Adam Sienkiewicz
2012-Feb-21 23:15 UTC
[Samba] samba 3.5.6 as PDC & LDAP - roaming profile problem
Hi all;
for few weeks I'm trying to implement a new samba PDC server for my school.
It is based on debian squeeze and samba 3.5.6 with lDAP backend.
I was able to join a computer into domain, LDAP is working, mapping home
drive for users also.
It seems that almost all works good but with one exeption. The one thing
which is broken is roaming profile support.
When user is logging into domain windows (I tested win XP prof SP2 and win7
prof SP1) always said:
"Windows cannot locate the server copy of your roaming profile and is
attempting to log you on with your local profile. Changes to the profile
will not be copied to the server when you logoff. Possible causes of this
error include network problems or insufficient security rights. If this
problem persists, contact your network administrator.
DETAIL ? The network name cannot be found."
and
"Windows cannot find the local profile and is logging you on with a
temporary profile. Changes you make to this profile will be lost when you
log off."
It looks strange because when I put into netlogon share default profile
windows take it ( I see that background color in windows is the same like I
prevoiusly set into default profil), user is able to browse his profile
directory and create inside this dirs and files.In samba logs there are no
errors, I can see that /profile share is assigned into user.
On windows side in c:\windows\debug\userenv log there is:
USERENV(320.324) 18:58:22:898 DeleteProfileEx: Failed to query profile
guid with error 2
USERENV(320.324) 18:58:34:758 GetUserGuid: Failed to get user guid with
1355.
USERENV(320.324) 18:58:34:758 GetUserGuid: Failed to get user guid with
1355.
USERENV(320.324) 18:58:34:804 CheckRoamingShareOwnership: owner is S-1-1-0!
USERENV(320.324) 18:58:34:804 IsCentralProfileReachable: Ownership check
failed with 8007051B
USERENV(320.324) 18:58:34:804 ReportError: Impersonating user.
USERENV(320.324) 18:58:36:429 GetUserGuid: Failed to get user guid with
1355.
USERENV(320.324) 18:58:36:445 ReportError: Impersonating user.
USERENV(320.324) 18:58:37:023 RecurseDirectory:
=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=modern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;tpc=development;ord=3934272159358786
is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
lokalne\Temporary Internet Files\Content.IE5\ARGDYVI1\, dest = C:\Documents
and Settings\TEMP.TESTADM\Ustawienia lokalne\Temporary Internet
Files\Content.IE5\ARGDYVI1\
USERENV(320.324) 18:58:37:039 RecurseDirectory:
=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=modern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;tpc=development;ord=3934272159358786
is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
lokalne\Temporary Internet Files\Content.IE5\61Y5M1K7\, dest = C:\Documents
and Settings\TEMP.TESTADM\Ustawienia lokalne\Temporary Internet
Files\Content.IE5\61Y5M1K7\
USERENV(320.324) 18:58:37:039 RecurseDirectory:
=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=modern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;tpc=development;ord=3934272159358786
is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
lokalne\Temporary Internet Files\Content.IE5\Q6DTJICU\, dest = C:\Documents
and Settings\TEMP.TESTADM\Ustawienia lokalne\Temporary Internet
Files\Content.IE5\Q6DTJICU\
USERENV(320.324) 18:58:37:054 RecurseDirectory:
=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=modern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;tpc=development;ord=3934272159358786
is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
lokalne\Temporary Internet Files\Content.IE5\I56DMBW1\, dest = C:\Documents
and Settings\TEMP.TESTADM\Ustawienia lokalne\Temporary Internet
Files\Content.IE5\I56DMBW1\
USERENV(320.324) 18:58:43:461 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(358.278) 18:58:43:633 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(358.278) 18:58:43:633 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(320.324) 18:58:43:648 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(320.2a0) 18:58:43:664 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(550.6ac) 18:58:50:945 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(550.758) 18:58:50:992 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(320.f0) 18:58:58:758 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(77c.80) 19:04:24:414 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(320.324) 19:04:34:383 DeleteProfileEx: Failed to query profile
guid with error 2
USERENV(320.324) 19:04:51:508 GetUserGuid: Failed to get user guid with
1355.
USERENV(320.324) 19:04:51:508 GetUserGuid: Failed to get user guid with
1355.
USERENV(320.324) 19:04:51:554 CheckRoamingShareOwnership: owner is S-1-1-0!
USERENV(320.324) 19:04:51:554 IsCentralProfileReachable: Ownership check
failed with 8007051B
USERENV(320.324) 19:04:51:554 ReportError: Impersonating user.
USERENV(320.324) 19:04:53:273 GetUserGuid: Failed to get user guid with
1355.
USERENV(320.324) 19:04:53:273 ReportError: Impersonating user.
