="title"><a name="id2668430"></a>Windows XP Service Pack 1</h5></div></div></div><p>283 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2662344"></a>Windows XP Service Pack 1</h5></div></div></div><p> 284 284 There is a security check new to Windows XP (or maybe only Windows XP service pack 1). 285 285 It can be disabled via a group policy in the Active Directory. The policy is called: … … 294 294 </p><p>If you cannot set group policies in Samba, then you may be able to set the policy locally on 295 295 each machine. If you want to try this, then do the following: 296 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>On the XP workstation, log in with an administrative account.</p></li><li class="step" title="Step 2"><p>Click on <span class="guimenu">Start</span> -> <span class="guimenuitem">Run</span>.</p></li><li class="step" title="Step 3"><p>Type <code class="literal">mmc</code>.</p></li><li class="step" title="Step 4"><p>Click on <span class="guibutton">OK</span>.</p></li><li class="step" title="Step 5"><p>A Microsoft Management Console should appear.</p></li><li class="step" title="Step 6"><p>Click on <span class="guimenu">File</span> -> <span class="guimenuitem">Add/Remove Snap-in</span> -> <span class="guimenuitem">Add</span>.</p></li><li class="step" title="Step 7"><p>Double-click on <span class="guiicon">Group Policy</span>.</p></li><li class="step" title="Step 8"><p>Click on <span class="guibutton">Finish</span> -> <span class="guibutton">Close</span>.</p></li><li class="step" title="Step 9"><p>Click on <span class="guibutton">OK</span>.</p></li><li class="step" title="Step 10"><p>In the <span class="quote">“<span class="quote">Console Root</span>”</span>window expand <span class="guiicon">Local Computer Policy</span> ->296 </p><div class="procedure"><ol type="1"><li><p>On the XP workstation, log in with an administrative account.</p></li><li><p>Click on <span class="guimenu">Start</span> -> <span class="guimenuitem">Run</span>.</p></li><li><p>Type <code class="literal">mmc</code>.</p></li><li><p>Click on <span class="guibutton">OK</span>.</p></li><li><p>A Microsoft Management Console should appear.</p></li><li><p>Click on <span class="guimenu">File</span> -> <span class="guimenuitem">Add/Remove Snap-in</span> -> <span class="guimenuitem">Add</span>.</p></li><li><p>Double-click on <span class="guiicon">Group Policy</span>.</p></li><li><p>Click on <span class="guibutton">Finish</span> -> <span class="guibutton">Close</span>.</p></li><li><p>Click on <span class="guibutton">OK</span>.</p></li><li><p>In the “<span class="quote">Console Root</span>” window expand <span class="guiicon">Local Computer Policy</span> -> 297 297 <span class="guiicon">Computer Configuration</span> -> <span class="guiicon">Administrative Templates</span> -> 298 <span class="guiicon">System</span> -> <span class="guiicon">User Profiles</span>.</p></li><li class="step" title="Step 11"><p>Double-click on <span class="guilabel">Do not check for user ownership of Roaming Profile Folders</span>.</p></li><li class="step" title="Step 12"><p>Select <span class="guilabel">Enabled</span>.</p></li><li class="step" title="Step 13"><p>Click on <span class="guibutton">OK</span>.</p></li><li class="step" title="Step 14"><p>Close the whole console. You do not need to save the settings (this refers to the299 console settings rather than the policies you have changed).</p></li><li class="step" title="Step 15"><p>Reboot.</p></li></ol></div></div></div></div><div class="sect2" title="User Profile Hive Cleanup Service"><div class="titlepage"><div><div><h3 class="title"><a name="id2668697"></a>User Profile Hive Cleanup Service</h3></div></div></div><p>298 <span class="guiicon">System</span> -> <span class="guiicon">User Profiles</span>.</p></li><li><p>Double-click on <span class="guilabel">Do not check for user ownership of Roaming Profile Folders</span>.</p></li><li><p>Select <span class="guilabel">Enabled</span>.</p></li><li><p>Click on <span class="guibutton">OK</span>.</p></li><li><p>Close the whole console. You do not need to save the settings (this refers to the 299 console settings rather than the policies you have changed).</p></li><li><p>Reboot.</p></li></ol></div></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2662612"></a>User Profile Hive Cleanup Service</h3></div></div></div><p> 300 300 There are certain situations that cause a cached local copy of roaming profile not to be deleted on exit, even if 301 301 the policy to force such deletion is set. To deal with that situation, a special service was created. The application … … 304 304 </p><p> 305 305 The UPHClean software package can be downloaded from the User Profile Hive Cleanup 306 Service<sup>[<a name="id266 8722" href="#ftn.id2668722" class="footnote">7</a>]</sup>306 Service<sup>[<a name="id2662636" href="#ftn.id2662636" class="footnote">7</a>]</sup> 307 307 web site. 308 </p></div><div class="sect2" title="Sharing Profiles between Windows 9x/Me and NT4/200x/XP Workstations"><div class="titlepage"><div><div><h3 class="title"><a name="id2668731"></a>Sharing Profiles between Windows 9x/Me and NT4/200x/XP Workstations</h3></div></div></div><p>309 <a class="indexterm" name="id266 8739"></a>310 <a class="indexterm" name="id266 8746"></a>308 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2662645"></a>Sharing Profiles between Windows 9x/Me and NT4/200x/XP Workstations</h3></div></div></div><p> 309 <a class="indexterm" name="id2662654"></a> 310 <a class="indexterm" name="id2662661"></a> 311 311 Sharing of desktop profiles between Windows versions is not recommended. Desktop profiles are an 312 312 evolving phenomenon, and profiles for later versions of MS Windows clients add features that may interfere … … 320 320 <a class="link" href="smb.conf.5.html#LOGONPATH" target="_top">logon path</a> and <a class="link" href="smb.conf.5.html#LOGONHOME" target="_top">logon home</a>. 