[SCM] Samba Shared Repository - branch master updated
Andrew Bartlett
abartlet at samba.org
Tue Sep 25 00:28:02 MDT 2012
The branch, master has been updated
via 1c1ae6d docs: Change TOSHARG-VFS to avoid suggesting VFS modules are Linux/IRIX only
via a92d95b docs: Remove mention of auth methods in TOSHARG-Passdb
via 39b1ce1 docs: Fix typo in TOSHARG-Passdb
via e3f554a docs: Remove Win9X/WinMe mentions from TOSHARG-PDC
via f82affa docs: Add mention of AD DC support in TOSHARG-PDC
via 6fcb95b docs: Explain the no-domain-logons restriction applies to all HOME editions
via 3be323c docs: Remove references to default paramters in TOSHARG-PDC
via f3ab050 docs: Update TOSHARG-Install
via c4f143f client: Fix talloc_stackframe() free order assertion in developer mode
from 6749cfb replace: Avoid returning value in void setproctitle() replacement.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 1c1ae6d639364533c4b23cb71c471d0d46bfff36
Author: Andrew Bartlett <abartlet at samba.org>
Date: Tue Sep 25 11:05:37 2012 +1000
docs: Change TOSHARG-VFS to avoid suggesting VFS modules are Linux/IRIX only
Autobuild-User(master): Andrew Bartlett <abartlet at samba.org>
Autobuild-Date(master): Tue Sep 25 08:27:15 CEST 2012 on sn-devel-104
commit a92d95b1773cb024349a0a06432b685d69d59976
Author: Andrew Bartlett <abartlet at samba.org>
Date: Tue Sep 25 11:05:01 2012 +1000
docs: Remove mention of auth methods in TOSHARG-Passdb
This is not connected to the passdb system, and we should not encourage setting of auth methods
in any case.
Andrew Bartlett
commit 39b1ce102d4d8bca472ae96966e2afab83e8f1c0
Author: Andrew Bartlett <abartlet at samba.org>
Date: Tue Sep 25 11:04:14 2012 +1000
docs: Fix typo in TOSHARG-Passdb
commit e3f554a99f3871eabac35db1ba3236772ef58f64
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Sep 23 04:55:20 2012 +1000
docs: Remove Win9X/WinMe mentions from TOSHARG-PDC
commit f82affaa6defef52696f69f114143cfb80fee241
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Sep 23 04:54:24 2012 +1000
docs: Add mention of AD DC support in TOSHARG-PDC
commit 6fcb95bad7db8f970ae6c74f1fdd7b4c2a41f25c
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Sep 23 04:53:55 2012 +1000
docs: Explain the no-domain-logons restriction applies to all HOME editions
commit 3be323c6110f1a241f86aacb94c8ff1ba69351c5
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Sep 23 04:52:56 2012 +1000
docs: Remove references to default paramters in TOSHARG-PDC
commit f3ab05003ea94ba2717b544d912ec3e15fb629d5
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sun Sep 23 03:09:32 2012 +1000
docs: Update TOSHARG-Install
- winbindd runs as many processes now
- open_oplock_ipc errors do not happen any more, we do not use UDP messaging any more.
Andrew Bartlett
commit c4f143f9d7a1502712d8a6b1c872a13632a5cff3
Author: Andrew Bartlett <abartlet at samba.org>
Date: Tue Sep 25 10:41:05 2012 +1000
client: Fix talloc_stackframe() free order assertion in developer mode
Reported-by: Ricky Nance <ricky.nance at weaubleau.k12.mo.us>
-----------------------------------------------------------------------
Summary of changes:
docs-xml/Samba3-HOWTO/TOSHARG-Install.xml | 20 +--
docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml | 386 ++++++-----------------------
docs-xml/Samba3-HOWTO/TOSHARG-Passdb.xml | 14 +-
docs-xml/Samba3-HOWTO/TOSHARG-VFS.xml | 3 +-
source3/client/client.c | 1 +
5 files changed, 76 insertions(+), 348 deletions(-)
Changeset truncated at 500 lines:
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-Install.xml b/docs-xml/Samba3-HOWTO/TOSHARG-Install.xml
index 673ba93..88e0ed8 100644
--- a/docs-xml/Samba3-HOWTO/TOSHARG-Install.xml
+++ b/docs-xml/Samba3-HOWTO/TOSHARG-Install.xml
@@ -657,24 +657,8 @@ The following questions and issues are raised repeatedly on the Samba mailing li
</para>
<para>
- &winbindd; will run as one or two daemons, depending on whether or not it is being
- run in <emphasis>split mode</emphasis> (in which case there will be two instances).