USERENV(320.324) 19:04:53:883 RecurseDirectory:
=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=modern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;tpc=development;ord=3934272159358786
is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
lokalne\Temporary Internet Files\Content.IE5\ARGDYVI1\, dest = C:\Documents
and Settings\TEMP.TESTADM\Ustawienia
Here is my smb.conf
[global]
workgroup = TESTADM
netbios name = PDC-SRV
security = user
enable privileges = yes
server string = Samba Server %v
encrypt passwords = true
unix password sync = yes
ldap passwd sync = yes
passwd program = /usr/sbin/smbldap-passwd -u "%u"
passwd chat = "Changing *\nNew password*" %n\n "*Retype new
password*" %n\n"
log level = 3
syslog = 0
log file = /var/log/samba/%U_%I.log
max log size = 100000
time server = Yes
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
mangling method = hash2
unix charset = ISO8859-2
dos charset = CP852
logon script = %G.bat
logon drive = H:
logon home logon path =\\172.16.220.131\profiles\%U
domain logons = Yes
domain master = Yes
os level = 65
preferred master = Yes
wins support = yes
passdb backend = ldapsam:ldap://127.0.0.1/
ldap admin dn = cn=admin,dc=slackware,dc=local
ldap suffix = dc=slackware,dc=local
ldap group suffix = ou=groups
ldap user suffix = ou=users
ldap machine suffix = ou=Computers
#ldap idmap suffix = ou=Idmap
add user script = /usr/sbin/smbldap-useradd -m "%u"
#ldap delete dn = Yes
delete user script = /usr/sbin/smbldap-userdel "%u"
add machine script = /usr/sbin/smbldap-useradd -t 0 -w "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u"
"%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x
"%u"
"%g"
set primary group script = /usr/sbin/smbldap-usermod -g '%g'
'%u'
admin users = domainadm
ldap ssl = no
host msdfs = no
# printers configuration
#printer admin = @"Print Operators"
load printers = Yes
create mask = 0640
directory mask = 0750
#force create mode = 0640
#force directory mode = 0750
nt acl support = No
printing = cups
printcap name = cups
deadtime = 10
guest ok = no
;guest account = nobody
;map to guest = Bad User
dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd
show add printer wizard = yes
; to maintain capital letters in shortcuts in any of the profile folders:
preserve case = yes
short preserve case = yes
case sensitive = no
[netlogon]
path = /home/netlogon/
comment = Netwok Logon Service
browseable = No
writable = yes
writelist = @domainadm
[homes]
comment = Home Directories
path = /home/%U
;valid users = /home/%S
read only = No
browseable = No
create mask = 0644
directory mask = 0711
;admin users = piotrbrudny
nt acl support = no
[profiles]
path = /profiles
read only = no
writable = yes
create mask = 0600
directory mask = 0700
browseable = No
guest ok = no
profile acls = no
;nt acl support = no
#a bylo acls=yes
csc policy = disable
# next line is a great way to secure the profiles
force user = %U
valid users = %U @"Domain Admins" @users
map acl inherit = yes
[printers]
comment = Network Printers
#printer admin = @"Print Operators"
guest ok = yes
printable = yes
path = /home/spool/
browseable = No
read only = Yes
printable = Yes
print command = /usr/bin/lpr -P%p -r %s
lpq command = /usr/bin/lpq -P%p
lprm command = /usr/bin/lprm -P%p %j
# print command = /usr/bin/lpr -U%U@%M -P%p -r %s
# lpq command = /usr/bin/lpq -U%U@%M -P%p
# lprm command = /usr/bin/lprm -U%U@%M -P%p %j
# lppause command = /usr/sbin/lpc -U%U@%M hold %p %j
# lpresume command = /usr/sbin/lpc -U%U@%M release %p %j
# queuepause command = /usr/sbin/lpc -U%U@%M stop %p
# queueresume command = /usr/sbin/lpc -U%U@%M start %p
[print$]
path = /home/printers
guest ok = No
browseable = Yes
read only = Yes
valid users = @"Print Operators"
write list = @"Print Operators"
create mask = 0664
directory mask = 0775
[public]
path = /tmp
guest ok = yes
browseable = Yes
and also some info about roaming profiles directory permissions
drwxrwxrwt 13 root root 4096 Feb 17 20:05 profiles
oot at debldap4:~# tree -p -g -u /profiles
/profiles
??? [drwx------ czarus Domain U] czarus
??? [drwx------ domainad domainad] domainadm
??? [drwxrwxrwx jas Domain A] jas
??? [drwx------ root root ] root
??? [drwx------ sambaroo Domain U] sambaroot2
??? [drwx------ sambaroo Domain U] sambaroot2.V2
??? [drwx------ sambaroo Domain U] sambaroot3
??? [drwx------ sambaroo Domain U] sambaroot3.V2
??? [drwx------ test2 Domain U] test2
? ??? [drwx------ test2 Domain U] dfd
??? [drwx------ test5 domainad] test5
??? [drwx------ test4 domainad] %u
12 directories, 0 files
dirs in /profiles directory was created automatically during logon process.
I googled few days I tryed all what I can find but with no luck. It will be
great if somebody could help me with this because I have no idea what is a
root cause of my issue.
Adam Sienkiewicz
2012-Feb-23 07:45 UTC
[Samba] samba 3.5.6 as PDC & LDAP - roaming profile problem
Hi all;
for few weeks I'm trying to implement a new samba PDC server for my school.
It is based on debian squeeze and samba 3.5.6 with lDAP backend.
I was able to join a computer into domain, LDAP is working, mapping home
drive for users also.
It seems that almost all works good but with one exeption. The one thing
which is broken is roaming profile support.
When user is logging into domain windows (I tested win XP prof SP2 and win7
prof SP1) always said:
"Windows cannot locate the server copy of your roaming profile and is
attempting to log you on with your local profile. Changes to the profile
will not be copied to the server when you logoff. Possible causes of this
error include network problems or insufficient security rights. If this
problem persists, contact your network administrator.