321 321 </p><p> 322 <a class="indexterm" name="id266 8801"></a>323 <a class="indexterm" name="id266 8808"></a>322 <a class="indexterm" name="id2662716"></a> 323 <a class="indexterm" name="id2662722"></a> 324 324 If you have this set up correctly, you will find separate <code class="filename">user.DAT</code> and 325 325 <code class="filename">NTuser.DAT</code> files in the same profile directory. 326 </p></div><div class="sect2" title="Profile Migration from Windows NT4/200x Server to Samba"><div class="titlepage"><div><div><h3 class="title"><a name="id2668829"></a>Profile Migration from Windows NT4/200x Server to Samba</h3></div></div></div><p>327 <a class="indexterm" name="id266 8838"></a>326 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2662744"></a>Profile Migration from Windows NT4/200x Server to Samba</h3></div></div></div><p> 327 <a class="indexterm" name="id2662752"></a> 328 328 There is nothing to stop you from specifying any path that you like for the location of users' profiles. 329 329 Therefore, you could specify that the profile be stored on a Samba server or any other SMB server, 330 330 as long as that SMB server supports encrypted passwords. 331 </p><div class="sect3" title="Windows NT4 Profile Management Tools"><div class="titlepage"><div><div><h4 class="title"><a name="profilemigrn"></a>Windows NT4 Profile Management Tools</h4></div></div></div><p>332 <a class="indexterm" name="id266 8863"></a>331 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="profilemigrn"></a>Windows NT4 Profile Management Tools</h4></div></div></div><p> 332 <a class="indexterm" name="id2662777"></a> 333 333 Unfortunately, the resource kit information is specific to the version of MS Windows NT4/200x. The 334 334 correct resource kit is required for each platform. 335 </p><p>Here is a quick guide:</p><div class="procedure" title="Procedure 27.1. Profile Migration Procedure"><a name="id2668877"></a><p class="title"><b>Procedure 27.1. Profile Migration Procedure</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> On your NT4 domain controller, right-click on <span class="guiicon">My Computer</span>, then select336 <span class="guilabel">Properties</span>, then the tab labeled <span class="guilabel">User Profiles</span>. </p></li><li class="step" title="Step 2"><p> Select a user profile you want to migrate and click on it. </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>I am using the term <span class="quote">“<span class="quote">migrate</span>”</span>loosely. You can copy a profile to create a group335 </p><p>Here is a quick guide:</p><div class="procedure"><a name="id2662791"></a><p class="title"><b>Procedure 27.1. Profile Migration Procedure</b></p><ol type="1"><li><p> On your NT4 domain controller, right-click on <span class="guiicon">My Computer</span>, then select 336 <span class="guilabel">Properties</span>, then the tab labeled <span class="guilabel">User Profiles</span>. </p></li><li><p> Select a user profile you want to migrate and click on it. </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>I am using the term “<span class="quote">migrate</span>” loosely. You can copy a profile to create a group 337 337 profile. You can give the user <em class="parameter"><code>Everyone</code></em> rights to the profile you copy this to. That 338 338 is what you need to do, since your Samba domain is not a member of a trust relationship with your NT4 339 PDC.</p></div></li><li class="step" title="Step 3"><p>Click on the <span class="guibutton">Copy To</span> button.</p></li><li class="step" title="Step 4"><p>In the box labeled <span class="guilabel">Copy Profile to</span> add your new path, such as,340 <code class="filename">c:\temp\foobar</code></p></li><li class="step" title="Step 5"><p>Click on <span class="guibutton">Change</span> in the <span class="guilabel">Permitted to use</span> box.</p></li><li class="step" title="Step 6"><p>Click on the group <span class="quote">“<span class="quote">Everyone</span>”</span>, click on <span class="guibutton">OK</span>. This341 closes the <span class="quote">“<span class="quote">choose user</span>”</span> box.</p></li><li class="step" title="Step 7"><p>Now click on <span class="guibutton">OK</span>.</p></li></ol></div><p>339 PDC.</p></div></li><li><p>Click on the <span class="guibutton">Copy To</span> button.</p></li><li><p>In the box labeled <span class="guilabel">Copy Profile to</span> add your new path, such as, 340 <code class="filename">c:\temp\foobar</code></p></li><li><p>Click on <span class="guibutton">Change</span> in the <span class="guilabel">Permitted to use</span> box.</p></li><li><p>Click on the group “<span class="quote">Everyone</span>”, click on <span class="guibutton">OK</span>. This 341 closes the “<span class="quote">choose user</span>” box.</p></li><li><p>Now click on <span class="guibutton">OK</span>.</p></li></ol></div><p> 342 342 Follow these steps for every profile you need to migrate. 343 </p></div><div class="sect3" title="Side Bar Notes"><div class="titlepage"><div><div><h4 class="title"><a name="id2669023"></a>Side Bar Notes</h4></div></div></div><p>344 <a class="indexterm" name="id266 9031"></a>345 <a class="indexterm" name="id266 9038"></a>343 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2662938"></a>Side Bar Notes</h4></div></div></div><p> 344 <a class="indexterm" name="id2662946"></a> 345 <a class="indexterm" name="id2662952"></a> 346 346 You should obtain the SID of your NT4 domain. You can use the <code class="literal">net rpc info</code> to do this. 347 347 See <a class="link" href="NetCommand.html" title="Chapter 13. Remote and Local Management: The Net Command">The Net Command Chapter</a>, <a class="link" href="NetCommand.html#netmisc1" title="Other Miscellaneous Operations">Other Miscellaneous Operations</a> for more information. 