[PATCH 2/2] doc: remove outdate Samba3-HOWTO

Björn Jacke bj at sernet.de
Fri Jan 31 15:20:33 MST 2014


our users expect the documentation to be correct but this one is completely
outdated and it is less than helpful for people who look for help for recent
samba versions as we can see on the samba mailing list recently.

Signed-off-by: Bjoern Jacke <bj at sernet.de>
---
 docs-xml/Samba3-HOWTO/TOSHARG-AccessControls.xml   | 1710 -------
 .../Samba3-HOWTO/TOSHARG-AdvancedNetworkAdmin.xml  |  485 --
 docs-xml/Samba3-HOWTO/TOSHARG-BDC.xml              |  707 ---
 docs-xml/Samba3-HOWTO/TOSHARG-Backup.xml           |  241 -
 docs-xml/Samba3-HOWTO/TOSHARG-Bugs.xml             |  284 --
 docs-xml/Samba3-HOWTO/TOSHARG-CUPS-printing.xml    | 5173 --------------------
 docs-xml/Samba3-HOWTO/TOSHARG-ChangeNotes.xml      |  244 -
 docs-xml/Samba3-HOWTO/TOSHARG-Compiling.xml        |  356 --
 docs-xml/Samba3-HOWTO/TOSHARG-ConfigSmarts.xml     |  392 --
 .../TOSHARG-DNS-DHCP-Configuration.xml             |  346 --
 docs-xml/Samba3-HOWTO/TOSHARG-Diagnosis.xml        |  585 ---
 docs-xml/Samba3-HOWTO/TOSHARG-DomainMember.xml     | 1269 -----
 docs-xml/Samba3-HOWTO/TOSHARG-FastStart.xml        | 1298 -----
 .../Samba3-HOWTO/TOSHARG-Further-Resources.xml     |  174 -
 docs-xml/Samba3-HOWTO/TOSHARG-Group-Mapping.xml    |  920 ----
 docs-xml/Samba3-HOWTO/TOSHARG-IDMAP.xml            | 1122 -----
 docs-xml/Samba3-HOWTO/TOSHARG-Install.xml          |  687 ---
 .../TOSHARG-Integrating-with-Windows.xml           |  745 ---
 .../Samba3-HOWTO/TOSHARG-InterdomainTrusts.xml     |  602 ---
 docs-xml/Samba3-HOWTO/TOSHARG-IntroSMB.xml         |  224 -
 docs-xml/Samba3-HOWTO/TOSHARG-LargeFile.xml        |   89 -
 docs-xml/Samba3-HOWTO/TOSHARG-NT4Migration.xml     |  631 ---
 docs-xml/Samba3-HOWTO/TOSHARG-NetworkBrowsing.xml  | 2223 ---------
 docs-xml/Samba3-HOWTO/TOSHARG-PAM.xml              | 1013 ----
 docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml              | 1164 -----
 docs-xml/Samba3-HOWTO/TOSHARG-Passdb.xml           | 2610 ----------
 docs-xml/Samba3-HOWTO/TOSHARG-PolicyMgmt.xml       |  607 ---
 docs-xml/Samba3-HOWTO/TOSHARG-Printing.xml         | 3236 ------------
 docs-xml/Samba3-HOWTO/TOSHARG-Problems.xml         |  325 --
 docs-xml/Samba3-HOWTO/TOSHARG-ProfileMgmt.xml      | 1320 -----
 .../Samba3-HOWTO/TOSHARG-RightsAndPriviliges.xml   |  596 ---
 docs-xml/Samba3-HOWTO/TOSHARG-SWAT.xml             |  640 ---
 docs-xml/Samba3-HOWTO/TOSHARG-SecureLDAP.xml       |  405 --
 docs-xml/Samba3-HOWTO/TOSHARG-Securing.xml         |  448 --
 docs-xml/Samba3-HOWTO/TOSHARG-ServerType.xml       |  564 ---
 docs-xml/Samba3-HOWTO/TOSHARG-StandAloneServer.xml |  340 --
 docs-xml/Samba3-HOWTO/TOSHARG-Support.xml          |  163 -
 docs-xml/Samba3-HOWTO/TOSHARG-TDBFiles.xml         |  157 -
 docs-xml/Samba3-HOWTO/TOSHARG-TheNetCommand.xml    | 1916 --------
 docs-xml/Samba3-HOWTO/TOSHARG-Unicode.xml          |  571 ---
 docs-xml/Samba3-HOWTO/TOSHARG-VFS.xml              |  948 ----
 docs-xml/Samba3-HOWTO/TOSHARG-Winbind.xml          | 1475 ------
 .../Samba3-HOWTO/TOSHARG-WindowsClientConfig.xml   |  599 ---
 docs-xml/Samba3-HOWTO/TOSHARG-foreword-cargill.xml |   79 -
 docs-xml/Samba3-HOWTO/TOSHARG-foreword-tridge.xml  |   48 -
 docs-xml/Samba3-HOWTO/TOSHARG-glossary.xml         |  254 -
 docs-xml/Samba3-HOWTO/TOSHARG-inside-cover.xml     |   43 -
 docs-xml/Samba3-HOWTO/TOSHARG-locking.xml          | 1139 -----
 docs-xml/Samba3-HOWTO/TOSHARG-msdfs.xml            |  176 -
 docs-xml/Samba3-HOWTO/TOSHARG-preface.xml          |   61 -
 docs-xml/Samba3-HOWTO/conventions.xml              |   60 -
 docs-xml/Samba3-HOWTO/gpl-3.0.xml                  |  836 ----
 docs-xml/Samba3-HOWTO/hitlist-content              |   14 -
 docs-xml/Samba3-HOWTO/images/10small.png           |  Bin 46666 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/11small.png           |  Bin 27817 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/12small.png           |  Bin 29508 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/13small.png           |  Bin 30506 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/14small.png           |  Bin 56042 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/1small.png            |  Bin 20739 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/2small.png            |  Bin 15016 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/3small.png            |  Bin 15785 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/4small.png            |  Bin 22370 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/5small.png            |  Bin 27857 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/6small.png            |  Bin 32612 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/7small.png            |  Bin 29350 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/8small.png            |  Bin 45259 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/9small.png            |  Bin 30509 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WME001.png            |  Bin 8576 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WME002.png            |  Bin 6913 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WME003.png            |  Bin 6448 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WME004.png            |  Bin 8864 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WME005.png            |  Bin 6421 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WME006.png            |  Bin 5999 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WME007.png            |  Bin 5855 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WME008.png            |  Bin 2337 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WME009.png            |  Bin 8863 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WME010.png            |  Bin 6454 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WME011.png            |  Bin 5810 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WME012.png            |  Bin 6454 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WME013.png            |  Bin 5844 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WME014.png            |  Bin 5802 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WXPP002.png           |  Bin 25711 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WXPP003.png           |  Bin 18079 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WXPP005.png           |  Bin 15378 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WXPP009.png           |  Bin 18976 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/WXPP014.png           |  Bin 28767 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/a_small.png           |  Bin 115304 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/access1.svg           |  308 --
 docs-xml/Samba3-HOWTO/images/browsing1.svg         | 2025 --------
 docs-xml/Samba3-HOWTO/images/cups1.svg             |  274 --
 docs-xml/Samba3-HOWTO/images/cups2.svg             |  320 --
 docs-xml/Samba3-HOWTO/images/domain.svg            | 2288 ---------
 docs-xml/Samba3-HOWTO/images/ethereal1.png         |  Bin 18517 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/ethereal2.png         |  Bin 38069 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/idmap-gid2sid.svg     |  277 --
 docs-xml/Samba3-HOWTO/images/idmap-groups.svg      |  129 -
 docs-xml/Samba3-HOWTO/images/idmap-sid2gid.svg     |  277 --
 docs-xml/Samba3-HOWTO/images/idmap-sid2uid.svg     |  365 --
 .../Samba3-HOWTO/images/idmap-store-gid2sid.svg    |  122 -
 docs-xml/Samba3-HOWTO/images/idmap-uid2sid.svg     |  365 --
 docs-xml/Samba3-HOWTO/images/idmap.svg             |  119 -
 .../Samba3-HOWTO/images/idmap_winbind_no_loop.png  |  Bin 9172 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/pdftoepsonusb.svg     |  156 -
 docs-xml/Samba3-HOWTO/images/pdftosocket.svg       |   94 -
 docs-xml/Samba3-HOWTO/images/trusts1.svg           |  792 ---
 docs-xml/Samba3-HOWTO/images/w2kp001.png           |  Bin 10891 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/w2kp002.png           |  Bin 11966 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/w2kp003.png           |  Bin 8892 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/w2kp004.png           |  Bin 12127 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/w2kp005.png           |  Bin 9951 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/w2kp006.png           |  Bin 9244 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/wxpp001.png           |  Bin 31712 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/wxpp004.png           |  Bin 29694 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/wxpp006.png           |  Bin 12651 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/wxpp007.png           |  Bin 12781 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/wxpp008.png           |  Bin 19550 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/wxpp010.png           |  Bin 19725 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/wxpp011.png           |  Bin 8579 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/wxpp012.png           |  Bin 8918 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/wxpp013.png           |  Bin 30107 -> 0 bytes
 docs-xml/Samba3-HOWTO/images/wxpp015.png           |  Bin 9713 -> 0 bytes
 docs-xml/Samba3-HOWTO/index.xml                    |  229 -
 docs-xml/Samba3-HOWTO/manpages.xml                 |   71 -
 123 files changed, 50525 deletions(-)
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-AccessControls.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-AdvancedNetworkAdmin.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-BDC.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Backup.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Bugs.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-CUPS-printing.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-ChangeNotes.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Compiling.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-ConfigSmarts.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-DNS-DHCP-Configuration.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Diagnosis.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-DomainMember.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-FastStart.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Further-Resources.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Group-Mapping.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-IDMAP.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Install.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Integrating-with-Windows.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-InterdomainTrusts.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-IntroSMB.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-LargeFile.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-NT4Migration.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-NetworkBrowsing.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-PAM.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-PDC.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Passdb.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-PolicyMgmt.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Printing.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Problems.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-ProfileMgmt.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-RightsAndPriviliges.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-SWAT.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-SecureLDAP.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Securing.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-ServerType.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-StandAloneServer.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Support.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-TDBFiles.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-TheNetCommand.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Unicode.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-VFS.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-Winbind.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-WindowsClientConfig.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-foreword-cargill.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-foreword-tridge.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-glossary.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-inside-cover.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-locking.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-msdfs.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/TOSHARG-preface.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/conventions.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/gpl-3.0.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/hitlist-content
 delete mode 100644 docs-xml/Samba3-HOWTO/images/10small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/11small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/12small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/13small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/14small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/1small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/2small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/3small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/4small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/5small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/6small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/7small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/8small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/9small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WME001.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WME002.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WME003.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WME004.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WME005.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WME006.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WME007.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WME008.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WME009.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WME010.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WME011.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WME012.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WME013.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WME014.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WXPP002.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WXPP003.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WXPP005.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WXPP009.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/WXPP014.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/a_small.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/access1.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/browsing1.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/cups1.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/cups2.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/domain.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/ethereal1.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/ethereal2.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/idmap-gid2sid.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/idmap-groups.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/idmap-sid2gid.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/idmap-sid2uid.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/idmap-store-gid2sid.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/idmap-uid2sid.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/idmap.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/idmap_winbind_no_loop.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/pdftoepsonusb.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/pdftosocket.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/trusts1.svg
 delete mode 100644 docs-xml/Samba3-HOWTO/images/w2kp001.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/w2kp002.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/w2kp003.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/w2kp004.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/w2kp005.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/w2kp006.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/wxpp001.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/wxpp004.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/wxpp006.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/wxpp007.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/wxpp008.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/wxpp010.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/wxpp011.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/wxpp012.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/wxpp013.png
 delete mode 100644 docs-xml/Samba3-HOWTO/images/wxpp015.png
 delete mode 100644 docs-xml/Samba3-HOWTO/index.xml
 delete mode 100644 docs-xml/Samba3-HOWTO/manpages.xml

diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-AccessControls.xml b/docs-xml/Samba3-HOWTO/TOSHARG-AccessControls.xml
deleted file mode 100644
index 6096975..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-AccessControls.xml
+++ /dev/null
@@ -1,1710 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-
-<chapter id="AccessControls">
-<chapterinfo>
-	&author.jht;
-	&author.jeremy;
-	<author>&person.jelmer;<contrib>drawing</contrib></author>
-	<pubdate>May 10, 2003</pubdate>
-</chapterinfo>
-<title>File, Directory, and Share Access Controls</title>
-
-<para>
-<indexterm><primary>ACLs</primary></indexterm>
-<indexterm><primary>share</primary></indexterm>
-<indexterm><primary>network access controls</primary></indexterm>
-<indexterm><primary>unauthorized access</primary></indexterm>
-Advanced MS Windows users are frequently perplexed when file, directory, and share manipulation of
-resources shared via Samba do not behave in the manner they might expect. MS Windows network
-administrators are often confused regarding network access controls and how to
-provide users with the access they need while protecting resources from unauthorized access.
-</para>
-
-<para>
-<indexterm><primary>file access permissions</primary></indexterm>
-<indexterm><primary>directory access permissions</primary></indexterm>
-Many UNIX administrators are unfamiliar with the MS Windows environment and in particular
-have difficulty in visualizing what the MS Windows user wishes to achieve in attempts to set file
-and directory access permissions. 
-</para>
-
-<para>
-<indexterm><primary>bridge</primary></indexterm>
-<indexterm><primary>directory controls</primary></indexterm>
-<indexterm><primary>directory permissions</primary></indexterm>
-<indexterm><primary></primary></indexterm>
-The problem lies in the differences in how file and directory permissions and controls work
-between the two environments. This difference is one that Samba cannot completely hide, even
-though it does try to bridge the chasm to a degree.
-</para>
-
-<para>
-<indexterm><primary>Extended Attributes</primary></indexterm>
-<indexterm><primary>ACLs</primary><secondary>POSIX</secondary></indexterm>
-<indexterm><primary>Access Control List</primary></indexterm>
-<indexterm><primary>commercial Linux products</primary></indexterm>
-POSIX Access Control List technology has been available (along with extended attributes)
-for UNIX for many years, yet there is little evidence today of any significant use. This
-explains to some extent the slow adoption of ACLs into commercial Linux products. MS Windows
-administrators are astounded at this, given that ACLs were a foundational capability of the now
-decade-old MS Windows NT operating system.
-</para>
-
-<para>
-<indexterm><primary>network administrator</primary></indexterm>
-The purpose of this chapter is to present each of the points of control that are possible with
-Samba-3 in the hope that this will help the network administrator to find the optimum method
-for delivering the best environment for MS Windows desktop users.
-</para>
-
-<para>
-<indexterm><primary>interoperability</primary></indexterm>
-<indexterm><primary>data interchange</primary></indexterm>
-This is an opportune point to mention that Samba was created to provide a means of interoperability
-and interchange of data between differing operating environments. Samba has no intent to change
-UNIX/Linux into a platform like MS Windows. Instead the purpose was and is to provide a sufficient
-level of exchange of data between the two environments. What is available today extends well
-beyond early plans and expectations, yet the gap continues to shrink.
-</para>
-
-<sect1>
-<title>Features and Benefits</title>
-
-	<para>
-	Samba offers much flexibility in file system access management. These are the key access control
-	facilities present in Samba today:
-	</para>
-
-	<itemizedlist>
-	<title>Samba Access Control Facilities</title>
-		<listitem><para>
-		<indexterm><primary>permissions</primary><secondary>UNIX file and directory</secondary></indexterm>
-		<emphasis>UNIX File and Directory Permissions</emphasis>
-		</para>
-
-			<para>
-<indexterm><primary>UNIX file system access controls</primary></indexterm>
-<indexterm><primary>access controls</primary></indexterm>
-<indexterm><primary>permissions and controls</primary></indexterm>
-			Samba honors and implements UNIX file system access controls. Users
-			who access a Samba server will do so as a particular MS Windows user.
-			This information is passed to the Samba server as part of the logon or
-			connection setup process. Samba uses this user identity to validate
-			whether or not the user should be given access to file system resources
-			(files and directories). This chapter provides an overview for those
-			to whom the UNIX permissions and controls are a little strange or unknown.
-			</para>
-		</listitem>
-
-		<listitem><para>
-		<emphasis>Samba Share Definitions</emphasis>
-		</para>
-
-			<para>
-<indexterm><primary>share settings</primary></indexterm>
-			In configuring share settings and controls in the &smb.conf; file,
-			the network administrator can exercise overrides to native file
-			system permissions and behaviors. This can be handy and convenient
-			to effect behavior that is more like what MS Windows NT users expect,
-			but it is seldom the <emphasis>best</emphasis> way to achieve this.
-			The basic options and techniques are described herein.
-			</para>
-		</listitem>
-
-		<listitem><para>
-		<emphasis>Samba Share ACLs</emphasis>
-		<indexterm><primary>ACLs</primary><secondary>share</secondary></indexterm>
-		</para>
-
-			<para>
-<indexterm><primary>ACLs on shares</primary></indexterm>
-			Just as it is possible in MS Windows NT to set ACLs on shares
-			themselves, so it is possible to do in Samba.
-			Few people make use of this facility, yet it remains one of the
-			easiest ways to affect access controls (restrictions) and can often
-			do so with minimum invasiveness compared with other methods.
-			</para>
-		</listitem>
-
-		<listitem><para>
-				<indexterm><primary>ACLs</primary><secondary>POSIX</secondary></indexterm>
-				<indexterm><primary>ACLs</primary><secondary>Windows</secondary></indexterm>
-		<emphasis>MS Windows ACLs through UNIX POSIX ACLs</emphasis>
-		</para>
-
-			<para>
-<indexterm><primary>native ACLs</primary></indexterm>
-			The use of POSIX ACLs on UNIX/Linux is possible only if the underlying
-			operating system supports them. If not, then this option will not be
-			available to you. Current UNIX technology platforms have native support
-			for POSIX ACLs. There are patches for the Linux kernel that also provide
-			this support. Sadly, few Linux platforms ship today with native ACLs and
-			extended attributes enabled. This chapter has pertinent information
-			for users of platforms that support them.
-			</para>
-		</listitem>
-	</itemizedlist>
-
-</sect1>
-
-<sect1>
-<title>File System Access Controls</title>
-
-<para>
-Perhaps the most important recognition to be made is the simple fact that MS Windows NT4/200x/XP
-implement a totally divergent file system technology from what is provided in the UNIX operating system
-environment. First we consider what the most significant differences are, then we look
-at how Samba helps to bridge the differences.
-</para>
-
-	<sect2>
-	<title>MS Windows NTFS Comparison with UNIX File Systems</title>
-
-	<para>
-	<indexterm><primary>NTFS</primary></indexterm>
-	<indexterm><primary>File System</primary></indexterm>
-	<indexterm><primary>File System</primary><secondary>UNIX</secondary></indexterm>
-	<indexterm><primary>File System</primary><secondary>Windows</secondary></indexterm>
-	Samba operates on top of the UNIX file system. This means it is subject to UNIX file system conventions
-	and permissions. It also means that if the MS Windows networking environment requires file system
-	behavior, that differs from UNIX file system behavior then somehow Samba is responsible for emulating
-	that in a transparent and consistent manner.
-	</para>
-
-	<para>
-	It is good news that Samba does this to a large extent, and on top of that, provides a high degree
-	of optional configuration to override the default behavior. We look at some of these overrides,
-	but for the greater part we stay within the bounds of default behavior. Those wishing to explore
-	the depths of control ability should review the &smb.conf; man page.
-	</para>
-
-	<para>The following compares file system features for UNIX with those of MS Windows NT/200x:
-	<indexterm><primary>File System</primary><secondary>feature comparison</secondary></indexterm>
-	
-	</para>
-
-	<variablelist>
-		<varlistentry>
-			<term>Name Space</term>
-			<listitem>
-		<para>
-		MS Windows NT4/200x/XP file names may be up to 254 characters long, and UNIX file names
-		may be 1023 characters long. In MS Windows, file extensions indicate particular file types;
-		in UNIX this is not so rigorously observed because all names are considered arbitrary. 
-		</para>
-		<para>
-		What MS Windows calls a folder, UNIX calls a directory.
-		</para>
-			</listitem>
-		</varlistentry>
-
-		<varlistentry>
-			<term>Case Sensitivity</term>
-			<listitem>
-		<para>
-		<indexterm><primary>8.3 file names</primary></indexterm>
-		<indexterm><primary>File System</primary><secondary>case sensitivity</secondary></indexterm>
-		MS Windows file names are generally uppercase if made up of 8.3 (8-character file name
-		and 3 character extension. File names that are longer than 8.3 are case preserving and case
-		insensitive.
-		</para>
-
-		<para>
-		UNIX file and directory names are case sensitive and case preserving. Samba implements the
-		MS Windows file name behavior, but it does so as a user application. The UNIX file system
-		provides no mechanism to perform case-insensitive file name lookups. MS Windows does this
-		by default. This means that Samba has to carry the processing overhead to provide features
-		that are not native to the UNIX operating system environment.
-		</para>
-
-		<para>
-		Consider the following. All are unique UNIX names but one single MS Windows file name:
-		<screen>
-				MYFILE.TXT
-				MyFile.txt
-				myfile.txt
-		</screen></para>
-
-		<para>
-		So clearly, in an MS Windows file namespace these three files cannot co-exist, but in UNIX
-		they can.
-		</para>
-
-		<para>
-		So what should Samba do if all three are present? That which is lexically first will be
-		accessible to MS Windows users; the others are invisible and unaccessible &smbmdash; any
-		other solution would be suicidal. The Windows client will ask for a case-insensitive file
-		lookup, and that is the reason for which Samba must offer a consistent selection in the
-		event that the UNIX directory contains multiple files that would match a case insensitive
-		file listing.
-		</para></listitem>
-		</varlistentry>
-
-		<varlistentry>
-		<term>Directory Separators</term>
-		<listitem><para>
-		<indexterm><primary>Directory Separators</primary></indexterm>
-		MS Windows and DOS use the backslash <constant>\</constant> as a directory delimiter, and UNIX uses
-		the forward-slash <constant>/</constant> as its directory delimiter. This is handled transparently by Samba.
-		</para></listitem>
-		</varlistentry>
-
-		<varlistentry>
-		<term>Drive Identification</term>
-		<listitem><para>
-		<indexterm><primary>Drive Identification</primary></indexterm>
-		MS Windows products support a notion of drive letters, like <command>C:</command>, to represent
-		disk partitions. UNIX has no concept of separate identifiers for file partitions; each
-		such file system is mounted to become part of the overall directory tree.
-		The UNIX directory tree begins at <constant>/</constant> just as the root of a DOS drive is specified as
-		<constant>C:\</constant>.
-		</para></listitem>
-		</varlistentry>
-
-		<varlistentry>
-		<term>File Naming Conventions</term>
-		<listitem><para>
-		<indexterm><primary>File Naming Conventions</primary></indexterm>
-		MS Windows generally never experiences file names that begin with a dot (<constant>.</constant>), while in UNIX these
-		are commonly found in a user's home directory. Files that begin with a dot (<constant>.</constant>) are typically
-		startup files for various UNIX applications, or they may be files that contain
-		startup configuration data.
-		</para></listitem>
-		</varlistentry>
-
-		<varlistentry>
-		<term>Links and Short-Cuts</term>
-		<listitem><para>
-		<indexterm><primary>Links</primary><secondary>hard</secondary></indexterm>
-		<indexterm><primary>Links</primary><secondary>soft</secondary></indexterm>
-		<indexterm><primary>Shortcuts</primary></indexterm>
-		MS Windows make use of <emphasis>links and shortcuts</emphasis> that are actually special types of files that will
-		redirect an attempt to execute the file to the real location of the file. UNIX knows of file and directory
-		links, but they are entirely different from what MS Windows users are used to.
-		</para>
-
-		<para>
-		Symbolic links are files in UNIX that contain the actual location of the data (file or directory). An
-		operation (like read or write) will operate directly on the file referenced. Symbolic links are also
-		referred to as <quote>soft links.</quote> A hard link is something that MS Windows is not familiar with. It allows
-		one physical file to be known simultaneously by more than one file name.
-		</para></listitem>
-		</varlistentry>
-	</variablelist>
-
-	<para>
-	There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort
-	in the process of becoming familiar with UNIX/Linux. These are best left for a text that is dedicated to the
-	purpose of UNIX/Linux training and education.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Managing Directories</title>
-
-	<para>
-<indexterm><primary>create</primary></indexterm>
-<indexterm><primary>delete</primary></indexterm>
-<indexterm><primary>rename</primary></indexterm>
-	There are three basic operations for managing directories: <command>create</command>, <command>delete</command>,
-	<command>rename</command>. <link linkend="TOSH-Accesstbl">Managing Directories with UNIX and
-	Windows</link> compares the commands in Windows and UNIX that implement these operations.
-	</para>
-
-	<table frame="all" id="TOSH-Accesstbl">
-		<title>Managing Directories with UNIX and Windows</title>
-		<tgroup align="center" cols="3">
-		<thead>
-		<row><entry>Action</entry><entry>MS Windows Command</entry><entry>UNIX Command</entry></row>
-		</thead>
-	
-		<tbody>
-			<row><entry>create</entry><entry>md folder</entry><entry>mkdir folder</entry></row>
-			<row><entry>delete</entry><entry>rd folder</entry><entry>rmdir folder</entry></row>
-			<row><entry>rename</entry><entry>rename oldname newname</entry><entry>mv oldname newname</entry></row>
-		</tbody>
-	</tgroup>
-	</table>
-
-	</sect2>
-
-	<sect2>
-	<title>File and Directory Access Control</title>
-
-	<para>
-	<indexterm><primary>ACLs</primary><secondary>File System</secondary></indexterm>
-<indexterm><primary>POSIX ACLs</primary></indexterm>
-<indexterm><primary>EAs</primary></indexterm>
-	The network administrator is strongly advised to read basic UNIX training manuals and reference materials
-	regarding file and directory permissions maintenance. Much can be achieved with the basic UNIX permissions
-	without having to resort to more complex facilities like POSIX ACLs or extended attributes (EAs).
-	</para>
-
-	<para>
-	UNIX/Linux file and directory access permissions involves setting three primary sets of data and one control set.
-	A UNIX file listing looks as follows:
-<screen>
-&prompt;<userinput>ls -la</userinput>
-total 632
-drwxr-xr-x   13 maryo   gnomes      816 2003-05-12 22:56 .
-drwxrwxr-x   37 maryo   gnomes     3800 2003-05-12 22:29 ..
-dr-xr-xr-x    2 maryo   gnomes       48 2003-05-12 22:29 muchado02
-drwxrwxrwx    2 maryo   gnomes       48 2003-05-12 22:29 muchado03
-drw-rw-rw-    2 maryo   gnomes       48 2003-05-12 22:29 muchado04
-d-w--w--w-    2 maryo   gnomes       48 2003-05-12 22:29 muchado05
-dr--r--r--    2 maryo   gnomes       48 2003-05-12 22:29 muchado06
-drwsrwsrwx    2 maryo   gnomes       48 2003-05-12 22:29 muchado08
-----------    1 maryo   gnomes     1242 2003-05-12 22:31 mydata00.lst
---w--w--w-    1 maryo   gnomes     7754 2003-05-12 22:33 mydata02.lst
--r--r--r--    1 maryo   gnomes    21017 2003-05-12 22:32 mydata04.lst
--rw-rw-rw-    1 maryo   gnomes    41105 2003-05-12 22:32 mydata06.lst
-&prompt;
-</screen>
-	</para>
-
-	<para>
-	The columns represent (from left to right) permissions, number of hard links to file, owner, group, size
-	(bytes), access date, time of last modification, and file name.
-	</para>
-
-	<para>
-	An overview of the permissions field is shown in <link linkend="access1">Overview of UNIX permissions
-	field</link>.
-	</para>
-
-	<figure id="access1">
-		<title>Overview of UNIX permissions field.</title>
-		<imagefile scale="40">access1</imagefile>
-	</figure>
-
-	<para>
-		Any bit flag may be unset. An unset bit flag is the equivalent of "cannot" and is represented
-		as a <quote>-</quote> character (see <link linkend="access2"/>)
-<indexterm><primary>read</primary></indexterm>
-<indexterm><primary>write</primary></indexterm>
-<indexterm><primary>execute</primary></indexterm>
-<indexterm><primary>user</primary></indexterm>
-<indexterm><primary>group</primary></indexterm>
-<indexterm><primary>other</primary></indexterm>
-	</para>
-
-<example id="access2">
-<title>Example File</title>
-<programlisting>
--rwxr-x---   Means: 
- ^^^                The owner (user) can read, write, execute
-    ^^^             the group can read and execute
-       ^^^          everyone else cannot do anything with it.
-</programlisting>
-</example>
-
-
-	<para>
-<indexterm><primary>character device</primary></indexterm>
-<indexterm><primary>block device</primary></indexterm>
-<indexterm><primary>pipe device</primary></indexterm>
-<indexterm><primary>UNIX Domain Socket</primary></indexterm>
-	Additional possibilities in the [type] field are c = character device, b = block device, p = pipe device,
-	s = UNIX Domain Socket.
-	</para>
-
-	<para>
-<indexterm><primary>read</primary></indexterm>
-<indexterm><primary>write</primary></indexterm>
-<indexterm><primary>execute</primary></indexterm>
-<indexterm><primary>SGID</primary></indexterm>
-<indexterm><primary>SUID</primary></indexterm>
-	The letters <constant>rwxXst</constant> set permissions for the user, group, and others as read (r), write (w),
-	execute (or access for directories) (x), execute  only  if  the  file  is a directory or already has execute
-	permission for some user (X), set user (SUID) or group ID (SGID) on execution (s), sticky (t).
-	</para>
-
-	<para>
-<indexterm><primary>sticky bit</primary></indexterm>
-<indexterm><primary>unlinked</primary></indexterm>
-<indexterm><primary>/tmp</primary></indexterm>
-<indexterm><primary>world-writable</primary></indexterm>
-	When the sticky bit is set on a directory, files in that directory may be unlinked (deleted) or renamed only by root or their owner. 
-	Without the sticky  bit, anyone able to write to the directory can delete or rename files. The sticky bit is commonly found on
-	directories, such as <filename>/tmp</filename>, that are world-writable.
-	</para>
-
-	<para>
-<indexterm><primary>write</primary></indexterm>
-<indexterm><primary>read</primary></indexterm>
-<indexterm><primary>setting up directories</primary></indexterm>
-<indexterm><primary>set user id</primary><see>SUID</see></indexterm>
-<indexterm><primary>set group id</primary><see>SGID</see></indexterm>
-	When the set user or group ID bit (s) is set on a directory, then all files created within it will be owned by the user and/or
-	group whose `set user or group' bit is set. This can be helpful in setting up directories for which it is desired that
-	all users who are in a group should be able to write to and read from a file, particularly when it is undesirable for that file
-	to be exclusively owned by a user whose primary group is not the group that all such users belong to.
-	</para>
-
-	<para>
-	When a directory is set <constant>d-wx--x---</constant>, the owner can read and create (write) files in it, but because
-	the (r) read flags are not set, files cannot be listed (seen) in the directory by anyone. The group can read files in the
-	directory but cannot create new files. If files in the directory are set to be readable and writable for the group, then
-	group members will be able to write to (or delete) them.
-	</para>
-
-	<sect3>
-	<title>Protecting Directories and Files from Deletion</title>
-
-	<para>
-<indexterm><primary>protect files</primary></indexterm>
-<indexterm><primary>protect directories</primary></indexterm>
-<indexterm><primary>access controls</primary></indexterm>
-<indexterm><primary>capability to delete</primary></indexterm>
-	People have asked on the Samba mailing list how is it possible to protect files or directories from deletion by users.
-	For example, Windows NT/2K/XP provides the capacity to set access controls on a directory into which people can
-	write files but not delete them. It is possible to set an ACL on a Windows file that permits the file to be written to
-	but not deleted. Such concepts are foreign to the UNIX operating system file space. Within the UNIX file system
-	anyone who has the ability to create a file can write to it. Anyone who has write permission on the
-	directory that contains a file and has write permission for it has the capability to delete it.
-	</para>
-
-	<para>
-<indexterm><primary>directory permissions</primary></indexterm>
-<indexterm><primary>delete a file</primary></indexterm>
-<indexterm><primary>write access</primary></indexterm>
-	For the record, in the UNIX environment the ability to delete a file is controlled by the permissions on
-	the directory that the file is in. In other words, a user can delete a file in a directory to which that
-	user has write access, even if that user does not own the file.
-	</para>
-	
-	<para>
-<indexterm><primary>file system capabilities</primary></indexterm>
-<indexterm><primary>inheritance</primary></indexterm>
-<indexterm><primary>POSIX ACLs</primary></indexterm>
-<indexterm><primary>extended attributes</primary></indexterm>
-	Of necessity, Samba is subject to the file system semantics of the host operating system. Samba is therefore
-	limited in the file system capabilities that can be made available through Windows ACLs, and therefore performs
-	a "best fit" translation to POSIX ACLs. Some UNIX file systems do, however support, a feature known
-	as extended attributes. Only the Windows concept of <emphasis>inheritance</emphasis> is implemented by Samba through
-	the appropriate extended attribute.
-	</para>	
-
-	<para>
-<indexterm><primary>extended attributes</primary></indexterm>
-<indexterm><primary>immutable</primary></indexterm>
-<indexterm><primary>chattr</primary></indexterm>
-<indexterm><primary>CAP_LINUX_IMMUTABLE</primary></indexterm>
-	The specific semantics of the extended attributes are not consistent across UNIX and UNIX-like systems such as Linux.
-	For example, it is possible on some implementations of the extended attributes to set a flag that prevents the directory
-	or file from being deleted. The extended attribute that may achieve this is called the <constant>immutable</constant> bit.
-	Unfortunately, the implementation of the immutable flag is NOT consistent with published documentation. For example, the
-	man page for the <command>chattr</command> on SUSE Linux 9.2 says:
-<screen>
-A file with the i attribute cannot be modified: it cannot be deleted
-or renamed, no link can be created to this file and no data can be
-written to the file. Only the superuser or a process possessing the
-CAP_LINUX_IMMUTABLE capability can set or clear this attribute.
-</screen>
-	A simple test can be done to check if the immutable flag is supported on files in the file system of the Samba host
-	server.
-	</para>
-
-	<procedure>
-	<title>Test for File Immutibility Support</title>
-
-	<step><para>
-	Create a file called <filename>filename</filename>.
-	</para></step>
-
-	<step><para>
-	Login as the <constant>root</constant> user, then set the immutibile flag on a test file as follows:
-<screen>
-&rootprompt; chattr +i `filename'
-</screen>
-	</para></step>
-
-	<step><para>
-	Login as the user who owns the file (not root) and attempt to remove the file as follows:
-<screen>
-mystic:/home/hannibal > rm filename
-</screen>
-	It will not be possible to delete the file if the immutable flag is correctly honored.
-	</para></step>
-	</procedure>
-
-	<para>
-	On operating systems and file system types that support the immutable bit, it is possible to create directories
-	that cannot be deleted. Check the man page on your particular host system to determine whether or not
-	immutable directories are writable. If they are not, then the entire directory and its contents will effectively
-	be protected from writing (file creation also) and deletion.
-	</para>
-
-	</sect3>
-
-	</sect2>
-
-</sect1>
-
-<sect1>
-<title>Share Definition Access Controls</title>
-
-
-	<para>
-	<indexterm><primary>permissions</primary><secondary>share</secondary></indexterm>
-	The following parameters in the &smb.conf; file sections define a share control or affect access controls.
-	Before using any of the following options, please refer to the man page for &smb.conf;.
-	</para>
-
-	<sect2>
-	<title>User- and Group-Based Controls</title>
-
-	<para>
-	User- and group-based controls can prove quite useful. In some situations it is distinctly desirable to
-	force all file system operations as if a single user were doing so. The use of the
-	<smbconfoption name="force user"/> and <smbconfoption name="force group"/> behavior will achieve this.
-	In other situations it may be necessary to use a paranoia level of control to ensure that only particular
-	authorized persons will be able to access a share or its contents. Here the use of the
-	<smbconfoption name="valid users"/> or the <smbconfoption name="invalid users"/> parameter may be useful.
-	</para>
-
-	<para>
-	As always, it is highly advisable to use the easiest to maintain and the least ambiguous method for
-	controlling access. Remember, when you leave the scene, someone else will need to provide assistance, and
-	if he or she finds too great a mess or does not understand what you have done, there is risk of
-	Samba being removed and an alternative solution being adopted.
-	</para>
-
-	<para>
-	<link linkend="ugbc">User and Group Based Controls</link> enumerates these controls.
-	</para>
-
-	<table frame='all' pgwide='0' id="ugbc"><title>User- and Group-Based Controls</title>
-	<tgroup cols='2'>
-		<colspec align="left"/>
-		<colspec align="justify" colwidth="1*"/>
-		<thead>
-		<row>
-			<entry align="center">Control Parameter</entry>
-			<entry align="center">Description, Action, Notes</entry>
-		</row>
-		</thead>
-		<tbody>
-		<row>
-			<entry><smbconfoption name="admin users"/></entry>
-			<entry><para>
-			List of users who will be granted administrative privileges on the share.
-			They will do all file operations as the superuser (root). 
-			Users in this list will be able to do anything they like on the share,
-			irrespective of file permissions.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="force group"/></entry>
-			<entry><para>
-			Specifies a UNIX group name that will be assigned as the default primary group
-			for all users connecting to this service.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="force user"/></entry>
-			<entry><para>
-			Specifies a UNIX username that will be assigned as the default user for all users connecting to this service.
-			This is useful for sharing files. Incorrect use can cause security problems.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="guest ok"/></entry>
-			<entry><para>
-			If this parameter is set for a service, then no password is required to connect to the service. Privileges will be 
-			those of the  guest account.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="invalid users"/></entry>
-			<entry><para>
-			List of users that should not be allowed to login to this service.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="only user"/></entry>
-			<entry><para>
-			Controls whether connections with usernames not in the user list will be allowed.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="read list"/></entry>
-			<entry><para>
-			List of users that are given read-only access to a service. Users in this list
-			will not be given write access, no matter what the  read-only  option is set to. 
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="username"/></entry>
-			<entry><para>
-			Refer to the &smb.conf; man page for more information; this is a complex and potentially misused parameter.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="valid users"/></entry>
-			<entry><para>
-			List of users that should be allowed to login to this service.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="write list"/></entry>
-			<entry><para>
-			List of users that are given read-write access to a service.
-			</para></entry>
-		</row>
-		</tbody>
-	</tgroup>
-	</table>
-
-	</sect2>
-
-	<sect2>
-	<title>File and Directory Permissions-Based Controls</title>
-
-	<para>
-	Directory permission-based controls, if misused, can result in considerable difficulty in diagnosing the causes of 
-	misconfiguration. Use them sparingly and carefully. By gradually introducing each, one at a time, undesirable side 
-	effects may be detected. In the event of a problem, always comment all of them out and then gradually reintroduce 
-	them in a controlled way.
-	</para>
-
-	<para>
-	Refer to <link linkend="fdpbc">File and Directory Permission Based Controls</link> for information 
-	regarding the parameters that may be used to set file and directory permission-based access controls.
-	</para>
-
-	<table frame='all' id="fdpbc"><title>File and Directory Permission-Based Controls</title>
-		<tgroup cols='2'>
-			<colspec align="left"/>
-			<colspec align="justify" colwidth="1*"/>
-		<thead>
-		<row>
-			<entry align="center">Control Parameter</entry>
-			<entry align="center">Description, Action, Notes</entry>
-		</row>
-		</thead>
-		<tbody>
-		<row>
-			<entry><smbconfoption name="create mask"/></entry>
-			<entry><para>
-			Refer to the &smb.conf; man page.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="directory mask"/></entry>
-			<entry><para>
-			The octal modes used when converting DOS modes to UNIX modes when creating UNIX directories.
-			See also directory security mask.
-			</para></entry></row>
-		<row>
-			<entry><smbconfoption name="dos filemode"/></entry>
-			<entry><para>
-			Enabling this parameter allows a user who has write access to the file to modify the permissions on it.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="force create mode"/></entry>
-			<entry><para>
-			This parameter specifies a set of UNIX-mode bit permissions that will always be set on a file created by Samba.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="force directory mode"/></entry>
-			<entry><para>
-			This parameter specifies a set of UNIX-mode bit permissions that will always be set on a directory created by Samba.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="force directory security mode"/></entry>
-			<entry><para>
-			Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="force security mode"/></entry>
-			<entry><para>
-			Controls UNIX permission bits modified when a Windows NT client manipulates UNIX permissions.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="hide unreadable"/></entry>
-			<entry><para>
-			Prevents clients from seeing the existence of files that cannot be read.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="hide unwriteable files"/></entry>
-			<entry><para>
-			Prevents clients from seeing the existence of files that cannot be written to. Unwritable directories are shown as usual. 
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="nt acl support"/></entry>
-			<entry><para>
-			This parameter controls whether smbd will attempt to map UNIX permissions into Windows NT ACLs.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="security mask"/></entry>
-			<entry><para>
-			Controls UNIX permission bits modified when a Windows NT client is manipulating the UNIX permissions on a file.
-			</para></entry>
-		</row>
-		</tbody>
-	</tgroup>
-	</table>
-
-	</sect2>
-
-	<sect2>
-	<title>Miscellaneous Controls</title>
-
-	<para>
-	The parameters documented in <link linkend="mcoc">Other Controls</link> are often used by administrators
-	in ways that create inadvertent barriers to file access. Such are the consequences of not understanding the 
-	full implications of &smb.conf; file settings.
-	</para>
-
-	<table frame='all' id="mcoc"><title>Other Controls</title>
-	<tgroup cols='2'>
-		<colspec align="justify" colwidth="1*"/>
-		<colspec align="justify" colwidth="1*"/>
-		<thead>
-		<row>
-			<entry align="center">Control Parameter</entry>
-			<entry align="center">Description, Action, Notes</entry>
-		</row>
-		</thead>
-		<tbody>
-		<row>
-			<entry>
-			<smbconfoption name="case sensitive"/>,
-			<smbconfoption name="default case"/>,
-			<smbconfoption name="short preserve case"/>
-			</entry>
-			<entry><para>
-			This means that all file name lookup will be done in a case-sensitive manner. 
-			Files will be created with the precise file name Samba received from the MS Windows client.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="csc policy"/></entry>
-			<entry><para>
-			Client-side caching policy parallels MS Windows client-side file caching capabilities.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="dont descend"/></entry>
-			<entry><para>
-			Allows specifying a comma-delimited list of directories that the server should always show as empty.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="dos filetime resolution"/></entry>
-			<entry><para>
-			This option is mainly used as a compatibility option for Visual C++ when used against Samba shares.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="dos filetimes"/></entry>
-			<entry><para>
-			DOS and Windows allow users to change file timestamps if they can write to the file. POSIX semantics prevent this.
-			This option allows DOS and Windows behavior.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="fake oplocks"/></entry>
-			<entry><para>
-			Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an
-			oplock, the client is free to assume that it is the only one accessing the file, and it will aggressively cache file data.
-			</para></entry>
-		</row>
-		<row>
-			<entry>
-			<smbconfoption name="hide dot files"/>,
-			<smbconfoption name="hide files"/>,
-			<smbconfoption name="veto files"/>
-			</entry>
-			<entry><para>
-			Note: MS Windows Explorer allows override of files marked as hidden so they will still be visible.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="read only"/></entry>
-			<entry><para>
-			If this parameter is yes, then users of a service may not create or modify files in the service's directory.
-			</para></entry>
-		</row>
-		<row>
-			<entry><smbconfoption name="veto files"/></entry>
-			<entry><para>
-			List of files and directories that are neither visible nor accessible.
-			</para></entry>
-		</row>
-		</tbody>
-	</tgroup>
-	</table>
-
-	</sect2>
-
-</sect1>
-
-<sect1>
-<title>Access Controls on Shares</title>
-
-
-	<para>
-<indexterm><primary>per-share access control</primary></indexterm>
-<indexterm><primary>Everyone - Full Control</primary></indexterm>
-<indexterm><primary>specific restrictions</primary></indexterm>
-<indexterm><primary>share access</primary></indexterm>
-	<indexterm><primary>permissions</primary><secondary>share ACLs</secondary></indexterm>
-	This section deals with how to configure Samba per-share access control restrictions.
-	By default, Samba sets no restrictions on the share itself. Restrictions on the share itself
-	can be set on MS Windows NT4/200x/XP shares. This can be an effective way to limit who can
-	connect to a share. In the absence of specific restrictions, the default setting is to allow
-	the global user <constant>Everyone - Full Control</constant> (full control, change and read).
-	</para>
-
-	<para>
-<indexterm><primary>access control</primary></indexterm>
-<indexterm><primary>MMC</primary></indexterm>
-<indexterm><primary>Computer Management</primary></indexterm>
-	At this time Samba does not provide a tool for configuring access control settings on the share
-	itself.  The only way to create those settings is to use either the NT4 Server Manager or the Windows 200x
-	Microsoft Management Console (MMC) for Computer Management. There are currently no plans to provide
-	this capability in the Samba command-line tool set.
-	</para>
-
-	<para>
-<indexterm><primary>share_info.tdb</primary></indexterm>
-<indexterm><primary>/usr/local/samba/var</primary></indexterm>
-<indexterm><primary>tdbdump</primary></indexterm>
-<indexterm><primary>tdb files</primary></indexterm>
-	Samba stores the per-share access control settings in a file called <filename>share_info.tdb</filename>.
-	The location of this file on your system will depend on how Samba was compiled. The default location
-	for Samba's tdb files is under <filename>/usr/local/samba/var</filename>. If the <filename>tdbdump</filename>
-	utility has been compiled and installed on your system, then you can examine the contents of this file
-	by executing <command>tdbdump share_info.tdb</command> in the directory containing the tdb files.
-	</para>
-
-	<sect2>
-	<title>Share Permissions Management</title>
-
-		<para>
-		The best tool for share permissions management is platform-dependent. Choose the best tool for your environment.
-		</para>
-
-			<sect3>
-			<title>Windows NT4 Workstation/Server</title>
-			<para>
-<indexterm><primary>manage share permissions</primary></indexterm>
-<indexterm><primary>share permissions</primary></indexterm>
-<indexterm><primary>NT Server Manager</primary></indexterm>
-<indexterm><primary>Windows NT4</primary></indexterm>
-			The tool you need to manage share permissions on a Samba server from a Windows NT4 Workstation or Server
-			is the NT Server Manager.  Server Manager is shipped with Windows NT4 Server products but not with Windows
-			NT4 Workstation.  You can obtain the NT Server Manager for MS Windows NT4 Workstation from the Microsoft
-			web site <ulink url="http://support.microsoft.com/default.aspx?scid=kb;en-us;173673">support</ulink> section.
-			</para>
-
-			<procedure>
-			<title>Instructions</title>
-
-			<step><para>
-			Launch the <application>NT4 Server Manager</application> and click on the Samba server you want to
-			administer. From the menu select <guimenu>Computer</guimenu>, then click on
-			<guimenuitem>Shared Directories</guimenuitem>.
-			</para></step>
-
-			<step><para>
-			Click on the share that you wish to manage and click the <guilabel>Properties</guilabel> tab, then click
-			the <guilabel>Permissions</guilabel> tab. Now you can add or change access control settings as you wish.
-			</para></step>
-			</procedure>
-
-			</sect3>
-
-			<sect3>
-			<title>Windows 200x/XP</title>
-
-			<para>
-<indexterm><primary>Windows NT4/200x/XP</primary></indexterm>
-<indexterm><primary>ACLs on share</primary></indexterm>
-<indexterm><primary>Sharing</primary></indexterm>
-<indexterm><primary>Permissions</primary></indexterm>
-			On <application>MS Windows NT4/200x/XP</application> systems, ACLs on the share itself are set using
-			tools like the MS Explorer. For example, in Windows 200x, right-click on the shared folder,
-			then select <guimenuitem>Sharing</guimenuitem>, then click on <guilabel>Permissions</guilabel>. The default 
-			Windows NT4/200x permissions allow the group "Everyone" full control on the share.
-			</para>
-
-			<para>
-<indexterm><primary>Computer Management</primary></indexterm>
-<indexterm><primary>MMC</primary></indexterm>
-<indexterm><primary>tool</primary></indexterm>
-			MS Windows 200x and later versions come with a tool called the <application>Computer Management</application>
-			snap-in for the MMC. This tool can be accessed via <guimenu>Control Panel ->
-			Administrative Tools -> Computer Management</guimenu>.
-			</para>
-
-			<procedure>
-			<title>Instructions</title>
-			<step><para>
-			After launching the MMC with the Computer Management snap-in, click the menu item <guimenuitem>Action</guimenuitem>
-			and select <guilabel>Connect to another computer</guilabel>. If you are not logged onto a domain you will be prompted
-			to enter a domain login user identifier and a password. This will authenticate you to the domain.
-			If you are already logged in with administrative privilege, this step is not offered.
-			</para></step>
-
-			<step><para>
-			If the Samba server is not shown in the <guilabel>Select Computer</guilabel> box, type in the name of the target
-			Samba server in the field <guilabel>Name:</guilabel>. Now click the on <guibutton>[+]</guibutton> next to 
-			<guilabel>System Tools</guilabel>, then on the <guibutton>[+]</guibutton> next to
-			<guilabel>Shared Folders</guilabel> in the left panel.
-			</para></step>
-
-			<step><para>
-<indexterm><primary>Share Permissions</primary></indexterm>
-			In the right panel, double-click on the share on which you wish to set access control permissions.
-			Then click the tab <guilabel>Share Permissions</guilabel>. It is now possible to add access control entities
-			to the shared folder. Remember to set what type of access (full control, change, read) you
-			wish to assign for each entry.
-			</para></step>
-			</procedure>
-
-			<warning>
-			<para>
-			Be careful. If you take away all permissions from the <constant>Everyone</constant> user without removing
-			this user, effectively no user will be able to access the share. This is a result of what is known as
-			ACL precedence. Everyone with <emphasis>no access</emphasis> means that <constant>MaryK</constant> who is
-			part of the group <constant>Everyone</constant> will have no access even if she is given explicit full
-			control access.
-			</para>
-			</warning>
-
-			</sect3>
-		</sect2>
-
-</sect1>
-
-<sect1>
-<title>MS Windows Access Control Lists and UNIX Interoperability</title>
-
-	<sect2>
-		<title>Managing UNIX Permissions Using NT Security Dialogs</title>
-
-
-		<para>
-		<indexterm><primary>permissions</primary><secondary>file/directory ACLs</secondary></indexterm>
-		Windows NT clients can use their native security settings dialog box to view and modify the
-		underlying UNIX permissions.
-		</para>
-
-		<para>
-		This ability is careful not to compromise the security of the UNIX host on which Samba is running and 
-		still obeys all the file permission rules that a Samba administrator can set.
-		</para>
-
-		<para>
-		Samba does not attempt to go beyond POSIX ACLs, so the various finer-grained access control
-		options provided in Windows are actually ignored.
-		</para> 
-
-		<note>
-		<para>
-		All access to UNIX/Linux system files via Samba is controlled by the operating system file access controls.
-		When trying to figure out file access problems, it is vitally important to find the identity of the Windows
-		user as it is presented by Samba at the point of file access. This can best be determined from the
-		Samba log files.
-		</para>
-		</note>
-	</sect2>
-
-	<sect2>
-		<title>Viewing File Security on a Samba Share</title>
-
-		<para>
-		From an NT4/2000/XP client, right-click on any file or directory in a Samba-mounted drive letter
-		or UNC path. When the menu pops up, click on the <guilabel>Properties</guilabel> entry at the bottom
-		of the menu. This brings up the file <constant>Properties</constant> dialog box. Click on the 
-		<guilabel>Security</guilabel> tab and you will see three buttons: <guibutton>Permissions</guibutton>,
-		<guibutton>Auditing</guibutton>, and <guibutton>Ownership</guibutton>. The <guibutton>Auditing</guibutton>
-		button will cause either an error message <errorname>"A requested privilege is not held by the client"</errorname>
-		to appear if the user is not the NT administrator, or a dialog intended to allow an administrator
-		to add auditing requirements to a file if the user is logged on as the NT administrator. This dialog is
-		nonfunctional with a Samba share at this time, because the only useful button, the <guibutton>Add</guibutton>
-		button, will not currently allow a list of users to be seen.
-		</para>
-
-	</sect2>
-
-	<sect2>
-		<title>Viewing File Ownership</title>
-
-		<para>
-		Clicking on the <guibutton>Ownership</guibutton> button brings up a dialog box telling you who owns
-		the given file. The owner name will be displayed like this:
-		<screen>
-		<constant>SERVER\user (Long name)</constant>
-		</screen>
-		<replaceable>SERVER</replaceable> is the NetBIOS name of the Samba server, <replaceable>user</replaceable>
-		is the username of the UNIX user who owns the file, and <replaceable>(Long name)</replaceable> is the
-		descriptive string identifying the user (normally found in the GECOS field of the UNIX password database).
-		Click on the <guibutton>Close</guibutton> button to remove this dialog.
-		</para>
-
-		<para>
-		If the parameter <smbconfoption name="nt acl support"/> is set to <constant>false</constant>,
-		the file owner will be shown as the NT user <emphasis>Everyone</emphasis>.
-		</para>
-
-		<para>
-<indexterm><primary>Take Ownership</primary></indexterm>
-		The <guibutton>Take Ownership</guibutton> button will not allow you to change the ownership of this file to
-		yourself (clicking it will display a dialog box complaining that the user as whom you are currently logged onto
-		the NT client cannot be found). The reason for this is that changing the ownership of a file is a privileged
-		operation in UNIX, available only to the <emphasis>root</emphasis> user. Because clicking on this button causes
-		NT to attempt to change the ownership of a file to the current user logged into the NT client, this will
-		not work with Samba at this time.
-		</para>
-
-		<para>
-<indexterm><primary>chown</primary></indexterm>
-<indexterm><primary>ownership</primary></indexterm>
-<indexterm><primary>Seclib</primary></indexterm>
-		There is an NT <command>chown</command> command that will work with Samba and allow a user with administrator
-		privilege connected to a Samba server as root to change the ownership of files on both a local NTFS file system
-		or remote mounted NTFS or Samba drive. This is available as part of the <application>Seclib</application> NT
-		security library written by Jeremy Allison of the Samba Team and is downloadable from the main Samba FTP site.
-		</para>
-
-	</sect2>
-
-	<sect2>
-		<title>Viewing File or Directory Permissions</title>
-
-		<para>
-		The third button is the <guibutton>Permissions</guibutton> button. Clicking on it brings up a dialog box
-		that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed like this:
-		</para>
-
-		<para><command><replaceable>SERVER</replaceable>\
-				<replaceable>user</replaceable> 
-				<replaceable>(Long name)</replaceable></command></para>
-
-		<para><replaceable>SERVER</replaceable> is the NetBIOS name of the Samba server,
-		<replaceable>user</replaceable> is the username of the UNIX user who owns the file, and
-		<replaceable>(Long name)</replaceable> is the descriptive string identifying the user (normally found in the
-		GECOS field of the UNIX password database).</para>
-
-		<para>
-		If the parameter <smbconfoption name="nt acl support"/> is set to <constant>false</constant>,
-		the file owner will be shown as the NT user <constant>Everyone</constant>, and the permissions will be
-		shown as NT <emphasis>Full Control</emphasis>.
-		</para>
-
-
-		<para>
-		The permissions field is displayed differently for files and directories. Both are discussed next.
-		</para>
-
-		<sect3>
-		<title>File Permissions</title>
-
-		<para>
-		The standard UNIX user/group/world triplet and the corresponding <constant>read, write,
-		execute</constant> permissions triplets are mapped by Samba into a three-element NT ACL with the
-		<quote>r</quote>, <quote>w</quote>, and <quote>x</quote> bits mapped into the corresponding NT
-		permissions. The UNIX world permissions are mapped into the global NT group <constant>Everyone</constant>, followed 
-		by the list of permissions allowed for the UNIX world. The UNIX owner and group permissions are displayed as an NT 
-		<guiicon>user</guiicon> icon and an NT <guiicon>local group</guiicon> icon, respectively, followed by the list 
-		of permissions allowed for the UNIX user and group.
-		</para>
-
-		<para>
-		Because many UNIX permission sets do not map into common NT names such as <constant>read</constant>,
-		<constant>change</constant>, or <constant>full control</constant>, usually the permissions will be prefixed
-		by the words <constant>Special Access</constant> in the NT display list.
-		</para>
-
-		<para>
-		But what happens if the file has no permissions allowed for a particular UNIX user group or world component?
-		In order to  allow <emphasis>no permissions</emphasis> to be seen and modified, Samba then overloads the NT
-		<constant>Take Ownership</constant> ACL attribute (which has no meaning in UNIX) and reports a component with
-		no permissions as having the NT <command>O</command> bit set.  This was chosen, of course, to make it look
-		like a zero, meaning zero permissions. More details on the decision behind this action are given below.
-		</para>
-
-		</sect3>
-		
-		<sect3>
-		<title>Directory Permissions</title>
-
-		<para>
-		Directories on an NT NTFS file system have two different sets of permissions. The first set is the ACL set on the
-		directory itself, which is usually displayed in the first set of parentheses in the normal <constant>RW</constant> 
-		NT style. This first set of permissions is created by Samba in exactly the same way as normal file permissions are, described 
-		above, and is displayed in the same way.
-		</para>
-
-		<para>
-		The second set of directory permissions has no real meaning in the UNIX permissions world and represents the <constant>
-		inherited</constant> permissions that any file created within this directory would inherit.
-		</para>
-
-		<para>
-		Samba synthesizes these inherited permissions for NT by returning as an NT ACL the UNIX permission mode that a new file 
-		created by Samba on this share would receive.
-		</para>
-
-		</sect3>
-
-	</sect2>
-		
-	<sect2>
-	<title>Modifying File or Directory Permissions</title>
-
-	<para>
-	Modifying file and directory permissions is as simple as changing the displayed permissions in the dialog box
-	and clicking on <guibutton>OK</guibutton>. However, there are limitations that a user needs to be aware of,
-	and also interactions with the standard Samba permission masks and mapping of DOS attributes that also need to
-	be taken into account.
-	</para>
-
-	<para>
-	If the parameter <smbconfoption name="nt acl support"/> is set to <constant>false</constant>, any attempt to
-	set security permissions will fail with an <errorname>"Access Denied" </errorname> message.
-	</para>
-
-	<para>
-	The first thing to note is that the <guibutton>Add</guibutton> button will not return a list of users in Samba
-	(it will give an error message saying <errorname>"The remote procedure call failed and did not
-	execute"</errorname>). This means that you can only manipulate the current user/group/world permissions listed
-	in the dialog box. This actually works quite well because these are the only permissions that UNIX actually
-	has.
-	</para>
-
-	<para>
-	If a permission triplet (either user, group, or world) is removed from the list of permissions in the NT
-	dialog box, then when the <guibutton>OK</guibutton> button is pressed, it will be applied as <emphasis>no
-	permissions</emphasis> on the UNIX side. If you view the permissions again, the <emphasis>no
-	permissions</emphasis> entry will appear as the NT <command>O</command> flag, as described above. This allows
-	you to add permissions back to a file or directory once you have removed them from a triplet component.
-	</para>
-
-	<para>
-	Because UNIX supports only the <quote>r</quote>, <quote>w</quote>, and <quote>x</quote> bits of an NT ACL, if
-	other NT security attributes such as <constant>Delete Access</constant> are selected, they will be ignored
-	when applied on the Samba server.
-	</para>
-
-	<para>
-	When setting permissions on a directory, the second set of permissions (in the second set of parentheses) is
-	by default applied to all files within that directory. If this is not what you want, you must uncheck the
-	<guilabel>Replace permissions on existing files</guilabel> checkbox in the NT dialog before clicking on
-	<guibutton>OK</guibutton>.
-	</para>
-
-	<para>
-	If you wish to remove all permissions from a user/group/world  component, you may either highlight the
-	component and click on the <guibutton>Remove</guibutton> button or set the component to only have the special
-	<constant>Take Ownership</constant> permission (displayed as <command>O</command>) highlighted.
-	</para>
-
-	</sect2>
-
-<?latex \newpage ?>
-	<sect2>
-	<title>Interaction with the Standard Samba <quote>create mask</quote> Parameters</title>
-
-	<para>There are four parameters that control interaction with the standard Samba <parameter>create mask</parameter> parameters:
-	
-
-	<itemizedlist>
-		<listitem><para><smbconfoption name="security mask"/></para></listitem>
-		<listitem><para><smbconfoption name="force security mode"/></para></listitem>
-		<listitem><para><smbconfoption name="directory security mask"/></para></listitem>
-		<listitem><para><smbconfoption name="force directory security mode"/></para></listitem>
-	</itemizedlist>
-
-	</para>
-
-	<para>
-	When a user clicks on <guibutton>OK</guibutton> to apply the 
-	permissions, Samba maps the given permissions into a user/group/world 
-	r/w/x triplet set, and then checks the changed permissions for a 
-	file against the bits set in the  
-	<smbconfoption name="security mask"/> parameter. Any bits that 
-	were changed that are not set to <emphasis>1</emphasis> in this parameter are left alone 
-	in the file permissions.</para>
-
-	<para>
-	Essentially, zero bits in the <smbconfoption name="security mask"/>
-	may be treated as a set of bits the user is <emphasis>not</emphasis> 
-	allowed to change, and one bits are those the user is allowed to change.
-	</para>
-
-	<para>
-	If not explicitly set, this parameter defaults to the same value as 
-	the <smbconfoption name="create mask"/> parameter. To allow a user to modify all the
-	user/group/world permissions on a file, set this parameter to 0777.
-	</para>
-
-	<para>
-	Next Samba checks the changed permissions for a file against the bits set in the 
-	<smbconfoption name="force security mode"/> parameter. Any bits 
-	that were changed that correspond to bits set to <emphasis>1</emphasis> in this parameter 
-	are forced to be set.</para>
-
-	<para>
-	Essentially, bits set in the <parameter>force security mode</parameter> parameter
-	may be treated as a set of bits that, when modifying security on a file, the user 
-	has always set to be <emphasis>on</emphasis>.</para>
-
-	<para>
-	If not explicitly set, this parameter defaults to the same value 
-	as the <smbconfoption name="force create mode"/> parameter.
-	To allow a user to modify all the user/group/world permissions on a file
-	with no restrictions, set this parameter to 000. The
-	<smbconfoption name="security mask"/> and <parameter>force 
-	security mode</parameter> parameters are applied to the change 
-	request in that order.</para>
-
-	<para>
-	For a directory, Samba performs the same operations as 
-	described above for a file except it uses the parameter <parameter>
-	directory security mask</parameter> instead of <parameter>security 
-	mask</parameter>, and <parameter>force directory security mode
-	</parameter> parameter instead of <parameter>force security mode
-	</parameter>.</para>
-
-	<para>
-	The <smbconfoption name="directory security mask"/> parameter 
-	by default is set to the same value as the <parameter>directory mask
-	</parameter> parameter and the <parameter>force directory security 
-	mode</parameter> parameter by default is set to the same value as 
-	the <smbconfoption name="force directory mode"/> parameter.
-	In this way Samba enforces the permission restrictions that 
-	an administrator can set on a Samba share, while still allowing users 
-	to modify the permission bits within that restriction.</para>
-
-	<para>
-	If you want to set up a share that allows users full control
-	in modifying the permission bits on their files and directories and
-	does not force any particular bits to be set <emphasis>on</emphasis>,
-	then set the following parameters in the &smb.conf; file in that
-	share-specific section:
-	</para>
-
-<?latex \newpage ?>
-	<smbconfblock>
-		<smbconfoption name="security mask">0777</smbconfoption>
-		<smbconfoption name="force security mode">0</smbconfoption>
-		<smbconfoption name="directory security mask">0777</smbconfoption>
-		<smbconfoption name="force directory security mode">0</smbconfoption>
-	</smbconfblock>
-
-</sect2>
-
-<sect2>
-	<title>Interaction with the Standard Samba File Attribute Mapping</title>
-
-	<note>
-	<para>
-	Samba maps some of the DOS attribute bits (such as <quote>read-only</quote>)
-	into the UNIX permissions of a file. This means there can 
-	be a conflict between the permission bits set via the security 
-	dialog and the permission bits set by the file attribute mapping.
