[SCM] Samba Shared Repository - branch v4-0-test updated
Karolin Seeger
kseeger at samba.org
Thu Oct 4 04:42:03 MDT 2012
The branch, v4-0-test has been updated
via 42d2af9 Fix net rpc share allowedusers to work with 2008r2
via f480cc4 s3-docs: Fix opening and ending tag mismatch in Samba3-HOWTO (Bug #9235)
via f3e6072 docs: Remove Win9X/WinMe mentions from TOSHARG-PDC (cherry picked from commit e3f554a99f3871eabac35db1ba3236772ef58f64)
via 2fe3c52 docs: Add mention of AD DC support in TOSHARG-PDC (cherry picked from commit f82affaa6defef52696f69f114143cfb80fee241)
via 1e672c2 docs: Explain the no-domain-logons restriction applies to all HOME editions (cherry picked from commit 6fcb95bad7db8f970ae6c74f1fdd7b4c2a41f25c)
via eae9db6 docs: Remove references to default paramters in TOSHARG-PDC (cherry picked from commit 3be323c6110f1a241f86aacb94c8ff1ba69351c5)
from 1a0c013 s4 dns: Fix return code for deleted records
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v4-0-test
- Log -----------------------------------------------------------------
commit 42d2af97e1a106fc07ed65168652b533bacb9059
Author: Jeremy Allison <jra at samba.org>
Date: Thu Oct 4 10:56:12 2012 +0200
Fix net rpc share allowedusers to work with 2008r2
The RAP NetShareEnum command was removed in 2008r2, so use the RPC equivalent
instead.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=8966
Author: Jeremy Allison <jra at samba.org>
Autobuild-User(v4-0-test): Karolin Seeger <kseeger at samba.org>
Autobuild-Date(v4-0-test): Thu Oct 4 12:41:16 CEST 2012 on sn-devel-104
commit f480cc4b01daf59426a171729accc2bfcb5d4ae0
Author: Björn Baumbach <bb at sernet.de>
Date: Tue Oct 2 10:53:15 2012 +0200
s3-docs: Fix opening and ending tag mismatch in Samba3-HOWTO (Bug #9235)
Signed-off-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit f5a7bc26648e5edd2d0958c50a4432f14f5ce727)
The last 5 patches address bug #9235 - Opening and ending tag mismatch in
Samba3-HOWTO/TOSHARG-PDC.xml.
commit f3e6072de827a5badfde7bf1a0de0c88e58cf336
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Sep 23 04:55:20 2012 +1000
docs: Remove Win9X/WinMe mentions from TOSHARG-PDC
(cherry picked from commit e3f554a99f3871eabac35db1ba3236772ef58f64)
commit 2fe3c5270eb78f4f5e61bea7799bcdd214f8da8f
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Sep 23 04:54:24 2012 +1000
docs: Add mention of AD DC support in TOSHARG-PDC
(cherry picked from commit f82affaa6defef52696f69f114143cfb80fee241)
commit 1e672c2e6de31111c858f606858344f6bd9e6938
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Sep 23 04:53:55 2012 +1000
docs: Explain the no-domain-logons restriction applies to all HOME editions
(cherry picked from commit 6fcb95bad7db8f970ae6c74f1fdd7b4c2a41f25c)
commit eae9db624a69ba77c5f0ea046ec1a7ec72aabfae
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Sep 23 04:52:56 2012 +1000
docs: Remove references to default paramters in TOSHARG-PDC
(cherry picked from commit 3be323c6110f1a241f86aacb94c8ff1ba69351c5)
-----------------------------------------------------------------------
Summary of changes:
docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml | 387 ++++++---------------------------
source3/utils/net_rpc.c | 81 ++++---
2 files changed, 115 insertions(+), 353 deletions(-)
Changeset truncated at 500 lines:
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml b/docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml
index a2461b7..f2f3a30 100644
--- a/docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml
+++ b/docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml
@@ -144,15 +144,17 @@ account). Refer to <link linkend="domain-member">Domain Membership</link> for mo
</para></note>
<para>
-The following functionalities are new to the Samba-3 release:
+The following functionalities are an overview of some of the features
+in the Samba-4 release:
</para>
<itemizedlist>
<listitem><para>
<indexterm><primary>account</primary><secondary>backend</secondary></indexterm>
- Samba-3 supports the use of a choice of backends that may be used in which user, group and machine
- accounts may be stored. Multiple passwd backends can be used in combination, either as additive backend
- data sets, or as fail-over data sets.
