Hi all, I am setting up my second server with Samba 3.0.21c with LDAP as described in Samba3-ByExample. The server OS is Slackware Linux 10.2, without PAM. All seemed to work perfect until I decided to try folder redirection. I followed the instructions given in the "happy users" chapter, but now new users cant log in. When trying to log in with a new user (umgrtest16) from a WinXP SP2 client, I get a error message about "Windows cannot log you on because your profile cannot be loaded". When I look in the Samba log for the computer I tried to log in from (s100$), I find that Samba is trying to do something as the "guest" user. " guest user (from session setup) not permitted to access this share (profdata)" See more of the log below. To further test this, I set "guest ok = yes" on the profdata share, and try to log in as the new user again. Now the new user can log in! The problem is that the folder containig the redirected folders (\\SOT01\profdata\umgrtest16) and all its content are owned by the user "nobody", and the group "Domain Guests". The home and profile folders and all their content are owned by umgrtest16.Domain Users. I am struggling with figuring out why I must set "guest ok = yes". Is there anybody out there that can give me any kind of help with this? Please excuse my English, it is not my native tongue. Regards Joran Kvalvaag s100$ logfile: [2006/03/28 23:06:44, 2] smbd/sesssetup.c:setup_new_vc_session(772) setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. [2006/03/28 23:06:44, 2] smbd/sesssetup.c:setup_new_vc_session(772) setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. [2006/03/28 23:06:44, 2] libsmb/credentials.c:creds_server_check(159) creds_server_check: credentials check failed. [2006/03/28 23:06:44, 2] rpc_server/srv_netlog_nt.c:_net_sam_logon(667) _net_sam_logon: creds_server_step failed. Rejecting auth request from client S100 machine account S100$ [2006/03/28 23:06:44, 2] lib/smbldap.c:smbldap_open_connection(722) smbldap_open_connection: connection opened [2006/03/28 23:06:44, 2] passdb/pdb_ldap.c:init_sam_from_ldap(640) init_sam_from_ldap: Entry found for user: s100$ [2006/03/28 23:06:44, 2] passdb/pdb_ldap.c:init_sam_from_ldap(640) init_sam_from_ldap: Entry found for user: umgrtest16 [2006/03/28 23:06:44, 2] passdb/pdb_ldap.c:init_group_from_ldap(2199) init_group_from_ldap: Entry found for group: 513 [2006/03/28 23:06:44, 2] auth/auth.c:check_ntlm_password(307) check_ntlm_password: authentication for user [umgrtest16] -> [umgrtest16] -> [umgrtest16] succeeded [2006/03/28 23:06:44, 2] passdb/pdb_ldap.c:init_sam_from_ldap(640) init_sam_from_ldap: Entry found for user: umgrtest16 [2006/03/28 23:06:44, 2] auth/auth.c:check_ntlm_password(307) check_ntlm_password: authentication for user [umgrtest16] -> [umgrtest16] -> [umgrtest16] succeeded [2006/03/28 23:06:44, 2] rpc_server/srv_samr_nt.c:_samr_lookup_domain(2670) Returning domain sid for domain SOT -> S-1-5-21-995782943-3300503536-3180620993 [2006/03/28 23:06:44, 2] passdb/pdb_ldap.c:init_sam_from_ldap(640) init_sam_from_ldap: Entry found for user: umgrtest16 [2006/03/28 23:06:44, 2] passdb/pdb_ldap.c:init_sam_from_ldap(640) init_sam_from_ldap: Entry found for user: umgrtest16 [2006/03/28 23:06:44, 1] smbd/service.c:make_connection_snum(693) s100 (10.0.2.1) connect to service profiles initially as user umgrtest16 (uid=1127, gid=513) (pid 22671) [2006/03/28 23:06:44, 1] smbd/service.c:make_connection_snum(693) s100 (10.0.2.1) connect to service netlogon initially as user umgrtest16 (uid=1127, gid=513) (pid 22671) [2006/03/28 23:06:44, 2] smbd/open.c:open_file(350) umgrtest16 opened file Default User/NTUSER.DAT.LOG read=Yes write=No (numopen=1) [2006/03/28 23:06:44, 2] smbd/open.c:open_file(350) umgrtest16 opened file Default User/NTUSER.DAT read=Yes write=No (numopen=2) [2006/03/28 23:06:45, 2] smbd/open.c:open_file(350) umgrtest16 opened file Default User/Templates/wordpfct.wpg read=Yes write=No (numopen=3) ---cut away a lot of files--- [2006/03/28 23:06:46, 2] smbd/open.c:open_file(350) umgrtest16 opened file Default User/Application Data/desktop.ini read=Yes write=No (numopen=55) [2006/03/28 23:06:46, 2] smbd/close.c:close_normal_file(308) umgrtest16 closed file Default User/Start Menu/Programs/Accessories/Program Compatibility Wizard.lnk (numopen=54) [2006/03/28 23:06:46, 2] smbd/close.c:close_normal_file(308) umgrtest16 closed file Default User/Start Menu/Programs/Accessories/Command Prompt.lnk (numopen=53) [2006/03/28 23:06:46, 2] smbd/close.c:close_normal_file(308) umgrtest16 closed file Default User/Start Menu/Programs/Accessories/desktop.ini (numopen=52) [2006/03/28 23:06:47, 2] smbd/service.c:make_connection_snum(316) guest user (from session setup) not permitted to access this share (profdata) ########## problem??? [2006/03/28 23:06:55, 2] smbd/close.c:close_normal_file(308) umgrtest16 closed file Default User/SendTo/Compressed (zipped) Folder.ZFSendToTarget (numopen=51) ---cut away a lot of files--- [2006/03/28 23:07:06, 2] smbd/close.c:close_normal_file(308) umgrtest16 closed file Default User/Application Data/desktop.ini (numopen=1) [2006/03/28 23:07:06, 2] smbd/close.c:close_normal_file(308) umgrtest16 closed file Default User/Application Data/Microsoft/Internet Explorer/Quick Launch/Launch Internet Explorer Browser.lnk (numopen=0) [2006/03/28 23:07:06, 1] smbd/service.c:close_cnum(885) s100 (10.0.2.1) closed connection to service profiles [2006/03/28 23:07:06, 1] smbd/service.c:close_cnum(885) s100 (10.0.2.1) closed connection to service netlogon [2006/03/28 23:07:26, 2] smbd/server.c:exit_server(614) Closing connections -------------------------------------------------------------------------------------------------------------- #testparm -sv [global] dos charset = 850 unix charset = ISO8859-1 display charset = LOCALE workgroup = SOT realm netbios name = SOT01 netbios aliases netbios scope server string = Samba 3.0.21c interfaces = eth0, lo bind interfaces only = Yes security = USER auth methods encrypt passwords = Yes update encrypted = No client schannel = Auto server schannel = Auto allow trusted domains = Yes hosts equiv map to guest = Never null passwords = No obey pam restrictions = No password server = * smb passwd file = /etc/samba/private/smbpasswd private dir = /etc/samba/private passdb backend = ldapsam:ldap://sot01.sot.scana.no algorithmic rid base = 1000 root directory guest account = nobody enable privileges = Yes pam password change = No passwd program passwd chat = *new*password* %n\n *new*password* %n\n *changed* passwd chat debug = No passwd chat timeout = 2 check password script username map = /etc/samba/smbusers password level = 0 username level = 0 unix password sync = No restrict anonymous = 0 lanman auth = Yes ntlm auth = Yes client NTLMv2 auth = No client lanman auth = Yes client plaintext auth = Yes preload modules use kerberos keytab = No log level = 2 syslog = 0 syslog only = No log file = /var/log/samba/%m max log size = 5000 debug timestamp = Yes debug hires timestamp = No debug pid = No debug uid = No smb ports = 139 large readwrite = Yes max protocol = NT1 min protocol = CORE read bmpx = No read raw = Yes write raw = Yes disable netbios = No reset on zero vc = No acl compatibility defer sharing violations = Yes nt pipe support = Yes nt status support = Yes announce version = 4.9 announce as = NT max mux = 50 max xmit = 16644 name resolve order = wins, bcast, hosts max ttl = 259200 max wins ttl = 518400 min wins ttl = 21600 time server = Yes unix extensions = Yes use spnego = Yes client signing = auto server signing = No client use spnego = Yes enable asu support = Yes svcctl list change notify timeout = 60 deadtime = 0 getwd cache = Yes keepalive = 300 kernel change notify = Yes lpq cache time = 30 max smbd processes = 0 paranoid server security = Yes max disk size = 0 max open files = 10000 socket options = IPTOS_LOWDELAY TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 use mmap = Yes hostname lookups = No name cache timeout = 660 load printers = Yes printcap cache time = 750 printcap name = CUPS cups server iprint server disable spoolss = No enumports command addprinter command deleteprinter command show add printer wizard = No os2 driver map mangling method = hash2 mangle prefix = 1 max stat cache size = 0 stat cache = Yes machine password timeout = 604800 add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u" rename user script delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u" add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g" delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g" add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g" delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g" set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u" add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u" shutdown script abort shutdown script username map script logon script = scripts\logon.bat logon path = \\SOT01\profiles\%U logon drive = P: logon home = \\%N\%U domain logons = Yes os level = 65 lm announce = Auto lm interval = 60 preferred master = Yes local master = Yes domain master = Auto browse list = Yes enhanced browsing = Yes dns proxy = Yes wins proxy = No wins server wins