-	</para>
-	</note>
-
-	<para>
-	If a file has no UNIX read access for the owner, it will show up
-	as <quote>read-only</quote> in the standard file attributes tabbed dialog.
-	Unfortunately, this dialog is the same one that contains the security information
-	in another tab.
-	</para>
-
-	<para>
-	What this can mean is that if the owner changes the permissions
-	to allow himself or herself read access using the security dialog, clicks on
-	<guibutton>OK</guibutton> to get back to the standard attributes tab 
-	dialog, and clicks on <guibutton>OK</guibutton> on that dialog, then 
-	NT will set the file permissions back to read-only (as that is what 
-	the attributes still say in the dialog). This means that after setting 
-	permissions and clicking on <guibutton>OK</guibutton> to get back to the 
-	attributes dialog, you should always press <guibutton>Cancel</guibutton> 
-	rather than <guibutton>OK</guibutton> to ensure that your changes 
-	are not overridden.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Windows NT/200X ACLs and POSIX ACLs Limitations</title>
-
-	<para>
-	Windows administrators are familiar with simple ACL controls, and they typically
-	consider that UNIX user/group/other (ugo) permissions are inadequate and not
-	sufficiently fine-grained.
-	</para>
-
-	<para>
-	Competing SMB implementations differ in how they handle Windows ACLs. Samba handles
-	Windows ACLs from the perspective of UNIX file system administration and thus adopts
-	the limitations of POSIX ACLs. Therefore, where POSIX ACLs lack a capability of the
-	Windows NT/200X ACLs, the POSIX semantics and limitations are imposed on the Windows
-	administrator.
-	</para>
-
-	<para>
-	POSIX ACLs present an interesting challenge to the UNIX administrator and therefore
-	force a compromise to be applied to Windows ACLs administration. POSIX ACLs are not
-	covered by an official standard; rather, the latest standard is a draft standard
-	1003.1e revision 17. This is the POSIX document on which the Samba implementation has
-	been implemented.
-	</para>
-
-	<para>
-	UNIX vendors differ in the manner in which POSIX ACLs are implemented. There are a
-	number of Linux file systems that support ACLs. Samba has to provide a way to make
-	transparent all the differences between the various implementations of POSIX ACLs.
-	The pressure for ACLs support in Samba has noticeably increased the pressure to
-	standardize ACLs support in the UNIX world.
-	</para>
-
-	<para>
-	Samba has to deal with the complicated matter of handling the challenge of the Windows
-	ACL that implements <emphasis>inheritance</emphasis>, a concept not anticipated by POSIX
-	ACLs as implemented in UNIX file systems. Samba provides support for <emphasis>masks</emphasis>
-	that permit normal ugo and ACLs functionality to be overridden. This further complicates
-	the way in which Windows ACLs must be implemented.
-	</para>
-
-	<sect3>
-	<title>UNIX POSIX ACL Overview</title>
-
-	<para>
-	In examining POSIX ACLs we must consider the manner in which they operate for 
-	both files and directories. File ACLs have the following significance:
-<screen>
-# file: testfile      <- the file name
-# owner: jeremy       <-- the file owner
-# group: users        <-- the POSIX group owner
-user::rwx             <-- perms for the file owner (user)
-user:tpot:r-x         <-- perms for the additional user `tpot'
-group::r--            <-- perms for the file group owner (group)
-group:engrs:r--       <-- perms for the additonal group `engineers'
-mask:rwx              <-- the mask that is `ANDed' with groups
-other::---            <-- perms applied to everyone else (other)
-</screen>
-	Directory ACLs have the following signficance:
-<screen>
-# file: testdir       <-- the directory name
-# owner: jeremy       <-- the directory owner
-# group: jeremy       <-- the POSIX group owner
-user::rwx             <-- directory perms for owner (user)
-group::rwx            <-- directory perms for owning group (group)
-mask::rwx             <-- the mask that is `ANDed' with group perms
-other:r-x             <-- perms applied to everyone else (other)
-default:user::rwx     <-- inherited owner perms
-default:user:tpot:rwx <-- inherited extra perms for user `tpot'
-default:group::r-x    <-- inherited group perms
-default:mask:rwx      <-- inherited default mask
-default:other:---     <-- inherited permissions for everyone (other)
-</screen>
-	</para>
-
-	</sect3>
-
-	<sect3>
-	<title>Mapping of Windows File ACLs to UNIX POSIX ACLs</title>
-
-	<para>
-	Microsoft Windows NT4/200X ACLs must of necessity be mapped to POSIX ACLs.
-	The mappings for file permissions are shown in <link linkend="fdsacls">How
-	Windows File ACLs Map to UNIX POSIX File ACLs</link>.
-	The # character means this flag is set only when the Windows administrator
-	sets the <constant>Full Control</constant> flag on the file.
-	</para>
-
-	<table frame='all' pgwide='0' id="fdsacls"><title>How Windows File ACLs Map to UNIX POSIX File ACLs</title>
-	<tgroup cols='2'>
-		<colspec align="left"/>
-		<colspec align="center"/>
-		<thead>
-		<row>
-			<entry align="left">Windows ACE</entry>
-			<entry align="center">File Attribute Flag</entry>
-		</row>
-		</thead>
-		<tbody>
-		<row>
-			<entry><para>Full Control</para></entry>
-			<entry><para>#</para></entry>
-		</row>
-		<row>
-			<entry><para>Traverse Folder/Execute File</para></entry>
-			<entry><para>x</para></entry>
-		</row>
-		<row>
-			<entry><para>List Folder/Read Data</para></entry>
-			<entry><para>r</para></entry>
-		</row>
-		<row>
-			<entry><para>Read Attributes</para></entry>
-			<entry><para>r</para></entry>
-		</row>
-		<row>
-			<entry><para>Read Extended Attribures</para></entry>
-			<entry><para>r</para></entry>
-		</row>
-		<row>
-			<entry><para>Create Files/Write Data</para></entry>
-			<entry><para>w</para></entry>
-		</row>
-		<row>
-			<entry><para>Create Folders/Append Data</para></entry>
-			<entry><para>w</para></entry>
-		</row>
-		<row>
-			<entry><para>Write Attributes</para></entry>
-			<entry><para>w</para></entry>
-		</row>
-		<row>
-			<entry><para>Write Extended Attributes</para></entry>
-			<entry><para>w</para></entry>
-		</row>
-		<row>
-			<entry><para>Delete Subfolders and Files</para></entry>
-			<entry><para>w</para></entry>
-		</row>
-		<row>
-			<entry><para>Delete</para></entry>
-			<entry><para>#</para></entry>
-		</row>
-		<row>
-			<entry><para>Read Permissions</para></entry>
-			<entry><para>all</para></entry>
-		</row>
-		<row>
-			<entry><para>Change Permissions</para></entry>
-			<entry><para>#</para></entry>
-		</row>
-		<row>
-			<entry><para>Take Ownership</para></entry>
-			<entry><para>#</para></entry>
-		</row>
-		</tbody>
-	</tgroup>
-	</table>
-
-	<para>
-	As can be seen from the mapping table, there is no one-to-one mapping capability, and therefore
-	Samba must make a logical mapping that will permit Windows to operate more-or-less the way
-	that is intended by the administrator.
-	</para>
-
-	<para>
-	In general the mapping of UNIX POSIX user/group/other permissions will be mapped to
-	Windows ACLs. This has precedence over the creation of POSIX ACLs. POSIX ACLs are necessary
-	to establish access controls for users and groups other than the user and group that
-	own the file or directory.
-	</para>
-
-	<para>
-	The UNIX administrator can set any directory permission from within the UNIX environment.
-	The Windows administrator is more restricted in that it is not possible from within 
-	Windows Explorer to remove read permission for the file owner.
-	</para>
-
-	</sect3>
-
-	<sect3>
-	<title>Mapping of Windows Directory ACLs to UNIX POSIX ACLs</title>
-
-	<para>
-	Interesting things happen in the mapping of UNIX POSIX directory permissions and
-	UNIX POSIX ACLs to Windows ACEs (Access Control Entries, the discrete components of
-	an ACL) are mapped to Windows directory ACLs.
-	</para>
-
-	<para>
-	Directory permissions function in much the same way as shown for file permissions, but
-	there are some notable exceptions and a few peculiarities that the astute administrator
-	will want to take into account in the setting up of directory permissions.
-	</para>
-
-	</sect3>
-
-	</sect2>
-</sect1>
-
-<sect1>
-<title>Common Errors</title>
-
-<para>
-File, directory, and share access problems are common topics on the mailing list. The following
-are examples recently taken from the mailing list.
-</para>
-
-
-	<sect2>
-	<title>Users Cannot Write to a Public Share</title>
-
-	<para>
-	The following complaint has frequently been voiced on the Samba mailing list: 
-	<quote>
-	We are facing some troubles with file/directory permissions. I can log on the domain as admin user (root),
-	and there's a public share on which everyone needs to have permission to create/modify files, but only
-	root can change the file, no one else can. We need to constantly go to the server to
-	<userinput>chgrp -R users *</userinput> and <userinput>chown -R nobody *</userinput> to allow
-	other users to change the file.
-	</quote>
-	</para>
-
-	<para>
-	Here is one way the problem can be solved:
-	</para>
-
-	<procedure>
-		<step>
-			<para>
-			Go to the top of the directory that is shared.
-			</para>
-		</step>
-
-		<step>
-			<para>
-			Set the ownership to whatever public user and group you want
-<screen>
-&prompt;find `directory_name' -type d -exec chown user:group {}\;
-&prompt;find `directory_name' -type d -exec chmod 2775 {}\;
-&prompt;find `directory_name' -type f -exec chmod 0775 {}\;
-&prompt;find `directory_name' -type f -exec chown user:group {}\;
-</screen>
-			</para>
-
-			<note><para>
-			The above will set the <constant>SGID bit</constant> on all directories. Read your
-			UNIX/Linux man page on what that does. This ensures that all files and directories
-			that are created in the directory tree will be owned by the current user and will
-			be owned by the group that owns the directory in which it is created.
-			</para></note>
-		</step>
-		<step>
-			<para>
-			Directory is <replaceable>/foodbar</replaceable>:
-<screen>
-&prompt;<userinput>chown jack:engr /foodbar</userinput>
-</screen>
-			</para>
-
-			<note>
-			<para>This is the same as doing:</para>
-<screen>
-&prompt;<userinput>chown jack /foodbar</userinput>
-&prompt;<userinput>chgrp engr /foodbar</userinput>
-</screen>
-			</note>
-		</step>
-		<step>
-			<para>Now type: 
-
-<screen>
-&prompt;<userinput>chmod 2775 /foodbar</userinput>
-&prompt;<userinput>ls -al /foodbar/..</userinput>
-</screen>
-			</para>
-		
-			<para>You should see:
-<screen>
-drwxrwsr-x  2 jack  engr    48 2003-02-04 09:55 foodbar
-</screen>
-			</para>
-		</step>
-		<step>
-
-		<para>Now type:
-<screen>
-&prompt;<userinput>su - jill</userinput>
-&prompt;<userinput>cd /foodbar</userinput>
-&prompt;<userinput>touch Afile</userinput>
-&prompt;<userinput>ls -al</userinput>
-</screen>
-		</para>
-
-		<para>
-		You should see that the file <filename>Afile</filename> created by Jill will have ownership
-		and permissions of Jack, as follows:
-<screen>
--rw-r--r--  1 jill  engr     0 2007-01-18 19:41 Afile
-</screen>
-		</para>
-		</step>
-
-		<step>
-		<para>
-		If the user that must have write permission in the directory is not a member of the group
-		<emphasis>engr</emphasis> set in the &smb.conf; entry for the share:
-		<smbconfblock>
-<smbconfoption name="force group">engr</smbconfoption>
-		</smbconfblock>
-		</para>
-	</step>
-	</procedure>
-	</sect2>
-
-
-	<sect2>
-		<title>File Operations Done as <emphasis>root</emphasis> with <emphasis>force user</emphasis> Set</title>
-
-		<para>
-		When you have a user in <smbconfoption name="admin users"/>, Samba will always do file operations for
-		this user as <emphasis>root</emphasis>, even if <smbconfoption name="force user"/> has been set.
-		</para>
-	</sect2>
-	
-	<sect2>
-		<title>MS Word with Samba Changes Owner of File</title>
-
-		<para>
-		<emphasis>Question:</emphasis> <quote>When user B saves a word document that is owned by user A,
-		the updated file is now owned by user B.  Why is Samba doing this? How do I fix this?</quote>
-		</para>
-
-		<para>
-		<emphasis>Answer:</emphasis> Word does the following when you modify/change a Word document: MS Word creates a new document with
-		a temporary name. Word then closes the old document and deletes it, then renames the new document to the original document name.
-		There is no mechanism by which Samba can in any way know that the new document really should be owned by the owners
-		of the original file. Samba has no way of knowing that the file will be renamed by MS Word. As far as Samba is able
-		to tell, the file that gets created is a new file, not one that the application (Word) is updating.
-		</para>
-
-		<para>
-		There is a workaround to solve the permissions problem. It involves understanding how you can manage file
-		system behavior from within the &smb.conf; file, as well as understanding how UNIX file systems work. Set on the directory
-		in which you are changing Word documents: <command>chmod g+s `directory_name'.</command> This ensures that all files will
-		be created with the group that owns the directory. In &smb.conf; share declaration section set:
-		</para>
-
-		<para>
-		<smbconfblock>
-                <smbconfoption name="force create mode">0660</smbconfoption>
-                <smbconfoption name="force directory mode">0770</smbconfoption>
-		</smbconfblock>
-		</para>
-
-		<para>
-		These two settings will ensure that all directories and files that get created in the share will be readable/writable by the
-		owner and group set on the directory itself.
-		</para>
-		
-	</sect2>
-
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-AdvancedNetworkAdmin.xml b/docs-xml/Samba3-HOWTO/TOSHARG-AdvancedNetworkAdmin.xml
deleted file mode 100644
index a6c1af0..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-AdvancedNetworkAdmin.xml
+++ /dev/null
@@ -1,485 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="AdvancedNetworkManagement">
-<chapterinfo>
-	&author.jht;
-    <pubdate>June 15 2005</pubdate>
-</chapterinfo>
-
-<title>Advanced Network Management</title>
-
-<para>
-<indexterm><primary>access control</primary></indexterm>
-This section documents peripheral issues that are of great importance to network
-administrators who want to improve network resource access control, to automate the user
-environment, and to make their lives a little easier.
-</para>
-
-<sect1>
-<title>Features and Benefits</title>
-
-<para>
-Often the difference between a working network environment and a well-appreciated one can
-best be measured by the <emphasis>little things</emphasis> that make everything work more
-harmoniously. A key part of every network environment solution is the ability to remotely
-manage MS Windows workstations, remotely access the Samba server, provide customized
-logon scripts, as well as other housekeeping activities that help to sustain more reliable
-network operations.
-</para>
-
-<para>
-This chapter presents information on each of these areas. They are placed here, and not in
-other chapters, for ease of reference.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Remote Server Administration</title>
-
-
-<para><quote>How do I get User Manager and Server Manager?</quote></para>
-
-<para>
-<indexterm><primary>User Manager</primary></indexterm>
-<indexterm><primary>Server Manager</primary></indexterm>
-<indexterm><primary>Event Viewer</primary></indexterm>
-Since I do not need to buy an <application>NT4 server</application>, how do I get the User Manager for Domains
-and the Server Manager?
-</para>
-
-<para>
-<indexterm><primary>Nexus.exe</primary></indexterm>
-<indexterm><primary>Windows 9x/Me</primary></indexterm>
-Microsoft distributes a version of these tools called <filename>Nexus.exe</filename> for installation 
-on <application>Windows 9x/Me</application> systems. The tools set includes:
-</para>
-
-<itemizedlist>
-	<listitem><para>Server Manager</para></listitem>
-	<listitem><para>User Manager for Domains</para></listitem>
-	<listitem><para>Event Viewer</para></listitem>
-</itemizedlist>
-
-<para>
-Download the archived file at the Microsoft <ulink noescape="1"
-url="ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE">Nexus</ulink> link.
-</para>
-
-<para>
-<indexterm><primary>SRVTOOLS.EXE</primary></indexterm>
-<indexterm><primary>User Manager for Domains</primary></indexterm>
-<indexterm><primary>Server Manager</primary></indexterm>
-The <application>Windows NT 4.0</application> version of the User Manager for 
-Domains and Server Manager are available from Microsoft
-<ulink url="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE">via ftp</ulink>.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Remote Desktop Management</title>
-
-<para>
-<indexterm><primary>remote desktop management</primary></indexterm>
-<indexterm><primary>network environment</primary></indexterm>
-There are a number of possible remote desktop management solutions that range from free
-through costly. Do not let that put you off. Sometimes the most costly solution is the
-most cost effective. In any case, you will need to draw your own conclusions as to which
-is the best tool in your network environment.
-</para>
-
-	<sect2>
-	<title>Remote Management from NoMachine.Com</title>
-
-	<para>
-	<indexterm><primary>NoMachine.Com</primary></indexterm>
-	The following information was posted to the Samba mailing list at Apr 3 23:33:50 GMT 2003.
-	It is presented in slightly edited form (with author details omitted for privacy reasons).
-	The entire answer is reproduced below with some comments removed.
-	</para>
-
-		<para><quote>
-<indexterm><primary>remote desktop capabilities</primary></indexterm>
-		I have a wonderful Linux/Samba server running as PDC for a network. Now I would like to add remote
-		desktop capabilities so users outside could login to the system and get their desktop up from home or
-		another country.
-		</quote></para>
-
-		<para><quote>
-<indexterm><primary>Windows Terminal server</primary></indexterm>
-<indexterm><primary>BDC</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>remote login</primary></indexterm>
-		Is there a way to accomplish this? Do I need a Windows Terminal server?  Do I need to configure it so
-		it is a member of the domain or a BDC or PDC? Are there any hacks for MS Windows XP to enable remote login
-		even if the computer is in a domain?
-		</quote></para>
-
-		<para>
-		Answer provided: Check out the new offer of <quote>NX</quote> software from
-		<ulink noescape="1" url="http://www.nomachine.com/">NoMachine</ulink>.
-		</para>
-
-	<para>
-<indexterm><primary>Remote X protocol</primary></indexterm>
-<indexterm><primary>VNC/RFB</primary></indexterm>
-<indexterm><primary>rdesktop/RDP</primary></indexterm>
-	It implements an easy-to-use interface to the Remote X protocol as
-	well as incorporating VNC/RFB and rdesktop/RDP into it, but at a speed
-	performance much better than anything you may have ever seen.
-	</para>
-
-	<para>
-<indexterm><primary>modem/ISDN</primary></indexterm>
-	Remote X is not new at all, but what they did achieve successfully is
-	a new way of compression and caching technologies that makes the thing
-	fast enough to run even over slow modem/ISDN connections.
-	</para>
-
-	<para>
-<indexterm><primary>KDE konqueror</primary></indexterm>
-<indexterm><primary>mouse-over</primary></indexterm>
-<indexterm><primary>rdesktop</primary></indexterm>
-<indexterm><primary></primary></indexterm>
-	I test drove their (public) Red Hat machine in Italy, over a loaded
-	Internet connection, with enabled thumbnail previews in KDE konqueror,
-	which popped up immediately on <quote>mouse-over</quote>. From inside that (remote X)
-	session I started a rdesktop session on another, a Windows XP machine.
-	To test the performance, I played Pinball. I am proud to announce
-	that my score was 631,750 points at first try.
-	</para>
-
-	<para>
-<indexterm><primary>NX</primary></indexterm>
-<indexterm><primary>TightVNC</primary></indexterm>
-<indexterm><primary>rdesktop</primary></indexterm>
-<indexterm><primary>Remote X</primary></indexterm>
-	NX performs better on my local LAN than any of the other <quote>pure</quote>
-	connection methods I use from time to time: TightVNC, rdesktop or
-	Remote X. It is even faster than a direct crosslink connection between
-	two nodes.
-	</para>
-
-	<para>
-<indexterm><primary>Remote X</primary></indexterm>
-<indexterm><primary>KDE session</primary></indexterm>
-<indexterm><primary>copy'n'paste</primary></indexterm>
-	I even got sound playing from the Remote X app to my local boxes, and
-	had a working <quote>copy'n'paste</quote> from an NX  window (running a KDE session
-	in Italy) to my Mozilla mailing agent. These guys are certainly doing
-	something right!
-	</para>
-
-	<para>
-	I recommend test driving NX to anybody with a only a passing interest in remote computing
-	the <ulink noescape="1" url="http://www.nomachine.com/testdrive.php">NX</ulink> utility.
-	</para>
-
-	<para>
-	Just download the free-of-charge client software (available for Red Hat,
-	SuSE, Debian and Windows) and be up and running within 5 minutes (they
-	need to send you your account data, though, because you are assigned
-	a real UNIX account on their testdrive.nomachine.com box).
-	</para>
-
-	<para>
-	They plan to get to the point were you can have NX application servers
-	running as a cluster of nodes, and users simply start an NX session locally
-	and can select applications to run transparently (apps may even run on
-	another NX node, but pretend to be on the same as used for initial login,
-	because it displays in the same window. You also can run it
-	full-screen, and after a short time you forget that it is a remote session
-	at all).
-	</para>
-
-	<para>
-<indexterm><primary>GPL</primary></indexterm>
-	Now the best thing for last: All the core compression and caching
-	technologies are released under the GPL and available as source code
-	to anybody who wants to build on it! These technologies are working,
-	albeit started from the command line only (and very inconvenient to
-	use in order to get a fully running remote X session up and running).
-	</para>
-
-	<para>
-	To answer your questions:
-	</para>
-
-	<itemizedlist>
-		<listitem><para>
-		You do not need to install a terminal server; XP has RDP support built in.
-		</para></listitem>
-
-		<listitem><para>
-		NX is much cheaper than Citrix &smbmdash; and comparable in performance, probably faster.
-		</para></listitem>
-
-		<listitem><para>
-		You do not need to hack XP &smbmdash; it just works.
-		</para></listitem>
-
-		<listitem><para>
-		You log into the XP box from remote transparently (and I think there is no
-		need to change anything to get a connection, even if authentication is against a domain).
-		</para></listitem>
-
-		<listitem><para>
-		The NX core technologies are all Open Source and released under the GPL &smbmdash;
-		you can now use a (very inconvenient) command line at no cost,
-		but you can buy a comfortable (proprietary) NX GUI front end for money.
-		</para></listitem>
-
-		<listitem><para>
-<indexterm><primary>OSS/Free Software</primary></indexterm>
-<indexterm><primary>LTSP</primary></indexterm>
-<indexterm><primary>KDE</primary></indexterm>
-<indexterm><primary>GNOME</primary></indexterm>
-<indexterm><primary>NoMachine</primary></indexterm>
-		NoMachine is encouraging and offering help to OSS/Free Software implementations
-		for such a front-end too, even if it means competition to them (they have written
-		to this effect even to the LTSP, KDE, and GNOME developer mailing lists).
-		</para></listitem>
-	</itemizedlist>
-
-	</sect2>
-	<sect2>
-	<title>Remote Management with ThinLinc</title>
-	<para>
-	Another alternative for remote access is <emphasis>ThinLinc</emphasis> from Cendio.
-	</para>
-
-	<para>
-<indexterm><primary>ThinLinc</primary></indexterm>
-<indexterm><primary>terminal server</primary></indexterm>
-<indexterm><primary>Linux</primary></indexterm>
-<indexterm><primary>Solaris</primary></indexterm>
-<indexterm><primary>TightVNC</primary></indexterm>
-<indexterm><primary>SSH</primary></indexterm>
-<indexterm><primary>NFS</primary></indexterm>
-<indexterm><primary>PulseAudio</primary></indexterm>
-	ThinLinc is a terminal server solution that is available for Linux and Solaris based on standard
-	protocols such as SSH, TightVNC, NFS and PulseAudio.
-	</para>
-
-	<para>
-<indexterm><primary>LAN</primary></indexterm>
-<indexterm><primary>thin client</primary></indexterm>
-	ThinLinc can be used both in the LAN environment to implement a Thin Client strategy for an organization, and as
-	secure remote access solution for people working from remote locations, even over smallband connections.
-	ThinLinc is free to use for a single concurrent user.
-	</para>
-
-	<para>
-<indexterm><primary>Citrix</primary></indexterm>
-<indexterm><primary>Windows Terminal Server</primary></indexterm>
-<indexterm><primary>Java</primary></indexterm>
-	The product can also be used as a frontend to access Windows Terminal Server or Citrix farms, or even Windows
-	XP machines, securing the connection via the ssh protocol. The client is available both for Linux (supporting
-	all Linux distributions as well as numerous thin terminals) and for Windows. A Java-based Web client is also
-	available.
-	</para>
-
-	<para>
-	ThinLinc may be evaluated by connecting to Cendio's demo system, see
-	<ulink noescape="1" url="http://www.cendio.com">Cendio's</ulink> web site
-	<ulink noescape="1" url="http://www.cendio.com/testdrive">testdrive</ulink> center.
-	</para>
-
-	<para>
-	Cendio is a major contributor to several open source projects including
-	<ulink noescape="1" url="http://www.tightvnc.com">TightVNC</ulink>,
-	<ulink noescape="1" url="http://pulseaudio.org">PulseAudio</ulink> , unfsd,
-	<ulink noescape="1" url="http://www.python.org">Python</ulink> and
-	<ulink noescape="1" url="http://www.rdesktop.org">rdesktop</ulink>.
-	</para>
-
-	</sect2>
-</sect1>
-
-<sect1>
-<title>Network Logon Script Magic</title>
-
-<para>
-There are several opportunities for creating a custom network startup configuration environment.
-</para>
-
-<itemizedlist>
-	<listitem><para>No Logon Script.</para></listitem>
-	<listitem><para>Simple universal Logon Script that applies to all users.</para></listitem>
-	<listitem><para>Use of a conditional Logon Script that applies per-user or per-group attributes.</para></listitem>
-	<listitem><para>Use of Samba's preexec and postexec functions on access to the NETLOGON share to create
-		a custom logon script and then execute it.</para></listitem>
-	<listitem><para>User of a tool such as KixStart.</para></listitem>
-</itemizedlist>
-
-<para>
-The Samba source code tree includes two logon script generation/execution tools.
-See <filename>examples</filename> directory <filename>genlogon</filename> and
-<filename>ntlogon</filename> subdirectories.
-</para>
-
-<para>
-The following listings are from the genlogon directory.
-</para>
-
-
-<para>
-<indexterm><primary>genlogon.pl</primary></indexterm>
-This is the <filename>genlogon.pl</filename> file:
-
-<programlisting>
-	#!/usr/bin/perl
-	#
-	# genlogon.pl
-	#
-	# Perl script to generate user logon scripts on the fly, when users
-	# connect from a Windows client. This script should be called from 
-	# smb.conf with the %U, %G and %L parameters. I.e:
-	#
-	#       root preexec = genlogon.pl %U %G %L
-	#
-	# The script generated will perform
-	# the following:
-	#
-	# 1. Log the user connection to /var/log/samba/netlogon.log
-	# 2. Set the PC's time to the Linux server time (which is maintained
-	#    daily to the National Institute of Standards Atomic clock on the
-	#    internet.
-	# 3. Connect the user's home drive to H: (H for Home).
-	# 4. Connect common drives that everyone uses.
-	# 5. Connect group-specific drives for certain user groups.
-	# 6. Connect user-specific drives for certain users.
-	# 7. Connect network printers.
-
-	# Log client connection
-	#($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
-	($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
-	open LOG, ">>/var/log/samba/netlogon.log";
-	print LOG "$mon/$mday/$year $hour:$min:$sec";
-	print LOG " - User $ARGV[0] logged into $ARGV[1]\n";
-	close LOG;
-
-	# Start generating logon script
-	open LOGON, ">/shared/netlogon/$ARGV[0].bat";
-	print LOGON "\@ECHO OFF\r\n";
-
-	# Connect shares just use by Software Development group
-	if ($ARGV[1] eq "SOFTDEV" || $ARGV[0] eq "softdev")
-	{
-		print LOGON "NET USE M: \\\\$ARGV[2]\\SOURCE\r\n";
-	}
-
-	# Connect shares just use by Technical Support staff
-	if ($ARGV[1] eq "SUPPORT" || $ARGV[0] eq "support")
-	{
-		print LOGON "NET USE S: \\\\$ARGV[2]\\SUPPORT\r\n";
-	}
-
-	# Connect shares just used by Administration staff
-	If ($ARGV[1] eq "ADMIN" || $ARGV[0] eq "admin")
-	{
-		print LOGON "NET USE L: \\\\$ARGV[2]\\ADMIN\r\n";
-		print LOGON "NET USE K: \\\\$ARGV[2]\\MKTING\r\n";
-	}
-
-	# Now connect Printers. We handle just two or three users a little
-	# differently, because they are the exceptions that have desktop
-	# printers on LPT1: - all other user's go to the LaserJet on the
-	# server.
-	if ($ARGV[0] eq 'jim'
-	    || $ARGV[0] eq 'yvonne')
-	{
-		print LOGON "NET USE LPT2: \\\\$ARGV[2]\\LJET3\r\n";
-		print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
-	}
-	else
-	{
-		print LOGON "NET USE LPT1: \\\\$ARGV[2]\\LJET3\r\n";
-		print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
-	}
-
-	# All done! Close the output file.
-	close LOGON;
-</programlisting>
-</para>
-
-<para>
-Those wishing to use a more elaborate or capable logon processing system should check out these sites:
-</para>
-
-<itemizedlist>
-	<listitem><para><ulink noescape="1" url="http://www.craigelachie.org/rhacer/ntlogon">http://www.craigelachie.org/rhacer/ntlogon</ulink></para></listitem>
-	<listitem><para><ulink noescape="1" url="http://www.kixtart.org">http://www.kixtart.org</ulink></para></listitem>
-</itemizedlist>
-
-<sect2>
-<title>Adding Printers without User Intervention</title>
-
-
-<para>
-<indexterm><primary>rundll32</primary></indexterm>
-Printers may be added automatically during logon script processing through the use of:
-<screen>
-&dosprompt;<userinput>rundll32 printui.dll,PrintUIEntry /?</userinput>
-</screen>
-
-See the documentation in the <ulink url="http://support.microsoft.com/default.asp?scid=kb;en-us;189105">Microsoft Knowledge Base article 189105</ulink>.
-</para>
-</sect2>
-
-<sect2>
-	<title>Limiting Logon Connections</title>
-
-	<para>
-		Sometimes it is necessary to limit the number of concurrent connections to a
-		Samba shared resource. For example, a site may wish to permit only one network
-		logon per user.
-	</para>
-
-	<para>
-		The Samba <parameter>preexec script</parameter> parameter can be used to permit only one
-		connection per user. Though this method is not foolproof and may have side effects,
-		the following contributed method may inspire someone to provide a better solution.
-	</para>
-
-	<para>
-		This is not a perfect solution because Windows clients can drop idle connections
-		with an auto-reconnect capability that could result in the appearance that a share
-		is no longer in use, while actually it is. Even so, it demonstrates the principle
-		of use of the <parameter>preexec script</parameter> parameter.
-	</para>
-
-	<para>
-		The following share configuration demonstrates use of the script shown in <link linkend="Tpees"/>.
-<programlisting>
-[myshare]
-	...
-	preexec script = /sbin/PermitSingleLogon.sh
-	preexec close = Yes
-	...
-</programlisting>
-	</para>
-
-<example id="Tpees">
-<title>Script to Enforce Single Resource Logon</title>
-<screen>
-#!/bin/bash
-
-IFS="-"
-RESULT=$(smbstatus -S -u $1 2> /dev/null | awk 'NF \
-        > 6 {print $1}' | sort | uniq -d)
-
-if [ "X${RESULT}" == X  ]; then
-  exit 0
-else
-  exit 1
-fi
-</screen>
-</example>
-
-</sect2>
-
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-BDC.xml b/docs-xml/Samba3-HOWTO/TOSHARG-BDC.xml
deleted file mode 100644
index 9b69368..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-BDC.xml
+++ /dev/null
@@ -1,707 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="samba-bdc">
-
-<chapterinfo>
-	&author.jht;
-	&author.vl;
-	<author>&person.gd;<contrib>LDAP updates</contrib></author>
-</chapterinfo>
-
-<title>Backup Domain Control</title>
-
-<para>
-Before you continue reading this section, please make sure that you are comfortable
-with configuring a Samba domain controller as described in <link linkend="samba-pdc">Domain Control</link>.
-</para>
-
-<sect1>
-<title>Features and Benefits</title>
-
-<para>
-This is one of the most difficult chapters to summarize. It does not matter what we say here, for someone will
-still draw conclusions and/or approach the Samba Team with expectations that are either not yet capable of
-being delivered or that can be achieved far more effectively using a totally different approach. In the event
-that you should have a persistent concern that is not addressed in this book, please email <ulink
-url="mailto:jht at samba.org">John H. Terpstra</ulink> clearly setting out your requirements and/or question, and
-we will do our best to provide a solution.
-</para>
-
-<para>
-<indexterm><primary>SAM backend</primary><secondary>LDAP</secondary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>BDC</primary></indexterm>
-<indexterm><primary>LDAP</primary><secondary>slave</secondary></indexterm>
-<indexterm><primary>scalability</primary></indexterm>
-Samba-3 can act as a Backup Domain Controller (BDC) to another Samba Primary Domain Controller (PDC). A
-Samba-3 PDC can operate with an LDAP account backend. The LDAP backend can be either a common master LDAP
-server or a slave server. The use of a slave LDAP server has the benefit that when the master is down, clients
-may still be able to log onto the network.  This effectively gives Samba a high degree of scalability and is
-an effective solution for large organizations. If you use an LDAP slave server for a PDC, you will need to
-ensure the master's continued availability &smbmdash; if the slave finds its master down at the wrong time,
-you will have stability and operational problems.
-</para>
-
-<para>
-<indexterm><primary>two-way</primary><secondary>propagation</secondary></indexterm>
-<indexterm><primary>replication</primary><secondary>SAM</secondary></indexterm>
-<indexterm><primary>non-LDAP</primary><secondary>backend</secondary></indexterm>
-<indexterm><primary>propagate</primary></indexterm>
-It is not possible to run a Samba-3 BDC with a non-LDAP backend, as that backend must allow some form of
-"two-way" propagation of changes from the BDC to the master.  At this time only LDAP delivers the capability
-to propagate identity database changes from the BDC to the PDC. The BDC can use a slave LDAP server, while it
-is preferable for the PDC to use as its primary an LDAP master server.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Essential Background Information</title>
-
-<para>
-<indexterm><primary>domain controller</primary></indexterm>
-<indexterm><primary>logon requests</primary></indexterm>
-<indexterm><primary>LanMan</primary></indexterm>
-<indexterm><primary>Netlogon</primary></indexterm>
-A domain controller is a machine that is able to answer logon requests from network
-workstations. Microsoft LanManager and IBM LanServer were two early products that
-provided this capability. The technology has become known as the LanMan Netlogon service.
-</para>
-
-<para>
-<indexterm><primary>network</primary><secondary>logon</secondary><tertiary>service</tertiary></indexterm>
-<indexterm><primary>Windows NT3.10</primary></indexterm>
-When MS Windows NT3.10 was first released, it supported a new style of Domain Control
-and with it a new form of the network logon service that has extended functionality.
-This service became known as the NT NetLogon Service. The nature of this service has
-changed with the evolution of MS Windows NT and today provides a complex array of
-services that are implemented over an intricate spectrum of technologies.
-</para>
-
-<sect2>
-<title>MS Windows NT4-style Domain Control</title>
-
-<para>
-<indexterm><primary>domain controller</primary></indexterm>
-<indexterm><primary>authentication server</primary></indexterm>
-<indexterm><primary>username</primary></indexterm>
-<indexterm><primary>password</primary></indexterm>
-<indexterm><primary>SAM</primary></indexterm>
-<indexterm><primary>Security Account Manager</primary><see>SAM</see></indexterm>
-<indexterm><primary>domain control database</primary><see>SAM</see></indexterm>
-Whenever a user logs into a Windows NT4/200x/XP Professional workstation,
-the workstation connects to a domain controller (authentication server) to validate that
-the username and password the user entered are valid. If the information entered
-does not match account information that has been stored in the domain
-control database (the SAM, or Security Account Manager database), a set of error
-codes is returned to the workstation that has made the authentication request.
-</para>
-
-<para>
-<indexterm><primary>account information</primary></indexterm>
-<indexterm><primary>machine accounts database</primary></indexterm>
-<indexterm><primary>profile</primary></indexterm>
-<indexterm><primary>network access profile</primary></indexterm>
-<indexterm><primary>desktop profile</primary></indexterm>
-When the username/password pair has been validated, the domain controller
-(authentication server) will respond with full enumeration of the account information
-that has been stored regarding that user in the user and machine accounts database
-for that domain. This information contains a complete network access profile for
-the user but excludes any information that is particular to the user's desktop profile,
-or for that matter it excludes all desktop profiles for groups that the user may
-belong to. It does include password time limits, password uniqueness controls,
-network access time limits, account validity information, machine names from which the
-user may access the network, and much more. All this information was stored in the SAM
-in all versions of MS Windows NT (3.10, 3.50, 3.51, 4.0).
-</para>
-
-<para>
-<indexterm><primary>replication</primary><secondary>SAM</secondary></indexterm>
-<indexterm><primary>%SystemRoot%\System32\config</primary></indexterm>
-<indexterm><primary>C:\WinNT\System32\config</primary></indexterm>
-<indexterm><primary>BDC</primary></indexterm>
-<indexterm><primary>SAM</primary></indexterm>
-The account information (user and machine) on domain controllers is stored in two files,
-one containing the security information and the other the SAM. These are stored in files
-by the same name in the <filename>%SystemRoot%\System32\config</filename> directory. 
-This normally translates to the path <filename>C:\WinNT\System32\config</filename>. These
-are the files that are involved in replication of the SAM database where BDCs are present
-on the network.
-</para>
-
-<para>
-There are two situations in which it is desirable to install BDCs:
-</para>
-
-<itemizedlist>
-	<listitem><para>
-	<indexterm><primary>PDC</primary></indexterm>
-	<indexterm><primary>BDC</primary></indexterm>
-	On the local network that the PDC is on, if there are many
-	workstations and/or where the PDC is generally very busy. In this case the BDCs
-	will pick up network logon requests and help to add robustness to network services.
-	</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>network</primary><secondary>wide-area</secondary></indexterm>
-	At each remote site, to reduce wide-area network traffic and to add stability to
-	remote network operations. The design of the network, and the strategic placement of
-	BDCs, together with an implementation that localizes as much of network to client
-	interchange as possible, will help to minimize wide-area network bandwidth needs
-	(and thus costs).
-	</para></listitem>
-</itemizedlist>
-
-<para>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>SAM</primary></indexterm>
-<indexterm><primary>user account database</primary></indexterm>
-<indexterm><primary>BDC</primary></indexterm>
-<indexterm><primary>trigger</primary></indexterm>
-The interoperation of a PDC and its BDCs in a true Windows NT4 environment is worth
-mentioning here. The PDC contains the master copy of the SAM. In the event that an
-administrator makes a change to the user account database while physically present
-on the local network that has the PDC, the change will likely be made directly to
-the PDC instance of the master copy of the SAM. In the event that this update may
-be performed in a branch office, the change will likely be stored in a delta file
-on the local BDC. The BDC will then send a trigger to the PDC to commence the process
-of SAM synchronization. The PDC will then request the delta from the BDC and apply
-it to the master SAM. The PDC will then contact all the BDCs in the domain and
-trigger them to obtain the update and then apply that to their own copy of the SAM.
-</para>
-
-<para>
-<indexterm><primary>SAM</primary><secondary>replication</secondary></indexterm>
-<indexterm><primary>SAM</primary><secondary>delta file</secondary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>BDC</primary></indexterm>
-Samba-3 cannot participate in true SAM replication and is therefore not able to
-employ precisely the same protocols used by MS Windows NT4. A Samba-3 BDC will
-not create SAM update delta files. It will not interoperate with a PDC (NT4 or Samba)
-to synchronize the SAM from delta files that are held by BDCs.
-</para>
-
-<para>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>BDC</primary></indexterm>
-Samba-3 cannot function as a BDC to an MS Windows NT4 PDC, and Samba-3 cannot
-function correctly as a PDC to an MS Windows NT4 BDC. Both Samba-3 and MS Windows
-NT4 can function as a BDC to its own type of PDC.
-</para>
-
-<para>
-<indexterm><primary>SAM</primary></indexterm>
-<indexterm><primary>BDC</primary></indexterm>
-<indexterm><primary>domain security</primary></indexterm>
-The BDC is said to hold a <emphasis>read-only</emphasis> of the SAM from which
-it is able to process network logon requests and authenticate users. The BDC can
-continue to provide this service, particularly while, for example, the wide-area
-network link to the PDC is down. A BDC plays a very important role in both the
-maintenance of domain security as well as in network integrity.
-</para>
-
-<para>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>promoted</primary></indexterm>
-<indexterm><primary>demoted</primary></indexterm>
-<indexterm><primary>reconfiguration</primary></indexterm>
-In the event that the NT4 PDC should need to be taken out of service, or if it dies, one of the NT4 BDCs can
-be promoted to a PDC. If this happens while the original NT4 PDC is online, it is automatically demoted to an
-NT4 BDC. This is an important aspect of domain controller management. The tool that is used to effect a
-promotion or a demotion is the Server Manager for Domains. It should be noted that Samba-3 BDCs cannot be
-promoted in this manner because reconfiguration of Samba requires changes to the &smb.conf; file. It is easy
-enough to manuall change the &smb.conf; file and then restart relevant Samba network services.
-</para>
-
-<sect3>
-<title>Example PDC Configuration</title>
-
-<para>
-<indexterm><primary>domain logon</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-Beginning with Version 2.2, Samba officially supports domain logons for all current Windows clients, including
-Windows NT4, 2003, and XP Professional. For Samba to be enabled as a PDC, some parameters in the
-<smbconfsection name="[global]"/> section of the &smb.conf; have to be set.  Refer to <link
-linkend="minimalPDC">the Minimal smb.conf for a PDC in Use with a BDC &smbmdash; LDAP Server on PDC
-section</link> for an example of the minimum required settings.
-</para>
-
-<example id="minimalPDC">
-<title>Minimal smb.conf for a PDC in Use with a BDC &smbmdash; LDAP Server on PDC</title>
-<smbconfblock>
-<smbconfoption name="workgroup">&example.workgroup;</smbconfoption>
-<smbconfoption name="passdb backend">ldapsam://localhost:389</smbconfoption>
-<smbconfoption name="domain master">yes</smbconfoption>
-<smbconfoption name="domain logons">yes</smbconfoption>
-<smbconfoption name="ldap suffix">dc=quenya,dc=org</smbconfoption>
-<smbconfoption name="ldap user suffix">ou=Users</smbconfoption>
-<smbconfoption name="ldap group suffix">ou=Groups</smbconfoption>
-<smbconfoption name="ldap machine suffix">ou=Computers</smbconfoption>
-<smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
-<smbconfoption name="ldap admin dn">cn=sambadmin,dc=quenya,dc=org</smbconfoption>
-</smbconfblock>
-</example>
-
-<para>
-<indexterm><primary>profile path</primary></indexterm>
-<indexterm><primary>home drive</primary></indexterm>
-Several other things like a <smbconfsection name="[homes]"/> and a <smbconfsection name="[netlogon]"/> share
-also need to be set along with settings for the profile path, the user's home drive, and so on. This is not
-covered in this chapter; for more information please refer to <link linkend="samba-pdc">Domain Control</link>.
-Refer to <link linkend="samba-pdc">the Domain Control chapter</link> for specific recommendations for PDC
-configuration. Alternately, fully documented working example network configurations using OpenLDAP and Samba
-as available in the <ulink url="http://www.samba.org/samba/docs/Samba3-ByExample">book</ulink> <quote>Samba-3
-by Example</quote> that may be obtained from local and on-line book stores.
-</para>
-
-</sect3>
-</sect2>
-
-<sect2>
-<title>LDAP Configuration Notes</title>
-
-<para>
-<indexterm><primary>LDAP</primary><secondary>master</secondary></indexterm>
-<indexterm><primary>LDAP</primary><secondary>slave</secondary></indexterm>
-<indexterm><primary>BDC</primary></indexterm>
-When configuring a master and a slave LDAP server, it is advisable to use the master LDAP server
-for the PDC and slave LDAP servers for the BDCs. It is not essential to use slave LDAP servers; however,
-many administrators will want to do so in order to provide redundant services. Of course, one or more BDCs
-may use any slave LDAP server. Then again, it is entirely possible to use a single LDAP server for the
-entire network.
-</para>
-
-<para>
-<indexterm><primary>LDAP</primary><secondary>master</secondary></indexterm>
-<indexterm><primary>LDAP</primary><secondary>server</secondary></indexterm>
-<indexterm><primary>CN</primary></indexterm>
-<indexterm><primary>DN</primary></indexterm>
-<indexterm><primary>RFC2830</primary></indexterm>
-When configuring a master LDAP server that will have slave LDAP servers, do not forget to configure this in
-the <filename>/etc/openldap/slapd.conf</filename> file. It must be noted that the DN of a server certificate
-must use the CN attribute to name the server, and the CN must carry the servers' fully qualified domain name.
-Additional alias names and wildcards may be present in the subjectAltName certificate extension. More details
-on server certificate names are in RFC2830.
-</para>
-
-<para>
-<indexterm><primary>LDAP</primary></indexterm>
-<indexterm><primary>BDC</primary></indexterm>
-<indexterm><primary>OpenLDAP</primary></indexterm>
-<indexterm><primary>transport layer security</primary><see>TLS</see></indexterm>
-<indexterm><primary>/etc/ssl/certs/slapd.pem</primary></indexterm>
-<indexterm><primary>slapd.pem</primary></indexterm>
-<indexterm><primary>Red Hat Linux</primary></indexterm>
-It does not really fit within the scope of this document, but a working LDAP installation is basic to
-LDAP-enabled Samba operation. When using an OpenLDAP server with Transport Layer Security (TLS), the machine
-name in <filename>/etc/ssl/certs/slapd.pem</filename> must be the same as in
-<filename>/etc/openldap/sldap.conf</filename>. The Red Hat Linux startup script creates the
-<filename>slapd.pem</filename> file with hostname <quote>localhost.localdomain.</quote> It is impossible to
-access this LDAP server from a slave LDAP server (i.e., a Samba BDC) unless the certificate is re-created with
-a correct hostname.
-</para>
-
-<para>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>OpenLDAP</primary></indexterm>
-<indexterm><primary>machine account</primary></indexterm>
-<indexterm><primary>credentials</primary></indexterm>
-<indexterm><primary>replication</primary></indexterm>
-<indexterm><primary>duplicate</primary></indexterm>
-Do not install a Samba PDC so that is uses an LDAP slave server. Joining client machines to the domain
-will fail in this configuration because the change to the machine account in the LDAP tree must take place on
-the master LDAP server. This is not replicated rapidly enough to the slave server that the PDC queries. It
-therefore gives an error message on the client machine about not being able to set up account credentials. The
-machine account is created on the LDAP server, but the password fields will be empty.  Unfortunately, some
-sites are unable to avoid such configurations, and these sites should review the <smbconfoption name="ldap
-replication sleep"/> parameter, intended to slow down Samba sufficiently for the replication to catch up.
-This is a kludge, and one that the administrator must manually duplicate in any scripts (such as the
-<smbconfoption name="add machine script"/>) that they use.
-</para>
-
-<para>
-Possible PDC/BDC plus LDAP configurations include:
-</para>
-
-<itemizedlist>
-	<listitem><para>
-	PDC+BDC -> One Central LDAP Server.
-	</para></listitem>
-	<listitem><para>
-	PDC -> LDAP master server, BDC -> LDAP slave server.
-	</para></listitem>
-	<listitem><para>
-	PDC -> LDAP master, with secondary slave LDAP server.
-	</para><para>
-	BDC -> LDAP master, with secondary slave LDAP server.
-	</para></listitem>
-	<listitem><para>
-	PDC -> LDAP master, with secondary slave LDAP server.
-	</para><para>
-	BDC -> LDAP slave server, with secondary master LDAP server.
-	</para></listitem>
-</itemizedlist>
-
-<para>
-In order to have a fallback configuration (secondary) LDAP server, you would specify
-the secondary LDAP server in the &smb.conf; file as shown in <link linkend="mulitldapcfg">the Multiple LDAP
-Servers in &smb.conf; example</link>.
-</para>
-
-<example id="mulitldapcfg">
-<title>Multiple LDAP Servers in &smb.conf;</title>
-<smbconfblock>
-<smbconfoption name="passdb backend">ldapsam:"ldap://master.quenya.org ldap://slave.quenya.org"</smbconfoption>
-</smbconfblock>
-</example>
-
-</sect2>
-
-<sect2>
-<title>Active Directory Domain Control</title>
-
-<para>
-<indexterm><primary>MS Windows 2000</primary></indexterm>
-<indexterm><primary>Active Directory</primary></indexterm>
-<indexterm><primary>directory</primary></indexterm>
-<indexterm><primary>replicated</primary></indexterm>
-<indexterm><primary>BDC</primary></indexterm>
-<indexterm><primary>domain controller</primary></indexterm>
-As of the release of MS Windows 2000 and Active Directory, this information is now stored
-in a directory that can be replicated and for which partial or full administrative control
-can be delegated. Samba-4.0 is able to be a domain controller within an Active Directory
-tree, and it can be an Active Directory server.  The details for how
-this can be done are documented in the <ulink
-url="https://wiki.samba.org/index.php/Samba4/HOWTO">Samba 4.0 as an
-AD DC HOWTO</ulink>
-
-</para>
-
-</sect2>
-
-<sect2>
-<title>What Qualifies a Domain Controller on the Network?</title>
-
-<para>
-<indexterm><primary>DMB</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>NetBIOS</primary></indexterm>
-Every machine that is a domain controller for the domain MIDEARTH has to register the NetBIOS
-group name MIDEARTH<1C> with the WINS server and/or by broadcast on the local network.
-The PDC also registers the unique NetBIOS name MIDEARTH<1B> with the WINS server.
-The name type <1B> name is normally reserved for the Domain Master Browser (DMB), a role
-that has nothing to do with anything related to authentication, but the Microsoft domain
-implementation requires the DMB to be on the same machine as the PDC.
-</para>
-
-<para>
-<indexterm><primary>broadcast</primary></indexterm>
-<indexterm><primary>name registration</primary></indexterm>
-<indexterm><primary>SMB/CIFS</primary></indexterm>
-Where a WINS server is not used, broadcast name registrations alone must suffice. Refer to
-<link linkend="NetworkBrowsing">Network Browsing</link>,<link linkend="netdiscuss">Discussion</link>
-for more information regarding TCP/IP network protocols and how SMB/CIFS names are handled.
-</para>
-
-</sect2>
-
-<sect2>
-<title>How Does a Workstation find its Domain Controller?</title>
-
-<para>
-<indexterm><primary>locate domain controller</primary></indexterm>
-<indexterm><primary>NetBIOS</primary></indexterm>
-There are two different mechanisms to locate a domain controller: one method is used when
-NetBIOS over TCP/IP is enabled and the other when it has been disabled in the TCP/IP
-network configuration.
-</para>
-
-<para>
-<indexterm><primary>DNS</primary></indexterm>
-<indexterm><primary>broadcast messaging</primary></indexterm>
-Where NetBIOS over TCP/IP is disabled, all name resolution involves the use of DNS, broadcast
-messaging over UDP, as well as Active Directory communication technologies. In this type of
-environment all machines require appropriate DNS entries. More information may be found in
-<link linkend="adsdnstech">DNS and Active Directory</link>.
-</para>
-
-<sect3>
-<title>NetBIOS Over TCP/IP Enabled</title>
-<para>
-<indexterm><primary>Windows NT4/200x/XP</primary></indexterm>
-<indexterm><primary>domain controller</primary></indexterm>
-<indexterm><primary>logon requests</primary></indexterm>
-<indexterm><primary>credentials validation</primary></indexterm>
-An MS Windows NT4/200x/XP Professional workstation in the domain MIDEARTH that wants a
-local user to be authenticated has to find the domain controller for MIDEARTH. It does this
-by doing a NetBIOS name query for the group name MIDEARTH<1C>. It assumes that each
-of the machines it gets back from the queries is a domain controller and can answer logon
-requests. To not open security holes, both the workstation and the selected domain controller
-authenticate each other. After that the workstation sends the user's credentials (name and
-password) to the local domain controller for validation.
-</para>
-
-</sect3>
-
-<sect3>
-<title>NetBIOS Over TCP/IP Disabled</title>
-
-<para>
-<indexterm><primary>realm</primary></indexterm>
-<indexterm><primary>logon authentication</primary></indexterm>
-<indexterm><primary>DNS</primary></indexterm>
-<indexterm><primary>_ldap._tcp.pdc._msdcs.quenya.org</primary></indexterm>
-An MS Windows NT4/200x/XP Professional workstation in the realm <constant>quenya.org</constant>
-that has a need to affect user logon authentication will locate the domain controller by 
-re-querying DNS servers for the <constant>_ldap._tcp.pdc._msdcs.quenya.org</constant> record.
-More information regarding this subject may be found in <link linkend="adsdnstech">DNS and Active Directory</link>.
-</para>
-
-</sect3>
-</sect2>
-</sect1>
-
-<sect1>
-<title>Backup Domain Controller Configuration</title>
-
-<para>
-<indexterm><primary>BDC</primary></indexterm>
-The creation of a BDC requires some steps to prepare the Samba server before
-&smbd; is executed for the first time. These steps are as follows:
-</para>
-
-<itemizedlist>
-	<listitem><para>
-	<indexterm><primary>secrets.tdb</primary></indexterm>
-	<indexterm><primary>smbpasswd</primary></indexterm>
-	<indexterm><primary>LDAP administration password</primary></indexterm>
-	Specification of the <smbconfoption name="ldap admin dn"/> is obligatory.
-	This also requires the LDAP administration password to be set in the <filename>secrets.tdb</filename>
-	using the <command>smbpasswd -w <replaceable>mysecret</replaceable></command>.
-	</para></listitem>
-
-	<listitem><para>
-	The <smbconfoption name="ldap suffix"/> parameter and the <smbconfoption name="ldap idmap suffix"/>
-	parameter must be specified in the &smb.conf; file.
-	</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>replication</primary><secondary>SAM</secondary></indexterm>
-	<indexterm><primary>user database</primary></indexterm>
-	<indexterm><primary>synchronized</primary></indexterm>
-	<indexterm><primary>NIS</primary></indexterm>
-	The UNIX user database has to be synchronized from the PDC to the
-	BDC. This means that both the <filename>/etc/passwd</filename> and
-	<filename>/etc/group</filename> have to be replicated from the PDC
-	to the BDC. This can be done manually whenever changes are made. 
-	Alternately, the PDC is set up as an NIS master server and the BDC as an NIS slave
-	server. To set up the BDC as a mere NIS client would not be enough,
-	as the BDC would not be able to access its user database in case of
-	a PDC failure. NIS is by no means the only method to synchronize
-	passwords. An LDAP solution would also work.
-	</para>
-	</listitem>
-
-	<listitem><para>
-	<indexterm><primary>password database</primary></indexterm>
-	<indexterm><primary>replicated</primary></indexterm>
-	<indexterm><primary>PDC</primary></indexterm>
-	<indexterm><primary>BDC</primary></indexterm>
-	<indexterm><primary>smbpasswd</primary></indexterm>
-	<indexterm><primary>rsync</primary></indexterm>
-	<indexterm><primary>ssh</primary></indexterm>
-	<indexterm><primary>LDAP</primary></indexterm>
-	The Samba password database must be replicated from the PDC to the BDC.
-        The solution
-	is to set up slave LDAP servers for each BDC and a master LDAP server for the PDC.
-	The use of rsync is inherently flawed by the fact that the data will be replicated
-	at timed intervals. There is no guarantee that the BDC will be operating at all
-	times with correct and current machine and user account information. This means that
-	this method runs the risk of users being inconvenienced by discontinuity of access
-	to network services due to inconsistent security data. It must be born in mind that
-	Windows workstations update (change) the machine trust account password at regular
-	intervals &smbmdash; administrators are not normally aware that this is happening
-	or when it takes place.
-	</para>
-
-	<para>
-	<indexterm><primary>POSIX</primary></indexterm>
-	<indexterm><primary>LDAP</primary></indexterm>
-	<indexterm><primary>SambaSAMAccount</primary></indexterm>
-	<indexterm><primary>synchronize</primary></indexterm>
-	The use of LDAP for both the POSIX (UNIX user and group) accounts and for the
-	SambaSAMAccount data automatically ensures that all account change information
-	will be written to the shared directory. This eliminates the need for any special
-	action to synchronize account information because LDAP will meet that requirement.
-	</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>netlogon share</primary></indexterm>
-	<indexterm><primary>replicate</primary></indexterm>
-	<indexterm><primary>PDC</primary></indexterm>
-	<indexterm><primary>BDC</primary></indexterm>
-	<indexterm><primary>cron</primary></indexterm>
-	<indexterm><primary>rsync</primary></indexterm>
-	The netlogon share has to be replicated from the PDC to the BDC. This can be done manually whenever login
-	scripts are changed, or it can be done automatically using a <command>cron</command> job that will replicate
-	the directory structure in this share using a tool like <command>rsync</command>. The use of
-	<command>rsync</command> for replication of the netlogon data is not critical to network security and is one
-	that can be manually managed given that the administrator will make all changes to the netlogon share as part
-	of a conscious move.
-	</para></listitem>
-
-</itemizedlist>
-
-<sect2>
-<title>Example Configuration</title>
-
-<para>
-Finally, the BDC has to be capable of being found by the workstations. This can be done by configuring the
-Samba &smb.conf; file <smbconfsection name="[global]"/> section as shown in <link linkend="minim-bdc">Minimal
-Setup for Being a BDC</link>.
-</para>
-
-<example id="minim-bdc">
-<title>Minimal Setup for Being a BDC</title>
-<smbconfblock>
-<smbconfoption name="workgroup">&example.workgroup;</smbconfoption>
-<smbconfoption name="passdb backend">ldapsam:ldap://slave-ldap.quenya.org</smbconfoption>
-<smbconfoption name="domain master">no</smbconfoption>
-<smbconfoption name="domain logons">yes</smbconfoption>
-<smbconfoption name="ldap suffix">dc=abmas,dc=biz</smbconfoption>
-<smbconfoption name="ldap user suffix">ou=Users</smbconfoption>
-<smbconfoption name="ldap group suffix">ou=Groups</smbconfoption>
-<smbconfoption name="ldap machine suffix">ou=Computers</smbconfoption>
-<smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
-<smbconfoption name="ldap admin dn">cn=sambadmin,dc=quenya,dc=org</smbconfoption>
-<smbconfoption name="idmap backend">ldap:ldap://master-ldap.quenya.org</smbconfoption>
-<smbconfoption name="idmap uid">10000-20000</smbconfoption>
-<smbconfoption name="idmap gid">10000-20000</smbconfoption>
-</smbconfblock>
-</example>
-
-<para>
-Fully documented working example network configurations using OpenLDAP and Samba
-as available in the <ulink url="http://www.samba.org/samba/docs/Samba3-ByExample">book</ulink> <quote>Samba-3
-by Example</quote> that may be obtained from local and on-line book stores.
-</para>
-
-<para>
-<indexterm><primary>BDC</primary></indexterm>
-<indexterm><primary>NetBIOS</primary></indexterm>
-<indexterm><primary>group</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-This configuration causes the BDC to register only the name MIDEARTH<1C> with the WINS server. This is
-not a problem, as the name MIDEARTH<1C> is a NetBIOS group name that is meant to be registered by more
-than one machine. The parameter <smbconfoption name="domain master">no</smbconfoption> forces the BDC not to
-register MIDEARTH<1B>, which is a unique NetBIOS name that is reserved for the PDC.
-</para>
-
-<para>
-<indexterm><primary>idmap backend</primary></indexterm>
-<indexterm><primary>winbindd</primary></indexterm>
-<indexterm><primary>redirect</primary></indexterm>
-<indexterm><primary>winbindd</primary></indexterm>
-<indexterm><primary>LDAP database</primary></indexterm>
-<indexterm><primary>UID</primary></indexterm>
-<indexterm><primary>GID</primary></indexterm>
-<indexterm><primary>SID</primary></indexterm>
-<indexterm><primary>nss_ldap</primary></indexterm>
-The <parameter>idmap backend</parameter> will redirect the <command>winbindd</command> utility to use the LDAP
-database to store all mappings for Windows SIDs to  UIDs and GIDs for UNIX accounts in a repository that is
-shared. The BDC will however depend on local resolution of UIDs and GIDs via NSS and the
-<command>nss_ldap</command> utility.
-</para>
-
-<note><para>
-<indexterm><primary>Server Type</primary><secondary>Domain Member</secondary></indexterm>
-<indexterm><primary>ID mapping</primary></indexterm>
-<indexterm><primary>domain member server</primary></indexterm>
-<indexterm><primary>idmap backend</primary></indexterm>
-Samba-3 has introduced a new ID mapping facility. One of the features of this facility is that it
-allows greater flexibility in how user and group IDs are handled in respect to NT domain user and group
-SIDs. One of the new facilities provides for explicitly ensuring that UNIX/Linux UID and GID values
-will be consistent on the PDC, all BDCs, and all domain member servers. The parameter that controls this
-is called <parameter>idmap backend</parameter>. Please refer to the man page for &smb.conf; for more information
-regarding its behavior.
-</para></note>
-
-<para>
-<indexterm><primary>BDC</primary></indexterm>
-<indexterm><primary>winbindd</primary></indexterm>
-<indexterm><primary>domain member servers</primary></indexterm>
-The use of the <smbconfoption name="idmap backend">ldap:ldap://master.quenya.org</smbconfoption>
-option on a BDC only makes sense where ldapsam is used on a PDC. The purpose of an LDAP-based idmap backend is
-also to allow a domain member (without its own passdb backend) to use winbindd to resolve Windows network users
-and groups to common UID/GIDs. In other words, this option is generally intended for use on BDCs and on domain
-member servers.
-</para>
-
-</sect2>
-</sect1>
-
-<sect1>
-<title>Common Errors</title>
-
-<para>
-<indexterm><primary>domain control</primary></indexterm>
-Domain control was a new area for Samba, but there are now many examples that we may refer to.
-Updated information will be published as they become available and may be found in later Samba releases or
-from the Samba Web <ulink url="http://samba.org">site</ulink>; refer in particular to the
-<filename>WHATSNEW.txt</filename> in the Samba release tarball. The book, <quote>Samba-3 by Example</quote>
-documents well tested and proven configuration examples. You can obtain a copy of this
-<ulink url="http://www.samba.org/samba/docs/Samba3-ByExample.pdf">book</ulink> for the Samba web site.
-</para>
-
-<sect2>
-<title>Machine Accounts Keep Expiring</title>
-
-<para>
-<indexterm><primary>Machine Trust Accounts</primary></indexterm>
-<indexterm><primary>passdb</primary></indexterm>
-<indexterm><primary>SAM</primary></indexterm>
-<indexterm><primary>Local Machine Trust Account</primary></indexterm>
-This problem will occur when the passdb (SAM) files are copied  from a central
-server but the local BDC is acting as a PDC. This results in the application of
-Local Machine Trust Account password updates to the local SAM. Such updates 
-are not copied back to the central server. The newer machine account password is then
-overwritten when the SAM is recopied from the PDC. The result is that the domain member machine
-on startup will find that its passwords do not match the one now in the database, and
-since the startup security check will now fail, this machine will not allow logon attempts
-to proceed and the account expiry error will be reported.