+ Samba-4 supports the use of a choice of backends that may be used in which user, group and machine
+ accounts may be stored, but only when acting as a classic
+ (NT4) domain controller,
+ but not when it is acting as an Active Directory Domain Controller.
</para>
<para>
@@ -162,16 +164,20 @@ The following functionalities are new to the Samba-3 release:
<indexterm><primary>scalability</primary></indexterm>
<indexterm><primary>reliability</primary></indexterm>
An LDAP passdb backend confers the benefit that the account backend can be distributed and replicated,
- which is of great value because it confers scalability and provides a high degree of reliability.
+ which is of great value because it confers scalability and
+ provides a high degree of reliability. This may be used when
+ Samba-4 is acting as an classic (NT4-like) domain controller,
+ but not when it is acting as an Active Directory Domain Controller.
</para></listitem>
<listitem><para>
<indexterm><primary>interdomain</primary><secondary>trust</secondary><tertiary>account</tertiary></indexterm>
<indexterm><primary>trust account</primary><secondary>interdomain</secondary></indexterm>
<indexterm><primary>interoperability</primary></indexterm>
- Windows NT4 domain trusts. Samba-3 supports workstation and server (machine) trust accounts. It also
+ Windows NT4 domain trusts. Samba-4 supports workstation and server (machine) trust accounts. It also
supports Windows NT4 style interdomain trust accounts, which further assists in network scalability
- and interoperability.
+ and interoperability, but only when itself is an classic
+ (NT4-like) domain controller.
</para></listitem>
<listitem><para>
@@ -182,7 +188,8 @@ The following functionalities are new to the Samba-3 release:
<indexterm><primary>domain</primary><secondary>controller</secondary></indexterm>
<indexterm><primary>network</primary><secondary>browsing</secondary></indexterm>
Operation without NetBIOS over TCP/IP, rather using the raw SMB over TCP/IP. Note, this is feasible
- only when operating as a Microsoft active directory domain member server. When acting as a Samba domain
+ only when operating as a Microsoft active directory domain
+ member server. When acting as a Samba classic (NT4-like) domain
controller the use of NetBIOS is necessary to provide network browsing support.
</para></listitem>
@@ -190,26 +197,34 @@ The following functionalities are new to the Samba-3 release:
<indexterm><primary>WINS</primary></indexterm>
<indexterm><primary>TCP port</primary></indexterm>
<indexterm><primary>session services</primary></indexterm>
- Samba-3 provides NetBIOS name services (WINS), NetBIOS over TCP/IP (TCP port 139) session services, SMB over
+ Samba-4 provides NetBIOS name services (WINS), NetBIOS over TCP/IP (TCP port 139) session services, SMB over
TCP/IP (TCP port 445) session services, and Microsoft compatible ONC DCE RPC services (TCP port 135)
services.
</para></listitem>
+
<listitem><para>
- <indexterm><primary>Nexus.exe</primary></indexterm>
- Management of users and groups via the User Manager for Domains. This can be done on any MS Windows client
- using the <filename>Nexus.exe</filename> toolkit for Windows 9x/Me, or using the SRVTOOLS.EXE package for MS
- Windows NT4/200x/XP platforms. These packages are available from Microsoft's Web site.
+ <indexterm><primary>kerberos</primary></indexterm>
+ <indexterm><primary>active directory</primary></indexterm>
+ Acting as a Windows 2000 active directory domain controller
+ (i.e., Kerberos and Active Directory).
</para></listitem>
<listitem><para>
- Implements full Unicode support. This simplifies cross-locale internationalization support. It also opens up
- the use of protocols that Samba-2.2.x had but could not use due to the need to fully support Unicode.