support = Yes wins hook wins partners kernel oplocks = Yes lock spin count = 3 lock spin time = 10 oplock break wait time = 0 ldap server = localhost ldap port = 636 ldap admin dn = cn=Manager,dc=sot,dc=scana,dc=no ldap delete dn = Yes ldap group suffix = ou=Groups ldap idmap suffix = ou=Idmap ldap machine suffix = ou=Computers ldap passwd sync = no ldap replication sleep = 1000 ldap suffix = dc=sot,dc=scana,dc=no ldap ssl = start tls ldap timeout = 15 ldap page size = 1024 ldap user suffix = ou=People add share command change share command delete share command eventlog list config file preload lock directory = /usr/local/samba/var/locks pid directory = /usr/local/samba/var/locks utmp directory wtmp directory utmp = No default service message command = /bin/mail -s 'Message from %f on %m' root < %s; rm %s get quota command set quota command remote announce remote browse sync socket address = 0.0.0.0 homedir map = auto.home afs username map afs token lifetime = 604800 log nt token command time offset = 0 NIS homedir = No panic action host msdfs = No enable rid algorithm = Yes passdb expand explicit = Yes idmap backend = ldap:ldap://sot01.sot.scana.no idmap uid = 10000-20000 idmap gid = 10000-20000 template homedir = /home/%D/%U template shell = /bin/false winbind separator = \ winbind cache time = 300 winbind enum users = Yes winbind enum groups = Yes winbind use default domain = No winbind trusted domains only = No winbind nested groups = No winbind max idle children = 3 winbind nss info = template comment path username invalid users valid users admin users read list write list printer admin force user force group read only = Yes acl check permissions = Yes acl group control = No acl map full control = Yes create mask = 0744 force create mode = 00 security mask = 0777 force security mode = 00 directory mask = 0755 force directory mode = 00 directory security mask = 0777 force directory security mode = 00 force unknown acl user = No inherit permissions = No inherit acls = No inherit owner = No guest only = No guest ok = No only user = No hosts allow hosts deny allocation roundup size = 1048576 aio read size = 0 aio write size = 0 aio write behind ea support = No nt acl support = Yes profile acls = No map acl inherit = Yes afs share = No block size = 1024 max connections = 0 min print space = 0 strict allocate = No strict sync = No sync always = No use sendfile = No write cache size = 0 max reported print jobs = 0 max print jobs = 1000 printable = No printing = cups cups options print command lpq command = %p lprm command lppause command lpresume command queuepause command queueresume command printer name use client driver = No default devmode = No force printername = No default case = lower case sensitive = No preserve case = Yes short preserve case = Yes mangling char = ~ hide dot files = Yes hide special files = No hide unreadable = No hide unwriteable files = No delete veto files = No veto files hide files veto oplock files map archive = Yes map hidden = No map system = No map readonly = yes mangled names = Yes mangled map store dos attributes = No browseable = Yes blocking locks = Yes csc policy = manual fake oplocks = No locking = Yes oplocks = Yes level2 oplocks = Yes oplock contention limit = 2 posix locking = Yes strict locking = Yes share modes = Yes dfree cache time = 0 dfree command copy include preexec preexec close = No postexec root preexec root preexec close = No root postexec available = Yes volume fstype = NTFS set directory = No wide links = Yes follow symlinks = Yes dont descend magic script magic output delete readonly = No dos filemode = No dos filetimes = Yes dos filetime resolution = No fake directory create times = No vfs objects msdfs root = No msdfs proxy [homes] comment = Home for %U valid users = %S read only = No browseable = No [profiles] comment = User profiles share path = /home/samba/profiles valid users = %U, "@Domain Admins" force user = %U read only = No create mask = 0600 directory mask = 0700 guest ok = Yes profile acls = Yes browseable = No [profdata] comment = Redirected profile folders path = /home/samba/profdata read only = No create mask = 0600 directory mask = 0700 profile acls = Yes browseable = No [netlogon] comment = Netlogon Logon Service path = /home/samba/netlogon write list = jka guest ok = Yes browseable = No locking = No [print$] comment = Printer drivers path = /home/samba/printdrivers write list = jka [printers] comment = SMB Print Spool path = /var/spool/samba guest ok = Yes printable = Yes browseable = No [testshare] comment = testshare path = /home/data/testshare read only = No