-</para>
-
-<para>
-The solution is to use a more robust passdb backend, such as the ldapsam backend, setting up
-a slave LDAP server for each BDC and a master LDAP server for the PDC.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Can Samba Be a Backup Domain Controller to an NT4 PDC?</title>
-
-<para>
-<indexterm><primary>replication</primary><secondary>SAM</secondary></indexterm>
-<indexterm><primary>SAM</primary></indexterm>
-No. The native NT4 SAM replication protocols have not yet been fully implemented.
-</para>
-
-<para>
-<indexterm><primary>BDC</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>logon requests</primary></indexterm>
-Can I get the benefits of a BDC with Samba?  Yes, but only to a Samba
-PDC or as a <ulink
-url="https://wiki.samba.org/index.php/Samba4/HOWTO">Samba 4.0 Active
-Directory domain controller.</ulink>  The
-main reason for implementing a BDC is availability. If the PDC is a Samba
-machine, a second Samba machine can be set up to service logon requests whenever
-the PDC is down.
-</para>
-
-</sect2>
-
-</sect1>
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-Backup.xml b/docs-xml/Samba3-HOWTO/TOSHARG-Backup.xml
deleted file mode 100644
index ede6822..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-Backup.xml
+++ /dev/null
@@ -1,241 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="Backup">
-<chapterinfo>
-	&author.jht;
-</chapterinfo>
-
-<title>Backup Techniques</title>
-
-<sect1>
-<title>Features and Benefits</title>
-
-<para>
-<indexterm><primary>backup</primary></indexterm>
-<indexterm><primary>UNIX system files</primary></indexterm>
-<indexterm><primary>system tools</primary></indexterm>
-<indexterm><primary>Samba mailing lists</primary></indexterm>
-The Samba project is over 10 years old. During the early history
-of Samba, UNIX administrators were its key implementors. UNIX administrators
-use UNIX system tools to backup UNIX system files. Over the past
-4 years, an increasing number of Microsoft network administrators have
-taken an interest in Samba. This is reflected in the questions about backup
-in general on the Samba mailing lists.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Discussion of Backup Solutions</title>
-
-<para>
-<indexterm><primary>Meccano set</primary></indexterm>
-<indexterm><primary>training course</primary></indexterm>
-During discussions at a Microsoft Windows training course, one of
-the pro-UNIX delegates stunned the class when he pointed out that Windows
-NT4 is limiting compared with UNIX. He likened UNIX to a Meccano set
-that has an unlimited number of tools that are simple, efficient,
-and, in combination, capable of achieving any desired outcome.
-</para>
-
-<para>
-<indexterm><primary>networking advocates</primary></indexterm>
-<indexterm><primary>clear purpose preferred</primary></indexterm>
-One of the Windows networking advocates retorted that if she wanted a
-Meccano set, she would buy one. She made it clear that a complex single
-tool that does more than is needed but does it with a clear purpose and
-intent is preferred by some like her.
-</para>
-
-<para>
-<indexterm><primary>due diligence</primary></indexterm>
-<indexterm><primary>research</primary></indexterm>
-<indexterm><primary>backup solution</primary></indexterm>
-Please note that all information here is provided as is and without recommendation
-of fitness or suitability. The network administrator is strongly encouraged to
-perform due diligence research before implementing any backup solution, whether free
-software or commercial.
-</para>
-
-<para>
-A useful Web site I recently stumbled across that you might like to refer to
-is located at <ulink noescape="1" url="http://www.allmerchants.com/Software/Backup_Software/">
-www.allmerchants.com</ulink>.
-</para>
-
-<para>
-The following three free software projects might also merit consideration.
-</para>
-
-	<sect2>
-	<title>BackupPC</title>
-
-
-	<para>
-	<indexterm><primary>BackupPC</primary></indexterm>
-<indexterm><primary>rsync</primary></indexterm>
-<indexterm><primary>rsyncd</primary></indexterm>
-	BackupPC version 2.0.0 has been released on <ulink url="http://backuppc.sourceforge.net">SourceForge</ulink>.
-	 New features include support for <command>rsync/rsyncd</command> and internationalization of the CGI interface
-	(including English, French, Spanish, and German).
-	</para>
-
-	<para>
-<indexterm><primary>BackupPC</primary></indexterm>
-<indexterm><primary>laptops</primary></indexterm>
-<indexterm><primary>SMB</primary></indexterm>
-<indexterm><primary>smbclient</primary></indexterm>
-<indexterm><primary>tar</primary></indexterm>
-<indexterm><primary>rsh</primary></indexterm>
-<indexterm><primary>ssh</primary></indexterm>
-<indexterm><primary>rsync</primary></indexterm>
-	BackupPC is a high-performance Perl-based package for backing up Linux,
-	UNIX, and Windows PCs and laptops to a server's disk. BackupPC is highly
-	configurable and easy to install and maintain. SMB (via smbclient),
-	<command>tar</command> over <command>rsh/ssh</command>, or <command>rsync/rsyncd</command>
-	 are used to extract client data.
-	</para>
-
-	<para>
-<indexterm><primary>RAID</primary></indexterm>
-<indexterm><primary>local disk</primary></indexterm>
-<indexterm><primary>network storage</primary></indexterm>
-	Given the ever-decreasing cost of disks and RAID systems, it is now
-	practical and cost effective to backup a large number of machines onto
-	a server's local disk or network storage. This is what BackupPC does.
-	</para>
-
-	<para>
-	Key features are pooling of identical files (big savings in server disk
-	space), compression, and a comprehensive CGI interface that allows users
-	to browse backups and restore files.
-	</para>
-
-	<para>
-<indexterm><primary>GNU GPL</primary></indexterm>
-	BackupPC is free software distributed under a GNU GPL license.
-	BackupPC runs on Linux/UNIX/freenix servers and has been tested
-	on Linux, UNIX, Windows 9x/Me, Windows 98, Windows 200x, Windows XP, and Mac OSX clients.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Rsync</title>
-
-	<para>
-<indexterm><primary>rsync</primary></indexterm>
-<indexterm><primary>ftp</primary></indexterm>
-<indexterm><primary>http</primary></indexterm>
-<indexterm><primary>scp</primary></indexterm>
-<indexterm><primary>rcp</primary></indexterm>
-<indexterm><primary>checksum-search</primary></indexterm>
-	<command>rsync</command> is a flexible program for efficiently copying files or
-		directory trees.</para>
-
-	<para><command>rsync</command> has many options to select which files will be copied
-	  and how they are to be transferred. It may be used as an
-	  alternative to <command>ftp, http, scp</command>, or <command>rcp</command>.</para>
-
-	<para>
-<indexterm><primary>remote-update protocol</primary></indexterm>
-<indexterm><primary>transfer differences</primary></indexterm>
-<indexterm><primary>differences</primary></indexterm>
-	The rsync remote-update protocol allows rsync to transfer just
-	  the differences between two sets of files across the network link,
-	  using an efficient checksum-search algorithm described in the
-	  technical report that accompanies the rsync package.</para>
-
-	<para>Some of the additional features of rsync are:</para>
-
-	<itemizedlist>
-
-		<listitem>
-		  <para>
-		    Support for copying links, devices, owners, groups, and permissions.
-		  </para>
-		</listitem>
-
-		<listitem>
-		  <para>
-		    Exclude and exclude-from options are similar to GNU tar.
-		  </para>
-		</listitem>
-
-		<listitem>
-		  <para>
-		    A CVS exclude mode for ignoring the same files that CVS would ignore.
-		  </para>
-		</listitem>
-
-		<listitem>
-		  <para>
-		    Can use any transparent remote shell, including rsh or ssh.
-		  </para>
-		</listitem>
-
-		<listitem>
-		  <para>
-		    Does not require root privileges.
-		  </para>
-		</listitem>
-
-		<listitem>
-		  <para>
-		    Pipelining of file transfers to minimize latency costs.
-		  </para>
-		</listitem>
-
-		<listitem>
-		  <para>
-		    Support for anonymous or authenticated rsync servers (ideal for
-		    mirroring).
-		  </para>
-		</listitem>
-	</itemizedlist>
-
-	</sect2>
-
-	<sect2>
-	<title>Amanda</title>
-
-
-	<para>
-	<indexterm><primary>Amanda</primary></indexterm>
-<indexterm><primary>native dump</primary></indexterm>
-<indexterm><primary>GNU tar</primary></indexterm>
-	Amanda, the Advanced Maryland Automatic Network Disk Archiver, is a backup system that
-	allows the administrator of a LAN to set up a single master backup server to back up
-	multiple hosts to a single large capacity tape drive. Amanda uses native dump and/or
-	GNU tar facilities and can back up a large number of workstations running multiple
-	versions of UNIX. Recent versions can also use Samba to back up Microsoft Windows hosts.
-	</para>
-
-	<para>
-	For more information regarding Amanda, please check the <ulink url="http://www.amanda.org/">
-	www.amanda.org/ site</ulink>.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>BOBS: Browseable Online Backup System</title>
-
-	
-	<para>
-	<indexterm><primary>BOBS</primary></indexterm>
-	Browseable Online Backup System (BOBS) is a complete online backup system. Uses large
-	disks for storing backups and lets users browse the files using a Web browser. Handles
-	some special files like AppleDouble and icon files.
-	</para>
-
-	<para>
-	The home page for BOBS is located at <ulink url="http://bobs.sourceforge.net/">
-	bobs.sourceforge.net</ulink>.
-	</para>
-
-	</sect2>
-
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-Bugs.xml b/docs-xml/Samba3-HOWTO/TOSHARG-Bugs.xml
deleted file mode 100644
index f6d7ba4..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-Bugs.xml
+++ /dev/null
@@ -1,284 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="bugreport">
-
-<chapterinfo>
-	&author.jht;
-	&author.jelmer;
-	&author.tridge;
-	<pubdate> 27 June 1997 </pubdate>
-</chapterinfo>
-
-<title>Reporting Bugs</title>
-
-<sect1>
-<title>Introduction</title>
-
-<para>
-<indexterm><primary>Bugzilla</primary></indexterm>
-<indexterm><primary>bug reports</primary></indexterm>
-Please report bugs using Samba's <ulink url="https://bugzilla.samba.org/">Bugzilla</ulink> facilities and take
-the time to read this file before you submit a bug report. Also, check to see if it has changed between
-releases, as we may be changing the bug reporting mechanism at some point.
-</para>
-
-<para>
-Please do as much as you can yourself to help track down the
-bug. Samba is maintained by a dedicated group of people who volunteer
-their time, skills, and efforts. We receive far more mail than
-we can possibly answer, so you have a much higher chance of a response
-and a fix if you send us a <quote>developer-friendly</quote> bug report that lets
-us fix it fast. 
-</para>
-
-<para>
-<indexterm><primary>configuration problem</primary></indexterm>
-If you suspect that your 
-problem is not a bug but a configuration problem, it is best to send 
-it to the Samba mailing list, as there are thousands of other users on
-that list who may be able to help you.
-</para>
-
-<para>
-You may also like to look though the recent mailing list archives,
-which are conveniently accessible on the Samba Web pages
-at <ulink noescape="1" url="http://samba.org/samba/">http://samba.org/samba/</ulink>.
-</para>
-
-</sect1>
-
-<sect1>
-<title>General Information</title>
-
-<para>
-Before submitting a bug report, check your config for silly
-errors. Look in your log files for obvious messages that tell
-you've misconfigured something. Run testparm to check your config
-file for correct syntax.
-</para>
-
-<para>
-Have you looked through <link linkend="diagnosis">The Samba Checklist</link>? This is extremely important.
-</para>
-
-<para>
-If you include part of a log file with your bug report, then be sure to
-annotate it with exactly what you were doing on the client at the
-time and exactly what the results were.
-</para>
-
-</sect1>
-
-<sect1 id="dbglvl">
-<title>Debug Levels</title>
-
-<para>
-If the bug has anything to do with Samba behaving incorrectly as a
-server (like refusing to open a file), then the log files will probably
-be quite useful. Depending on the problem, a log level of between 3 and
-10 showing the problem may be appropriate. A higher level gives more
-detail but may use too much disk space.
-</para>
-
-<para>
-<indexterm><primary>debug level</primary></indexterm>
-<indexterm><primary>log level</primary></indexterm>
-To set the debug level, use the <smbconfoption name="log level"/> in your 
-&smb.conf;. You may also find it useful to set the log 
-level higher for just one machine and keep separate logs for each machine. 
-To do this, add the following lines to your main &smb.conf; file:
-</para>
-
-<smbconfblock>
-<smbconfoption name="log level">10</smbconfoption>
-<smbconfoption name="log file">/usr/local/samba/lib/log.%m</smbconfoption>
-<smbconfoption name="include">/usr/local/samba/lib/smb.conf.%m</smbconfoption>
-</smbconfblock>
-
-<para>
-and create a file <filename>/usr/local/samba/lib/smb.conf.<replaceable>machine</replaceable></filename> where
-<replaceable>machine</replaceable> is the name of the client you wish to debug. In that file put any
-&smb.conf; commands you want; for example, <smbconfoption name="log level"/> may be useful. This also allows
-you to experiment with different security systems, protocol levels, and so on, on just one machine.
-</para>
-
-<para>
-The &smb.conf; entry <smbconfoption name="log level"/> is synonymous with the parameter <smbconfoption
-name="debuglevel"/> that has been used in older versions of Samba and is being retained for backward
-compatibility of &smb.conf; files.
-</para>
-
-<para>
-As the <smbconfoption name="log level"/> value is increased, you will record a significantly greater level of
-debugging information. For most debugging operations, you may not need a setting higher than
-<constant>3</constant>. Nearly all bugs can be tracked at a setting of <constant>10</constant>, but be
-prepared for a large volume of log data.
-</para>
-
-	<sect2>
-	<title>Debugging-Specific Operations</title>
-
-	<para>
-<indexterm><primary>debugging</primary></indexterm>
-<indexterm><primary>logging</primary></indexterm>
-<indexterm><primary>functional components</primary></indexterm>
-<indexterm><primary>cluttering</primary></indexterm>
-	Samba-3.x permits debugging (logging) of specific functional components without unnecessarily
-	cluttering the log files with detailed logs for all operations. An example configuration to 
-	achieve this is shown in:
-	</para>
-
-<para>
-<smbconfblock>
-<smbconfoption name="log level">0 tdb:3 passdb:5 auth:4 vfs:2</smbconfoption>
-<smbconfoption name="max log size">0</smbconfoption>
-<smbconfoption name="log file">/var/log/samba/%U.%m.log</smbconfoption>
-</smbconfblock>
-</para>
-
-	<para>
-	This will cause the level of detail to be expanded to the debug class (log level) passed to
-	each functional area per the value shown above. The first value passed to the <parameter>log level</parameter>
-	of <constant>0</constant> means turn off all unnecessary debugging except the debug classes set for
-	the functional areas as specified. The table shown in <link linkend="dbgclass">Debuggable Functions</link>
-	may be used to attain very precise analysis of each SMB operation Samba is conducting.
-	</para>
-
-	<table frame="all" id="dbgclass">
-		<title>Debuggable Functions</title>
-	<tgroup cols="2" align="center">
-		<thead>
-		<row><entry>Function Name</entry><entry>Function Name</entry></row>
-		</thead>
-		<tbody>
-		<row><entry>all</entry><entry>passdb</entry></row>
-		<row><entry>tdb</entry><entry>sam</entry></row>
-		<row><entry>printdrivers</entry><entry>auth</entry></row>
-		<row><entry>lanman</entry><entry>winbind</entry></row>
-		<row><entry>smb</entry><entry>vfs</entry></row>
-		<row><entry>rpc_parse</entry><entry>idmap</entry></row>
-		<row><entry>rpc_srv</entry><entry>quota</entry></row>
-		<row><entry>rpc_cli</entry><entry>acls</entry></row>
-		</tbody>
-	</tgroup>
-	</table>
-
-	</sect2>
-
-</sect1>
-
-<sect1>
-<title>Internal Errors</title>
-
-<para>
-If you get the message <quote><errorname>INTERNAL ERROR</errorname></quote> in your log files, 
-it means that Samba got an unexpected signal while running. It is probably a
-segmentation fault and almost certainly means a bug in Samba (unless
-you have faulty hardware or system software).
-</para>
-
-<para>
-If the message came from smbd, it will probably be accompanied by
-a message that details the last SMB message received by smbd. This
-information is often useful in tracking down the problem, so please
-include it in your bug report.
-</para>
-
-<para>
-You should also detail how to reproduce the problem, if
-possible. Please make this reasonably detailed.
-</para>
-
-
-<para>
-<indexterm><primary>core files</primary></indexterm>
-You may also find that a core file appeared in a <filename>corefiles</filename>
-subdirectory of the directory where you keep your Samba log
-files. This file is the most useful tool for tracking down the bug. To
-use it, you do this:
-<indexterm><primary>gdb</primary></indexterm>
-<indexterm><primary>debug</primary></indexterm>
-<screen>
-&prompt;<userinput>gdb smbd core</userinput>
-</screen>
-</para>
-
-<para>
-<indexterm><primary>dbx</primary></indexterm>
-<indexterm><primary>stack trace</primary></indexterm>
-adding appropriate paths to smbd and core so gdb can find them. If you
-do not have gdb, try <userinput>dbx</userinput>. Then within the debugger,
-use the command <command>where</command> to give a stack trace of where the
-problem occurred. Include this in your report.
-</para>
-
-<para>
-<indexterm><primary>disass</primary></indexterm>
-If you know any assembly language, do a <command>disass</command> of the routine
-where the problem occurred (if it's in a library routine, then
-disassemble the routine that called it) and try to work out exactly
-where the problem is by looking at the surrounding code. Even if you
-do not know assembly, including this information in the bug report can be
-useful. 
-</para>
-</sect1>
-
-<sect1>
-<title>Attaching to a Running Process</title>
-
-<para>
-<indexterm><primary>PID</primary></indexterm>
-<indexterm><primary>gdb</primary></indexterm>
-<indexterm><primary>smbstatus</primary></indexterm>
-Unfortunately, some UNIXes (in particular some recent Linux kernels)
-refuse to dump a core file if the task has changed UID (which smbd
-does often). To debug with this sort of system, you could try to attach
-to the running process using
-<userinput>gdb smbd <replaceable>PID</replaceable></userinput>, where you get
-<replaceable>PID</replaceable> from <application>smbstatus</application>.
-Then use <command>c</command> to continue and try to cause the core dump
-using the client. The debugger should catch the fault and tell you
-where it occurred.
-</para>
-
-<para>
-Sometimes it is necessary to build Samba binary files that have debugging
-symbols so as to make it possible to capture enough information from a crashed
-operation to permit the Samba Team to fix the problem.
-</para>
-
-<para>
-Compile with <constant>-g</constant> to ensure you have symbols in place. 
-Add the following line to the &smb.conf; file global section:
-<screen>
-panic action = "/bin/sleep 90000"
-</screen>
-to catch any panics. If <command>smbd</command> seems to be frozen, look for any sleep
-processes. If it is not, and appears to be spinning, find the PID
-of the spinning process and type:
-<screen>
-&rootprompt; gdb -p PID
-</screen>
-<indexterm><primary>spinning process</primary></indexterm>
-then type <quote>bt full</quote> to
-get a backtrace to see where the smbd is in the call path.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Patches</title>
-
-
-<para>
-<indexterm><primary>diff</primary></indexterm>
-<indexterm><primary>patch</primary></indexterm>
-The best sort of bug report is one that includes a fix! If you send us
-patches, please use <userinput>diff -u</userinput> format if your version of 
-diff supports it; otherwise, use <userinput>diff -c4</userinput>. Make sure 
-you do the diff against a clean version of the source and let me know 
-exactly what version you used. 
-</para>
-
-</sect1>
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-CUPS-printing.xml b/docs-xml/Samba3-HOWTO/TOSHARG-CUPS-printing.xml
deleted file mode 100644
index 807334e..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-CUPS-printing.xml
+++ /dev/null
@@ -1,5173 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="CUPS-printing">
-
-<chapterinfo>
-
-	<author>
-		<firstname>Kurt</firstname><surname>Pfeifle</surname>
-		<affiliation>
-			<orgname>Danka Deutschland GmbH </orgname>
-                        <address><email>kpfeifle at danka.de</email></address>
-		</affiliation>
-	</author>
-	<author>
-		<firstname>Ciprian</firstname><surname>Vizitiu</surname>
-		<affiliation>
-			<address><email>CVizitiu at gbif.org</email></address>
-		</affiliation>
-		<contrib>drawings</contrib>
-	</author>
-
-	<author>&person.jelmer;<contrib>drawings</contrib></author>
-
-	<pubdate> (27 Jan 2004) </pubdate>
-</chapterinfo>
-
-<title>CUPS Printing Support</title>
-
-<sect1>
-
-	<title>Introduction</title>
-
-	<sect2>
-		<title>Features and Benefits</title>
-
-		<para>
-<indexterm><primary>default printing</primary></indexterm>
-		The Common UNIX Print System (<ulink url="http://www.cups.org/">CUPS</ulink>)
-		has become quite popular. All major Linux distributions now ship it as their default printing
-		system. To many, it is still a mystical tool. Mostly, it just works.  People tend to regard
-		it as a <quote>black box</quote> that they do not want to look into as long as it works. But once
-		there is a little problem, they have trouble finding out where to start debugging it. Refer to
-		<link linkend="classicalprinting">Classical Printing</link>, which contains much information
-		that is also relevant to CUPS.
-		</para>
-
-		<para>
-<indexterm><primary>CUPS</primary></indexterm>
-		CUPS sports quite a few unique and powerful features. While its basic functions may be grasped quite
-		easily, they are also new. Because it is different from other, more traditional printing systems, it is best
-		not to try to apply any prior knowledge about printing to this new system. Rather, try to understand CUPS from
-		the beginning. This documentation will lead you to a complete understanding of CUPS. Let's start with the most
-		basic things first.
-		</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Overview</title>
-
-	<para>
-<indexterm><primary>print spooling system</primary></indexterm>
-<indexterm><primary>CUPS</primary></indexterm>
-<indexterm><primary>printer management system</primary></indexterm>
-<indexterm><primary>IETF</primary></indexterm>
-<indexterm><primary>Internet Printing Protocol</primary><see>IPP</see></indexterm>
-<indexterm><primary>Internet Engineering Task Force</primary><see>IETF</see></indexterm>
-<indexterm><primary>GUI</primary></indexterm>
-<indexterm><primary>KDEPrint</primary></indexterm>
-	CUPS is more than just a print spooling system. It is a complete printer management system that
-	complies with the new Internet Printing Protocol (IPP). IPP is an industry and Internet Engineering Task Force
-	(IETF) standard for network printing. Many of its functions can be managed remotely (or locally) via a Web
-	browser (giving you platform-independent access to the CUPS print server). Additionally, it has the
-	traditional command line and several more modern GUI interfaces (GUI interfaces developed by third parties,
-	like KDE's overwhelming <ulink url="http://printing.kde.org/">KDEPrint</ulink>).
-	</para>
-
-	<para>
-<indexterm><primary>raw printers</primary></indexterm>
-<indexterm><primary>smart printers</primary></indexterm>
-	CUPS allows creation of <emphasis>raw</emphasis> printers (i.e., no print file format translation) as
-	well as <emphasis>smart</emphasis> printers (i.e., CUPS does file format conversion as required for the
-	printer). In many ways, this gives CUPS capabilities similar to the MS Windows print monitoring system. Of
-	course, if you are a CUPS advocate, you would argue that CUPS is better! In any case, let us now explore how
-	to configure CUPS for interfacing with MS Windows print clients via Samba.
-	</para>
-
-	</sect2>
-
-</sect1>
-
-<sect1>
-	<title>Basic CUPS Support Configuration</title>
-
-	<para>
-<indexterm><primary>CUPS</primary></indexterm>
-<indexterm><primary>cupsd.conf</primary></indexterm>
-<indexterm><primary>/etc/printcap</primary></indexterm>
-<indexterm><primary>Printcap</primary></indexterm>
-<indexterm><primary>PrintcapFormat</primary></indexterm>
-Printing with CUPS in the most basic &smb.conf; setup in Samba requires just this parameter: <smbconfoption name="printing">cups</smbconfoption>. CUPS does not need a printcap file.  However, the
-<filename>cupsd.conf</filename> configuration file knows of two related directives that control how such a
-file will be automatically created and maintained by CUPS for the convenience of third-party applications
-(example: <parameter>Printcap /etc/printcap</parameter> and <parameter>PrintcapFormat BSD</parameter>).
-Legacy programs often require the existence of a printcap file containing printer names or they will refuse to
-print. Make sure CUPS is set to generate and maintain a printcap file. For details, see <command>man
-cupsd.conf</command> and other CUPS-related documentation, like the wealth of documents regarding the CUPS
-server itself available from the <ulink noescape="1"
-url="http://localhost:631/documentation.html">CUPS</ulink> web site.
-	</para>
-
-	<sect2>
-	<title>Linking smbd with libcups.so</title>
-
-	<para>
-<indexterm><primary>libcups.so</primary></indexterm>
-	Samba has a special relationship to CUPS, and to use CUPS Samba must be compiled with CUPS library support.
-	Most recent installations have this support enabled. By default, CUPS linking is compiled
-	into smbd and other Samba binaries.  The parameter
-	<smbconfoption name="printing">cups</smbconfoption> will only
-	be accepted if this is the case.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Simple &smb.conf; Settings for CUPS</title>
-
-	<para>
-	To summarize, <link linkend="cups-exam-simple">the Simplest Printing-Related 
-	&smb.conf; file</link> shows the simplest printing-related setup for &smb.conf; to 
-	enable basic CUPS support:
-	</para>
-
-	<example id="cups-exam-simple">
-	<title>Simplest Printing-Related smb.conf</title>
-	<smbconfblock>
-	<smbconfsection name="[global]"/>
-	<smbconfoption name="load printers">yes</smbconfoption>
-	<smbconfoption name="printing">cups</smbconfoption>
-
-	<smbconfsection name="[printers]"/>
-	<smbconfoption name="comment">All Printers</smbconfoption>
-	<smbconfoption name="path">/var/spool/samba</smbconfoption>
-	<smbconfoption name="browseable">no</smbconfoption>
-	<smbconfoption name="guest ok">yes</smbconfoption>
-	<smbconfoption name="writable">no</smbconfoption>
-	<smbconfoption name="printable">yes</smbconfoption>
-	</smbconfblock>
-	</example>
-
-	<para>
-<indexterm><primary>PDF</primary></indexterm>
-<indexterm><primary>PostScript</primary></indexterm>
-<indexterm><primary>printer driver</primary></indexterm>
-	This is all you need for basic printing setup for CUPS. It will print all graphic, text, PDF, and PostScript
-	files submitted from Windows clients. However, most of your Windows users would not know how to send these
-	kinds of files to print without opening a GUI application. Windows clients tend to have local printer drivers
-	installed, and the GUI application's print buttons start a printer driver. Your users also rarely send files
-	from the command line. Unlike UNIX clients, they rarely submit graphic, text, or PDF formatted files directly
-	to the spooler. They nearly exclusively print from GUI applications with a <quote>printer driver</quote>
-	hooked between the application's native format and the print data stream. If the backend printer is not a
-	PostScript device, the print data stream is <quote>binary,</quote> sensible only for the target printer. Read
-	on to learn what problem this may cause and how to avoid it.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>More Complex CUPS &smb.conf; Settings</title>
-
-	<para>
-	<link linkend="overridesettings">The Overriding Global CUPS Settings for One Printer example</link> 
-	is a slightly more complex printing-related setup for &smb.conf;. It enables general CUPS printing
-	support for all printers, but defines one printer share, which is set up differently. 
-	</para>
-
-	<example id="overridesettings">
-	<title>Overriding Global CUPS Settings for One Printer</title>
-	<smbconfblock>
-	<smbconfsection name="[global]"/>
-	<smbconfoption name="printing">cups</smbconfoption>
-	<smbconfoption name="load printers">yes</smbconfoption>
-
-	<smbconfsection name="[printers]"/>
-	<smbconfoption name="comment">All Printers</smbconfoption>
-	<smbconfoption name="path">/var/spool/samba</smbconfoption>
-	<smbconfoption name="guest ok">yes</smbconfoption>
-	<smbconfoption name="writable">no</smbconfoption>
-	<smbconfoption name="printable">yes</smbconfoption>
-
-	<smbconfsection name="[special_printer]"/>
-	<smbconfoption name="comment">A special printer with his own settings</smbconfoption>
-	<smbconfoption name="path">/var/spool/samba-special</smbconfoption>
-	<smbconfoption name="printing">sysv</smbconfoption>
-	<smbconfoption name="printcap">lpstat</smbconfoption>
-	<smbconfoption name="print command">echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ; echo "     `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ; echo "     `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log ; rm %f </smbconfoption>
-	<smbconfoption name="guest ok">no</smbconfoption>
-	<smbconfoption name="writable">no</smbconfoption>
-	<smbconfoption name="printable">yes</smbconfoption>
-	<smbconfoption name="hosts deny">0.0.0.0</smbconfoption>
-	<smbconfoption name="hosts allow">turbo_xp, 10.160.50.23, 10.160.51.60</smbconfoption>
-	</smbconfblock>
-	</example>
-
-	<para>
-	This special share is only for testing purposes. It does not write the print job to a file. It just logs the job parameters
-	known to Samba into the <filename>/tmp/smbprn.log</filename> file and deletes the job-file. Moreover, guest access is not
-	allowed, the share isn't published to the Network Neighborhood (so you need to know it is there), and it
-	allows access from only three hosts. To prevent CUPS from kicking in and taking over the print jobs for that share, we need to set
-	<smbconfoption name="printing">sysv</smbconfoption> and <smbconfoption name="printcap">lpstat</smbconfoption>.
-	</para>
-
-	</sect2>
-
-</sect1>
-
-<sect1>
-	<title>Advanced Configuration</title>
-
-	<para>
-	Before we delve into all the configuration options, let us clarify a few points. <emphasis>Network printing
-	needs to be organized and set up correctly</emphasis>. This frequently doesn't happen. Legacy systems or small
-	business LAN environments often lack design and good housekeeping.
-	</para>
-
-
-	<sect2>
-	<title>Central Spooling vs. <quote>Peer-to-Peer</quote> Printing</title>
-
-
-	<para>
-<indexterm><primary>spooling</primary></indexterm>
-	<indexterm><primary>spooling</primary><secondary>central</secondary></indexterm>
-	<indexterm><primary>spooling</primary><secondary>peer-to-peer</secondary></indexterm>
-	Many small office or home networks, as well as badly organized larger environments, allow each client a direct
-	access to available network printers. This is generally a bad idea. It often blocks one client's access to the
-	printer when another client's job is printing. It might freeze the first client's application while it is
-	waiting to get rid of the job. Also, there are frequent complaints about various jobs being printed with their
-	pages mixed with each other. A better concept is the use of a print server: it routes all jobs through one
-	central system, which responds immediately, takes jobs from multiple concurrent clients, and transfers them to
-	the printer(s) in the correct order.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Raw Print Serving: Vendor Drivers on Windows Clients</title>
-
-	<para>
-	<indexterm><primary>spooling-only</primary></indexterm>
-	<indexterm><primary>raw printing</primary></indexterm>
-	Most traditionally configured UNIX print servers acting on behalf of
-	Samba's Windows clients represented a really simple setup. Their only
-	task was to manage the <quote>raw</quote> spooling of all jobs handed to them by
-	Samba. This approach meant that the Windows clients were expected to
-	prepare the print job file that is ready to be sent to the printing
-	device. In this case, a native (vendor-supplied) Windows printer driver needs to
-	be installed on each and every client for the target device.
-	</para>
-
-	<para>
-<indexterm><primary>render</primary></indexterm>
-<indexterm><primary>vendor-provided drivers</primary></indexterm>
-	It is possible to configure CUPS, Samba, and your Windows clients in the
-	same traditional and simple way. When CUPS printers are configured
-	for raw print-through mode operation, it is the responsibility of the
-	Samba client to fully render the print job (file). The file must be
-	sent in a format that is suitable for direct delivery to the
-	printer. Clients need to run the vendor-provided drivers to do
-	this. In this case, CUPS will not do any print file format conversion
-	work.
-	</para>
-
-	<para>
-	The easiest printing configuration possible is raw print-through.
-	This is achieved by installation of the printer as if it were physically
-	attached to the Windows client. You then redirect output to a raw network
-	print queue. This procedure may be followed to achieve this:
-	</para>
-
-	<procedure>
-	<title>Configuration Steps for Raw CUPS Printing Support</title>
-
-		<step><para>
-<indexterm><primary>/etc/cups/mime.types</primary></indexterm>
-		Edit <filename>/etc/cups/mime.types</filename> to uncomment the line
-		near the end of the file that has:
-<screen>
-#application/octet-...
-</screen>
-		</para></step>
-
-		<step><para>
-<indexterm><primary>/etc/cups/mime.convs</primary></indexterm>
-		Do the same for the file <filename>/etc/cups/mime.convs</filename>.
-		</para></step>
-
-		<step><para>
-		Add a raw printer using the Web interface. Point your browser at
-		<constant>http://localhost:631</constant>. Enter Administration, and add
-		the printer following the prompts. Do not install any drivers for it.
-		Choose Raw. Choose queue name <constant>Raw Queue</constant>.
-		</para></step>
-
-		<step><para>
-		In the &smb.conf; file <constant>[printers]</constant> section add
-		<smbconfoption name="use client driver">Yes</smbconfoption>,
-		and in the <constant>[global]</constant> section add
-		<smbconfoption name="printing">CUPS</smbconfoption>, plus
-		<smbconfoption name="printcap">CUPS</smbconfoption>.
-		</para></step>
-
-		<step><para>
-		Install the printer as if it is a local printer, that is, Printing to <constant>LPT1:</constant>.
-		</para></step>
-
-		<step><para>
-		Edit the configuration under the <guimenu>Detail</guimenu> tab and create a
-		<constant>local port</constant> that points to the raw printer queue that
-		you have configured above. Example: <constant>\\server\raw_q</constant>.
-		Here, the name <constant>raw_q</constant> is the name you gave the print
-		queue in the CUPS environment.
-		</para></step>
-	</procedure>
-
-	</sect2>
-
-	<sect2>
-	<title>Installation of Windows Client Drivers</title>
-
-	<para>
-	The printer drivers on the Windows clients may be installed
-	in two functionally different ways:
-	</para>
-
-	<itemizedlist>
-	<listitem><para>Manually install the drivers locally on each client,
-	one by one; this yields the old LanMan style
-	printing and uses a <filename>\\sambaserver\printershare</filename>
-	type of connection.</para></listitem>
-
-
-	<listitem><para>
-	<indexterm><primary>point 'n' print</primary></indexterm>
-			Deposit and prepare the drivers (for later download) on
-			the print server (Samba); this enables the clients to use
-	<quote>Point'n'Print</quote> to get drivers semi-automatically installed the
-	first time they access the printer; with this method NT/200x/XP
-	clients use the <emphasis>SPOOLSS/MS-RPC</emphasis>
-	type printing calls.</para></listitem>
-	</itemizedlist>
-
-	<para>
-	The second method is recommended for use over the first as it reduces the
-	administrative efforts and prevents that different versions of the drivers
-	are used accidentally.
-	</para>
-	</sect2>
-
-	<sect2 id="cups-raw">
-	<title>Explicitly Enable <quote>raw</quote> Printing for <emphasis>application/octet-stream</emphasis></title>
-
-
-	<para>
-	<indexterm><primary>application/octet-stream</primary></indexterm>
-	<indexterm><primary>raw printing</primary></indexterm>
-	<indexterm><primary>MIME</primary><secondary>raw</secondary></indexterm>
-	If you use the first option (drivers are installed on the client
-	side), there is one setting to take care of: CUPS needs to be told
-	that it should allow <quote>raw</quote> printing of deliberate (binary) file
-	formats. The CUPS files that need to be correctly set for raw mode
-	printers to work are:
-	</para>
-
-	<itemizedlist>
-		<listitem><para><filename>/etc/cups/mime.types</filename></para></listitem>
-		<listitem><para><filename>/etc/cups/mime.convs</filename></para></listitem>
-	</itemizedlist>
-
-	<para>
-	Both contain entries (at the end of the respective files) that must be uncommented to allow RAW mode
-	operation.  In <filename>/etc/cups/mime.types</filename>, make sure this line is present:
-<programlisting>
-application/octet-stream
-</programlisting>
-	<indexterm><primary>/etc/cups/mime.convs</primary></indexterm>
-	<indexterm><primary>/etc/cups/mime.types</primary></indexterm>
-	In <filename>/etc/cups/mime.convs</filename>, have this line:
-	<indexterm><primary>application/vnd.cups-raw</primary></indexterm>
-<programlisting>
-application/octet-stream   application/vnd.cups-raw   0   - 
-</programlisting>
-	If these two files are not set up correctly for raw Windows client
-	printing, you may encounter the dreaded <computeroutput>Unable to
-	convert file 0</computeroutput> in your CUPS <filename>error_log</filename> file. 
-	</para>
-
-	<note><para>
-	Editing the <filename>mime.convs</filename> and the <filename>mime.types</filename> file does
-	not <emphasis>enforce</emphasis> <quote>raw</quote> printing, it only <emphasis>allows</emphasis> it.
-	</para></note>
-
-	<formalpara><title>Background</title>
-
-	<para>
-	<indexterm><primary>application/octet-stream</primary></indexterm>
-<indexterm><primary>MIME type</primary></indexterm>
-	That CUPS is a more security-aware printing system than traditional ones does not by default allow a user to
-	send deliberate (possibly binary) data to printing devices. This could be easily abused to launch a
-	<quote>Denial of Service</quote> attack on your printer(s), causing at least the loss of a lot of paper and
-	ink. <quote>Unknown</quote> data are tagged by CUPS as <parameter>MIME type: application/octet-stream</parameter>
-	and not allowed to go to the printer. By default, you can only send other (known) MIME types <quote>raw.</quote>
-	Sending data <quote>raw</quote> means that CUPS does not try to convert them and passes them to the printer
-	untouched.
-	</para>
-	</formalpara>
-
-	<para>
-	This is all you need to know to get the CUPS/Samba combo printing
-	<quote>raw</quote> files prepared by Windows clients, which have vendor drivers
-	locally installed. If you are not interested in background information about
-	more advanced CUPS/Samba printing, simply skip the remaining sections
-	of this chapter.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Driver Upload Methods</title>
-
-	<para>
-	This section describes three familiar methods, plus one new one, by which
-	printer drivers may be uploaded.
-	</para>
-
-	<para>
-	<indexterm><primary>point'n'print</primary></indexterm>
-	If you want to use the MS-RPC-type printing, you must upload the
-	drivers onto the Samba server first (<smbconfsection name="[print$]"/>
-	share). For a discussion on how to deposit printer drivers on the
-	Samba host (so the Windows clients can download and use them via
-	<quote>Point'n'Print</quote>), please refer to the <link linkend="classicalprinting">Classical Printing
-	chapter</link> of this book. There you will find a description or reference to
-	three methods of preparing the client drivers on the Samba server:
-	</para>
-
-	<itemizedlist>
-		<listitem><para>
-		<indexterm><primary>add printer wizard</primary></indexterm>
-		The GUI, <quote>Add Printer Wizard</quote> <emphasis>upload-from-a-Windows-client</emphasis> method.
-		</para></listitem>
-
-		<listitem><para>
-		The command line, <quote>smbclient/rpcclient</quote> upload-from-a-UNIX-workstation method.
-		</para></listitem>
-
-		<listitem><para>
-		<indexterm><primary>imprints</primary></indexterm>
-		The Imprints tool set method.
-		</para></listitem>
-	</itemizedlist>
-
-	<para> 
-<indexterm><primary>cupsaddsmb</primary></indexterm>
-	These three methods apply to CUPS all the same. The <command>cupsaddsmb</command> utility is a new and more
-	convenient way to load the Windows drivers into Samba and is provided if you use CUPS.
-	</para>
-
-	<para>
-	<command>cupsaddsmb</command> is discussed in much detail later in this chapter. But we first
-	explore the CUPS filtering system and compare the Windows and UNIX printing architectures.
-	</para>
-
-	</sect2>
-
-</sect1>
-
-<sect1>
-	<title>Advanced Intelligent Printing with PostScript Driver Download</title>
-
-	<para>
-	<indexterm><primary>PostScript</primary><seealso>Ghostscript</seealso></indexterm>
-	We now know how to set up a <quote>dump</quote> print server, that is, a server that spools
-	print jobs <quote>raw</quote>, leaving the print data untouched.
-	</para>
-
-	<para>
-	You might need to set up CUPS in a smarter way. The reasons could be manifold:
-	</para>
-
-<indexterm><primary>print statistics</primary></indexterm>
-<indexterm><primary>average print run</primary></indexterm>
-<indexterm><primary>print quota</primary></indexterm>
-	<itemizedlist>
-	<listitem><para>Maybe your boss wants to get monthly statistics: Which
-	printer did how many pages? What was the average data size of a job?
-	What was the average print run per day? What are the typical hourly
-	peaks in printing? Which department prints how much?</para></listitem>
-
-	<listitem><para>Maybe you are asked to set up a print quota system:
-	Users should not be able to print more jobs once they have surpassed
-	a given limit per period.</para></listitem>
-
-	<listitem><para>Maybe your previous network printing setup is a mess
-	and must be re-organized from a clean beginning.</para></listitem>
-
-	<listitem><para>Maybe you are experiencing too many <quote>blue screens</quote>
-	originating from poorly debugged printer drivers running in NT <quote>kernel mode</quote>?</para></listitem>
-	</itemizedlist>
-
-	<para>
-	These goals cannot be achieved by a raw print server. To build a
-	server meeting these requirements, you'll first need to learn
-	how CUPS works and how you can enable its features.
-	</para>
-
-	<para>
-	What follows is the comparison of some fundamental concepts for
-	Windows and UNIX printing, then a description of the
-	CUPS filtering system, how it works, and how you can tweak it.
-	</para>
-
-	<sect2 id="gdipost">
-	<title>GDI on Windows, PostScript on UNIX</title>
-
-	<para>
-	<indexterm><primary>GDI</primary></indexterm>
-	<indexterm><primary>PostScript</primary></indexterm>
-	Network printing is one of the most complicated and error-prone
-	day-to-day tasks any user or administrator may encounter. This is
-	true for all OS platforms, and there are reasons it is so.
-	</para>
-
-
-	<para>
-	<indexterm><primary>PCL</primary></indexterm>
-	<indexterm><primary>PDL</primary></indexterm>
-<indexterm><primary>PostScript</primary></indexterm>
-<indexterm><primary>Adobe</primary></indexterm>
-<indexterm><primary>page description languages</primary><see>PDL</see></indexterm>
-	You can't expect to throw just any file format at a printer and have it get printed. A file format conversion
-	must take place. The problem is that there is no common standard for print file formats across all
-	manufacturers and printer types. While PostScript (trademark held by Adobe) and, to an extent, PCL (trademark
-	held by Hewlett-Packard) have developed into semi-official <quote>standards</quote> by being the most widely
-	used page description languages (PDLs), there are still many manufacturers who <quote>roll their own</quote>
-	(their reasons may be unacceptable license fees for using printer-embedded PostScript interpreters, and so on).
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Windows Drivers, GDI, and EMF</title>
-
-	<para>
-	<indexterm><primary>GDI</primary></indexterm>
-	<indexterm><primary>EMF</primary></indexterm>
-	<indexterm><primary>WYSIWYG</primary></indexterm>
-<indexterm><primary>Enhanced MetaFile</primary><see>EMF</see></indexterm>
-	In Windows OS, the format conversion job is done by the printer drivers. On MS Windows OS platforms all
-	application programmers have at their disposal a built-in API, the graphical device interface (GDI), as part
-	and parcel of the OS itself to base themselves on. This GDI core is used as one common unified ground for all
-	Windows programs to draw pictures, fonts, and documents <emphasis>on screen</emphasis> as well as <emphasis>on
-	paper</emphasis> (print). Therefore, printer driver developers can standardize on a well-defined GDI output
-	for their own driver input. Achieving WYSIWYG (What You See Is What You Get) is relatively easy, because the
-	on-screen graphic primitives, as well as the on-paper drawn objects, come from one common source. This source,
-	the GDI, often produces a file format called Enhanced MetaFile (EMF). The EMF is processed by the printer
-	driver and converted to the printer-specific file format.
-	</para>
-
-	<note><para>
-	<indexterm><primary>PDF</primary></indexterm>
-<indexterm><primary>Xprint</primary></indexterm>
-<indexterm><primary>core graphic engine</primary></indexterm>
-	To the GDI foundation in MS Windows, Apple has chosen to put paper and screen output on a common foundation
-	for its (BSD-UNIX-based, did you know?) Mac OS X and Darwin operating <indexterm><primary>X Window
-	System</primary></indexterm> <indexterm><primary>PostScript</primary></indexterm>
-	<indexterm><primary>PCL</primary></indexterm> <indexterm><primary>Xprint</primary></indexterm> systems.
-	Apple's <emphasis>core graphic engine</emphasis> uses a <emphasis>PDF</emphasis> derivative for all display work.
-	</para></note>
-
-	<para>
-	The example in <link linkend="f1small">Windows Printing to a Local Printer</link> illustrates local Windows
-	printing.
-	</para>
-
-	<figure id="f1small">
-		<title>Windows Printing to a Local Printer.</title>
-		<imagefile>1small</imagefile>
-	</figure>
-
-	</sect2>
-
-	<sect2>
-	<title>UNIX Printfile Conversion and GUI Basics</title>
-
-	<para>
-	<indexterm><primary>X Window System</primary></indexterm>
-	<indexterm><primary>PostScript</primary></indexterm>
-	<indexterm><primary>PCL</primary></indexterm>
-	<indexterm><primary>Xprint</primary></indexterm>
-	In UNIX and Linux, there is no comparable layer built into the OS kernel(s) or the X (screen display) server.
-	Every application is responsible for itself to create its print output. Fortunately, most use PostScript and
-	that at least gives some common ground. Unfortunately, there are many different levels of quality for this
-	PostScript. And worse, there is a huge difference (and no common root) in the way the same document is
-	displayed on screen and how it is presented on paper. WYSIWYG is more difficult to achieve. This goes back to
-	the time, decades ago, when the predecessors of X.org, designing the UNIX foundations and protocols for
-	graphical user interfaces, refused to take responsibility for <quote>paper output</quote>, as some had
-	demanded at the time, and restricted itself to <quote>on-screen only.</quote> (For some years now, the
-	<quote>Xprint</quote> project has been under development, attempting to build printing support into the X
-	framework, including a PostScript and a PCL driver, but it is not yet ready for prime time.) You can see this
-	unfavorable inheritance up to the present day by looking into the various <quote>font</quote> directories on
-	your system; there are separate ones for fonts used for X display and fonts to be used on paper.
-	</para>
-
-	<formalpara>
-	<title>Background</title>
-
-	<para>
-	<indexterm><primary>PostScript</primary></indexterm>
-<indexterm><primary>color</primary></indexterm>
-<indexterm><primary>linewidth</primary></indexterm>
-<indexterm><primary>scale</primary></indexterm>
-<indexterm><primary>distort</primary></indexterm>
-<indexterm><primary>rotate</primary></indexterm>
-<indexterm><primary>shift</primary></indexterm>
-<indexterm><primary>raster images</primary></indexterm>
-<indexterm><primary>display PostScript</primary></indexterm>
-<indexterm><primary>graphical objects</primary></indexterm>
-	The PostScript programming language is an <quote>invention</quote> by Adobe, but its specifications have been
-	published extensively. Its strength lies in its powerful abilities to describe graphical objects (fonts,
-	shapes, patterns, lines, curves, and dots), their attributes (color, linewidth), and the way to manipulate
-	(scale, distort, rotate, shift) them. Because of its open specification, anybody with the skill can start
-	writing his or her own implementation of a PostScript interpreter and use it to display PostScript files on
-	screen or on paper. Most graphical output devices are based on the concept of <quote>raster images</quote> or
-	<quote>pixels</quote> (one notable exception is pen plotters). Of course, you can look at a PostScript file in
-	its textual form and you will be reading its PostScript code, the language instructions that need to be
-	interpreted by a rasterizer. Rasterizers produce pixel images, which may be displayed on screen by a viewer
-	program or on paper by a printer.
-	</para>
-	</formalpara>
-	</sect2>
-
-	<sect2 id="post-and-ghost">
-	<title>PostScript and Ghostscript</title>
-
-	<para>
-	<indexterm><primary>PostScript</primary></indexterm>
-	<indexterm><primary>GhostScript</primary><seealso>PostScript</seealso></indexterm>
-	<indexterm><primary>PostScript</primary><secondary>RIP</secondary></indexterm>
-<indexterm><primary>PostScript interpreter</primary></indexterm>
-<indexterm><primary>raster image processor</primary><see>RIP</see></indexterm>
-	So UNIX is lacking a common ground for printing on paper and displaying on screen. Despite this unfavorable
-	legacy for UNIX, basic printing is fairly easy if you have PostScript printers at your disposal. The reason is
-	that these devices have a built-in PostScript language <quote>interpreter,</quote> also called a raster image
-	processor (RIP), (which makes them more expensive than other types of printers; throw PostScript toward them,
-	and they will spit out your printed pages. The RIP does all the hard work of converting the PostScript drawing
-	commands into a bitmap picture as you see it on paper, in a resolution as done by your printer. This is no
-	different than PostScript printing a file from a Windows origin.
-	</para>
-
-	<note><para>
-	<indexterm><primary>PPD</primary></indexterm>
-<indexterm><primary>PPD-aware</primary></indexterm>
-<indexterm><primary>PostScript Printer Description</primary><see>PPD</see></indexterm>
-	Traditional UNIX programs and printing systems &smbmdash; while using PostScript &smbmdash; are largely not
-	PPD-aware. PPDs are <quote>PostScript Printer Description</quote> files. They enable you to specify and
-	control all options a printer supports: duplexing, stapling, and punching. Therefore, UNIX users for a long
-	time couldn't choose many of the supported device and job options, unlike Windows or Apple users. But now
-	there is CUPS. as illustrated in <link linkend="f2small">Printing to a PostScript Printer</link>.
-	</para>
-	</note>
-
-	<figure id="f2small">
-		<title>Printing to a PostScript Printer.</title>
-		<imagefile>2small</imagefile>
-	</figure>
-
-	<para>
-	<indexterm><primary>PDL</primary></indexterm>
-	However, there are other types of printers out there. These do not know how to print PostScript. They use
-	their own PDL, often proprietary. To print to them is much more demanding. Since your UNIX applications mostly
-	produce PostScript, and since these devices do not understand PostScript, you need to convert the print files
-	to a format suitable for your printer on the host before you can send it away.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Ghostscript: The Software RIP for Non-PostScript Printers</title>
-
-	<para>
-	<indexterm><primary>GhostScript</primary></indexterm>
-	Here is where Ghostscript kicks in. Ghostscript is the traditional (and quite powerful) PostScript interpreter
-	used on UNIX platforms. It is a RIP in software, capable of doing a <emphasis>lot</emphasis> of file format
-	conversions for a very broad spectrum of hardware devices as well as software file formats.  Ghostscript
-	technology and drivers are what enable PostScript printing to non-PostScript hardware. This is shown in
-	<link linkend="f3small">Ghostscript as a RIP for Non-PostScript Printers</link>.
-	</para>
-
-	<figure id="f3small">
-		<title>Ghostscript as a RIP for Non-PostScript Printers.</title>
-		<imagefile>3small</imagefile>
-	</figure>
-
-	<tip><para>
-<indexterm><primary>PNG</primary></indexterm>
-<indexterm><primary>AFPL</primary></indexterm>
-<indexterm><primary>ESP</primary></indexterm>
-	Use the <quote>gs -h</quote> command to check for all built-in <quote>devices</quote> on your Ghostscript
-	version. If you specify a parameter of <parameter>-sDEVICE=png256</parameter> on your Ghostscript command
-	line, you are asking Ghostscript to convert the input into a PNG file. Naming a <quote>device</quote> on the
-	command line is the most important single parameter to tell Ghostscript exactly how it should render the
-	input. New Ghostscript versions are released at fairly regular intervals, now by artofcode LLC. They are
-	initially put under the <quote>AFPL</quote> license, but re-released under the GNU GPL as soon as the next
-	AFPL version appears. GNU Ghostscript is probably the version installed on most Samba systems. But it has some
-	deficiencies.  <indexterm><primary>Ghostscript</primary><secondary>ESP</secondary><see>ESP
-	GhostScript</see></indexterm> Therefore, ESP Ghostscript was developed as an enhancement over GNU Ghostscript,
-	with lots of bug-fixes, additional devices, and improvements. It is jointly maintained by developers from
-	CUPS, Gutenprint, MandrakeSoft, SuSE, Red Hat, and Debian. It includes the <quote>cups</quote> device
-	(essential to print to non-PS printers from CUPS).
-	</para></tip>
-
-	</sect2>
-
-	<sect2>
-	<title>PostScript Printer Description (PPD) Specification</title>
-
-	<para>
-	<indexterm><primary>PPD</primary></indexterm>
-<indexterm><primary>PDL</primary></indexterm>
-<indexterm><primary>PostScript</primary></indexterm>
-	While PostScript in essence is a PDL to represent the page layout in a device-independent way, real-world
-	print jobs are always ending up being output on hardware with device-specific features. To take care of all
-	the differences in hardware and to allow for innovations, Adobe has specified a syntax and file format for
-	PostScript Printer Description (PPD) files. Every PostScript printer ships with one of these files.
-	</para>
-
-	<para>
-	PPDs contain all the information about general and special features of the
-	given printer model: Which different resolutions can it handle? Does
-	it have a duplexing unit? How many paper trays are there? What media
-	types and sizes does it take? For each item, it also names the special
-	command string to be sent to the printer (mostly inside the PostScript
-	file) in order to enable it.
-	</para>
-
-	<para>
-	Information from these PPDs is meant to be taken into account by the
-	printer drivers. Therefore, installed as part of the Windows
-	PostScript driver for a given printer is the printer's PPD. Where it
-	makes sense, the PPD features are presented in the drivers' UI dialogs
-	to display to the user a choice of print options. In the end, the
-	user selections are somehow written (in the form of special
-	PostScript, PJL, JCL, or vendor-dependent commands) into the PostScript
-	file created by the driver.
-	</para>
-
-	<warning><para>
-	<indexterm><primary>PDF</primary></indexterm>
-<indexterm><primary>PDF distilling</primary></indexterm>
-	A PostScript file that was created to contain device-specific commands
-	for achieving a certain print job output (e.g., duplexed, stapled, and
-	punched) on a specific target machine may not print as expected, or
-	may not be printable at all on other models; it also may not be fit
-	for further processing by software (e.g., by a PDF distilling program).
-	</para></warning>
-	</sect2>
-
-	<sect2>
-	<title>Using Windows-Formatted Vendor PPDs</title>
-
-	<para>
-<indexterm><primary>CUPS</primary></indexterm>
-<indexterm><primary>PPDs</primary></indexterm>
-<indexterm><primary>PostScript</primary></indexterm>
-	CUPS can handle all spec-compliant PPDs as supplied by the manufacturers for their PostScript models. Even if
-	a vendor does not mention our favorite OS in his or her manuals and brochures, you can safely trust this:
-	<emphasis>If you get the Windows NT version of the PPD, you can use it unchanged in CUPS</emphasis> and thus
-	access the full power of your printer just like a Windows NT user could!
-	</para>
-
-	<tip><para>
-	To check the spec compliance of any PPD online, go to <ulink noescape="1"
-	url="http://www.cups.org/testppd.php">http://www.cups.org/testppd.php</ulink> and upload your PPD. You will
-	see the results displayed immediately. CUPS in all versions after 1.1.19 has a much stricter internal PPD
-	parsing and checking code enabled; in case of printing trouble, this online resource should be one of your
-	first pit stops.
-	</para></tip>
-
-	<warning><para>
-	<indexterm><primary>foomatic</primary></indexterm>
-	<indexterm><primary>cupsomatic</primary></indexterm>
-	For real PostScript printers, <emphasis>do not</emphasis> use the <emphasis>Foomatic</emphasis> or
-	<emphasis>cupsomatic</emphasis> PPDs from Linuxprinting.org. With these devices, the original vendor-provided
-	PPDs are always the first choice.
-	</para></warning>
-
-	<tip><para>
-<indexterm><primary>W32X86/2</primary></indexterm>
-	If you are looking for an original vendor-provided PPD of a specific device, and you know that an NT4 box (or
-	any other Windows box) on your LAN has the PostScript driver installed, just use <command>smbclient
-	//NT4-box/print\$ -U username</command> to access the Windows directory where all printer driver files are
-	stored. First look in the <filename>W32X86/2</filename> subdirectory for the PPD you are seeking.
-	</para></tip>
-	</sect2>
-
-	<sect2>
-	<title>CUPS Also Uses PPDs for Non-PostScript Printers</title>
-
-	<para>
-<indexterm><primary>non-PostScript</primary></indexterm>
-<indexterm><primary>PPD</primary></indexterm>
-<indexterm><primary>CUPS filtering</primary></indexterm>
-	CUPS also uses specially crafted PPDs to handle non-PostScript printers. These PPDs are usually not available
-	from the vendors (and no, you can't just take the PPD of a PostScript printer with the same model name and
-	hope it works for the non-PostScript version too). To understand how these PPDs work for non-PS printers, we
-	first need to dive deeply into the CUPS filtering and file format conversion architecture. Stay tuned.
-	</para>
-
-	</sect2>
-
-</sect1>
-
-<sect1>
-<title>The CUPS Filtering Architecture</title>
-
-<para>
-<indexterm><primary>CUPS filtering</primary></indexterm>
-<indexterm><primary>Ghostscript</primary></indexterm>
-<indexterm><primary>MIME type</primary></indexterm>
-<indexterm><primary>MIME recognition</primary></indexterm>
-<indexterm><primary>MIME conversion rules</primary></indexterm>
-The core of the CUPS filtering system is based on Ghostscript. In addition to Ghostscript, CUPS uses some
-other filters of its own. You (or your OS vendor) may have plugged in even more filters. CUPS handles all data
-file formats under the label of various MIME types. Every incoming print file is subjected to an initial
-autotyping. The autotyping determines its given MIME type. A given MIME type implies zero or more possible
-filtering chains relevant to the selected target printer. This section discusses how MIME types recognition
-and conversion rules interact. They are used by CUPS to automatically set up a working filtering chain for any
-given input data format.
-</para>
-
-<para>
-If CUPS rasterizes a PostScript file natively to a bitmap, this is done in two stages:
-</para>
-
-<itemizedlist>
-	<listitem><para>
-<indexterm><primary>generic raster format</primary></indexterm>
-<indexterm><primary>CUPS raster</primary></indexterm>
-	The first stage uses a Ghostscript device named <quote>cups</quote>
-	(this is since version 1.1.15) and produces a generic raster format
-	called <quote>CUPS raster</quote>.
-	</para></listitem>
-
-	<listitem><para>
-<indexterm><primary>raster driver</primary></indexterm>
-	The second stage uses a <quote>raster driver</quote> that converts
-	the generic CUPS raster to a device-specific raster.
-	</para></listitem>
-</itemizedlist>
-
-<para>
-<indexterm><primary>Ghostscript</primary></indexterm>
-<indexterm><primary>GNU Ghostscript</primary></indexterm>
-<indexterm><primary>ESP Ghostscript</primary></indexterm>
-Make sure your Ghostscript version has the <quote>cups</quote> device compiled in (check with <command>gs -h |
-grep cups</command>). Otherwise you may encounter the dreaded <computeroutput>Unable to convert file
-0</computeroutput> in your CUPS error_log file. To have <quote>cups</quote> as a device in your Ghostscript,
-you either need to patch GNU Ghostscript and recompile or use
-<indexterm><primary>ESP</primary><secondary>Ghostscript</secondary></indexterm><ulink
-url="http://www.cups.org/ghostscript.php">ESP Ghostscript</ulink>. The superior alternative is ESP
-Ghostscript. It supports not just CUPS, but 300 other devices (while GNU Ghostscript supports only about 180).
-Because of this broad output device support, ESP Ghostscript is the first choice for non-CUPS spoolers, too.
-It is now recommended by Linuxprinting.org for all spoolers.
-</para>
-
-<para>
-<indexterm><primary>cupsomatic</primary></indexterm>
-<indexterm><primary>foomatic</primary></indexterm>
-<indexterm><primary>foomatic-rip</primary></indexterm>
-<indexterm><primary>ESP Ghostscript</primary></indexterm>
-CUPS printers may be set up to use external rendering paths. One of the most common is provided by the
-Foomatic/cupsomatic concept from <ulink url="http://www.linuxprinting.org/">Linuxprinting.org</ulink>. This
-uses the classical Ghostscript approach, doing everything in one step.  It does not use the
-<quote>cups</quote> device, but one of the many others. However, even for Foomatic/cupsomatic usage, best
-results and <indexterm><primary>ESP</primary><secondary>Ghostscript</secondary></indexterm> broadest printer
-model support is provided by ESP Ghostscript (more about Foomatic/cupsomatic, particularly the new version
-called now <emphasis>foomatic-rip</emphasis>, follows).
-</para>
-
-	<sect2>
-	<title>MIME Types and CUPS Filters</title>
-
-
-	<para>
-	<indexterm><primary>MIME</primary><secondary>filters</secondary></indexterm>
-	<indexterm><primary>MIME</primary></indexterm>
-<indexterm><primary>mime.types</primary></indexterm>
-<indexterm><primary>application/pdf</primary></indexterm>
-<indexterm><primary>autotyping</primary></indexterm>
-	CUPS reads the file <filename>/etc/cups/mime.types</filename> (and all other files carrying a
-	<filename>*.types</filename> suffix in the same directory) upon startup. These files contain the MIME type
-	recognition rules that are applied when CUPS runs its autotyping routines. The rule syntax is explained in the
-	man page for <filename>mime.types</filename> and in the comments section of the
-	<filename>mime.types</filename> file itself. A simple rule reads like this:
-	<indexterm><primary>application/pdf</primary></indexterm>
-<programlisting>
-application/pdf         pdf string(0,%PDF)
-</programlisting>
-<indexterm><primary>%PDF</primary></indexterm>
-<indexterm><primary>.pdf</primary></indexterm>
-	This means if a filename has a <filename>.pdf</filename> suffix or if the magic string
-	<emphasis>%PDF</emphasis> is right at the beginning of the file itself (offset 0 from the start), then it is a
-	PDF file (<parameter>application/pdf</parameter>).  Another rule is this:
-<programlisting>
-application/postscript  ai eps ps string(0,%!) string(0,<04>%!)
-</programlisting>
-<indexterm><primary>suffixes</primary></indexterm>
-<indexterm><primary>.ai</primary></indexterm>
-<indexterm><primary>.eps</primary></indexterm>
-<indexterm><primary>.ps</primary></indexterm>
-<indexterm><primary>generic PostScript</primary></indexterm>
-<indexterm><primary>application/postscript</primary></indexterm>
-	If the filename has one of the suffixes <filename>.ai</filename>, <filename>.eps</filename>,
-	<filename>.ps</filename>, or if the file itself starts with one of the strings <emphasis>%!</emphasis> or
-	<emphasis><![CDATA[<04>%!]]></emphasis>, it is a generic PostScript file
-	(<parameter>application/postscript</parameter>).
-	</para>
-
-	<warning><para>
-<indexterm><primary>/etc/cups/</primary></indexterm>
-	Don't confuse the other mime.types files your system might be using
-	with the one in the <filename>/etc/cups/</filename> directory.
-	</para></warning>
-
-	<note><para>
-<indexterm><primary>application/postscript</primary></indexterm>
-<indexterm><primary>PostScript</primary></indexterm>
-<indexterm><primary>filter</primary></indexterm>
-<indexterm><primary>PPD</primary></indexterm>
-<indexterm><primary>transformation</primary></indexterm>
-	There is an important difference between two similar MIME types in CUPS: one is
-	<parameter>application/postscript</parameter>, the other is
-	<parameter>application/vnd.cups-postscript</parameter>. While <parameter>application/postscript</parameter> is
-	meant to be device-independent, job options for the file are still outside the PS file content, embedded in
-	command line or environment variables by CUPS, <parameter>application/vnd.cups-postscript</parameter> may have
-	the job options inserted into the PostScript data itself (where applicable). The transformation of the generic
-	PostScript (<parameter>application/postscript</parameter>) to the device-specific version
-	(<parameter>application/vnd.cups-postscript</parameter>) is the responsibility of the CUPS
-	<parameter>pstops</parameter> filter. pstops uses information contained in the PPD to do the transformation.