+ <indexterm><primary>MMC</primary></indexterm>
+ <indexterm><primary>SVRTOOLS.EXE</primary></indexterm>
+ <indexterm><primary>Microsoft management console</primary><see>MMC</see></indexterm>
+ The Windows 200x/XP Microsoft Management Console (MMC) can be
+ used to manage a Samba-4 server, when it is an Active
+ Directory Domain Controller. When acting as a classic (NT4)
+ domain controller, you
+ can use only the MS Windows NT4 Domain Server Manager and the MS Windows NT4 Domain User Manager. Both are
+ part of the SVRTOOLS.EXE package mentioned later.
</para></listitem>
</itemizedlist>
<para>
-The following functionalities are not provided by Samba-3:
+The following functionalities are not provided by Samba-4:
</para>
<itemizedlist>
@@ -217,40 +232,13 @@ The following functionalities are not provided by Samba-3:
<indexterm><primary>SAM</primary></indexterm>
<indexterm><primary>replication</primary></indexterm>
SAM replication with Windows NT4 domain controllers (i.e., a Samba PDC and a Windows NT BDC, or vice versa).
- This means Samba cannot operate as a BDC when the PDC is Microsoft-based Windows NT PDC. Samba-3 can not
+ This means Samba cannot operate as a BDC when the PDC is Microsoft-based Windows NT PDC. Samba-4 can not
participate in replication of account data to Windows PDCs and BDCs.
</para></listitem>
- <listitem><para>
- <indexterm><primary>kerberos</primary></indexterm>
- <indexterm><primary>active directory</primary></indexterm>
- Acting as a Windows 2000 active directory domain controller (i.e., Kerberos and Active Directory). In point of
- fact, Samba-3 does have some Active Directory domain control ability that is at this time purely experimental.
- Active directory domain control is one of the features that is being developed in Samba-4, the next
- generation Samba release. At this time there are no plans to enable active directory domain control
- support during the Samba-3 series life-cycle.
- </para></listitem>
-
- <listitem><para>
- <indexterm><primary>MMC</primary></indexterm>
- <indexterm><primary>SVRTOOLS.EXE</primary></indexterm>
- <indexterm><primary>Microsoft management console</primary><see>MMC</see></indexterm>
- The Windows 200x/XP Microsoft Management Console (MMC) cannot be used to manage a Samba-3 server. For this you
- can use only the MS Windows NT4 Domain Server Manager and the MS Windows NT4 Domain User Manager. Both are
- part of the SVRTOOLS.EXE package mentioned later.
- </para></listitem>
</itemizedlist>
<para>
-<indexterm><primary>Windows XP Home edition</primary></indexterm>
-<indexterm><primary>LanMan</primary></indexterm>
-Windows 9x/Me/XP Home clients are not true members of a domain for reasons outlined in this chapter. The
-protocol for support of Windows 9x/Me-style network (domain) logons is completely different from NT4/Windows
-200x-type domain logons and has been officially supported for some time. These clients use the old LanMan
-network logon facilities that are supported in Samba since approximately the Samba-1.9.15 series.
-</para>
-
-<para>
<indexterm><primary>group</primary><secondary>mapping</secondary></indexterm>
Samba-3 implements group mapping between Windows NT groups and UNIX groups (this is really quite complicated
to explain in a short space). This is discussed more fully in <link linkend="groupmapping">Group Mapping: MS
@@ -261,10 +249,9 @@ Windows and UNIX</link>.
<indexterm><primary>machine trust account</primary></indexterm>
<indexterm><primary>trust account</primary><secondary>machine</secondary></indexterm>
<indexterm><primary>machine account</primary></indexterm>
-Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store user and Machine Trust
+Samba-4, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store user and Machine Trust
Account information in a suitable backend data-store. Refer to <link linkend="machine-trust-accounts">MS
-Windows Workstation/Server Machine Trust Accounts</link>. With Samba-3 there can be multiple backends for
-this. A complete discussion of account database backends can be found in <link linkend="passdb">Account
+Windows Workstation/Server Machine Trust Accounts</link>. A complete discussion of account database backends can be found in <link linkend="passdb">Account
Information Databases</link>.
</para>
@@ -433,7 +420,9 @@ user and group identity information can be distributed makes it an an unavoidabl
<indexterm><primary>BDC</primary></indexterm>
<indexterm><primary>LDAP</primary></indexterm>
<indexterm><primary>e-Directory</primary></indexterm>
-At this time, the use of Samba based BDCs, necessitates the use of LDAP. The most commonly used LDAP
+At this time, the use of Samba based BDCs, necessitates the use of
+either the Samba-4 Active Directory Domain controller or, for classic
+(NT4-like)domains an LDAP backend. The most commonly used LDAP
implementation used by Samba sites is OpenLDAP. It is possible to use any standards compliant LDAP server.
