samba - Apr 2008 - group profiles

Hello,

according to the samba howto it should be possible to create group 
profiles but the documentation is very short, summarized in:

"A group profile is a profile that is created first using a template 
(example) user. Then using the profile migration tool (see above), the 
profile is assigned access rights for the user group that needs
to be given access to the group profile."

It's all but clear to me how to procede.
What name should the profile get ? The name of the group ?

Thanks
Andreas

On Wednesday 30 April 2008 02:11:31 am Andreas Moroder
wrote:
> Hello,
>
> according to the samba howto it should be possible to create group
> profiles but the documentation is very short, summarized in:
>
> "A group profile is a profile that is created first using a template
> (example) user. Then using the profile migration tool (see above), the
> profile is assigned access rights for the user group that needs
> to be given access to the group profile."
>
> It's all but clear to me how to procede.
> What name should the profile get ? The name of the group ?
>
> Thanks
> Andreas
You can name the profile anything you want, so long as the ACLs inside the 
profile are correct for the group that needs to be able to access it.

As a general rule, the ACLs should be set so that members of the group have 
full control.  Then select a user who is a member of that group; set the 
profile path to the new group profile; now log on as that user and edit, or 
clean up and polish up the setting for that profile.  Now log off. As the 
Domain Admin rename the user.dat file to user.man.

You now have a "mandatory" (meaning - usr can not change the profile
settings)
profile that is accessible only by members of the group.

Group members will be able to access this group profile - but first the 
administrator must set their profile path to point to this group profile.

Does that clarify things?

- John T.

Hello John,
> You can name the profile anything you want, so long as the ACLs inside the 
> profile are correct for the group that needs to be able to access it.
> 
> As a general rule, the ACLs should be set so that members of the group have
> full control.  Then select a user who is a member of that group; set the 
> profile path to the new group profile; now log on as that user and edit, or
> clean up and polish up the setting for that profile.  Now log off. As the 
> Domain Admin rename the user.dat file to user.man.
> 
> You now have a "mandatory" (meaning - usr can not change the
profile settings)
> profile that is accessible only by members of the group.
Now I know how to prepare the mandatory profile.
> 
> Group members will be able to access this group profile - but first the 
> administrator must set their profile path to point to this group profile.

Does this mean, that they have only this profile or is it possible to 
have a mandatory group profile and a personal profile ?
> 
> Does that clarify things?
> 
> - John T.
Maybe I oversought this in the howto, but your explanation should be 
added to the howto.

Thank you very much
Andreas