-	</para></note>
-
-	<para>
-<indexterm><primary>ASCII</primary></indexterm>
-<indexterm><primary>HP-GL</primary></indexterm>
-<indexterm><primary>PDF</primary></indexterm>
-<indexterm><primary>PostScript</primary></indexterm>
-<indexterm><primary>DVI</primary></indexterm>
-<indexterm><primary>GIF</primary></indexterm>
-<indexterm><primary>PNG</primary></indexterm>
-<indexterm><primary>TIFF</primary></indexterm>
-<indexterm><primary>JPEG</primary></indexterm>
-<indexterm><primary>Photo-CD</primary></indexterm>
-<indexterm><primary>SUN-Raster</primary></indexterm>
-<indexterm><primary>PNM</primary></indexterm>
-<indexterm><primary>PBM</primary></indexterm>
-<indexterm><primary>SGI-RGB</primary></indexterm>
-<indexterm><primary>MIME</primary></indexterm>
-<indexterm><primary>filters</primary></indexterm>
-	CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI, and
-	many image formats (GIF, PNG, TIFF, JPEG, Photo-CD, SUN-Raster,
-	PNM, PBM, SGI-RGB, and more) and their associated MIME types
-	with its filters.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>MIME Type Conversion Rules</title>
-
-
-	<para>
-	<indexterm><primary>MIME</primary></indexterm>
-	<indexterm><primary>application/pdf</primary></indexterm>
-<indexterm><primary>/etc/cups/mime.convs</primary></indexterm>
-<indexterm><primary>application/pdf</primary></indexterm>
-<indexterm><primary>application/postscript</primary></indexterm>
-	CUPS reads the file <filename>/etc/cups/mime.convs</filename>
-	(and all other files named with a <filename>*.convs</filename>
-	suffix in the same directory) upon startup. These files contain
-	lines naming an input MIME type, an output MIME type, a format
-	conversion filter that can produce the output from the input type,
-	and virtual costs associated with this conversion. One example line
-	reads like this:
-<programlisting>
-application/pdf         application/postscript   33   pdftops
-</programlisting>
-<indexterm><primary>pdftops</primary></indexterm>
-	This means that the <parameter>pdftops</parameter> filter will take
-	<parameter>application/pdf</parameter> as input and produce
-	<parameter>application/postscript</parameter> as output; the virtual
-	cost of this operation is 33 CUPS-$. The next filter is more
-	expensive, costing 66 CUPS-$:
-	<indexterm><primary>pdf</primary></indexterm>
-<programlisting>
-application/vnd.hp-HPGL application/postscript   66   hpgltops
-</programlisting>
-<indexterm><primary>hpgltops</primary></indexterm>
-	This is the <parameter>hpgltops</parameter>, which processes HP-GL
-	plotter files to PostScript.
-	<indexterm><primary>application/octet-stream</primary></indexterm>
-<programlisting>
-application/octet-stream
-</programlisting>
-	Here are two more examples: 
-	<indexterm><primary>text/plain</primary></indexterm>
-<indexterm><primary>application/x-shell</primary></indexterm>
-<indexterm><primary>text/plain</primary></indexterm>
-<indexterm><primary>texttops</primary></indexterm>
-<programlisting>
-application/x-shell     application/postscript   33    texttops
-text/plain              application/postscript   33    texttops
-</programlisting>
-<indexterm><primary>application/x-shell</primary></indexterm>
-	The last two examples name the <parameter>texttops</parameter> filter to work on
-	<parameter>text/plain</parameter> as well as on <parameter>application/x-shell</parameter>. (Hint: This
-	differentiation is needed for the syntax highlighting feature of <parameter>texttops</parameter>).
-	</para>
-	</sect2>
-
-	<sect2>
-	<title>Filtering  Overview</title>
-
-	<para>
-	<indexterm><primary>MIME</primary></indexterm>
-	There are many more combinations named in <filename>mime.convs</filename>. However, you are not limited to use
-	the ones predefined there. You can plug in any filter you like to the CUPS framework. It must meet, or must be
-	made to meet, some minimal requirements. If you find (or write) a cool conversion filter of some kind, make
-	sure it complies with what CUPS needs and put in the right lines in <filename>mime.types</filename> and
-	<filename>mime.convs</filename>; then it will work seamlessly inside CUPS.
-	</para>
-
-	<sect3>
-	<title>Filter Requirements</title>
-
-	<para>
-	The <quote>CUPS requirements</quote> for filters are simple. Take filenames or <filename>stdin</filename> as
-	input and write to <filename>stdout</filename>. They should take these arguments:
-	</para>
-
-	<variablelist>
-		<varlistentry><term>printer</term>
-			<listitem><para>
-			The name of the printer queue (normally this is the name of the filter being run).
-			</para></listitem>
-		</varlistentry>
-
-		<varlistentry><term>job</term>
-			<listitem><para>
-			The numeric job ID for the job being printed.
-			</para></listitem>
-		</varlistentry>
-
-		<varlistentry><term>user</term>
-			<listitem><para>
-			The string from the originating-user-name attribute.
-			</para></listitem>
-		</varlistentry>
-
-		<varlistentry><term>title</term>
-			<listitem><para>
-			The string from the job-name attribute.
-			</para></listitem>
-		</varlistentry>
-
-		<varlistentry><term>copies</term>
-			<listitem><para>
-			The numeric value from the number-copies attribute.
-			</para></listitem>
-		</varlistentry>
-
-		<varlistentry><term>options</term>
-			<listitem><para>
-			The job options.
-			</para></listitem>
-		</varlistentry>
-
-		<varlistentry><term>filename</term>
-			<listitem><para>
-			(optionally) The print request file (if missing, filters expect data
-			fed through <filename>stdin</filename>). In most cases, it is easy to
-			write a simple wrapper script around existing filters to make them work with CUPS.
-			</para></listitem>
-		</varlistentry>
-	</variablelist>
-
-	</sect3>
-
-	</sect2>
-
-	<sect2>
-	<title>Prefilters</title>
-
-	<para>
-	<indexterm><primary>PostScript</primary></indexterm>
-<indexterm><primary>non-PostScript printers</primary></indexterm>
-<indexterm><primary>raster</primary></indexterm>
-	As previously stated, PostScript is the central file format to any UNIX-based
-	printing system. From PostScript, CUPS generates raster data to feed
-	non-PostScript printers.
-	</para>
-
-	<para>
-<indexterm><primary>prefilters</primary></indexterm>
-<indexterm><primary>PostScript</primary></indexterm>
-<indexterm><primary>ASCII text</primary></indexterm>
-<indexterm><primary>PDF</primary></indexterm>
-<indexterm><primary>DVI</primary></indexterm>
-<indexterm><primary>HP-GL.</primary></indexterm>
-<indexterm><primary>MIME type</primary></indexterm>
-<indexterm><primary>application/postscript</primary></indexterm>
-<indexterm><primary>pstops</primary></indexterm>
-<indexterm><primary>application/vnd.cups-postscript</primary></indexterm>
-	But what happens if you send one of the supported non-PS formats to print? Then CUPS runs
-	<quote>prefilters</quote> on these input formats to generate PostScript first. There are prefilters to create
-	PostScript from ASCII text, PDF, DVI, or HP-GL. The outcome of these filters is always of MIME type
-	<parameter>application/postscript</parameter> (meaning that any device-specific print options are not yet
-	embedded into the PostScript by CUPS and that the next filter to be called is pstops). Another prefilter is
-	running on all supported image formats, the <parameter>imagetops</parameter> filter. Its outcome is always of
-	MIME type <parameter>application/vnd.cups-postscript</parameter> (not application/postscript), meaning it has
-	the print options already embedded into the file. This is shown in <link linkend="f4small">Prefiltering in
-	CUPS to Form PostScript</link>.
-	</para>
-
-	<figure id="f4small">
-		<title>Prefiltering in CUPS to Form PostScript.</title>
-		<imagefile scale="25">4small</imagefile>
-	</figure>
-
-	</sect2>
-
-	<sect2>
-	<title>pstops</title>
-
-	<para>
-<indexterm><primary>pstops</primary></indexterm>
-<indexterm><primary>application/postscript</primary></indexterm>
-<indexterm><primary>application/vnd.cups-postscript</primary></indexterm>
-<indexterm><primary>output duplexing</primary></indexterm>
-<indexterm><primary>stapling</primary></indexterm>
-<indexterm><primary>punching</primary></indexterm>
-<indexterm><primary>PostScript</primary></indexterm>
-	<emphasis>pstops</emphasis> is a filter that is used to convert <parameter>application/postscript</parameter> to
-	<parameter>application/vnd.cups-postscript</parameter>. As stated earlier, this filter inserts all
-	device-specific print options (commands to the printer to ask for the duplexing of output, or stapling and
-	punching it, and so on) into the PostScript file. An example is illustrated in <link
-	linkend="f5small">Adding Device-Specific Print Options</link>.
-	</para>
-
-	<figure id="f5small">
-		<title>Adding Device-Specific Print Options.</title>
-		<imagefile scale="25">5small</imagefile>
-	</figure>
-
-	<para>
-	This is not all. Other tasks performed by it are:
-	</para>
-
-	<itemizedlist>
-		<listitem><para>
-		Selecting the range of pages to be printed (e.g., you can choose to
-		print only pages <quote>3, 6, 8-11, 16, and 19-21</quote>, or only odd-numbered
-		pages).
-		</para></listitem>
-
-		<listitem><para>
-		Putting two or more logical pages on one sheet of paper (the
-		so-called <quote>number-up</quote> function).
-		</para></listitem>
-
-		<listitem><para>Counting the pages of the job to insert the accounting
-		information into the <filename>/var/log/cups/page_log</filename>.
-		</para></listitem>
-	</itemizedlist>
-	</sect2>
-
-	<sect2>
-	<title>pstoraster</title>
-
-	<para>
-<indexterm><primary>pstoraster</primary></indexterm>
-<indexterm><primary>rasterization</primary></indexterm>
-<indexterm><primary>raster drivers</primary></indexterm>
-	<parameter>pstoraster</parameter> is at the core of the CUPS filtering system. It is responsible for the first
-	stage of the rasterization process. Its input is of MIME type application/vnd.cups-postscript; its output is
-	application/vnd.cups-raster. This output format is not yet meant to be printable. Its aim is to serve as a
-	general-purpose input format for more specialized <emphasis>raster drivers</emphasis> that are able to
-	generate device-specific printer data. This is shown in <link linkend="cups-raster">the PostScript to
-	Intermediate Raster Format diagram</link>.
-	</para>
-
-	<figure id="cups-raster">
-		<title>PostScript to Intermediate Raster Format.</title>
-		<imagefile scale="25">6small</imagefile>
-	</figure>
-
-	<para>
-<indexterm><primary>CUPS raster</primary></indexterm>
-<indexterm><primary>generic raster</primary></indexterm>
-<indexterm><primary>IANA</primary></indexterm>
-<indexterm><primary>raster drivers</primary></indexterm>
-	CUPS raster is a generic raster format with powerful features. It is able to include per-page information,
-	color profiles, and more, to be used by the downstream raster drivers. Its MIME type is registered with IANA
-	and its specification is, of course, completely open. It is designed to make it quite easy and inexpensive for
-	manufacturers to develop Linux and UNIX raster drivers for their printer models should they choose to do so.
-	CUPS always takes care of the first stage of rasterization so these vendors do not need to care about
-	Ghostscript complications (in fact, there are currently more than one vendor financing the development of CUPS
-	raster drivers). This is illustrated in <link linkend="cups-raster2">the CUPS-Raster Production Using
-	Ghostscript illustration</link>.
-	</para>
-
-	<figure id="cups-raster2">
-		<title>CUPS-Raster Production Using Ghostscript.</title>
-		<imagefile>7small</imagefile>
-	</figure>
-
-	<para>
-<indexterm><primary>pstoraster</primary></indexterm>
-<indexterm><primary>GNU Ghostscript</primary></indexterm>
-<indexterm><primary>AFPL Ghostscript</primary></indexterm>
-<indexterm><primary>standalone filter</primary></indexterm>
-	CUPS versions before version 1.1.15 shipped a binary (or source code) standalone filter, named
-	<parameter>pstoraster</parameter>. <parameter>pstoraster</parameter>, which was derived from GNU Ghostscript
-	5.50 and could be installed instead of and in addition to any GNU or AFPL Ghostscript package without
-	conflicting.
-	</para>
-
-	<para>
-	Since version 1.1.15, this feature has changed. The functions for this filter have been integrated back
-	into Ghostscript (now based on GNU Ghostscript version 7.05). The <parameter>pstoraster</parameter> filter is
-	now a simple shell script calling <command>gs</command> with the <command>-sDEVICE=cups</command> parameter.
-	If your Ghostscript fails when this command is executed: <command>gs -h |grep cups</command>, you might not 
-	be able to print, update your Ghostscript.
-	</para>
-	</sect2>
-
-	<sect2>
-	<title>imagetops and imagetoraster</title>
-
-	<para>
-<indexterm><primary>prefilter</primary></indexterm>
-<indexterm><primary>imagetoraster</primary></indexterm>
-	In the section about prefilters, we mentioned the prefilter
-	that generates PostScript from image formats. The <parameter>imagetoraster</parameter>
-	filter is used to convert directly from image to raster, without the
-	intermediate PostScript stage. It is used more often than the previously
-	mentioned prefilters. We summarize in a flowchart the image file
-	filtering in <link linkend="small8">the Image Format to CUPS-Raster Format Conversion illustration</link>.
-	</para>
-
-	<figure id="small8">
-		<title>Image Format to CUPS-Raster Format Conversion.</title>
-		<imagefile>8small</imagefile>
-	</figure>
-
-	</sect2>
-
-	<sect2>
-	<title>rasterto [printers specific]</title>
-
-	<para>
-<indexterm><primary>rastertoalps</primary></indexterm>
-<indexterm><primary>rastertobj</primary></indexterm>
-<indexterm><primary>rastertoepson</primary></indexterm>
-<indexterm><primary>rastertoescp</primary></indexterm>
-<indexterm><primary>rastertopcl</primary></indexterm>
-<indexterm><primary>rastertoturboprint</primary></indexterm>
-<indexterm><primary>rastertoescp</primary></indexterm>
-<indexterm><primary>rastertohp</primary></indexterm>
-<indexterm><primary>rastertoprinter</primary></indexterm>
-<indexterm><primary>rastertoprinter</primary></indexterm>
-<indexterm><primary>Gutenprint</primary></indexterm>
-	CUPS ships with quite a variety of raster drivers for processing CUPS raster. On my system, I find in
-	/usr/lib/cups/filter/ the following: <parameter>rastertoalps</parameter>, <parameter>rastertobj</parameter>,
-	<parameter>rastertoepson</parameter>, <parameter>rastertoescp</parameter>, <parameter>rastertopcl</parameter>,
-	<parameter>rastertoturboprint</parameter>, <parameter>rastertoapdk</parameter>,
-	<parameter>rastertodymo</parameter>, <parameter>rastertoescp</parameter>, <parameter>rastertohp</parameter>,
-	and <parameter>rastertoprinter</parameter>. Don't worry if you have fewer drivers than this; some of these are
-	installed by commercial add-ons to CUPS (like <parameter>rastertoturboprint</parameter>), and others (like
-	<parameter>rastertoprinter</parameter>) by third-party driver development projects (such as Gutenprint)
-	wanting to cooperate as closely as possible with CUPS. See <link linkend="small9">the Raster to
-	Printer-Specific Formats illustration</link>.
-	</para>
-
-		<figure id="small9">
-			<title>Raster to Printer-Specific Formats.</title>
-			<imagefile>9small</imagefile>
-		</figure>
-	</sect2>
-
-	<sect2>
-	<title>CUPS Backends</title>
-
-	<para>
-<indexterm><primary>CUPS filtering chain</primary></indexterm>
-<indexterm><primary>print queue</primary></indexterm>
-	The last part of any CUPS filtering chain is a backend. Backends
-	are special programs that send the print-ready file to the final
-	device. There is a separate backend program for any transfer
-	protocol for sending print jobs over the network, and one for every local
-	interface. Every CUPS print queue needs to have a CUPS <quote>device-URI</quote>
-	associated with it. The device URI is the way to encode the backend
-	used to send the job to its destination. Network device-URIs use
-	two slashes in their syntax, local device URIs only one, as you can
-	see from the following list. Keep in mind that local interface names
-	may vary greatly from my examples, if your OS is not Linux:
-	</para>
-
-	<variablelist>
-		<varlistentry><term>usb</term>
-		<listitem><para>
-		This backend sends print files to USB-connected printers. An
-		example for the CUPS device-URI to use is
-		<filename>usb:/dev/usb/lp0</filename>.
-		</para></listitem></varlistentry>
-
-		<varlistentry><term>serial</term>
-		<listitem><para>
-		This backend sends print files to serially connected printers.
-		An example for the CUPS device-URI to use is
-		<filename>serial:/dev/ttyS0?baud=11500</filename>.
-		</para></listitem></varlistentry>
-
-		<varlistentry><term>parallel</term>
-		<listitem><para>
-		This backend sends print files to printers connected to the
-		parallel port. An example for the CUPS device-URI to use is
-		<filename>parallel:/dev/lp0</filename>.
-		</para></listitem></varlistentry>
-
-		<varlistentry><term>SCSI</term>
-		<listitem><para>
-		This backend sends print files to printers attached to the
-		SCSI interface. An example for the CUPS device-URI to use is
-		<filename>scsi:/dev/sr1</filename>.
-		</para></listitem></varlistentry>
-
-		<varlistentry><term>lpd</term>
-		<listitem><para>
-		This backend sends print files to LPR/LPD-connected network
-		printers. An example for the CUPS device-URI to use is
-		<filename>lpd://remote_host_name/remote_queue_name</filename>.
-		</para></listitem></varlistentry>
-
-		<varlistentry><term>AppSocket/HP JetDirect</term>
-		<listitem><para>
-		This backend sends print files to AppSocket (a.k.a., HP
-		JetDirect) connected network printers. An example for the CUPS
-		device-URI to use is
-		<filename>socket://10.11.12.13:9100</filename>.
-		</para></listitem></varlistentry>
-
-		<varlistentry><term>ipp</term>
-		<listitem><para>
-		This backend sends print files to IPP-connected network
-		printers (or to other CUPS servers). Examples for CUPS device-URIs
-		to use are
-		<filename>ipp:://192.193.194.195/ipp</filename>
-		(for many HP printers) and
-		<filename>ipp://remote_cups_server/printers/remote_printer_name</filename>.
-		</para></listitem></varlistentry>
-
-		<varlistentry><term>http</term>
-		<listitem><para>
-		This backend sends print files to HTTP-connected printers.
-		(The http:// CUPS backend is only a symlink to the ipp:// backend.)
-		Examples for the CUPS device-URIs to use are
-		<filename>http:://192.193.194.195:631/ipp</filename>
-		(for many HP printers) and
-		<filename>http://remote_cups_server:631/printers/remote_printer_name</filename>.
-		</para></listitem></varlistentry>
-
-		<varlistentry><term>smb</term>
-		<listitem><para>
-		This backend sends print files to printers shared by a Windows
-		host. Examples of CUPS device-URIs that may be used includes:
-		</para>
-
-		<para>
-		<simplelist>
-		<member><filename>smb://workgroup/server/printersharename</filename></member>
-		<member><filename>smb://server/printersharename</filename></member>
-		<member><filename>smb://username:password@workgroup/server/printersharename</filename></member>
-		<member><filename>smb://username:password@server/printersharename</filename></member>
-		</simplelist>
-		</para>
-
-		<para>
-		The smb:// backend is a symlink to the Samba utility
-		<parameter>smbspool</parameter> (does not ship with CUPS). If the
-		symlink is not present in your CUPS backend directory, have your
-		root user create it: <command>ln -s `which smbspool'
-		/usr/lib/cups/backend/smb</command>.
-		</para></listitem></varlistentry>
-	</variablelist>
-
-	<para>
-	It is easy to write your own backends as shell or Perl scripts if you
-	need any modification or extension to the CUPS print system. One
-	reason could be that you want to create <quote>special</quote> printers that send
-	the print jobs as email (through a <quote>mailto:/</quote> backend), convert them to
-	PDF (through a <quote>pdfgen:/</quote> backend) or dump them to <quote>/dev/null</quote>. (In
-	fact, I have the systemwide default printer set up to be connected to
-	a devnull:/ backend: there are just too many people sending jobs
-	without specifying a printer, and scripts and programs that do not name
-	a printer. The systemwide default deletes the job and sends a polite
-	email back to the $USER asking him or her to always specify the correct
-	printer name.)
-	</para>
-
-	<para>
-<indexterm><primary>lpinfo</primary></indexterm>
-<indexterm><primary>CUPS backends</primary></indexterm>
-	Not all of the mentioned backends may be present on your system or
-	usable (depending on your hardware configuration). One test for all
-	available CUPS backends is provided by the <emphasis>lpinfo</emphasis>
-	utility. Used with the <option>-v</option> parameter, it lists
-	all available backends:
-	</para>
-
-	<para><screen>
-	&prompt;<userinput>lpinfo -v</userinput>
-	</screen></para>
-	</sect2>
-
-	<sect2>
-	<title>The Role of <parameter>cupsomatic/foomatic</parameter></title>
-
-	<para>
-	<indexterm><primary>cupsomatic</primary></indexterm>
-	<indexterm><primary>foomatic</primary></indexterm>
-<indexterm><primary>PPDs</primary></indexterm>
-<indexterm><primary>Foomatic Printer</primary></indexterm>
-<indexterm><primary>Linuxprinting.org</primary></indexterm>
-	<parameter>cupsomatic</parameter> filters may be the most widely used on CUPS
-	installations. You must be clear that these were not
-	developed by the CUPS people. They are a third-party add-on to
-	CUPS. They utilize the traditional Ghostscript devices to render jobs
-	for CUPS. When troubleshooting, you should know about the
-	difference. Here the whole rendering process is done in one stage,
-	inside Ghostscript, using an appropriate device for the target
-	printer. <parameter>cupsomatic</parameter> uses PPDs that are generated from the Foomatic
-	Printer & Driver Database at Linuxprinting.org.
-	</para>
-
-	<para>
-	You can recognize these PPDs from the line calling the
-	<parameter>cupsomatic</parameter> filter:
-<programlisting>
-*cupsFilter: "application/vnd.cups-postscript  0  cupsomatic"
-</programlisting>
-	You may find this line among the first 40 or so lines of the PPD
-	file. If you have such a PPD installed, the printer shows up in the
-	CUPS Web interface with a <parameter>foomatic</parameter> namepart for
-	the driver description. <parameter>cupsomatic</parameter> is a Perl script that runs
-	Ghostscript with all the complicated command line options
-	autoconstructed from the selected PPD and command line options given to
-	the print job.
-	</para>
-
-	<para>
-	<indexterm><primary>point'n'print</primary></indexterm>
-<indexterm><primary>foomatic-rip</primary></indexterm>
-<indexterm><primary>Adobe specifications</primary></indexterm>
-<indexterm><primary>hi-res photo</primary></indexterm>
-<indexterm><primary>normal color</primary></indexterm>
-<indexterm><primary>grayscale</primary></indexterm>
-<indexterm><primary>draft</primary></indexterm>
-<indexterm><primary>media type</primary></indexterm>
-<indexterm><primary>resolution</primary></indexterm>
-<indexterm><primary>inktype</primary></indexterm>
-<indexterm><primary>dithering algorithm</primary></indexterm>
-	However, <parameter>cupsomatic</parameter> is now deprecated. Its PPDs (especially the first
-	generation of them, still in heavy use out there) are not meeting the
-	Adobe specifications. You might also suffer difficulties when you try
-	to download them with <quote>Point'n'Print</quote> to Windows clients. A better
-	and more powerful successor is now available: it is called <parameter>foomatic-rip</parameter>. To use
-	<parameter>foomatic-rip</parameter> as a filter with CUPS, you need the new type of PPDs, which
-	have a similar but different line:
-<programlisting>
-*cupsFilter: "application/vnd.cups-postscript  0  foomatic-rip"
-</programlisting>
-	The PPD-generating engine at Linuxprinting.org has been revamped.
-	The new PPDs comply with the Adobe spec. They also provide a
-	new way to specify different quality levels (hi-res photo, normal
-	color, grayscale, and draft) with a single click, whereas before you
-	could have required five or more different selections (media type,
-	resolution, inktype, and dithering algorithm). There is support for
-	custom-size media built in. There is support to switch
-	print options from page to page in the middle of a job. And the
-	best thing is that the new <constant>foomatic-rip</constant> works seamlessly with all
-	legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR, and so on), providing
-	for them access to use PPDs for their printing.
-	</para>
-	</sect2>
-
-	<sect2>
-	<title>The Complete Picture</title>
-
-	<para>
-	If you want to see an overview of all the filters and how they
-	relate to each other, the complete picture of the puzzle is at the end
-	of this chapter.
-	</para>
-	</sect2>
-
-	<sect2>
-	<title><filename>mime.convs</filename></title>
-
-	<para>
-	CUPS autoconstructs all possible filtering chain paths for any given
-	MIME type and every printer installed. But how does it decide in
-	favor of or against a specific alternative?  (There may be cases
-	where there is a choice of two or more possible filtering chains for
-	the same target printer.) Simple. You may have noticed the figures in
-	the third column of the mime.convs file. They represent virtual costs
-	assigned to this filter. Every possible filtering chain will sum up to
-	a total <quote>filter cost.</quote> CUPS decides for the most <quote>inexpensive</quote> route.
-	</para>
-
-	<tip><para>
-<indexterm><primary>cupsd.conf</primary></indexterm>
-<indexterm><primary>FilterLimit</primary></indexterm>
-	Setting <parameter>FilterLimit 1000</parameter> in
-	<filename>cupsd.conf</filename> will not allow more filters to
-	run concurrently than will consume a total of 1000 virtual filter
-	cost. This is an efficient way to limit the load of any CUPS
-	server by setting an appropriate <quote>FilterLimit</quote> value. A FilterLimit of
-	200 allows roughly one job at a time, while a FilterLimit of 1000 allows
-	approximately five jobs maximum at a time.
-	</para></tip>
-	</sect2>
-
-	<sect2>
-	<title><quote>Raw</quote> Printing</title>
-
-	<para>
-<indexterm><primary>PPD</primary></indexterm>
-<indexterm><primary>lpadmin</primary></indexterm>
-<indexterm><primary>rawprinter</primary></indexterm>
-	You can tell CUPS to print (nearly) any file <quote>raw</quote>. <quote>Raw</quote> means it will not be
-	filtered. CUPS will send the file to the printer <quote>as is</quote> without bothering if the printer is able
-	to digest it. Users need to take care themselves that they send sensible data formats only. Raw printing can
-	happen on any queue if the <quote><parameter>-o raw</parameter></quote> option is specified on the command
-	line. You can also set up raw-only queues by simply not associating any PPD with it. This command:
-<screen>
-&prompt;<userinput>lpadmin -P rawprinter -v socket://11.12.13.14:9100 -E</userinput>
-</screen>
-	sets up a queue named <quote>rawprinter</quote>, connected via the <quote>socket</quote> protocol (a.k.a.
-	<quote>HP JetDirect</quote>) to the device at IP address 11.12.1.3.14, using port 9100. (If you had added a
-	PPD with <command>-P /path/to/PPD</command> to this command line, you would have installed a
-	<quote>normal</quote> print queue.)
-	</para>
-
-	<para>
-	CUPS will automatically treat each job sent to a queue as a <quote>raw</quote> one
-	if it can't find a PPD associated with the queue. However, CUPS will
-	only send known MIME types (as defined in its own mime.types file) and
-	refuse others.
-	</para>
-	</sect2>
-
-	<sect2>
-	<title>application/octet-stream Printing</title>
-
-	<para>
-<indexterm><primary>/etc/cups/mime.types</primary></indexterm>
-<indexterm><primary>application/octet-stream</primary></indexterm>
-	Any MIME type with no rule in the <filename>/etc/cups/mime.types</filename> file is regarded as unknown
-	or <parameter>application/octet-stream</parameter> and will not be
-	sent. Because CUPS refuses to print unknown MIME types by default,
-	you will probably have experienced that print jobs originating
-	from Windows clients were not printed. You may have found an error
-	message in your CUPS logs like:
-	</para>
-
-	<para><computeroutput>
-	 Unable to convert file 0 to printable format for job
-	</computeroutput></para>
-
-	<para>
-	To enable the printing of <parameter>application/octet-stream</parameter> files, edit
-	these two files:
-	</para>
-
-	<itemizedlist>
-		<listitem><para><filename>/etc/cups/mime.convs</filename></para></listitem>
-
-		<listitem><para><filename>/etc/cups/mime.types</filename></para></listitem>
-	</itemizedlist>
-
-	<para>
-<indexterm><primary>raw mode</primary></indexterm>
-	Both contain entries (at the end of the respective files) that must be uncommented to allow raw mode
-	operation for <parameter>application/octet-stream</parameter>. In <filename>/etc/cups/mime.types</filename>
-	make sure this line is present:
-	<indexterm><primary>application/octet-stream</primary></indexterm>
-<programlisting>
-application/octet-stream
-</programlisting>
-	This line (with no specific autotyping rule set) makes all files
-	not otherwise auto-typed a member of <parameter>application/octet-stream</parameter>. In
-	<filename>/etc/cups/mime.convs</filename>, have this
-	line: 
-<programlisting>
-application/octet-stream   application/vnd.cups-raw   0   -
-</programlisting>
-	<indexterm><primary>MIME</primary></indexterm>
-	This line tells CUPS to use the <emphasis>Null Filter</emphasis>
-	(denoted as <quote>-</quote>, doing nothing at all) on
-	<parameter>application/octet-stream</parameter>, and tag the result as
-	<parameter>application/vnd.cups-raw</parameter>. This last one is
-	always a green light to the CUPS scheduler to now hand the file over
-	to the backend connecting to the printer and sending it over.
-	</para>
-
-	<note><para>
-	Editing the <filename>mime.convs</filename> and the <filename>mime.types</filename> file does not
-	<emphasis>enforce</emphasis> <quote>raw</quote> printing, it only <emphasis>allows</emphasis> it.
-	</para></note>
-
-	<formalpara>
-	<title>Background</title>
-
-	<para>
-<indexterm><primary>security-aware</primary></indexterm>
-<indexterm><primary>MIME type</primary></indexterm>
-<indexterm><primary>/etc/cups/mime.types</primary></indexterm>
-<indexterm><primary>/etc/cups/mime.convs</primary></indexterm>
-	That CUPS is a more security-aware printing system than traditional ones
-	does not by default allow one to send deliberate (possibly binary)
-	data to printing devices. (This could be easily abused to launch a
-	Denial of Service attack on your printer(s), causing at least the loss
-	of a lot of paper and ink.) <quote>Unknown</quote> data are regarded by CUPS
-	as <emphasis>MIME type</emphasis> <emphasis>application/octet-stream</emphasis>. While you
-	<emphasis>can</emphasis> send data <quote>raw</quote>, the MIME type for these must
-	be one that is known to CUPS and allowed by it. The file
-	<filename>/etc/cups/mime.types</filename> defines the <quote>rules</quote> of how CUPS
-	recognizes MIME types. The file <filename>/etc/cups/mime.convs</filename> decides which file
-	conversion filter(s) may be applied to which MIME types.
-	</para>
-	</formalpara>
-	</sect2>
-
-	<sect2>
-	<title>PostScript Printer Descriptions for Non-PostScript Printers</title>
-
-	<para>
-	<indexterm><primary>PPD</primary></indexterm>
-<indexterm><primary>non-PostScript</primary></indexterm>
-<indexterm><primary>PostScript</primary></indexterm>
-<indexterm><primary>RIP</primary></indexterm>
-<indexterm><primary>Ghostscript</primary></indexterm>
-<indexterm><primary>device-specific commands</primary></indexterm>
-	Originally PPDs were meant to be used for PostScript printers
-	only. Here, they help to send device-specific commands and settings
-	to the RIP, which processes the job file. CUPS has extended this
-	scope for PPDs to cover non-PostScript printers too. This was not
-	difficult, because it is a standardized file format. In a way
-	it was logical too: CUPS handles PostScript and uses a PostScript
-	RIP (Ghostscript) to process the job files. The only difference is that
-	a PostScript printer has the RIP built-in, for other types of
-	printers the Ghostscript RIP runs on the host computer.
-	</para>
-
-	<para>
-	PPDs for a non-PostScript printer have a few lines that are unique to
-	CUPS. The most important one looks similar to this:
-	<indexterm><primary>application/vnd.cups-raster</primary></indexterm>
-<programlisting>
-*cupsFilter: application/vnd.cups-raster  66   rastertoprinter
-</programlisting>
-	It is the last piece in the CUPS filtering puzzle. This line tells the
-	CUPS daemon to use as a last filter <parameter>rastertoprinter</parameter>. This filter
-	should be served as input an <parameter>application/vnd.cups-raster</parameter> MIME type
-	file. Therefore, CUPS should autoconstruct a filtering chain, which
-	delivers as its last output the specified MIME type. This is then
-	taken as input to the specified <parameter>rastertoprinter</parameter> filter. After
-	the last filter has done its work (<parameter>rastertoprinter</parameter> is a Gutenprint
-	filter), the file should go to the backend, which sends it to the
-	output device.
-	</para>
-
-	<para>
-	CUPS by default ships only a few generic PPDs, but they are good for
-	several hundred printer models. You may not be able to control
-	different paper trays, or you may get larger margins than your
-	specific model supports. See Table 21.1<link linkend="cups-ppds"></link> for summary information.
-	</para>
-
-	<table frame="all" id="cups-ppds">
-		<title>PPDs Shipped with CUPS</title>
-		<tgroup cols="2" align="left">
-			<colspec align="left"/>
-			<colspec align="justify" colwidth="1*"/>
-			<thead><row><entry>PPD file</entry><entry>Printer type</entry></row></thead>
-			<tbody>
-			<row><entry>deskjet.ppd</entry><entry>older HP inkjet printers and compatible</entry></row>
-
-			<row><entry>deskjet2.ppd</entry> <entry>newer HP inkjet printers and compatible </entry> </row>
-
-			<row><entry>dymo.ppd</entry> <entry>label printers </entry> </row>
-
-			<row><entry>epson9.ppd</entry> <entry>Epson 24-pin impact printers and compatible </entry> </row>
-
-			<row><entry>epson24.ppd</entry> <entry>Epson 24-pin impact printers and compatible </entry> </row>
-
-			<row><entry>okidata9.ppd</entry> <entry>Okidata 9-pin impact printers and compatible </entry> </row>
-
-			<row><entry>okidat24.ppd</entry> <entry>Okidata 24-pin impact printers and compatible </entry> </row>
-
-			<row><entry>stcolor.ppd</entry> <entry>older Epson Stylus Color printers </entry> </row>
-
-			<row><entry>stcolor2.ppd</entry> <entry>newer Epson Stylus Color printers </entry> </row>
-
-			<row><entry>stphoto.ppd</entry> <entry>older Epson Stylus Photo printers </entry> </row>
-
-			<row><entry>stphoto2.ppd</entry> <entry>newer Epson Stylus Photo printers </entry> </row>
-
-			<row><entry>laserjet.ppd</entry> <entry>all PCL printers </entry> </row>
-
-			</tbody>
-		</tgroup>
-	</table>
-
-	</sect2>
-
-	<sect2>
-	<title><emphasis>cupsomatic/foomatic-rip</emphasis> Versus <emphasis>Native CUPS</emphasis> Printing</title>
-
-	<para>
-	<indexterm><primary>cupsomatic</primary></indexterm>
-	<indexterm><primary>foomatic-rip</primary></indexterm>
-	Native CUPS rasterization works in two steps:
-	</para>
-
-	<itemizedlist>
-		<listitem><para>
-<indexterm><primary>pstoraster</primary></indexterm>
-		First is the <parameter>pstoraster</parameter> step. It uses the special CUPS
-		<indexterm><primary>ESP</primary><secondary>Ghostscript</secondary></indexterm>
-		device from ESP Ghostscript 7.05.x as its tool.
-		</para></listitem>
-
-		<listitem><para>
-		Second is the <parameter>rasterdriver</parameter> step. It uses various
-		device-specific filters; there are several vendors who provide good
-		quality filters for this step. Some are free software, some are
-		shareware, and some are proprietary.
-		</para></listitem>
-	</itemizedlist>
-
-	<para>
-	Often this produces better quality (and has several more advantages) than other methods.
-	This is shown in <link linkend="cupsomatic-dia"> the cupsomatic/foomatic Processing Versus Native CUPS
-	illustration</link>.
-	</para>
-
-	<figure id="cupsomatic-dia">
-		<title>cupsomatic/foomatic Processing Versus Native CUPS.</title>
-		<imagefile>10small</imagefile>
-	</figure>
-
-	<para>
-	One other method is the <parameter>cupsomatic/foomatic-rip</parameter>
-	way. Note that <parameter>cupsomatic</parameter> is <emphasis>not</emphasis> made by the CUPS
-	developers. It is an independent contribution to printing development,
-	made by people from Linuxprinting.org.<footnote><para>See also <ulink
-	noescape="1" url="http://www.cups.org/cups-help.html">http://www.cups.org/cups-help.html</ulink></para></footnote>
-	<parameter>cupsomatic</parameter> is no longer developed, maintained, or supported. It now been
-	replaced by <parameter>foomatic-rip</parameter>. <parameter>foomatic-rip</parameter> is a complete rewrite
-	of the old <parameter>cupsomatic</parameter> idea, but very much improved and generalized to
-	other (non-CUPS) spoolers. An upgrade to <parameter>foomatic-rip</parameter> is strongly
-	advised, especially if you are upgrading to a recent version of CUPS,
-	too.
-	</para>
-
-	<para>
-	<indexterm><primary>cupsomatic</primary></indexterm>
-	<indexterm><primary>foomatic</primary></indexterm>
-	Like the old <parameter>cupsomatic</parameter> method, the <parameter>foomatic-rip</parameter> (new) method
-	from Linuxprinting.org uses the traditional Ghostscript print file processing, doing everything in a single
-	step. It therefore relies on all the other devices built into Ghostscript. The quality is as good (or bad) as
-	Ghostscript rendering is in other spoolers. The advantage is that this method supports many printer models not
-	supported (yet) by the more modern CUPS method.
-	</para>
-
-	<para>
-	Of course, you can use both methods side by side on one system (and even for one printer, if you set up
-	different queues) and find out which works best for you.
-	</para>
-
-	<para>
-<indexterm><primary>cupsomatic</primary></indexterm>
-<indexterm><primary>pstoraster</primary></indexterm>
-<indexterm><primary>rastertosomething</primary></indexterm>
-<indexterm><primary>rasterization</primary></indexterm>
-<indexterm><primary>Foomatic/cupsomatic</primary></indexterm>
-<indexterm><primary>rendering</primary></indexterm>
-	<parameter>cupsomatic</parameter> kidnaps the print file after the
-	<parameter>application/vnd.cups-postscript</parameter> stage and deviates it through the CUPS-external,
-	systemwide Ghostscript installation. Therefore, the print file bypasses the <parameter>pstoraster</parameter>
-	filter (and also bypasses the CUPS raster drivers <parameter>rastertosomething</parameter>). After Ghostscript
-	finished its rasterization, <parameter>cupsomatic</parameter> hands the rendered file directly to the CUPS
-	backend. <link linkend="cupsomatic-dia">cupsomatic/foomatic Processing Versus Native
-	CUPS</link>, illustrates the difference between native CUPS rendering and the
-	<parameter>Foomatic/cupsomatic</parameter> method.
-	</para>
-	</sect2>
-
-	<sect2>
-	<title>Examples for Filtering Chains</title>
-
-	<para>
-	Here are a few examples of commonly occurring filtering chains to
-	illustrate the workings of CUPS.
-	</para>
-
-	<para>
-<indexterm><primary>HP JetDirect</primary></indexterm>
-<indexterm><primary>PostScript</primary></indexterm>
-<indexterm><primary>two-up</primary></indexterm>
-<indexterm><primary>duplex</primary></indexterm>
-	Assume you want to print a PDF file to an HP JetDirect-connected
-	PostScript printer, but you want to print pages 3-5, 7, and 11-13
-	only, and you want to print them <quote>two-up</quote> and <quote>duplex</quote>:
-	</para>
-
-	<itemizedlist>
-	<listitem><para>Your print options (page selection as required, two-up,
-	duplex) are passed to CUPS on the command line.</para></listitem>
-
-	<listitem><para>The (complete) PDF file is sent to CUPS and autotyped as
-	<parameter>application/pdf</parameter>.</para></listitem>
-
-	<listitem><para>The file therefore must first pass the
-	<parameter>pdftops</parameter> prefilter, which produces PostScript
-	MIME type <parameter>application/postscript</parameter> (a preview here
-	would still show all pages of the original PDF).</para></listitem>
-
-	<listitem><para>The file then passes the <parameter>pstops</parameter>
-	filter that applies the command line options: it selects pages
-	2-5, 7, and 11-13, creates the imposed layout <quote>two pages on one sheet</quote>, and
-	inserts the correct <quote>duplex</quote> command (as defined in the printer's
-	PPD) into the new PostScript file; the file is now of PostScript MIME
-	type
-	<parameter>application/vnd.cups-postscript</parameter>.</para></listitem>
-
-	<listitem><para>The file goes to the <parameter>socket</parameter>
-	backend, which transfers the job to the printers.</para></listitem>
-	</itemizedlist>
-
-	<para>
-	The resulting filter chain, therefore, is as shown in <link linkend="pdftosocket">the PDF to socket chain
-	illustration</link>.
-	</para>
-
-<indexterm><primary>pdftosocket</primary></indexterm>
-	<figure id="pdftosocket">
-		<title>PDF to Socket Chain.</title>
-		<imagefile>pdftosocket</imagefile>
-	</figure>
-
-	<para>
-<indexterm><primary>USB</primary></indexterm>
-<indexterm><primary>Epson Stylus</primary></indexterm>
-<indexterm><primary>stphoto2.ppd</primary></indexterm>
-	Assume you want to print the same filter to an USB-connected Epson Stylus Photo Printer installed with the CUPS
-	<filename>stphoto2.ppd</filename>. The first few filtering stages are nearly the same:
-	</para>
-
-	<itemizedlist>
-		<listitem><para>
-		Your print options (page selection as required, two-up,
-		duplex) are passed to CUPS on the command line.
-		</para></listitem>
-
-		<listitem><para>
-		The (complete) PDF file is sent to CUPS and autotyped as
-		<parameter>application/pdf</parameter>.
-		</para></listitem>
-
-		<listitem><para>
-<indexterm><primary>pdftops</primary></indexterm>
-<indexterm><primary>PDF</primary></indexterm>
-		The file must first pass the <parameter>pdftops</parameter> prefilter, which produces PostScript
-		MIME type <parameter>application/postscript</parameter> (a preview here would still show all
-		pages of the original PDF).
-		</para></listitem>
-
-		<listitem><para>
-<indexterm><primary>pstops</primary></indexterm>
-<indexterm><primary>duplex printing</primary></indexterm>
-		The file then passes the <quote>pstops</quote> filter that applies
-		the command line options: it selects the pages 2-5, 7, and 11-13,
-		creates the imposed layout <quote>two pages on one sheet,</quote> and inserts the
-		correct <quote>duplex</quote> command (oops &smbmdash; this printer and PPD
-		do not support duplex printing at all, so this option will
-		be ignored) into the new PostScript file; the file is now of PostScript
-		MIME type <parameter>application/vnd.cups-postscript</parameter>.
-		</para></listitem>
-
-		<listitem><para>
-		The file then passes the <parameter>pstoraster</parameter> stage and becomes MIME type
-		<parameter>application/cups-raster</parameter>.
-		</para></listitem>
-
-		<listitem><para>
-<indexterm><primary>rastertoepson</primary></indexterm>
-		Finally, the <parameter>rastertoepson</parameter> filter
-		does its work (as indicated in the printer's PPD), creating the
-		printer-specific raster data and embedding any user-selected
-		print options into the print data stream.
-		</para></listitem>
-
-		<listitem><para>
-		The file goes to the <parameter>usb</parameter> backend, which transfers the job to the printers.
-		</para></listitem>
-	</itemizedlist>
-
-	<para>
-	The resulting filter chain therefore is as shown in <link linkend="pdftoepsonusb">the PDF to USB Chain
-	illustration</link>.
-	</para>
-
-	<figure id="pdftoepsonusb">
-		<title>PDF to USB Chain.</title>
-		<imagefile>pdftoepsonusb</imagefile>
-	</figure>
-	</sect2>
-
-	<sect2>
-	<title>Sources of CUPS Drivers/PPDs</title>
-
-	<para>
-	On the Internet you can now find many thousands of CUPS-PPD files
-	(with their companion filters), in many national languages
-	supporting more than 1,000 non-PostScript models.
-	</para>
-
-	<itemizedlist>
-		<indexterm><primary>ESP</primary><secondary>Print Pro</secondary></indexterm>
-		<indexterm><primary>PrintPro</primary><see>ESP Print Pro</see></indexterm>
-		<listitem><para>
-		<ulink url="http://www.easysw.com/printpro/">ESP PrintPro</ulink>
-		(commercial, non-free) is packaged with more than 3,000 PPDs, ready for
-		successful use <quote>out of the box</quote> on Linux, Mac OS X, IBM-AIX,
-		HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital UNIX, and
-		other commercial Unices (it is written by the CUPS developers
-		themselves and its sales help finance the further development of
-		CUPS, as they feed their creators).
-		</para></listitem>
-
-		<listitem><para>
-		The <ulink url="http://gimp-print.sourceforge.net/">Gutenprint Project</ulink>
-		(GPL, free software) provides around 140 PPDs (supporting nearly 400 printers, many driven
-		to photo quality output), to be used alongside the Gutenprint CUPS filters.
-		</para></listitem>
-
-		<listitem><para>
-		<ulink url="http://www.turboprint.de/english.html/">TurboPrint </ulink> (shareware, non-free) supports
-		roughly the same number of printers in excellent quality.
-		</para></listitem>
-
-		<listitem><para>
-		<ulink url="http://www-124.ibm.com/developerworks/oss/linux/projects/omni/">OMNI </ulink>
-		(LPGL, free) is a package made by IBM, now containing support for more
-		than 400 printers, stemming from the inheritance of IBM OS/2 know-how
-		ported over to Linux (CUPS support is in a beta stage at present).
-		</para></listitem>
-
-		<listitem><para>
-		<ulink url="http://hpinkjet.sourceforge.net/">HPIJS </ulink> (BSD-style licenses, free)
-		supports approximately 150 of HP's own printers and also provides
-		excellent print quality now (currently available only via the Foomatic path).
-		</para></listitem>
-
-		<listitem><para>
-		<ulink url="http://www.linuxprinting.org/">Foomatic/cupsomatic </ulink>
-		(LPGL, free) from Linuxprinting.org provide PPDs for practically every Ghostscript
-		filter known to the world (including Omni, Gutenprint, and HPIJS).
-		</para></listitem>
-	</itemizedlist>
-
-	</sect2>
-
-	<sect2>
-	<title>Printing with Interface Scripts</title>
-
-	<para>
-<indexterm><primary>PCL</primary></indexterm>
-<indexterm><primary>lpadmin</primary></indexterm>
-	CUPS also supports the use of <quote>interface scripts</quote> as known from
-	System V AT&T printing systems. These are often used for PCL
-	printers, from applications that generate PCL print jobs. Interface
-	scripts are specific to printer models. They have a role similar to
-	PPDs for PostScript printers. Interface scripts may inject the Escape
-	sequences as required into the print data stream if the user, for example, selects
-	a certain paper tray, or changes paper orientation, or uses A3
-	paper. Interface scripts are practically unknown in the Linux
-	realm. On HP-UX platforms they are more often used. You can use any
-	working interface script on CUPS too. Just install the printer with
-	the <command>-i</command> option:
-<screen>
-&rootprompt;<userinput>lpadmin -p pclprinter -v socket://11.12.13.14:9100 \
-          -i /path/to/interface-script</userinput>
-</screen></para>
-
-	<para>
-	Interface scripts might be the <quote>unknown animal</quote> to many. However,
-	with CUPS they provide the easiest way to plug in your own custom-written filtering
-	script or program into one specific print queue (some information about the traditional
-	use of interface scripts is found at
-	<ulink noescape="1" url="http://playground.sun.com/printing/documentation/interface.html">
-	http://playground.sun.com/printing/documentation/interface.html</ulink>).
-	</para>
-	</sect2>
-</sect1>
-
-<sect1>
-<title>Network Printing (Purely Windows)</title>
-
-<para>
-Network printing covers a lot of ground. To understand what exactly
-goes on with Samba when it is printing on behalf of its Windows
-clients, let's first look at a <quote>purely Windows</quote> setup: Windows clients
-with a Windows NT print server.
-</para>
-
-<sect2>
-<title>From Windows Clients to an NT Print Server</title>
-
-<para>
-Windows clients printing to an NT-based print server have two
-options. They may:
-<indexterm><primary>GDI</primary></indexterm>
-<indexterm><primary>EMF</primary></indexterm>
-</para>
-
-
-<itemizedlist>
-	<listitem><para>Execute the driver locally and render the GDI output
-			(EMF) into the printer-specific format on their own.
-	</para></listitem>
-
-	<listitem><para>Send the GDI output (EMF) to the server, where the
-	driver is executed to render the printer-specific output.
-	</para></listitem>
-</itemizedlist>
-
-<para>
-Both print paths are shown in the flowcharts in <link linkend="small11">
-Print Driver Execution on the Client</link>, and
-<link linkend="small12">Print Driver Execution on the Server</link>.
-</para>
-</sect2>
-
-<sect2>
-<title>Driver Execution on the Client</title>
-
-<para>
-In the first case, the print server must spool the file as raw, meaning it shouldn't touch the job file and try
-to convert it in any way. This is what a traditional UNIX-based print server can do too, and at a better
-performance and more reliably than an NT print server. This is what most Samba administrators probably are
-familiar with. One advantage of this setup is that this <quote>spooling-only</quote> print server may be used
-even if no driver(s) for UNIX is available. It is sufficient to have the Windows client drivers available and
-installed on the clients. This is illustrated in <link linkend="small11">the Print Driver Execution on the
-Client diagram</link>.
-</para>
-
-<figure id="small11">
-	<title>Print Driver Execution on the Client.</title>
-	<imagefile>11small</imagefile>
-</figure>
-
-</sect2>
-
-<sect2>
-<title>Driver Execution on the Server</title>
-
-
-<para>
-<indexterm><primary>PostScript</primary></indexterm>
-<indexterm><primary>PCL</primary></indexterm>
-<indexterm><primary>ESC/P</primary></indexterm>
-<indexterm><primary>EMF</primary></indexterm>
-<indexterm><primary>GDI</primary></indexterm>
-The other path executes the printer driver on the server. The client transfers print files in EMF format to
-the server. The server uses the PostScript, PCL, ESC/P, or other driver to convert the EMF file into the
-printer-specific language. It is not possible for UNIX to do the same. Currently, there is no program or
-method to convert a Windows client's GDI output on a UNIX server into something a printer could understand.
-This is illustrated in <link linkend="small12">the Print Driver Execution on the Server diagram</link>.
-</para>
-
-	<figure id="small12">
-		<title>Print Driver Execution on the Server.</title>
-		<imagefile>12small</imagefile>
-	</figure>
-
-<para>
-However, something similar is possible with CUPS, so read on.
-</para>
-</sect2>
-</sect1>
-
-<sect1>
-<title>Network Printing (Windows Clients and UNIX/Samba Print
-Servers)</title>
-
-<para>
-Since UNIX print servers <emphasis>cannot</emphasis> execute the Win32
-program code on their platform, the picture is somewhat
-different. However, this does not limit your options all that
-much. On the contrary, you may have a way here to implement printing
-features that are not possible otherwise.
-</para>
-
-<sect2>
-<title>From Windows Clients to a CUPS/Samba Print Server</title>
-
-<para>
-Here is a simple recipe showing how you can take advantage of CUPS's
-powerful features for the benefit of your Windows network printing
-clients:
-</para>
-
-<itemizedlist>
-	<listitem><para>Let the Windows clients send PostScript to the CUPS
-	server.</para></listitem>
-
-	<listitem><para>Let the CUPS server render the PostScript into device-specific raster format.</para></listitem>
-</itemizedlist>
-
-<para>
-This requires the clients to use a PostScript driver (even if the
-printer is a non-PostScript model. It also requires that you have a
-driver on the CUPS server.
-</para>
-
-<para>
-First, to enable CUPS-based printing through Samba, the following options should be set in your &smb.conf;
-file <parameter>[global]</parameter> section:
-</para>
-
-<smbconfblock>
-<smbconfoption name="printing">cups</smbconfoption>
-</smbconfblock>
-
-<para>
-When these parameters are specified, all manually set print directives (like <smbconfoption name="print
-command"/> or <smbconfoption name="lppause command"/>) in &smb.conf; (as well as in Samba itself) will be
-ignored. Instead, Samba will directly interface with CUPS through its
-application program interface (API). 
-This is illustrated in <link linkend="f13small">the Printing via
-CUPS/Samba Server diagram</link>.
-</para>
-
-	<figure id="f13small">
-		<title>Printing via CUPS/Samba Server.</title>
-		<imagefile>13small</imagefile>
-	</figure>
-</sect2>
-
-<sect2>
-<title>Samba Receiving Job-Files and Passing Them to CUPS</title>
-
-<para>
-Samba <emphasis>must</emphasis> use its own spool directory (it is set by a line similar to <smbconfoption
-name="path">/var/spool/samba</smbconfoption>, in the <smbconfsection name="[printers]"/> or <smbconfsection
-name="[printername]"/> section of &smb.conf;). Samba receives the job in its own spool space and passes it
-into the spool directory of CUPS (the CUPS spool directory is set by the <parameter>RequestRoot</parameter>
-directive in a line that defaults to <parameter>RequestRoot /var/spool/cups</parameter>). CUPS checks the
-access rights of its spool directory and resets it to healthy values with every restart. We have seen quite a
-few people who used a common spooling space for Samba and CUPS, and struggled for weeks with this
-<quote>problem.</quote>
-</para>
-
-<para>
-A Windows user authenticates only to Samba (by whatever means is
-configured). If Samba runs on the same host as CUPS, you only need to
-allow <quote>localhost</quote> to print. If it runs on different machines, you
-need to make sure the Samba host gets access to printing on CUPS.
-</para>
-</sect2>
-</sect1>
-
-<sect1>
-<title>Network PostScript RIP</title>
-
-<para>
-This section discusses the use of CUPS filters on the server &smbmdash; configuration where
-clients make use of a PostScript driver with CUPS-PPDs.
-</para>
-
-
-<para>
-<indexterm><primary>PostScript</primary></indexterm>
-<indexterm><primary>PCL</primary></indexterm>
-<indexterm><primary>PJL</primary></indexterm>
-PPDs can control all print device options. They are usually provided by the manufacturer &smbmdash; if you own
-a PostScript printer, that is. PPD files are always a component of PostScript printer drivers on MS Windows or
-Apple Mac OS systems. They are ASCII files containing user-selectable print options, mapped to appropriate
-PostScript, PCL, or PJL commands for the target printer. Printer driver GUI dialogs translate these options
-<quote>on the fly</quote> into buttons and drop-down lists for the user to select.
-</para>
-
-<para>
-CUPS can load, without any conversions, the PPD file from any Windows (NT is recommended) PostScript driver
-and handle the options. There is a Web browser interface to the print options (select <ulink noescape="1"
-url="http://localhost:631/printers/">http://localhost:631/printers/</ulink> and click on one
-<guibutton>Configure Printer</guibutton> button to see it) or a command line interface (see <command>man
-lpoptions</command> or see if you have <command>lphelp</command> on your system). There are also some
-different GUI front-ends on Linux/UNIX, which can present PPD options to users. PPD options are normally meant
-to be evaluated by the PostScript RIP on the real PostScript printer.
-</para>
-
-<sect2>
-<title>PPDs for Non-PS Printers on UNIX</title>
-
-
-<para>
-<indexterm><primary>PPD</primary></indexterm>
-CUPS does not limit itself to <quote>real</quote> PostScript printers in its use of PPDs. The CUPS developers
-have extended the scope of the PPD concept to also describe available device and driver options for
-non-PostScript printers through CUPS-PPDs.
-</para>
-
-<para>
-This is logical, because CUPS includes a fully featured PostScript interpreter (RIP). This RIP is based on
-Ghostscript. It can process all received PostScript (and additionally many other file formats) from clients.
-All CUPS-PPDs geared to non-PostScript printers contain an additional line, starting with the keyword
-<parameter>*cupsFilter</parameter>. This line tells the CUPS print system which printer-specific filter to use
-for the interpretation of the supplied PostScript. Thus CUPS lets all its printers appear as PostScript
-devices to its clients, because it can act as a PostScript RIP for those printers, processing the received
-PostScript code into a proper raster print format.
-</para>
-</sect2>
-
-<sect2>
-<title>PPDs for Non-PS Printers on Windows</title>
-
-<para>
-<indexterm><primary>PPD</primary></indexterm>
-CUPS-PPDs can also be used on Windows clients, on top of a <quote>core</quote> PostScript driver (now
-recommended is the CUPS PostScript Driver for Windows NT/200x/XP; you can also use the Adobe one, with
-limitations). This feature enables CUPS to do a few tricks no other spooler can do:
-</para>
-
-<itemizedlist>
-	<listitem><para>
-	Act as a networked PostScript RIP handling print files from all client platforms in a uniform way.
-	</para></listitem>
-
-	<listitem><para>
-	Act as a central accounting and billing server, since all files are passed through the pstops filter and are therefore
-	logged in the CUPS <filename>page_log</filename> file.  <emphasis>Note:</emphasis> this cannot happen with
-	<quote>raw</quote> print jobs, which always remain unfiltered per definition.
-	</para></listitem>
-
-	<listitem><para>
-	Enable clients to consolidate on a single PostScript driver, even for many different target printers.
-	</para></listitem>
-</itemizedlist>
-
-<para>
-Using CUPS PPDs on Windows clients enables them to control all print job settings just as a UNIX client can do.
-</para>
-</sect2>
-</sect1>
-
-<sect1>
-<title>Windows Terminal Servers (WTS) as CUPS Clients</title>
-
-<para>
-This setup may be of special interest to people experiencing major problems in WTS environments. WTS often
-need a multitude of non-PostScript drivers installed to run their clients' variety of different printer
-models. This often imposes the price of much increased instability.
-</para>
-
-<sect2>
-<title>Printer Drivers Running in <quote>Kernel Mode</quote> Cause Many
-Problems</title>
-
-<para>
-Windows NT printer drivers, which run in <quote>kernel mode</quote>, introduce a high risk for the stability
-of the system if the driver is not really stable and well-tested. And there are a lot of bad drivers out
-there! Especially notorious is the example of the PCL printer driver that had an additional sound module
-running to notify users via soundcard of their finished jobs. Do I need to say that this one was also reliably
-causing <quote>blue screens of death</quote> on a regular basis?
-</para>
-
-<para>
-PostScript drivers are generally well-tested. They are not known to cause any problems, even though they also
-run in kernel mode. This might be because until now there have been only two different PostScript drivers: the
-one from Adobe and the one from Microsoft. Both are well-tested and are as stable as you can imagine on
-Windows. The CUPS driver is derived from the Microsoft one.
-</para>
-</sect2>
-
-<sect2>
-<title>Workarounds Impose Heavy Limitations</title>
-
-<para>
-In an attempt to work around problems, site administrators have resorted to restricting the
-allowed drivers installed on their WTS to one generic PCL and one PostScript driver. This, however, restricts
-the number of printer options available for clients to use. Often they can't get out more than simplex
-prints from one standard paper tray, while their devices could do much better if driven by a different driver!
-</para>
-</sect2>
-
-<sect2>
-<title>CUPS: A <quote>Magical Stone</quote>?</title>
-
-<para>
-<indexterm><primary>PPD</primary></indexterm>
-<indexterm><primary>PostScript</primary></indexterm>
-Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very elegant way to overcome all these
-shortcomings. There are, depending on the version of Windows OS you use, up to three different PostScript
-drivers now available: Adobe, Microsoft, and CUPS PostScript drivers. None of them is known to cause major
-stability problems on WTS (even if used with many different PPDs). The clients will be able to (again) choose
-paper trays, duplex printing, and other settings. However, there is a certain price for this too: a CUPS
-server acting as a PostScript RIP for its clients requires more CPU and RAM than when just acting as a
-<quote>raw spooling</quote> device. Plus, this setup is not yet widely tested, although the first feedbacks
-look very promising.
-</para>
-</sect2>
-
-<sect2>
-<title>PostScript Drivers with No Major Problems, Even in Kernel
-Mode</title>
-
-<para>
-<indexterm><primary>DDK</primary></indexterm>
-<indexterm><primary>W32X86</primary></indexterm>
-<indexterm><primary>PostScript</primary></indexterm>
-<indexterm><primary>Visual Studio</primary></indexterm>
-<indexterm><primary>Microsoft driver</primary></indexterm>
-<indexterm><primary>Adobe</primary></indexterm>
-More recent printer drivers on W200x and XP no longer run in kernel mode (unlike Windows NT). However, both
-operating systems can still use the NT drivers, running in kernel mode (you can roughly tell which is which as
-the drivers in subdirectory <quote>2</quote> of <quote>W32X86</quote> are <quote>old</quote> ones). As was
-said before, the Adobe as well as the Microsoft PostScript drivers are not known to cause any stability
-problems. The CUPS driver is derived from the Microsoft one. There is a simple reason for this: the MS DDK
-(Device Development Kit) for Windows NT (which used to be available at no cost to licensees of Visual Studio)
-includes the source code of the Microsoft driver, and licensees of Visual Studio are allowed to use and modify
-it for their own driver development efforts. This is what the CUPS people have done. The license does not
-allow them to publish the whole of the source code.  However, they have released the <quote>diff</quote> under
-the GPL, and if you are the owner of an <quote>MS DDK for Windows NT,</quote> you can check the driver
-yourself.
-</para>
-</sect2>
-</sect1>
-
-<sect1>
-<title>Configuring CUPS for Driver Download</title>
-
-<para>
-As we have said before, all previously known methods to prepare client printer drivers on the Samba server for
-download and Point'n'Print convenience of Windows workstations are working with CUPS, too. These methods were
-described in <link linkend="classicalprinting">Classical Printing</link>. In reality, this is a pure Samba
-business and relates only to the Samba-Windows client relationship.
-</para>
-
-<sect2>
-<title><emphasis>cupsaddsmb</emphasis>: The Unknown Utility</title>
-
-
-<para>
-<indexterm><primary>cupsaddsmb</primary></indexterm>
-The <parameter>cupsaddsmb</parameter> utility (shipped with all current CUPS versions) is an alternative
-method to transfer printer drivers into the Samba <smbconfsection name="[print$]"/> share. Remember, this
-share is where clients expect drivers deposited and set up for download and installation. It makes the sharing
-of any (or all) installed CUPS printers quite easy. <command>cupsaddsmb</command> can use the Adobe PostScript
-driver as well as the newly developed CUPS PostScript driver for Windows NT/200x/XP.
-<parameter>cupsaddsmb</parameter> does <emphasis>not</emphasis> work with arbitrary vendor printer drivers,
-but only with the <emphasis>exact</emphasis> driver files that are named in its man page.