Those known to work includes those manufactured by: IBM, CA, Novell (e-Directory), and others.
</para>
@@ -476,30 +465,26 @@ dictates that the entire infrastructure needs to be balanced. It is advisable to
<indexterm><primary>BDC</primary></indexterm>
<indexterm><primary>authenticatior</primary></indexterm>
<indexterm><primary>synchronization</primary></indexterm>
+<indexterm><primary>FSMO</primary></indexterm>
+<indexterm><primary>Flexible Single Master Operator</primary><see>FSMO</see></indexterm>
<indexterm><primary>Security Account Manager</primary><see>SAM</see></indexterm>
In the case of MS Windows NT4-style domains, it is the PDC that initiates a new domain control database.
This forms a part of the Windows registry called the Security Account Manager (SAM). It plays a key
part in NT4-type domain user authentication and in synchronization of the domain authentication
-database with BDCs.
-</para>
-
-<para>
-<indexterm><primary>domain</primary><secondary>controller</secondary><tertiary>hierarchy</tertiary></indexterm>
-<indexterm><primary>LDAP</primary></indexterm>
-<indexterm><primary>account</primary><secondary>backend</secondary></indexterm>
-<indexterm><primary>machine account</primary></indexterm>
-With MS Windows 200x Server-based Active Directory domains, one domain controller initiates a potential
-hierarchy of domain controllers, each with its own area of delegated control. The master domain
-controller has the ability to override any downstream controller, but a downline controller has
-control only over its downline. With Samba-3, this functionality can be implemented using an
-LDAP-based user and machine account backend.
+database with BDCs. With Active Directory domains, while some servers
+may be a Flexible Single Master Operator (FSMO) role owner (and
+therefore hold the monopoly for certain operations), it is in general
+a distributed, multi-master replicated directory.
</para>
<para>
<indexterm><primary>backend database</primary></indexterm>
<indexterm><primary>registry</primary></indexterm>
-New to Samba-3 is the ability to use a backend database that holds the same type of data as the NT4-style SAM
-database (one of the registry files)<footnote><para>See also <link linkend="passdb">Account Information
+Samba-4 can use a backend database that holds the same type of data as the NT4-style SAM
+database (one of the registry files). For BDC/BDC operations in a
+classic domain, this functionality can be implemented using an
+LDAP-based user and machine account backend. The Samba-4 Active
+Directory Domain controller implements the required storage internally.<footnote><para>See also <link linkend="passdb">Account Information
Databases</link>.</para></footnote>
</para>
@@ -547,13 +532,6 @@ time choices offered are:
has its own authentication database, and plays no role in domain security.</para></listitem>
</itemizedlist>
-<note><para>
-<indexterm><primary>promote</primary></indexterm>
-Algin Technology LLC provide a commercial tool that makes it possible to promote a Windows NT4 standalone
-server to a PDC or a BDC, and also permits this process to be reversed. Refer to the <ulink
-url="http://utools.com/UPromote.asp">Algin</ulink> web site for further information.
-</para></note>
-
<para>
<indexterm><primary>domain</primary><secondary>control</secondary><tertiary>role</tertiary></indexterm>
<indexterm><primary>native member</primary></indexterm>
@@ -577,26 +555,6 @@ excluding the SAM replication components. However, please be aware that Samba-3
MS Windows 200x domain control protocols.