- </para>
-
- </sect2>
-
- <sect2>
- <title>Error Message: open_oplock_ipc</title>
-
- <para>
- An error message is observed in the log files when &smbd; is started: <quote>open_oplock_ipc: Failed to
- get local UDP socket for address 100007f. Error was Cannot assign requested.</quote>
- </para>
-
- <para>
- Your loopback device isn't working correctly. Make sure it is configured correctly. The loopback
- device is an internal (virtual) network device with the IP address <emphasis>127.0.0.1</emphasis>.
- Read your OS documentation for details on how to configure the loopback on your system.
+ &winbindd; will run as many processes depending in part on how many
+ domains it needs to contact.
</para>
</sect2>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml b/docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml
index a2461b7..0698ced 100644
--- a/docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml
+++ b/docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml
@@ -144,15 +144,17 @@ account). Refer to <link linkend="domain-member">Domain Membership</link> for mo
</para></note>
<para>
-The following functionalities are new to the Samba-3 release:
+The following functionalities are an overview of some of the features
+in the Samba-4 release:
</para>
<itemizedlist>
<listitem><para>
<indexterm><primary>account</primary><secondary>backend</secondary></indexterm>
- Samba-3 supports the use of a choice of backends that may be used in which user, group and machine
- accounts may be stored. Multiple passwd backends can be used in combination, either as additive backend
- data sets, or as fail-over data sets.
+ Samba-4 supports the use of a choice of backends that may be used in which user, group and machine
+ accounts may be stored, but only when acting as a classic
+ (NT4) domain controller,
+ but not when it is acting as an Active Directory Domain Controller.
</para>
<para>
@@ -162,16 +164,20 @@ The following functionalities are new to the Samba-3 release:
<indexterm><primary>scalability</primary></indexterm>
<indexterm><primary>reliability</primary></indexterm>
An LDAP passdb backend confers the benefit that the account backend can be distributed and replicated,
- which is of great value because it confers scalability and provides a high degree of reliability.
+ which is of great value because it confers scalability and
+ provides a high degree of reliability. This may be used when
+ Samba-4 is acting as an classic (NT4-like) domain controller,
+ but not when it is acting as an Active Directory Domain Controller.
</para></listitem>
<listitem><para>
<indexterm><primary>interdomain</primary><secondary>trust</secondary><tertiary>account</tertiary></indexterm>
<indexterm><primary>trust account</primary><secondary>interdomain</secondary></indexterm>
<indexterm><primary>interoperability</primary></indexterm>
- Windows NT4 domain trusts. Samba-3 supports workstation and server (machine) trust accounts. It also
+ Windows NT4 domain trusts. Samba-4 supports workstation and server (machine) trust accounts. It also
supports Windows NT4 style interdomain trust accounts, which further assists in network scalability
- and interoperability.
+ and interoperability, but only when itself is an classic
+ (NT4-like) domain controller.
</para></listitem>
<listitem><para>
@@ -182,7 +188,8 @@ The following functionalities are new to the Samba-3 release:
<indexterm><primary>domain</primary><secondary>controller</secondary></indexterm>
<indexterm><primary>network</primary><secondary>browsing</secondary></indexterm>
Operation without NetBIOS over TCP/IP, rather using the raw SMB over TCP/IP. Note, this is feasible
- only when operating as a Microsoft active directory domain member server. When acting as a Samba domain
+ only when operating as a Microsoft active directory domain
+ member server. When acting as a Samba classic (NT4-like) domain
controller the use of NetBIOS is necessary to provide network browsing support.
</para></listitem>
@@ -190,26 +197,34 @@ The following functionalities are new to the Samba-3 release:
<indexterm><primary>WINS</primary></indexterm>
<indexterm><primary>TCP port</primary></indexterm>
<indexterm><primary>session services</primary></indexterm>
- Samba-3 provides NetBIOS name services (WINS), NetBIOS over TCP/IP (TCP port 139) session services, SMB over
+ Samba-4 provides NetBIOS name services (WINS), NetBIOS over TCP/IP (TCP port 139) session services, SMB over
TCP/IP (TCP port 445) session services, and Microsoft compatible ONC DCE RPC services (TCP port 135)
services.