-</para>
-
-<para>
-The CUPS printer driver is available from the CUPS download site. Its package name is
-<filename>cups-samba-[version].tar.gz</filename>. It is preferred over the Adobe drivers because it has a
-number of advantages:
-</para>
-
-<itemizedlist>
-	<listitem><para>It supports a much more accurate page accounting.</para></listitem>
-
-	<listitem><para>It supports banner pages and page labels on all printers.</para></listitem>
-
-	<listitem><para>It supports the setting of a number of job IPP attributes
-	(such as job priority, page label, and job billing).</para></listitem>
-</itemizedlist>
-
-<para>
-However, currently only Windows NT, 2000, and XP are supported by the
-CUPS drivers. You will also need to get the respective part of the Adobe driver
-if you need to support Windows 95, 98, and Me clients.
-</para>
-</sect2>
-
-<sect2>
-<title>Prepare Your &smb.conf; for <command>cupsaddsmb</command></title>
-
-<para>
-Prior to running <command>cupsaddsmb</command>, you need the settings in
-&smb.conf; as shown in <link linkend="cupsadd-ex">the &smb.conf; for cupsaddsmb Usage</link>.
-</para>
-
-<example id="cupsadd-ex">
-<title>smb.conf for cupsaddsmb Usage</title>
-<smbconfblock>
-<smbconfsection name="[global]"/>
-<smbconfoption name="load printers">yes</smbconfoption>
-<smbconfoption name="printing">cups</smbconfoption>
-<smbconfoption name="printcap name">cups</smbconfoption>
-
-<smbconfsection name="[printers]"/>
-<smbconfoption name="comment">All Printers</smbconfoption>
-<smbconfoption name="path">/var/spool/samba</smbconfoption>
-<smbconfoption name="browseable">no</smbconfoption>
-<smbconfcomment>setting depends on your requirements</smbconfcomment>
-<smbconfoption name="guest ok">yes</smbconfoption>
-<smbconfoption name="writable">no</smbconfoption>
-<smbconfoption name="printable">yes</smbconfoption>
-<smbconfoption name="printer admin">root</smbconfoption>
- <smbconfsection name="[print$]"/>
-<smbconfoption name="comment">Printer Drivers</smbconfoption>
-<smbconfoption name="path">/etc/samba/drivers</smbconfoption>
-<smbconfoption name="browseable">yes</smbconfoption>
-<smbconfoption name="guest ok">no</smbconfoption>
-<smbconfoption name="read only">yes</smbconfoption>
-<smbconfoption name="write list">root, @smbprintadm</smbconfoption>
-</smbconfblock>
-</example>
-</sect2>
-
-<sect2>
-<title>CUPS <quote>PostScript Driver for Windows NT/200x/XP</quote></title>
-
-<para>
-<indexterm><primary>PostScript</primary></indexterm>
-CUPS users may get the exact same package from <ulink noescape="1"
-url="http://www.cups.org/software.html">http://www.cups.org/software.html</ulink>.  It is a separate package
-from the CUPS-based software files, tagged as CUPS 1.1.x Windows NT/200x/XP Printer Driver for Samba (tar.gz,
-192k). The filename to download is <filename>cups-samba-1.1.x.tar.gz</filename>. Upon untar and unzipping, it
-will reveal these files:
-<screen>
-&rootprompt;<userinput>tar xvzf cups-samba-1.1.19.tar.gz</userinput>
-cups-samba.install
-cups-samba.license
-cups-samba.readme
-cups-samba.remove
-cups-samba.ss
-</screen></para>
-
-<para>
-<indexterm><primary>ESP</primary><secondary>meta packager</secondary></indexterm>
-<indexterm><primary>EPM</primary><see>ESP meta packager</see></indexterm>
-These have been packaged with the ESP meta-packager software EPM. The <filename>*.install</filename> and
-<filename>*.remove</filename> files are simple shell scripts, which untar the <filename>*.ss</filename> (the
-<filename>*.ss</filename> is nothing else but a tar archive, which can be untarred by <quote>tar</quote> too).
-Then it puts the content into <filename>/usr/share/cups/drivers/</filename>. This content includes three
-files:
-<screen>
-&rootprompt;<userinput>tar tv cups-samba.ss</userinput>
-cupsdrvr.dll
-cupsui.dll
-cups.hlp  
-</screen></para>
-
-<para>
-The <parameter>cups-samba.install</parameter> shell scripts are easy to
-handle:
-<screen>
-&rootprompt;<userinput>./cups-samba.install</userinput>
-[....]
-Installing software...
-Updating file permissions...
-Running post-install commands...
-Installation is complete.       
-</screen></para>
-
-<para>
-The script should automatically put the driver files into the
-<filename>/usr/share/cups/drivers/</filename> directory:
-<screen>
-&rootprompt;<userinput>cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/</userinput>
-</screen></para>
-
-<warning><para>
-Due to a bug, one recent CUPS release puts the <filename>cups.hlp</filename> driver file
-into<filename>/usr/share/drivers/</filename> instead of <filename>/usr/share/cups/drivers/</filename>. To work
-around this, copy/move the file (after running the <command>./cups-samba.install</command> script) manually to
-the correct place.
-</para></warning>
-
-<para>
-<indexterm><primary>DDK</primary></indexterm>
-This new CUPS PostScript driver is currently binary only, but free of charge. No complete source code is
-provided (yet). The reason is that it has been developed with the help of the Microsoft DDK and compiled with
-Microsoft Visual Studio 6. Driver developers are not allowed to distribute the whole of the source code as
-free software. However, CUPS developers released the <quote>diff</quote> in source code under the GPL, so
-anybody with a license for Visual Studio and a DDK will be able to compile for himself or herself.
-</para>
-</sect2>
-
-<sect2>
-<title>Recognizing Different Driver Files</title>
-
-<para>
-The CUPS drivers do not support the older Windows 95/98/Me, but only the Windows NT/2000/XP client.
-</para>
-
-<para>Windows NT, 2000, and XP are supported by:</para>
-
-<itemizedlist>
-	<listitem><para>cups.hlp</para></listitem>
-	<listitem><para>cupsdrvr.dll</para></listitem>
-	<listitem><para>cupsui.dll</para></listitem>
-</itemizedlist>
-
-<para>
-Adobe drivers are available for the older Windows 95/98/Me as well as
-for Windows NT/2000/XP clients. The set of files is different from the
-different platforms.
-</para>
-
-<para>Windows 95, 98, and ME are supported by:</para>
-
-<itemizedlist>
-	<listitem><para>ADFONTS.MFM</para></listitem>
-	<listitem><para>ADOBEPS4.DRV</para></listitem>
-	<listitem><para>ADOBEPS4.HLP</para></listitem>
-	<listitem><para>DEFPRTR2.PPD</para></listitem>
-	<listitem><para>ICONLIB.DLL</para></listitem>
-	<listitem><para>PSMON.DLL</para></listitem>
-</itemizedlist>
-
-<para>Windows NT, 2000, and XP are supported by:</para>
-
-<itemizedlist>
-	<listitem><para>ADOBEPS5.DLL</para></listitem>
-	<listitem><para>ADOBEPSU.DLL</para></listitem>
-	<listitem><para>ADOBEPSU.HLP</para></listitem>
-</itemizedlist>
-
-<note><para>
-<indexterm><primary>Adobe driver files</primary></indexterm>
-If both the Adobe driver files and the CUPS driver files for the support of Windows NT/200x/XP are presently
-installed on the server, the Adobe files will be ignored and the CUPS files will be used. If you prefer
-&smbmdash; for whatever reason &smbmdash; to use Adobe-only drivers, move away the three CUPS driver files.
-The Windows 9x/Me clients use the Adobe drivers in any case.
-</para></note>
-</sect2>
-
-<sect2>
-<title>Acquiring the Adobe Driver Files</title>
-
-<para>
-Acquiring the Adobe driver files seems to be unexpectedly difficult for many users. They are not available on
-the Adobe Web site as single files, and the self-extracting and/or self-installing Windows-.exe is not easy to
-locate either. You probably need to use the included native installer and run the installation process on one
-client once. This will install the drivers (and one generic PostScript printer) locally on the client. When
-they are installed, share the generic PostScript printer. After this, the client's <smbconfsection
-name="[print$]"/> share holds the Adobe files, which you can get with smbclient from the CUPS host.
-</para>
-</sect2>
-
-<sect2>
-<title>ESP Print Pro PostScript Driver for Windows NT/200x/XP</title>
-
-<para>
-<indexterm><primary>ESP</primary><secondary>Print Pro</secondary></indexterm>
-Users of the ESP Print Pro software are able to install the ESP print drivers package as an alternative to the
-Adobe PostScript drivers.  To do so, retrieve the driver files from the normal download area of the ESP Print
-Pro software at <ulink noescape="1" url="http://www.easysw.com/software.html">Easy Software</ulink> web site.
-You need to locate the link labeled <quote>SAMBA</quote> among the <guilabel>Download Printer Drivers for ESP
-Print Pro 4.x</guilabel> area and download the package. Once installed, you can prepare any driver by simply
-highlighting the printer in the Printer Manager GUI and selecting <guilabel>Export Driver...</guilabel> from
-the menu. Of course, you need to have prepared Samba beforehand to handle the driver files; that is, set up
-the <smbconfsection name="[print$]"/> share, and so on. The ESP Print Pro package includes the CUPS driver
-files as well as a (licensed) set of Adobe drivers for the Windows 95/98/Me client family.
-</para>
-</sect2>
-
-<sect2>
-<title>Caveats to Be Considered</title>
-
-
-<para>
-<indexterm><primary>cupsaddsmb</primary></indexterm>
-<indexterm><primary>cups.hlp</primary></indexterm>
-<indexterm><primary>WIN40</primary></indexterm>
-<indexterm><primary>W32X86</primary></indexterm>
-Once you have run the install script (and possibly manually moved the <filename>cups.hlp</filename> file to
-<filename>/usr/share/cups/drivers/</filename>), the driver is ready to be put into Samba's <smbconfsection
-name="[print$]"/> share (which often maps to <filename>/etc/samba/drivers/</filename> and contains a
-subdirectory tree with <emphasis>WIN40</emphasis> and <emphasis>W32X86</emphasis> branches). You do this by
-running <command>cupsaddsmb</command> (see also <command>man cupsaddsmb</command> for CUPS since release
-1.1.16).
-</para>
-
-<tip><para>
-<indexterm><primary>Single Sign-On</primary></indexterm>
-<indexterm><primary>Domain Controller</primary></indexterm>
-You may need to put root into the smbpasswd file by running <command>smbpasswd</command>; this is especially
-important if you should run this whole procedure for the first time and are not working in an environment
-where everything is configured for <emphasis>single sign-on</emphasis> to a Windows Domain Controller.
-</para></tip>
-
-<para>
-Once the driver files are in the <smbconfsection name="[print$]"/> share and are initialized, they are ready
-to be downloaded and installed by the Windows NT/200x/XP clients.
-</para>
-
-<note><para>
-Win 9x/Me clients will not work with the CUPS PostScript driver. For these you still need to use the
-<filename>ADOBE*.*</filename> drivers, as previously stated.
-</para></note>
-
-<note>
-<para>
-It is not harmful if you still have the <filename>ADOBE*.*</filename> driver files from previous installations
-in the <filename>/usr/share/cups/drivers/</filename> directory. The new <command>cupsaddsmb</command> (from
-1.1.16) will automatically prefer its own drivers if it finds both.
-</para></note>
-
-<note><para>
-<indexterm><primary>"Printers" folder</primary></indexterm>
-<indexterm><primary>Adobe PostScript</primary></indexterm>
-Should your Windows clients have had the old <filename>ADOBE*.*</filename> files for the Adobe PostScript
-driver installed, the download and installation of the new CUPS PostScript driver for Windows NT/200x/XP will
-fail at first. You need to wipe the old driver from the clients first. It is not enough to
-<quote>delete</quote> the printer, because the driver files will still be kept by the clients and re-used if
-you try to re-install the printer. To really get rid of the Adobe driver files on the clients, open the
-<guilabel>Printers</guilabel> folder (possibly via <guilabel>Start -> Settings -> Control Panel ->
-Printers</guilabel>), right-click on the folder background, and select <guimenuitem>Server
-Properties</guimenuitem>. When the new dialog opens, select the <guilabel>Drivers</guilabel> tab. On the list
-select the driver you want to delete and click the <guilabel>Delete</guilabel> button. This will only work if
-there is not one single printer left that uses that particular driver. You need to <quote>delete</quote> all
-printers using this driver in the <guilabel>Printers</guilabel> folder first. You will need Administrator
-privileges to do this.
-</para></note>
-
-<note><para>
-<indexterm><primary>rpcclient</primary><secondary>setdriver</secondary></indexterm>
-<indexterm><primary>CUPS PostScript</primary></indexterm>
-Once you have successfully downloaded the CUPS PostScript driver to a client, you can easily switch all
-printers to this one by proceeding as described in <link linkend="classicalprinting">Classical Printing
-Support</link>. Either change a driver for an existing printer by running the <guilabel>Printer
-Properties</guilabel> dialog, or use <command>rpcclient</command> with the <command>setdriver</command>
-subcommand.
-</para></note>
-</sect2>
-
-<sect2>
-<title>Windows CUPS PostScript Driver Versus Adobe Driver</title>
-
-<para>
-Are you interested in a comparison between the CUPS and the Adobe PostScript drivers? For our purposes, these
-are the most important items that weigh in favor of CUPS:
-</para>
-
-<itemizedlist>
-	<listitem><para>No hassle with the Adobe EULA.</para></listitem>
-
-	<listitem><para>No hassle with the question, <quote>Where do I
-	get the ADOBE*.* driver files?</quote></para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>PJL</primary></indexterm>
-	The Adobe drivers (on request of the printer PPD associated with them) often put a PJL header in front of the
-	main PostScript part of the print file. Thus, the print file starts with <parameter><1B
-	>%-12345X</parameter> or <parameter><escape>%-12345X</parameter> instead of
-	<parameter>%!PS</parameter>. This leads to the CUPS daemon autotyping the incoming file as a print-ready file,
-	not initiating a pass through the <parameter>pstops</parameter> filter (to speak more technically, it is not
-	regarded as the generic MIME-type <indexterm><primary>application/postscript</primary></indexterm>
-	<parameter>application/postscript</parameter>, but as the more special MIME type
-	<indexterm><primary>application/cups.vnd-postscript</primary></indexterm>
-	<parameter>application/cups.vnd-postscript</parameter>), which therefore also leads to the page accounting in
-	<parameter>/var/log/cups/page_log</parameter> not receiving the exact number of pages; instead the dummy page
-	number of <quote>1</quote> is logged in a standard setup).
-	</para></listitem>
-
-	<listitem><para>The Adobe driver has more options to misconfigure the
-<indexterm><primary>Adobe driver</primary></indexterm>
-	PostScript generated by it (like setting it inadvertently to
-	<guilabel>Optimize for Speed</guilabel> instead of
-	<guilabel>Optimize for Portability</guilabel>, which
-	could lead to CUPS being unable to process it).</para></listitem>
-
-	<listitem><para>The CUPS PostScript driver output sent by Windows
-<indexterm><primary>CUPS PostScript driver</primary></indexterm>
-	clients to the CUPS server is guaranteed to autotype 
-	as the generic MIME type <parameter>application/postscript</parameter>,
-	thus passing through the CUPS <parameter>pstops</parameter> filter and logging the
-	correct number of pages in the <filename>page_log</filename> for
-	accounting and quota purposes.</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>banner pages</primary></indexterm>
-	The CUPS PostScript driver supports the sending of additional standard (IPP) print options by Windows
-	NT/200x/XP clients. Such additional print options are naming the CUPS standard <emphasis>banner
-	pages</emphasis> (or the custom ones, should they be installed at the time of driver download), using the CUPS
-	page-label option, setting a job priority, and setting the scheduled time of printing (with the option to
-	support additional useful IPP job attributes in the future).
-	</para></listitem>
-
-	<listitem><para>The CUPS PostScript driver supports the inclusion of
-	the new <parameter>*cupsJobTicket</parameter> comments at the
-	beginning of the PostScript file (which could be used in the future
-	for all sorts of beneficial extensions on the CUPS side, but which will
-	not disturb any other applications because they will regard it as a comment
-	and simply ignore it).</para></listitem>
-
-	<listitem><para>The CUPS PostScript driver will be the heart of the
-	fully fledged CUPS IPP client for Windows NT/200x/XP to be released soon
-	(probably alongside the first beta release for CUPS 1.2).</para></listitem>
-</itemizedlist>
-
-</sect2>
-
-<sect2>
-<title>Run cupsaddsmb (Quiet Mode)</title>
-
-
-<para>
-<indexterm><primary>cupsaddsmb</primary></indexterm>
-<indexterm><primary>point 'n' print</primary></indexterm>
-The <command>cupsaddsmb</command> command copies the needed files into your <smbconfsection name="[print$]"/>
-share. Additionally, the PPD associated with this printer is copied from <filename>/etc/cups/ppd/</filename>
-to <smbconfsection name="[print$]"/>. There the files wait for convenient Windows client installations via
-Point'n'Print. Before we can run the command successfully, we need to be sure that we can authenticate toward
-Samba. If you have a small network, you are probably using user-level security (<smbconfoption
-name="security">user</smbconfoption>).
-</para>
-
-<para>
-Here is an example of a successfully run <command>cupsaddsmb</command> command: 
-<indexterm><primary>banner pages</primary></indexterm>
-<indexterm><primary>cupsaddsmb</primary></indexterm>
-<screen>
-&rootprompt;<userinput>cupsaddsmb -U root infotec_IS2027</userinput>
-Password for root required to access localhost via Samba: <userinput>['secret']</userinput>
-</screen></para>
-
-<para>
-<indexterm><primary>cupsaddsmb</primary></indexterm>
-To share <emphasis>all</emphasis> printers and drivers, use the
-<option>-a</option> parameter instead of a printer name. Since
-<command>cupsaddsmb</command> <quote>exports</quote> the printer drivers to Samba, it should be
-obvious that it only works for queues with a CUPS driver associated.
-</para>
-</sect2>
-
-<sect2>
-<title>Run cupsaddsmb with Verbose Output</title>
-
-
-<para>
-<indexterm><primary>cupsaddsmb</primary></indexterm>
-Probably you want to see what's going on. Use the
-<option>-v</option> parameter to get a more verbose output. The
-output below was edited for better readability: all <quote>\</quote> at the end of
-a line indicate that I inserted an artificial line break plus some
-indentation here:
-<indexterm><primary>rpcclient</primary><secondary>adddriver</secondary></indexterm>
-<indexterm><primary>rpcclient</primary><secondary>setdriver</secondary></indexterm>
-<screen>
-&rootprompt;<userinput>cupsaddsmb -U root -v infotec_2105</userinput>
-Password for root required to access localhost via &example.server.samba;:
-Running command: smbclient //localhost/print\$ -N -U'root%secret' \
-    -c 'mkdir W32X86; \
-    put /var/spool/cups/tmp/3e98bf2d333b5 W32X86/infotec_2105.ppd; \
-	put /usr/share/cups/drivers/cupsdrvr.dll W32X86/cupsdrvr.dll; \
-    put /usr/share/cups/drivers/cupsui.dll W32X86/cupsui.dll; \
-    put /usr/share/cups/drivers/cups.hlp W32X86/cups.hlp'
-added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
-Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
-NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86
-putting file /var/spool/cups/tmp/3e98bf2d333b5 as \W32X86/infotec_2105.ppd
-putting file /usr/share/cups/drivers/cupsdrvr.dll as \W32X86/cupsdrvr.dll
-putting file /usr/share/cups/drivers/cupsui.dll as \W32X86/cupsui.dll
-putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp
-  
-Running command: rpcclient localhost -N -U'root%secret' 
-   -c 'adddriver "Windows NT x86"   \
-   "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL: \
-    RAW:NULL"'
-cmd = adddriver "Windows NT x86" \
-   "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL: \
-	RAW:NULL"
-Printer Driver infotec_2105 successfully installed.
-  
-Running command: smbclient //localhost/print\$ -N -U'root%secret' \
--c 'mkdir WIN40; \
-    put /var/spool/cups/tmp/3e98bf2d333b5 WIN40/infotec_2105.PPD; \
-	put /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;   \
-    put /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV; \
-    put /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP; \
-    put /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD; \
-	put /usr/share/cups/drivers/ICONLIB.DLL WIN40/ICONLIB.DLL; \
-	put /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;'
-  added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
-  Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
-  NT_STATUS_OBJECT_NAME_COLLISION making remote directory \WIN40
-  putting file /var/spool/cups/tmp/3e98bf2d333b5 as \WIN40/infotec_2105.PPD
-  putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM
-  putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV
-  putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP
-  putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD
-  putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL
-  putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL
-  
-  Running command: rpcclient localhost -N -U'root%secret' \
-   -c 'adddriver "Windows 4.0"      \
-   "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP: \
-   PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL, \
-    ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
-	cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:\
-	infotec_2105.PPD:NULL:ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,\
-	infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,\
-	ICONLIB.DLL"
-  Printer Driver infotec_2105 successfully installed.
-  
-  Running command: rpcclient localhost -N -U'root%secret'  \
-   -c 'setdriver infotec_2105 infotec_2105'
-  cmd = setdriver infotec_2105 infotec_2105
-  Successfully set infotec_2105 to driver infotec_2105.
-</screen></para>
-
-<warning><para>
-You will see the root password for the Samba account printed on screen. 
-</para></warning>
-
-<para>
-If you look closely, you'll discover your root password was transferred unencrypted over the wire, so beware!
-Also, if you look further, you may discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in the output.
-This will occur when the directories WIN40 and W32X86 already existed in the <smbconfsection name="[print$]"/>
-driver download share (from a previous driver installation). These are harmless warning messages.
-</para>
-</sect2>
-
-<sect2>
-<title>Understanding cupsaddsmb</title>
-
-<para>
-<indexterm><primary>cupsaddsmb</primary></indexterm>
-What has happened? What did <command>cupsaddsmb</command> do? There are five stages of the procedure:
-</para>
-
-<orderedlist>
-	<listitem><para>
-	<indexterm><primary>IPP</primary></indexterm>
-	Call the CUPS server via IPP and request the driver files and the PPD file for the named printer.</para></listitem>
-
-	<listitem><para>Store the files temporarily in the local TEMPDIR (as defined in <filename>cupsd.conf</filename>).</para></listitem>
-
-	<listitem><para>Connect via smbclient to the Samba server's <smbconfsection name="[print$]"/> share and put the files into the
-	 share's WIN40 (for Windows 9x/Me) and W32X86 (for Windows NT/200x/XP) subdirectories.</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>rpcclient</primary><secondary>adddriver</secondary></indexterm>
-	Connect via rpcclient to the Samba server and execute the <command>adddriver</command> command with the correct parameters.
-	</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>rpcclient</primary><secondary>setdriver</secondary></indexterm>
-	Connect via rpcclient to the Samba server a second time and execute the <command>setdriver</command> command.</para></listitem>
-</orderedlist>
-
-<note>
-<para>
-You can run the <command>cupsaddsmb</command> utility with parameters to specify one remote host as Samba host
-and a second remote host as CUPS host. Especially if you want to get a deeper understanding, it is a good idea
-to try it and see more clearly what is going on (though in real life most people will have their CUPS and
-Samba servers run on the same host):
-<screen>
-&rootprompt;<userinput>cupsaddsmb -H sambaserver -h cupsserver -v printer</userinput>
-</screen>
-</para></note>
-
-</sect2>
-
-<sect2>
-<title>How to Recognize If cupsaddsmb Completed Successfully</title>
-
-<para>
-You <emphasis>must</emphasis> always check if the utility completed
-successfully in all fields. You need at minimum these three messages
-among the output:
-</para>
-
-<orderedlist>
-	<listitem><para><emphasis>Printer Driver infotec_2105 successfully
-	installed.</emphasis> # (for the W32X86 == Windows NT/200x/XP
-	architecture).</para></listitem>
-
-	<listitem><para><emphasis>Printer Driver infotec_2105 successfully
-	installed.</emphasis> # (for the WIN40 == Windows 9x/Me
-	architecture).</para></listitem>
-
-	<listitem><para><emphasis>Successfully set [printerXPZ] to driver
-	[printerXYZ].</emphasis></para></listitem>
-</orderedlist>
-
-<para>
-These messages are probably not easily recognized in the general
-output. If you run <command>cupsaddsmb</command> with the <option>-a</option>
-parameter (which tries to prepare <emphasis>all</emphasis> active CUPS
-printer drivers for download), you might miss if individual printer
-drivers had problems installing properly. A redirection of the
-output will help you analyze the results in retrospective.
-</para>
-
-<para>
-If you get:
-<screen>
-SetPrinter call failed!
-result was WERR_ACCESS_DENIED
-</screen>
-it means that you might have set <smbconfoption name="use client driver">yes</smbconfoption> for this printer. 
-Setting it to <quote>no</quote> will solve the problem. Refer to the &smb.conf; man page for explanation of 
-the <parameter>use client driver</parameter>.
-</para>
-
-<note><para>
-It is impossible to see any diagnostic output if you do not run <command>cupsaddsmb</command> in verbose mode.
-Therefore, we strongly recommend against use of the default quiet mode. It will hide any problems from you that
-might occur.
-</para></note>
-</sect2>
-
-<sect2>
-<title>cupsaddsmb with a Samba PDC</title>
-
-<para>
-<indexterm><primary>cupsaddsmb</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-Can't get the standard <command>cupsaddsmb</command> command to run on a Samba PDC?  Are you asked for the
-password credential again and again, and the command just will not take off at all? Try one of these
-variations:
-</para>
-
-<para><screen>
-&rootprompt;<userinput>cupsaddsmb -U &example.workgroup;\\root -v printername</userinput>
-&rootprompt;<userinput>cupsaddsmb -H &example.pdc.samba; -U &example.workgroup;\\root -v printername</userinput>
-&rootprompt;<userinput>cupsaddsmb -H &example.pdc.samba; -U &example.workgroup;\\root -h cups-server -v printername</userinput>
-</screen></para>
-
-<para>
-(Note the two backslashes: the first one is required to <quote>escape</quote> the second one).
-</para>
-</sect2>
-
-<sect2>
-<title>cupsaddsmb Flowchart</title>
-
-<para>
-<indexterm><primary>cupsaddsmb</primary></indexterm>
-<indexterm><primary>raw print</primary></indexterm>
-<link linkend="small14">The cupsaddsmb Flowchart</link> shows a chart about the procedures, command flows, and
-data flows of the <command>cupaddsmb</command> command. Note again: cupsaddsmb is
-not intended to, and does not work with, raw print queues!
-</para>
-
-	<figure id="small14">
-		<title>cupsaddsmb Flowchart.</title>
-		<imagefile>14small</imagefile></figure>
-</sect2>
-
-<sect2>
-<title>Installing the PostScript Driver on a Client</title>
-
-<para>
-<indexterm><primary>point'n'print</primary></indexterm>
-<indexterm><primary>cupsaddsmb</primary></indexterm>
-After <command>cupsaddsmb</command> is completed, your driver is prepared for the clients to use. Here are the
-steps you must perform to download and install it via Point'n'Print. From a Windows client, browse to the
-CUPS/Samba server:
-</para>
-
-<itemizedlist>
-
-	<listitem><para>
-	<indexterm><primary>"Printers" folder</primary></indexterm>
-	Open the <guilabel>Printers</guilabel> share of Samba in Network Neighborhood.</para></listitem>
-
-	<listitem><para>Right-click on the printer in question.</para></listitem>
-
-	<listitem><para>From the opening context menu select
-	<guimenuitem>Install...</guimenuitem> or 
-	<guimenuitem>Connect...</guimenuitem> (depending on the Windows version you use).</para></listitem>
-</itemizedlist>
-
-<para>
-After a few seconds, there should be a new printer in your client's <emphasis>local</emphasis>
-<guilabel>Printers</guilabel> folder. On Windows XP it will follow a naming convention of
-<emphasis>PrinterName on SambaServer</emphasis>. (In my current case it is infotec_2105 on kde-bitshop). If
-you want to test it and send your first job from an application like Microsoft Word,
-the new printer appears in a
-<filename>\\SambaServer\PrinterName</filename> entry in the drop-down list of available printers.
-</para>
-
-<para>
-<indexterm><primary>PPD</primary></indexterm>
-<indexterm><primary>Adobe PostScript driver</primary></indexterm>
-<indexterm><primary>net use lpt1:</primary></indexterm>
-<command>cupsaddsmb</command> will only reliably work with CUPS version 1.1.15 or higher and with Samba
-version 2.2.4, or later. If it does not work, or if the automatic printer driver download to the clients does
-not succeed, you can still manually install the CUPS printer PPD on top of the Adobe PostScript driver on
-clients. Then point the client's printer queue to the Samba printer share for a UNC type of connection:
-<screen>
-&dosprompt;<userinput>net use lpt1: \\sambaserver\printershare /user:ntadmin</userinput>
-</screen>
-should you desire to use the CUPS networked PostScript RIP functions. (Note that user <quote>ntadmin</quote>
-needs to be a valid Samba user with the required privileges to access the printershare.) This sets up the
-printer connection in the traditional LanMan way (not using MS-RPC).
-</para>
-</sect2>
-
-<sect2 id="cups-avoidps1">
-<title>Avoiding Critical PostScript Driver Settings on the Client</title>
-
-<para>
-Printing works, but there are still problems. Most jobs print well, some do not print at all. Some jobs have
-problems with fonts, which do not look very good. Some jobs print fast and some are dead-slow. Many of these
-problems can be greatly reduced or even completely eliminated if you follow a few guidelines. Remember, if
-your print device is not PostScript-enabled, you are treating your Ghostscript installation on your CUPS host
-with the output your client driver settings produce. Treat it well:
-</para>
-
-<itemizedlist>
-	<listitem><para>
-	Avoid the PostScript Output Option: Optimize for Speed setting. Use the Optimize for Portability instead
-	(Adobe PostScript driver).</para></listitem>
-
-	<listitem><para>
-	Don't use the Page Independence: NO setting. Instead, use Page Independence: YES (CUPS PostScript Driver).
-	</para></listitem>
-
-	<listitem><para>
-	Recommended is the True Type Font Downloading Option: Native True Type over Automatic and Outline; 
-	you should by all means avoid Bitmap (Adobe PostScript Driver).</para></listitem>
-
-	<listitem><para>
-	Choose True Type Font: Download as Softfont into Printer over the default Replace by Device
-	Font (for exotic fonts, you may need to change it back to get a printout at all; Adobe).</para></listitem>
-
-	<listitem><para>
-	Sometimes you can choose PostScript Language Level: in case of problems try 2
-	instead of 3 (the latest ESP Ghostscript package handles Level 3 PostScript very well; Adobe).
-	</para></listitem>
-
-	<listitem><para>
-	Say Yes to PostScript Error Handler (Adobe).</para></listitem>
-</itemizedlist>
-
-</sect2>
-</sect1>
-
-<sect1>
-<title>Installing PostScript Driver Files Manually Using rpcclient</title>
-
-<para>
-Of course, you can run all the commands that are embedded into the
-cupsaddsmb convenience utility yourself, one by one, and upload
-and prepare the driver files for future client downloads.
-</para>
-
-<orderedlist>
-	<listitem><para>Prepare Samba (a CUPS print queue with the name of the
-	printer should be there. We are providing the driver now).</para></listitem>
-
-	<listitem><para>Copy all files to <smbconfsection name="[print$]"/>.</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>rpcclient</primary><secondary>adddriver</secondary></indexterm>
-	Run <command>rpcclient adddriver</command>
-	(for each client architecture you want to support).</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>rpcclient</primary><secondary>setdriver</secondary></indexterm>
-	Run <command>rpcclient setdriver.</command></para></listitem>
-</orderedlist>
-
-<para>
-<indexterm><primary>rpcclient</primary><secondary>enumports</secondary></indexterm>
-<indexterm><primary>rpcclient</primary><secondary>enumprinters</secondary></indexterm>
-<indexterm><primary>rpcclient</primary><secondary>enumdrivers</secondary></indexterm>
-<indexterm><primary>rpcclient</primary><secondary>setdriver</secondary></indexterm>
-<indexterm><primary>rpcclient</primary><secondary>adddriver</secondary></indexterm>
-We are going to do this now. First, read the man page on <parameter>rpcclient</parameter> to get a first idea.
-Look at all the printing-related subcommands: <command>enumprinters</command>, <command>enumdrivers</command>,
-<command>enumports</command>, <command>adddriver</command>, and <command>setdriver</command> are among the
-most interesting ones. <parameter>rpcclient</parameter> implements an important part of the MS-RPC protocol.
-You can use it to query (and command) a Windows NT (or 200x/XP) PC, too. MS-RPC is used by Windows clients,
-among other things, to benefit from the Point'n'Print features. Samba can now mimic this as well.
-</para>
-
-<sect2>
-<title>A Check of the rpcclient man Page</title>
-
-<para>
-First let's check the <parameter>rpcclient</parameter> man page. Here are two relevant passages:
-</para>
-
-<para>
-<indexterm><primary>adddriver</primary></indexterm>
-<indexterm><primary>AddPrinterDriver()</primary></indexterm>
-<indexterm><primary>getdriverdir</primary></indexterm>
-<command>adddriver <arch> <config></command> Execute an <command>AddPrinterDriver()</command> RPC
-to install the printer driver information on the server. The driver files should already exist in the
-directory returned by <command>getdriverdir</command>. Possible values for <parameter>arch</parameter> are the
-same as those for the <command>getdriverdir</command> command. The <parameter>config</parameter> parameter is
-defined as follows:
-<screen>
-Long Printer Name:\
-Driver File Name:\
-Data File Name:\
-Config File Name:\
-Help File Name:\
-Language Monitor Name:\
-Default Data Type:\
-Comma Separated list of Files
-</screen></para>
-
-<para>
-Any empty fields should be entered as the string <quote>NULL</quote>. 
-</para>
-
-<para>
-Samba does not need to support the concept of print monitors, since these only apply to local printers whose
-drivers can use a bidirectional link for communication. This field should be <quote>NULL</quote>.  On a remote
-NT print server, the print monitor for a driver must already be installed before adding the driver or else the
-RPC will fail.
-</para>
-
-<para>
-<indexterm><primary>setdriver</primary></indexterm>
-<indexterm><primary>SetPrinter()</primary></indexterm>
-<command>setdriver <printername> <drivername></command> Execute a <command>SetPrinter()</command>
-command to update the printer driver associated with an installed printer. The printer driver must already be
-correctly installed on the print server.
-</para>
-
-<para>
-<indexterm><primary>enumprinters</primary></indexterm>
-<indexterm><primary>enumdrivers</primary></indexterm>
-See also the <command>enumprinters</command> and <command>enumdrivers</command> commands to
-obtain a list of installed printers and drivers.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Understanding the rpcclient man Page</title>
-
-<para>
-<indexterm><primary>rpcclient</primary><secondary>adddriver</secondary></indexterm>
-The <emphasis>exact</emphasis> format isn't made too clear by the man page, since you have to deal with some
-parameters containing spaces. Here is a better description for it. We have line-broken the command and
-indicated the breaks with <quote>\</quote>. Usually you would type the command in one line without the line
-breaks:
-<screen>
-adddriver "Architecture" \
-   "LongPrinterName:DriverFile:DataFile:ConfigFile:HelpFile:\
-   LanguageMonitorFile:DataType:ListOfFiles,Comma-separated"
-</screen></para>
-
-<para>
-What the man pages denote as a simple <parameter><config></parameter> keyword in reality consists of
-eight colon-separated fields. The last field may take multiple (in some very insane cases, even 20 different
-additional) files. This might sound confusing at first.  What the man pages call the
-<quote>LongPrinterName</quote> in reality should be called the <quote>Driver Name</quote>. You can name it
-anything you want, as long as you use this name later in the <command>rpcclient ... setdriver</command>
-command. For practical reasons, many name the driver the same as the printer.
-</para>
-
-<para>
-It isn't simple at all. I hear you asking: <quote>How do I know which files are Driver File</quote>,
-<quote>Data File</quote>, <quote>Config File</quote>, <quote>Help File</quote> and <quote>Language Monitor
-File in each case?</quote> For an answer, you may want to have a look at how a Windows NT box with a shared
-printer presents the files to us. Remember that this whole procedure has to be developed by the Samba Team by
-listening to the traffic caused by Windows computers on the wire. We may as well turn to a Windows box now and
-access it from a UNIX workstation. We will query it with <command>rpcclient</command> to see what it tells us
-and try to understand the man page more clearly.
-</para>
-</sect2>
-
-<sect2>
-<title>Producing an Example by Querying a Windows Box</title>
-
-<para>
-<indexterm><primary>rpcclient</primary><secondary>getdriver</secondary></indexterm>
-<indexterm><primary>rpcclient</primary><secondary>getprinter</secondary></indexterm>
-We could run <command>rpcclient</command> with a <command>getdriver</command> or a
-<command>getprinter</command> subcommand (in level 3 verbosity) against it. Just sit down at a UNIX or Linux
-workstation with the Samba utilities installed, then type the following command:
-<screen>
-&rootprompt;<userinput>rpcclient -U'user%secret' NT-SERVER -c 'getdriver printername 3'</userinput>
-</screen></para>
-
-<para>
-From the result it should become clear which is which. Here is an example from my installation:
-<indexterm><primary>rpcclient</primary><secondary>getdriver</secondary></indexterm>
-<screen>
-&rootprompt;<userinput>rpcclient -U'Danka%xxxx' W200xSERVER \
-    -c'getdriver "DANKA InfoStream Virtual Printer" 3'</userinput>
-    cmd = getdriver "DANKA InfoStream Virtual Printer" 3
-
- [Windows NT x86]
- Printer Driver Info 3:
-         Version: [2]
-         Driver Name: [DANKA InfoStream]
-         Architecture: [Windows NT x86]
-         Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRIPT.DLL]
-         Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\INFOSTRM.PPD]
-         Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRPTUI.DLL]
-         Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRIPT.HLP]
- 
-         Dependentfiles: []
-         Dependentfiles: []
-         Dependentfiles: []
-         Dependentfiles: []
-         Dependentfiles: []
-         Dependentfiles: []
-         Dependentfiles: []
- 
-         Monitorname: []
-         Defaultdatatype: []
-</screen></para>
-
-<para>
-Some printer drivers list additional files under the label <parameter>Dependentfiles</parameter>, and these
-would go into the last field <parameter>ListOfFiles,Comma-separated</parameter>. For the CUPS PostScript
-drivers, we do not need any (nor would we for the Adobe PostScript driver); therefore, the field will get a
-<quote>NULL</quote> entry.
-</para>
-</sect2>
-
-<sect2>
-<title>Requirements for adddriver and setdriver to Succeed</title>
-
-<para>
-<indexterm><primary>rpcclient</primary><secondary>adddriver</secondary></indexterm>
-<indexterm><primary>cupsaddsmb</primary></indexterm>
-<indexterm><primary>setdriver</primary></indexterm>
-From the man page (and from the quoted output of <command>cupsaddsmb</command> above) it becomes clear that
-you need to have certain conditions in order to make the manual uploading and initializing of the driver files
-succeed. The two <command>rpcclient</command> subcommands (<command>adddriver</command> and
-<command>setdriver</command>) need to encounter the following preconditions to complete successfully:
-</para>
-
-<itemizedlist>
-	<listitem><para>You are connected as <smbconfoption name="printer admin"/> or root (this is
-	<emphasis>not</emphasis> the <quote>Printer Operators</quote> group in NT, but the <emphasis>printer
-	admin</emphasis> group as defined in the <smbconfsection name="[global]"/> section of &smb.conf;).
-	</para></listitem>
-
-	<listitem><para>Copy all required driver files to <filename>\\SAMBA\print$\w32x86</filename> and
-	<filename>\\SAMBA\print$\win40</filename> as appropriate. They will end up in the <quote>0</quote> respective
-	<quote>2</quote> subdirectories later. For now, <emphasis>do not</emphasis> put them there; they'll be
-	automatically used by the <command>adddriver</command> subcommand. (If you use <command>smbclient</command> to
-	put the driver files into the share, note that you need to escape the <quote>$</quote>: <command>smbclient
-	//sambaserver/print\$ -U root.</command>)</para></listitem>
-
-	<listitem><para>The user you're connecting as must be able to write to
-	the <smbconfsection name="[print$]"/> share and create
-	subdirectories.</para></listitem>
-
-	<listitem><para>The printer you are going to set up for the Windows
-	clients needs to be installed in CUPS already.</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>rpcclient</primary><secondary>setdriver</secondary></indexterm>
-	<indexterm><primary>rpcclient</primary><secondary>enumprinters</secondary></indexterm>
-	The CUPS printer must be known to Samba; otherwise the <command>setdriver</command> subcommand fails with an
-	NT_STATUS_UNSUCCESSFUL error. To check if the printer is known by Samba, you may use the
-	<command>enumprinters</command> subcommand to <command>rpcclient</command>. A long-standing bug prevented a
-	proper update of the printer list until every smbd process had received a SIGHUP or was restarted. Remember
-	this in case you've created the CUPS printer just recently and encounter problems: try restarting Samba.
-	</para></listitem>
-</itemizedlist>
-</sect2>
-
-<sect2>
-<title>Manual Driver Installation in 15 Steps</title>
-
-<para>
-We are going to install a printer driver now by manually executing all
-required commands. Because this may seem a rather complicated process at
-first, we go through the procedure step by step, explaining every
-single action item as it comes up.
-</para>
-
-<procedure>
-<title>Manual Driver Installation</title>
-
-	<step>
-	<title>Install the printer on CUPS.</title>
-
-	<para><screen>
-	&rootprompt;<userinput>lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E \
-				-P canonIR85.ppd</userinput>
-	</screen></para>
-
-	<para>
-	This installs a printer with the name <parameter>mysmbtstprn</parameter>
-	to the CUPS system. The printer is accessed via a socket
-	(a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root
-	for this step.
-	</para>
-	</step>
-
-	<step>
-	<title>(Optional.) Check if the printer is recognized by Samba.</title>
-
-	<para>
-	<indexterm><primary>rpcclient</primary><secondary>enumprinters</secondary></indexterm>
-<screen>
-&rootprompt;<userinput>rpcclient -Uroot%xxxx -c 'enumprinters' localhost \
-  | grep -C2 mysmbtstprn</userinput>
-flags:[0x800000]
-name:[\\kde-bitshop\mysmbtstprn]
-description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn]
-comment:[mysmbtstprn]
-</screen>
-	</para>
-
-	<para>
-	This should show the printer in the list. If not, stop and restart the Samba daemon (smbd) or send a HUP signal: 
-<screen>
-&rootprompt;<userinput>kill -HUP `pidof smbd`</userinput>
-</screen>
-	Check again. Troubleshoot and repeat until successful. Note the <quote>empty</quote> field between the two
-	commas in the <quote>description</quote> line. The driver name would appear here if there was one already. You
-	need to know root's Samba password (as set by the <command>smbpasswd</command> command) for this step and most
-	of the following steps. Alternatively, you can authenticate as one of the users from the <quote>write
-	list</quote> as defined in &smb.conf; for <smbconfsection name="[print$]"/>.
-	</para>
-	</step>
-
-	<step>
-	<title>(Optional.) Check if Samba knows a driver for the printer.</title>
-
-	<para>
-	<indexterm><primary>rpcclient</primary><secondary>getprinter</secondary></indexterm>
-	<indexterm><primary>rpcclient</primary><secondary>getdriver</secondary></indexterm>
-<screen>
-&rootprompt;<userinput>rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2'\
- localhost | grep driver </userinput>
-
-drivername:[]
-
-&rootprompt;<userinput>rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' \
- localhost | grep -C4 driv</userinput>
-
-servername:[\\kde-bitshop]
-printername:[\\kde-bitshop\mysmbtstprn]
-sharename:[mysmbtstprn]
-portname:[Samba Printer Port]
-drivername:[]
-comment:[mysmbtstprn]
-location:[]
-sepfile:[]
-printprocessor:[winprint]
- 
-&rootprompt;<userinput>rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost</userinput>
- result was WERR_UNKNOWN_PRINTER_DRIVER
-</screen></para>
-
-<para>
-None of the three commands shown above should show a driver.
-This step was done for the purpose of demonstrating this condition. An
-attempt to connect to the printer at this stage will prompt a
-message along the lines of, <quote>The server does not have the required printer
-driver installed.</quote>
-</para>
-</step>
-
-<step>
-<title>Put all required driver files into Samba's
-[print$].</title>
-
-<para><screen>
-&rootprompt;<userinput>smbclient //localhost/print\$ -U 'root%xxxx' \
-	-c 'cd W32X86; \
-	put /etc/cups/ppd/mysmbtstprn.ppd mysmbtstprn.PPD; \ 
-	put /usr/share/cups/drivers/cupsui.dll cupsui.dll; \
-	put /usr/share/cups/drivers/cupsdrvr.dll cupsdrvr.dll; \
-	put /usr/share/cups/drivers/cups.hlp cups.hlp'</userinput>
-</screen></para>
-
-<para>
-(This command should be entered in one long single line. Line breaks and the line ends indicated by
-<quote>\</quote> have been inserted for readability reasons.) This step is <emphasis>required</emphasis> for
-the next one to succeed. It makes the driver files physically present in the <smbconfsection name="[print$]"/>
-share. However, clients would still not be able to install them, because Samba does not yet treat them as
-driver files. A client asking for the driver would still be presented with a <quote>not installed here</quote>
-message.
-</para>
-</step>
-
-<step>
-<title>Verify where the driver files are now.</title>
-
-<para><screen>
-&rootprompt;<userinput>ls -l /etc/samba/drivers/W32X86/</userinput>
-total 669
-drwxr-sr-x    2 root     ntadmin       532 May 25 23:08 2
-drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
--rwxr--r--    1 root     ntadmin     14234 May 25 23:21 cups.hlp
--rwxr--r--    1 root     ntadmin    278380 May 25 23:21 cupsdrvr.dll
--rwxr--r--    1 root     ntadmin    215848 May 25 23:21 cupsui.dll
--rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
-</screen></para>
-
-<para>
-The driver files now are in the W32X86 architecture <quote>root</quote> of
-<smbconfsection name="[print$]"/>.
-</para>
-</step>
-
-<step>
-<title>Tell Samba that these are driver files (<command>adddriver</command>).</title>
-
-<para>
-<indexterm><primary>rpcclient</primary><secondary>adddriver</secondary></indexterm>
-<screen>
-&rootprompt;<userinput>rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" \
-	"mydrivername:cupsdrvr.dll:mysmbtstprn.PPD: \
-  cupsui.dll:cups.hlp:NULL:RAW:NULL"' \
-  localhost</userinput>
-Printer Driver mydrivername successfully installed.
-</screen></para>
-
-<para>
-You cannot repeat this step if it fails. It could fail even as a result of a simple typo. It will most likely
-have moved a part of the driver files into the <quote>2</quote> subdirectory. If this step fails, you need to
-go back to the fourth step and repeat it before you can try this one again. In this step, you need to choose a
-name for your driver. It is normally a good idea to use the same name as is used for the printer name;
-however, in big installations you may use this driver for a number of printers that obviously have different
-names, so the name of the driver is not fixed.
-</para>
-</step>
-
-<step>
-<title>Verify where the driver files are now.</title>
-
-<para><screen>
-&rootprompt;<userinput>ls -l /etc/samba/drivers/W32X86/</userinput>
-total 1
-drwxr-sr-x    2 root     ntadmin       532 May 25 23:22 2
-drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
-
-&rootprompt;<userinput>ls -l /etc/samba/drivers/W32X86/2</userinput>
-total 5039
-[....]
--rwxr--r--    1 root     ntadmin     14234 May 25 23:21 cups.hlp
--rwxr--r--    1 root     ntadmin    278380 May 13 13:53 cupsdrvr.dll
--rwxr--r--    1 root     ntadmin    215848 May 13 13:53 cupsui.dll
--rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
-</screen></para>
-
-<para>
-Notice how step 6 also moved the driver files to the appropriate
-subdirectory. Compare this with the situation after step 5.
-</para>
-</step>
-
-<step>
-<title>(Optional.) Verify if Samba now recognizes the driver.</title>
-
-<para>
-<indexterm><primary>rpcclient</primary><secondary>enumdrivers</secondary></indexterm>
-<screen>
-&rootprompt;<userinput>rpcclient -Uroot%xxxx -c 'enumdrivers 3' \
-	localhost | grep -B2 -A5 mydrivername</userinput>
-Printer Driver Info 3:
-Version: [2]
-Driver Name: [mydrivername]
-Architecture: [Windows NT x86]
-Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
-Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
-Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
-Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
-</screen></para>
-
-<para>
-Remember, this command greps for the name you chose for the
-driver in step 6. This command must succeed before you can proceed.
-</para>
-</step>
-
-<step>
-<title>Tell Samba which printer should use these driver files (<command>setdriver</command>).</title>
-
-<para>
-<indexterm><primary>rpcclient</primary><secondary>setdriver</secondary></indexterm>
-<screen>
-&rootprompt;<userinput>rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' \
-	localhost</userinput>
-Successfully set mysmbtstprn to driver mydrivername
-</screen></para>
-
-<para>
-Since you can bind any printer name (print queue) to any driver, this is a convenient way to set up many
-queues that use the same driver. You do not need to repeat all the previous steps for the setdriver command to
-succeed. The only preconditions are that <command>enumdrivers</command> must find the driver and
-<command>enumprinters</command> must find the printer.
-</para>
-</step>
-
-<step>
-<title>(Optional) Verify if Samba has recognized this association.</title>
-
-<para>
-<indexterm><primary>rpcclient</primary><secondary>getprinter</secondary></indexterm>
-<indexterm><primary>rpcclient</primary><secondary>getdriver</secondary></indexterm>
-<indexterm><primary>rpcclient</primary><secondary>enumprinters</secondary></indexterm>
-<screen>
-&rootprompt;<userinput>rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
-  | grep driver</userinput>
-drivername:[mydrivername]
- 
-&rootprompt;<userinput>rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
-  | grep -C4 driv</userinput>
-servername:[\\kde-bitshop]
-printername:[\\kde-bitshop\mysmbtstprn]
-sharename:[mysmbtstprn]
-portname:[Done]
-drivername:[mydrivername]
-comment:[mysmbtstprn]
-location:[]
-sepfile:[]
-printprocessor:[winprint]
- 
-&rootprompt;<userinput>rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost</userinput>
-[Windows NT x86]
-Printer Driver Info 3:
-     Version: [2]
-     Driver Name: [mydrivername]
-     Architecture: [Windows NT x86]
-     Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
-     Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
-     Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
-     Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
-     Monitorname: []
-     Defaultdatatype: [RAW]
-     Monitorname: []
-     Defaultdatatype: [RAW]
- 
-&rootprompt;<userinput>rpcclient -Uroot%xxxx -c 'enumprinters' localhost \
-	| grep mysmbtstprn</userinput>
-     name:[\\kde-bitshop\mysmbtstprn]
-     description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn]
-     comment:[mysmbtstprn]
-
-</screen></para>
-
-<para>
-<indexterm><primary>rpcclient</primary><secondary>enumprinters</secondary></indexterm>
-Compare these results with the ones from steps 2 and 3. Every one of these commands show the driver is installed. Even
-the <command>enumprinters</command> command now lists the driver
-on the <quote>description</quote> line.
-</para>
-</step>
-
-<step>
-<title>(Optional.) Tickle the driver into a correct
-device mode.</title>
-
-<para>
-<indexterm><primary>"Printers" folder</primary></indexterm>
-You certainly know how to install the driver on the client. In case
-you are not particularly familiar with Windows, here is a short
-recipe: Browse the Network Neighborhood, go to the Samba server, and look
-for the shares. You should see all shared Samba printers.
-Double-click on the one in question. The driver should get
-installed and the network connection set up. Another way is to
-open the <guilabel>Printers (and Faxes)</guilabel> folder, right-click on the printer in
-question, and select <guilabel>Connect</guilabel> or <guilabel>Install</guilabel>. As a result, a new printer
-should appear in your client's local <guilabel>Printers (and Faxes)</guilabel>
-folder, named something like <guilabel>printersharename on Sambahostname</guilabel>.
-</para>
-
-<para>
-It is important that you execute this step as a Samba printer admin
-(as defined in &smb.conf;). Here is another method
-to do this on Windows XP. It uses a command line, which you may type
-into the <quote>DOS box</quote> (type root's smbpassword when prompted):
-</para>
-
-<para><screen>
-&dosprompt;<userinput>runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry \
-	/in /n \\sambaserver\mysmbtstprn"</userinput>
-</screen></para>
-
-<para>
-Change any printer setting once (like changing <emphasis><guilabel>portrait</guilabel> to
-<guilabel>landscape</guilabel></emphasis>), click on <guibutton>Apply</guibutton>, and change the setting back.
-</para>
-</step>
-
-<step>
-<title>Install the printer on a client (Point'n'Print).</title>
-
-<para>
-<indexterm significance="preferred"><primary>point 'n' print</primary></indexterm>
-<screen>
-&dosprompt;<userinput>rundll32 printui.dll,PrintUIEntry /in /n "\\sambaserver\mysmbtstprn"</userinput>
-</screen>
-If it does not work, it could be a permissions problem with the <smbconfsection name="[print$]"/> share.
-</para>
-</step>
-
-<step>
-<title>(Optional) Print a test page.</title>
-
-<indexterm><primary>rundll32</primary></indexterm>
-<para><screen>
-&dosprompt;<userinput>rundll32 printui.dll,PrintUIEntry /p /n "\\sambaserver\mysmbtstprn"</userinput>
-</screen></para>
-
-<para>
-Then hit [TAB] five times, [ENTER] twice, [TAB] once, and [ENTER] again, and march to the printer.
-</para>
-</step>
-
-<step>
-<title>(Recommended.) Study the test page.</title>
-
-<para>
-Hmmm. Just kidding! By now you know everything about printer installations and you do not need to read a word.
-Just put it in a frame and bolt it to the wall with the heading "MY FIRST RPCCLIENT-INSTALLED PRINTER"
-&smbmdash; why not just throw it away!
-</para>
-</step>
-
-<step>
-<title>(Obligatory.) Enjoy. Jump. Celebrate your success.</title>
-
-<para><screen>
-&rootprompt;<userinput>echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd</userinput>
-</screen></para>
-</step>
-</procedure>
-</sect2>
-
-<sect2>
-<title>Troubleshooting Revisited</title>
-
-<para>
-<indexterm><primary>adddriver</primary></indexterm>
-The setdriver command will fail if in Samba's mind the queue is not
-already there. A successful installation displays the promising message that the:
-<screen>
-Printer Driver ABC successfully installed.
-</screen>
-following the <command>adddriver</command> parts of the procedure.  But you may also see
-a disappointing message like this one:
-<computeroutput>
-result was NT_STATUS_UNSUCCESSFUL
-</computeroutput></para>
-
-<para>
-<indexterm><primary>lpstat</primary></indexterm>
-<indexterm><primary>rpcclient</primary></indexterm>
-It is not good enough that you can see the queue in CUPS, using the <command>lpstat -p ir85wm</command>
-command. A bug in most recent versions of Samba prevents the proper update of the queue list. The recognition
-of newly installed CUPS printers fails unless you restart Samba or send a HUP to all smbd processes. To verify
-if this is the reason why Samba does not execute the <command>setdriver</command> command successfully, check
-if Samba <quote>sees</quote> the printer:
-<indexterm><primary>rpcclient</primary><secondary>enumprinters</secondary></indexterm>
-<screen>
-&rootprompt;<userinput>rpcclient transmeta -N -U'root%xxxx' -c 'enumprinters 0'|grep ir85wm</userinput>
-        printername:[ir85wm]
-</screen></para>
-
-<para>
-An alternate command could be this: 
-<indexterm><primary>rpcclient</primary><secondary>getprinter</secondary></indexterm>
-<screen>
-&rootprompt;<userinput>rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm' </userinput>
-        cmd = getprinter ir85wm
-        flags:[0x800000]
-        name:[\\transmeta\ir85wm]
-        description:[\\transmeta\ir85wm,ir85wm,DPD]
-        comment:[CUPS PostScript-Treiber for Windows NT/200x/XP]
-</screen></para>
-
-<para>
-By the way, you can use these commands, plus a few more, of course, to install drivers on remote Windows NT print servers too!
-</para>
-</sect2>
-</sect1>
-
-<sect1>
-<title>The Printing <filename>*.tdb</filename> Files</title>
-
-<para>
-<indexterm><primary>TDB</primary></indexterm>
-<indexterm><primary>connections.tdb</primary><seealso>TDB</seealso></indexterm>
-<indexterm><primary>printing.tdb</primary><seealso>TDB</seealso></indexterm>
-<indexterm><primary>share_info.tdb</primary><seealso>TDB</seealso></indexterm>
-<indexterm><primary>ntdrivers.tdb</primary><seealso>TDB</seealso></indexterm>
-<indexterm><primary>unexpected.tdb</primary><seealso>TDB</seealso></indexterm>
-<indexterm><primary>brlock.tdb</primary><seealso>TDB</seealso></indexterm>
-<indexterm><primary>locking.tdb</primary><seealso>TDB</seealso></indexterm>
-<indexterm><primary>ntforms.tdb</primary><seealso>TDB</seealso></indexterm>
-<indexterm><primary>messages.tdb</primary><seealso>TDB</seealso></indexterm>
-<indexterm><primary>ntprinters.tdb</primary><seealso>TDB</seealso></indexterm>
-<indexterm><primary>sessionid.tdb</primary><seealso>TDB</seealso></indexterm>
-<indexterm><primary>secrets.tdb</primary><seealso>TDB</seealso></indexterm>
-Some mystery is associated with the series of files with a tdb suffix appearing in every Samba installation.
-They are <filename>connections.tdb</filename>, <filename>printing.tdb</filename>,
-<filename>share_info.tdb</filename>, <filename>ntdrivers.tdb</filename>, <filename>unexpected.tdb</filename>,
-<filename>brlock.tdb</filename>, <filename>locking.tdb</filename>, <filename>ntforms.tdb</filename>,
-<filename>messages.tdb</filename> , <filename>ntprinters.tdb</filename>, <filename>sessionid.tdb</filename>,
-and <filename>secrets.tdb</filename>. What is their purpose?
-</para>
-
-<sect2>
-<title>Trivial Database Files</title>
-
-<para>
-<indexterm><primary>TDB</primary></indexterm>
-A Windows NT (print) server keeps track of all information needed to serve its duty toward its clients by
-storing entries in the Windows registry. Client queries are answered by reading from the registry,
-Administrator or user configuration settings that are saved by writing into the registry. Samba and UNIX
-obviously do not have such a Registry. Samba instead keeps track of all client-related information in a series
-of <filename>*.tdb</filename> files. (TDB stands for trivial data base). These are often located in
-<filename>/var/lib/samba/</filename> or <filename>/var/lock/samba/</filename>. The printing-related files are
-<filename>ntprinters.tdb</filename>, <filename>printing.tdb</filename>,<filename>ntforms.tdb</filename>, and
-<filename>ntdrivers.tdb</filename>.
-</para>
-</sect2>
-
-<sect2>
-<title>Binary Format</title>
-
-<para>
-<filename>*.tdb</filename> files are not human readable. They are written in a binary format. <quote>Why not
-ASCII?</quote>, you may ask. <quote>After all, ASCII configuration files are a good and proven tradition on
-UNIX.</quote> The reason for this design decision by the Samba Team is mainly performance. Samba needs to be
-fast; it runs a separate <command>smbd</command> process for each client connection, in some environments many
-thousands of them. Some of these <command>smbds</command> might need to write-access the same
-<filename>*.tdb</filename> file <emphasis>at the same time</emphasis>. The file format of Samba's
-<filename>*.tdb</filename> files allows for this provision. Many smbd processes may write to the same
-<filename>*.tdb</filename> file at the same time. This wouldn't be possible with pure ASCII files.
-</para>
-</sect2>
-
-<sect2>
-<title>Losing <filename>*.tdb</filename> Files</title>
-
-<para>
-It is very important that all <filename>*.tdb</filename> files remain consistent over all write and read
-accesses. However, it may happen that these files <emphasis>do</emphasis> get corrupted. (A <command>kill -9
-`pidof smbd'</command> while a write access is in progress could do the damage, as could a power interruption,
-etc.). In cases of trouble, a deletion of the old printing-related <filename>*.tdb</filename> files may be the
-only option. After that, you need to re-create all print-related setups unless you have made a backup of the
-<filename>*.tdb</filename> files in time.
-</para>
-</sect2>
-
-<sect2>
-<title>Using <command>tdbbackup</command></title>
-
-<para>
-<indexterm><primary>TDB</primary><secondary>backing up</secondary><see>tdbbackup</see></indexterm>
-<indexterm><primary>tdbbackup</primary></indexterm>
-Samba ships with a little utility that helps the root user of your system to backup your
-<filename>*.tdb</filename> files. If you run it with no argument, it prints a usage message:
-<screen>
-&rootprompt;<userinput>tdbbackup</userinput>
- Usage: tdbbackup [options] <fname...>
- 
- Version:3.0a
-   -h            this help message
-   -s suffix     set the backup suffix
-   -v            verify mode (restore if corrupt)
-</screen></para>
-
-<para>
-Here is how I backed up my <filename>printing.tdb</filename> file:
-</para>
-
-<para><screen>
-&rootprompt;<userinput>ls</userinput>
-.              browse.dat     locking.tdb     ntdrivers.tdb printing.tdb
-..             share_info.tdb connections.tdb messages.tdb  ntforms.tdb
-printing.tdbkp unexpected.tdb brlock.tdb      gmon.out      namelist.debug  
-ntprinters.tdb sessionid.tdb
- 
-&rootprompt;<userinput>tdbbackup -s .bak printing.tdb</userinput>
- printing.tdb : 135 records
- 
-&rootprompt;<userinput>ls -l printing.tdb*</userinput>
- -rw-------    1 root     root        40960 May  2 03:44 printing.tdb
- -rw-------    1 root     root        40960 May  2 03:44 printing.tdb.bak
-
-</screen></para>
-</sect2>
-</sect1>
-
-<sect1>
-<title>CUPS Print Drivers from Linuxprinting.org</title>
-
-<para>
-<indexterm><primary>Linuxprinting.org</primary></indexterm>
-CUPS ships with good support for HP LaserJet-type printers. You can install the generic driver as follows:
-<indexterm><primary>lpadmin</primary></indexterm>
-<screen>
-&rootprompt;<userinput>lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd</userinput>
-</screen></para>
-
-<para>
-The <option>-m</option> switch will retrieve the <filename>laserjet.ppd</filename> from the standard
-repository for not-yet-installed PPDs, which CUPS typically stores in
-<filename>/usr/share/cups/model</filename>. Alternatively, you may use <option>-P /path/to/your.ppd</option>.
-</para>
-
-<para>
-The generic <filename>laserjet.ppd,</filename> however, does not support every special option for every
-LaserJet-compatible model. It constitutes a sort of <quote>least common denominator</quote> of all the models.
-If for some reason you must pay for the commercially available ESP Print Pro drivers, your first move should
-be to consult the database on the <ulink noescape="1"
-url="http://www.linuxprinting.org/printer_list.cgi">Linuxprinting</ulink> Web site.  Linuxprinting.org has
-excellent recommendations about which driver is best used for each printer. Its database is kept current by
-the tireless work of Till Kamppeter from Mandrakesoft, who is also the principal author of the
-<command>foomatic-rip</command> utility.
-</para>
-
-<note><para>
-<indexterm><primary>foomatic-rip</primary></indexterm>
-<indexterm><primary>cupsomatic</primary></indexterm>
-<indexterm><primary>Adobe PPD</primary></indexterm>
-The former <command>cupsomatic</command> concept is now being replaced by the new successor, a much more
-powerful <command>foomatic-rip</command>.  <command>cupsomatic</command> is no longer maintained. Here is the
-new URL to the <ulink noescape="1" url="http://www.linuxprinting.org/driver_list.cgi">Foomatic-3.0</ulink>
-database.  If you upgrade to <command>foomatic-rip</command>, remember to also upgrade to the new-style PPDs
-for your Foomatic-driven printers. foomatic-rip will not work with PPDs generated for the old
-<command>cupsomatic</command>. The new-style PPDs are 100% compliant with the Adobe PPD specification. They
-are also intended to be used by Samba and the cupsaddsmb utility, to provide the driver files for the Windows
-clients!