</para>
-<para>
-<indexterm><primary>ADS</primary></indexterm>
-At this time any appearance that Samba-3 is capable of acting as a <emphasis>domain controller</emphasis> in
-native ADS mode is limited and experimental in nature. This functionality should not be used until the Samba
-Team offers formal support for it. At such a time, the documentation will be revised to duly reflect all
-configuration and management requirements. Samba can act as a NT4-style domain controller in a Windows 2000/XP
-environment. However, there are certain compromises:
-</para>
-
-<itemizedlist>
- <listitem><para>No machine policy files.</para></listitem>
- <listitem><para>No Group Policy Objects.</para></listitem>
- <listitem><para>No synchronously executed Active Directory logon scripts.</para></listitem>
- <listitem><para>Can't use Active Directory management tools to manage users and machines.</para></listitem>
- <listitem><para>Registry changes tattoo the main registry, while with Active Directory they do not leave
- permanent changes in effect.</para></listitem>
- <listitem><para>Without Active Directory you cannot perform the function of exporting specific
- applications to specific users or groups.</para></listitem>
-</itemizedlist>
-
</sect2>
<sect2>
@@ -662,24 +620,6 @@ NT4/200x/XP clients:
<listitem><para>Configuring MS Windows NT4/2000 Professional and Windows XP Professional client machines to become domain members.</para></listitem>
</itemizedlist>
-<para>
-The following provisions are required to serve MS Windows 9x/Me clients:
-</para>
-
-<itemizedlist>
- <listitem><para>Configuration of basic TCP/IP and MS Windows networking.</para></listitem>
- <listitem><para>Correct designation of the server role (<smbconfoption name="security">user</smbconfoption>).</para></listitem>
- <listitem><para>Network logon configuration (since Windows 9x/Me/XP Home are not technically domain
- members, they do not really participate in the security aspects of Domain logons as such).</para></listitem>
- <listitem><para>Roaming profile configuration.</para></listitem>
- <listitem><para>Configuration of system policy handling.</para></listitem>
- <listitem><para>Installation of the network driver <quote>Client for MS Windows Networks</quote> and configuration
- to log onto the domain.</para></listitem>
- <listitem><para>Placing Windows 9x/Me clients in user-level security &smbmdash; if it is desired to allow
- all client-share access to be controlled according to domain user/group identities.</para></listitem>
- <listitem><para>Adding and managing domain user accounts.</para></listitem>
-</itemizedlist>
-
<note><para>
<indexterm><primary>roaming profiles</primary></indexterm>
<indexterm><primary>account policies</primary></indexterm>
@@ -754,10 +694,6 @@ smb.conf file for an example PDC</link>.
<smbconfoption name="netbios name"><replaceable>BELERIAND</replaceable></smbconfoption>
<smbconfoption name="workgroup"><replaceable>&example.workgroup;</replaceable></smbconfoption>
<smbconfoption name="passdb backend">tdbsam</smbconfoption>
-<smbconfoption name="os level">33</smbconfoption>
-<smbconfoption name="preferred master">auto</smbconfoption>
-<smbconfoption name="domain master">yes</smbconfoption>
-<smbconfoption name="local master">yes</smbconfoption>
<smbconfoption name="security">user</smbconfoption>
<smbconfoption name="domain logons">yes</smbconfoption>
<smbconfoption name="logon path">\\%N\profiles\%U</smbconfoption>
@@ -809,23 +745,10 @@ The basic options shown in <link linkend="pdc-example">this example</link> are e
<varlistentry><term>Domain Control Parameters </term>
<listitem><para>
- <indexterm><primary>os level</primary></indexterm>
- <indexterm><primary>preferred master</primary></indexterm>
- <indexterm><primary>domain master</primary></indexterm>
<indexterm><primary>network</primary><secondary>logon</secondary></indexterm>
- The parameters <emphasis>os level, preferred master, domain master, security,
- encrypt passwords</emphasis>, and <emphasis>domain logons</emphasis> play a central role in assuring domain
+ The parameters <emphasis>domain logons</emphasis>
+ parameter is the key parameter indicating domain
control and network logon support.
- </para>
-
- <para>
- <indexterm><primary>DMB</primary></indexterm>
- <indexterm><primary>encryped password</primary></indexterm>
- The <emphasis>os level</emphasis> must be set at or above a value of 32. A domain controller
- must be the DMB, must be set in <emphasis>user</emphasis> mode security,
- must support Microsoft-compatible encrypted passwords, and must provide the network logon
- service (domain logons). Encrypted passwords must be enabled. For more details on how
- to do this, refer to <link linkend="passdb">Account Information Databases</link>.
