similar to: Troubles on Roaming Profiles...

Hello, The GPO must be linked to the computers OU also, then the computer part will be applied too. Greetings!! 2017-11-30 14:54 GMT+01:00 Marco Gaiarin via samba <samba at lists.samba.org>: > Mandi! Daniel Carrasco via samba > In chel di` si favelave... > > > What about a gpresult -h result.html. The GPo is appplied to the user? > > Mmmhhhh... seems me no. Clearly

i've seen that is similar to your latest test. What about a gpresult -h result.html. The GPo is appplied to the user? Greetings!! 2017-11-30 13:29 GMT+01:00 Daniel Carrasco <d.carrasco at i2tic.com>: > I don't know if is relevant and maybe is the same as GPO that you've > created, but Ive a profiles folder with this configuration: > > [profiles] > path

I don't know if is relevant and maybe is the same as GPO that you've created, but Ive a profiles folder with this configuration: [profiles] path = /server/share/profiles read only = no browsable = no Other options are on my smb.conf global section so is the same as your configuration. Next I've changed the profile path on the user configuration instead use a

Mandi! Daniel Carrasco via samba In chel di` si favelave... > What about a gpresult -h result.html. The GPo is appplied to the user? Mmmhhhh... seems me no. Clearly Microsoft help here, building an Italian-language html file, but briefly i've defined a policy, only one, in the sub-OU OU=FVG, and inside i've set profile path (computer-oriented setting) and home path (user-based

Mandi! Rowland Penny via samba In chel di` si favelave... > Is this on a DC ? No, is a DM. > If it isn't, Try setting it up exactly like it is shown on the > wikipage, note that you only need the 'vfs objects' line if it isn't > set in [global] Wikipage say only: Create a new share. For details, see Setting up a Share Using Windows ACLs. and

I've created a folder for roaming profiles: [profiles] comment = Network Profiles Share path = /srv/samba/profiles browseable = No store dos attributes = Yes csc policy = disable map acl inherit = Yes read only = No vfs objects = acl_xattr Share permission and folder permission seems right, exactly as in: https://wiki.samba.org/index.php/Roaming_Windows_User_Profiles I've

Hai Marco, You can do this multiple ways. These are some good basics to read https://blogs.technet.microsoft.com/musings_of_a_technical_tam/2012/02/13/group-policy-basics-part-1-understanding-the-structure-of-a-group-policy-object/ https://blogs.technet.microsoft.com/musings_of_a_technical_tam/2012/02/15/group-policy-basics-part-2-understanding-which-gpos-to-apply/ ^^ see processing GPO

Hai, Sorry for the late reply, but yes, this is a risky move. Did you make sure this the DOMAIN SID's are exact the same between old and new servers? This: rsync -av --progress --xattrs --rsh=ssh Does not copy the (windows) acl's. Look at https://wiki.samba.org/index.php/Bidirectional_Rsync/Unison_based_SysVol_replication_workaround Howto to this with rsync and unison, the

Sorry, i came back on this, but: > In another, more generic, way: how password policies are enforced? still i need an answer on this question. I've done some tests, using my account, that pdbedit say: root at vdcsv1:~# LANG=C pdbedit -v gaio Unix username: gaio NT username: Account Flags: [U ] User SID:

A collegue of mine, in a different office branch of my organization, suffer continuous troubles on roaming profiles, troubles thta in my site, with rather similar setup, does not happens. Trouble last some month, but 'till now we have thinked was the network, and we had worked checking cables, switches, configurations. But trouble continues... and seems frequent but not with a specific

OK, now i've to start to move the big part of my users from my old NT-like domains to my new AD domain. I've setup roaming profile in the new domain following the wiki (https://wiki.samba.org/index.php/Roaming_Windows_User_Profiles, 'using windows ACL') and for new profiles works like a charm. But i've tried to move/copy old profile to the new domain, and seems work, with

I've setup home drive in my AD domain, using POSIX ACL because i've a script that create home and do other things (set email folder, set quota, ...). [users] comment = Home Directories path = /home browseable = No veto files = /.mail/.inbox/.ssh/ root preexec = /etc/samba/createhome "%u" force create mode = 0600 force directory mode = 0700 read only = No I've also

Happy new year to all! Samba 4.9.17 on stretch, Louis package. On 22/12, at midnight, office closed, i suffered a network outgage that 'broke in two' my domain. On 23/12, at 14.00, network come back. After that, some scripts written around ldbsearch i run on DM (against vdcsv1 that is the DC with FSMO roles) start to complain: Failed to bind - LDAP client internal error:

Mandi! L.P.H. van Belle via samba In chel di` si favelave... > I hope this helps you understanding your problem a bit more. > See also: > https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts No, wait. I'm probably mixed up too many things, and maked a lot of confusion. Restart. Say may domain is 'LNFFVG', and my windows 7

Mandi! Rowland Penny via samba In chel di` si favelave... > No, but what I do know is this, you should not use guest access on a > domain member, Windows turns it off by default. Also 'Guest' doesn't > exist on a Unix domain member, you would have to map it to the Unix > domain user 'nobody' No, this is not exactly true. You forget the 'guest account'

Mandi! Rowland Penny via samba In chel di` si favelave... > OK, Windows 'Guest' != Unix 'nobody' > It might seem if it does, but it doesn't Rowland, clearly i know that. But you sayed: > > > Also 'Guest' doesn't > > > exist on a Unix domain member, you would have to map it to the Unix > > > domain user 'nobody' and

Mandi! Rowland penny via samba In chel di` si favelave... > Try it with '%U' instead of '%u', it seems to be using the service name > instead of the username. OK, good hint but... for test users we have created by hand the profiles folders, so surely the script is not the culprit... Anyway, thanks. -- dott. Marco Gaiarin GNUPG Key ID: 240A3D66

Not only NT domains, but also Samba 3.6! Wow! I'm a retro-sysadmin! ;-) I know i'm asking a rather hard thinks but... we are upgrading, but also solving some troubles. We have ''decently'' integrated some W10 1803 in a NT domain, but now with some other 1903 there's no way to make roaming profiles work. Looking at samba logs, seems that the client don't try at

As subject say, we are trying to ''integrate'' some W10 machine on a NT domain, with samba as PDB/BDC, OpenLDAP backend. profile share is defined as: [profiles] comment = Network Profiles Share path = /srv/samba/profiles read only = No create mask = 0600 directory mask = 0700 store dos attributes = Yes browseable = No csc policy = disable root preexec =

In Samba/NT i was used to share mapping done in netlogon script, so users move around between sites, get home and profile from remote location but still have share mapped from local servers. In Samba/AD, using GPO, share mapping is in ''user policy'', and so user roam between sites and get different policies? I'm googling around but i'm a bit confused... i can still use