-</para></note>
-
-<sect2>
-<title>foomatic-rip and Foomatic Explained</title>
-
-
-<para>
-<indexterm significance="preferred"><primary>foomatic</primary></indexterm>
-<indexterm significance="preferred"><primary>foomatic-rip</primary></indexterm>
-Nowadays, most Linux distributions rely on the utilities from the <ulink
-url="http://www.linuxprinting.org/">Linuxprinting.org</ulink> to create their printing-related software
-(which, by the way, works on all UNIXes and on Mac OS X and Darwin, too).  The utilities from this sire have a
-very end-user-friendly interface that allows for an easy update of drivers and PPDs for all supported models,
-all spoolers, all operating systems, and all package formats (because there is none). Its history goes back a
-few years.
-</para>
-
-<para>
-Recently, Foomatic has achieved the astonishing milestone of <ulink
-url="http://www.linuxprinting.org/printer_list.cgi?make=Anyone">1,000 listed</ulink> printer models.
-Linuxprinting.org keeps all the important facts about printer drivers, supported models, and which options are
-available for the various driver/printer combinations in its <ulink
-url="http://www.linuxprinting.org/foomatic.html">Foomatic</ulink> database. Currently there are <ulink
-url="http://www.linuxprinting.org/driver_list.cgi">245 drivers</ulink> in the database. Many drivers support
-various models, and many models may be driven by different drivers &smbmdash; its your choice!
-</para>
-
-<sect3>
-<title>690 <quote>Perfect</quote> Printers</title>
-
-<para>
-<indexterm><primary>Windows PPD</primary></indexterm>
-At present, there are 690 devices dubbed as working perfectly: 181 are <emphasis>mostly</emphasis> perfect, 96
-are <emphasis>partially</emphasis> perfect, and 46 are paperweights. Keeping in mind that most of these are
-non-PostScript models (PostScript printers are automatically supported by CUPS to perfection by using their
-own manufacturer-provided Windows PPD), and that a multifunctional device never qualifies as working perfectly
-if it does not also scan and copy and fax under GNU/Linux &smbmdash; then this is a truly astonishing
-achievement! Three years ago the number was not more than 500, and Linux or UNIX printing at the time wasn't
-anywhere near the quality it is today.
-</para>
-</sect3>
-
-<sect3>
-<title>How the Printing HOWTO Started It All</title>
-
-<para>
-A few years ago <ulink url="http://www2.picante.com/">Grant Taylor</ulink> started it all. The
-roots of today's Linuxprinting.org are in the first <ulink
-url="http://www.linuxprinting.org/foomatic2.9/howto/">Linux Printing HOWTO</ulink> that he authored. As a
-side-project to this document, which served many Linux users and admins to guide their first steps in this
-complicated and delicate setup (to a scientist, printing is <quote>applying a structured deposition of
-distinct patterns of ink or toner particles on paper substrates</quote>), he started to build in a little
-Postgres database with information about the hardware and driver zoo that made up Linux printing of the time.
-This database became the core component of today's Foomatic collection of tools and data. In the meantime, it
-has moved to an XML representation of the data.
-</para>
-</sect3>
-
-<sect3>
-<title>Foomatic's Strange Name</title>
-
-
-<para>
-<indexterm><primary>foomatic</primary></indexterm>
-<quote>Why the funny name?</quote> you ask. When it really took off, around spring 2000, CUPS was far less
-popular than today, and most systems used LPD, LPRng, or even PDQ to print. CUPS shipped with a few generic
-drivers (good for a few hundred different printer models). These didn't support many device-specific options.
-CUPS also shipped with its own built-in rasterization filter (<parameter>pstoraster</parameter>, derived from
-Ghostscript). On the other hand, CUPS provided brilliant support for <emphasis>controlling</emphasis> all
-printer options through standardized and well-defined PPD files.  Plus, CUPS was designed to be easily
-extensible.
-</para>
-
-<para>
-Taylor already had in his database a respectable compilation of facts about many more printers and the
-Ghostscript <quote>drivers</quote> they run with. His idea, to generate PPDs from the database information and
-use them to make standard Ghostscript filters work within CUPS, proved to work very well. It also killed
-several birds with one stone:
-</para>
-
-<itemizedlist>
-	<listitem><para>It made all current and future Ghostscript filter
-	developments available for CUPS.</para></listitem>
-
-	<listitem><para>It made available a lot of additional printer models
-	to CUPS users (because often the traditional Ghostscript way of
-	printing was the only one available).</para></listitem>
-
-	<listitem><para>It gave all the advanced CUPS options (Web interface,
-	GUI driver configurations) to users wanting (or needing) to use
-	Ghostscript filters.</para></listitem>
-</itemizedlist>
-</sect3>
-
-<sect3>
-<title>cupsomatic, pdqomatic, lpdomatic, directomatic</title>
-
-<para>
-<indexterm><primary>cupsomatic</primary></indexterm>
-<indexterm><primary>CUPS-PPD</primary></indexterm>
-<indexterm><primary>PPD</primary><secondary>CUPS</secondary><see>CUPS-PPD</see></indexterm>
-CUPS worked through a quickly hacked-up filter script named <ulink
-url="http://www.linuxprinting.org/download.cgi?filename=cupsomatic&show=0">cupsomatic</ulink>.  cupsomatic
-ran the printfile through Ghostscript, constructing automatically the rather complicated command line needed.
-It just needed to be copied into the CUPS system to make it work. To configure the way cupsomatic controls the
-Ghostscript rendering process, it needs a CUPS-PPD. This PPD is generated directly from the contents of the
-database. For CUPS and the respective printer/filter combo, another Perl script named CUPS-O-Matic did the PPD
-generation. After that was working, Taylor implemented within a few days a similar thing for two other
-spoolers. Names chosen for the config-generator scripts were <ulink
-url="http://www.linuxprinting.org/download.cgi?filename=lpdomatic&show=0">PDQ-O-Matic</ulink> (for PDQ)
-and <ulink url="http://www.linuxprinting.org/download.cgi?filename=lpdomatic&show=0">LPD-O-Matic</ulink>
-(for &smbmdash; you guessed it &smbmdash; LPD); the configuration here didn't use PPDs but other
-spooler-specific files.
-</para>
-
-<para>
-From late summer of that year, <ulink url="http://www.linuxprinting.org/till/">Till Kamppeter</ulink> started
-to put work into the database. Kamppeter had been newly employed by <ulink
-url="http://www.mandrakesoft.com/">Mandrakesoft</ulink> to convert its printing system over to CUPS, after
-they had seen his <ulink url="http://www.fltk.org/">FLTK</ulink>-based <ulink
-url="http://cups.sourceforge.net/xpp/">XPP</ulink> (a GUI front-end to the CUPS lp-command). He added a huge
-amount of new information and new printers. He also developed the support for other spoolers, like <ulink
-url="http://ppr.sourceforge.net/">PPR</ulink> (via ppromatic), <ulink
-url="http://sourceforge.net/projects/lpr/">GNUlpr</ulink>, and <ulink
-url="http://www.lprng.org/">LPRng</ulink> (both via an extended lpdomatic) and spooler-less printing (<ulink
-url="http://www.linuxprinting.org/download.cgi?filename=directomatic&show=0">directomatic</ulink>).
-</para>
-
-<para>
-So, to answer your question, <quote>Foomatic</quote> is the general name for all the overlapping code and data
-behind the <quote>*omatic</quote> scripts.  Foomatic, up to versions 2.0.x, required (ugly) Perl data
-structures attached to Linuxprinting.org PPDs for CUPS. It had a different <quote>*omatic</quote> script for
-every spooler, as well as different printer configuration files.
-</para>
-</sect3>
-
-<sect3>
-<title>The <emphasis>Grand Unification</emphasis> Achieved</title>
-
-<para>
-<indexterm><primary>foomatic-rip</primary></indexterm>
-This has all changed in Foomatic versions 2.9 (beta) and released as <quote>stable</quote> 3.0. It has now
-achieved the convergence of all *omatic scripts and is called the <ulink
-url="http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0">foomatic-rip</ulink>.
-This single script is the unification of the previously different spooler-specific *omatic scripts.
-foomatic-rip is used by all the different spoolers alike, and because it can read PPDs (both the original
-PostScript printer PPDs and the Linuxprinting.org-generated ones), all of a sudden all supported spoolers can
-have the power of PPDs at their disposal. Users only need to plug foomatic-rip into their system. For users
-there is improved media type and source support &smbmdash; paper sizes and trays are easier to configure.
-</para>
-
-<para>
-<indexterm><primary>PPDs</primary></indexterm>
-<indexterm><primary>Foomatic tutorial</primary></indexterm>
-<indexterm><primary>LinuxKongress2002</primary></indexterm>
-Also, the new generation of Linuxprinting.org PPDs no longer contains Perl data structures. If you are a
-distro maintainer and have used the previous version of Foomatic, you may want to give the new one a spin, but
-remember to generate a new-version set of PPDs via the new <ulink
-url="http://www.linuxprinting.org/download/foomatic/foomatic-db-engine-3.0.0beta1.tar.gz">foomatic-db-engine!</ulink>.
-Individual users just need to generate a single new PPD specific to their model by <ulink
-url="http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/II.Foomatic-User/II.tutorial-handout-foomatic-user.html">following
-the steps</ulink> outlined in the Foomatic tutorial or in this chapter. This new development is truly amazing.
-</para>
-
-<para>
-<indexterm><primary>foomatic-rip</primary></indexterm>
-<indexterm><primary>Adobe</primary></indexterm>
-<indexterm><primary>printer drivers</primary></indexterm>
-foomatic-rip is a very clever wrapper around the need to run Ghostscript with a different syntax, options,
-device selections, and/or filters for each different printer or spooler. At the same time, it can read the PPD
-associated with a print queue and modify the print job according to the user selections. Together with this
-comes the 100% compliance of the new Foomatic PPDs with the Adobe spec. Some innovative features of the
-Foomatic concept may surprise users. It will support custom paper sizes for many printers and will support
-printing on media drawn from different paper trays within the same job (in both cases, even where there is no
-support for this from Windows-based vendor printer drivers).
-</para>
-</sect3>
-
-<sect3>
-<title>Driver Development Outside</title>
-
-<para>
-<indexterm><primary>Linuxprinting.org</primary></indexterm>
-Most driver development itself does not happen within Linuxprinting.org. Drivers are written by independent
-maintainers.  Linuxprinting.org just pools all the information and stores it in its database. In addition, it
-also provides the Foomatic glue to integrate the many drivers into any modern (or legacy) printing system
-known to the world.
-</para>
-
-<para>
-Speaking of the different driver development groups, most of the work is currently done in three projects:
-</para>
-
-<itemizedlist>
-	<listitem><para>
-<indexterm><primary>Omni</primary></indexterm>
-	<ulink url="http://www-124.ibm.com/developerworks/oss/linux/projects/omni/">Omni</ulink>
-	&smbmdash; a free software project by IBM that tries to convert its printer
-	driver knowledge from good-ol' OS/2 times into a modern, modular,
-	universal driver architecture for Linux/UNIX (still beta). This
-	currently supports 437 models.</para></listitem>
-
-	<listitem><para>
-<indexterm><primary>HPIJS</primary></indexterm>
-	<ulink url="http://hpinkjet.sf.net/">HPIJS</ulink> &smbmdash;
-	a free software project by HP to provide the support for its own
-	range of models (very mature, printing in most cases is perfect and
-	provides true photo quality). This currently supports 369
-	models.</para></listitem>
-
-	<listitem><para>
-<indexterm><primary>Gutenprint</primary></indexterm>
-	<ulink url="http://gimp-print.sourceforge.net/">Gutenprint</ulink> &smbmdash; a free software
-	effort, started by Michael Sweet (also lead developer for CUPS), now
-	directed by Robert Krawitz, which has achieved an amazing level of
-	photo print quality (many Epson users swear that its quality is
-	better than the vendor drivers provided by Epson for the Microsoft
-	platforms). This currently supports 522 models.</para></listitem>
-</itemizedlist>
-</sect3>
-
-<sect3>
-<title>Forums, Downloads, Tutorials, Howtos (Also for Mac OS X and Commercial UNIX)</title>
-
-<para>
-Linuxprinting.org today is the one-stop shop to download printer drivers. Look for printer information and
-<ulink url="http://www.linuxprinting.org//kpfeifle/LinuxKongress2002/Tutorial/">tutorials</ulink> or solve
-printing problems in its popular <ulink url="http://www.linuxprinting.org/newsportal/">forums</ulink>. This
-forum is not just for GNU/Linux users, but admins of <ulink url="http://www.linuxprinting.org/macosx/">
-commercial UNIX systems</ulink> are also going there, and the relatively new
-<ulink url="http://www.linuxprinting.org/newsportal/thread.php3?name=linuxprinting.macosx.general">Mac OS X
-forum</ulink> has turned out to be one of the most frequented forums after only a few weeks.
-</para>
-
-<para>
-<indexterm><primary>Mandriva</primary></indexterm>
-<indexterm><primary>Mandrake</primary></indexterm>
-<indexterm><primary>Conectiva</primary></indexterm>
-Linuxprinting.org and the Foomatic driver wrappers around Ghostscript are now a standard tool-chain for
-printing on all the important distros. Most of them also have CUPS underneath. While in recent years most
-printer data had been added by Kamppeter, many additional contributions came from engineers with SuSE, Red
-Hat, Conectiva, Debian, and others. Vendor-neutrality is an important goal of the Foomatic project. Mandrake
-and Conectiva have merged and are now called Mandriva.
-</para>
-
-<note><para>
-Till Kamppeter from Mandrakesoft is doing an excellent job in his spare time to maintain Linuxprinting.org and
-Foomatic. So if you use it often, please send him a note showing your appreciation.
-</para></note>
-</sect3>
-
-<sect3>
-<title>Foomatic Database-Generated PPDs</title>
-
-<para>
-<indexterm><primary>Foomatic database</primary></indexterm>
-<indexterm><primary>XML-based datasets</primary></indexterm>
-<indexterm><primary>kprinter</primary></indexterm>
-<indexterm><primary>gtklp</primary></indexterm>
-<indexterm><primary>xpp</primary></indexterm>
-<indexterm><primary>HP Photosmart</primary></indexterm>
-<indexterm><primary>Epson Stylus inkjet</primary></indexterm>
-<indexterm><primary>non-PostScript printers</primary></indexterm>
-<indexterm><primary>raster</primary></indexterm>
-The Foomatic database is an amazing piece of ingenuity in itself. Not only does it keep the printer and driver
-information, but it is organized in a way that it can generate PPD files on the fly from its internal
-XML-based datasets. While these PPDs are modeled to the Adobe specification of PPDs, the
-Linuxprinting.org/Foomatic-PPDs do not normally drive PostScript printers. They are used to describe all the
-bells and whistles you could ring or blow on an Epson Stylus inkjet, or an HP Photosmart, or what-have-you.
-The main trick is one little additional line, not envisaged by the PPD specification, starting with the
-<parameter>*cupsFilter</parameter> keyword. It tells the CUPS daemon how to proceed with the PostScript print
-file (old-style Foomatic-PPDs named the cupsomatic filter script, while the new-style PPDs are now call
-foomatic-rip). This filter script calls Ghostscript on the host system (the recommended variant is ESP
-Ghostscript) to do the rendering work. foomatic-rip knows which filter or internal device setting it should
-ask from Ghostscript to convert the PostScript print job into a raster format ready for the target device.
-This usage of PPDs to describe the options of non-PostScript printers was the invention of the CUPS
-developers. The rest is easy.  GUI tools (like KDE's marvelous <ulink
-url="http://printing.kde.org/overview/kprinter.phtml">kprinter</ulink> or the GNOME <ulink
-url="http://gtklp.sourceforge.net/">gtklp</ulink> xpp and the CUPS Web interface) read the PPD as well and use
-this information to present the available settings to the user as an intuitive menu selection.
-</para>
-</sect3>
-</sect2>
-
-<sect2>
-<title>foomatic-rip and Foomatic PPD Download and Installation</title>
-
-<para>
-Here are the steps to install a foomatic-rip-driven LaserJet 4 Plus-compatible
-printer in CUPS (note that recent distributions of SuSE, UnitedLinux and
-Mandrake may ship with a complete package of Foomatic-PPDs plus the
-<command>foomatic-rip</command> utility. Going directly to
-Linuxprinting.org ensures that you get the latest driver/PPD files).
-</para>
-
-<itemizedlist>
-	<listitem><para>Open your browser at the Linuxprinting.org printer list <ulink url="http://www.linuxprinting.org/printer_list.cgi">page.</ulink>
-	</para></listitem>
-
-	<listitem><para>Check the complete list of printers in the 
-	<ulink url="http://www.linuxprinting.org/printer_list.cgi?make=Anyone">database.</ulink>.
-	</para></listitem>
-
-	<listitem><para>Select your model and click on the link.
-	</para></listitem>
-
-	<listitem><para>You'll arrive at a page listing all drivers working with this
-	model (for all printers, there will always be <emphasis>one</emphasis>
-	recommended driver. Try this one first).
-	</para></listitem>
-
-	<listitem><para>In our case (HP LaserJet 4 Plus), we'll arrive at the default driver for the
-	<ulink url="http://www.linuxprinting.org/show_printer.cgi?recnum=HP-LaserJet_4_Plus">HP-LaserJet 4 Plus.</ulink>
-	</para></listitem>
-
-	<listitem><para>The recommended driver is ljet4.</para></listitem>
-
-	<listitem><para>Several links are provided here. You should visit them all if you
-	are not familiar with the Linuxprinting.org database.
-	</para></listitem>
-
-	<listitem><para>There is a link to the database page for the
-	<ulink url="http://www.linuxprinting.org/show_driver.cgi?driver=ljet4">ljet4</ulink>.
-	On the driver's page, you'll find important and detailed information
-	about how to use that driver within the various available
-	spoolers.</para></listitem>
-
-	<listitem><para>Another link may lead you to the home page of the
-	author of the driver.</para></listitem>
-
-	<listitem><para>Important links are the ones that provide hints with
-	setup instructions for <ulink noescape="1" url="http://www.linuxprinting.org/cups-doc.html">CUPS</ulink>;
-	<ulink url="http://www.linuxprinting.org/pdq-doc.html">PDQ</ulink>;
-	<ulink url="http://www.linuxprinting.org/lpd-doc.html">LPD, LPRng, and GNUlpr</ulink>);
-	as well as <ulink url="http://www.linuxprinting.org/ppr-doc.html">PPR</ulink>
-	or <quote>spoolerless</quote> <ulink url="http://www.linuxprinting.org/direct-doc.html">printing</ulink>.
-	</para></listitem>
-
-	<listitem><para>You can view the PPD in your browser through this link:
-	<ulink noescape="1" url="http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1">http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1</ulink>
-	</para></listitem> <listitem><para>Most importantly, you can also generate and download
-	the <ulink url="http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=0">PPD</ulink>.
-	</para></listitem>
-
-	<listitem><para>The PPD contains all the information needed to use our
-	model and the driver; once installed, this works transparently
-	for the user. Later you'll only need to choose resolution, paper size,
-	and so on, from the Web-based menu, or from the print dialog GUI, or from
-	the command line.</para></listitem>
-
-	<listitem><para>If you ended up on the drivers
-	<ulink url="http://www.linuxprinting.org/show_driver.cgi?driver=ljet4">page</ulink>,
-	you can choose to use the <quote>PPD-O-Matic</quote> online PPD generator
-	program.</para></listitem>
-
-	<listitem><para>Select the exact model and check either <guilabel>Download</guilabel> or
-	<guilabel>Display PPD file</guilabel> and click <guilabel>Generate PPD file</guilabel>.</para></listitem>
-
-	<listitem><para>If you save the PPD file from the browser view, please
-	do not use cut and paste (since it could possibly damage line endings
-	and tabs, which makes the PPD likely to fail its duty), but use <guimenuitem>Save
-	as...</guimenuitem> in your browser's menu. (It is best to use the <guilabel>Download</guilabel> option
-	directly from the Web page.)</para></listitem>
-
-	<listitem><para>Another interesting part on each driver page is
-	the <guimenuitem>Show execution details</guimenuitem> button. If you
-	select your printer model and click on that button,
-	a complete Ghostscript command line will be displayed, enumerating all options
-	available for that combination of driver and printer model. This is a great way to
-	<quote>learn Ghostscript by doing</quote>. It is also an excellent cheat sheet
-	for all experienced users who need to reconstruct a good command line
-	for that darned printing script, but can't remember the exact
-	syntax. </para></listitem>
-
-	<listitem><para>Sometime during your visit to Linuxprinting.org, save
-	the PPD to a suitable place on your hard disk, say
-	<filename>/path/to/my-printer.ppd</filename> (if you prefer to install
-	your printers with the help of the CUPS Web interface, save the PPD to
-	the <filename>/usr/share/cups/model/</filename> path and restart
-	cupsd).</para></listitem>
-
-	<listitem><para>Then install the printer with a suitable command line,
-	like this: 
-	</para>
-
-	<para><screen>
-	&rootprompt;<userinput>lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E \
-		-P path/to/my-printer.ppd</userinput>
-	</screen></para></listitem>
-
-	<listitem><para>For all the new-style <quote>Foomatic-PPDs</quote>
-	from Linuxprinting.org, you also need a special CUPS filter named
-	foomatic-rip. 
-	</para></listitem>
-
-	<listitem><para>The foomatic-rip Perl script itself also makes some
-	interesting <ulink url="http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=1">reading</ulink>
-	because it is well documented by Kamppeter's in-line comments (even
-	non-Perl hackers will learn quite a bit about printing by reading
-	it).</para></listitem>
-
-	<listitem><para>Save foomatic-rip either directly in
-	<filename>/usr/lib/cups/filter/foomatic-rip</filename> or somewhere in
-	your $PATH (and remember to make it world-executable). Again,
-	do not save by copy and paste but use the appropriate link or the
-	<guimenuitem>Save as...</guimenuitem>  menu item in your browser.</para></listitem>
-
-	<listitem><para>If you save foomatic-rip in your $PATH, create a symlink:
-	<screen>
-	&rootprompt;<userinput>cd /usr/lib/cups/filter/ ; ln -s `which foomatic-rip'</userinput>
-	</screen>
-	</para>
-
-	<para>
-	CUPS will discover this new available filter at startup after restarting
-	cupsd.</para></listitem>
-</itemizedlist>
-
-<para>
-Once you print to a print queue set up with the Foomatic PPD, CUPS will insert the appropriate commands and
-comments into the resulting PostScript job file. foomatic-rip is able to read and act upon these and uses some
-specially encoded Foomatic comments embedded in the job file. These in turn are used to construct
-(transparently for you, the user) the complicated Ghostscript command line telling the printer driver exactly
-how the resulting raster data should look and which printer commands to embed into the data stream. You need:
-</para>
-
-<itemizedlist>
-	<listitem><para>A <quote>foomatic+something</quote> PPD &smbmdash; but this is not enough
-	to print with CUPS (it is only <emphasis>one</emphasis> important
-	component).</para></listitem>
-
-	<listitem><para>The <parameter>foomatic-rip</parameter> filter script (Perl) in
-	<filename>/usr/lib/cups/filters/</filename>.</para></listitem>
-
-	<listitem><para>Perl to make foomatic-rip run.</para></listitem>
-
-	<listitem><para>Ghostscript (because it is doing the main work,
-	controlled by the PPD/foomatic-rip combo) to produce the raster data
-	fit for your printer model's consumption.</para></listitem>
-
-	<listitem><para>Ghostscript <emphasis>must</emphasis> (depending on
-	the driver/model) contain support for a certain device representing
-	the selected driver for your model (as shown by <command>gs -h</command>).</para></listitem>
-
-	<listitem><para>foomatic-rip needs a new version of PPDs (PPD versions
-	produced for cupsomatic do not work with foomatic-rip).</para></listitem>
-</itemizedlist>
-</sect2>
-</sect1>
-
-<sect1>
-<title>Page Accounting with CUPS</title>
-
-
-<para>
-<indexterm><primary>CUPS</primary><secondary>Page Accounting</secondary></indexterm>
-Often there are questions regarding print quotas where Samba users (that is, Windows clients) should not be
-able to print beyond a certain number of pages or data volume per day, week, or month. This feature is
-dependent on the real print subsystem you're using.  Samba's part is always to receive the job files from the
-clients (filtered <emphasis>or</emphasis> unfiltered) and hand them over to this printing subsystem.
-</para>
-
-<para>
-Of course one could hack things with one's own scripts. But then there is CUPS. CUPS supports quotas that can
-be based on the size of jobs or on the number of pages or both, and can span any time period you want.
-</para>
-
-<sect2>
-<title>Setting Up Quotas</title>
-
-<para>
-<indexterm><primary>CUPS</primary><secondary>quotas</secondary></indexterm>
-This is an example command of how root would set a print quota in CUPS, assuming an existing printer named
-<quote>quotaprinter</quote>:
-<indexterm><primary>lpadmin</primary></indexterm>
-<screen>
-&rootprompt;<userinput>lpadmin -p quotaprinter -o job-quota-period=604800 \
-	-o job-k-limit=1024 -o job-page-limit=100</userinput>
-</screen></para>
-
-<para>
-This would limit every single user to print no more than 100 pages or 1024 KB of
-data (whichever comes first) within the last 604,800 seconds ( = 1 week).
-</para>
-</sect2>
-
-<sect2>
-<title>Correct and Incorrect Accounting</title>
-
-<para>
-For CUPS to count correctly, the printfile needs to pass the CUPS pstops filter; otherwise it uses a dummy
-count of <quote>one</quote>. Some print files do not pass it (e.g., image files), but then those are mostly
-one-page jobs anyway. This also means that proprietary drivers for the target printer running on the client
-computers and CUPS/Samba, which then spool these files as <quote>raw</quote> (i.e., leaving them untouched,
-not filtering them), will be counted as one-pagers too!
-</para>
-
-<para>
-You need to send PostScript from the clients (i.e., run a PostScript driver there) to have the chance to get
-accounting done. If the printer is a non-PostScript model, you need to let CUPS do the job to convert the file
-to a print-ready format for the target printer. This is currently working for about a thousand different
-printer models.  Linuxprinting.org has a driver <ulink url="http://www.linuxprinting.org/printer_list.cgi">list</ulink>.
-</para>
-</sect2>
-
-<sect2>
-<title>Adobe and CUPS PostScript Drivers for Windows Clients</title>
-
-<para>
-<indexterm><primary>Adobe PostScript</primary></indexterm>
-<indexterm><primary>pstops</primary></indexterm>
-<indexterm><primary>PPD</primary></indexterm>
-<indexterm><primary>pstoraster</primary></indexterm>
-<indexterm><primary>PJL-header</primary></indexterm>
-Before CUPS 1.1.16, your only option was to use the Adobe PostScript driver on the Windows clients. The output
-of this driver was not always passed through the <command>pstops</command> filter on the CUPS/Samba side, and
-therefore was not counted correctly (the reason is that it often, depending on the PPD being used, wrote a
-PJL-header in front of the real PostScript, which caused CUPS to skip <command>pstops</command> and go
-directly to the <command>pstoraster</command> stage).
-</para>
-
-<para>
-From CUPS 1.1.16 and later releases, you can use the CUPS PostScript driver for Windows NT/200x/XP
-clients (which is tagged in the download area of <filename>http://www.cups.org/</filename> as the
-<filename>cups-samba-1.1.16.tar.gz</filename> package). It does <emphasis>not</emphasis> work for Windows
-9x/Me clients, but it guarantees:
-</para>
-
-<itemizedlist>
-	<listitem><para> <indexterm><primary>PJL</primary></indexterm> To not write a PJL-header.</para></listitem>
-
-	<listitem><para>To still read and support all PJL-options named in the
-	driver PPD with its own means.</para></listitem>
-
-	<listitem><para>That the file will pass through the <command>pstops</command> filter
-	on the CUPS/Samba server.</para></listitem>
-
-	<listitem><para>To page-count correctly the print file.</para></listitem>
-</itemizedlist>
-
-<para>
-You can read more about the setup of this combination in the man page for <command>cupsaddsmb</command> (which
-is only present with CUPS installed, and only current from CUPS 1.1.16).
-</para>
-</sect2>
-
-<sect2>
-<title>The page_log File Syntax</title>
-
-<para>
-<indexterm><primary>page_log</primary></indexterm>
-These are the items CUPS logs in the <filename>page_log</filename> for every page of a job:
-</para>
-
-<itemizedlist>
-	<listitem><para>Printer name</para></listitem>
-
-	<listitem><para>User name</para></listitem>
-
-	<listitem><para>Job ID</para></listitem>
-
-	<listitem><para>Time of printing</para></listitem>
-
-	<listitem><para>Page number</para></listitem>
-
-	<listitem><para>Number of copies</para></listitem>
-
-	<listitem><para>A billing information string (optional)</para></listitem>
-
-	<listitem><para>The host that sent the job (included since version 1.1.19)</para></listitem>
-</itemizedlist>
-
-<para>
-Here is an extract of my CUPS server's <filename>page_log</filename> file to illustrate the
-format and included items:
-</para>
-
-<para><screen>
-tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13
-tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13
-tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13
-tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13
-Dig9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33
-</screen></para>
-
-<para>
-This was job ID <parameter>401</parameter>, printed on <parameter>tec_IS2027</parameter>
-by user <parameter>kurt</parameter>, a 64-page job printed in three copies, billed to
-<parameter>#marketing</parameter>, and sent from IP address <constant>10.160.50.13.</constant>
- The next job had ID <parameter>402</parameter>, was sent by user <parameter>boss</parameter>
-from IP address <constant>10.160.51.33</constant>, printed from one page 440 copies, and
-is set to be billed to <parameter>finance-dep</parameter>.
-</para>
-</sect2>
-
-<sect2>
-<title>Possible Shortcomings</title>
-
-<para>
-What flaws or shortcomings are there with this quota system?
-</para>
-
-<itemizedlist>
-	<listitem><para>The ones named above (wrongly logged job in case of
-	printer hardware failure, and so on).</para></listitem>
-
-	<listitem><para>In reality, CUPS counts the job pages that are being
-	processed in <emphasis>software</emphasis> (that is, going through the
-	RIP) rather than the physical sheets successfully leaving the
-	printing device. Thus, if there is a jam while printing the fifth sheet out
-	of 1,000 and the job is aborted by the printer, the page count will
-	still show the figure of 1,000 for that job.</para></listitem>
-
-	<listitem><para>All quotas are the same for all users (no flexibility
-	to give the boss a higher quota than the clerk) and no support for
-	groups.</para></listitem>
-
-	<listitem><para>No means to read out the current balance or the
-	<quote>used-up</quote> number of current quota.</para></listitem>
-
-	<listitem><para>A user having used up 99 sheets of a 100 quota will
-	still be able to send and print a 1,000 sheet job.</para></listitem>
-
-	<listitem><para>A user being denied a job because of a filled-up quota
-	does not get a meaningful error message from CUPS other than
-	<quote>client-error-not-possible</quote>.</para></listitem>
-</itemizedlist>
-</sect2>
-
-<sect2>
-<title>Future Developments</title>
-
-<para>
-This is the best system currently available, and there are huge
-improvements under development for CUPS 1.2:
-</para>
-
-<itemizedlist>
-	<listitem><para>Page counting will go into the backends (these talk
-	directly to the printer and will increase the count in sync with the
-	actual printing process; thus, a jam at the fifth sheet will lead to a
-	stop in the counting).</para></listitem>
-
-	<listitem><para>Quotas will be handled more flexibly.</para></listitem>
-
-	<listitem><para>Probably there will be support for users to inquire
-	about their accounts in advance.</para></listitem>
-
-	<listitem><para>Probably there will be support for some other tools
-	around this topic.</para></listitem>
-</itemizedlist>
-</sect2>
-
-<sect2>
-<title>Other Accounting Tools</title>
-
-<para>
-Other accounting tools that can be used includes: PrintAnalyzer, pyKota, printbill, LogReport.
-For more information regarding these tools you can try a Google search.
-</para>
-
-</sect2>
-</sect1>
-
-<sect1>
-<title>Additional Material</title>
-
-<para>
-A printer queue with <emphasis>no</emphasis> PPD associated to it is a
-<quote>raw</quote> printer, and all files will go directly there as received by the
-spooler. The exceptions are file types <parameter>application/octet-stream</parameter>
-that need the pass-through feature enabled. <quote>Raw</quote> queues do not do any
-filtering at all; they hand the file directly to the CUPS backend.
-This backend is responsible for sending the data to the device
-(as in the <quote>device URI</quote> notation: <filename>lpd://, socket://,
-smb://, ipp://, http://, parallel:/, serial:/, usb:/</filename>, and so on).
-</para>
-
-<para>
-cupsomatic/Foomatic are <emphasis>not</emphasis> native CUPS drivers
-and they do not ship with CUPS. They are a third-party add-on
-developed at Linuxprinting.org. As such, they are a brilliant hack to
-make all models (driven by Ghostscript drivers/filters in traditional
-spoolers) also work via CUPS, with the same (good or bad!) quality as
-in these other spoolers. <parameter>cupsomatic</parameter> is only a vehicle to execute a
-Ghostscript command line at that stage in the CUPS filtering chain
-where normally the native CUPS <parameter>pstoraster</parameter> filter would kick
-in. <parameter>cupsomatic</parameter> bypasses <parameter>pstoraster</parameter>, kidnaps the print file from CUPS,
-and redirects it to go through Ghostscript. CUPS accepts this
-because the associated cupsomatic/foomatic-PPD specifies:
-
-<programlisting>
-*cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"
-</programlisting>
-
-This line persuades CUPS to hand the file to <parameter>cupsomatic</parameter> once it has
-successfully converted it to the MIME type
-<parameter>application/vnd.cups-postscript</parameter>. This conversion will not happen for
-jobs arriving from Windows that are autotyped
-<parameter>application/octet-stream</parameter>, with the according changes in
-<filename>/etc/cups/mime.types</filename> in place.
-</para>
-
-<para>
-CUPS is widely configurable and flexible, even regarding its filtering
-mechanism. Another workaround in some situations would be to have in
-<filename>/etc/cups/mime.types</filename> entries as follows:
-
-<programlisting>
-application/postscript           application/vnd.cups-raw  0  -
-application/vnd.cups-postscript  application/vnd.cups-raw  0  -
-</programlisting>
-
-This would prevent all PostScript files from being filtered (rather,
-they will through the virtual <emphasis>nullfilter</emphasis>
-denoted with <quote>-</quote>). This could only be useful for PostScript printers. If you
-want to print PostScript code on non-PostScript printers (provided they support ASCII
-text printing), an entry as follows could be useful:
-
-<programlisting>
-*/*           application/vnd.cups-raw  0  -
-</programlisting>
-
-and would effectively send <emphasis>all</emphasis> files to the
-backend without further processing.
-</para>
-
-<para>
-You could have the following entry:
-
-<programlisting>
-application/vnd.cups-postscript application/vnd.cups-raw 0 \
-	my_PJL_stripping_filter
-</programlisting>
-
-You will need to write a <parameter>my_PJL_stripping_filter</parameter>
-(which could be a shell script) that parses the PostScript and removes the
-unwanted PJL. This needs to conform to CUPS filter design
-(mainly, receive and pass the parameters printername, job-id,
-username, jobtitle, copies, print options, and possibly the
-filename). It is installed as world executable into
-<filename>/usr/lib/cups/filters/</filename> and is called by CUPS
-if it encounters a MIME type <parameter>application/vnd.cups-postscript</parameter>.
-</para>
-
-<para>
-CUPS can handle <parameter>-o job-hold-until=indefinite</parameter>.
-This keeps the job in the queue on hold. It will only be printed
-upon manual release by the printer operator. This is a requirement in
-many central reproduction departments, where a few operators manage
-the jobs of hundreds of users on some big machine, where no user is
-allowed to have direct access (such as when the operators often need
-to load the proper paper type before running the 10,000 page job
-requested by marketing for the mailing, and so on).
-</para>
-</sect1>
-
-<sect1>
-<title>Autodeletion or Preservation of CUPS Spool Files</title>
-
-<para>
-<indexterm><primary>/var/spool/samba</primary></indexterm>
-<indexterm><primary>/var/spool/cups/</primary></indexterm>
-<indexterm><primary>cupsd.conf</primary></indexterm>
-Samba print files pass through two spool directories. One is the incoming directory managed by Samba (set in
-the <smbconfoption name="path">/var/spool/samba</smbconfoption> directive in the <smbconfsection
-name="[printers]"/> section of &smb.conf;). The other is the spool directory of your UNIX print subsystem. For
-CUPS it is normally <filename>/var/spool/cups/</filename>, as set by the <filename>cupsd.conf</filename>
-directive <filename>RequestRoot /var/spool/cups</filename>.
-</para>
-
-<sect2>
-<title>CUPS Configuration Settings Explained</title>
-
-<para>
-Some important parameter settings in the CUPS configuration file
-<filename>cupsd.conf</filename> are:
-</para>
-
-<variablelist>
-
-	<varlistentry><term>PreserveJobHistory Yes</term>
-	<listitem><para>
-	This keeps some details of jobs in cupsd's mind (well, it keeps the
-	c12345, c12346, and so on, files in the CUPS spool directory, which does a
-	similar job as the old-fashioned BSD-LPD control files). This is set
-	to <quote>Yes</quote> as a default.
-	</para></listitem></varlistentry>
-
-	<varlistentry><term>PreserveJobFiles Yes</term>
-	<listitem><para>
-	This keeps the job files themselves in cupsd's mind
-	(it keeps the d12345, d12346, etc., files in the CUPS spool
-	directory). This is set to <quote>No</quote> as the CUPS
-	default.
-	</para></listitem></varlistentry>
-
-	<varlistentry><term><quote>MaxJobs 500</quote></term>
-	<listitem><para>
-	This directive controls the maximum number of jobs
-	that are kept in memory. Once the number of jobs reaches the limit,
-	the oldest completed job is automatically purged from the system to
-	make room for the new one. If all of the known jobs are still
-	pending or active, then the new job will be rejected. Setting the
-	maximum to 0 disables this functionality. The default setting is
-	0.
-	</para></listitem></varlistentry>
-</variablelist>
-
-<para>
-(There are also additional settings for <parameter>MaxJobsPerUser</parameter> and
-<parameter>MaxJobsPerPrinter</parameter>.)
-</para>
-</sect2>
-
-<sect2>
-<title>Preconditions</title>
-
-<para>
-For everything to work as it should, you need to have three things:
-</para>
-
-<itemizedlist>
-	<listitem><para>A Samba smbd that is compiled against <filename>libcups</filename> (check
-	on Linux by running <userinput>ldd `which smbd'</userinput>).</para></listitem>
-
-	<listitem><para>A Samba-&smb.conf; setting of
-			<smbconfoption name="printing">cups</smbconfoption>.</para></listitem>
-
-</itemizedlist>
-
-<note><para>
-In this case, all other manually set printing-related commands (like
-<smbconfoption name="print command"/>, 
-<smbconfoption name="lpq command"/>, 
-<smbconfoption name="lprm command"/>, 
-<smbconfoption name="lppause command"/>, and
-<smbconfoption name="lpresume command"/>) are ignored, and they should normally have no
-influence whatsoever on your printing.
-</para></note>
-</sect2>
-
-</sect1>
-
-<sect1>
-<title>Printing from CUPS to Windows-Attached Printers</title>
-
-<para>
-<indexterm><primary>smbspool</primary></indexterm>
-<indexterm><primary>backends</primary></indexterm>
-From time to time the question arises, how can you print <emphasis>to</emphasis> a Windows-attached printer
-<emphasis>from</emphasis> Samba? Normally the local connection from Windows host to printer would be done by
-USB or parallel cable, but this does not matter to Samba. From here only an SMB connection needs to be opened
-to the Windows host. Of course, this printer must be shared first. As you have learned by now, CUPS uses
-<emphasis>backends</emphasis> to talk to printers and other servers. To talk to Windows shared printers, you
-need to use the <filename>smb</filename> (surprise, surprise!) backend. Check if this is in the CUPS backend
-directory. This usually resides in <filename>/usr/lib/cups/backend/</filename>. You need to find an
-<filename>smb</filename> file there. It should be a symlink to <filename>smbspool</filename>, and the file
-must exist and be executable:
-<screen>
-&rootprompt;<userinput>ls -l /usr/lib/cups/backend/</userinput>
-total 253
-drwxr-xr-x    3 root   root     720 Apr 30 19:04 .
-drwxr-xr-x    6 root   root     125 Dec 19 17:13 ..
--rwxr-xr-x    1 root   root   10692 Feb 16 21:29 canon
--rwxr-xr-x    1 root   root   10692 Feb 16 21:29 epson
-lrwxrwxrwx    1 root   root       3 Apr 17 22:50 http -> ipp
--rwxr-xr-x    1 root   root   17316 Apr 17 22:50 ipp
--rwxr-xr-x    1 root   root   15420 Apr 20 17:01 lpd
--rwxr-xr-x    1 root   root    8656 Apr 20 17:01 parallel
--rwxr-xr-x    1 root   root    2162 Mar 31 23:15 pdfdistiller
-lrwxrwxrwx    1 root   root      25 Apr 30 19:04 ptal -> /usr/sbin/ptal-cups
--rwxr-xr-x    1 root   root    6284 Apr 20 17:01 scsi
-lrwxrwxrwx    1 root   root      17 Apr  2 03:11 smb -> /usr/bin/smbspool
--rwxr-xr-x    1 root   root    7912 Apr 20 17:01 socket
--rwxr-xr-x    1 root   root    9012 Apr 20 17:01 usb
-
-&rootprompt;<userinput>ls -l `which smbspool`</userinput>
--rwxr-xr-x    1 root   root  563245 Dec 28 14:49 /usr/bin/smbspool
-</screen></para>
-
-<para>
-If this symlink does not exist, create it:
-<screen>
-&rootprompt;<userinput>ln -s `which smbspool` /usr/lib/cups/backend/smb</userinput>
-</screen></para>
-
-<para>
-<indexterm><primary>smbspool</primary></indexterm>
-<indexterm><primary>troubleshooting</primary></indexterm>
-<command>smbspool</command> was written by Mike Sweet from the CUPS folks. It is included and ships with
-Samba. It may also be used with print subsystems other than CUPS, to spool jobs to Windows printer shares. To
-set up printer <replaceable>winprinter</replaceable> on CUPS, you need to have a driver for it. Essentially
-this means to convert the print data on the CUPS/Samba host to a format that the printer can digest (the
-Windows host is unable to convert any files you may send). This also means you should be able to print to the
-printer if it were hooked directly at your Samba/CUPS host. For troubleshooting purposes, this is what you
-should do to determine if that part of the process chain is in order. Then proceed to fix the network
-connection/authentication to the Windows host, and so on.
-</para>
-
-<para>
-To install a printer with the <parameter>smb</parameter> backend on CUPS, use this command:
-</para>
-
-<para><screen>
-&rootprompt;<userinput>lpadmin -p winprinter -v smb://WINDOWSNETBIOSNAME/printersharename \
-  -P /path/to/PPD</userinput>
-</screen></para>
-
-<para>
-<indexterm><primary>PostScript printers</primary></indexterm>
-<indexterm><primary>PPD</primary></indexterm>
-<indexterm><primary>Windows NT PostScript driver</primary></indexterm>
-The PPD must be able to direct CUPS to generate the print data for the target model. For PostScript printers,
-just use the PPD that would be used with the Windows NT PostScript driver. But what can you do if the printer
-is only accessible with a password? Or if the printer's host is part of another workgroup? This is provided
-for: You can include the required parameters as part of the <filename>smb://</filename> device-URI like this:
-</para>
-
-<itemizedlist>
-	<listitem><para><filename>smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename</filename></para></listitem>
-	<listitem><para><filename>smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename</filename></para></listitem>
-	<listitem><para><filename>smb://username:password@WINDOWSNETBIOSNAME/printersharename</filename></para></listitem>
-</itemizedlist>
-
-<para>
-Note that the device URI will be visible in the process list of the Samba server (e.g., when someone uses the
-<command>ps -aux</command> command on Linux), even if the username and passwords are sanitized before they get
-written into the log files. This is an inherently insecure option; however, it is the only one. Don't use it
-if you want to protect your passwords. Better share the printer in a way that does not require a password!
-Printing will only work if you have a working NetBIOS name resolution up and running. Note that this is a
-feature of CUPS and you do not necessarily need to have smbd running.
-
-</para>
-</sect1>
-
-<sect1>
-<title>More CUPS Filtering Chains</title>
-
-<para>
-The diagrams in <link linkend="cups1">Filtering Chain 1</link> and <link linkend="cups2">Filtering Chain with
-cupsomatic</link> show how CUPS handles print jobs.
-</para>
-
-<figure id="cups1">
-	<title>Filtering Chain 1.</title>
-	<imagefile>cups1</imagefile>
-</figure>
-
-<!-- JJJ -->
-<figure id="cups2">
-	<title>Filtering Chain with cupsomatic</title>
-	<imagefile scale="45">cups2</imagefile>
-</figure>
-
-</sect1>
-
-<sect1>
-<title>Common Errors</title>
-
-	<sect2>
-	<title>Windows 9x/Me Client Can't Install Driver</title>
-
-	<para>For Windows 9x/Me, clients require the printer names to be eight
-	characters (or <quote>8 plus 3 chars suffix</quote>) max; otherwise, the driver files
-	will not get transferred when you want to download them from Samba.</para>
-
-	</sect2>
-
-	<sect2 id="root-ask-loop">
-	<title><quote>cupsaddsmb</quote> Keeps Asking for Root Password in Never-ending Loop</title>
-
-	<para>Have you set <smbconfoption name="security">user</smbconfoption>? Have
-	you used <command>smbpasswd</command> to give root a Samba account?
-	You can do two things: open another terminal and execute
-	<command>smbpasswd -a root</command> to create the account and
-	continue entering the password into the first terminal. Or, break
-	out of the loop by pressing Enter twice (without trying to type a
-	password).</para>
-
-	<para>
-	If the error is <quote>Tree connect failed: NT_STATUS_BAD_NETWORK_NAME</quote>, 
-	you may have forgotten to create the <filename>/etc/samba/drivers</filename> directory.
-	</para>
-	</sect2>
-
-	<sect2>
-	<title><quote>cupsaddsmb</quote> or <quote>rpcclient addriver</quote> Emit Error</title>
-
-	<para>
-	If <command>cupsaddsmb</command>, or <command>rpcclient addriver</command> emit the error message
-	WERR_BAD_PASSWORD, refer to <link linkend="root-ask-loop">the previous common error</link>.
-	</para>
-	
-	</sect2>
-
-	<sect2>
-	<title><quote>cupsaddsmb</quote> Errors</title>
-
-	<para>
-	The use of <quote>cupsaddsmb</quote> gives <quote>No PPD file for printer...</quote> 
-	message while PPD file is present.  What might the problem be?
-	</para>
-
-	<para>
-	Have you enabled printer sharing on CUPS? This means, do you have a <literal><Location
-	/printers>....</Location></literal> section in CUPS server's <filename>cupsd.conf</filename> that
-	does not deny access to the host you run <quote>cupsaddsmb</quote> from?  It <emphasis>could</emphasis> be an
-	issue if you use cupsaddsmb remotely, or if you use it with a <option>-h</option> parameter:
-	<userinput>cupsaddsmb -H sambaserver -h cupsserver -v printername</userinput>.
-	</para>
-
-	<para>Is your <parameter>TempDir</parameter> directive in
-	<filename>cupsd.conf</filename> set to a valid value, and is it writable?
-	</para>
-
-	</sect2>
-
-	<sect2>
-		<title>Client Can't Connect to Samba Printer</title>
-
-	<para>Use <command>smbstatus</command> to check which user
-	you are from Samba's point of view. Do you have the privileges to
-	write into the <smbconfsection name="[print$]"/>
-	share?</para>
-
-	</sect2>
-
-	<sect2>
-	<title>New Account Reconnection from Windows 200x/XP Troubles</title>
-
-<para>
-Once you are connected as the wrong user (for example, as <constant>nobody</constant>, which often occurs if
-you have <smbconfoption name="map to guest">bad user</smbconfoption>), Windows Explorer will not accept an
-attempt to connect again as a different user. There will not be any bytes transferred on the wire to Samba,
-but still you'll see a stupid error message that makes you think Samba has denied access. Use
-<command>smbstatus</command> to check for active connections. Kill the PIDs. You still can't re-connect, and
-you get the dreaded <computeroutput>You can't connect with a second account from the same
-machine</computeroutput> message as soon as you try. And you do not see a single byte arriving at Samba (see
-logs; use <quote>ethereal</quote>) indicating a renewed connection attempt. Shut all Explorer Windows.  This
-makes Windows forget what it has cached in its memory as established connections. Then reconnect as the right
-user. The best method is to use a DOS terminal window and <emphasis>first</emphasis> do <userinput>net use z:
-\\&example.server.samba;\print$ /user:root</userinput>. Check with <command>smbstatus</command> that you are
-connected under a different account. Now open the <guilabel>Printers</guilabel> folder (on the Samba server in
-the <guilabel>Network Neighborhood</guilabel>), right-click on the printer in question, and select
-<guibutton>Connect....</guibutton>.
-</para>
-</sect2>
-
-<sect2>
-<title>Avoid Being Connected to the Samba Server as the Wrong User</title>
-	
-<para>
-<indexterm><primary>smbstatus</primary></indexterm>
-You see per <command>smbstatus</command> that you are connected as user nobody, but you want to be root or
-printer admin. This is probably due to <smbconfoption name="map to guest">bad user</smbconfoption>, which
-silently connected you under the guest account when you gave (maybe by accident) an incorrect username. Remove
-<smbconfoption name="map to guest"/> if you want to prevent this.
-</para>
-</sect2>
-
-<sect2>
-<title>Upgrading to CUPS Drivers from Adobe Drivers</title>
-
-<para>
-This information came from a mailing list posting regarding problems experienced when
-upgrading from Adobe drivers to CUPS drivers on Microsoft Windows NT/200x/XP clients.
-</para>
-
-<para>First delete all old Adobe-using printers. Then delete all old Adobe drivers. (On Windows 200x/XP, right-click in
-the background of <guilabel>Printers</guilabel> folder, select <guimenuitem>Server Properties...</guimenuitem>, select
-tab <guilabel>Drivers</guilabel>, and delete here).</para>
-</sect2>
-
-<sect2>
-<title>Can't Use <quote>cupsaddsmb</quote> on Samba Server, Which Is a PDC</title>
-
-<para>Do you use the <quote>naked</quote> root user name? Try to do it
-this way: <userinput>cupsaddsmb -U <replaceable>DOMAINNAME</replaceable>\\root -v
-<replaceable>printername</replaceable></userinput>> (note the two backslashes: the first one is
-required to <quote>escape</quote> the second one).</para>
-
-</sect2>
-
-<sect2>
-<title>Deleted Windows 200x Printer Driver Is Still Shown</title>
-
-<para>Deleting a printer on the client will not delete the
-driver too (to verify, right-click on the white background of the
-<guilabel>Printers</guilabel> folder, select <guimenuitem>Server Properties</guimenuitem> and click on the
-<guilabel>Drivers</guilabel> tab). These same old drivers will be re-used when you try to
-install a printer with the same name. If you want to update to a new
-driver, delete the old ones first. Deletion is only possible if no
-other printer uses the same driver.</para>
-</sect2>
-
-<sect2>
-<title>Windows 200x/XP Local Security Policies</title>
-
-<indexterm><primary>Local security policies</primary></indexterm>
-<indexterm><primary>unsigned drivers</primary></indexterm>
-<para>Local security policies may not allow the installation of unsigned drivers &smbmdash; <quote>local
-security policies</quote> may not allow the installation of printer drivers at all.</para>
-
-</sect2>
-
-<sect2>
-<title>Administrator Cannot Install Printers for All Local Users</title>
-
-<para>
-<indexterm><primary>SMB printers</primary></indexterm>
-<indexterm><primary>IPP client</primary></indexterm>
-Windows XP handles SMB printers on a <quote>per-user</quote> basis.
-This means every user needs to install the printer himself or herself. To have a printer available for
-everybody, you might want to use the built-in IPP client capabilities of Win XP. Add a printer with the print
-path of <parameter>http://cupsserver:631/printers/printername</parameter>.  We're still looking into this one.
-Maybe a logon script could automatically install printers for all users.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Print Change, Notify Functions on NT Clients</title>
-
-<para>For print change, notify functions on NT++ clients.  These need to run the <command>Server</command>
-service first (renamed to <command>File & Print Sharing for MS Networks</command> in XP).</para>
-
-</sect2>
-
-<sect2>
-<title>Windows XP SP1</title>
-
-<para>Windows XP SP1 introduced a Point and Print Restriction Policy (this restriction does not apply to
-<quote>Administrator</quote> or <quote>Power User</quote> groups of users). In Group Policy Object Editor, go
-to <guimenu>User Configuration -> Administrative Templates -> Control Panel -> Printers</guimenu>. The policy
-is automatically set to <constant>Enabled</constant> and the <constant>Users can only Point and Print to
-machines in their Forest</constant> . You probably need to change it to <constant>Disabled</constant> or
-<constant>Users can only Point and Print to these servers</constant> to make driver downloads from Samba
-possible.
-</para>
-</sect2>
-
-<sect2>
-<title>Print Options for All Users Can't Be Set on Windows 200x/XP</title>
-
-<para>How are you doing it? I bet the wrong way (it is not easy to find out, though). There are three
-different ways to bring you to a dialog that <emphasis>seems</emphasis> to set everything. All three dialogs
-<emphasis>look</emphasis> the same, yet only one of them does what you intend. You need to be Administrator or
-Print Administrator to do this for all users. Here is how I do it on XP:
-</para>
-
-<orderedlist numeration="upperalpha">
-
-	<listitem><para>The first wrong way:
-
-		<orderedlist>
-		<listitem><para>Open the <guilabel>Printers</guilabel>
-		folder.</para></listitem>
-
-		<listitem><para>Right-click on the printer
-		(<guilabel>remoteprinter on cupshost</guilabel>) and
-		select in context menu <guimenuitem>Printing
-		Preferences...</guimenuitem></para></listitem>.
-
-		<listitem><para>Look at this dialog closely and remember what it looks like.</para></listitem>
-		</orderedlist>
-	</para></listitem>
-
-	<listitem><para>The second wrong way:
-	<orderedlist>
-		<listitem><para>Open the <guilabel>Printers</guilabel> folder.</para></listitem>
-
-		<listitem><para>Right-click on the printer (<guilabel>remoteprinter on
-		cupshost</guilabel>) and select the context menu
-		<guimenuitem>Properties</guimenuitem>.</para></listitem>
-
-		<listitem><para>Click on the <guilabel>General</guilabel> tab.</para></listitem>
-
-		<listitem><para>Click on the button <guibutton>Printing
-		Preferences...</guibutton></para></listitem>.
-
-		<listitem><para>A new dialog opens. Keep this dialog open and go back
-		to the parent dialog.</para></listitem>
-	</orderedlist>
-	</para></listitem>
-
-	<listitem><para>The third and correct way: 
-	<orderedlist>
-		<listitem><para>Open the <guilabel>Printers</guilabel> folder.</para></listitem>
-
-		<listitem><para>Right-click on the printer (<guilabel>remoteprinter on
-		cupshost</guilabel>) and select the context menu
-		<guimenuitem>Properties</guimenuitem>.</para></listitem>
-
-		<listitem><para>Click on the <guilabel>Advanced</guilabel>
-		tab. (If everything is <quote>grayed out,</quote> then you are not logged
-		in as a user with enough privileges).</para></listitem>
-
-		<listitem><para>Click on the <guibutton>Printing
-		Defaults...</guibutton> button.</para></listitem>
-
-		<listitem><para>On any of the two new tabs, click on the
-		<guibutton>Advanced...</guibutton> button.</para></listitem>
-
-		<listitem><para>A new dialog opens. Compare this one to the other
-		identical-looking one from step <quote>B.5</quote> or A.3".</para></listitem>
-	</orderedlist>
-	</para></listitem>
-</orderedlist>
-
-<para>
-Do you see any difference? I don't either. However, only the last one, which you arrived at with steps
-<quote>C.1. to C.6.</quote>, will save any settings permanently and be the defaults for new users. If you want
-all clients to get the same defaults, you need to conduct these steps <emphasis>as Administrator</emphasis>
-(<smbconfoption name="printer admin"/> in &smb.conf;) <emphasis>before</emphasis> a client downloads the
-driver (the clients can later set their own <emphasis>per-user defaults</emphasis> by following the procedures
-<emphasis>A</emphasis> or <emphasis>B</emphasis>).
-</para>
-
-</sect2>
-
-<sect2>
-<title>Most Common Blunders in Driver Settings on Windows Clients</title>
-
-<para>
-Don't use <parameter>Optimize for Speed</parameter>, but use <parameter>Optimize for Portability</parameter>
-instead (Adobe PS Driver). Don't use <parameter>Page Independence: No</parameter>. Always settle with
-<parameter>Page Independence: Yes</parameter> (Microsoft PS Driver and CUPS PS Driver for Windows NT/200x/XP).
-If there are problems with fonts, use <parameter>Download as Softfont into printer</parameter> (Adobe PS
-Driver). For <guilabel>TrueType Download Options</guilabel> choose <constant>Outline</constant>. Use
-PostScript Level 2 if you are having trouble with a non-PS printer and if there is a choice.
-</para>
-
-</sect2>
-
-<sect2>
-<title><command>cupsaddsmb</command> Does Not Work with Newly Installed Printer</title>
-
-<para>
-Symptom: The last command of <command>cupsaddsmb</command> does not complete successfully. If the <command>cmd
-= setdriver printername printername</command> result was NT_STATUS_UNSUCCESSFUL, then possibly the printer was
-not yet recognized by Samba. Did it show up in Network Neighborhood? Did it show up in <command>rpcclient
-hostname -c `enumprinters'</command>? Restart smbd (or send a <command>kill -HUP</command> to all processes
-listed by <command>smbstatus</command>, and try again.
-</para></sect2>
-
-<sect2>
-<title>Permissions on <filename>/var/spool/samba/</filename> Get Reset After Each Reboot</title>
-
-<para>
-Have you ever by accident set the CUPS spool directory to the same location (<parameter>RequestRoot
-/var/spool/samba/</parameter> in <filename>cupsd.conf</filename> or the other way round:
-<filename>/var/spool/cups/</filename> is set as <smbconfoption name="path"/>> in the <smbconfsection
-name="[printers]"/> section)? These <parameter>must</parameter> be different. Set <parameter>RequestRoot
-/var/spool/cups/</parameter> in <filename>cupsd.conf</filename> and <smbconfoption name="path">
-/var/spool/samba</smbconfoption> in the <smbconfsection name="[printers]"/> section of &smb.conf;. Otherwise,
-cupsd will sanitize permissions to its spool directory with each restart and printing will not work reliably.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Print Queue Called <quote>lp</quote> Mishandles Print Jobs</title>
-
-<para>
-In this case a print queue called <quote>lp</quote> intermittently swallows jobs and
-spits out completely different ones from what was sent.
-</para>
-
-<para>
-<indexterm><primary>lp</primary></indexterm>
-<indexterm><primary>Implicit Classes</primary></indexterm>
-<indexterm><primary>BrowseShortNames</primary></indexterm>
-It is a bad idea to name any printer <quote>lp</quote>. This is the traditional UNIX name for the default
-printer. CUPS may be set up to do an automatic creation of Implicit Classes. This means, to group all printers
-with the same name to a pool of devices and load-balance the jobs across them in a round-robin fashion.
-Chances are high that someone else has a printer named <quote>lp</quote> too. You may receive that person's
-jobs and send your own to his or her device unwittingly. To have tight control over the printer names, set
-<parameter>BrowseShortNames No</parameter>. It will present any printer as
-<replaceable>printername at cupshost</replaceable>, which gives you better control over what may happen in a
-large networked environment.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Location of Adobe PostScript Driver Files for <quote>cupsaddsmb</quote></title>
-
-<para>
-Use <command>smbclient</command> to connect to any Windows box with a shared PostScript printer:
-<command>smbclient //windowsbox/print\$ -U guest</command>. You can navigate to the
-<filename>W32X86/2</filename> subdir to <command>mget ADOBE*</command> and other files or to
-<filename>WIN40/0</filename> to do the same.  Another option is to download the <filename>*.exe</filename>
-packaged files from the Adobe Web site.
-</para>
-
-</sect2>
-
-</sect1>
-
-<sect1>
-<title>Overview of the CUPS Printing Processes</title>
-
-<para>
-A complete overview of the CUPS printing processes can be found in <link linkend="a_small">the CUPS
-Printing Overview diagram</link>.
-</para>
-
-<figure id="a_small">
-	<title>CUPS Printing Overview.</title>
-	<imagefile scale="45">a_small</imagefile>
-</figure>
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-ChangeNotes.xml b/docs-xml/Samba3-HOWTO/TOSHARG-ChangeNotes.xml
deleted file mode 100644
index 29bdf40..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-ChangeNotes.xml
+++ /dev/null
@@ -1,244 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="ChangeNotes">
-<chapterinfo>
-	&author.jht;
-	&author.jerry;
-</chapterinfo>
-
-<title>Important and Critical Change Notes for the Samba 3.x Series</title>
-<para>
-Please read this chapter carefully before update or upgrading Samba.  You should expect to find only critical
-or very important information here. Comprehensive change notes and guidance information can be found in the
-section <link linkend="upgrading-to-3.0">Updating and Upgrading Samba</link>.
-</para>
-
-<sect1>
-
-<title>Important Samba-3.2.x Change Notes</title>
-<para>
-!!!!!!!!!!!!Add all critical update notes here!!!!!!!!!!!!!
-</para>
-
-</sect1>
-
-<sect1>
-
-<title>Important Samba-3.0.x Change Notes</title>
-<para>
-These following notes pertain in particular to Samba 3.0.23 through Samba 3.0.25c (or more recent 3.0.25
-update).  Samba is a fluid and ever changing project. Changes throughout the 3.0.x series release are
-documented in this documention - See <link linkend="oldupdatenotes">Upgrading from Samba-2.x to Samba-3.0.25</link>.
-</para>
-
-<para>
-Sometimes it is difficult to figure out which part, or parts, of the HOWTO documentation should be updated to
-reflect the impact of new or modified features. At other times it becomes clear that the documentation is in
-need of being restructured.
-</para>
-
-<para>
-In recent times a group of Samba users has joined the thrust to create a new <ulink
-url="http://wiki.samba.org/">Samba Wiki</ulink> that is slated to become the all-singing and all-dancing
-new face of Samba documentation. Hopefully, the Wiki will benefit from greater community input and
-thus may be kept more up to date. Until that golden dream materializes and matures it is necessary to
-continue to maintain the HOWTO. This chapter will document major departures from earlier behavior until
-such time as the body of this HOWTO is restructured or modified.
-</para>
-
-<para>
-This chapter is new to the release of the HOWTO for Samba 3.0.23. It includes much of the notes provided
-in the <filename>WHATSNEW.txt</filename> file that is included with the Samba source code release tarball.
-</para>
-
-<sect2>
-<title>User and Group Changes</title>
-
-<para>
-The change documented here affects unmapped user and group accounts only.
-</para>
-
-<para>
-<indexterm><primary>user</primary></indexterm>
-<indexterm><primary>group</primary></indexterm>
-<indexterm><primary>Relative Identifiers</primary><see>RID</see></indexterm>
-<indexterm><primary>net</primary><secondary>groupmap</secondary></indexterm>
-<indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>vampire</tertiary></indexterm>
-The user and group internal management routines have been rewritten to prevent overlaps of
-assigned Relative Identifiers (RIDs).  In the past the has been a potential problem when
-either manually mapping Unix groups with the <command>net groupmap</command> command or
-when migrating a Windows domain to a Samba domain by executing:
-<command>net rpc vampire</command>.
-</para>
-
-<para>
-<indexterm><primary>SID</primary></indexterm>
-<indexterm><primary>SAM</primary></indexterm>
-<indexterm><primary>RID</primary></indexterm>
-<indexterm><primary>net</primary><secondary>getlocalsid</secondary></indexterm>
-Unmapped users are now assigned a SID in the <literal>S-1-22-1</literal> domain and unmapped
-groups are assigned a SID in the <literal>S-1-22-2</literal> domain.  Previously they were
-assigned a RID within the SAM on the Samba server.  For a domain controller this would have been under the
-authority of the domain SID where as on a member server or standalone server, this would have
-been under the authority of the local SAM (see the man page for <command>net getlocalsid</command>).