DETAIL ? The network name cannot be found."
and
"Windows cannot find the local profile and is logging you on with a
temporary profile. Changes you make to this profile will be lost when you
log off."
It looks strange because when I put into netlogon share default profile
windows take it ( I see that background color in windows is the same like I
prevoiusly set into default profil), user is able to browse his profile
directory and create inside this dirs and files.In samba logs there are no
errors, I can see that /profile share is assigned into user.
On windows side in c:\windows\debug\userenv log there is:
USERENV(320.324) 18:58:22:898 DeleteProfileEx: Failed to query profile
guid with error 2
USERENV(320.324) 18:58:34:758 GetUserGuid: Failed to get user guid with
1355.
USERENV(320.324) 18:58:34:758 GetUserGuid: Failed to get user guid with
1355.
USERENV(320.324) 18:58:34:804 CheckRoamingShareOwnership: owner is S-1-1-0!
USERENV(320.324) 18:58:34:804 IsCentralProfileReachable: Ownership check
failed with 8007051B
USERENV(320.324) 18:58:34:804 ReportError: Impersonating user.
USERENV(320.324) 18:58:36:429 GetUserGuid: Failed to get user guid with
1355.
USERENV(320.324) 18:58:36:445 ReportError: Impersonating user.
USERENV(320.324) 18:58:37:023 RecurseDirectory:
=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=modern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;tpc=development;ord=3934272159358786
is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
lokalne\Temporary Internet Files\Content.IE5\ARGDYVI1\, dest = C:\Documents
and Settings\TEMP.TESTADM\Ustawienia lokalne\Temporary Internet
Files\Content.IE5\ARGDYVI1\
USERENV(320.324) 18:58:37:039 RecurseDirectory:
=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=modern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;tpc=development;ord=3934272159358786
is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
lokalne\Temporary Internet Files\Content.IE5\61Y5M1K7\, dest = C:\Documents
and Settings\TEMP.TESTADM\Ustawienia lokalne\Temporary Internet
Files\Content.IE5\61Y5M1K7\
USERENV(320.324) 18:58:37:039 RecurseDirectory:
=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=modern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;tpc=development;ord=3934272159358786
is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
lokalne\Temporary Internet Files\Content.IE5\Q6DTJICU\, dest = C:\Documents
and Settings\TEMP.TESTADM\Ustawienia lokalne\Temporary Internet
Files\Content.IE5\Q6DTJICU\
USERENV(320.324) 18:58:37:054 RecurseDirectory:
=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=modern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;tpc=development;ord=3934272159358786
is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
lokalne\Temporary Internet Files\Content.IE5\I56DMBW1\, dest = C:\Documents
and Settings\TEMP.TESTADM\Ustawienia lokalne\Temporary Internet
Files\Content.IE5\I56DMBW1\
USERENV(320.324) 18:58:43:461 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(358.278) 18:58:43:633 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(358.278) 18:58:43:633 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(320.324) 18:58:43:648 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(320.2a0) 18:58:43:664 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(550.6ac) 18:58:50:945 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(550.758) 18:58:50:992 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(320.f0) 18:58:58:758 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(77c.80) 19:04:24:414 GetUserDNSDomainName: MyGetUserNameEx failed
for NameDnsDomain style name with 1332
USERENV(320.324) 19:04:34:383 DeleteProfileEx: Failed to query profile
guid with error 2
USERENV(320.324) 19:04:51:508 GetUserGuid: Failed to get user guid with
1355.
USERENV(320.324) 19:04:51:508 GetUserGuid: Failed to get user guid with
1355.
USERENV(320.324) 19:04:51:554 CheckRoamingShareOwnership: owner is S-1-1-0!
USERENV(320.324) 19:04:51:554 IsCentralProfileReachable: Ownership check
failed with 8007051B
USERENV(320.324) 19:04:51:554 ReportError: Impersonating user.
USERENV(320.324) 19:04:53:273 GetUserGuid: Failed to get user guid with
1355.
USERENV(320.324) 19:04:53:273 ReportError: Impersonating user.