</para></listitem>
+
<listitem><para>
- <indexterm><primary>Nexus.exe</primary></indexterm>
- Management of users and groups via the User Manager for Domains. This can be done on any MS Windows client
- using the <filename>Nexus.exe</filename> toolkit for Windows 9x/Me, or using the SRVTOOLS.EXE package for MS
- Windows NT4/200x/XP platforms. These packages are available from Microsoft's Web site.
+ <indexterm><primary>kerberos</primary></indexterm>
+ <indexterm><primary>active directory</primary></indexterm>
+ Acting as a Windows 2000 active directory domain controller
+ (i.e., Kerberos and Active Directory).
</para></listitem>
<listitem><para>
- Implements full Unicode support. This simplifies cross-locale internationalization support. It also opens up
- the use of protocols that Samba-2.2.x had but could not use due to the need to fully support Unicode.
+ <indexterm><primary>MMC</primary></indexterm>
+ <indexterm><primary>SVRTOOLS.EXE</primary></indexterm>
+ <indexterm><primary>Microsoft management console</primary><see>MMC</see></indexterm>
+ The Windows 200x/XP Microsoft Management Console (MMC) can be
+ used to manage a Samba-4 server, when it is an Active
+ Directory Domain Controller. When acting as a classic (NT4)
+ domain controller, you
+ can use only the MS Windows NT4 Domain Server Manager and the MS Windows NT4 Domain User Manager. Both are
+ part of the SVRTOOLS.EXE package mentioned later.
</para></listitem>
</itemizedlist>
<para>
-The following functionalities are not provided by Samba-3:
+The following functionalities are not provided by Samba-4:
</para>
<itemizedlist>
@@ -217,40 +232,13 @@ The following functionalities are not provided by Samba-3:
<indexterm><primary>SAM</primary></indexterm>
<indexterm><primary>replication</primary></indexterm>
SAM replication with Windows NT4 domain controllers (i.e., a Samba PDC and a Windows NT BDC, or vice versa).
- This means Samba cannot operate as a BDC when the PDC is Microsoft-based Windows NT PDC. Samba-3 can not
+ This means Samba cannot operate as a BDC when the PDC is Microsoft-based Windows NT PDC. Samba-4 can not
participate in replication of account data to Windows PDCs and BDCs.
</para></listitem>
- <listitem><para>
- <indexterm><primary>kerberos</primary></indexterm>
- <indexterm><primary>active directory</primary></indexterm>
- Acting as a Windows 2000 active directory domain controller (i.e., Kerberos and Active Directory). In point of
- fact, Samba-3 does have some Active Directory domain control ability that is at this time purely experimental.
- Active directory domain control is one of the features that is being developed in Samba-4, the next
- generation Samba release. At this time there are no plans to enable active directory domain control
- support during the Samba-3 series life-cycle.
- </para></listitem>
-
- <listitem><para>
- <indexterm><primary>MMC</primary></indexterm>
- <indexterm><primary>SVRTOOLS.EXE</primary></indexterm>
- <indexterm><primary>Microsoft management console</primary><see>MMC</see></indexterm>
- The Windows 200x/XP Microsoft Management Console (MMC) cannot be used to manage a Samba-3 server. For this you
- can use only the MS Windows NT4 Domain Server Manager and the MS Windows NT4 Domain User Manager. Both are
- part of the SVRTOOLS.EXE package mentioned later.
- </para></listitem>
</itemizedlist>
<para>
-<indexterm><primary>Windows XP Home edition</primary></indexterm>
-<indexterm><primary>LanMan</primary></indexterm>
-Windows 9x/Me/XP Home clients are not true members of a domain for reasons outlined in this chapter. The
-protocol for support of Windows 9x/Me-style network (domain) logons is completely different from NT4/Windows
-200x-type domain logons and has been officially supported for some time. These clients use the old LanMan
-network logon facilities that are supported in Samba since approximately the Samba-1.9.15 series.
