samba - Nov 2004 - Win2K Terminal Server and roaming profiles issue

I have been using Samba 2.2 with LDAP as a PDC for a domain for over a year in a
gradeschool setting.  Recently, users have been having problems with roaming
profiles not working.  And not all users, just some.  I have applied the policy
fix for CompatibleRUPSecurity, along with other suggestions, but  I still get
'the profile cannot be loaded', Access is denied message for somce
users.  I should upgrade to 3, but (to be honest) fear that something major will
break when I do so.

How hard is it to upgrade to 3.0.8 while maintaining the LDAP functionality?  I
am not an expert in any of this, just stubborn enough about getting it to work
that I will try, but need clear instructions.

At wits end,
Dave Hopkins
Parent Volunteer
Newark Charter School
Newark, Delaware 19713

Hi all,

I have been playing with getting my samba server to participate in an Acive
Directory domain for some time and have noticed a couple things about when i
get the machine working (or so i think).  One is that when the machine joins
the domian it always show up as a domain controller.  I dont want this to
happen.  I simply wish for it to be able to authenticate users to its share
based on the domain users.  Therefore, only users on the domain should be
able to get to the samba shares!  Up to this point in have been doing the
following:

1. relam = MY.REALM
2. security = ADS
3. encrypt passwords = yes
 and configuring my winbind file.

Is this all i have to do? Do i have the wrong impression as to what ADS
security provides?  Again, all i want to do is avoid having to create a user
for EVERYone on my domain and two allow domain users to authenticate to the
samba shares.

Thanks for your help,
R.