USERENV(320.324) 19:04:53:883 RecurseDirectory:
=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=modern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;tpc=development;ord=3934272159358786
is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
lokalne\Temporary Internet Files\Content.IE5\ARGDYVI1\, dest = C:\Documents
and Settings\TEMP.TESTADM\Ustawienia
Here is my smb.conf
[global]
workgroup = TESTADM
netbios name = PDC-SRV
security = user
enable privileges = yes
server string = Samba Server %v
encrypt passwords = true
unix password sync = yes
ldap passwd sync = yes
passwd program = /usr/sbin/smbldap-passwd -u "%u"
passwd chat = "Changing *\nNew password*" %n\n "*Retype new
password*" %n\n"
log level = 3
syslog = 0
log file = /var/log/samba/%U_%I.log
max log size = 100000
time server = Yes
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
mangling method = hash2
unix charset = ISO8859-2
dos charset = CP852
logon script = %G.bat
logon drive = H:
logon home logon path =\\172.16.220.131\profiles\%U
domain logons = Yes
domain master = Yes
os level = 65
preferred master = Yes
wins support = yes
passdb backend = ldapsam:ldap://127.0.0.1/
ldap admin dn = cn=admin,dc=slackware,dc=local
ldap suffix = dc=slackware,dc=local
ldap group suffix = ou=groups
ldap user suffix = ou=users
ldap machine suffix = ou=Computers
#ldap idmap suffix = ou=Idmap
add user script = /usr/sbin/smbldap-useradd -m "%u"
#ldap delete dn = Yes
delete user script = /usr/sbin/smbldap-userdel "%u"
add machine script = /usr/sbin/smbldap-useradd -t 0 -w "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u"
"%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x
"%u"
"%g"
set primary group script = /usr/sbin/smbldap-usermod -g '%g'
'%u'
admin users = domainadm
ldap ssl = no
host msdfs = no
# printers configuration
#printer admin = @"Print Operators"
load printers = Yes
create mask = 0640
directory mask = 0750
#force create mode = 0640
#force directory mode = 0750
nt acl support = No
printing = cups
printcap name = cups
deadtime = 10
guest ok = no
;guest account = nobody
;map to guest = Bad User
dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd
show add printer wizard = yes
; to maintain capital letters in shortcuts in any of the profile folders:
preserve case = yes
short preserve case = yes
case sensitive = no
[netlogon]
path = /home/netlogon/
comment = Netwok Logon Service
browseable = No
writable = yes
writelist = @domainadm
[homes]
comment = Home Directories
path = /home/%U
;valid users = /home/%S
read only = No
browseable = No
create mask = 0644
directory mask = 0711
;admin users = piotrbrudny
nt acl support = no
[profiles]
path = /profiles
read only = no
writable = yes
create mask = 0600
directory mask = 0700
browseable = No
guest ok = no
profile acls = no
;nt acl support = no
#a bylo acls=yes
csc policy = disable
# next line is a great way to secure the profiles
force user = %U
valid users = %U @"Domain Admins" @users
map acl inherit = yes
[printers]
comment = Network Printers
#printer admin = @"Print Operators"
guest ok = yes
printable = yes
path = /home/spool/
browseable = No
read only = Yes
printable = Yes
print command = /usr/bin/lpr -P%p -r %s
lpq command = /usr/bin/lpq -P%p
lprm command = /usr/bin/lprm -P%p %j
# print command = /usr/bin/lpr -U%U@%M -P%p -r %s
# lpq command = /usr/bin/lpq -U%U@%M -P%p
# lprm command = /usr/bin/lprm -U%U@%M -P%p %j
# lppause command = /usr/sbin/lpc -U%U@%M hold %p %j
# lpresume command = /usr/sbin/lpc -U%U@%M release %p %j
# queuepause command = /usr/sbin/lpc -U%U@%M stop %p
# queueresume command = /usr/sbin/lpc -U%U@%M start %p
[print$]
path = /home/printers
guest ok = No
browseable = Yes
read only = Yes
valid users = @"Print Operators"
write list = @"Print Operators"
create mask = 0664
directory mask = 0775
[public]
path = /tmp
guest ok = yes
browseable = Yes
and also some info about roaming profiles directory permissions
drwxrwxrwt 13 root root 4096 Feb 17 20:05 profiles
oot at debldap4:~# tree -p -g -u /profiles
/profiles
??? [drwx------ czarus Domain U] czarus
??? [drwx------ domainad domainad] domainadm
??? [drwxrwxrwx jas Domain A] jas
??? [drwx------ root root ] root
??? [drwx------ sambaroo Domain U] sambaroot2
??? [drwx------ sambaroo Domain U] sambaroot2.V2
??? [drwx------ sambaroo Domain U] sambaroot3
??? [drwx------ sambaroo Domain U] sambaroot3.V2
??? [drwx------ test2 Domain U] test2
? ??? [drwx------ test2 Domain U] dfd
??? [drwx------ test5 domainad] test5
??? [drwx------ test4 domainad] %u
12 directories, 0 files
dirs in /profiles directory was created automatically during logon process.
I googled few days I tryed all what I can find but with no luck. It will be
great if somebody could help me with this because I have no idea what is a
root cause of my issue.