348 </p></div><div class="sect3" title="moveuser.exe"><div class="titlepage"><div><div><h4 class="title"><a name="id2669074"></a>moveuser.exe</h4></div></div></div><p>349 <a class="indexterm" name="id266 9082"></a>348 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2662989"></a>moveuser.exe</h4></div></div></div><p> 349 <a class="indexterm" name="id2662997"></a> 350 350 The Windows 200x professional resource kit has <code class="literal">moveuser.exe</code>. 351 351 <code class="literal">moveuser.exe</code> changes the security of a profile from one user to another. This allows the … … 353 353 </p><p> 354 354 This command is like the Samba <code class="literal">profiles</code> tool. 355 </p></div><div class="sect3" title="Get SID"><div class="titlepage"><div><div><h4 class="title"><a name="id2669116"></a>Get SID</h4></div></div></div><p>356 <a class="indexterm" name="id266 9124"></a>357 <a class="indexterm" name="id266 9130"></a>355 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2663030"></a>Get SID</h4></div></div></div><p> 356 <a class="indexterm" name="id2663038"></a> 357 <a class="indexterm" name="id2663045"></a> 358 358 You can identify the SID by using <code class="literal">GetSID.exe</code> from the Windows NT Server 4.0 Resource Kit. 359 359 </p><p> … … 365 365 to move, find the SID for the user with the <code class="literal">GetSID.exe</code> utility.) Inside the appropriate user's subkey, 366 366 you will see a string value named <em class="parameter"><code>ProfileImagePath</code></em>. 367 </p></div></div></div><div class="sect1" title="Mandatory Profiles"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2669181"></a>Mandatory Profiles</h2></div></div></div><p>368 <a class="indexterm" name="id266 9189"></a>367 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2663095"></a>Mandatory Profiles</h2></div></div></div><p> 368 <a class="indexterm" name="id2663103"></a> 369 369 A mandatory profile is a profile that the user does not have the ability to overwrite. During the 370 370 user's session, it may be possible to change the desktop environment; however, as the user logs out, all changes … … 372 372 then this must be done through policy settings. See <a class="link" href="PolicyMgmt.html" title="Chapter 26. System and Account Policies">System and Account 373 373 Policies</a>. 374 </p><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>375 <a class="indexterm" name="id266 9213"></a>376 <a class="indexterm" name="id266 9220"></a>377 <a class="indexterm" name="id266 9227"></a>374 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 375 <a class="indexterm" name="id2663128"></a> 376 <a class="indexterm" name="id2663135"></a> 377 <a class="indexterm" name="id2663142"></a> 378 378 Under NO circumstances should the profile directory (or its contents) be made read-only because this may 379 379 render the profile unusable. Where it is essential to make a profile read-only within the UNIX file system, … … 381 381 instruct MS Windows NT/200x/XP clients that the Profile has write permission for the user. See <a class="link" href="VFS.html#fakeperms" title="fake_perms">fake_perms VFS module</a>. 382 382 </p></div><p> 383 <a class="indexterm" name="id266 9258"></a>384 <a class="indexterm" name="id266 9264"></a>383 <a class="indexterm" name="id2663172"></a> 384 <a class="indexterm" name="id2663179"></a> 385 385 For MS Windows NT4/200x/XP, the procedure shown in <a class="link" href="ProfileMgmt.html#profilemigrn" title="Windows NT4 Profile Management Tools">Profile Migration from Windows 386 386 NT4/200x Server to Samba</a> can also be used to create mandatory profiles. To convert a group profile into … … 388 388 it to <code class="filename">NTUser.MAN</code>. 389 389 </p><p> 390 <a class="indexterm" name="id266 9299"></a>390 <a class="indexterm" name="id2663213"></a> 391 391 For MS Windows 9x/Me, it is the <code class="filename">User.DAT</code> file that must be renamed to 392 392 <code class="filename">User.MAN</code> to effect a mandatory profile. 393 </p></div><div class="sect1" title="Creating and Managing Group Profiles"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2669321"></a>Creating and Managing Group Profiles</h2></div></div></div><p>394 <a class="indexterm" name="id266 9329"></a>395 <a class="indexterm" name="id266 9336"></a>396 <a class="indexterm" name="id266 9343"></a>397 <a class="indexterm" name="id266 9350"></a>393 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2663236"></a>Creating and Managing Group Profiles</h2></div></div></div><p> 394 <a class="indexterm" name="id2663244"></a> 395 <a class="indexterm" name="id2663250"></a> 396 <a class="indexterm" name="id2663257"></a> 397 <a class="indexterm" name="id2663264"></a> 398 398 Most organizations are arranged into departments. There is a nice benefit in this fact, since usually 399 399 most users in a department require the same desktop applications and the same desktop layout. MS … … 402 402 assigned access rights for the user group that needs to be given access to the group profile. 403 403 </p><p> 404 <a class="indexterm" name="id266 9377"></a>404 <a class="indexterm" name="id2663291"></a> 405 405 The next step is rather important. Instead of assigning a group profile to users (Using User Manager) 406 on a <span class="quote">“<span class="quote">per-user</span>”</span>basis, the group itself is assigned the now modified profile.407 </p><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>406 on a “<span class="quote">per-user</span>” basis, the group itself is assigned the now modified profile. 