samba - Jul 2011 - Samba 3.4, Windows 7, Roaming profiles and Folder redirection

Hello,
I'm quite new to Samba administration and I've inherited a working samba
setup with roaming profiles however the login and logout times for users has
been growing and I'm starting to think it's time do something about it.
I'm
thinking redirect some folders to a samba share on the network will speed up
the login and logout times.

Our setup has 25 Windows 7 workstations and about 10 laptop users(also on
windows 7) all connecting to one Samba server. The laptops are often not on
the main office network so i was planning to use offline file sync for the
network drive i would be redirecing to, is this a bad idea for some reason?

I've had a look around at various documentation and details seem
quite scarce. However all the documentation I've found is targeted at
Windows XP or suggests using domain wide Group Policy Objects (GPO's). My
understanding is that GPO's can only be used if you have a Windows AD server
or Samba 4 however I don't have a Windows server and Samba 4 is abit too
bleeding edge for a production deployment(?).

If anyone can point me to some good documentation it would be really useful,
I would love to see an updated "The Official Samba HOWTO and Reference
Guide" or similar. Thought's comments or insights are also more then
welcome.

Thanks,
Tanuki

On 21.07.2011, at 17:07, Tanuki uk wrote:
> Hello,
> I'm quite new to Samba administration and I've inherited a working
samba
> setup with roaming profiles however the login and logout times for users
has
> been growing and I'm starting to think it's time do something about
it.
I'd be curious what you are going to do.

I personally inherited a similar situation a year ago, where the roaming
profiles were supposed to allow the users to work from different locations in a
50 people company spread around two buildings on three floors. As far as I
understand the roaming profiles, one has to log out in order to log in. This was
the first problem - people used to log into one PC, then into another, and then
wonder where their desktop items have gone (last logout overwrites the
previous). Could be something has been set wrong, I did not investigate. Also
they had these huge long loading and unloading times. Also, they do not have
everywhere the same software (some licenses are expensive). So I stopped using
roaming profiles and introduced Remote desktop. Now people, who happen to be
"somewhere" in the company and need to access their PC, just open
Remote desktop, remember the last three digits of their IP address (192.168.1.*)
and they are on their PC, all apps open as they have left them, etc.

But of course, this is one scenario, which might not be good in all cases. Our
users work 80% of their time on their PC and then it happens they need to work
for a couple of hours on another PC, which happens to be free at this moment.
Just thought it might help to share it with you.

Geert.

Here are the key steps that need to be applied for Windows 7 and WinXp folder
redirection in Samba 3.x environments.  Feel free to email me off list if you
need any more detail:

-- For Windows 7 be sure to create a proper default user profile on the
workstation using sysprep.  It's crucial to the initial profile creation.

The first time a user logs onto the domain have a logon script (vbscript works
great for this) do the following:

-- Copy the applicable folder(s) from the users local profile to locations on
the server that are outside the user's remote profile path; for instance to
a folder in their home directory.

-- Alter the paths in
"HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell
Folders" to point to these new locations.  The most critical folders, and
maybe the only ones you really need to redirect, are Application Data(AppData)
and Desktop,  though you can redirect anything that's list in User Shell
Folders including Downloads.

-- Make sure the workstation's local GroupPolicy is set to not roam the
folders you've redirected. Windows will continue to copy them up and down
from the server's profile folder if you don't set this: User
Configuration\Administrative Templates\System\User Profiles	\Exclude directories
in roaming profile

- You will want to look at a couple of other settings in the Local GroupPolicy
and tweak to your preferences
	Computer Configuration\Administrative Templates\System\User Profiles
	User Configuration\Administrative Templates\System\User Profiles	

Here's the path structure we use:

Profile:
\\sambaserver\profiles\username\WinXP
\\sambaserver\profiles\username\WinXP.V2

Redirected:
\\sambaserver\homes\username\redirectedfolders\Desktop
\\sambaserver\homes\username\redirectedfolders\Favorites
\\sambaserver\homes\username\redirectedfolders\WinXP\AppData
\\sambaserver\homes\username\redirectedfolders\WinXP.V2\AppData

The first logon can be long depending on network performance and the number of
installed apps, up to a couple of minutes due to the copying of data from local
to remote drives.  Subsequent logons should only take 5 to 10 seconds (again
depending on network performance) since the system is only copying a few
megabytes worth of data to and from the profile folder.

