samba - Mar 2011 - Mandatory User Profile

Hi,

first of all: my name is uli... i'm from bavaria/germany and i'm working
with linux quite a long time (maybe 10 years).

Now my "problem":
my samba is setup with ldap-backend. my configuration with mandatory
profiles is working quite good. i created a Default User - Profile in my
netlogon-share (migrated from a windows-xp client). ntuser.dat has been
renamed to ntuser.man. my windows client is configured to delete cached
profiles on logoff. this is working perfect.
but the problem is, that my keyborad layout is american and not german at
first logon. next logons the keyboard-layout is germen. but i think the
reason for that is, that the server-side profile creates a ntuser.dat AND
the ntuser.man (ntuser.dat does not exist in Default User profile).
renaming the ntuser.man in Default User profile to ntuser.dat makes the
german keyboard-layout available at first logon.
but i wanna have the mandatory profiles not editable. users should not be
able to save things or change things in the profile.
do you have an idea, how to make my mandatory profile "readonly" AND
have
a german keyboard-layout.
another thing id like to have: is it possible to remove the serverside
profile at logoff. if i logon there is the Default User profile copied to
my profiles-share. we have a lot of students and it would be a waste of
disc-space to create the same copy of the Default User  profile many
thousend times...

Here is some information about my setup:
OS: Debian Squeeze
Samba-Version: 3.5.6
smb.conf:
[global]
workgroup = SCHINZ-HOME
netbios name = klamm
domain logons = yes
domain master = yes
local master = yes
preferred master = yes
os level = 65
logon path = \\%L\profiles\%u
passdb backend = ldapsam:ldap://klamm.home.schinz.de
ldapsam:trusted = yes
ldapsam:editposix = yes
ldap admin dn = cn=admin,dc=schinz,dc=de
ldap user suffix = ou=users
ldap group suffix = ou=groups
ldap idmap suffix = ou=idmap
ldap machine suffix = ou=machines
ldap passwd sync = Yes
ldap suffix = dc=schinz,dc=de
ldap ssl = off
idmap backend = ldap:ldap://klamm.home.schinz.de
idmap uid = 10000 - 50000
idmap gid = 10000 - 50000
idmap config SCHINZ-HOME:default      = yes
idmap config SCHINZ-HOME:backend      = ldap
idmap config SCHINZ-HOME:ldap_base_dn = ou=idmap,dc=schinz,dc=de
idmap config SCHINZ-HOME:ldap_user_dn = cn=admin,dc=schinz,dc=de
idmap config SCHINZ-HOME:ldap_url     = ldap://klamm.home.schinz.de/
idmap config SCHINZ-HOME:range        = 10000 - 50000

idmap alloc backend = ldap
idmap alloc config:ldap_base_dn = ou=idmap,dc=schinz,dc=de
idmap alloc config:ldap_user_dn = cn=admin,dc=schinz,dc=de
idmap alloc config:ldap_url     = ldap://klamm.home.schinz.de
idmap alloc config:range        = 10000 - 50000


[profiles]
  path = /samba/profiles
  read only = No
  store dos attributes = Yes
  create mask = 0700
  directory mask = 0700
  browsable = No
  guest ok = No
  printable = No
  hide files = /desktop.ini/outlook*.lnk/*Briefcase*/

[netlogon]
  path = /samba/netlogon
  read only = yes
[homes]
  path = /samba/homes
  readonly = no


hope you forgive my bad english.
kind regards
uli

On 06.03.2011 12:16, ulrich.schinz at ksfh.de wrote:
> Hi,
>
> first of all: my name is uli... i'm from bavaria/germany and i'm
working
> with linux quite a long time (maybe 10 years).
>
> Now my "problem":
> my samba is setup with ldap-backend. my configuration with mandatory
> profiles is working quite good. i created a Default User - Profile in my
> netlogon-share (migrated from a windows-xp client). ntuser.dat has been
> renamed to ntuser.man. my windows client is configured to delete cached
> profiles on logoff. this is working perfect.
> but the problem is, that my keyborad layout is american and not german at
> first logon. next logons the keyboard-layout is germen. but i think the
> reason for that is, that the server-side profile creates a ntuser.dat AND
> the ntuser.man (ntuser.dat does not exist in Default User profile).
> renaming the ntuser.man in Default User profile to ntuser.dat makes the
> german keyboard-layout available at first logon.
> but i wanna have the mandatory profiles not editable. users should not be
> able to save things or change things in the profile.
> do you have an idea, how to make my mandatory profile "readonly"
AND have
> a german keyboard-layout.
> another thing id like to have: is it possible to remove the serverside
> profile at logoff. if i logon there is the Default User profile copied to
> my profiles-share. we have a lot of students and it would be a waste of
> disc-space to create the same copy of the Default User  profile many
> thousend times...
To solve both problems, you need to do this:

1. Create a local user tmpusr.
2. Login, set everything as you like, incl. keyboard layout, logoff
3. Copy C:\Documents and Settings\tmpusr\* (except the Local Settings 
folder) to \\klamm\profiles\manprof
4. Rename ntuser.dat to ntuser.man
5. logon path = \\%L\profiles\manprof

Remove everything else from \\klamm\profiles\ - you don't need it anymore.

HTH,
Deyan

Hi,
>> my samba is setup with ldap-backend. my configuration with mandatory
>> profiles is working quite good. i created a Default User - Profile in
my
>> netlogon-share (migrated from a windows-xp client). ntuser.dat has been
>> renamed to ntuser.man. my windows client is configured to delete cached
>> profiles on logoff. this is working perfect.
>> but the problem is, that my keyborad layout is american and not 
>> german at
>> first logon. next logons the keyboard-layout is germen. but i think the
>> reason for that is, that the server-side profile creates a ntuser.dat 
>> AND
>> the ntuser.man (ntuser.dat does not exist in Default User profile).
>> renaming the ntuser.man in Default User profile to ntuser.dat makes the
>> german keyboard-layout available at first logon.
>> but i wanna have the mandatory profiles not editable. users should 
>> not be
>> able to save things or change things in the profile.
>> do you have an idea, how to make my mandatory profile
"readonly" AND
>> have
>> a german keyboard-layout.
>> another thing id like to have: is it possible to remove the serverside
>> profile at logoff. if i logon there is the Default User profile 
>> copied to
>> my profiles-share. we have a lot of students and it would be a waste of
>> disc-space to create the same copy of the Default User  profile many
>> thousend times...
>
> To solve both problems, you need to do this:
>
> 1. Create a local user tmpusr.
> 2. Login, set everything as you like, incl. keyboard layout, logoff
> 3. Copy C:\Documents and Settings\tmpusr\* (except the Local Settings 
> folder) to \\klamm\profiles\manprof
> 4. Rename ntuser.dat to ntuser.man
> 5. logon path = \\%L\profiles\manprof
I tried this before. In any case: renaming my ntuser.dat to ntuser.man 
leads to an american keyboradlayout. The original Profile has everything 
perfectly configured. And a ntuser.dat in it has a german keyboard layout.
Some other hints?

kind regards
uli