407 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 408 408 Be careful with group profiles. If the user who is a member of a group also has a personal 409 409 profile, then the result will be a fusion (merge) of the two. 410 </p></div></div><div class="sect1" title="Default Profile for Windows Users"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2669400"></a>Default Profile for Windows Users</h2></div></div></div><p>411 <a class="indexterm" name="id266 9408"></a>412 <a class="indexterm" name="id266 9415"></a>410 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2663314"></a>Default Profile for Windows Users</h2></div></div></div><p> 411 <a class="indexterm" name="id2663322"></a> 412 <a class="indexterm" name="id2663329"></a> 413 413 MS Windows 9x/Me and NT4/200x/XP will use a default profile for any user for whom a profile 414 414 does not already exist. Armed with a knowledge of where the default profile is located on the Windows … … 416 416 it is possible to modify the default profile to one that has been optimized for the site. This has 417 417 significant administrative advantages. 418 </p><div class="sect2" title="MS Windows 9x/Me"><div class="titlepage"><div><div><h3 class="title"><a name="id2669430"></a>MS Windows 9x/Me</h3></div></div></div><p>419 <a class="indexterm" name="id266 9438"></a>420 <a class="indexterm" name="id266 9445"></a>418 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2663345"></a>MS Windows 9x/Me</h3></div></div></div><p> 419 <a class="indexterm" name="id2663352"></a> 420 <a class="indexterm" name="id2663360"></a> 421 421 To enable default per-use profiles in Windows 9x/Me, you can either use the <span class="application">Windows 422 422 98 System Policy Editor</span> or change the registry directly. … … 428 428 changes. 429 429 </p><p> 430 <a class="indexterm" name="id266 9506"></a>430 <a class="indexterm" name="id2663421"></a> 431 431 To modify the registry directly, launch the <span class="application">Registry Editor</span> 432 432 (<code class="literal">regedit.exe</code>) and select the hive <code class="filename">HKEY_LOCAL_MACHINE\Network\Logon</code>. 433 Now add a DWORD type key with the name <span class="quote">“<span class="quote">User Profiles.</span>”</span>To enable user profiles to set the value433 Now add a DWORD type key with the name “<span class="quote">User Profiles.</span>” To enable user profiles to set the value 434 434 to 1; to disable user profiles set it to 0. 435 </p><div class="sect3" title="User Profile Handling with Windows 9x/Me"><div class="titlepage"><div><div><h4 class="title"><a name="id2669539"></a>User Profile Handling with Windows 9x/Me</h4></div></div></div><p>435 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2663454"></a>User Profile Handling with Windows 9x/Me</h4></div></div></div><p> 436 436 When a user logs on to a Windows 9x/Me machine, the local profile path, 437 437 <code class="filename">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList</code>, is checked … … 449 449 changes that the user made are written to the user's local profile. If the user has a roaming profile, 450 450 the changes are written to the user's profile on the server. 451 </p></div></div><div class="sect2" title="MS Windows NT4 Workstation"><div class="titlepage"><div><div><h3 class="title"><a name="id2669587"></a>MS Windows NT4 Workstation</h3></div></div></div><p>451 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2663502"></a>MS Windows NT4 Workstation</h3></div></div></div><p> 452 452 On MS Windows NT4, the default user profile is obtained from the location 453 453 <code class="filename">%SystemRoot%\Profiles</code>, which in a default installation will translate to … … 462 462 </p><p> 463 463 When a new user first logs onto an MS Windows NT4 machine, a new profile is created from: 464 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>All Users settings.</p></li><li class="listitem"><p>Default User settings (contains the default <code class="filename">NTUser.DAT</code> file).</p></li></ul></div><p>465 <a class="indexterm" name="id266 9675"></a>464 </p><div class="itemizedlist"><ul type="disc"><li><p>All Users settings.</p></li><li><p>Default User settings (contains the default <code class="filename">NTUser.DAT</code> file).</p></li></ul></div><p> 465 <a class="indexterm" name="id2663589"></a> 466 466 When a user logs on to an MS Windows NT4 machine that is a member of a Microsoft security domain, 467 467 the following steps are followed for profile handling: 468 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> The user's account information that is obtained during the logon process468 </p><div class="procedure"><ol type="1"><li><p> The user's account information that is obtained during the logon process 469 469 contains the location of the user's desktop profile. The profile path may be local to 470 470 the machine or it may be located on a network share. If there exists a profile at the … … 472 472 <code class="filename">%SystemRoot%\Profiles\%USERNAME%</code>. This profile then inherits the settings 473 473 in the <code class="filename">All Users</code> profile in the <code class="filename">%SystemRoot%\Profiles</code> 474 location. </p></li><li class="step" title="Step 2"><p> If the user account has a profile path, but at its location a profile does not474 location. </p></li><li><p> If the user account has a profile path, but at its location a profile does not 475 475 exist, then a new profile is created in the <code class="filename">%SystemRoot%\Profiles\%USERNAME%</code> 476 directory from reading the <code class="filename">Default User</code> profile. </p></li><li class="step" title="Step 3"><p>477 <a class="indexterm" name="id266 9752"></a>478 <a class="indexterm" name="id266 9759"></a>479 <a class="indexterm" name="id266 9766"></a>480 <a class="indexterm" name="id266 9773"></a>481 <a class="indexterm" name="id266 9780"></a>476 directory from reading the <code class="filename">Default User</code> profile. </p></li><li><p> 477 <a class="indexterm" name="id2663666"></a> 478 <a class="indexterm" name="id2663673"></a> 479 <a class="indexterm" name="id2663680"></a> 480 <a class="indexterm" name="id2663687"></a> 481 <a class="indexterm" name="id2663694"></a> 482 482 If the NETLOGON share on the authenticating server (logon server) contains 483 483 a policy file (<code class="filename">NTConfig.POL</code>), then its contents are applied to the 484 484 <code class="filename">NTUser.DAT</code>, which is applied to the <code class="filename">HKEY_CURRENT_USER</code> 485 485 part of the registry. 