There are a couple of critical timeout issues that may need to be addressed if
you experience long Welcome screens after the initial logon:

When the following local GPO is left in its default setting Samba domain logons
are delayed for 30 seconds: "Computer Configuration\Administrative
Templates\System\User Profiles\Set maximum wait time for the network if the user
has a roaming user profile or remote home directory."  Enable this and set
the value to 0 to work around this timeout.

A 30 second timeout can occur if you set the local GPO to "Run logon
scripts synchronously".  The fix was to apply an old Vista reg setting. 
Can be Googled as "Vista Run logon scripts synchronously".
.

Marc

On Jul 21, 2011, at 8:07 AM, Tanuki uk wrote:
> Hello,
> I'm quite new to Samba administration and I've inherited a working
samba
> setup with roaming profiles however the login and logout times for users
has
> been growing and I'm starting to think it's time do something about
it. I'm
> thinking redirect some folders to a samba share on the network will speed
up
> the login and logout times.
> 
> Our setup has 25 Windows 7 workstations and about 10 laptop users(also on
> windows 7) all connecting to one Samba server. The laptops are often not on
> the main office network so i was planning to use offline file sync for the
> network drive i would be redirecing to, is this a bad idea for some reason?
> 
> I've had a look around at various documentation and details seem
> quite scarce. However all the documentation I've found is targeted at
> Windows XP or suggests using domain wide Group Policy Objects (GPO's).
My
> understanding is that GPO's can only be used if you have a Windows AD
server
> or Samba 4 however I don't have a Windows server and Samba 4 is abit
too
> bleeding edge for a production deployment(?).
> 
> If anyone can point me to some good documentation it would be really
useful,
> I would love to see an updated "The Official Samba HOWTO and Reference
> Guide" or similar. Thought's comments or insights are also more
then
> welcome.
> 
> Thanks,
> Tanuki
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba

On 07/21/2011 10:07 AM, Tanuki uk wrote:
> Hello,
> I'm quite new to Samba administration and I've inherited a working
samba
> setup with roaming profiles however the login and logout times for users
has
> been growing and I'm starting to think it's time do something about
it. I'm
> thinking redirect some folders to a samba share on the network will speed
up
> the login and logout times.
The increasing logon and logoff times are most frequently caused by 
people storing files on their desktops (a VERY bad practice in corporate 
environments) - the entire desktop is written to the server when the 
user logs off from a machine.  This is particularly problematic when 
people log onto multiple machines at the same time.

Additionally, the files that are stored under "My Documents" are also 
copied from the profile server to the workstation at logon and are 
written back to the profile server at logoff.

PS: I came across one site where users had up to 120GB files in their 
"My Documents" and up to 20GB on their desktop.  Needless to say, they
could not afford the long logon and logoff times. :-)
> Our setup has 25 Windows 7 workstations and about 10 laptop users(also on
> windows 7) all connecting to one Samba server. The laptops are often not on
> the main office network so i was planning to use offline file sync for the
> network drive i would be redirecing to, is this a bad idea for some reason?
Should work OK so long as you can educate your users NOT to use the 
desktop and traditional "My Documents" to store large volumes of
files.
  Both the "Desktop" and "My Documents" folders can be
redirected to a
network share in the users' home directory - that will help resolve some 
of the problems.  Make sure that you disable the copying of these 
folders as part of the profile.  Refer to the Microsoft knowledge-base 
for info on how to do that.
> I've had a look around at various documentation and details seem
> quite scarce. However all the documentation I've found is targeted at
> Windows XP or suggests using domain wide Group Policy Objects (GPO's).
My
> understanding is that GPO's can only be used if you have a Windows AD
server
> or Samba 4 however I don't have a Windows server and Samba 4 is abit
too
> bleeding edge for a production deployment(?).
>
> If anyone can point me to some good documentation it would be really
useful,
> I would love to see an updated "The Official Samba HOWTO and Reference
> Guide" or similar. Thought's comments or insights are also more
then
> welcome.
I have no intention to update the Official Samba HOWTO and Reference 
Guide - it was enough work the first time and when I wrote the update 
for Samba 3.0.20.  If you wish to do that please be my guest!

Please check out the "Samba3 by Example" book I wrote - it has some 
now-aging info that can still be useful on setting up folder redirection.

Additionally, it might be worth your while to check the Samba Wiki for 
updated info that users have contributed.

Cheers,
John T.