samba - Apr 2002 - help Samba 2.2.3a and win2k sp2 roaming profiles

All

I wondered if anyone out there can help me :) , for days I have been trying
and seem to be getting know where fast.   I have setup a samba PDC which
works fine and logon scripts,  but I cannot get the roaming profiles to
work.  I have read so many threads about this problem but no answers,  how
does the ntconfig.pol fit into the picture?.   I have read that  there is a
big difference between NT4 Policy Editor and GPO.  Is this causing me a
problem?  if anyone out there can give me a pointers it would be great I
enclose my smb.conf.


In my netlogon directory I have logon scripts and a ntconfig.pol whihc was
made on a nt 4 server.


Cheers

Philip Grisedale
Systems Administrator
Anvil Software Ltd

0207-749-7906
pmg@anvil.co.uk

# This is the main Samba configuration file. You should read the

# smb.conf(5) manual page in order to understand the options listed

# here. Samba has a huge number of configurable options (perhaps too

# many!) most of which are not shown in this example

#

# Any line which starts with a ; (semi-colon) or a # (hash)

# is a comment and is ignored. In this example we will use a #

# for commentry and a ; for parts of the config file that you

# may wish to enable

#

# NOTE: Whenever you modify this file you should run the command
"testparm"

# to check that you have not made any basic syntactic errors.

#

#======================= Global Settings
====================================
[global]

# workgroup = NT-Domain-Name or Workgroup-Name

workgroup = TEST

# server string is the equivalent of the NT Description field

server string = Samba Server

# This option is important for security. It allows you to restrict

# connections to machines which are on your local network. The

# following example restricts access to two C class networks and

# the "loopback" interface. For more examples of the syntax see

# the smb.conf man page

hosts allow = 192.168.24. 192.168.24. 127.

# if you want to automatically load your printer list rather

# than setting them up individually then you'll need this

printcap name = /etc/printcap

load printers = yes

# It should not be necessary to spell out the print system type unless

# yours is non-standard. Currently supported print systems include:

# bsd, sysv, plp, lprng, aix, hpux, qnx

printing = lprng

# Uncomment this if you want a guest account, you must add this to
/etc/passwd

# otherwise the user "nobody" is used

; guest account = pcguest

# this tells Samba to use a separate log file for each machine

# that connects

log file = /var/log/samba/%m.log

# Put a capping on the size of the log files (in Kb).

max log size = 0

# Security mode. Most people will want user level security. See

# security_level.txt for details.

security = user

# Use password server option only with security = server

# The argument list may include:

# password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]

# or to auto-locate the domain controller/s

# password server = *

#password server = <NT-Server-Name>

# Password Level allows matching of _n_ characters of the password for

# all combinations of upper and lower case.

; password level = 8

; username level = 8

# You may wish to use password encryption. Please read

# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation.

# Do not enable this option unless you have read those documents

encrypt passwords = yes

smb passwd file = /etc/samba/smbpasswd

# The following is needed to keep smbclient from spouting spurious errors

# when Samba is built with support for SSL.

; ssl CA certFile = /usr/share/ssl/certs/ca-bundle.crt

# The following are needed to allow password changing from Windows to

# update the Linux sytsem password also.

# NOTE: Use these with 'encrypt passwords' and 'smb passwd file'
above.

# NOTE2: You do NOT need these to allow workstations to change only

# the encrypted SMB passwords. They allow the Unix password

# to be kept in sync with the SMB password.

; unix password sync = Yes

; passwd program = /usr/bin/passwd %u

; passwd chat = *New*password* %n\n *Retype*new*password* %n\n
*passwd:*all*authentication*tokens*updated*successfully*