Adam Sienkiewicz
2012-Feb-26 08:33 UTC
[Samba] samba 3.5.6 as PDC & LDAP - roaming profile problem
Hi Steve In my system I have following permissions; /home 777 /home/netlogon/Default Profile 755 still not working :( 2012/2/24 steve <steve at steve-ss.com>> [2012/02/24 17:50:50.931935, 2] smbd/open.c:633(open_file) jas opened file > Default User/NTUSER.DAT read=Yes write=No (numopen=1) > > [2012/02/24 17:50:51.884020, 2] smbd/open.c:633(open_file) jas opened file > Default User/ntuser.dat.LOG read=Yes write=No (numopen=2) > > [2012/02/24 17:50:51.905456, 2] smbd/open.c:633(open_file) jas opened file > Default User/ntuser.ini read=Yes write=No (numopen=3) > > On those files I have: > > -rw-r--r-- 1 steve suseusers 786432 Feb 24 20:07 NTUSER.DAT > -rw-r--r-- 1 steve suseusers 160 Feb 24 20:08 ntuser.ini > and > drwxr-xr-x > on the folders. > > Any good? > > Steve > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/**mailman/options/samba<https://lists.samba.org/mailman/options/samba> >
Hi r u sure you are mapping the correct user? Is nscd turned off? Cheers On 02/26/2012 09:33 AM, Adam Sienkiewicz wrote:> Hi Steve > > In my system I have following permissions; > > /home 777 > /home/netlogon/Default Profile 755 > > still not working :( > > > 2012/2/24 steve <steve at steve-ss.com <mailto:steve at steve-ss.com>> > > [2012/02/24 17:50:50.931935, 2] smbd/open.c:633(open_file) jas > opened file Default User/NTUSER.DAT read=Yes write=No (numopen=1) > > [2012/02/24 17:50:51.884020, 2] smbd/open.c:633(open_file) jas > opened file Default User/ntuser.dat.LOG read=Yes write=No (numopen=2) > > [2012/02/24 17:50:51.905456, 2] smbd/open.c:633(open_file) jas > opened file Default User/ntuser.ini read=Yes write=No (numopen=3) > > On those files I have: > > -rw-r--r-- 1 steve suseusers 786432 Feb 24 20:07 NTUSER.DAT > -rw-r--r-- 1 steve suseusers 160 Feb 24 20:08 ntuser.ini > and > drwxr-xr-x > on the folders. > > Any good? > > Steve > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba > >
Adam Sienkiewicz
2012-Feb-27 06:58 UTC
[Samba] samba 3.5.6 as PDC & LDAP - roaming profile problem
Hi; nscd is not installed in my system. I thing mapping of users is correct. I can login into linux via ldap using account which caused problems with roaming profiles in samba ... 2012/2/26 steve <steve at steve-ss.com>> Hi > r u sure you are mapping the correct user? Is nscd turned off? > Cheers > > > On 02/26/2012 09:33 AM, Adam Sienkiewicz wrote: > >> Hi Steve >> >> In my system I have following permissions; >> >> /home 777 >> /home/netlogon/Default Profile 755 >> >> still not working :( >> >> >> 2012/2/24 steve <steve at steve-ss.com <mailto:steve at steve-ss.com>> >> >> >> [2012/02/24 17:50:50.931935, 2] smbd/open.c:633(open_file) jas >> opened file Default User/NTUSER.DAT read=Yes write=No (numopen=1) >> >> [2012/02/24 17:50:51.884020, 2] smbd/open.c:633(open_file) jas >> opened file Default User/ntuser.dat.LOG read=Yes write=No (numopen=2) >> >> [2012/02/24 17:50:51.905456, 2] smbd/open.c:633(open_file) jas >> opened file Default User/ntuser.ini read=Yes write=No (numopen=3) >> >> On those files I have: >> >> -rw-r--r-- 1 steve suseusers 786432 Feb 24 20:07 NTUSER.DAT >> -rw-r--r-- 1 steve suseusers 160 Feb 24 20:08 ntuser.ini >> and >> drwxr-xr-x >> on the folders. >> >> Any good? >> >> Steve >> -- To unsubscribe from this list go to the following URL and read >> the >> instructions: https://lists.samba.org/**mailman/options/samba<https://lists.samba.org/mailman/options/samba> >> >> >> >
Adam Sienkiewicz
2012-Feb-27 12:50 UTC
[Samba] samba 3.5.6 as PDC & LDAP - roaming profile problem
Hi all; I discovered thet from unknow reason %userprofile% varianle on both win xp anf win 7 is empt. But why ??? LDAP ?? Have any seen those kind of issue ? Cheers Adam 2012/2/27 Adam Sienkiewicz <adamsienkiewicz78 at gmail.com>> Hi; > > nscd is not installed in my system. > I thing mapping of users is correct. I can login into linux via ldap > using account which caused problems with roaming profiles in samba ... > > > 2012/2/26 steve <steve at steve-ss.com> > >> Hi >> r u sure you are mapping the correct user? Is nscd turned off? >> Cheers >> >> >> On 02/26/2012 09:33 AM, Adam Sienkiewicz wrote: >> >>> Hi Steve >>> >>> In my system I have following permissions; >>> >>> /home 777 >>> /home/netlogon/Default Profile 755 >>> >>> still not working :( >>> >>> >>> 2012/2/24 steve <steve at steve-ss.com <mailto:steve at steve-ss.com>> >>> >>> >>> [2012/02/24 17:50:50.931935, 2] smbd/open.c:633(open_file) jas >>> opened file Default User/NTUSER.DAT read=Yes write=No (numopen=1) >>> >>> [2012/02/24 17:50:51.884020, 2] smbd/open.c:633(open_file) jas >>> opened file Default User/ntuser.dat.LOG read=Yes write=No (numopen=2) >>> >>> [2012/02/24 17:50:51.905456, 2] smbd/open.c:633(open_file) jas >>> opened file Default User/ntuser.ini read=Yes write=No (numopen=3) >>> >>> On those files I have: >>> >>> -rw-r--r-- 1 steve suseusers 786432 Feb 24 20:07 NTUSER.DAT >>> -rw-r--r-- 1 steve suseusers 160 Feb 24 20:08 ntuser.ini >>> and >>> drwxr-xr-x >>> on the folders. >>> >>> Any good? >>> >>> Steve >>> -- To unsubscribe from this list go to the following URL and read >>> the >>> instructions: https://lists.samba.org/**mailman/options/samba<https://lists.samba.org/mailman/options/samba> >>> >>> >>> >> >
