samba - Mar 2017 - User profiles question

Hi,

I'm facing an issue where most users receive the error "The Group
Policy Client service
failed the logon. Access denied.". The fix so far is to delete a registry
folder on the
client machine, but there are cases where this does not work. For one user, I
had to
delete the account and create it again. The domain uses 3 centos7 + samba 4.5.5,
with a
fileserver running 4.4.4.

Reading https://wiki.samba.org/index.php/Roaming_Windows_User_Profiles shows me
that our
setup does not thing different from the suggested configuration:

We do not have a profiles share. Instead, we put the user profile inside the
user's home
folder.

Are there recomendations regarding the profile location? Is it ok to have the
user profile
inside the home drive, insteado of a specific share?

Here's the fileserver smb.conf, if it helps:

[global]
         netbios name = ULTRON
         security = ADS
         workgroup = E-TRUST
         realm = E-TRUST.COM.BR
         #dns forwarder = 192.168.2.27
         server role = member server

         # Default idmap config used for BUILTIN and local accounts/groups
         #idmap config *:backend = ad
         idmap config *:range = 2000-9999

         # Use settings from AD for login shell and home directory
         idmap_ldb:use rfc2307 = yes

         # idmap config for domain E-TRUST
         idmap config E-TRUST:backend = ad
         idmap config E-TRUST:schema_mode = rfc2307
         idmap config E-TRUST:range = 10000-40000

         # Winbind Configuration
         winbind enum groups = yes
         winbind enum users = yes
         winbind use default domain = yes
         winbind nss info = rfc2307

         #[cp 13.Oct.2016] Reduzido o cache do Winbindd
         idmap cache time = 30
         idmap negative cache time = 30
         winbind cache time = 30

         # Necessario no domain member apenas
         vfs objects = acl_xattr
         map acl inherit = yes
         store dos attributes = yes
         log level = 5
         log file = /var/log/samba/%M.log

         #[vbs 30.11.2016]180417 - remove vulnerabilidade
         #"26920 - Microsoft Windows SMB NULL Session Authentication"
         restrict anonymous = 2


[home]
    comment = Diretorios de usuarios
    path = /compartilhamentos/home/
    browseable = no
    writable = yes
    guest ok = no
    create mask = 600
    directory mask = 700

-- 

	
Vinicius Silva
SOC


BRA: + 55 51 2117.1000 | 55 11 5521.2021
USA: + 1 888 259.5801
vbs at e-trust.com.br
skype: vinicius.bones.silva

	







	Smiley face

www.e-trust.com.br <http://www.e-trust.com.br/>


Esta mensagem pode conter informações confidenciais ou privilegiadas. Se você
recebeu esta
mensagem por engano, você não deve usar, copiar, divulgar ou tomar qualquer
atitude com
base nestas informações. Solicitamos que você apague a mensagem imediatamente e
avise a
E-TRUST, enviando um e-mail para suporte at e-trust.com.br. Opiniões, conclusões
ou
informações contidas nesta mensagem não necessariamente refletem a posição
oficial da
E-TRUST. Caso assinada digitalmente, a autenticidade desta mensagem pode ser
confirmada
pela Autoridade Certificadora Privada E-TRUST, disponível em www.e-trust.com.br.

This message may contain privileged and confidential information for the use of
the
intended recipients only. If you are not an intended recipient then you should
not
disseminate, copy, or take any action based on its contents. If you have
received this
message in error then please notify E-TRUST by sending an e-mail message to 
suporte at e-trust.com.br immediately. Views and opinions expressed in this
message do not
necessarily reflect the position of E-TRUST. If this message is digitally
signed, its
authenticity can be confirmed by E-TRUST Private Certificate Authority,
available at
www.e-trust.com.br.

On Fri, 31 Mar 2017 12:16:09 -0300
Vinicius Bones Silva via samba <samba at lists.samba.org> wrote:
> Hi,
> 
> I'm facing an issue where most users receive the error "The Group
> Policy Client service failed the logon. Access denied.". The fix so
> far is to delete a registry folder on the client machine, but there
> are cases where this does not work. For one user, I had to delete the
> account and create it again. The domain uses 3 centos7 + samba 4.5.5,
> with a fileserver running 4.4.4.
> 
> Reading
> https://wiki.samba.org/index.php/Roaming_Windows_User_Profiles shows
> me that our setup does not thing different from the suggested
> configuration:
> 
> We do not have a profiles share. Instead, we put the user profile
> inside the user's home folder.
> 
> Are there recomendations regarding the profile location? Is it ok to
> have the user profile inside the home drive, insteado of a specific
> share?
I wouldn't put the profiles there.
> 
> Here's the fileserver smb.conf, if it helps:
> 
> [global]
>          #idmap config *:backend = ad
You should change the above to:

           idmap config * : backend = tdb
>          idmap config *:range = 2000-9999
> 
>          idmap_ldb:use rfc2307 = yes
You should remove the above line, this isn't a DC
>          #[cp 13.Oct.2016] Reduzido o cache do Winbindd
>          idmap cache time = 30
>          idmap negative cache time = 30
>          winbind cache time = 30
> 
Do you really need the above lines ?

I suggest you follow this Samba wiki page:

https://wiki.samba.org/index.php/Roaming_Windows_User_Profiles

Rowland