</para></listitem>
</varlistentry>
@@ -883,7 +806,6 @@ of operation. The following &smb.conf; parameters are the essentials alone:
<smbconfoption name="netbios name">BELERIAND</smbconfoption>
<smbconfoption name="workgroup">&example.workgroup;</smbconfoption>
<smbconfoption name="domain logons">Yes</smbconfoption>
-<smbconfoption name="domain master">Yes</smbconfoption>
<smbconfoption name="security">User</smbconfoption>
</smbconfblock>
</para>
@@ -900,23 +822,21 @@ a more complete explanation.
<para>
<indexterm><primary>active directory</primary></indexterm>
-Samba-3 is not, and cannot act as, an Active Directory server. It cannot truly function as an Active Directory
-PDC. The protocols for some of the functionality of Active Directory domain controllers has been partially
-implemented on an experimental only basis. Please do not expect Samba-3 to support these protocols. Do not
-depend on any such functionality either now or in the future. The Samba Team may remove these experimental
-features or may change their behavior. This is mentioned for the benefit of those who have discovered secret
-capabilities in Samba-3 and who have asked when this functionality will be completed. The answer is maybe
-someday or maybe never!
+Samba-4 is also available as an Active Directory server. It can truly function as an Active Directory
+PDC. The protocols for some of the functionality of Active Directory
+domain controllers has been implemented.
</para>
<para>
<indexterm><primary>domain controllers</primary></indexterm>
<indexterm><primary>active directory</primary></indexterm>
-To be sure, Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4-style
-domain controllers have. Samba-3 does not have all the capabilities of Windows NT4, but it does have
-a number of features that Windows NT4 domain controllers do not have. In short, Samba-3 is not NT4 and it
-is not Windows Server 200x: it is not an Active Directory server. We hope this is plain and simple
-enough for all to understand.
+<indexterm><primary>classic domain support</primary></indexterm>
+To be sure, Samba-4 is also designed to provide most of the functionality that Microsoft Windows NT4-style
+domain controllers have. Samba-4 does not have all the capabilities of Windows NT4, but it does have
+a number of features that Windows NT4 domain controllers do not
+have. We call it a <emphasis>classic domain</emphasis> controller for
+this reason, as in short, Samba-4 when acting in this mode is not NT4,
+and the Active Directory Domain Control aspect is a distinct capability.
</para>
</sect1>
@@ -936,7 +856,8 @@ an integral part of the essential functionality that is provided by a domain con
<para>
<indexterm><primary>domain logon</primary></indexterm>
All domain controllers must run the netlogon service (<emphasis>domain logons</emphasis>
-in Samba). One domain controller must be configured with <smbconfoption name="domain master">Yes</smbconfoption>
+in Samba). One domain controller must be configured without the
+<smbconfoption name="domain master"></smbconfoption> parameter
(the PDC); on all BDCs set the parameter <smbconfoption name="domain master">No</smbconfoption>.
</para>
@@ -948,7 +869,7 @@ in Samba). One domain controller must be configured with <smbconfoption name="do
<smbconfblock>
<smbconfsection name="[global]"/>
<smbconfoption name="domain logons">Yes</smbconfoption>
-<smbconfoption name="domain master">(Yes on PDC, No on BDCs)</smbconfoption>
+<smbconfoption name="domain master">(omit on PDC, No on BDCs)</smbconfoption>
<smbconfsection name="[netlogon]"/>
<smbconfoption name="comment">Network Logon Service</smbconfoption>
@@ -960,20 +881,20 @@ in Samba). One domain controller must be configured with <smbconfoption name="do
</sect3>
<sect3>
-<title>The Special Case of MS Windows XP Home Edition</title>
+<title>The Special Case of MS Windows Home Editions</title>
<para>
-<indexterm><primary>Windows XP Home edition</primary></indexterm>
-To be completely clear: If you want MS Windows XP Home Edition to integrate with your
+<indexterm><primary>Windows Home editions</primary></indexterm>
+To be completely clear: If you want MS Windows Home Editions to integrate with your
MS Windows NT4 or Active Directory domain security, understand it cannot be done.
-The only option is to purchase the upgrade from MS Windows XP Home Edition to
-MS Windows XP Professional.
+The only option is to purchase the upgrade from MS Windows Home Edition to
+a MS Windows Professional edition.
