Hi,
We are testing AD migration and have come across an issue with login script. The
current (pre-ad) login scripts is located in /home/samba/netlogon and the login
script is KIX32.exe.
Post the migration, we copied the contents of the /home/samba/netlogon to
/var/lib/samba/sysvol/lin.group/scripts. When the users (both standard users and
domain admins) login, the login script (KIX32) doesn't execute.
We found the following:
If we browse to the path //server5/netlogon and run KIX32 manually , it works
and maps the drive.
If we run //server5/netlogon/KIX32.exe, it doesn't
Using rsat tools , we tried setting the logon script to the following and still
doesn't work
KIX32.EXE
//lin.group/netlogon/KIX32.EXE.
Looking at the logs, we see the following in the audit log
Feb 25 15:25:55 server5-new smbd_audit:
pghimire|192.168.125.188|netlogon|pread|ok|kixtart.kix
Feb 25 15:25:55 server5-new smbd_audit:
adw7d_|192.168.125.188|netlogon|pread|ok|WKIX32.EXE
Samba logs for the machine has the following ,
lin\ADW7D$ opened file lin.group/scripts/KIX32.EXE read=No write=No (numopen=2)
lin\ADW7D$ closed file lin.group/scripts/KIX32.EXE (numopen=1) NT_STATUS_OK
lin\ADW7D$ opened file lin.group/scripts/KIX32.EXE read=Yes write=No
(numopen=2)
lin\ADW7D$ closed file lin.group/scripts/KIX32.EXE (numopen=1) NT_STATUS_OK
The relevant smb.conf is as follows
[global]
workgroup = lin
realm = lin.GROUP
netbios name = server5
server role = active directory domain controller
log level = 4
log file = /var/log/samba/log.%m
template homedir = /home/%U
template shell = /bin/bash
winbind enum users = Yes
winbind enum groups = Yes
winbind nss info = rfc2307
full_audit:prefix = %u|%I|%S
full_audit:failure = none
full_audit:success = mkdir rmdir read pread write pwrite rename unlink
full_audit:facility = local5
full_audit:priority = notice
acl allow execute always = Yes
The permissions for the /var/lib/samba/sysvol/lin.group/scripts is as follows
drwxrwx---+ 5 root BUILTIN\administrators
Regards,
Praveen Ghimire