Adam Sienkiewicz
2012-Feb-27 14:24 UTC
[Samba] samba 3.5.6 as PDC & LDAP - roaming profile problem
Hi again Seems to be solved now - I changed Do not check owner of roaming profile in gpedit.msc on win xp and win7 and now is working but loading of roaminf profile in win7 is very slow. I will try to do some tuning this. Anyway thanks for help for all !!! 2012/2/27 Adam Sienkiewicz <adamsienkiewicz78 at gmail.com>> Hi all; > > I discovered thet from unknow reason %userprofile% varianle on both win xp > anf win 7 is empt. But why ??? > LDAP ?? > > Have any seen those kind of issue ? > > Cheers Adam > > 2012/2/27 Adam Sienkiewicz <adamsienkiewicz78 at gmail.com> > >> Hi; >> >> nscd is not installed in my system. >> I thing mapping of users is correct. I can login into linux via ldap >> using account which caused problems with roaming profiles in samba ... >> >> >> 2012/2/26 steve <steve at steve-ss.com> >> >>> Hi >>> r u sure you are mapping the correct user? Is nscd turned off? >>> Cheers >>> >>> >>> On 02/26/2012 09:33 AM, Adam Sienkiewicz wrote: >>> >>>> Hi Steve >>>> >>>> In my system I have following permissions; >>>> >>>> /home 777 >>>> /home/netlogon/Default Profile 755 >>>> >>>> still not working :( >>>> >>>> >>>> 2012/2/24 steve <steve at steve-ss.com <mailto:steve at steve-ss.com>> >>>> >>>> >>>> [2012/02/24 17:50:50.931935, 2] smbd/open.c:633(open_file) jas >>>> opened file Default User/NTUSER.DAT read=Yes write=No (numopen=1) >>>> >>>> [2012/02/24 17:50:51.884020, 2] smbd/open.c:633(open_file) jas >>>> opened file Default User/ntuser.dat.LOG read=Yes write=No (numopen=2) >>>> >>>> [2012/02/24 17:50:51.905456, 2] smbd/open.c:633(open_file) jas >>>> opened file Default User/ntuser.ini read=Yes write=No (numopen=3) >>>> >>>> On those files I have: >>>> >>>> -rw-r--r-- 1 steve suseusers 786432 Feb 24 20:07 NTUSER.DAT >>>> -rw-r--r-- 1 steve suseusers 160 Feb 24 20:08 ntuser.ini >>>> and >>>> drwxr-xr-x >>>> on the folders. >>>> >>>> Any good? >>>> >>>> Steve >>>> -- To unsubscribe from this list go to the following URL and >>>> read the >>>> instructions: https://lists.samba.org/**mailman/options/samba<https://lists.samba.org/mailman/options/samba> >>>> >>>> >>>> >>> >> >
L.P.H. van Belle
2012-Mar-05 07:44 UTC
[Samba] samba 3.5.6 as PDC & LDAP - roaming profile problem
Hai,
First, cleanup your profile before making it your default profile.
this ( Ustawienia Lokalne\Temporary Internet Files\Content.IE5\ARGDYVI1 )
should not be there, there should not be any "Temp" folder.
Second, your profiles doesn't look right.
this is mine and this is working: ( adjust your path to : path = /profiles )
set the initial rights on /profiles to 777
new folders are created with the right rights.
[profiles]
path = /home/samba/profiles
comment = Profiel omgeving
read only = no
create mask = 0600
directory mask = 0700
browseable = Yes
guest ok = Yes
csc policy = disable
force user = %U
# next line allows administrator to access all profiles
valid users = %U @"Domain Admins"
>-----Oorspronkelijk bericht-----
>Van: adamsienkiewicz78 at gmail.com
>[mailto:samba-bounces at lists.samba.org] Namens Adam Sienkiewicz
>Verzonden: 2012-02-22 00:15
>Aan: samba at lists.samba.org
>Onderwerp: [Samba] samba 3.5.6 as PDC & LDAP - roaming profile problem
>
>Hi all;
>
>for few weeks I'm trying to implement a new samba PDC server
>for my school.
>It is based on debian squeeze and samba 3.5.6 with lDAP backend.
>I was able to join a computer into domain, LDAP is working,
>mapping home
>drive for users also.
>It seems that almost all works good but with one exeption. The
>one thing
>which is broken is roaming profile support.
>When user is logging into domain windows (I tested win XP prof
>SP2 and win7
>prof SP1) always said:
>"Windows cannot locate the server copy of your roaming profile and is
>attempting to log you on with your local profile. Changes to
>the profile
>will not be copied to the server when you logoff. Possible
>causes of this
>error include network problems or insufficient security rights. If this
>problem persists, contact your network administrator.
>DETAIL ? The network name cannot be found."
>and
>"Windows cannot find the local profile and is logging you on with a
>temporary profile. Changes you make to this profile will be
>lost when you
>log off."
>It looks strange because when I put into netlogon share default profile
>windows take it ( I see that background color in windows is
>the same like I
>prevoiusly set into default profil), user is able to browse his profile
>directory and create inside this dirs and files.In samba logs
>there are no
>errors, I can see that /profile share is assigned into user.
>On windows side in c:\windows\debug\userenv log there is:
>
>USERENV(320.324) 18:58:22:898 DeleteProfileEx: Failed to query profile
>guid with error 2
>USERENV(320.324) 18:58:34:758 GetUserGuid: Failed to get user guid with
>1355.
>USERENV(320.324) 18:58:34:758 GetUserGuid: Failed to get user guid with
>1355.
>USERENV(320.324) 18:58:34:804 CheckRoamingShareOwnership:
>owner is S-1-1-0!