</para>
<note><para>
-MS Windows XP Home Edition does not have the ability to join any type of domain
-security facility. Unlike MS Windows 9x/Me, MS Windows XP Home Edition also completely
-lacks the ability to log onto a network.
+MS Windows Home Editions do not have the ability to join any type of domain
+security facility. Unlike MS Windows 9x/Me, MS Windows Home Edition
+deliberatly lacks the ability to log onto a network.
</para></note>
<para>
@@ -985,172 +906,6 @@ Microsoft, and we recommend that you do not do that.
</sect3>
-<sect3>
-<title>The Special Case of Windows 9x/Me</title>
-
-<para>
-<indexterm><primary>domain</primary></indexterm>
-<indexterm><primary>workgroup</primary></indexterm>
-<indexterm><primary>authentication</primary></indexterm>
-<indexterm><primary>browsing</primary></indexterm>
-<indexterm><primary>rights</primary></indexterm>
-A domain and a workgroup are exactly the same in terms of network
-browsing. The difference is that a distributable authentication
-database is associated with a domain, for secure login access to a
-network. Also, different access rights can be granted to users if they
-successfully authenticate against a domain logon server. Samba-3 does this
-now in the same way as MS Windows NT/200x.
-</para>
-
-<para>
-<indexterm><primary>browsing</primary></indexterm>
-The SMB client logging on to a domain has an expectation that every other
-server in the domain should accept the same authentication information.
-Network browsing functionality of domains and workgroups is identical and
-is explained in this documentation under the browsing discussions.
-It should be noted that browsing is totally orthogonal to logon support.
-</para>
-
-<para>
-<indexterm><primary>single-logon</primary></indexterm>
-<indexterm><primary>domain logons</primary></indexterm>
-<indexterm><primary>network logon</primary></indexterm>
-Issues related to the single-logon network model are discussed in this
-section. Samba supports domain logons, network logon scripts, and user
-profiles for MS Windows for Workgroups and MS Windows 9x/Me clients,
-which are the focus of this section.
-</para>
-
-<para>
-<indexterm><primary>broadcast request</primary></indexterm>
-When an SMB client in a domain wishes to log on, it broadcasts requests for a logon server. The first one to
-reply gets the job and validates its password using whatever mechanism the Samba administrator has installed.
-It is possible (but ill advised) to create a domain where the user database is not shared between servers;
-that is, they are effectively workgroup servers advertising themselves as participating in a domain. This
-demonstrates how authentication is quite different from but closely involved with domains.
-</para>
-
-<para>
-Using these features, you can make your clients verify their logon via
-the Samba server, make clients run a batch file when they log on to
-the network and download their preferences, desktop, and start menu.
-</para>
-
-<para><emphasis>
-MS Windows XP Home edition is not able to join a domain and does not permit the use of domain logons.
-</emphasis></para>
-
-<para>
-Before launching into the configuration instructions, it is worthwhile to look at how a Windows 9x/Me client
-performs a logon:
-</para>
-
-<orderedlist>
-<listitem>
- <para>
- <indexterm><primary>DOMAIN<1C></primary></indexterm>
- <indexterm><primary>logon server</primary></indexterm>
- The client broadcasts (to the IP broadcast address of the subnet it is in)
- a NetLogon request. This is sent to the NetBIOS name DOMAIN<1C> at the
- NetBIOS layer. The client chooses the first response it receives, which
- contains the NetBIOS name of the logon server to use in the format of
- <filename>\\SERVER</filename>. The <literal>1C</literal> name is the name
- type that is registered by domain controllers (SMB/CIFS servers that provide
- the netlogon service).
- </para>
-</listitem>
-
-<listitem>
- <para>
- <indexterm><primary>IPC$</primary></indexterm>
- <indexterm><primary>SMBsessetupX</primary></indexterm>
- <indexterm><primary>SMBtconX</primary></indexterm>
- The client connects to that server, logs on (does an SMBsessetupX) and
- then connects to the IPC$ share (using an SMBtconX).
- </para>
-</listitem>
-
-<listitem>
- <para>
- <indexterm><primary>NetWkstaUserLogon</primary></indexterm>
- The client does a NetWkstaUserLogon request, which retrieves the name
- of the user's logon script.
- </para>
-</listitem>
--
Samba Shared Repository
More information about the samba-cvs
mailing list