-</para>
-
-<para>
<indexterm><primary>group</primary><secondary>mapping</secondary></indexterm>
Samba-3 implements group mapping between Windows NT groups and UNIX groups (this is really quite complicated
to explain in a short space). This is discussed more fully in <link linkend="groupmapping">Group Mapping: MS
@@ -261,10 +249,9 @@ Windows and UNIX</link>.
<indexterm><primary>machine trust account</primary></indexterm>
<indexterm><primary>trust account</primary><secondary>machine</secondary></indexterm>
<indexterm><primary>machine account</primary></indexterm>
-Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store user and Machine Trust
+Samba-4, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store user and Machine Trust
Account information in a suitable backend data-store. Refer to <link linkend="machine-trust-accounts">MS
-Windows Workstation/Server Machine Trust Accounts</link>. With Samba-3 there can be multiple backends for
-this. A complete discussion of account database backends can be found in <link linkend="passdb">Account
+Windows Workstation/Server Machine Trust Accounts</link>. A complete discussion of account database backends can be found in <link linkend="passdb">Account
Information Databases</link>.
</para>
@@ -433,7 +420,9 @@ user and group identity information can be distributed makes it an an unavoidabl
<indexterm><primary>BDC</primary></indexterm>
<indexterm><primary>LDAP</primary></indexterm>
<indexterm><primary>e-Directory</primary></indexterm>
-At this time, the use of Samba based BDCs, necessitates the use of LDAP. The most commonly used LDAP
+At this time, the use of Samba based BDCs, necessitates the use of
+either the Samba-4 Active Directory Domain controller or, for classic
+(NT4-like)domains an LDAP backend. The most commonly used LDAP
implementation used by Samba sites is OpenLDAP. It is possible to use any standards compliant LDAP server.
Those known to work includes those manufactured by: IBM, CA, Novell (e-Directory), and others.
</para>
@@ -476,30 +465,26 @@ dictates that the entire infrastructure needs to be balanced. It is advisable to
<indexterm><primary>BDC</primary></indexterm>
<indexterm><primary>authenticatior</primary></indexterm>
<indexterm><primary>synchronization</primary></indexterm>
+<indexterm><primary>FSMO</primary></indexterm>
+<indexterm><primary>Flexible Single Master Operator</primary><see>FSMO</see></indexterm>
<indexterm><primary>Security Account Manager</primary><see>SAM</see></indexterm>
In the case of MS Windows NT4-style domains, it is the PDC that initiates a new domain control database.
This forms a part of the Windows registry called the Security Account Manager (SAM). It plays a key
part in NT4-type domain user authentication and in synchronization of the domain authentication
-database with BDCs.
-</para>
-
-<para>
-<indexterm><primary>domain</primary><secondary>controller</secondary><tertiary>hierarchy</tertiary></indexterm>
-<indexterm><primary>LDAP</primary></indexterm>
-<indexterm><primary>account</primary><secondary>backend</secondary></indexterm>
-<indexterm><primary>machine account</primary></indexterm>
-With MS Windows 200x Server-based Active Directory domains, one domain controller initiates a potential
-hierarchy of domain controllers, each with its own area of delegated control. The master domain
-controller has the ability to override any downstream controller, but a downline controller has
-control only over its downline. With Samba-3, this functionality can be implemented using an
-LDAP-based user and machine account backend.
+database with BDCs. With Active Directory domains, while some servers
+may be a Flexible Single Master Operator (FSMO) role owner (and
+therefore hold the monopoly for certain operations), it is in general
+a distributed, multi-master replicated directory.
</para>
<para>
<indexterm><primary>backend database</primary></indexterm>
<indexterm><primary>registry</primary></indexterm>
-New to Samba-3 is the ability to use a backend database that holds the same type of data as the NT4-style SAM
-database (one of the registry files)<footnote><para>See also <link linkend="passdb">Account Information
+Samba-4 can use a backend database that holds the same type of data as the NT4-style SAM
+database (one of the registry files). For BDC/BDC operations in a
+classic domain, this functionality can be implemented using an
+LDAP-based user and machine account backend. The Samba-4 Active
+Directory Domain controller implements the required storage internally.<footnote><para>See also <link linkend="passdb">Account Information
Databases</link>.</para></footnote>
</para>
@@ -547,13 +532,6 @@ time choices offered are:
has its own authentication database, and plays no role in domain security.</para></listitem>
</itemizedlist>
-<note><para>
-<indexterm><primary>promote</primary></indexterm>
-Algin Technology LLC provide a commercial tool that makes it possible to promote a Windows NT4 standalone
-server to a PDC or a BDC, and also permits this process to be reversed. Refer to the <ulink
-url="http://utools.com/UPromote.asp">Algin</ulink> web site for further information.
