Profiles/Policies: Beware the Registry Size (fwd)

[Luke Kenneth Casson Leighton]

<a href="mailto:lkcl at samba.org" > Luke Kenneth Casson Leighton    </a>
<a href="http://cb1.com/~lkcl"  > Samba and Network Development   </a>
<a href="http://samba.org"      > Samba Web site                  </a>
<a href="http://www.iss.net"    > Internet Security Systems, Inc. </a>
<a href="http://mcp.com"        > Macmillan Technical Publishing  </a>
 
ISBN1578701503 DCE/RPC over SMB: Samba and Windows NT Domain Internals

---------- Forwarded message ----------
Date: Fri, 18 Feb 2000 09:32:25 PST
From: "Merchant, Gurdon E Jr <merchant at parc.xerox.com>"
    <merchant at parc.xerox.com>
To: 'Luke Kenneth Casson Leighton' <lkcl at SAMBA.ORG>
Cc: "Merchant, Gurdon E Jr <merchant at parc.xerox.com>" <merchant at parc.xerox.com>
Subject: RE: Profiles/Policies: Beware the Registry Size (fwd)

Yes.  It happens frequently.  The more apps you load the bigger the registry.  It will prevent a variety of things from happening such as the loading of Office, etc.  It's a common thing to check.


Gurdon E. Merchant, Jr.
Xerox Palo Alto Research Center
merchant at parc.xerox.com

-----Original Message-----
From: Luke Kenneth Casson Leighton [mailto:lkcl at SAMBA.ORG]
Sent: Friday, 18 February, 2000 08:49
To: NTBUGTRAQ at LISTSERV.NTBUGTRAQ.COM
Subject: Profiles/Policies: Beware the Registry Size (fwd)


does anyone know if this is a known problem on nt or not?  it's actually
not related to samba, it could happen in a pure nt-only environment.

<a href="mailto:lkcl at samba.org" > Luke Kenneth Casson Leighton    </a>
<a href="http://cb1.com/~lkcl"  > Samba and Network Development   </a>
<a href="http://samba.org"      > Samba Web site                  </a>
<a href="http://www.iss.net"    > Internet Security Systems, Inc. </a>
<a href="http://mcp.com"        > Macmillan Technical Publishing  </a>

ISBN1578701503 DCE/RPC over SMB: Samba and Windows NT Domain Internals

---------- Forwarded message ----------
Date: Fri, 18 Feb 2000 10:49:53 +1100
From: Benjamin Kuit <bj at mcs.uts.edu.au>
To: Multiple recipients of list SAMBA-NTDOM <samba-ntdom at samba.org>
Subject: Profiles/Policies: Beware the Registry Size


Disclaimer: This is not a problem or feature of Samba as a PDC, but is
of interest to people setting up domains.

A couple of weeks ago I asked samba-ntdom for help/information. I'm back
again to say that one of our NT people may have solved the problem and
this finding should be shared amoungst others.

The problem was that we had the strange phenomenon whereby a particular
profile would inhibit the inforcement of policy settings, eg the
'shut down' menu option would show, control panel was accessable, regedit
was able to be run etc, and it was unclear why a profile could disable
the effects of the policy.

The problem seems to fall to a registry size limit on the NT workstation,
which can be accessed by
Control Panel -> System -> Performance -> (Virt. Mem)Change

This brings up the Virtual Memory properties dialog box, and at the bottom
of it shows current and maximum registry sizes.

The problem was the maximum registry size was set to the same value as the
current registry size, so once the profile was loaded, there simply wasn't
any more room for the policy to be loaded into the registry, so the policies
dont take any effect, and because it doesn't give any warning messages for
not having enough room, it remains a mystery to most people.

This could be a source of alot of 'my policies dont work' type problems.

The moral of the story is: Check the maximum registry size.

Just trying to help =)

caio

Bj

+-------------------------------+--------------------------------------+
|      Benjamin (Bj) Kuit       |  Faculty of Mathematical             |
|      Systems Programmer       |          and Computing Sciences.     |
|      Phone: 02 9514 1841      |  University of Technology, Sydney    |
|      Mobile: 0412 182 972     |  bj at mcs.uts.edu.au                   |
+-------------------------------+--------------------------------------+

------------------------------------------------------------------------
Delivery co-sponsored by Trend Micro, Inc.:

http://www.antivirus.com/neatsuite.htm

ScanMail for Microsoft Exchange
* Stops viruses from spreading through Exchange Servers.
* Eliminates viruses from email in real time, even unknown macro viruses
* Filters spam (unsolicited junk email).
* Sends customized virus warning messages to specific parties and admins
* Remote installation and management via web or ScanMail's Windows GUI
------------------------------------------------------------------------