samba - Jun 2011 - DFS root only works for more recent Windows clients

I've been testing DFS roots and I'm finding that while Vista and 2008
Server clients can connect with no problems, Windows XP Pro and 2003
Server clients fail.  This seems like it's the wrong way round - Samba
usually has more difficulties with recent Windows versions than older
ones - but I can only assume that there's some registry/policy change
between the versions.  If anybody has seen similar issues or has an idea
of the likely cause, I'd be very glad of the help.

Using the Samba3x packages on Centos, so it's Samba 3.5.4.  Very simple
config:

#======================= Global Settings ====================================
[global]

        workgroup = OFFICE
        server string = 

# ------------------------- Domain Members Options --------------------------

        security = domain
        passdb backend = tdbsam
        password server = *

# -------------------------- Share Default Options ---------------------------

        writeable = no
        browseable = yes
        printable = no
        write list = @domadmins,
        valid users = @domadmins, @domusers,

# ---------------------------- Share Definitions -----------------------------

[files]
        path = /dfsroot
        msdfs root = yes


-- 
Bruce

Bitterly it mathinketh me, that I spent mine wholle lyf in the lists
against the ignorant.  -- Roger Bacon, "Doctor Mirabilis"

For me working without any trouble. Centos 5.5,5.4,5.6.
Did you:
host msdfs=yes???

-----------------------------------------------
EDV Daniel M?ller

Leitung EDV
Tropenklinik Paul-Lechler-Krankenhaus
Paul-Lechler-Str. 24
72076 T?bingen

Tel.: 07071/206-463, Fax: 07071/206-499
eMail: mueller at tropenklinik.de
Internet: www.tropenklinik.de
-----------------------------------------------
-----Urspr?ngliche Nachricht-----
Von: samba-bounces at lists.samba.org [mailto:samba-bounces at lists.samba.org]
Im
Auftrag von Bruce Richardson
Gesendet: Donnerstag, 9. Juni 2011 11:40
An: Samba
Betreff: [Samba] DFS root only works for more recent Windows clients

I've been testing DFS roots and I'm finding that while Vista and 2008
Server clients can connect with no problems, Windows XP Pro and 2003
Server clients fail.  This seems like it's the wrong way round - Samba
usually has more difficulties with recent Windows versions than older
ones - but I can only assume that there's some registry/policy change
between the versions.  If anybody has seen similar issues or has an idea
of the likely cause, I'd be very glad of the help.

Using the Samba3x packages on Centos, so it's Samba 3.5.4.  Very simple
config:

#======================= Global Settings
====================================
[global]

        workgroup = OFFICE
        server string = 

# ------------------------- Domain Members Options
--------------------------

        security = domain
        passdb backend = tdbsam
        password server = *

# -------------------------- Share Default Options
---------------------------

        writeable = no
        browseable = yes
        printable = no
        write list = @domadmins,
        valid users = @domadmins, @domusers,

# ---------------------------- Share Definitions
-----------------------------

[files]
        path = /dfsroot
        msdfs root = yes


-- 
Bruce

Bitterly it mathinketh me, that I spent mine wholle lyf in the lists
against the ignorant.  -- Roger Bacon, "Doctor Mirabilis"
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

On Thu, 9 Jun 2011, Bruce Richardson wrote:
> I've been testing DFS roots and I'm finding that while Vista and
2008
> Server clients can connect with no problems, Windows XP Pro and 2003
> Server clients fail.
I have also seen the same behaviour. Sometimes the links work, sometimes 
they don't. I can create two links to the same share, identical apart from 
name, and one works and one does not. For the links that work, I can do a 
Properties on the link, and there is a Security tab, and under the DFS 
tab, I see \\realserver\realshare as the destination. For the links that 
do not work, there is no Security tab and under DFS I see just 
\\dfsserver\dfsroot.

I've also noticed that if I map the final share (one that does not work 
via dfsroot) as \\dfsserver\dfsroot\share, it always works, and after 
disconnecting that mapping, \\dfsserver\share also starts working. Reboot 
the client and they don't work any more.

I using Samba 3.5.1 on CentOS 5.5 x86_64 with ldapsam. All share names and 
link names are lower case, and I am using FQDN server names. All clients 
are Windows XP SP3 32-bit. I'm not convinced that it is a Samba problem, 
though, as I've seen folks with pure Windows environments complain of the 
same thing.

Steve

On Thu, Jun 09, 2011 at 10:39:50AM +0100, Bruce Richardson
wrote:
> I've been testing DFS roots and I'm finding that while Vista and
2008
> Server clients can connect with no problems, Windows XP Pro and 2003
> Server clients fail.  This seems like it's the wrong way round - Samba
> usually has more difficulties with recent Windows versions than older
> ones - but I can only assume that there's some registry/policy change
> between the versions.  If anybody has seen similar issues or has an idea
> of the likely cause, I'd be very glad of the help.
The cause was having a global restriction on access to shares:
> 
> # -------------------------- Share Default Options
---------------------------
>         valid users = @domadmins, @domusers,
Moving that option from the global config into the share config enabled
access for XP and 2003 DFS clients.  It seems that older versions of
Windows rely on public visibility of the IPC$ share for some things.

-- 
Bruce

What would Edward Woodward do?