-</para>
-
-<para>
-<indexterm><primary>unmapped users</primary></indexterm>
-<indexterm><primary>unmapped groups</primary></indexterm>
-<indexterm><primary>SID</primary></indexterm>
-<indexterm><primary>NTFS</primary></indexterm>
-<indexterm><primary>GID</primary></indexterm>
-The result is that any unmapped users or groups on an upgraded Samba domain controller may
-be assigned a new SID.  Because the SID rather than a name is stored in Windows security
-descriptors, this can cause a user to no longer have access to a resource for example if a
-file was copied from a Samba file server to a local Windows client NTFS partition.  Any files
-stored on the Samba server itself will continue to be accessible because UNIX stores the UNIX
-GID and not the SID for authorization checks.
-</para>
-
-<para>
-An example helps to illustrate the change:
-</para>
-
-<para>
-<indexterm><primary>group mapping</primary></indexterm>
-<indexterm><primary>GID</primary></indexterm>
-<indexterm><primary>ACL</primary></indexterm>
-<indexterm><primary>SID</primary></indexterm>
-Assume that a group named <emphasis>developers</emphasis> exists with a UNIX GID of 782. In this
-case this group does not exist in Samba's group mapping table. It would be perfectly normal for
-this group to be appear in an ACL editor.  Prior to Samba-3.0.23, the group SID might appear as
-<literal>S-1-5-21-647511796-4126122067-3123570092-2565</literal>.
-</para>
-
-<para>
-<indexterm><primary>SID</primary></indexterm>
-<indexterm><primary>NTFS</primary></indexterm>
-<indexterm><primary>access</primary></indexterm>
-<indexterm><primary>group permissions</primary></indexterm>
-With the release of Samba-3.0.23, the group SID would be reported as <literal>S-1-22-2-782</literal>.  Any
-security descriptors associated with files stored on a Windows NTFS disk partition will not allow access based
-on the group permissions if the user was not a member of the
-<literal>S-1-5-21-647511796-4126122067-3123570092-2565</literal>  group.  Because this group SID is
-<literal>S-1-22-2-782</literal> and not reported in a user's token, Windows would fail the authorization check
-even though both SIDs in some respect refer to the same UNIX group.
-</para>
-
-<para>
-<indexterm><primary>group mapping</primary></indexterm>
-<indexterm><primary>SID</primary></indexterm>
-The workaround for versions of Samba prior to 3.0.23, is to create a manual domain group mapping
-entry for the group <emphasis>developers</emphasis> to point at the
-<literal>S-1-5-21-647511796-4126122067-3123570092-2565</literal> SID. With the release of Samba-3.0.23 this
-workaround is no longer needed.
-</para>
-</sect2>
-
-<sect2>
-<title>Essential Group Mappings</title>
-<para>
-Samba 3.0.x series  releases before 3.0.23 automatically created group mappings for the essential Windows
-domain groups <literal>Domain Admins, Domain Users, Domain Guests</literal>. Commencing with Samba 3.0.23
-these mappings need to be created by the Samba administrator. Failure to do this may result in a failure to
-correctly authenticate and recoognize valid domain users. When this happens users will not be able to log onto
-the Windows client.
-</para>
-
-<note><para>
-Group mappings are essentail only if the Samba servers is running as a PDC/BDC. Stand-alone servers do not
-require these group mappings.
-</para></note>
-
-<para>
-The following mappings are required:
-</para>
-
-<table frame="all" id="TOSH-domgroups">
-	<title>Essential Domain Group Mappings</title>
-	<tgroup align="center" cols="3">
-	<thead>
-		<row><entry>Domain Group</entry><entry>RID</entry><entry>Example UNIX Group</entry></row>
-	</thead>
-	<tbody>
-		<row><entry>Domain Admins</entry><entry>512</entry><entry>root</entry></row>
-		<row><entry>Domain Users</entry><entry>513</entry><entry>users</entry></row>
-		<row><entry>Domain Guests</entry><entry>514</entry><entry>nobody</entry></row>
-	</tbody>
-	</tgroup>
-</table>
-
-<para>
-When the POSIX (UNIX) groups are stored in LDAP, it may be desirable to call these <literal>domadmins, domusers,
-domguests</literal> respectively.
-</para>
-
-<para>
-For further information regarding group mappings see <link linkend="groupmapping">Group Mapping: MS Windows
-and UNIX</link>.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Passdb Changes</title>
-
-<para>
-<indexterm><primary>backends</primary></indexterm>
-<indexterm><primary>GID</primary></indexterm>
-<indexterm><primary>SQL</primary></indexterm>
-<indexterm><primary>XML</primary></indexterm>
-The <smbconfoption name="passdb backend"/> parameter no longer accepts multiple passdb backends in a
-chained configuration.  Also be aware that the SQL and XML based passdb modules have been
-removed in the Samba-3.0.23 release.  More information regarding external support for a SQL
-passdb module can be found on the  <ulink url="http://pdbsql.sourceforge.net/">pdbsql</ulink> web site.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Group Mapping Changes in Samba-3.0.23</title>
-
-<para>
-<indexterm><primary>default mapping</primary></indexterm>
-<indexterm><primary>Domain Admins</primary></indexterm>
-<indexterm><primary>smbpasswd</primary></indexterm>
-<indexterm><primary>tdbsam</primary></indexterm>
-<indexterm><primary>passdb backend</primary></indexterm>
-<indexterm><primary>group mappings</primary></indexterm>
-<indexterm><primary>GID</primary></indexterm>
-<indexterm><primary>SID</primary></indexterm>
-<indexterm><primary>IDMAP</primary></indexterm>
-<indexterm><primary>winbindd</primary></indexterm>
-<indexterm><primary>domain groups</primary></indexterm>
-The default mapping entries for groups such as <literal>Domain Admins</literal> are no longer
-created when using an <literal>smbpasswd</literal> file or a <literal>tdbsam</literal> passdb
-backend.  This means that it is necessary to explicitly execute the <command>net groupmap add</command>
-to create group mappings, rather than use the <command>net groupmap modify</command> method to create the
-Windows group SID to UNIX GID mappings.  This change has no effect on winbindd's IDMAP functionality
-for domain groups.
-</para>
-
-</sect2>
-
-<sect2>
-<title>LDAP Changes in Samba-3.0.23</title>
-
-<para>
-<indexterm><primary>LDAP schema</primary></indexterm>
-<indexterm><primary>sambaSID</primary></indexterm>
-<indexterm><primary>OpenLDAP</primary></indexterm>
-<indexterm><primary>slapindex</primary></indexterm>
-<indexterm><primary>slapd.conf</primary></indexterm>
-There has been a minor update the Samba LDAP schema file. A substring matching rule has been
-added to the <literal>sambaSID</literal> attribute definition.  For OpenLDAP servers, this
-will require the addition of <literal>index sambaSID sub</literal> to the
-<filename>slapd.conf</filename> configuration file.  It will be necessary to execute the
-<command>slapindex</command> command after making this change. There has been no change to the
-actual data storage schema.
-</para>
-
-</sect2>
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-Compiling.xml b/docs-xml/Samba3-HOWTO/TOSHARG-Compiling.xml
deleted file mode 100644
index 3a2b729..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-Compiling.xml
+++ /dev/null
@@ -1,356 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="compiling">
-<chapterinfo>
-	&author.jelmer;
-	&author.jht;
-	&author.tridge;
-	
-	<pubdate> 22 May 2001 </pubdate>
-	<pubdate> 18 March 2003 </pubdate>
-	<pubdate> June 2005 </pubdate>
-</chapterinfo>
-
-<title>How to Compile Samba</title>
-
-<para>
-You can obtain the Samba source file from the
-<ulink url="http://samba.org/">Samba Web site</ulink>. To obtain a development version, 
-you can download Samba from Subversion or using <command>rsync</command>.
-</para>
-
-<sect1>
-<title>Access Samba Source Code via GIT</title>
-
-
-<sect2>
-<title>Introduction</title>
-
-<para>
-<indexterm><primary>Subversion</primary></indexterm>
-Samba is developed in an open environment. Developers use
-GIT to <quote>checkin</quote> (also known as 
-<quote>commit</quote>) new source code.  See the
-<ulink noescape="1"
-       url="https://wiki.samba.org/index.php/Using_Git_for_Samba_Development">Using
-Git for Samba Development page</ulink> in the Samba wiki.
-</para>
-
-</sect2>
-
-
-</sect1>
-
-<sect1>
-	<title>Accessing the Samba Sources via rsync and ftp</title>
-
-
-	<para>
-	<indexterm><primary>rsync</primary></indexterm>
-	<indexterm><primary>ftp</primary></indexterm>
-	<parameter>pserver.samba.org</parameter> also exports unpacked copies of most parts of the Subversion tree
-	at the Samba <ulink noescape="1" url="ftp://samba.org/pub/unpacked">unpacked</ulink> location and also
-	via anonymous rsync at the Samba <ulink noescape="1"
-	url="rsync://samba.org/ftp/unpacked/">rsync</ulink> server location.  I recommend using rsync rather
-	than ftp, because rsync is capable of compressing data streams, but it is also more useful than FTP because
-	during a partial update it will transfer only the data that is missing plus a small overhead.  See <ulink
-	noescape="1" url="http://rsync.samba.org/">the rsync home page</ulink> for more info on rsync.
-	</para>
-
-	<para>
-	The disadvantage of the unpacked trees is that they do not support automatic
-	merging of local changes as GIT does. <command>rsync</command> access is most convenient 
-	for an initial install.                      
-	</para>
-</sect1>
-
-<sect1>
-<title>Verifying Samba's PGP Signature</title>
-
-<para>
-<indexterm><primary>GPG</primary></indexterm>
-<indexterm><primary>PGP</primary></indexterm>
-It is strongly recommended that you verify the PGP signature for any source file before
-installing it. Even if you're not downloading from a mirror site, verifying PGP signatures
-should be a standard reflex. Many people today use the GNU GPG tool set in place of PGP.
-GPG can substitute for PGP.
-</para>
-
-
-<para>
-With that said, go ahead and download the following files:
-</para>
-
-<para><screen>
-&prompt;<userinput>wget http://samba.org/samba/ftp/samba-latest.tar.asc</userinput>
-&prompt;<userinput>wget http://samba.org/samba/ftp/samba-latest.tar.gz</userinput>
-&prompt;<userinput>wget http://samba.org/samba/ftp/samba-pubkey.asc</userinput>
-</screen></para>
-
-
-<para>
-<indexterm><primary>PGP</primary></indexterm>
-The first file is the PGP signature for the Samba source file; the other is the Samba public
-PGP key itself. Import the public PGP key with:
-<screen>
-&prompt;<userinput>gpg --import samba-pubkey.asc</userinput>
-</screen>
-and verify the Samba source code integrity with:
-<screen>
-&prompt;<userinput>gzip -d samba-latest.tar.gz</userinput>
-&prompt;<userinput>gpg --verify samba-latest.tar.asc</userinput>
-</screen>
-</para>
-
-<para>
-If you receive a message like, <quote>Good signature from Samba Distribution Verification Key...,</quote>
-then all is well. The warnings about trust relationships can be ignored. An
-example of what you would not want to see would be:
-<screen>
-gpg: BAD signature from <quote>Samba Distribution Verification Key</quote>
-</screen>
-</para>
-
-</sect1>
-
-<sect1>
-	<title>Building the Binaries</title>
-	
-	<para>
-	<indexterm><primary>configure</primary></indexterm>
-	To build the binaries, run the program <userinput>./configure
-	</userinput> in the top level directory of the source tree. This should automatically
-	configure Samba for your operating system. If you have unusual 
-	needs, then you may wish to first run:
-<screen>
-&rootprompt;<userinput>./configure --help</userinput>
-</screen>
-</para>
-	
-	<para>
-	This will help you to see what special options can be enabled. Now execute
-	<userinput>./configure</userinput> with any arguments it might need:
-<screen>
-&rootprompt;<userinput>./configure <replaceable>[... arguments ...]</replaceable></userinput>
-</screen>
-	</para>
-	
-	<para>
-	<indexterm><primary>make</primary></indexterm>
-	Execute the following create the binaries:
-<screen>
-&rootprompt; <userinput>make</userinput>
-</screen>
-	Once it is successfully compiled, you can execute the command shown here to
-	install the binaries and manual pages:
-<screen>
-&rootprompt; <userinput>make install</userinput>
-</screen>
-	</para>
-	
-	<sect2>
-	<title>Compiling Samba with Active Directory Support</title>
-	
-	<para>
-	In order to compile Samba with ADS support, you need to have installed
-	on your system:
-	</para>
-
-	<itemizedlist>
-	
-	    <listitem><para>
-		The MIT or Heimdal Kerberos development libraries
-	    (either install from the sources or use a package).
-		</para></listitem>
-	
-	    <listitem><para>
-		The OpenLDAP development libraries.
-		</para></listitem>
-	    
-	</itemizedlist>
-
-	<para>
-	If your Kerberos libraries are in a nonstandard location, then
-	remember to add the configure option
-	<option>--with-krb5=<replaceable>DIR</replaceable></option>.
-	</para>
-
-	<para>
-	After you run configure, make sure that the 
-	<filename>bin/default/include/config.h</filename> it generates contain lines like this:
-<programlisting>
-#define HAVE_KRB5 1
-#define HAVE_LDAP 1
-</programlisting>
-	</para>
-
-	<para>
-	If it does not, configure did not find your KRB5 libraries or
-	your LDAP libraries. Look in <filename>bin/config.log</filename> to figure
-	out why and fix it.
-	</para>
-
-	<sect3>
-	<title>Installing the Required Packages for Debian</title>
-
-	<para>On Debian, you need to install the following packages:</para>
-	<para>
-		<itemizedlist>
-			<listitem><para>libkrb5-dev</para></listitem>
-			<listitem><para>krb5-user</para></listitem>
-		</itemizedlist>
-	</para>
-	</sect3>
-
-	<sect3>
-	<title>Installing the Required Packages for Red Hat Linux</title>
-
-	<para>On Red Hat Linux, this means you should have at least: </para>
-	<para>
-		<itemizedlist>
-			<listitem><para>krb5-workstation (for kinit)</para></listitem>
-			<listitem><para>krb5-libs (for linking with)</para></listitem>
-			<listitem><para>krb5-devel (because you are compiling from source)</para></listitem>
-		</itemizedlist>
-	</para>
-
-	<para>in addition to the standard development environment.</para>
-
-	<para>If these files are not installed on your system, you should check the installation
-	CDs to find which has them and install the files using your tool of choice. If in doubt
-	about what tool to use, refer to the Red Hat Linux documentation.</para>
-
-	</sect3>
-
-	<sect3>
-	<title>SuSE Linux Package Requirements</title>
-
-	<para>
-	SuSE Linux installs Heimdal packages that may be required to allow you to build
-	binary packages. You should verify that the development libraries have been installed on
-	your system.
-	</para>
-
-	<para>
-	SuSE Linux Samba RPMs support Kerberos. Please refer to the documentation for
-	your SuSE Linux system for information regarding SuSE Linux specific configuration.
-	Additionally, SuSE is very active in the maintenance of Samba packages that provide
-	the maximum capabilities that are available. You should consider using SuSE-provided
-	packages where they are available.
-	</para>
-
-	</sect3>
-	
-	</sect2>
-			  
-</sect1>
-
-<sect1 id="startingSamba">
-	<title>Starting the &smbd; &nmbd; and &winbindd;</title>
-
-
-	<para>
-	<indexterm><primary>inetd</primary></indexterm>
-	You must choose to start &smbd;, &winbindd;  and &nmbd; either as daemons or from
-	<application>inetd</application>. Don't try to do both!  Either you can put
-	them in <filename> inetd.conf</filename> and have them started on demand by
-	<application>inetd</application> or <application>xinetd</application>, or you
-	can start them as daemons either from the command-line or in
-	<filename>/etc/rc.local</filename>. See the man pages for details on the
-	command line options. Take particular care to read the bit about what user
-	you need to have to start Samba. In many cases, you must be root.
-	</para>
-
-	<para>
-	The main advantage of starting &smbd; and &nmbd; using the recommended daemon method
-	is that they will respond slightly more quickly to an initial connection request.
-	</para>
-
-	<sect2>
-	<title>Starting &smbd; as a Daemon</title>
-		
-	<para>
-	<indexterm><primary>daemon</primary></indexterm>
-<indexterm><primary>startsmb</primary></indexterm>
-	To start the server as a daemon, you should create a script something
-	like this one, perhaps calling it <filename>startsmb</filename>.
-	</para>
-
-<para><programlisting>
-#!/bin/sh
-/usr/local/samba/sbin/smbd -D
-/usr/local/samba/sbin/winbindd -D
-/usr/local/samba/sbin/nmbd -D
-</programlisting></para>
-
-	<para>
-	Make it executable with <command>chmod +x startsmb</command>.
-	</para>
-
-	<para>
-	You can then run <command>startsmb</command> by hand or execute
-	it from <filename>/etc/rc.local</filename>.
-	</para>
-
-	<para>
-	To kill it, send a kill signal to the processes &nmbd; and &smbd;.
-	</para>
-
-	<note><para>
-	If you use the SVR4-style init system, you may like to look at the
-	<filename>examples/svr4-startup</filename> script to make Samba fit
-	into that system.
-	</para></note>
-
-	<sect3>
-	<title>Starting Samba for Red Hat Linux</title>
-	<para>
-	The process for starting Samba will now be outlined. Be sure to configure Samba's &smb.conf;
-	file before starting Samba. When configured, start Samba by executing:
-<screen>
-&rootprompt; service smb start
-&rootprompt; service winbind start
-</screen>
-	These steps will start &nmbd;, &smbd; and &winbindd;.
-	</para>
-
-	<para>
-	To ensure that these services will be automatically restarted when the system is rebooted
-	execute:
-<screen>
-&rootprompt; chkconfig smb on
-&rootprompt; chkconfig winbind on
-</screen>
-	Samba will be started automatically at every system reboot.
-	</para>
-
-	</sect3>
-
-	<sect3>
-	<title>Starting Samba for Novell SUSE Linux</title>
-
-	<para>
-	Novell SUSE Linux products automatically install all essential Samba components in a default installation.
-	Configure your &smb.conf; file, then execute the following to start Samba:
-<screen>
-&rootprompt; rcnmb start
-&rootprompt; rcsmb start
-&rootprompt; rcwinbind start
-</screen>
-	Now execute these commands so that Samba will be started automatically following a system
-	reboot:
-<screen>
-&rootprompt; chkconfig nmb on
-&rootprompt; chkconfig smb on
-&rootprompt; chkconfig winbind on
-</screen>
-	The Samba services will now be started automatically following a system reboot.
-	</para>
-
-	</sect3>
-
-	</sect2>
-
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-ConfigSmarts.xml b/docs-xml/Samba3-HOWTO/TOSHARG-ConfigSmarts.xml
deleted file mode 100644
index f46cc8e..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-ConfigSmarts.xml
+++ /dev/null
@@ -1,392 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="cfgsmarts">
-<chapterinfo>
-	&author.jht;
-	<pubdate>June 30, 2005</pubdate>
-</chapterinfo>
-<title>Advanced Configuration Techniques</title>
-
-<para>
-<indexterm><primary>configuration techniques</primary></indexterm>
-<indexterm><primary>include</primary></indexterm>
-Since the release of the first edition of this book there have been repeated requests to better document
-configuration techniques that may help a network administrator to get more out of Samba. Some users have asked
-for documentation regarding the use of the <smbconfoption name="include">file-name</smbconfoption> parameter.
-</para>
-
-<para>
-<indexterm><primary>multiple servers</primary></indexterm>
-<indexterm><primary>multiple server personalities</primary></indexterm>
-Commencing around mid-2004 there has been increasing interest in the ability to host multiple Samba servers on
-one machine. There has also been an interest in the hosting of multiple Samba server personalities on one
-server.
-</para>
-
-<para>
-<indexterm><primary>technical reviewers</primary></indexterm>
-<indexterm><primary>reviewers</primary></indexterm>
-Feedback from technical reviewers made the inclusion of this chapter a necessity. So, here is an 
-answer the questions that have to date not been adequately addressed. Additional user input is welcome as
-it will help this chapter to mature. What is presented here is just a small beginning.
-</para>
-
-<para>
-<indexterm><primary>multiple servers</primary></indexterm>
-<indexterm><primary>multiple hosting</primary></indexterm>
-<indexterm><primary>domain controllers</primary></indexterm>
-There are a number of ways in which multiple servers can be hosted on a single Samba server. Multiple server
-hosting makes it possible to host multiple domain controllers on one machine. Each such machine is
-independent, and each can be stopped or started without affecting another.
-</para>
-
-<para>
-<indexterm><primary>multiple servers</primary></indexterm>
-<indexterm><primary>DMS</primary></indexterm>
-<indexterm><primary>anonymous server</primary></indexterm>
-Sometimes it is desirable to host multiple servers, each with its own security mode. For example, a single
-UNIX/Linux host may be a domain member server (DMS) as well as a generic anonymous print server. In this case,
-only domain member machines and domain users can access the DMS, but even guest users can access the generic
-print server. Another example of a situation where it may be beneficial to host a generic (anonymous) server
-is to host a CDROM server.
-</para>
-
-<para>
-<indexterm><primary>separate servers</primary></indexterm>
-<indexterm><primary></primary></indexterm>
-Some environments dictate the need to have separate servers, each with their own resources, each of which are
-accessible only by certain users or groups. This is one of the simple, but highly effective, ways that Samba
-can replace many physical Windows servers in one Samba installation.
-</para>
-
-<sect1>
-<title>Implementation</title>
-
-<para>
-</para>
-
-<sect2>
-<title>Multiple Server Hosting</title>
-
-<para>
-<indexterm><primary>multiple server hosting</primary></indexterm>
-<indexterm><primary>separate instances</primary></indexterm>
-<indexterm><primary>nmbd</primary></indexterm>
-<indexterm><primary>smbd</primary></indexterm>
-<indexterm><primary>winbindd</primary></indexterm>
-<indexterm><primary>recompiling</primary></indexterm>
-<indexterm><primary>TDB</primary></indexterm>
-The use of multiple server hosting involves running multiple separate instances of Samba, each with it's own
-configuration file. This method is complicated by the fact that each instance of &nmbd;, &smbd; and &winbindd;
-must have write access to entirely separate TDB files. The ability to keep separate the TDB files used by
-&nmbd;, &smbd; and &winbindd; can be enabled either by recompiling Samba for each server hosted so each has its
-own default TDB directories, or by configuring these in the &smb.conf; file, in which case each instance of
-&nmbd;, &smbd; and &winbindd; must be told to start up with its own &smb.conf; configuration file.
-</para>
-
-<para>
-<indexterm><primary>independent</primary></indexterm>
-<indexterm><primary>listen own socket</primary></indexterm>
-<indexterm><primary>socket</primary></indexterm>
-<indexterm><primary>SID</primary></indexterm>
-Each instance should operate on its own IP address (that independent IP address can be an IP Alias).
-Each instance of &nmbd;, &smbd; and &winbindd; should listen only on its own IP socket. This can be secured
-using the <smbconfoption name="socket address"/> parameter. Each instance of the Samba server will have its
-own SID also, this means that the servers are discrete and independent of each other.
-</para>
-
-<para>
-<indexterm><primary>multiple server hosting</primary></indexterm>
-<indexterm><primary>private dir</primary></indexterm>
-<indexterm><primary>pid directory</primary></indexterm>
-<indexterm><primary>lock directory</primary></indexterm>
-<indexterm><primary>interfaces</primary></indexterm>
-<indexterm><primary>bind interfaces only</primary></indexterm>
-<indexterm><primary>netbios name</primary></indexterm>
-<indexterm><primary>workgroup</primary></indexterm>
-<indexterm><primary>socket address</primary></indexterm>
-The user of multiple server hosting is non-trivial, and requires careful configuration of each aspect of
-process management and start up. The &smb.conf; parameters that must be carefully configured includes:
-<smbconfoption name="private dir"/>, <smbconfoption name="pid directory"/>,<smbconfoption name="lock
-directory"/>, <smbconfoption name="interfaces"/>, <smbconfoption name="bind interfaces only"/>, <smbconfoption
-name="netbios name"/>, <smbconfoption name="workgroup"/>, <smbconfoption name="socket address"/>.
-</para>
-
-<para>
-<indexterm><primary>multiple servers</primary></indexterm>
-<indexterm><primary>contribute</primary></indexterm>
-<indexterm><primary>comprehensive documentation</primary></indexterm>
-Those who elect to create multiple Samba servers should have the ability to read and follow
-the Samba source code, and to modify it as needed. This mode of deployment is considered beyond the scope of
-this book. However, if someone will contribute more comprehensive documentation we will gladly review it, and
-if it is suitable extend this section of this chapter. Until such documentation becomes available the hosting
-of multiple samba servers on a single host is considered not supported for Samba-3 by the Samba Team.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Multiple Virtual Server Personalities</title>
-
-<para>
-<indexterm><primary>multiple virtual servers</primary></indexterm>
-<indexterm><primary>netbios alias</primary></indexterm>
-<indexterm><primary>meta-services</primary></indexterm>
-Samba has the ability to host multiple virtual servers, each of which have their own personality.  This is
-achieved by configuring an &smb.conf; file that is common to all personalities hosted.  Each server
-personality is hosted using its own <smbconfoption name="netbios alias"/> name, and each has its own distinct
-<smbconfoption name="[global]"/> section. Each server may have its own stanzas for services and meta-services.
-</para>
-
-<para>
-<indexterm><primary>workgroup</primary></indexterm>
-<indexterm><primary>security</primary></indexterm>
-<indexterm><primary>netbios aliases</primary></indexterm>
-When hosting multiple virtual servers, each with their own personality, each can be in a different workgroup.
-Only the primary server can be a domain member or a domain controller. The personality is defined by the
-combination of the <smbconfoption name="security"/> mode it is operating in, the <smbconfoption name="netbios
-aliases"/> it has, and the <smbconfoption name="workgroup"/> that is defined for it.
-</para>
-
-<para>
-<indexterm><primary>NetBIOS name</primary></indexterm>
-<indexterm><primary>NetBIOS-less SMB</primary></indexterm>
-<indexterm><primary>smb ports</primary></indexterm>
-<indexterm><primary>TCP port 139</primary></indexterm>
-<indexterm><primary>TCP port 445</primary></indexterm>
-<indexterm><primary>%L</primary></indexterm>
-This configuration style can be used either with NetBIOS names, or using NetBIOS-less SMB over TCP services.
-If run using NetBIOS mode (the most common method) it is important that the parameter <smbconfoption name="smb
-ports">139</smbconfoption> should be specified in the primary &smb.conf; file. Failure to do this will result
-in Samba operating over TCP port 445 and problematic operation at best, and at worst only being able to obtain
-the functionality that is specified in the primary &smb.conf; file. The use of NetBIOS over TCP/IP using only
-TCP port 139 means that the use of the <literal>%L</literal> macro is fully enabled. If the <smbconfoption
-name="smb ports">139</smbconfoption> is not specified (the default is <parameter>445 139</parameter>, or if
-the value of this parameter is set at <parameter>139 445</parameter> then the <literal>%L</literal> macro
-is not serviceable.
-</para>
-
-<para>
-<indexterm><primary>host multiple servers</primary></indexterm>
-<indexterm><primary>multiple personality</primary></indexterm>
-<indexterm><primary>NetBIOS-less</primary></indexterm>
-<indexterm><primary>%i macro</primary></indexterm>
-It is possible to host multiple servers, each with their own personality, using port 445 (the NetBIOS-less SMB
-port), in which case the <literal>%i</literal> macro can be used to provide separate server identities (by
-IP Address). Each can have its own <smbconfoption name="security"/> mode. It will be necessary to use the
-<smbconfoption name="interfaces"/>, <smbconfoption name="bind interfaces only"/> and IP aliases in addition to
-the <smbconfoption name="netbios name"/> parameters to create the virtual servers. This method is considerably
-more complex than that using NetBIOS names only using TCP port 139.
-</para>
-
-<para>
-<indexterm><primary>anonymous file server</primary></indexterm>
-Consider an example environment that consists of a standalone, user-mode security Samba server and a read-only
-Windows 95 file server that has to be replaced. Instead of replacing the Windows 95 machine with a new PC, it
-is possible to add this server as a read-only anonymous file server that is hosted on the Samba server. Here
-are some parameters:
-</para>
-
-<para>
-The Samba server is called <literal>ELASTIC</literal>, its workgroup name is <literal>ROBINSNEST</literal>.
-The CDROM server is called <literal>CDSERVER</literal> and its workgroup is <literal>ARTSDEPT</literal>. A
-possible implementation is shown here:
-</para>
-
-<para>
-<indexterm><primary>/etc/samba</primary></indexterm>
-<indexterm><primary>nmbd</primary></indexterm>
-<indexterm><primary>smbd</primary></indexterm>
-<indexterm><primary>smb.conf</primary></indexterm>
-The &smb.conf; file for the master server is shown in <link linkend="elastic">Elastic smb.conf File</link>.
-This file is placed in the <filename>/etc/samba</filename> directory. Only the &nmbd; and the &smbd; daemons
-are needed. When started the server will appear in Windows Network Neighborhood as the machine
-<literal>ELASTIC</literal> under the workgroup <literal>ROBINSNEST</literal>. It is helpful if the Windows
-clients that must access this server are also in the workgroup <literal>ROBINSNEST</literal> as this will make
-browsing much more reliable.
-</para>
-
-<example id="elastic">
-<title>Elastic smb.conf File</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">ROBINSNEST</smbconfoption>
-<smbconfoption name="netbios name">ELASTIC</smbconfoption>
-<smbconfoption name="netbios aliases">CDSERVER</smbconfoption>
-<smbconfoption name="smb ports">139</smbconfoption>
-<smbconfoption name="printcap name">cups</smbconfoption>
-<smbconfoption name="disable spoolss">Yes</smbconfoption>
-<smbconfoption name="show add printer wizard">No</smbconfoption>
-<smbconfoption name="printing">cups</smbconfoption>
-<smbconfoption name="include">/etc/samba/smb-%L.conf</smbconfoption>
-
-<smbconfsection name="[homes]"/>
-<smbconfoption name="comment">Home Directories</smbconfoption>
-<smbconfoption name="valid users">%S</smbconfoption>
-<smbconfoption name="read only">No</smbconfoption>
-<smbconfoption name="browseable">No</smbconfoption>
-
-<smbconfsection name="[office]"/>
-<smbconfoption name="comment">Data</smbconfoption>
-<smbconfoption name="path">/data</smbconfoption>
-<smbconfoption name="read only">No</smbconfoption>
-
-<smbconfsection name="[printers]"/>
-<smbconfoption name="comment">All Printers</smbconfoption>
-<smbconfoption name="path">/var/spool/samba</smbconfoption>
-<smbconfoption name="create mask">0600</smbconfoption>
-<smbconfoption name="guest ok">Yes</smbconfoption>
-<smbconfoption name="printable">Yes</smbconfoption>
-<smbconfoption name="use client driver">Yes</smbconfoption>
-<smbconfoption name="browseable">No</smbconfoption>
-</smbconfblock>
-</example>
-
-<para>
-<indexterm><primary>smb-cdserver.conf</primary></indexterm>
-The configuration file for the CDROM server is listed in <link linkend="cdserver">CDROM Server
-smb-cdserver.conf file</link>. This file is called <filename>smb-cdserver.conf</filename> and it should be
-located in the <filename>/etc/samba</filename> directory. Machines that are in the workgroup
-<literal>ARTSDEPT</literal> will be able to browse this server freely.
-</para>
-
-<example id="cdserver">
-<title>CDROM Server smb-cdserver.conf file</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">ARTSDEPT</smbconfoption>
-<smbconfoption name="netbios name">CDSERVER</smbconfoption>
-<smbconfoption name="map to guest">Bad User</smbconfoption>
-<smbconfoption name="guest ok">Yes</smbconfoption>
-
-<smbconfsection name="[carousel]"/>
-<smbconfoption name="comment">CDROM Share</smbconfoption>
-<smbconfoption name="path">/export/cddata</smbconfoption>
-<smbconfoption name="read only">Yes</smbconfoption>
-<smbconfoption name="guest ok">Yes</smbconfoption>
-</smbconfblock>
-</example>
-
-<para>
-<indexterm><primary>different resources</primary></indexterm>
-<indexterm><primary>separate workgroups</primary></indexterm>
-<indexterm><primary>read-only access</primary></indexterm>
-<indexterm><primary>nobody account</primary></indexterm>
-The two servers have different resources and are in separate workgroups. The server <literal>ELASTIC</literal>
-can only be accessed by uses who have an appropriate account on the host server. All users will be able to
-access the CDROM data that is stored in the <filename>/export/cddata</filename> directory. File system
-permissions should set so that the <literal>others</literal> user has read-only access to the directory and its
-contents. The files can be owned by root (any user other than the nobody account).
-</para>
-
-</sect2>
-
-<sect2>
-<title>Multiple Virtual Server Hosting</title>
-
-<para>
-<indexterm><primary>primary domain controller</primary></indexterm>
-<indexterm><primary>extra machine</primary></indexterm>
-<indexterm><primary>same domain/workgroup</primary></indexterm>
-In this example, the requirement is for a primary domain controller for the domain called
-<literal>MIDEARTH</literal>. The PDC will be called <literal>MERLIN</literal>. An extra machine called
-<literal>SAURON</literal> is required. Each machine will have only its own shares. Both machines belong to the
-same domain/workgroup.
-</para>
-
-<para>
-<indexterm><primary>master smb.conf</primary></indexterm>
-<indexterm><primary>/etc/samba</primary></indexterm>
-<indexterm><primary></primary></indexterm>
-The master &smb.conf; file is shown in <link linkend="mastersmbc">the Master smb.conf File Global Section</link>.
-The two files that specify the share information for each server are shown in <link linkend="merlinsmbc">the
-smb-merlin.conf File Share Section</link>, and <link linkend="sauronsmbc">the smb-sauron.conf File Share
-Section</link>. All three files are locate in the <filename>/etc/samba</filename> directory.
-</para>
-
-<example id="mastersmbc">
-<title>Master smb.conf File Global Section</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
-<smbconfoption name="netbios name">MERLIN</smbconfoption>
-<smbconfoption name="netbios aliases">SAURON</smbconfoption>
-<smbconfoption name="passdb backend">tdbsam</smbconfoption>
-<smbconfoption name="smb ports">139</smbconfoption>
-<smbconfoption name="syslog">0</smbconfoption>
-<smbconfoption name="printcap name">CUPS</smbconfoption>
-<smbconfoption name="show add printer wizard">No</smbconfoption>
-<smbconfoption name="add user script">/usr/sbin/useradd -m '%u'</smbconfoption>
-<smbconfoption name="delete user script">/usr/sbin/userdel -r '%u'</smbconfoption>
-<smbconfoption name="add group script">/usr/sbin/groupadd '%g'</smbconfoption>
-<smbconfoption name="delete group script">/usr/sbin/groupdel '%g'</smbconfoption>
-<smbconfoption name="add user to group script">/usr/sbin/usermod -G '%g' '%u'</smbconfoption>
-<smbconfoption name="add machine script">/usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</smbconfoption>
-<smbconfoption name="logon script">scripts\login.bat</smbconfoption>
-<smbconfoption name="logon path"> </smbconfoption>
-<smbconfoption name="logon drive">X:</smbconfoption>
-<smbconfoption name="domain logons">Yes</smbconfoption>
-<smbconfoption name="preferred master">Yes</smbconfoption>
-<smbconfoption name="wins support">Yes</smbconfoption>
-<smbconfoption name="printing">CUPS</smbconfoption>
-<smbconfoption name="include">/etc/samba/smb-%L.conf</smbconfoption>
-</smbconfblock>
-</example>
-
-<example id="merlinsmbc">
-<title>MERLIN smb-merlin.conf File Share Section</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
-<smbconfoption name="netbios name">MERLIN</smbconfoption>
-
-<smbconfsection name="[homes]"/>
-<smbconfoption name="comment">Home Directories</smbconfoption>
-<smbconfoption name="valid users">%S</smbconfoption>
-<smbconfoption name="read only">No</smbconfoption>
-<smbconfoption name="browseable">No</smbconfoption>
-
-<smbconfsection name="[office]"/>
-<smbconfoption name="comment">Data</smbconfoption>
-<smbconfoption name="path">/data</smbconfoption>
-<smbconfoption name="read only">No</smbconfoption>
-
-<smbconfsection name="[netlogon]"/>
-<smbconfoption name="comment">NETLOGON</smbconfoption>
-<smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption>
-<smbconfoption name="read only">Yes</smbconfoption>
-<smbconfoption name="browseable">No</smbconfoption>
-
-<smbconfsection name="[printers]"/>
-<smbconfoption name="comment">All Printers</smbconfoption>
-<smbconfoption name="path">/var/spool/samba</smbconfoption>
-<smbconfoption name="printable">Yes</smbconfoption>
-<smbconfoption name="use client driver">Yes</smbconfoption>
-<smbconfoption name="browseable">No</smbconfoption>
-</smbconfblock>
-</example>
-
-<example id="sauronsmbc">
-<title>SAURON smb-sauron.conf File Share Section</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
-<smbconfoption name="netbios name">SAURON</smbconfoption>
-
-<smbconfsection name="[www]"/>
-<smbconfoption name="comment">Web Pages</smbconfoption>
-<smbconfoption name="path">/srv/www/htdocs</smbconfoption>
-<smbconfoption name="read only">No</smbconfoption>
-</smbconfblock>
-</example>
-
-</sect2>
-
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-DNS-DHCP-Configuration.xml b/docs-xml/Samba3-HOWTO/TOSHARG-DNS-DHCP-Configuration.xml
deleted file mode 100644
index f64a677..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-DNS-DHCP-Configuration.xml
+++ /dev/null
@@ -1,346 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="DNSDHCP">
-<chapterinfo>
-	&author.jht;
-</chapterinfo>
-
-<title>DNS and DHCP Configuration Guide</title>
-
-<sect1>
-<title>Features and Benefits</title>
-
-<para>
-<indexterm><primary>Dynamic Host Configuration Protocol</primary><see>DHCP</see></indexterm>
-<indexterm><primary>Domain Name System</primary><see>DNS</see></indexterm>
-There are few subjects in the UNIX world that might raise as much contention as
-Domain Name System (DNS) and Dynamic Host Configuration Protocol (DHCP).
-Not all opinions held for or against particular implementations of DNS and DHCP
-are valid.
-</para>
-
-<para>
-We live in a modern age where many information technology users demand mobility
-and freedom. Microsoft Windows users in particular expect to be able to plug their
-notebook computer into a network port and have things <quote>just work.</quote>
-</para>
-
-<para>
-<indexterm><primary>ADS</primary></indexterm>
-UNIX administrators have a point. Many of the normative practices in the Microsoft
-Windows world at best border on bad practice from a security perspective.
-Microsoft Windows networking protocols allow workstations to arbitrarily register
-themselves on a network. Windows 2000 Active Directory registers entries in the DNS namespace
-that are equally perplexing to UNIX administrators. Welcome to the new world!
-</para>
-
-
-<para>
-<indexterm><primary>ISC</primary><secondary>DNS</secondary></indexterm>
-<indexterm><primary>ISC</primary><secondary>DHCP</secondary></indexterm>
-<indexterm><primary>Dynamic DNS</primary><see>DDNS</see></indexterm>
-The purpose of this chapter is to demonstrate the configuration of the Internet
-Software Consortium (ISC) DNS and DHCP servers to provide dynamic services that are
-compatible with their equivalents in the Microsoft Windows 2000 Server products.
-</para>
-
-<para>
-This chapter provides no more than a working example of configuration files for both DNS and DHCP servers. The
-examples used match configuration examples used elsewhere in this document.
-</para>
-
-<para>
-<indexterm><primary>DNS</primary></indexterm>
-<indexterm><primary>DHCP</primary></indexterm>
-<indexterm><primary>BIND9.NET</primary></indexterm>
-This chapter explicitly does not provide a tutorial, nor does it pretend to be a reference guide on DNS and
-DHCP, as this is well beyond the scope and intent of this document as a whole. Anyone who wants more detailed
-reference materials on DNS or DHCP should visit the ISC Web site at <ulink noescape="1"
-url="http://www.isc.org"> http://www.isc.org</ulink>.  Those wanting a written text might also be interested
-in the O'Reilly publications on DNS, see the <ulink
-url="http://www.oreilly.com/catalog/dns/index.htm">O'Reilly</ulink> web site, and the <ulink
-url="http://www.bind9.net/books-dhcp">BIND9.NET</ulink> web site for details.
-The books are:
-</para>
-
-<orderedlist>
-	<listitem><para>DNS and BIND, By Cricket Liu, Paul Albitz, ISBN: 1-56592-010-4</para></listitem>
-	<listitem><para>DNS & Bind Cookbook, By Cricket Liu, ISBN: 0-596-00410-9</para></listitem>
-	<listitem><para>The DHCP Handbook (2nd Edition), By: Ralph Droms, Ted Lemon, ISBN 0-672-32327-3</para></listitem>
-</orderedlist>
-
-</sect1>
-
-<sect1>
-<title>Example Configuration</title>
-
-<para>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>DNS</primary></indexterm>
-The DNS is to the Internet what water is to life. Nearly all information resources (host names) are resolved
-to their Internet protocol (IP) addresses through DNS.  Windows networking tried hard to avoid the
-complexities of DNS, but alas, DNS won.  <indexterm><primary>WINS</primary></indexterm> The alternative to
-DNS, the Windows Internet Name Service (WINS) &smbmdash; an artifact of NetBIOS networking over the TCP/IP
-protocols &smbmdash; has demonstrated scalability problems as well as a flat, nonhierarchical namespace that
-became unmanageable as the size and complexity of information technology networks grew.
-</para>
-
-<para>
-<indexterm><primary>RFC 1001</primary></indexterm>
-<indexterm><primary>RFC 1002</primary></indexterm>
-WINS is a Microsoft implementation of the RFC1001/1002 NetBIOS Name Service (NBNS).
-It allows NetBIOS clients (like Microsoft Windows machines) to register an arbitrary
-machine name that the administrator or user has chosen together with the IP
-address that the machine has been given. Through the use of WINS, network client machines
-could resolve machine names to their IP address.
-</para>
-
-<para>
-The demand for an alternative to the limitations of NetBIOS networking finally drove
-Microsoft to use DNS and Active Directory. Microsoft's new implementation attempts
-to use DNS in a manner similar to the way that WINS is used for NetBIOS networking.
-Both WINS and Microsoft DNS rely on dynamic name registration.
-</para> 
-
-<para>
-Microsoft Windows clients can perform dynamic name registration to the DNS server
-on startup. Alternatively, where DHCP is used to assign workstation IP addresses,
-it is possible to register hostnames and their IP address by the DHCP server as
-soon as a client acknowledges an IP address lease. Finally, Microsoft DNS can resolve
-hostnames via Microsoft WINS.
-</para>
-
-<para>
-The following configurations demonstrate a simple, insecure dynamic DNS server and
-a simple DHCP server that matches the DNS configuration.
-</para>
-
-	<sect2>
-	<title>Dynamic DNS</title>
-
-	<para>
-	<indexterm><primary>DNS</primary><secondary>Dynamic</secondary></indexterm>
-	The example DNS configuration is for a private network in the IP address
-	space for network 192.168.1.0/24. The private class network address space
-	is set forth in RFC1918.
-	</para>
-
-
-	<para>
-	<indexterm><primary>BIND</primary></indexterm>
-	It is assumed that this network will be situated behind a secure firewall.
-	The files that follow work with ISC BIND version 9. BIND is the Berkeley
-	Internet Name Daemon.
-	</para>
-
-	<para>
-	The master configuration file <filename>/etc/named.conf</filename>
-	determines the location of all further configuration files used.
-	The location and name of this file is specified in the startup script
-	that is part of the operating system.
-<programlisting>
-# Quenya.Org configuration file
-
-acl mynet {
-	192.168.1.0/24;
-	127.0.0.1;
-};
-
-options {
-
-	directory "/var/named";
-	listen-on-v6 { any; };
-	notify no;
-	forward first;
-	forwarders {
-		192.168.1.1;
-		};
-	auth-nxdomain yes;
-	multiple-cnames yes;
-	listen-on {
-		mynet;
-		};
-};
-
-# The following three zone definitions do not need any modification.
-# The first one defines localhost while the second defines the
-# reverse lookup for localhost. The last zone "." is the
-# definition of the root name servers.
-
-zone "localhost" in {
-	type master;
-	file "localhost.zone";
-};
-
-zone "0.0.127.in-addr.arpa" in {
-	type master;
-	file "127.0.0.zone";
-};
-
-zone "." in {
-	type hint;
-	file "root.hint";
-};
-
-# You can insert further zone records for your own domains below.
-
-zone "quenya.org" {
-	type master;
-	file "/var/named/quenya.org.hosts";
-	allow-query {
-		mynet;
-		};
-	allow-transfer {
-		mynet;
-		};
-	allow-update {
-		mynet;
-		};
-	};
-
-zone "1.168.192.in-addr.arpa" {
-	type master;
-	file "/var/named/192.168.1.0.rev";
-	allow-query {
-		mynet;
-	};
-	allow-transfer {
-		mynet;
-	};
-	allow-update {
-		mynet;
-	};
-};
-</programlisting>
-	</para>
-
-	<para>
-	The following files are all located in the directory <filename>/var/named</filename>.
-	This is the <filename>/var/named/localhost.zone</filename> file:
-<programlisting>
-$TTL 1W
-@               IN SOA  @   root (
-				42              ; serial (d. adams)
-				2D              ; refresh
-				4H              ; retry
-				6W              ; expiry
-				1W )            ; minimum
-
-		IN NS           @
-		IN A            127.0.0.1
-	</programlisting>
-	</para>
-
-	<para>
-	The <filename>/var/named/127.0.0.zone</filename> file:
-<programlisting>
-$TTL 1W
-@               IN SOA          localhost.  root.localhost. (
-				42              ; serial (d. adams)
-				2D              ; refresh
-				4H              ; retry
-				6W              ; expiry
-				1W )            ; minimum
-
-				IN NS           localhost.
-1               IN PTR          localhost.
-</programlisting>
-	</para>
-
-	<para>
-		The <filename>/var/named/quenya.org.host</filename> file:
-<programlisting>
-$ORIGIN .
-$TTL 38400      ; 10 hours 40 minutes
-quenya.org      IN SOA  marvel.quenya.org. root.quenya.org. (
-				2003021832 ; serial
-				10800      ; refresh (3 hours)
-				3600       ; retry (1 hour)
-				604800     ; expire (1 week)
-				38400      ; minimum (10 hours 40 minutes)
-				)
-			NS      marvel.quenya.org.
-			MX      10 mail.quenya.org.
-$ORIGIN quenya.org.
-frodo                   A       192.168.1.1
-marvel                  A       192.168.1.2
-;
-mail                    CNAME   marvel
-www                     CNAME   marvel
-</programlisting>
-</para>
-
-<para>
-	The <filename>/var/named/192.168.1.0.rev</filename> file:
-<programlisting>
-$ORIGIN .
-$TTL 38400      ; 10 hours 40 minutes
-1.168.192.in-addr.arpa  IN SOA  marvel.quenya.org. root.quenya.org. (
-				2003021824 ; serial
-				10800      ; refresh (3 hours)
-				3600       ; retry (1 hour)
-				604800     ; expire (1 week)
-				38400      ; minimum (10 hours 40 minutes)
-				)
-			NS      marvel.quenya.org.
-$ORIGIN 1.168.192.in-addr.arpa.
-1                       PTR     frodo.quenya.org.
-2                       PTR     marvel.quenya.org.
-</programlisting>
-	</para>
-
-	<para>
-<indexterm><primary>BIND</primary></indexterm>
-<indexterm><primary>dynamic registration files</primary></indexterm>
-	The configuration files shown here were copied from a fully working system. All dynamically registered
-	entries have been removed. In addition to these files, BIND version 9 will
-	create for each of the dynamic registration files a file that has a 
-	<filename>.jnl</filename> extension. Do not edit or tamper with the configuration
-	files or with the <filename>.jnl</filename> files that are created.
-	</para>
-
-	</sect2>
-
-	<sect2 id="DHCP">
-	<title>DHCP Server</title>
-
-	<para>
-	The following file is used with the ISC DHCP Server version 3.
-	The file is located in <filename>/etc/dhcpd.conf</filename>:
-	</para>
-
-	<para>
-	<programlisting>
-ddns-updates on;
-ddns-domainname "quenya.org";
-option ntp-servers 192.168.1.2;
-ddns-update-style ad-hoc;
-allow unknown-clients;
-default-lease-time 86400;
-max-lease-time 172800;
-
-option domain-name "quenya.org";
-option domain-name-servers 192.168.1.2;
-option netbios-name-servers 192.168.1.2;
-option netbios-dd-server 192.168.1.2;
-option netbios-node-type 8;
-
-subnet 192.168.1.0 netmask 255.255.255.0 {
-	range dynamic-bootp 192.168.1.60 192.168.1.254;
-	option subnet-mask 255.255.255.0;
-	option routers 192.168.1.2;
-	allow unknown-clients;
-}
-</programlisting>
-	</para>
-
-	<para>
-	In this example, IP addresses between 192.168.1.1 and 192.168.1.59 are
-	reserved for fixed-address (commonly called <constant>hard-wired</constant>) IP addresses. The
-	addresses between 192.168.1.60 and 192.168.1.254 are allocated for dynamic use.
-	</para>
-
-	</sect2>
-
-</sect1>
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-Diagnosis.xml b/docs-xml/Samba3-HOWTO/TOSHARG-Diagnosis.xml
deleted file mode 100644
index 657cc97..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-Diagnosis.xml
+++ /dev/null
@@ -1,585 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="diagnosis">
-<chapterinfo>
-	&author.tridge;
-	&author.jelmer;
-	&author.danshearer;
-	<pubdate>Wed Jan 15</pubdate>
-</chapterinfo>
-
-<title>The Samba Checklist</title>
-
-<sect1>
-<title>Introduction</title>
-
-<para>
-<indexterm><primary>validate</primary></indexterm>
-This file contains a list of tests you can perform to validate your
-Samba server. It also tells you what the likely cause of the problem
-is if it fails any one of these steps. If it passes all these tests,
-then it is probably working fine.
-</para>
-
-<para>
-You should do all the tests in the order shown. We have tried to
-carefully choose them so later tests only use capabilities verified in
-the earlier tests. However, do not stop at the first error: there
-have been some instances when continuing with the tests has helped
-to solve a problem.
-</para>
-
-<para>
-If you send one of the Samba mailing lists  an email saying, <quote>It does not work,</quote>
-and you have not followed this test procedure, you should not be surprised
-if your email is ignored.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Assumptions</title>
-
-<para>
-In all of the tests, it is assumed you have a Samba server called 
-BIGSERVER and a PC called ACLIENT, both in workgroup TESTGROUP.
-</para>
-
-<para>
-The procedure is similar for other types of clients.
-</para>
-
-<para>
-It is also assumed you know the name of an available share in your
-&smb.conf;. I for our examples this share is called <smbconfsection name="tmp"/>.
-You can add a <smbconfsection name="tmp"/> share like this by adding the
-lines shown in <link linkend="tmpshare">the next example</link>.
-</para>
-
-<example id="tmpshare">
-<title>smb.conf with [tmp] Share</title>
-<smbconfblock>
-<smbconfsection name="[tmp]"/>
-<smbconfoption name="comment">temporary files </smbconfoption>
-<smbconfoption name="path">/tmp</smbconfoption>
-<smbconfoption name="read only">yes</smbconfoption>
-</smbconfblock>
-</example>
-
-<note><para>
-These tests assume version 3.0.0 or later of the Samba suite.
-Some commands shown did not exist in earlier versions. 
-</para></note>
-
-<para>
-<indexterm><primary>error messages</primary></indexterm>
-<indexterm><primary>name resolution</primary></indexterm>
-<indexterm><primary>/etc/resolv.conf</primary></indexterm>
-Please pay attention to the error messages you receive. If any error message
-reports that your server is being unfriendly, you should first check that your
-IP name resolution is correctly set up. Make sure your <filename>/etc/resolv.conf</filename>
-file points to name servers that really do exist.
-</para>
-
-<para>
-<indexterm><primary>DNS server access</primary></indexterm>
-<indexterm><primary>name resolution</primary></indexterm>
-<indexterm><primary>dns proxy</primary></indexterm>
-<indexterm><primary>testparm</primary></indexterm>
-Also, if you do not have DNS server access for name resolution, please check
-that the settings for your &smb.conf; file results in <parameter>dns proxy = no</parameter>. The
-best way to check this is with <command>testparm smb.conf</command>.
-</para>
-
-
-<para>
-<indexterm><primary>log files</primary></indexterm>
-<indexterm><primary>tail</primary></indexterm>
-<indexterm><primary>/usr/local/samba/var</primary></indexterm>
-<indexterm><primary>/var/log/samba</primary></indexterm>
-<indexterm><primary>log files</primary><secondary>monitoring</secondary></indexterm>
-It is helpful to monitor the log files during testing by using the
-<command>tail -F log_file_name</command> in a separate
-terminal console (use ctrl-alt-F1 through F6 or multiple terminals in X). 
-Relevant log files can be found (for default installations) in
-<filename>/usr/local/samba/var</filename>. Also, connection logs from
-machines can be found here or possibly in <filename>/var/log/samba</filename>,
-depending on how or if you specified logging in your &smb.conf; file.
-</para>
-
-<para>
-If you make changes to your &smb.conf; file while going through these test,
-remember to restart &smbd; and &nmbd;.
-</para>
-
-</sect1>
-
-<sect1>
-<title>The Tests</title>
-<procedure>
-<title>Diagnosing Your Samba Server</title>
-
-
-<step performance="required">
-<para>
-<indexterm><primary>testparm</primary></indexterm>
-In the directory in which you store your &smb.conf; file, run the command
-<command>testparm smb.conf</command>. If it reports any errors, then your &smb.conf;
-configuration file is faulty.
-</para>
-
-<note><para>
-<indexterm><primary>/etc/samba</primary></indexterm>
-<indexterm><primary>/usr/local/samba/etc</primary></indexterm>
-Your &smb.conf; file may be located in <filename>/etc/samba</filename>
-or in <filename>/usr/local/samba/etc</filename>.
-</para></note>
-</step>
-
-<step performance="required">
-<para>
-<indexterm><primary>ping</primary></indexterm>
-Run the command <command>ping BIGSERVER</command> from the PC and
-<command>ping ACLIENT</command> from the UNIX box. If you do not get a valid response,
-then your TCP/IP software is not correctly installed. 
-</para>
-
-<para>
-You will need to start a <quote>DOS prompt</quote> window on the PC to run ping.
-</para>
-
-<para>
-<indexterm><primary>/etc/hosts</primary></indexterm>
-<indexterm><primary>DNS</primary></indexterm>
-<indexterm><primary>/etc/resolv.conf</primary></indexterm>
-If you get a message saying <quote><errorname>host not found</errorname></quote> or a similar message, then
-your DNS software or <filename>/etc/hosts</filename> file is not correctly set up.  If using DNS, check that
-the <filename>/etc/resolv.conf</filename> has correct, current, entries in it. It is possible to run
-Samba without DNS entries for the server and client, but it is assumed you do have correct entries for the
-remainder of these tests.
-</para>
-
-<para>
-<indexterm><primary>firewall</primary></indexterm>
-<indexterm><primary>iptables</primary></indexterm>
-<indexterm><primary>ipchains</primary></indexterm>
-Another reason why ping might fail is if your host is running firewall 
-software. You will need to relax the rules to let in the workstation
-in question, perhaps by allowing access from another subnet (on Linux
-this is done via the appropriate firewall maintenance commands <command>ipchains</command>
-or <command>iptables</command>).
-</para>
-
-<note>
-<para>
-Modern Linux distributions install ipchains/iptables by default. 
-This is a common problem that is often overlooked.
-</para>
-</note>
-
-<para>
-<indexterm><primary>iptables</primary></indexterm>
-<indexterm><primary>ipchains</primary></indexterm>
-If you wish to check what firewall rules may be present in a system under test, simply run
-<command>iptables -L -v</command>, or if <parameter>ipchains</parameter>-based firewall rules are in use,
-<command>ipchains -L -v</command>.
-</para>
-
-<para>
-Here is a sample listing from a system that has an external Ethernet interface (eth1) on which Samba
-is not active and an internal (private network) interface (eth0) on which Samba is active:
-<screen>
-frodo:~ # iptables -L -v
-Chain INPUT (policy DROP 98496 packets, 12M bytes)
- pkts bytes target     prot opt in     out     source     destination
- 187K  109M ACCEPT     all  --  lo     any     anywhere   anywhere
- 892K  125M ACCEPT     all  --  eth0   any     anywhere   anywhere
-1399K 1380M ACCEPT     all  --  eth1   any     anywhere   anywhere  \
-					state RELATED,ESTABLISHED
-
-Chain FORWARD (policy DROP 0 packets, 0 bytes)
- pkts bytes target     prot opt in     out     source     destination
- 978K 1177M ACCEPT     all  --  eth1   eth0    anywhere   anywhere \
-					state RELATED,ESTABLISHED
- 658K   40M ACCEPT     all  --  eth0   eth1    anywhere   anywhere
-    0     0 LOG        all  --  any    any     anywhere   anywhere \
-					LOG level warning
-
-Chain OUTPUT (policy ACCEPT 2875K packets, 1508M bytes)
- pkts bytes target     prot opt in     out     source     destination
-
-Chain reject_func (0 references)
- pkts bytes target     prot opt in     out     source     destination
-</screen>
-</para>
-
-</step>
-
-<step performance="required">
-<para>
-Run the command <command>smbclient -L BIGSERVER</command>
-on the UNIX box. You should get back a list of available shares. 
-</para>
-
-<para>
-<indexterm><primary>bad password</primary></indexterm>
-<indexterm><primary>hosts allow</primary></indexterm>
-<indexterm><primary>hosts deny</primary></indexterm>
-<indexterm><primary>valid users</primary></indexterm>
-<indexterm><primary>guest account</primary></indexterm>
-<indexterm><primary>invalid users</primary></indexterm>
-If you get an error message containing the string <quote>bad password</quote>, then
-you probably have either an incorrect <parameter>hosts allow</parameter>, 
-<parameter>hosts deny</parameter>, or <parameter>valid users</parameter> line in your 
-&smb.conf;, or your guest account is not valid. Check what your guest account is using &testparm; and
-temporarily remove any <parameter>hosts allow</parameter>, <parameter>hosts deny</parameter>,
-<parameter>valid users</parameter>, or <parameter>invalid users</parameter> lines.
-</para>
-
-<para>
-<indexterm><primary>inetd.conf</primary></indexterm>
-If you get a message <literal>connection refused</literal> response, then the <command>smbd</command> server may
-not be running. If you installed it in <filename>inetd.conf</filename>, then you probably edited
-that file incorrectly. If you installed it as a daemon, then check that
-it is running and check that the netbios-ssn port is in a LISTEN
-state using <command>netstat -a</command>.
-</para>
-
-<note><para>
-<indexterm><primary>inetd</primary></indexterm>
-<indexterm><primary>xinetd</primary><see>inetd</see></indexterm>
-Some UNIX/Linux systems use <command>xinetd</command> in place of
-<command>inetd</command>. Check your system documentation for the location
-of the control files for your particular system implementation of
-the network super daemon.
-</para></note>
-
-<para>
-If you get a message saying <literal>session request failed,</literal> the server refused the
-connection. If it says <quote>Your server software is being unfriendly,</quote> then
-it's probably because you have invalid command line parameters to &smbd;,
-or a similar fatal problem with the initial startup of &smbd;. Also
-check your config file (&smb.conf;) for syntax errors with &testparm;
-and that the various directories where Samba keeps its log and lock
-files exist.
-</para>
-
-<para>
-There are a number of reasons for which smbd may refuse or decline
-a session request. The most common of these involve one or more of
-the &smb.conf; file entries as shown in <link linkend="modif1">the next example</link>.
-</para>
-
-
-<example id="modif1">
-<title>Configuration for Allowing Connections Only from a Certain Subnet</title>
-<smbconfblock>
-<smbconfsection name="[globals]"/>
-<smbconfoption name="hosts deny">ALL</smbconfoption>
-<smbconfoption name="hosts allow">xxx.xxx.xxx.xxx/yy</smbconfoption>
-<smbconfoption name="interfaces">eth0</smbconfoption>
-<smbconfoption name="bind interfaces only">Yes</smbconfoption>
-</smbconfblock>
-</example>
-
-<para>
-<indexterm><primary>loopback adapter</primary></indexterm>
-In <link linkend="modif1">Configuration for Allowing Connections Only from a Certain Subnet</link>, no
-allowance has been made for any session requests that will automatically translate to the loopback adapter
-address 127.0.0.1.  To solve this problem, change these lines as shown in <link linkend="modif2">the following
-example</link>.
-</para>
-
-<example id="modif2">
-<title>Configuration for Allowing Connections from a Certain Subnet and localhost</title>
-<smbconfblock>
-<smbconfsection name="[globals]"/>
-<smbconfoption name="hosts deny">ALL</smbconfoption>
-<smbconfoption name="hosts allow">xxx.xxx.xxx.xxx/yy 127.</smbconfoption>
-<smbconfoption name="interfaces">eth0 lo</smbconfoption>
-</smbconfblock>
-</example>
-
-<para>
-<indexterm><primary>inetd</primary></indexterm>
-<indexterm><primary>smbclient</primary></indexterm>
-Another common cause of these two errors is having something already running on port <constant>139</constant>,
-such as Samba (&smbd; is running from <application>inetd</application> already) or Digital's Pathworks. Check
-your <filename>inetd.conf</filename> file before trying to start &smbd; as a daemon &smbmdash; it can avoid a
-lot of frustration!
-</para>
-
-<para>
-<indexterm><primary>subnet mask</primary></indexterm>
-<indexterm><primary>broadcast address</primary></indexterm>
-<indexterm><primary>log.nmbd</primary></indexterm>
-<indexterm><primary>network interface</primary></indexterm>
-<indexterm><primary>IP address</primary></indexterm>
-And yet another possible cause for failure of this test is when the subnet mask and/or broadcast address
-settings are incorrect. Please check that the network interface IP address/broadcast address/subnet mask
-settings are correct and that Samba has correctly noted these in the <filename>log.nmbd</filename> file.
-</para>
-
-</step>
-
-<step performance="required">
-
-<para>
-<indexterm><primary>nmblookup</primary></indexterm>
-Run the command <command>nmblookup -B BIGSERVER __SAMBA__</command>.
-You should get back the IP address of your Samba server.
-</para>
-
-<para>
-<indexterm><primary>inetd.conf</primary></indexterm>
-<indexterm><primary>nmbd</primary></indexterm>
-<indexterm><primary>port 137</primary></indexterm>
-If you do not, then &nmbd; is incorrectly installed. Check your <filename>inetd.conf</filename>
-if you run it from there, or that the daemon is running and listening to UDP port 137.
-</para>
-
-<para>
-One common problem is that many inetd implementations can't take many
-parameters on the command line. If this is the case, then create a
-one-line script that contains the right parameters and run that from
-inetd.
-</para>
-
-</step>
-
-<step performance="required">
-
-<para>
-<indexterm><primary>nmblookup</primary></indexterm>
-Run the command <command>nmblookup -B ACLIENT `*'</command>.
-</para>
-
-<para>
-You should get the PC's IP address back. If you do not, then the client
-software on the PC isn't installed correctly, or isn't started, or you
-got the name of the PC wrong. 
-</para>
-
-<para>
-If ACLIENT does not resolve via DNS, then use the IP address of the
-client in the above test.
-</para>
-
-</step>
-
-<step performance="required">
-
-<para>
-Run the command <command>nmblookup -d 2 `*'</command>.
