Profiles/Policies: Beware the Registry Size

[Benjamin Kuit]

Disclaimer: This is not a problem or feature of Samba as a PDC, but is
of interest to people setting up domains.

A couple of weeks ago I asked samba-ntdom for help/information. I'm back
again to say that one of our NT people may have solved the problem and
this finding should be shared amoungst others.

The problem was that we had the strange phenomenon whereby a particular
profile would inhibit the inforcement of policy settings, eg the
'shut down' menu option would show, control panel was accessable, regedit
was able to be run etc, and it was unclear why a profile could disable
the effects of the policy.

The problem seems to fall to a registry size limit on the NT workstation,
which can be accessed by
Control Panel -> System -> Performance -> (Virt. Mem)Change

This brings up the Virtual Memory properties dialog box, and at the bottom
of it shows current and maximum registry sizes.

The problem was the maximum registry size was set to the same value as the
current registry size, so once the profile was loaded, there simply wasn't
any more room for the policy to be loaded into the registry, so the policies
dont take any effect, and because it doesn't give any warning messages for
not having enough room, it remains a mystery to most people.

This could be a source of alot of 'my policies dont work' type problems.

The moral of the story is: Check the maximum registry size.

Just trying to help =)

caio

Bj

+-------------------------------+--------------------------------------+
|      Benjamin (Bj) Kuit       |  Faculty of Mathematical             |
|      Systems Programmer       |          and Computing Sciences.     |
|      Phone: 02 9514 1841      |  University of Technology, Sydney    |
|      Mobile: 0412 182 972     |  bj at mcs.uts.edu.au                   |
+-------------------------------+--------------------------------------+