486 </p></li><li class="step" title="Step 4"><p> When the user logs out, if the profile is set to be a roaming profile, it will be486 </p></li><li><p> When the user logs out, if the profile is set to be a roaming profile, it will be 487 487 written out to the location of the profile. The <code class="filename">NTuser.DAT</code> file is then 488 488 re-created from the contents of the <code class="filename">HKEY_CURRENT_USER</code> contents. Thus, … … 501 501 on logout. 502 502 </p><p> 503 <a class="indexterm" name="id266 9887"></a>503 <a class="indexterm" name="id2663802"></a> 504 504 Under MS Windows NT4, default locations for common resources like <code class="filename">My Documents</code> 505 505 may be redirected to a network share by modifying the following registry keys. These changes may be … … 520 520 \User Shell Folders 521 521 </pre><p> 522 <a class="indexterm" name="id266 9927"></a>522 <a class="indexterm" name="id2663842"></a> 523 523 </p><p> The above hive key contains a list of automatically managed 524 524 folders. The default entries are shown in <a class="link" href="ProfileMgmt.html#ProfileLocs" title="Table 27.1. User Shell Folder Registry Keys Default Values">the next table</a>. … … 530 530 </p><p> 531 531 The default entries are shown in <a class="link" href="ProfileMgmt.html#regkeys" title="Table 27.2. Defaults of Profile Settings Registry Keys">Defaults of Profile Settings Registry Keys</a>. 532 </p><div class="table"><a name="regkeys"></a><p class="title"><b>Table 27.2. Defaults of Profile Settings Registry Keys</b></p><div class="table-contents"><table summary="Defaults of Profile Settings Registry Keys" border="1"><colgroup><col align="left"><col align="left"></colgroup><tbody><tr><td align="left">Common Desktop</td><td align="left">%SystemRoot%\Profiles\All Users\Desktop</td></tr><tr><td align="left">Common Programs</td><td align="left">%SystemRoot%\Profiles\All Users\Programs</td></tr><tr><td align="left">Common Start Menu</td><td align="left">%SystemRoot%\Profiles\All Users\Start Menu</td></tr><tr><td align="left">Common Startup</td><td align="left">%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" title="MS Windows 200x/XP"><div class="titlepage"><div><div><h3 class="title"><a name="id2670149"></a>MS Windows 200x/XP</h3></div></div></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>533 <a class="indexterm" name="id26 70158"></a>534 <a class="indexterm" name="id26 70165"></a>535 <a class="indexterm" name="id26 70172"></a>536 <a class="indexterm" name="id26 70179"></a>532 </p><div class="table"><a name="regkeys"></a><p class="title"><b>Table 27.2. Defaults of Profile Settings Registry Keys</b></p><div class="table-contents"><table summary="Defaults of Profile Settings Registry Keys" border="1"><colgroup><col align="left"><col align="left"></colgroup><tbody><tr><td align="left">Common Desktop</td><td align="left">%SystemRoot%\Profiles\All Users\Desktop</td></tr><tr><td align="left">Common Programs</td><td align="left">%SystemRoot%\Profiles\All Users\Programs</td></tr><tr><td align="left">Common Start Menu</td><td align="left">%SystemRoot%\Profiles\All Users\Start Menu</td></tr><tr><td align="left">Common Startup</td><td align="left">%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2664064"></a>MS Windows 200x/XP</h3></div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 533 <a class="indexterm" name="id2664073"></a> 534 <a class="indexterm" name="id2664080"></a> 535 <a class="indexterm" name="id2664087"></a> 536 <a class="indexterm" name="id2664093"></a> 537 537 MS Windows XP Home Edition does use default per-user profiles, but cannot participate 538 538 in domain security, cannot log onto an NT/ADS-style domain, and thus can obtain the profile only … … 541 541 profile and enforce it through the use of Group Policy Objects (GPOs). 542 542 </p></div><p> 543 <a class="indexterm" name="id26 70197"></a>543 <a class="indexterm" name="id2664111"></a> 544 544 When a new user first logs onto an MS Windows 200x/XP machine, the default profile is obtained from 545 545 <code class="filename">C:\Documents and Settings\Default User</code>. The administrator can modify or change the … … 547 547 since it will involve copying a new default profile to every MS Windows 200x/XP client workstation. 