-</para></note>
-
<para>
<indexterm><primary>domain</primary><secondary>control</secondary><tertiary>role</tertiary></indexterm>
<indexterm><primary>native member</primary></indexterm>
@@ -577,26 +555,6 @@ excluding the SAM replication components. However, please be aware that Samba-3
MS Windows 200x domain control protocols.
</para>
-<para>
-<indexterm><primary>ADS</primary></indexterm>
-At this time any appearance that Samba-3 is capable of acting as a <emphasis>domain controller</emphasis> in
-native ADS mode is limited and experimental in nature. This functionality should not be used until the Samba
-Team offers formal support for it. At such a time, the documentation will be revised to duly reflect all
-configuration and management requirements. Samba can act as a NT4-style domain controller in a Windows 2000/XP
-environment. However, there are certain compromises:
-</para>
-
-<itemizedlist>
- <listitem><para>No machine policy files.</para></listitem>
- <listitem><para>No Group Policy Objects.</para></listitem>
- <listitem><para>No synchronously executed Active Directory logon scripts.</para></listitem>
- <listitem><para>Can't use Active Directory management tools to manage users and machines.</para></listitem>
- <listitem><para>Registry changes tattoo the main registry, while with Active Directory they do not leave
- permanent changes in effect.</para></listitem>
- <listitem><para>Without Active Directory you cannot perform the function of exporting specific
- applications to specific users or groups.</para></listitem>
-</itemizedlist>
-
</sect2>
<sect2>
@@ -662,24 +620,6 @@ NT4/200x/XP clients:
<listitem><para>Configuring MS Windows NT4/2000 Professional and Windows XP Professional client machines to become domain members.</para></listitem>
</itemizedlist>
-<para>
-The following provisions are required to serve MS Windows 9x/Me clients:
-</para>
-
-<itemizedlist>
- <listitem><para>Configuration of basic TCP/IP and MS Windows networking.</para></listitem>
- <listitem><para>Correct designation of the server role (<smbconfoption name="security">user</smbconfoption>).</para></listitem>
- <listitem><para>Network logon configuration (since Windows 9x/Me/XP Home are not technically domain
- members, they do not really participate in the security aspects of Domain logons as such).</para></listitem>
- <listitem><para>Roaming profile configuration.</para></listitem>
- <listitem><para>Configuration of system policy handling.</para></listitem>
- <listitem><para>Installation of the network driver <quote>Client for MS Windows Networks</quote> and configuration
- to log onto the domain.</para></listitem>
- <listitem><para>Placing Windows 9x/Me clients in user-level security &smbmdash; if it is desired to allow
- all client-share access to be controlled according to domain user/group identities.</para></listitem>
- <listitem><para>Adding and managing domain user accounts.</para></listitem>
-</itemizedlist>
-
<note><para>
<indexterm><primary>roaming profiles</primary></indexterm>
<indexterm><primary>account policies</primary></indexterm>
@@ -754,10 +694,6 @@ smb.conf file for an example PDC</link>.
<smbconfoption name="netbios name"><replaceable>BELERIAND</replaceable></smbconfoption>
<smbconfoption name="workgroup"><replaceable>&example.workgroup;</replaceable></smbconfoption>
<smbconfoption name="passdb backend">tdbsam</smbconfoption>
-<smbconfoption name="os level">33</smbconfoption>
-<smbconfoption name="preferred master">auto</smbconfoption>
-<smbconfoption name="domain master">yes</smbconfoption>
-<smbconfoption name="local master">yes</smbconfoption>
<smbconfoption name="security">user</smbconfoption>
<smbconfoption name="domain logons">yes</smbconfoption>
<smbconfoption name="logon path">\\%N\profiles\%U</smbconfoption>
@@ -809,24 +745,12 @@ The basic options shown in <link linkend="pdc-example">this example</link> are e
<varlistentry><term>Domain Control Parameters </term>
<listitem><para>
- <indexterm><primary>os level</primary></indexterm>
- <indexterm><primary>preferred master</primary></indexterm>
- <indexterm><primary>domain master</primary></indexterm>
<indexterm><primary>network</primary><secondary>logon</secondary></indexterm>
- The parameters <emphasis>os level, preferred master, domain master, security,
- encrypt passwords</emphasis>, and <emphasis>domain logons</emphasis> play a central role in assuring domain
+ The parameters <emphasis>domain logons</emphasis>
+ parameter is the key parameter indicating domain
control and network logon support.
