samba - Nov 2010 - Windows 7 problems

Hi, 
 
I have upgraded to Samba 3.5.6 for Windows 7 Pro compatibility. 
I am in a test phase to evaluate the behavior of Windows 7 in a Samba PDC
environment. 
I have one Samba server as a PDC with tdbsam backend (no LDAP at all), and I
applied the reg and patch as described in the wiki. 
 
I have a couple of questions related to Windows 7 : 

- opening a domain session on the Win7 client takes a long time. At least 40
seconds, while there is no delay on XP client. Is it a kown problem ? A bug
? What can be done to avoid such a delay ? 

- in smb.conf , the %a value for Windows 7 is "Vista" , right ? 

- NT Default Profile no longer works with Windows 7 . I guess it is normal ,
but is there a workaround ? 

- Same question for NT policies : I assume it is normal that windows 7 does
not support NTconfig.pol files any longer. Nevertheless, is there a way to
get the same features ? For these kind of functionality (having some control
of user profiles on Win7 clients) , is AD the only and inescapable solution
? 

For my needs (200 domain users), NT domain was a sufficient solution and
worked perfectly with XP. I am affraid that with Windows 7, I will have to
move to something much more and unnecessarily complex :-( . 

Thanks in advance for your help. 

Henri 
________________________________

On Tue, 9 Nov 2010 19:29:23 +0400 henri <ciradhb.forward at laposte.net>
wrote:

h>  Same question for NT policies : I assume it is normal that windows 7 does
h> not support NTconfig.pol files any longer. Nevertheless, is there a way to
h> get the same features ? For these kind of functionality (having some
control
h> of user profiles on Win7 clients) , is AD the only and inescapable
solution
h> ? 

We use a combination of a logon script and Wpkg (wpkg.org) to pull the
machine and user registry entries to our Win7 clients
we add a registry value with version number of the changes and have a check
of this number before updating the hives, but that's not really necessary
and
you could overwrite the registry every time.

(if your users have admin rights on their machine a logon script will suffice.)


machine changes

Wpkg definition ------------------------------------

<package id="vreg" name="V2 Registry settings"
revision="10" reboot="false" priority="900">
	<check type="registry" condition="equals"
path="HKLM\Software\Wpkg\RegistryRevision" value="10" />
	<install cmd='regedit /s "%WpkgRoot%\Files\V2.reg"' />
	<upgrade cmd='regedit /s "%WpkgRoot%\Files\V2.reg"' />
</package>

---------------------V2.reg--------------------------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\WPKG]
"RegistryRevision"=dword:0000000a

;Fix for slow tab opening IE7/8
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Update\Policy]
"EnableJavaUpdate"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000ff

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"VerboseStatus"=dword:00000001
"RunLogonScriptSync"=dword:00000001
"DelayedDesktopSwitchTimeout"=dword:00000005

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"RunLogonScriptSync"=dword:00000001
"SyncForegroundPolicy"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]
"CompatibleRUPSecurity"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\NetCache]
"NoConfigCache"=dword:00000000
"DisableFRAdminPin"=dword:00000001 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\windows\WindowsUpdate\AU]
"NoAutoUpdate"=dword:00000000
"AUOptions"=dword:00000004
"ScheduledInstallDay"=dword:00000000
"ScheduledInstallTime"=dword:00000006
"RescheduleWaitTime"=dword:00000005
"NoAutoRebootWithLoggedOnUsers"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA]
"NoLMHash"=dword:00000001
"RestrictAnonymous"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server]
"fDenyTSConnections"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters]
"DomainCompatibilityMode"=dword:00000001
"DNSNameResolutionRequired"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters]
"DisabledComponents"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"CWDIllegalInDllSearch"=dword:00000002

----------------------------------------------

User changes

---------------------------Logon.cmd-------------------------
......
@if not "%allusersprofile%"=="%SystemDrive%\ProgramData"
goto Step_4
@reg query "HKCU\Software\Ersatz" /v UserShellFolders | find
"0x2" > NUL
@if errorlevel 1 reg import
%Logonserver%\netlogon\hkcu_user_shell_folders_v2.reg

@reg query "HKCU\Software\Ersatz" /v SomeOtherFunction | find
"0x9" > NUL
@if errorlevel 1 reg import %Logonserver%\netlogon\Someotherfunction_v2.reg

:Step_4
......
-------------------------------------------------------------


--------------------------hkcu_user_shell_folders_v2.reg---------------------------
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Ersatz]
"UserShellFolders"=dword:00000002

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell
Folders]
"Favorites"=hex(2):25,00,48,00,4f,00,4d,00,45,00,44,00,52,00,49,00,56,00,45,00,\
  25,00,5c,00,50,00,72,00,6f,00,66,00,69,00,6c,00,65,00,5c,00,46,00,61,00,76,\
  00,6f,00,72,00,69,00,74,00,65,00,73,00,00,00
"My
Music"=hex(2):25,00,48,00,4f,00,4d,00,45,00,44,00,52,00,49,00,56,00,45,00,\
  25,00,5c,00,4d,00,79,00,20,00,44,00,6f,00,63,00,75,00,6d,00,65,00,6e,00,74,\
  00,73,00,5c,00,4d,00,79,00,20,00,4d,00,75,00,73,00,69,00,63,00,00,00
"My
Pictures"=hex(2):25,00,48,00,4f,00,4d,00,45,00,44,00,52,00,49,00,56,00,45,\
  00,25,00,5c,00,4d,00,79,00,20,00,44,00,6f,00,63,00,75,00,6d,00,65,00,6e,00,\
  74,00,73,00,5c,00,4d,00,79,00,20,00,50,00,69,00,63,00,74,00,75,00,72,00,65,\
  00,73,00,00,00
"My
Video"=hex(2):25,00,48,00,4f,00,4d,00,45,00,44,00,52,00,49,00,56,00,45,00,\
  25,00,5c,00,4d,00,79,00,20,00,44,00,6f,00,63,00,75,00,6d,00,65,00,6e,00,74,\
  00,73,00,5c,00,4d,00,79,00,20,00,56,00,69,00,64,00,65,00,6f,00,73,00,00,00
"Personal"=hex(2):25,00,48,00,4f,00,4d,00,45,00,44,00,52,00,49,00,56,00,45,00,\
  25,00,5c,00,4d,00,79,00,20,00,44,00,6f,00,63,00,75,00,6d,00,65,00,6e,00,74,\
  00,73,00,00,00
"{374DE290-123F-4565-9164-39C4925E467B}"=hex(2):25,00,53,00,79,00,73,00,74,00,\
  65,00,6d,00,44,00,72,00,69,00,76,00,65,00,25,00,5c,00,4c,00,6f,00,63,00,61,\
  00,6c,00,20,00,48,00,6f,00,6d,00,65,00,73,00,5c,00,25,00,55,00,73,00,65,00,\
  72,00,4e,00,61,00,6d,00,65,00,25,00,5c,00,44,00,6f,00,77,00,6e,00,6c,00,6f,\
  00,61,00,64,00,73,00,00,00

------------------------------------------------------------------------------- 

-- 
Jean-Jacques   Moulis                              Tel:  (013) 281684
ISY                                                Fax:  (013) 139282
Link?ping University                            E-mail: jj at isy.liu.se
581 83 Link?ping