>USERENV(320.324) 18:58:34:804 IsCentralProfileReachable:
>Ownership check
>failed with 8007051B
>USERENV(320.324) 18:58:34:804 ReportError: Impersonating user.
>USERENV(320.324) 18:58:36:429 GetUserGuid: Failed to get user guid with
>1355.
>USERENV(320.324) 18:58:36:445 ReportError: Impersonating user.
>USERENV(320.324) 18:58:37:023 RecurseDirectory:
>=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=m
>odern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;t
>pc=development;ord=3934272159358786
>is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
>lokalne\Temporary Internet Files\Content.IE5\ARGDYVI1\, dest =
>C:\Documents
>and Settings\TEMP.TESTADM\Ustawienia lokalne\Temporary Internet
>Files\Content.IE5\ARGDYVI1\
>USERENV(320.324) 18:58:37:039 RecurseDirectory:
>=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=m
>odern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;t
>pc=development;ord=3934272159358786
>is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
>lokalne\Temporary Internet Files\Content.IE5\61Y5M1K7\, dest =
>C:\Documents
>and Settings\TEMP.TESTADM\Ustawienia lokalne\Temporary Internet
>Files\Content.IE5\61Y5M1K7\
>USERENV(320.324) 18:58:37:039 RecurseDirectory:
>=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=m
>odern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;t
>pc=development;ord=3934272159358786
>is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
>lokalne\Temporary Internet Files\Content.IE5\Q6DTJICU\, dest =
>C:\Documents
>and Settings\TEMP.TESTADM\Ustawienia lokalne\Temporary Internet
>Files\Content.IE5\Q6DTJICU\
>USERENV(320.324) 18:58:37:054 RecurseDirectory:
>=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=m
>odern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;t
>pc=development;ord=3934272159358786
>is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
>lokalne\Temporary Internet Files\Content.IE5\I56DMBW1\, dest =
>C:\Documents
>and Settings\TEMP.TESTADM\Ustawienia lokalne\Temporary Internet
>Files\Content.IE5\I56DMBW1\
>USERENV(320.324) 18:58:43:461 GetUserDNSDomainName:
>MyGetUserNameEx failed
>for NameDnsDomain style name with 1332
>USERENV(358.278) 18:58:43:633 GetUserDNSDomainName:
>MyGetUserNameEx failed
>for NameDnsDomain style name with 1332
>USERENV(358.278) 18:58:43:633 GetUserDNSDomainName:
>MyGetUserNameEx failed
>for NameDnsDomain style name with 1332
>USERENV(320.324) 18:58:43:648 GetUserDNSDomainName:
>MyGetUserNameEx failed
>for NameDnsDomain style name with 1332
>USERENV(320.2a0) 18:58:43:664 GetGPOInfo: Local GPO's gpt.ini is not
>accessible, assuming default state.
>USERENV(550.6ac) 18:58:50:945 GetUserDNSDomainName:
>MyGetUserNameEx failed
>for NameDnsDomain style name with 1332
>USERENV(550.758) 18:58:50:992 GetUserDNSDomainName:
>MyGetUserNameEx failed
>for NameDnsDomain style name with 1332
>USERENV(320.f0) 18:58:58:758 GetUserDNSDomainName:
>MyGetUserNameEx failed
>for NameDnsDomain style name with 1332
>USERENV(77c.80) 19:04:24:414 GetUserDNSDomainName:
>MyGetUserNameEx failed
>for NameDnsDomain style name with 1332
>USERENV(320.324) 19:04:34:383 DeleteProfileEx: Failed to query profile
>guid with error 2
>USERENV(320.324) 19:04:51:508 GetUserGuid: Failed to get user guid with
>1355.
>USERENV(320.324) 19:04:51:508 GetUserGuid: Failed to get user guid with
>1355.
>USERENV(320.324) 19:04:51:554 CheckRoamingShareOwnership:
>owner is S-1-1-0!
>USERENV(320.324) 19:04:51:554 IsCentralProfileReachable:
>Ownership check
>failed with 8007051B
>USERENV(320.324) 19:04:51:554 ReportError: Impersonating user.
>USERENV(320.324) 19:04:53:273 GetUserGuid: Failed to get user guid with
>1355.
>USERENV(320.324) 19:04:53:273 ReportError: Impersonating user.