548 548 </p><p> 549 <a class="indexterm" name="id26 70219"></a>549 <a class="indexterm" name="id2664134"></a> 550 550 When MS Windows 200x/XP participates in a domain security context, and if the default user profile is not 551 551 found, then the client will search for a default profile in the NETLOGON share of the authenticating server. … … 553 553 and if one exists there, it will copy this to the workstation in the <code class="filename">C:\Documents and 554 554 Settings\</code> under the Windows login name of the use. 555 </p><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> This path translates, in Samba parlance, to the <code class="filename">smb.conf</code>555 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> This path translates, in Samba parlance, to the <code class="filename">smb.conf</code> 556 556 <em class="parameter"><code>[NETLOGON]</code></em> share. The directory should be created at the root 557 557 of this share and must be called <code class="filename">Default User</code>. … … 560 560 settings that pertain to the user. If no specific policies have been created or passed to the client 561 561 during the login process (as Samba does automatically), then the user's profile is written to the 562 local machine only under the path <code class="filename">C:\Documents and Settings\%USERNAME%</code>. </p><p> Those wishing to modify the default behavior can do so through these three methods: </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> Modify the registry keys on the local machine manually and place the new562 local machine only under the path <code class="filename">C:\Documents and Settings\%USERNAME%</code>. </p><p> Those wishing to modify the default behavior can do so through these three methods: </p><div class="itemizedlist"><ul type="disc"><li><p> Modify the registry keys on the local machine manually and place the new 563 563 default profile in the NETLOGON share root. This is not recommended because it is maintenance intensive. 564 </p></li><li class="listitem"><p> Create an NT4-style NTConfig.POL file that specifies this behavior and locate565 this file in the root of the NETLOGON share along with the new default profile. </p></li><li class="listitem"><p> Create a GPO that enforces this through Active Directory, and place the new564 </p></li><li><p> Create an NT4-style NTConfig.POL file that specifies this behavior and locate 565 this file in the root of the NETLOGON share along with the new default profile. </p></li><li><p> Create a GPO that enforces this through Active Directory, and place the new 566 566 default profile in the NETLOGON share. </p></li></ul></div><p>The registry hive key that affects the behavior of folders that are part of the default user 567 567 profile are controlled by entries on Windows 200x/XP is: </p><p> <code class="filename">HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell … … 569 569 This hive key contains a list of automatically managed folders. The default entries are shown 570 570 in <a class="link" href="ProfileMgmt.html#defregpthkeys" title="Table 27.3. Defaults of Default User Profile Paths Registry Keys">the next table</a> 571 <a class="indexterm" name="id26 70356"></a>572 </p><div class="table"><a name="defregpthkeys"></a><p class="title"><b>Table 27.3. Defaults of Default User Profile Paths Registry Keys</b></p><div class="table-contents"><table summary="Defaults of Default User Profile Paths Registry Keys" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Name</th><th align="left">Default Value</th></tr></thead><tbody><tr><td align="left">AppData</td><td align="left">%USERPROFILE%\Application Data</td></tr><tr><td align="left">Cache</td><td align="left">%USERPROFILE%\Local Settings\Temporary Internet Files</td></tr><tr><td align="left">Cookies</td><td align="left">%USERPROFILE%\Cookies</td></tr><tr><td align="left">Desktop</td><td align="left">%USERPROFILE%\Desktop</td></tr><tr><td align="left">Favorites</td><td align="left">%USERPROFILE%\Favorites</td></tr><tr><td align="left">History</td><td align="left">%USERPROFILE%\Local Settings\History</td></tr><tr><td align="left">Local AppData</td><td align="left">%USERPROFILE%\Local Settings\Application Data</td></tr><tr><td align="left">Local Settings</td><td align="left">%USERPROFILE%\Local Settings</td></tr><tr><td align="left">My Pictures</td><td align="left">%USERPROFILE%\My Documents\My Pictures</td></tr><tr><td align="left">NetHood</td><td align="left">%USERPROFILE%\NetHood</td></tr><tr><td align="left">Personal</td><td align="left">%USERPROFILE%\My Documents</td></tr><tr><td align="left">PrintHood</td><td align="left">%USERPROFILE%\PrintHood</td></tr><tr><td align="left">Programs</td><td align="left">%USERPROFILE%\Start Menu\Programs</td></tr><tr><td align="left">Recent</td><td align="left">%USERPROFILE%\Recent</td></tr><tr><td align="left">SendTo</td><td align="left">%USERPROFILE%\SendTo</td></tr><tr><td align="left">Start Menu</td><td align="left">%USERPROFILE%\Start Menu</td></tr><tr><td align="left">Startup</td><td align="left">%USERPROFILE%\Start Menu\Programs\Startup</td></tr><tr><td align="left">Templates</td><td align="left">%USERPROFILE%\Templates</td></tr></tbody></table></div></div><br class="table-break"><p> There is also an entry called <span class="quote">“<span class="quote">Default</span>”</span>that has no value set. The default entry is571 <a class="indexterm" name="id2664271"></a> 572 </p><div class="table"><a name="defregpthkeys"></a><p class="title"><b>Table 27.3. Defaults of Default User Profile Paths Registry Keys</b></p><div class="table-contents"><table summary="Defaults of Default User Profile Paths Registry Keys" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Name</th><th align="left">Default Value</th></tr></thead><tbody><tr><td align="left">AppData</td><td align="left">%USERPROFILE%\Application Data</td></tr><tr><td align="left">Cache</td><td align="left">%USERPROFILE%\Local Settings\Temporary Internet Files</td></tr><tr><td align="left">Cookies</td><td align="left">%USERPROFILE%\Cookies</td></tr><tr><td align="left">Desktop</td><td align="left">%USERPROFILE%\Desktop</td></tr><tr><td align="left">Favorites</td><td align="left">%USERPROFILE%\Favorites</td></tr><tr><td align="left">History</td><td align="left">%USERPROFILE%\Local Settings\History</td></tr><tr><td align="left">Local AppData</td><td align="left">%USERPROFILE%\Local Settings\Application Data</td></tr><tr><td align="left">Local Settings</td><td align="left">%USERPROFILE%\Local Settings</td></tr><tr><td align="left">My Pictures</td><td align="left">%USERPROFILE%\My Documents\My