</para>
- <para>
- <indexterm><primary>DMB</primary></indexterm>
- <indexterm><primary>encryped password</primary></indexterm>
- The <emphasis>os level</emphasis> must be set at or above a value of 32. A domain controller
- must be the DMB, must be set in <emphasis>user</emphasis> mode security,
- must support Microsoft-compatible encrypted passwords, and must provide the network logon
- service (domain logons). Encrypted passwords must be enabled. For more details on how
- to do this, refer to <link linkend="passdb">Account Information Databases</link>.
- </para></listitem>
</varlistentry>
<varlistentry><term>Environment Parameters </term>
@@ -883,7 +807,6 @@ of operation. The following &smb.conf; parameters are the essentials alone:
<smbconfoption name="netbios name">BELERIAND</smbconfoption>
<smbconfoption name="workgroup">&example.workgroup;</smbconfoption>
<smbconfoption name="domain logons">Yes</smbconfoption>
-<smbconfoption name="domain master">Yes</smbconfoption>
<smbconfoption name="security">User</smbconfoption>
</smbconfblock>
</para>
@@ -900,23 +823,21 @@ a more complete explanation.
<para>
<indexterm><primary>active directory</primary></indexterm>
-Samba-3 is not, and cannot act as, an Active Directory server. It cannot truly function as an Active Directory
-PDC. The protocols for some of the functionality of Active Directory domain controllers has been partially
-implemented on an experimental only basis. Please do not expect Samba-3 to support these protocols. Do not
-depend on any such functionality either now or in the future. The Samba Team may remove these experimental
-features or may change their behavior. This is mentioned for the benefit of those who have discovered secret
-capabilities in Samba-3 and who have asked when this functionality will be completed. The answer is maybe
-someday or maybe never!
+Samba-4 is also available as an Active Directory server. It can truly function as an Active Directory
+PDC. The protocols for some of the functionality of Active Directory
+domain controllers has been implemented.
</para>
<para>
<indexterm><primary>domain controllers</primary></indexterm>
<indexterm><primary>active directory</primary></indexterm>
-To be sure, Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4-style
-domain controllers have. Samba-3 does not have all the capabilities of Windows NT4, but it does have
-a number of features that Windows NT4 domain controllers do not have. In short, Samba-3 is not NT4 and it
-is not Windows Server 200x: it is not an Active Directory server. We hope this is plain and simple
-enough for all to understand.
+<indexterm><primary>classic domain support</primary></indexterm>
+To be sure, Samba-4 is also designed to provide most of the functionality that Microsoft Windows NT4-style
+domain controllers have. Samba-4 does not have all the capabilities of Windows NT4, but it does have
+a number of features that Windows NT4 domain controllers do not
+have. We call it a <emphasis>classic domain</emphasis> controller for
+this reason, as in short, Samba-4 when acting in this mode is not NT4,
+and the Active Directory Domain Control aspect is a distinct capability.
</para>
</sect1>
@@ -936,7 +857,8 @@ an integral part of the essential functionality that is provided by a domain con
<para>
<indexterm><primary>domain logon</primary></indexterm>
All domain controllers must run the netlogon service (<emphasis>domain logons</emphasis>
-in Samba). One domain controller must be configured with <smbconfoption name="domain master">Yes</smbconfoption>
+in Samba). One domain controller must be configured without the
+<smbconfoption name="domain master"></smbconfoption> parameter
(the PDC); on all BDCs set the parameter <smbconfoption name="domain master">No</smbconfoption>.