>USERENV(320.324) 19:04:53:883 RecurseDirectory:
>=mswin_all32bit;tpc=os_groups;tpc=mswin_2000;tpc=mswin_xp;tpc=m
>odern_oses;tpc=Delphi;tpc=winnt;tpc=win95;tpc=linux;tpc=posix;t
>pc=development;ord=3934272159358786
>is too long. src = \\PDC-SRV\netlogon\Default User\Ustawienia
>lokalne\Temporary Internet Files\Content.IE5\ARGDYVI1\, dest =
>C:\Documents
>and Settings\TEMP.TESTADM\Ustawienia
>
>Here is my smb.conf
>
>[global]
>workgroup = TESTADM
>netbios name = PDC-SRV
>security = user
>enable privileges = yes
>server string = Samba Server %v
>encrypt passwords = true
>unix password sync = yes
>ldap passwd sync = yes
>passwd program = /usr/sbin/smbldap-passwd -u "%u"
>passwd chat = "Changing *\nNew password*" %n\n "*Retype new
>password*" %n\n"
>
>log level = 3
>syslog = 0
>log file = /var/log/samba/%U_%I.log
>max log size = 100000
>time server = Yes
>socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
>mangling method = hash2
>unix charset = ISO8859-2
>dos charset = CP852
>logon script = %G.bat
>logon drive = H:
> logon home > logon path =\\172.16.220.131\profiles\%U
>domain logons = Yes
>domain master = Yes
>os level = 65
>preferred master = Yes
>wins support = yes
>passdb backend = ldapsam:ldap://127.0.0.1/
>ldap admin dn = cn=admin,dc=slackware,dc=local
>ldap suffix = dc=slackware,dc=local
> ldap group suffix = ou=groups
> ldap user suffix = ou=users
> ldap machine suffix = ou=Computers
>#ldap idmap suffix = ou=Idmap
> add user script = /usr/sbin/smbldap-useradd -m "%u"
> #ldap delete dn = Yes
> delete user script = /usr/sbin/smbldap-userdel "%u"
> add machine script = /usr/sbin/smbldap-useradd -t 0 -w
"%u"
> add group script = /usr/sbin/smbldap-groupadd -p "%g"
> delete group script = /usr/sbin/smbldap-groupdel "%g"
> add user to group script = /usr/sbin/smbldap-groupmod
>-m "%u" "%g"
> delete user from group script =
>/usr/sbin/smbldap-groupmod -x "%u"
>"%g"
>set primary group script = /usr/sbin/smbldap-usermod -g '%g'
'%u'
>admin users = domainadm
>ldap ssl = no
>host msdfs = no
>
># printers configuration
>#printer admin = @"Print Operators"
>load printers = Yes
>create mask = 0640
>directory mask = 0750
>#force create mode = 0640
>#force directory mode = 0750
>nt acl support = No
>printing = cups
>printcap name = cups
>deadtime = 10
>guest ok = no
>;guest account = nobody
>;map to guest = Bad User
>dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd
>show add printer wizard = yes
>; to maintain capital letters in shortcuts in any of the
>profile folders:
>preserve case = yes
>short preserve case = yes
>case sensitive = no
>
>[netlogon]
>path = /home/netlogon/
>comment = Netwok Logon Service
>browseable = No
>writable = yes
>writelist = @domainadm
>
>[homes]
> comment = Home Directories
> path = /home/%U
> ;valid users = /home/%S
> read only = No
> browseable = No
> create mask = 0644
> directory mask = 0711
> ;admin users = piotrbrudny
> nt acl support = no
>
>
>[profiles]
>path = /profiles
>read only = no
>writable = yes
>create mask = 0600
>directory mask = 0700
>browseable = No
>guest ok = no
>profile acls = no
>;nt acl support = no
>#a bylo acls=yes
>csc policy = disable
># next line is a great way to secure the profiles
>force user = %U
>valid users = %U @"Domain Admins" @users
>map acl inherit = yes
>[printers]
> comment = Network Printers
> #printer admin = @"Print Operators"
> guest ok = yes
> printable = yes
> path = /home/spool/
> browseable = No
> read only = Yes
> printable = Yes
> print command = /usr/bin/lpr -P%p -r %s
> lpq command = /usr/bin/lpq -P%p
> lprm command = /usr/bin/lprm -P%p %j
> # print command = /usr/bin/lpr -U%U@%M -P%p -r %s
> # lpq command = /usr/bin/lpq -U%U@%M -P%p
> # lprm command = /usr/bin/lprm -U%U@%M -P%p %j
> # lppause command = /usr/sbin/lpc -U%U@%M hold %p %j
> # lpresume command = /usr/sbin/lpc -U%U@%M release %p %j
> # queuepause command = /usr/sbin/lpc -U%U@%M stop %p
> # queueresume command = /usr/sbin/lpc -U%U@%M start %p
>
>[print$]
> path = /home/printers
> guest ok = No
> browseable = Yes
> read only = Yes
> valid users = @"Print Operators"
> write list = @"Print Operators"
> create mask = 0664
> directory mask = 0775
>
>[public]
>path = /tmp
>guest ok = yes
>browseable = Yes
>
>and also some info about roaming profiles directory permissions
>
>drwxrwxrwt 13 root root 4096 Feb 17 20:05 profiles
>
>oot at debldap4:~# tree -p -g -u /profiles
>/profiles
>????????? [drwx------ czarus Domain U] czarus
>????????? [drwx------ domainad domainad] domainadm
>????????? [drwxrwxrwx jas Domain A] jas
>????????? [drwx------ root root ] root
>????????? [drwx------ sambaroo Domain U] sambaroot2
>????????? [drwx------ sambaroo Domain U] sambaroot2.V2
>????????? [drwx------ sambaroo Domain U] sambaroot3
>????????? [drwx------ sambaroo Domain U] sambaroot3.V2
>????????? [drwx------ test2 Domain U] test2
>??? ????????? [drwx------ test2 Domain U] dfd
>????????? [drwx------ test5 domainad] test5
>????????? [drwx------ test4 domainad] %u
>
>12 directories, 0 files
>
>dirs in /profiles directory was created automatically during
>logon process.
>
>I googled few days I tryed all what I can find but with no
>luck. It will be
>great if somebody could help me with this because I have no
>idea what is a
>root cause of my issue.
>--
>To unsubscribe from this list go to the following URL and read the
>instructions: https://lists.samba.org/mailman/options/samba
>