Pictures</td></tr><tr><td align="left">NetHood</td><td align="left">%USERPROFILE%\NetHood</td></tr><tr><td align="left">Personal</td><td align="left">%USERPROFILE%\My Documents</td></tr><tr><td align="left">PrintHood</td><td align="left">%USERPROFILE%\PrintHood</td></tr><tr><td align="left">Programs</td><td align="left">%USERPROFILE%\Start Menu\Programs</td></tr><tr><td align="left">Recent</td><td align="left">%USERPROFILE%\Recent</td></tr><tr><td align="left">SendTo</td><td align="left">%USERPROFILE%\SendTo</td></tr><tr><td align="left">Start Menu</td><td align="left">%USERPROFILE%\Start Menu</td></tr><tr><td align="left">Startup</td><td align="left">%USERPROFILE%\Start Menu\Programs\Startup</td></tr><tr><td align="left">Templates</td><td align="left">%USERPROFILE%\Templates</td></tr></tbody></table></div></div><br class="table-break"><p> There is also an entry called “<span class="quote">Default</span>” that has no value set. The default entry is 573 573 of type <code class="constant">REG_SZ</code>; all the others are of type <code class="constant">REG_EXPAND_SZ</code>. </p><p> It makes a huge difference to the speed of handling roaming user profiles if all the folders are 574 574 stored on a dedicated location on a network server. This means that it will not be necessary to write … … 590 590 A roaming profile is cached locally unless the following registry key is created: 591 591 592 <a class="indexterm" name="id26 70630"></a>592 <a class="indexterm" name="id2664545"></a> 593 593 </p><p> </p><pre class="programlisting"> HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\ 594 594 winlogon\"DeleteRoamingCache"=dword:00000001</pre><p> 595 595 In this case, the local cache copy is deleted on logout. 596 </p></div></div><div class="sect1" title="Common Errors"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2670655"></a>Common Errors</h2></div></div></div><p>596 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2664569"></a>Common Errors</h2></div></div></div><p> 597 597 The following are some typical errors, problems, and questions that have been asked on the Samba mailing lists. 598 </p><div class="sect2" title="Configuring Roaming Profiles for a Few Users or Groups"><div class="titlepage"><div><div><h3 class="title"><a name="id2670666"></a>Configuring Roaming Profiles for a Few Users or Groups</h3></div></div></div><p>598 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2664580"></a>Configuring Roaming Profiles for a Few Users or Groups</h3></div></div></div><p> 599 599 With Samba-2.2.x, the choice you have is to enable or disable roaming profiles support. It is a 600 600 global-only setting. The default is to have roaming profiles, and the default path will locate them in … … 606 606 </p><p> 607 607 With Samba-3, you can have a global profile setting in <code class="filename">smb.conf</code>, and you can override this by 608 per-user settings using the Domain User Manager (as with MS Windows NT4/200x). </p><p> In any case, you can configure only one profile per user. That profile can be either: </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>A profile unique to that user.</p></li><li class="listitem"><p>A mandatory profile (one the user cannot change).</p></li><li class="listitem"><p>A group profile (really should be mandatory that is, unchangable).</p></li></ul></div></div><div class="sect2" title="Cannot Use Roaming Profiles"><div class="titlepage"><div><div><h3 class="title"><a name="id2670727"></a>Cannot Use Roaming Profiles</h3></div></div></div><p> A user requested the following: <span class="quote">“<span class="quote"> I do not want roaming profiles to be implemented. I want608 per-user settings using the Domain User Manager (as with MS Windows NT4/200x). </p><p> In any case, you can configure only one profile per user. That profile can be either: </p><div class="itemizedlist"><ul type="disc"><li><p>A profile unique to that user.</p></li><li><p>A mandatory profile (one the user cannot change).</p></li><li><p>A group profile (really should be mandatory that is, unchangable).</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2664641"></a>Cannot Use Roaming Profiles</h3></div></div></div><p> A user requested the following: “<span class="quote"> I do not want roaming profiles to be implemented. I want 609 609 to give users a local profile alone. I am totally lost with this error. For the past 610 two days I tried everything, I googled around but found no useful pointers. Please help me. </span>”</ span></p><p> The choices are: </p><div class="variablelist"><dl><dt><span class="term">Local profiles</span></dt><dd><p> I know of no registry keys that will allow610 two days I tried everything, I googled around but found no useful pointers. Please help me. </span>”</p><p> The choices are: </p><div class="variablelist"><dl><dt><span class="term">Local profiles</span></dt><dd><p> I know of no registry keys that will allow 611 611 autodeletion of LOCAL profiles on log out.</p></dd><dt><span class="term">Roaming profiles</span></dt><dd><p> As a user logs onto the network, a centrally 612 612 stored profile is copied to the workstation to form a local profile. This local profile … … 624 624 workstation, but they harvest the fruits of folly (and ignorance). </p><p> The point of this discussion is to show that roaming profiles and good controls of how they can be 625 625 changed as well as good discipline make for a problem-free site. </p><p> Microsoft's answer to the PST problem is to store all email in an MS Exchange Server backend. This 626 removes the need for a PST file. </p><p>Local profiles mean: </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>If each machine is used by many users, then much local disk storage is needed627 for local profiles.