# Unix users can map to different SMB User names

; username map = /etc/samba/smbusers

# Using the following line enables you to customise your configuration

# on a per machine basis. The %m gets replaced with the netbios name

# of the machine that is connecting

; include = /etc/samba/smb.conf.%m

# This parameter will control whether or not Samba should obey PAM's

# account and session management directives. The default behavior is

# to use PAM for clear text authentication only and to ignore any

# account or session management. Note that Samba always ignores PAM

# for authentication in the case of encrypt passwords = yes

; obey pam restrictions = yes

# Most people will find that this option gives better performance.

# See speed.txt and the manual pages for details

socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

# Configure Samba to use multiple interfaces

# If you have multiple network interfaces then you must list them

# here. See the man page for details.

#; interfaces = 192.168.12.2/24 192.168.13.2/24

# Configure remote browse list synchronisation here

# request announcement to, or browse list sync from:

# a specific host or from / to a whole subnet (see below)

#; remote browse sync = 192.168.3.25 192.168.5.255

# Cause this host to announce itself to local subnets here

remote announce = 192.168.24.255 192.168.24.44

# Browser Control Options:

# set local master to no if you don't want Samba to become a master

# browser on your network. Otherwise the normal election rules apply

#; local master = no

local master = yes

# OS Level determines the precedence of this server in master browser

# elections. The default value should be reasonable

; os level = 64

# Domain Master specifies Samba to be the Domain Master Browser. This

# allows Samba to collate browse lists between subnets. Don't use this

# if you already have a Windows NT domain controller doing this job

domain master = yes

# Preferred Master causes Samba to force a local browser election on startup

# and gives it a slightly higher chance of winning the election

preferred master = yes

# Enable this if you want Samba to be a domain logon server for

# Windows95 workstations.

domain logons = yes

# if you enable domain logons then you may want a per-machine or

# per user logon script

# run a specific logon batch file per workstation (machine)

; logon script = %m.bat

# run a specific logon batch file per username

logon script = %U.bat

# Where to store roving profiles (only for Win95 and WinNT)

# %L substitutes for this servers netbios name, %U is username

# You must uncomment the [Profiles] share below

logon path = \\riker\Profiles\%U

logon drive = H:

# Windows Internet Name Serving Support Section:

# WINS Support - Tells the NMBD component of Samba to enable it's WINS
Server

; wins support = yes

# WINS Server - Tells the NMBD components of Samba to be a WINS Client

# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both

#; wins server = w.x.y.z

# WINS Proxy - Tells Samba to answer name resolution queries on

# behalf of a non WINS capable client, for this to work there must be

# at least one WINS Server on the network. The default is NO.

#; wins proxy = yes

# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names

# via DNS nslookups. The built-in default for versions 1.9.17 is yes,

# this has been changed in version 1.9.18 to no.

dns proxy = no

# Case Preservation can be handy - system default is _no_

# NOTE: These can be set on a per share basis

; preserve case = no

; short preserve case = no

# Default case is normally upper case for all DOS files

; default case = lower

# Be very careful with case sensitivity - it can break things!

; case sensitive = no



##################################Anvil Site
Configuration####################################

# #

############################################################################
##################

[homes]

comment = Home Directories

path = /vols/users/%U

browseable = no

writable = yes

valid users = %S

create mode = 0664

directory mode = 0775

[netlogon]

comment = Network Logon Service

#path = /usr/local/samba/lib/netlogon

path = /usr/local/samba/netlogon

guest ok = yes

writable = no

share modes = no

logon script = %U.bat

[Profiles]


path = /vols/profiles

writable = yes

browseable = no

guest ok = no

create mask = 0700

directory mask = 0700

[users]

guest ok = no

read only = no

path=/vols/users/%U

browsable = yes

[TEMP]

comment = Temporary file space

path = /tmp

read only = no

public = yes

[projects]

guest ok = no

read only = no

create mask = 0775

path=/vols/projects

[projectdocs]

guest ok = no

read only = no

path = /vols/projects/management

force create mode = 0775

force directory mode = 0775

[users2]

guest ok = no

read only = no

path=/vols/users2

[reference]

guest ok = no

read only = no

path=/vols/reference

[printers]

comment = All Printers

printable = yes

writable = no

[support]

guest ok = no

read only = no

path=/vols/support

[common]

guest ok = no

read only = no

path=/vols/common

[NT]

guest ok = no

read only = no

path=/vols/NT

[ATE]

guest ok = no

read only = no

path=/home/ate

force user = ate

valid users = @ate

[source]

guest ok = no

read only = no

path=/vols/src

[Virus]

guest ok = no

read only = no

path = /vols/NT/Virus

-------------- next part --------------
HTML attachment scrubbed and removed

Hi Philip,

I've got roaming profiles working very nicely using 2.2.3a and win2k - the
setup I have has worked for NT4 samba 2.0 through various versions of samba
and win2k. It also works for win98.

The first settings that you need to setup are:


logon path = \\myserver\profiles\%u
logon drive = z:
logon home = \\myserver\%u
logon script = login.cmd

-----------------------
Which means that you need a share "profiles" as well as
"netlogon".

the profiles share should be writable by the group, otherwise it won't work
(e.g. public group)

The netlogon share should contain a login.cmd file that maps drives. Note
that with win2k you don't need to map a home drive - the above will do it
for you.

-----------------------
[netlogon]
   comment = Network Logon Service
   path = /home/netlogon
   write list = @domainadmin
   share modes = no

[Profiles]
    path = /home/profiles
    browseable = no
    write list = @public
    force group = public

-----------------------

example login.cmd file:

----------------------

@echo off
echo ************************************************
echo Welcome to Far Edge Technology
echo
echo Unauthorised access is prohibited by law, and
echo will be prosecuted
echo
echo Mapping network resources:
echo
net use p: \\myserver\public
net use s: \\myserver\downloads
echo
echo Mapping drives complete
echo Applying virus patches
p:\Virusupdate\Setup.exe
echo And have a nice day
echo ************************************************

--------------------------

Obviously your own setup will vary depending up what you want mapped, and
whether you want to synchronise time upon login etc.

Cheers,

Chris