</para>
@@ -948,7 +870,7 @@ in Samba). One domain controller must be configured with <smbconfoption name="do
<smbconfblock>
<smbconfsection name="[global]"/>
<smbconfoption name="domain logons">Yes</smbconfoption>
-<smbconfoption name="domain master">(Yes on PDC, No on BDCs)</smbconfoption>
+<smbconfoption name="domain master">(omit on PDC, No on BDCs)</smbconfoption>
<smbconfsection name="[netlogon]"/>
<smbconfoption name="comment">Network Logon Service</smbconfoption>
@@ -960,20 +882,20 @@ in Samba). One domain controller must be configured with <smbconfoption name="do
</sect3>
<sect3>
-<title>The Special Case of MS Windows XP Home Edition</title>
+<title>The Special Case of MS Windows Home Editions</title>
<para>
-<indexterm><primary>Windows XP Home edition</primary></indexterm>
-To be completely clear: If you want MS Windows XP Home Edition to integrate with your
+<indexterm><primary>Windows Home editions</primary></indexterm>
+To be completely clear: If you want MS Windows Home Editions to integrate with your
MS Windows NT4 or Active Directory domain security, understand it cannot be done.
-The only option is to purchase the upgrade from MS Windows XP Home Edition to
-MS Windows XP Professional.
+The only option is to purchase the upgrade from MS Windows Home Edition to
+a MS Windows Professional edition.
</para>
<note><para>
-MS Windows XP Home Edition does not have the ability to join any type of domain
-security facility. Unlike MS Windows 9x/Me, MS Windows XP Home Edition also completely
-lacks the ability to log onto a network.
+MS Windows Home Editions do not have the ability to join any type of domain
+security facility. Unlike MS Windows 9x/Me, MS Windows Home Edition
+deliberatly lacks the ability to log onto a network.
</para></note>
<para>
@@ -985,172 +907,6 @@ Microsoft, and we recommend that you do not do that.
</sect3>
-<sect3>
-<title>The Special Case of Windows 9x/Me</title>
-
-<para>
-<indexterm><primary>domain</primary></indexterm>
-<indexterm><primary>workgroup</primary></indexterm>
-<indexterm><primary>authentication</primary></indexterm>
-<indexterm><primary>browsing</primary></indexterm>
-<indexterm><primary>rights</primary></indexterm>
-A domain and a workgroup are exactly the same in terms of network
-browsing. The difference is that a distributable authentication
-database is associated with a domain, for secure login access to a
-network. Also, different access rights can be granted to users if they
-successfully authenticate against a domain logon server. Samba-3 does this
-now in the same way as MS Windows NT/200x.
-</para>
-
-<para>
-<indexterm><primary>browsing</primary></indexterm>
-The SMB client logging on to a domain has an expectation that every other
-server in the domain should accept the same authentication information.
-Network browsing functionality of domains and workgroups is identical and
-is explained in this documentation under the browsing discussions.
-It should be noted that browsing is totally orthogonal to logon support.
-</para>
-
-<para>
-<indexterm><primary>single-logon</primary></indexterm>
-<indexterm><primary>domain logons</primary></indexterm>
-<indexterm><primary>network logon</primary></indexterm>
-Issues related to the single-logon network model are discussed in this
-section. Samba supports domain logons, network logon scripts, and user
-profiles for MS Windows for Workgroups and MS Windows 9x/Me clients,
-which are the focus of this section.
-</para>
-
-<para>
-<indexterm><primary>broadcast request</primary></indexterm>
-When an SMB client in a domain wishes to log on, it broadcasts requests for a logon server. The first one to
-reply gets the job and validates its password using whatever mechanism the Samba administrator has installed.
-It is possible (but ill advised) to create a domain where the user database is not shared between servers;
-that is, they are effectively workgroup servers advertising themselves as participating in a domain. This
-demonstrates how authentication is quite different from but closely involved with domains.
-</para>
-
-<para>
-Using these features, you can make your clients verify their logon via
-the Samba server, make clients run a batch file when they log on to
-the network and download their preferences, desktop, and start menu.
-</para>
-
-<para><emphasis>
-MS Windows XP Home edition is not able to join a domain and does not permit the use of domain logons.
-</emphasis></para>
-
-<para>
-Before launching into the configuration instructions, it is worthwhile to look at how a Windows 9x/Me client
-performs a logon:
-</para>
-
--
Samba Shared Repository
More information about the samba-cvs
mailing list