</p></li><li class="listitem"><p>Every workstation the user logs into has628 its own profile; these can be very different from machine to machine.</p></li></ul></div><p> On the other hand, use of roaming profiles means: </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>The network administrator can control the desktop environment of all users.</p></li><li class="listitem"><p>Use of mandatory profiles drastically reduces network management overheads.</p></li><li class="listitem"><p>In the long run, users will experience fewer problems.</p></li></ul></div></div><div class="sect2" title="Changing the Default Profile"><div class="titlepage"><div><div><h3 class="title"><a name="id2670898"></a>Changing the Default Profile</h3></div></div></div><p><span class="quote">“<span class="quote">When the client logs onto the domain controller, it searches629 for a profile to download. Where do I put this default profile?</span>”</ span></p><p>630 <a class="indexterm" name="id26 70913"></a>626 removes the need for a PST file. </p><p>Local profiles mean: </p><div class="itemizedlist"><ul type="disc"><li><p>If each machine is used by many users, then much local disk storage is needed 627 for local profiles.</p></li><li><p>Every workstation the user logs into has 628 its own profile; these can be very different from machine to machine.</p></li></ul></div><p> On the other hand, use of roaming profiles means: </p><div class="itemizedlist"><ul type="disc"><li><p>The network administrator can control the desktop environment of all users.</p></li><li><p>Use of mandatory profiles drastically reduces network management overheads.</p></li><li><p>In the long run, users will experience fewer problems.</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2664813"></a>Changing the Default Profile</h3></div></div></div><p>“<span class="quote">When the client logs onto the domain controller, it searches 629 for a profile to download. Where do I put this default profile?</span>”</p><p> 630 <a class="indexterm" name="id2664827"></a> 631 631 First, the Samba server needs to be configured as a domain controller. This can be done by 632 setting in <code class="filename">smb.conf</code>: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id2670934"></a><em class="parameter"><code>security = user</code></em></td></tr><tr><td><a class="indexterm" name="id2670945"></a><em class="parameter"><code>os level = 32 (or more)</code></em></td></tr><tr><td><a class="indexterm" name="id2670957"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr></table><p> There must be a <em class="parameter"><code>[netlogon]</code></em> share that is world readable. It is632 setting in <code class="filename">smb.conf</code>: </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2664848"></a><em class="parameter"><code>security = user</code></em></td></tr><tr><td><a class="indexterm" name="id2664860"></a><em class="parameter"><code>os level = 32 (or more)</code></em></td></tr><tr><td><a class="indexterm" name="id2664872"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr></table><p> There must be a <em class="parameter"><code>[netlogon]</code></em> share that is world readable. It is 633 633 a good idea to add a logon script to preset printer and drive connections. There is also a facility 634 634 for automatically synchronizing the workstation time clock with that of the logon server (another good 635 thing to do). </p><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> To invoke autodeletion of roaming profiles from the local workstation cache (disk storage), use635 thing to do). </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> To invoke autodeletion of roaming profiles from the local workstation cache (disk storage), use 636 636 the <span class="application">Group Policy Editor</span> to create a file called <code class="filename">NTConfig.POL</code> 637 637 with the appropriate entries. This file needs to be located in the <em class="parameter"><code>netlogon</code></em> 638 638 share root directory.</p></div><p> Windows clients need to be members of the domain. Workgroup machines do not use network logons, 639 so they do not interoperate with domain profiles. </p><p> For roaming profiles, add to <code class="filename">smb.conf</code>: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id2671029"></a><em class="parameter"><code>logon path = \\%N\profiles\%U</code></em></td></tr><tr><td># Default logon drive is Z:</td></tr><tr><td><a class="indexterm" name="id2671045"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td># This requires a PROFILES share that is world writable.</td></tr></table></div><div class="sect2" title="Debugging Roaming Profiles and NT4-style Domain Policies"><div class="titlepage"><div><div><h3 class="title"><a name="id2671062"></a>Debugging Roaming Profiles and NT4-style Domain Policies</h3></div></div></div><p>639 so they do not interoperate with domain profiles. </p><p> For roaming profiles, add to <code class="filename">smb.conf</code>: </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2664944"></a><em class="parameter"><code>logon path = \\%N\profiles\%U</code></em></td></tr><tr><td># Default logon drive is Z:</td></tr><tr><td><a class="indexterm" name="id2664960"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td># This requires a PROFILES share that is world writable.</td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2664976"></a>Debugging Roaming Profiles and NT4-style Domain Policies</h3></div></div></div><p> 640 640 Roaming profiles and domain policies are implemented via <code class="literal">USERENV.DLL</code>. 641 641 Microsoft Knowledge Base articles <a class="ulink" href="http://support.microsoft.com/default.aspx?scid=kb;en-us;221833" target="_top">221833</a> and
Note:
See TracChangeset
for help on using the changeset viewer.