-</para>
-
-<para>
-This time we are trying the same as the previous test but are trying
-it via a broadcast to the default broadcast address. A number of
-NetBIOS/TCP/IP hosts on the network should respond, although Samba may
-not catch all of the responses in the short time it listens. You
-should see the <literal>got a positive name query response</literal>
-messages from several hosts.
-</para>
-
-<para>
-<indexterm><primary>nmblookup</primary></indexterm>
-If this does not give a result similar to the previous test, then nmblookup isn't correctly getting your
-broadcast address through its automatic mechanism. In this case you should experiment with the <smbconfoption
-name="interfaces"/> option in &smb.conf; to manually configure your IP address, broadcast, and netmask.
-</para>
-
-<para>
-If your PC and server aren't on the same subnet, then you will need to use the
-<option>-B</option> option to set the broadcast address to that of the PC's subnet.
-</para>
-
-<para>
-This test will probably fail if your subnet mask and broadcast address are
-not correct. (Refer to test 3 notes above).
-</para>
-
-</step>
-
-<step performance="required">
-
-
-<para>
-<indexterm><primary>smbclient</primary></indexterm>
-Run the command <command>smbclient //BIGSERVER/TMP</command>. You should 
-then be prompted for a password. You should use the password of the account
-with which you are logged into the UNIX box. If you want to test with
-another account, then add the <option>-U accountname</option> option to the end of
-the command line &smbmdash; for example, <command>smbclient //bigserver/tmp -Ujohndoe</command>.
-</para>
-
-<note><para>
-It is possible to specify the password along with the username as follows:
-<command>smbclient //bigserver/tmp -Ujohndoe%secret</command>.
-</para></note>
-
-<para>
-Once you enter the password, you should get the <prompt>smb></prompt> prompt. If you
-do not, then look at the error message. If it says <quote><errorname>invalid network
-name,</errorname></quote> then the service <smbconfsection name="tmp"/> is not correctly set up in your &smb.conf;.
-</para>
-
-<para>
-If it says <quote><errorname>bad password,</errorname></quote> then the likely causes are:
-</para>
-
-<orderedlist>
-<listitem>
-	<para>
-	Password encryption is enabled by default, but you have not
-	yet set a password for your samba user. Run
-	<command>smbpasswd -a username</command>
-	</para>
-</listitem>
-
-<listitem>
-	<para>
-	Your <smbconfoption name="valid users"/> configuration is incorrect.
-	</para>
-</listitem>
-
-<listitem>
-	<para>
-	You have explicitly disabled encrypted passwords with
-	<smbconfoption name="encrypt passwords">no</smbconfoption> have a mixed-case password.
-	</para>
-</listitem>
-
-<listitem>
-	<para>
-	The <smbconfoption name="path"/> line in &smb.conf; is incorrect. Check it with &testparm;.
-	</para>
-</listitem>
-
-</orderedlist>
-
-<para>
-<indexterm><primary>dir</primary></indexterm>
-<indexterm><primary>get</primary></indexterm>
-<indexterm><primary>put</primary></indexterm>
-<indexterm><primary>help command</primary></indexterm>
-Once connected, you should be able to use the commands <command>dir</command>, <command>get</command>,
-<command>put</command>, and so on. Type <command>help command</command> for instructions. You should
-especially check that the amount of free disk space shown is correct when you type <command>dir</command>.
-</para>
-
-</step>
-
-<step performance="required">
-
-<para>
-<indexterm><primary>net view</primary></indexterm>
-On the PC, type the command <command>net view \\BIGSERVER</command>. You will 
-need to do this from within a DOS prompt window. You should get back a 
-list of shares available on the server.
-</para>
-
-<para>
-<indexterm><primary>nmbd</primary></indexterm>
-If you get a message <literal>network name not found</literal> or similar error, then NetBIOS
-name resolution is not working. This is usually caused by a problem in <command>nmbd</command>.
-To overcome it, you could do one of the following (you only need to choose one of them):
-</para>
-
-<orderedlist>
-<listitem><para>
-	Fix the &nmbd; installation.
-</para></listitem>
-
-<listitem><para>
-	Add the IP address of BIGSERVER to the <command>wins server</command> box in the
-	advanced TCP/IP setup on the PC.
-</para></listitem>
-
-<listitem><para>
-	Enable Windows name resolution via DNS in the advanced section of the TCP/IP setup.
-</para></listitem>
-
-<listitem><para>
-	Add BIGSERVER to your lmhosts file on the PC.
-</para></listitem>
-</orderedlist>
-
-<para>
-If you get a message <quote><errorname>invalid network name</errorname></quote> or 
-<quote><errorname>bad password error,</errorname></quote> then apply the
-same fixes as for the <command>smbclient -L</command> test. In
-particular, make sure your <command>hosts allow</command> line is correct (see the man pages).
-</para>
-
-<para>
-Also, do not overlook that fact that when the workstation requests the
-connection to the Samba server, it will attempt to connect using the 
-name with which you logged onto your Windows machine. You need to make
-sure that an account exists on your Samba server with that exact same
-name and password.
-</para>
-
-<para>
-If you get a message <quote><errorname>specified computer is not receiving requests</errorname></quote> or similar error,
-it probably means that the host is not contactable via TCP services.
-Check to see if the host is running TCP wrappers, and if so, add an entry in
-the <filename>hosts.allow</filename> file for your client (or subnet, and so on.)
-</para>
-
-</step>
-
-<step performance="required">
-
-<para>
-Run the command <command>net use x: \\BIGSERVER\TMP</command>. You should 
-be prompted for a password, then you should get a <computeroutput>command completed 
-successfully</computeroutput> message. If not, then your PC software is incorrectly 
-installed or your &smb.conf; is incorrect. Make sure your <parameter>hosts allow</parameter>
-and other config lines in &smb.conf; are correct.
-</para>
-
-<para>
-By default, most clients only sends encrypted passwords 
-and you have <smbconfoption name="encrypt passwords">no</smbconfoption> in &smb.conf;.
-Change this setting to `yes' to fix this.
-</para>
-
-</step>
-
-<step performance="required">
-
-<para>
-Run the command <command>nmblookup -M <parameter>testgroup</parameter></command> where 
-<parameter>testgroup</parameter> is the name of the workgroup that your Samba server and 
-Windows PCs belong to. You should get back the IP address of the 
-master browser for that workgroup.
-</para>
-
-<para>
-If you do not, then the election process has failed. Wait a minute to
-see if it is just being slow, then try again. If it still fails after
-that, then look at the browsing options you have set in &smb.conf;. Make
-sure you have <smbconfoption name="preferred master">yes</smbconfoption> to ensure that 
-an election is held at startup.
-</para>
-
-</step>
-
-<step performance="required">
-
-<para>
-From file manager, try to browse the server. Your Samba server should
-appear in the browse list of your local workgroup (or the one you
-specified in &smb.conf;). You should be able to double-click on the name
-of the server and get a list of shares. If you get the error message <quote>invalid password,</quote>
-your client may be refusing to browse a server that has no encrypted password
-capability. In this case make sure <smbconfoption name="encrypt passwords"/> is
-set to <quote>yes</quote> and repeat the steps in this gude.
-</para>
-
-</step>
-</procedure>
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-DomainMember.xml b/docs-xml/Samba3-HOWTO/TOSHARG-DomainMember.xml
deleted file mode 100644
index 11f79f7..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-DomainMember.xml
+++ /dev/null
@@ -1,1269 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="domain-member">
-
-<chapterinfo>
-	&author.jht;
-	&author.jeremy;
-	&author.jerry;
-	&author.tridge;
-	&author.jelmer;
-	<author>&person.gd;<contrib>LDAP updates</contrib></author>
-</chapterinfo>
-
-<title>Domain Membership</title>
-
-<para>
-<indexterm><primary>domain member</primary></indexterm>
-<indexterm><primary>machine trust account</primary></indexterm>
-<indexterm><primary>domain security</primary></indexterm>
-Domain membership is a subject of vital concern. Samba must be able to
-participate as a member server in a Microsoft domain security context, and
-Samba must be capable of providing domain machine member trust accounts;
-otherwise it would not be able to offer a viable option for many users.
-</para>
-
-<para>
-<indexterm><primary>domain membership</primary></indexterm>
-<indexterm><primary>misinformation</primary></indexterm>
-This chapter covers background information pertaining to domain membership,
-the Samba configuration for it, and MS Windows client procedures for joining a
-domain. Why is this necessary? Because both are areas in which there exists
-within the current MS Windows networking world, and particularly in the
-UNIX/Linux networking and administration world, a considerable level of
-misinformation, incorrect understanding, and lack of knowledge. Hopefully
-this chapter will fill the voids.
-</para>
-
-<sect1>
-<title>Features and Benefits</title>
-
-<para>
-<indexterm><primary>domain security</primary></indexterm>
-<indexterm><primary>single sign-on</primary></indexterm>
-<indexterm><primary>SSO</primary></indexterm>
-MS Windows workstations and servers that want to participate in domain security need to
-be made domain members. Participating in domain security is often called 
-<emphasis>single sign-on</emphasis>, or <acronym>SSO</acronym> for short. This
-chapter describes the process that must be followed to make a workstation
-(or another server &smbmdash; be it an <application>MS Windows NT4/200x</application>
-server) or a Samba server a member of an MS Windows domain security context.
-</para>
-
-<para>
-<indexterm><primary>native member</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-<indexterm><primary>domain control</primary></indexterm>
-<indexterm><primary>Server Type</primary><secondary>Domain Member</secondary></indexterm>
-Samba-3 can join an MS Windows NT4-style domain as a native member server, an 
-MS Windows Active Directory domain as a native member server, or a Samba domain
-control network. Domain membership has many advantages:
-</para>
-
-<itemizedlist>
-	<listitem><para>
-	<indexterm><primary>SAM</primary></indexterm>
-	MS Windows workstation users get the benefit of SSO.
-	</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>access rights</primary></indexterm>
-	<indexterm><primary>file ownership</primary></indexterm>
-	<indexterm><primary>access controls</primary></indexterm>
-	<indexterm><primary>SAM</primary></indexterm>
-	Domain user access rights and file ownership/access controls can be set
-	from the single Domain Security Account Manager (SAM) database 
-	(works with domain member servers as well as with MS Windows workstations
-	that are domain members).
-	</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>domain members</primary></indexterm>
-	<indexterm><primary>network logon</primary></indexterm>
-	Only <application>MS Windows NT4/200x/XP Professional</application>
-	workstations that are domain members can use network logon facilities.
-	</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>domain member</primary></indexterm>
-	<indexterm><primary>policy files</primary></indexterm>
-	<indexterm><primary>NTConfig.POL</primary></indexterm>
-	<indexterm><primary>desktop profiles</primary></indexterm>
-	Domain member workstations can be better controlled through the use of
-	policy files (<filename>NTConfig.POL</filename>) and desktop profiles.
-	</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>logon script</primary></indexterm>
-	<indexterm><primary>transparent access</primary></indexterm>
-	<indexterm><primary>application servers</primary></indexterm>
-	Through the use of logon scripts, users can be given transparent access to network
-	applications that run off application servers.
-	</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>user access management</primary></indexterm>
-	<indexterm><primary>SAM</primary></indexterm>
-	<indexterm><primary>LDAP</primary></indexterm>
-	<indexterm><primary>ADS</primary></indexterm>
-	Network administrators gain better application and user access management
-	abilities because there is no need to maintain user accounts on any network
-	client or server other than the central domain database 
-	(either NT4/Samba SAM-style domain, NT4 domain that is backend-ed with an
-	LDAP directory, or via an Active Directory infrastructure).
-	</para></listitem>
-</itemizedlist>
-
-</sect1>
-
-<sect1 id="machine-trust-accounts">
-<title>MS Windows Workstation/Server Machine Trust Accounts</title>
-
-<para>
-<indexterm><primary>Machine Trust Accounts</primary></indexterm>
-<indexterm><primary>authenticate</primary></indexterm>
-<indexterm><primary>domain controller</primary></indexterm>
-<indexterm><primary>rogue user</primary></indexterm>
-A Machine Trust Account is an account that is used to authenticate a client machine (rather than a user) to
-the domain controller server. In Windows terminology, this is known as a <quote>computer account.</quote> The
-purpose of the machine trust account is to prevent a rogue user and domain controller from colluding to gain
-access to a domain member workstation.
-</para>
-
-<para>
-<indexterm><primary>machine trust account</primary><secondary>password</secondary></indexterm>
-<indexterm><primary>shared secret</primary></indexterm>
-<indexterm><primary>unauthorized</primary></indexterm>
-<indexterm><primary>Windows NT/200x/XP Professional</primary></indexterm>
-<indexterm><primary>Windows 9x/Me/XP Home</primary></indexterm>
-The password of a Machine Trust Account acts as the shared secret for secure communication with the domain
-controller. This is a security feature to prevent an unauthorized machine with the same NetBIOS name from
-joining the domain, participating in domain security operations, and gaining access to domain user/group
-accounts. Windows NT/200x/XP Professional clients use machine trust accounts, but Windows 9x/Me/XP Home
-clients do not. Hence, a Windows 9x/Me/XP Home client is never a true member of a domain because it does not
-possess a Machine Trust Account, and, thus, has no shared secret with the domain controller.
-</para>
-
-<para>
-<indexterm><primary>Windows Registry</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-<indexterm><primary>Machine Trust Account</primary></indexterm>
-A Windows NT4 PDC stores each Machine Trust Account in the Windows Registry.
-The introduction of MS Windows 2000 saw the introduction of Active Directory,
-the new repository for Machine Trust Accounts. A Samba PDC, however, stores
-each Machine Trust Account in two parts,
-as follows:
-
-<itemizedlist>
-	<listitem><para>
-	<indexterm><primary>domain security account</primary></indexterm>
-	<indexterm><primary>account information</primary></indexterm>
-	<indexterm><primary>backend database</primary></indexterm>
-	A domain security account (stored in the <smbconfoption name="passdb backend"/>) that has been configured in
-	the &smb.conf; file. The precise nature of the account information that is stored depends on the type of
-	backend database that has been chosen.
-	</para>
-
-	<para>
-	<indexterm><primary>smbpasswd</primary></indexterm>
-	<indexterm><primary>UNIX login ID</primary></indexterm>
-	<indexterm><primary>UID</primary></indexterm>
-	<indexterm><primary>LanMan</primary></indexterm>
-	<indexterm><primary>NT-encrypted password</primary></indexterm>
-	<indexterm><primary>UNIX user identifier</primary><see>UID</see></indexterm>
-	The older format of this data is the <filename>smbpasswd</filename> database
-	that contains the UNIX login ID, the UNIX user identifier (UID), and the
-	LanMan and NT-encrypted passwords. There is also some other information in
-	this file that we do not need to concern ourselves with here.
-	</para>
-
-	<para>
-	<indexterm><primary>database</primary></indexterm>
-	<indexterm><primary>ldapsam</primary></indexterm>
-	<indexterm><primary>smbpasswd</primary></indexterm>
-	<indexterm><primary>account controls</primary></indexterm>
-	The two newer database types are called ldapsam and tdbsam. Both store considerably more data than the older
-	<filename>smbpasswd</filename> file did. The extra information enables new user account controls to be
-	implemented.
-	</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>UNIX account</primary></indexterm>
-	<indexterm><primary>/etc/passwd</primary></indexterm>
-	A corresponding UNIX account, typically stored in <filename>/etc/passwd</filename>. Work is in progress to
-	allow a simplified mode of operation that does not require UNIX user accounts, but this has not been a feature
-	of the early releases of Samba-3, and is not currently planned for release either.
-	</para></listitem>
-</itemizedlist>
-</para>
-
-<?latex \newpage ?>
-<para>
-<indexterm><primary>Machine Trust Accounts</primary><secondary>creating</secondary></indexterm>
-There are three ways to create Machine Trust Accounts:
-</para>
-
-<itemizedlist>
-	<listitem><para>
-	<indexterm><primary>manual UNIX account creation</primary></indexterm>
-	Manual creation from the UNIX/Linux command line. Here, both the Samba and
-	corresponding UNIX account are created by hand.
-	</para></listitem>
-
-	<listitem><para>
-	<indexterm><primary>Server Manager</primary></indexterm>
-	<indexterm><primary>Nexus toolkit</primary></indexterm>
-	Using the MS Windows NT4 Server Manager, either from an NT4 domain member
-	server or using the Nexus toolkit available from the Microsoft Web site.
-	This tool can be run from any MS Windows machine as long as the user is
-	logged on as the administrator account.
-	</para></listitem>
-	
-	<listitem><para>
-	<indexterm><primary>Machine Trust Account</primary></indexterm>
-	<indexterm><primary>joined client</primary></indexterm>
-	<quote>On-the-fly</quote> creation. The Samba Machine Trust Account is automatically
-	created by Samba at the time the client is joined to the domain.
-	(For security, this is the recommended method.) The corresponding UNIX
-	account may be created automatically or manually. 
-	</para></listitem>
-</itemizedlist>
-
-<para>
-<indexterm><primary>enforcing</primary></indexterm>
-<indexterm><primary>machine trust account</primary><secondary>creation</secondary></indexterm>
-Neither MS Windows NT4/200x/XP Professional, nor Samba, provide any method for enforcing the method of machine
-trust account creation. This is a matter of the administrator's choice.
-</para>
-
-<sect2>
-<title>Manual Creation of Machine Trust Accounts</title>
-
-<para>
-<indexterm><primary>/etc/passwd</primary></indexterm>
-<indexterm><primary></primary></indexterm>
-<indexterm><primary>useradd</primary></indexterm>
-<indexterm><primary>vipw</primary></indexterm>
-The first step in manually creating a Machine Trust Account is to manually
-create the corresponding UNIX account in <filename>/etc/passwd</filename>. 
-This can be done using <command>vipw</command> or another <quote>adduser</quote> command
-that is normally used to create new UNIX accounts. The following is an example for
-a Linux-based Samba server:
-<screen>
-&rootprompt;<userinput>/usr/sbin/useradd -g machines -d /var/lib/nobody \
-   -c <replaceable>"machine nickname"</replaceable> \
-   -s /bin/false <replaceable>machine_name</replaceable>$ </userinput>
-
-&rootprompt;<userinput>passwd -l <replaceable>machine_name</replaceable>$</userinput>
-</screen>
-</para>
-
-<para>
-<indexterm><primary>primary group</primary></indexterm>
-<indexterm><primary>GID</primary></indexterm>
-<indexterm><primary>machine accounts</primary></indexterm>
-In the example above there is an existing system group <quote>machines</quote> which is used
-as the primary group for all machine accounts. In the following examples the <quote>machines</quote> group
-numeric GID is 100.
-</para>
-
-<para>
-<indexterm><primary>chpass</primary></indexterm>
-<indexterm><primary>BSD</primary></indexterm>
-On *BSD systems, this can be done using the <command>chpass</command> utility:
-<screen>
-&rootprompt;<userinput>chpass -a \
-'<replaceable>machine_name</replaceable>$:*:101:100::0:0:Windows <replaceable>machine_name</replaceable>:/dev/null:/sbin/nologin'</userinput>
-</screen>
-</para>
-
-<para>
-<indexterm><primary>/etc/passwd</primary></indexterm>
-<indexterm><primary>$</primary></indexterm>
-<indexterm><primary>null shell</primary></indexterm>
-<indexterm><primary>home directory</primary></indexterm>
-The <filename>/etc/passwd</filename> entry will list the machine name 
-with a <quote>$</quote> appended, and will not have a password, will have a null shell and no 
-home directory. For example, a machine named <quote>doppy</quote> would have an 
-<filename>/etc/passwd</filename> entry like this:
-<programlisting>
-doppy$:x:505:100:<replaceable>machine_nickname</replaceable>:/dev/null:/bin/false
-</programlisting>
-</para>
-
-<para>
-<indexterm><primary>machine_nickname</primary></indexterm>
-<indexterm><primary>machine_name</primary></indexterm>
-<indexterm><primary>Machine Trust Account</primary></indexterm>
-in which <replaceable>machine_nickname</replaceable> can be any
-descriptive name for the client, such as BasementComputer.
-<replaceable>machine_name</replaceable> absolutely must be the NetBIOS
-name of the client to be joined to the domain. The <quote>$</quote> must be
-appended to the NetBIOS name of the client or Samba will not recognize
-this as a Machine Trust Account.
-</para>
-
-<para>
-<indexterm><primary>UNIX account</primary></indexterm>
-<indexterm><primary>Samba account</primary></indexterm>
-<indexterm><primary>Machine Trust Account</primary><secondary>password</secondary></indexterm>
-Now that the corresponding UNIX account has been created, the next step is to create 
-the Samba account for the client containing the well-known initial 
-Machine Trust Account password. This can be done using the 
-<command>smbpasswd</command> command 
-as shown here:
-<screen>
-&rootprompt;<userinput>smbpasswd -a -m <replaceable>machine_name</replaceable></userinput>
-</screen>
-</para>
-
-<para>
-<indexterm><primary>machine_name</primary></indexterm>
-<indexterm><primary>NetBIOS name</primary></indexterm>
-<indexterm><primary>RID</primary></indexterm>
-<indexterm><primary>UID</primary></indexterm>
-where <replaceable>machine_name</replaceable> is the machine's NetBIOS
-name. The RID of the new machine account is generated from the UID of 
-the corresponding UNIX account.
-</para>
-
-<warning>
-<title>Join the client to the domain immediately</title>
-
-<para>
-<indexterm><primary>Machine Trust Account</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>Server Manager</primary></indexterm>
-<indexterm><primary>changes password</primary></indexterm>
-<indexterm><primary>NetBIOS name</primary></indexterm>
-Manually creating a Machine Trust Account using this method is the 
-equivalent of creating a Machine Trust Account on a Windows NT PDC using 
-<indexterm><primary>Server Manager</primary></indexterm>
-the <application>Server Manager</application>. From the time at which the 
-account is created to the time the client joins the domain and 
-changes the password, your domain is vulnerable to an intruder joining 
-your domain using a machine with the same NetBIOS name. A PDC inherently 
-trusts members of the domain and will serve out a large degree of user 
-information to such clients. You have been warned!
-</para>
-</warning>
-</sect2>
-
-<sect2>
-<title>Managing Domain Machine Accounts using NT4 Server Manager</title>
-
-<para>
-<indexterm><primary>machine trust accounts</primary></indexterm>
-<indexterm><primary>automatic account creation</primary></indexterm>
-<indexterm><primary>Server Manager</primary></indexterm>
-A working <smbconfoption name="add machine script"/> is essential
-for machine trust accounts to be automatically created. This applies no matter whether
-you use automatic account creation or the NT4 Domain Server Manager.
-</para>
-
-<para>
-<indexterm><primary>SRVTOOLS.EXE</primary></indexterm>
-<indexterm><primary>SrvMgr.exe</primary></indexterm>
-<indexterm><primary>UsrMgr.exe</primary></indexterm>
-<indexterm><primary>domain management tools</primary></indexterm>
-If the machine from which you are trying to manage the domain is an 
-<application>MS Windows NT4 workstation or MS Windows 200x/XP Professional</application>,
-the tool of choice is the package called <command>SRVTOOLS.EXE</command>. 
-When executed in the target directory it will unpack <command>SrvMgr.exe</command>
-and <command>UsrMgr.exe</command> (both are domain management tools for MS Windows NT4 workstation).
-</para>
-
-<para>
-<indexterm><primary>Nexus.exe</primary></indexterm>
-<indexterm><primary>Microsoft Windows 9x/Me</primary></indexterm>
-If your workstation is a <application>Microsoft Windows 9x/Me</application> family product,
- you should download the <command>Nexus.exe</command> package from the Microsoft Web site.
-When executed from the target directory, it will unpack the same tools but for use on 
-this platform.
-</para>
-
-<para>
-Further information about these tools may be obtained from Knowledge Base articles
-<ulink url="http://support.microsoft.com/default.aspx?scid=kb;en-us;173673">173673</ulink>, and
-<ulink url="http://support.microsoft.com/default.aspx?scid=kb;en-us;172540">172540</ulink>
-</para>
-
-<para>
-<indexterm><primary>srvmgr.exe</primary></indexterm>
-<indexterm><primary>Server Manager for Domains</primary></indexterm>
-Launch the <command>srvmgr.exe</command> (Server Manager for Domains) and follow these steps:
-</para>
-
-<procedure>
-<title>Server Manager Account Machine Account Management</title>
-	<step><para>
-	From the menu select <guimenu>Computer</guimenu>.
-	</para></step>
-
-	<step><para>
-	Click <guimenuitem>Select Domain</guimenuitem>.
-	</para></step>
-
-	<step><para>
-	Click the name of the domain you wish to administer in the
-	<guilabel>Select Domain</guilabel> panel and then click 
-	<guibutton>OK</guibutton>.
-	</para></step>
-
-	<step><para>
-	Again from the menu select <guimenu>Computer</guimenu>.
-	</para></step>
-
-	<step><para>
-	Select <guimenuitem>Add to Domain</guimenuitem>.
-	</para></step>
-
-	<step><para>
-	In the dialog box, click the radio button to 
-	<guilabel>Add NT Workstation of Server</guilabel>, then
-	enter the machine name in the field provided, and click the 
-	<guibutton>Add</guibutton> button.
-	</para></step>
-</procedure>
-
-</sect2>
-
-<sect2>
-<title>On-the-Fly Creation of Machine Trust Accounts</title>
-
-<para>
-<indexterm><primary>Machine Trust Account</primary><secondary>creation</secondary></indexterm>
-The third (and recommended) way of creating Machine Trust Accounts is simply to allow the Samba server to
-create them as needed when the client is joined to the domain.
-</para>
-
-<para>
-<indexterm><primary>Machine Trust Account</primary><secondary>UNIX account</secondary></indexterm>
-<indexterm><primary>UNIX account</primary></indexterm>
-<indexterm><primary>add machine script</primary></indexterm>
-Since each Samba Machine Trust Account requires a corresponding UNIX account, a method
-for automatically creating the UNIX account is usually supplied; this requires configuration of the
-add machine script option in &smb.conf;. This method is not required; however, corresponding UNIX
-accounts may also be created manually.
-</para>
-
-
-<para>
-<indexterm><primary>useradd</primary></indexterm>
-<indexterm><primary>Red Hat Linux</primary></indexterm>
-Here is an example for a Red Hat Linux system:
-<smbconfblock>
-<smbconfsection name="[global]"/>
-<smbconfoption name="add machine script">/usr/sbin/useradd -d /var/lib/nobody -g 100 -s /bin/false -M %u</smbconfoption>
-</smbconfblock>
-</para>
-
-</sect2>
-
-<sect2><title>Making an MS Windows Workstation or Server a Domain Member</title>
-
-<para>
-The procedure for making an MS Windows workstation or server a member of the domain varies
-with the version of Windows.
-</para>
-
-<sect3>
-	<title>Windows 200x/XP Professional Client</title>
-
-	<para>
-<indexterm><primary>domain member</primary></indexterm>
-<indexterm><primary>machine trust account</primary><secondary>create privilege</secondary></indexterm>
-<indexterm><primary>privileges</primary></indexterm>
-<indexterm><primary>root</primary></indexterm>
-	When the user elects to make the client a domain member, Windows 200x prompts for
-	an account and password that has privileges to create machine accounts in the domain.
-	</para>
-
-	<para>
-	A Samba administrator account (i.e., a Samba account that has <literal>root</literal> privileges on the
-	Samba server) must be entered here; the operation will fail if an ordinary user account is given.
-	The necessary privilege can be assured by creating a Samba SAM account for <literal>root</literal> or
-	by granting the <literal>SeMachineAccountPrivilege</literal> privilege to the user account.
-	</para>
-
-	<para>
-<indexterm><primary>administrator account</primary></indexterm>
-<indexterm><primary>/etc/passwd</primary></indexterm>
-	For security reasons, the password for this administrator account should be set
-	to a password that is other than that used for the root user in <filename>/etc/passwd</filename>.
-	</para>
-
-	<para>
-<indexterm><primary>account</primary></indexterm>
-<indexterm><primary>create domain member</primary></indexterm>
-<indexterm><primary>root</primary></indexterm>
-<indexterm><primary>map</primary></indexterm>
-	The name of the account that is used to create domain member machine trust accounts can be
-	anything the network administrator may choose. If it is other than <constant>root</constant>,
-	then this is easily mapped to <constant>root</constant> in the file named in the &smb.conf; parameter
-	<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>.
-	</para>
-
-	<para>
-<indexterm><primary>administrator account</primary></indexterm>
-<indexterm><primary>encryption key</primary></indexterm>
-<indexterm><primary>machine trust account</primary></indexterm>
-	The session key of the Samba administrator account acts as an encryption key for setting the password of the machine trust
-	account. The Machine Trust Account will be created on-the-fly, or updated if it already exists.
-	</para>
-</sect3>
-
-<sect3>
-	<title>Windows NT4 Client</title>
-
-	<para>
-<indexterm><primary>Machine Trust Account</primary></indexterm>
-<indexterm><primary>Create a Computer Account</primary></indexterm>
-<indexterm><primary>join the machine</primary></indexterm>
-	If the Machine Trust Account was created manually, on the
-	Identification Changes menu enter the domain name, but do not
-	check the box <guilabel>Create a Computer Account in the Domain</guilabel>.
-	In this case, the existing Machine Trust Account is used to join the machine 
-	to the domain.
-	</para>
-
-	<para>
-<indexterm><primary>Machine Trust Account</primary></indexterm>
-<indexterm><primary>on the fly</primary></indexterm>
-<indexterm><primary>Computer Account</primary></indexterm>
-<indexterm><primary>administrator account</primary></indexterm>
-	If the Machine Trust Account is to be created on the fly, on the Identification Changes menu enter the domain
-	name and check the box <guilabel>Create a Computer Account in the Domain</guilabel>. In this case, joining
-	the domain proceeds as above for Windows 2000 (i.e., you must supply a Samba administrator account when
-	prompted).
-	</para>
-</sect3>
-
-<sect3>
-	<title>Samba Client</title>
-
-	<para>
-<indexterm><primary></primary></indexterm>
-	Joining a Samba client to a domain is documented in <link linkend="domain-member-server">the next section</link>.
-	</para>
-</sect3>
-
-</sect2>
-</sect1>
-
-<sect1 id="domain-member-server">
-<title>Domain Member Server</title>
-
-<para>
-<indexterm><primary>domain security</primary></indexterm>
-<indexterm><primary>security context</primary></indexterm>
-<indexterm><primary>authentication regime</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-This mode of server operation involves the Samba machine being made a member
-of a domain security context. This means by definition that all user
-authentication will be done from a centrally defined authentication regime. 
-The authentication regime may come from an NT3/4-style (old domain technology)
-server, or it may be provided from an Active Directory server (ADS) running on
-MS Windows 2000 or later.
-</para>
-
-<para>
-<emphasis>
-<indexterm><primary>authentication</primary><secondary>backend</secondary></indexterm>
-<indexterm><primary>distributed directory</primary></indexterm>
-<indexterm><primary>LDAP</primary></indexterm>
-<indexterm><primary>OpenLDAP</primary></indexterm>
-<indexterm><primary>iPlanet</primary></indexterm>
-<indexterm><primary>Sun</primary></indexterm>
-<indexterm><primary>Novell</primary></indexterm>
-<indexterm><primary>e-Directory</primary></indexterm>
-Of course it should be clear that the authentication backend itself could be
-from any distributed directory architecture server that is supported by Samba.
-This can be LDAP (from OpenLDAP), or Sun's iPlanet, or Novell e-Directory
-Server, and so on.
-</emphasis>
-</para>
-
-<note><para>
-<indexterm><primary>LDAP</primary></indexterm>
-<indexterm><primary>identity management</primary></indexterm>
-<indexterm><primary>machine authentication</primary></indexterm>
-When Samba is configured to use an LDAP or other identity management and/or
-directory service, it is Samba that continues to perform user and machine
-authentication. It should be noted that the LDAP server does not perform
-authentication handling in place of what Samba is designed to do.
-</para></note>
-
-<para>
-<indexterm><primary>create a domain machine account</primary></indexterm>
-<indexterm><primary>domain member server</primary></indexterm>
-<indexterm><primary>join the domain</primary></indexterm>
-Please refer to <link linkend="samba-pdc">Domain Control</link>, for more information regarding
-how to create a domain machine account for a domain member server as well as for
-information on how to enable the Samba domain member machine to join the domain
-and be fully trusted by it.
-</para>
-
-<sect2>
-<title>Joining an NT4-type Domain with Samba-3</title>
-
-<para><link linkend="assumptions">Assumptions</link> lists names that are used in the remainder of this chapter.</para>
-
-<table frame="all" id="assumptions"><title>Assumptions</title>
-	<tgroup cols="2">
-		<colspec align="right"/>
-		<colspec align="left"/>
-	<tbody>
-			<row>
-				<entry>Samba DMS NetBIOS name:</entry><entry>SERV1</entry>
-			</row>
-			<row>
-				<entry>Windows 200x/NT domain name:</entry><entry>&example.workgroup;</entry>
-			</row>
-			<row>
-				<entry>Domain's PDC NetBIOS name:</entry><entry>DOMPDC</entry>
-			</row>
-			<row>
-				<entry>Domain's BDC NetBIOS names:</entry><entry>DOMBDC1 and DOMBDC2</entry>
-			</row>
-	</tbody>
-	</tgroup>
-</table>
-
-<para>
-<indexterm><primary></primary></indexterm>
-First, you must edit your &smb.conf; file to tell Samba it should now use domain security.
-</para>
-
-<para>
-<indexterm><primary>security = user</primary></indexterm>
-<indexterm><primary>standalone server</primary></indexterm>
-<indexterm><primary>domain member server</primary></indexterm>
-<indexterm><primary>domain security</primary></indexterm>
-Change (or add) your <smbconfoption name="security"/> line in the [global] section 
-of your &smb.conf; to read:
-<smbconfblock>
-<smbconfoption name="security">domain</smbconfoption>
-</smbconfblock>
-Note that if the parameter <parameter>security = user</parameter> is used, this machine would function as a
-standalone server and not as a domain member server. Domain security mode causes Samba to work within the
-domain security context.
-</para>
-
-<para>
-Next change the <smbconfoption name="workgroup"/> line in the <smbconfsection name="[global]"/>
-section to read: 
-<smbconfblock>
-<smbconfoption name="workgroup">&example.workgroup;</smbconfoption>
-</smbconfblock>
-This is the name of the domain we are joining.
-</para>
-
-<para>
-<indexterm><primary>authenticate</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-You must also have the parameter <smbconfoption name="encrypt passwords"/>
-set to <constant>yes</constant> in order for your users to authenticate to the NT PDC.
-This is the default setting if this parameter is not specified. There is no need to specify this
-parameter, but if it is specified in the &smb.conf; file, it must be set to <constant>Yes</constant>.
-</para>
-
-<para>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>BDC</primary></indexterm>
-<indexterm><primary>authenticate users</primary></indexterm>
-<indexterm><primary>domain controllers</primary></indexterm>
-Finally, add (or modify) a <smbconfoption name="password server"/> line in the [global]
-section to read: 
-<smbconfblock>
-<smbconfoption name="password server">DOMPDC DOMBDC1 DOMBDC2</smbconfoption>
-</smbconfblock>
-These are the PDC and BDCs Samba 
-will attempt to contact in order to authenticate users. Samba will 
-try to contact each of these servers in order, so you may want to 
-rearrange this list in order to spread out the authentication load 
-among Domain Controllers.
-</para>
-
-<para>
-<indexterm><primary>list of domain controllers</primary></indexterm>
-<indexterm><primary>mechanism</primary></indexterm>
-<indexterm><primary>broadcast-based name resolution</primary></indexterm>
-<indexterm><primary>DNS name resolution</primary></indexterm>
-Alternatively, if you want smbd to determine automatically the list of domain controllers to use for
-authentication, you may set this line to be:
-<smbconfblock>
-<smbconfoption name="password server">*</smbconfoption>
-</smbconfblock>
-<indexterm><primary>WINS</primary></indexterm>
-This method allows Samba to use exactly the same mechanism that NT does. The 
-method either uses broadcast-based name resolution, performs a WINS database
-lookup in order to find a domain controller against which to authenticate,
-or locates the domain controller using DNS name resolution.
-</para>
-
-<para>
-To join the domain, run this command:
-<indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>join</tertiary></indexterm>
-<screen>
-&rootprompt;<userinput>net rpc join -S DOMPDC -U<replaceable>Administrator%password</replaceable></userinput>
-</screen>
-</para>
-
-<para>
-<indexterm><primary>NetBIOS name</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>WINS lookup</primary></indexterm>
-<indexterm><primary>NetBIOS broadcast</primary></indexterm>
-If the <option>-S DOMPDC</option> argument is not given, the domain name will be obtained from &smb.conf; and
-the NetBIOS name of the PDC will be obtained either using a WINS lookup or via NetBIOS broadcast based name
-look up.
-</para>
-
-<para>
-<indexterm><primary>joining the domain</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>Administrator%password</primary></indexterm>
-<indexterm><primary>Joined domain</primary></indexterm>
-The machine is joining the domain DOM, and the PDC for that domain (the only machine
-that has write access to the domain SAM database) is DOMPDC; therefore, use the <option>-S</option>
-option. The <replaceable>Administrator%password</replaceable> is the login name and
-password for an account that has the necessary privilege to add machines to the
-domain. If this is successful, you will see the following message in your terminal window.
-Where the older NT4-style domain architecture is used:
-<screen>
-<computeroutput>Joined domain DOM.</computeroutput>
-</screen>
-</para>
-
-<para>
-<indexterm><primary>net</primary><secondary>ads</secondary><tertiary>join</tertiary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-<indexterm><primary>join the ADS domain</primary></indexterm>
-Where Active Directory is used, the command used to join the ADS domain is:
-<screen>
-&rootprompt; net ads join -U<replaceable>Administrator%password</replaceable>
-</screen>
-And the following output is indicative of a successful outcome:
-<screen>
-<computeroutput>Joined SERV1 to realm MYREALM.</computeroutput>
-</screen>
-</para>
-
-<para>
-Refer to the <command>net</command> man page and to <link linkend="NetCommand">the chapter on remote
-administration</link> for further information.
-</para>
-
-<para>
-<indexterm><primary>join the domain</primary></indexterm>
-<indexterm><primary>create machine trust account</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-This process joins the server to the domain without separately having to create the machine
-trust account on the PDC beforehand.
-</para>
-
-<para>
-<indexterm><primary>machine account password</primary><secondary>change protocol</secondary></indexterm>
-<indexterm><primary>random machine account password</primary></indexterm>
-<indexterm><primary>/usr/local/samba/private/secrets.tdb</primary></indexterm>
-<indexterm><primary>/etc/samba/secrets.tdb</primary></indexterm>
-This command goes through the machine account password change protocol, then writes the new (random) machine
-account password for this Samba server into a file in the same directory in which a smbpasswd file would be
-normally stored. The trust account information that is needed by the DMS is written into the file
-<filename>/usr/local/samba/private/secrets.tdb</filename> or <filename>/etc/samba/secrets.tdb</filename>.
-</para>
-
-<para>
-<indexterm><primary>domain-level security</primary></indexterm>
-<indexterm><primary>shadow password file</primary></indexterm>
-This file is created and owned by root and is not readable by any other user. It is
-the key to the domain-level security for your system and should be treated as carefully 
-as a shadow password file.
-</para>
-
-<para>
-<indexterm><primary>Samba daemons</primary></indexterm>
-<indexterm><primary>distribution</primary></indexterm>
-<indexterm><primary>/etc/init.d/samba</primary></indexterm>
-Finally, restart your Samba daemons and get ready for clients to begin using domain
-security. The way you can restart your Samba daemons depends on your distribution,
-but in most cases the following will suffice:
-<screen>
-&rootprompt;/etc/init.d/samba restart
-</screen>
-</para>
-
-</sect2>
-
-</sect1>
-
-<sect1 id="ads-member">
-<title>Samba ADS Domain Membership</title>
-
-<para>
-<indexterm significance="preferred"><primary>Active Directory</primary></indexterm>
-<indexterm significance="preferred"><primary>ADS</primary><see>Active Directory</see></indexterm>
-<indexterm><primary>KDC</primary></indexterm>
-<indexterm><primary>Kerberos</primary></indexterm>
-This is a rough guide to setting up Samba-3 with Kerberos authentication against a
-Windows 200x KDC. A familiarity with Kerberos is assumed.
-</para> 
-
-<sect2>
-<title>Configure &smb.conf;</title>
-
-<para>
-You must use at least the following three options in &smb.conf;:
-</para>
-
-<smbconfblock>
-<smbconfoption name="realm">your.kerberos.REALM</smbconfoption>
-<smbconfoption name="security">ADS</smbconfoption>
-<smbconfcomment>The following parameter need only be specified if present.</smbconfcomment>
-<smbconfcomment>The default setting if not present is Yes.</smbconfcomment>
-<smbconfoption name="encrypt passwords">yes</smbconfoption>
-</smbconfblock>
-
-<para>
-<indexterm><primary>ADS</primary></indexterm>
-<indexterm><primary>realm</primary></indexterm>
-<indexterm><primary>DNS</primary></indexterm>
-<indexterm><primary>ADS DC</primary></indexterm>
-<indexterm><primary>password server</primary></indexterm>
-In case samba cannot correctly identify the appropriate ADS server using the realm name, use the 
-<smbconfoption name="password server"/> option in &smb.conf;:
-<smbconfblock>
-<smbconfoption name="password server">your.kerberos.server</smbconfoption>
-</smbconfblock>
-The most common reason for which Samba may not be able to locate the ADS domain controller is a consequence of
-sites maintaining some DNS servers on UNIX systems without regard for the DNS requirements of the ADS
-infrastructure. There is no harm in specifying a preferred ADS domain controller using the <parameter>password
-server</parameter>.
-</para>
-
-<note><para>
-<indexterm><primary>smbpasswd</primary></indexterm>
-<indexterm><primary>authenticated</primary></indexterm>
-You do <emphasis>not</emphasis> need an smbpasswd file, and older clients will be authenticated as 
-if <smbconfoption name="security">domain</smbconfoption>, although it will not do any harm and 
-allows you to have local users not in the domain.
-</para></note>
-
-</sect2>
-  
-<sect2>
-<title>Configure <filename>/etc/krb5.conf</filename></title>
-
-<para>
-<indexterm><primary>/etc/krb5.conf</primary></indexterm>
-<indexterm><primary>Kerberos</primary><secondary>/etc/krb5.conf</secondary></indexterm>
-<indexterm><primary>MIT</primary></indexterm>
-<indexterm><primary>Heimdal</primary></indexterm>
-With both MIT and Heimdal Kerberos, it is unnecessary to configure the <filename>/etc/krb5.conf</filename>,
-and it may be detrimental.
-</para>
-
-<para>
-<indexterm><primary>ADS</primary></indexterm>
-<indexterm><primary>SRV records</primary></indexterm>
-<indexterm><primary>DNS zon</primary></indexterm>
-<indexterm><primary>KDC</primary></indexterm>
-<indexterm><primary>_kerberos.REALM.NAME</primary></indexterm>
-Microsoft ADS automatically create SRV records in the DNS zone 
-<parameter>_kerberos._tcp.REALM.NAME</parameter> for each KDC in the realm. This is part
-of the installation and configuration process used to create an Active Directory domain.
-A KDC is a Kerberos Key Distribution Center and forms an integral part of the Microsoft
-active directory infrastructure.
-</para>
-
-<para>
-<indexterm><primary>kinit</primary></indexterm>
-<indexterm><primary>DES-CBC-MD5</primary></indexterm>
-<indexterm><primary>DES-CBC-CRC</primary></indexterm>
-<indexterm><primary>encryption types</primary></indexterm>
-<indexterm><primary>kerberos</primary></indexterm>
-<indexterm><primary>Windows 2000</primary></indexterm>
-UNIX systems can use kinit and the DES-CBC-MD5 or DES-CBC-CRC encryption types to authenticate to the Windows
-2000 KDC. For further information regarding Windows 2000 ADS kerberos interoperability please refer to the
-Microsoft Windows 2000 Kerberos <ulink
-url="http://www.microsoft.com/windows2000/techinfo/planning/security/kerbsteps.asp">Interoperability</ulink>
-guide. Another very useful document that may be referred to for general information regarding Kerberos
-interoperability is <ulink url="http://www.ietf.org/rfc/rfc1510.txt?number=1510">RFC1510</ulink>. This RFC
-explains much of the magic behind the operation of Kerberos.
-</para>
-
-<para>
-<indexterm><primary>MIT</primary></indexterm>
-<indexterm><primary>KRB5</primary></indexterm>
-<indexterm><primary>SRV records</primary></indexterm>
-<indexterm><primary>krb5.conf</primary></indexterm>
-<indexterm><primary>DNS lookup</primary></indexterm>
-<indexterm><primary>libraries</primary></indexterm>
-MIT's, as well as Heimdal's, recent KRB5 libraries default to checking for SRV records, so they will 
-automatically find the KDCs. In addition, <filename>krb5.conf</filename> only allows specifying 
-a single KDC, even there if there may be more than one. Using the DNS lookup allows the KRB5 
-libraries to use whichever KDCs are available.
-</para>
-
-<para>
-<indexterm><primary>krb5.conf</primary></indexterm>
-When manually configuring <filename>krb5.conf</filename>, the minimal configuration is:
-<screen>
-[libdefaults]
-	default_realm = YOUR.KERBEROS.REALM
-	dns_lookup_kdc = true
-
-[domain_realms]
-	.kerberos.server = YOUR.KERBEROS.REALM
-</screen>
-</para>
-
-<para>
-If you must specify the KDC directly, the minimal configuration is:
-<screen>
-[libdefaults]
-	default_realm      = YOUR.KERBEROS.REALM
-
-[realms]
-        YOUR.KERBEROS.REALM = {
-        kdc = your.kerberos.server
-	}
-
-[domain_realms]
-        .kerberos.server = YOUR.KERBEROS.REALM
-</screen>
-</para>
-
-<para>
-<indexterm><primary>KDC</primary></indexterm>
-<indexterm><primary>kinit</primary></indexterm>
-Test your config by doing a <userinput>kinit
-<replaceable>USERNAME</replaceable>@<replaceable>REALM</replaceable></userinput> and
-making sure that your password is accepted by the Win2000 KDC.
-</para>
-
-<note><para>
-<indexterm><primary>realm</primary></indexterm>
-<indexterm><primary>uppercase</primary></indexterm>
-<indexterm><primary>KDC</primary></indexterm>
-The realm must be in uppercase or you will get a <quote><errorname>Cannot find KDC for
-requested realm while getting initial credentials</errorname></quote> error (Kerberos
-is case-sensitive!).
-</para></note>
-
-<note><para>
-<indexterm><primary>synchronize</primary></indexterm>
-<indexterm><primary>credentials</primary></indexterm>
-<indexterm><primary>time difference</primary></indexterm>
-<indexterm><primary>clock skew</primary></indexterm>
-Time between the two servers must be synchronized. You will get a <quote><errorname>kinit(v5): Clock skew too
-great while getting initial credentials</errorname></quote> if the time difference (clock skew) is more than five minutes.
-</para></note>
-
-<para>
-<indexterm><primary>clock skew</primary></indexterm>
-<indexterm><primary>Kerberos</primary></indexterm>
-Clock skew limits are configurable in the Kerberos protocols. The default setting is five minutes.
-</para>
-
-<para>
-<indexterm><primary>Kerberos</primary></indexterm>
-<indexterm><primary>Create the Computer Account</primary></indexterm>
-<indexterm><primary>Testing Server Setup</primary></indexterm>
-<indexterm><primary></primary></indexterm>
-If all you want is Kerberos support in &smbclient;, then you can skip directly to <link
-linkend="ads-test-smbclient">Testing with &smbclient;</link> now.  <link
-linkend="ads-create-machine-account">Create the Computer Account</link> and <link
-linkend="ads-test-server">Testing Server Setup</link> are needed only if you want Kerberos support for &smbd;
-and &winbindd;.
-</para>
-
-</sect2>
-
-<sect2 id="ads-create-machine-account">
-<title>Create the Computer Account</title>
-
-<para>
-<indexterm><primary>write permission</primary></indexterm>
-<indexterm><primary>Samba private directory</primary></indexterm>
-<indexterm><primary>Administrator account</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-As a user who has write permission on the Samba private directory (usually root), run:
-<screen>
-&rootprompt; <userinput>net ads join -U Administrator%password</userinput>
-</screen>
-The Administrator account can be any account that has been designated in the ADS domain security settings with
-permission to add machines to the ADS domain. It is, of course, a good idea to use an account other than Administrator.
-On the UNIX/Linux system, this command must be executed by an account that has UID=0 (root).
-</para>
-
-<para>
-<indexterm><primary>ADS</primary></indexterm>
-<indexterm><primary>machine trust account</primary></indexterm>
-<indexterm><primary>organizational unit</primary></indexterm>
-<indexterm><primary>ADS manager</primary></indexterm>
-<indexterm><primary>kinit</primary></indexterm>
-<indexterm><primary>net</primary><secondary>ads</secondary><tertiary>join</tertiary></indexterm>
-When making a Windows client a member of an ADS domain within a complex organization, you
-may want to create the machine trust account within a particular organizational unit. Samba-3 permits
-this to be done using the following syntax:
-<screen>
-&rootprompt; <userinput>kinit Administrator at your.kerberos.REALM</userinput>
-&rootprompt; <userinput>net ads join createcomputer="organizational_unit"</userinput>
-</screen>
-Your ADS manager will be able to advise what should be specified for the "organizational_unit" parameter.
-</para>
-
-<para>
-<indexterm><primary>organizational directory</primary></indexterm>
-<indexterm><primary>machine trust account</primary></indexterm>
-<indexterm><primary>container</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-For example, you may want to create the machine trust account in a container called <quote>Servers</quote>
-under the organizational directory <quote>Computers/BusinessUnit/Department,</quote> like this:
-<screen>
-&rootprompt; <userinput>net ads join "Computers/BusinessUnit/Department/Servers"</userinput>
-</screen>
-This command will place the Samba server machine trust account in the container
-<literal>Computers/BusinessUnit/Department/Servers</literal>. The container should exist in the ADS directory
-before executing this command.  Please note that forward slashes must be used, because backslashes are both
-valid characters in an OU name and used as escapes for other characters.  If you need a backslash in an OU 
-name, it may need to be quadrupled to pass through the shell escape and ldap escape.
-</para>
-
-<sect3>
-<title>Possible Errors</title>
-
-<para>
-<variablelist>
-	<varlistentry><term><errorname>ADS support not compiled in</errorname></term>
-	<listitem><para>
-	<indexterm><primary>config.cache</primary></indexterm>
-	<indexterm><primary>Kerberos</primary></indexterm>
-	<indexterm><primary>headers files</primary></indexterm>
-	Samba must be reconfigured (remove config.cache) and recompiled (make clean all install) after the
-	Kerberos libraries and headers files are installed.
-	</para></listitem></varlistentry>
-
-	<varlistentry><term><errorname>net ads join prompts for user name</errorname></term>
-	<listitem><para>
-	<indexterm><primary>kinit</primary></indexterm>
-	<indexterm><primary>rights</primary></indexterm>
-	You need to login to the domain using <userinput>kinit
-	<replaceable>USERNAME</replaceable>@<replaceable>REALM</replaceable></userinput>.
-	<replaceable>USERNAME</replaceable> must be a user who has rights to add a machine to the domain.
-	</para></listitem></varlistentry>
-</variablelist>
-</para>
-
-</sect3>
-
-</sect2>
-
-<sect2 id="ads-test-server">
-<title>Testing Server Setup</title>
-
-<para>
-<indexterm><primary>successful join</primary></indexterm>
-<indexterm><primary>computer account</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-If the join was successful, you will see a new computer account with the
-NetBIOS name of your Samba server in Active Directory (in the <quote>Computers</quote>
-folder under Users and Computers.
-</para>
-
-<para>
-<indexterm><primary>Windows 2000</primary></indexterm>
-<indexterm><primary>net</primary><secondary>use</secondary></indexterm>
-<indexterm><primary>DES-CBC-MD5</primary></indexterm>
-On a Windows 2000 client, try <userinput>net use * \\server\share</userinput>. It should be possible
-to login with Kerberos without needing to know a password. If this fails, then run
-<userinput>klist tickets</userinput>. Did you get a ticket for the server? Does it have
-an encryption type of DES-CBC-MD5?
-</para>
-
-<note><para>
-<indexterm><primary>DES-CBC-MD5</primary></indexterm>
-<indexterm><primary>ARCFOUR-HMAC-MD5</primary></indexterm>
-<indexterm><primary>encoding</primary></indexterm>
-Samba can use both DES-CBC-MD5 encryption as well as ARCFOUR-HMAC-MD5 encoding.
-</para></note>
-
-</sect2>
-
-<sect2 id="ads-test-smbclient">
-<title>Testing with &smbclient;</title>
-
-<para>
-<indexterm><primary>smbclient</primary></indexterm>
-<indexterm><primary>Kerberos</primary></indexterm>
-<indexterm><primary>Kerberos authentication</primary></indexterm>
-On your Samba server try to login to a Windows 2000 server or your Samba
-server using &smbclient; and Kerberos. Use &smbclient; as usual, but
-specify the <option>-k</option> option to choose Kerberos authentication.
-</para>
-
-</sect2>
-</sect1>
-
-<sect1>
-<title>Sharing User ID Mappings between Samba Domain Members</title>
-
-<para>
-<indexterm><primary>maps UNIX users and groups</primary></indexterm>
-<indexterm><primary>UID</primary></indexterm>
-<indexterm><primary>GID</primary></indexterm>
-<indexterm><primary>SID</primary></indexterm>
-Samba maps UNIX users and groups (identified by UIDs and GIDs) to Windows users and groups (identified by SIDs).
-These mappings are done by the <parameter>idmap</parameter> subsystem of Samba.
-</para>
-
-<para>
-<indexterm><primary>mappings</primary></indexterm>
-<indexterm><primary>CIFS</primary></indexterm>
-<indexterm><primary>NFS</primary></indexterm>
-In some cases it is useful to share these mappings between Samba domain members,
-so <emphasis>name->id</emphasis> mapping is identical on all machines.
-This may be needed in particular when sharing files over both CIFS and NFS.
-</para>
-
-<para>
-<indexterm><primary>LDAP</primary></indexterm>
-<indexterm><primary>ldap idmap suffix</primary></indexterm>
-To use the <emphasis>LDAP</emphasis> <parameter>ldap idmap suffix</parameter>, set:
-</para>
-
-<smbconfblock>
-<smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
-</smbconfblock>
-
-<para>
-See the &smb.conf; man page entry for the <smbconfoption name="ldap idmap suffix"></smbconfoption>
-parameter for further information.
-</para>
-
-<para>
-<indexterm><primary>smbpasswd</primary></indexterm>
-<indexterm><primary>LDAP administrative password</primary></indexterm>
-<indexterm><primary>secrets.tdb</primary></indexterm>
-Do not forget to specify also the <smbconfoption name="ldap admin dn"/>
-and to make certain to set the LDAP administrative password into the <filename>secrets.tdb</filename> using:
-<screen>
-&rootprompt; smbpasswd -w ldap-admin-password
-</screen>
-In place of <literal>ldap-admin-password</literal>, substitute the LDAP administration password for your
-system.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Common Errors</title>
-
-<para>
-<indexterm><primary>domain member</primary></indexterm>
-<indexterm><primary>machine trust accounts</primary></indexterm>
-In the process of adding/deleting/re-adding domain member machine trust accounts, there are
-many traps for the unwary player and many <quote>little</quote> things that can go wrong.
-It is particularly interesting how often subscribers on the Samba mailing list have concluded
-after repeated failed attempts to add a machine account that it is necessary to <quote>reinstall</quote>
-MS Windows on the machine. In truth, it is seldom necessary to reinstall because of this type
-of problem. The real solution is often quite simple, and with an understanding of how MS Windows
-networking functions, it is easy to overcome.
-</para>
-
-<sect2>
-<title>Cannot Add Machine Back to Domain</title>
-
-<para>
-<indexterm><primary>machine trust account</primary></indexterm>
-<indexterm><primary>already exists</primary></indexterm>
-<quote>A Windows workstation was reinstalled. The original domain machine trust
-account was deleted and added immediately. The workstation will not join the domain if I use 
-the same machine name. Attempts to add the machine fail with a message that the machine already
-exists on the network &smbmdash; I know it does not. Why is this failing?</quote>
-</para>
-
-<para>
-<indexterm><primary>NetBIOS name cache</primary></indexterm>
-<indexterm><primary>nbtstat</primary></indexterm>
-The original name is still in the NetBIOS name cache and must expire after machine account
-deletion before adding that same name as a domain member again. The best advice is to delete
-the old account and then add the machine with a new name. Alternately, the name cache can be flushed and
-reloaded with current data using the <command>nbtstat</command> command on the Windows client:
-<screen>
-&dosprompt; nbtstat -R
-</screen>
-</para>
-
-</sect2>
-
-<sect2>
-<title>Adding Machine to Domain Fails</title>
-
-<para>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>fails</primary></indexterm>
-<quote>Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a
-message that says, <errorname>"The machine could not be added at this time, there is a network problem.
-Please try again later."</errorname> Why?</quote>
-</para>
-
-<para>
-<indexterm><primary>check logs</primary></indexterm>
-You should check that there is an <smbconfoption name="add machine script"/> in your &smb.conf;
-file. If there is not, please add one that is appropriate for your OS platform. If a script
-has been defined, you will need to debug its operation. Increase the <smbconfoption name="log level"></smbconfoption>
-in the &smb.conf; file to level 10, then try to rejoin the domain. Check the logs to see which
-operation is failing.
-</para>
-
-<para>
-Possible causes include:
-</para>
-
-<itemizedlist>
-	<listitem><para>
-<indexterm><primary>script</primary></indexterm>
-<indexterm><primary>path specified</primary></indexterm>
-	The script does not actually exist, or could not be located in the path specified.
-	</para>
-
-	<para>
-<indexterm><primary>UNIX system account</primary></indexterm>
-<indexterm><primary>Samba SAM account</primary></indexterm>
-	<emphasis>Corrective action:</emphasis> Fix it. Make sure when run manually
-	that the script will add both the UNIX system account and the Samba SAM account.
-	</para></listitem>
-
-	<listitem><para>
-<indexterm><primary>UNIX system account</primary></indexterm>
-<indexterm><primary>/etc/passwd</primary></indexterm>
-	The machine could not be added to the UNIX system accounts file <filename>/etc/passwd</filename>.
-	</para>
-
-	<para>
-<indexterm><primary>legal UNIX system account name</primary></indexterm>
-<indexterm><primary>uppercase</primary></indexterm>
-	<emphasis>Corrective action:</emphasis> Check that the machine name is a legal UNIX
-	system account name. If the UNIX utility <command>useradd</command> is called,
-	then make sure that the machine name you are trying to add can be added using this
-	tool. <command>Useradd</command> on some systems will not allow any uppercase characters
-	nor will it allow spaces in the name.
-	</para></listitem>
-</itemizedlist>
-
-<para>
-<indexterm><primary>backend database</primary></indexterm>
-<indexterm><primary>UNIX system account</primary></indexterm>
-<indexterm><primary>Samba backend database</primary></indexterm>
-The <smbconfoption name="add machine script"/> does not create the
-machine account in the Samba backend database; it is there only to create a UNIX system
-account to which the Samba backend database account can be mapped.
-</para>
-
-</sect2>
-</sect1>
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-FastStart.xml b/docs-xml/Samba3-HOWTO/TOSHARG-FastStart.xml
deleted file mode 100644
index 13a212b..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-FastStart.xml
+++ /dev/null
@@ -1,1298 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="FastStart">
-<chapterinfo>
-	&author.jht;
-</chapterinfo>
-
-<title>Fast Start: Cure for Impatience</title>
-
-<para>
-When we first asked for suggestions for inclusion in the Samba HOWTO documentation,
-someone wrote asking for example configurations &smbmdash; and lots of them. That is remarkably
-difficult to do without losing a lot of value that can be derived from presenting
-many extracts from working systems. That is what the rest of this document does.
-It does so with extensive descriptions of the configuration possibilities within the
-context of the chapter that covers it. We hope that this chapter is the medicine 
-that has been requested.
-</para>
-
-<para>
-The information in this chapter is very sparse compared with the book <quote>Samba-3 by Example</quote>
-that was written after the original version of this book was nearly complete. <quote>Samba-3 by Example</quote>
-was the result of feedback from reviewers during the final copy editing of the first edition. It
-was interesting to see that reader feedback mirrored that given by the original reviewers.
-In any case, a month and a half was spent in doing basic research to better understand what
-new as well as experienced network administrators would best benefit from. The book <quote>Samba-3 by Example</quote>
-is the result of that research. What is presented in the few pages of this book is covered
-far more comprehensively in the second edition of <quote>Samba-3 by Example</quote>. The second edition
-of both books will be released at the same time.
-</para>
-
-<para>
-So in summary, the book <quote>The Official Samba-3 HOWTO & Reference Guide</quote> is intended
-as the equivalent of an auto mechanic's repair guide. The book <quote>Samba-3 by Example</quote> is the
-equivalent of the driver's guide that explains how to drive the car. If you want complete network
-configuration examples, go to <ulink url="http://www.samba.org/samba/docs/Samba3-ByExample.pdf">Samba-3 by
-Example</ulink>.
-</para>
-
-<sect1>
-<title>Features and Benefits</title>
-
-<para>
-Samba needs very little configuration to create a basic working system.
-In this chapter we progress from the simple to the complex, for each providing
-all steps and configuration file changes needed to make each work. Please note
-that a comprehensively configured system will likely employ additional smart
-features. These additional features are covered in the remainder of this document.
-</para>
-
-<para>
-The examples used here have been obtained from a number of people who made
-requests for example configurations. All identities have been obscured to protect
-the guilty, and any resemblance to unreal nonexistent sites is deliberate.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Description of Example Sites</title>
-
-<para>
-In the first set of configuration examples we consider the case of exceptionally simple system requirements.
-There is a real temptation to make something that should require little effort much too complex.
-</para>
-
-<para>
-<link linkend="anon-ro"></link> documents the type of server that might be sufficient to serve CD-ROM images,
-or reference document files for network client use. This configuration is also discussed in <link
-linkend="StandAloneServer"></link>, <link linkend="RefDocServer"></link>.  The purpose for this configuration
-is to provide a shared volume that is read-only that anyone, even guests, can access.
-</para>
-
-<para>
-The second example shows a minimal configuration for a print server that anyone can print to as long as they
-have the correct printer drivers installed on their computer. This is a mirror of the system described in
-<link linkend="StandAloneServer"></link>, <link linkend="SimplePrintServer"></link>.
-</para>
-
-<para>
-The next example is of a secure office file and print server that will be accessible only to users who have an
-account on the system. This server is meant to closely resemble a workgroup file and print server, but has to
-be more secure than an anonymous access machine.  This type of system will typically suit the needs of a small
-office. The server provides no network logon facilities, offers no domain control; instead it is just a
-network-attached storage (NAS) device and a print server.
-</para>
-
-<para>
-The later example consider more complex systems that will either integrate into existing MS Windows networks
-or replace them entirely. These cover domain member servers as well as Samba domain control (PDC/BDC) and
-finally describes in detail a large distributed network with branch offices in remote locations.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Worked Examples</title>
-
-<para>
-The configuration examples are designed to cover everything necessary to get Samba 
-running. They do not cover basic operating system platform configuration, which is
-clearly beyond the scope of this text.
-</para>
-
-<para>
-It is also assumed that Samba has been correctly installed, either by way of installation
-of the packages that are provided by the operating system vendor or through other means.
-</para>
-
-	<sect2>
-	<title>Standalone Server</title>
-
-	<para>
-	<indexterm><primary>Server Type</primary><secondary>Stand-alone</secondary></indexterm>
-	A standalone server implies no more than the fact that it is not a domain controller
-	and it does not participate in domain control. It can be a simple, workgroup-like
-	server, or it can be a complex server that is a member of a domain security context.
-	</para>
-
-	<para>
-	As the examples are developed, every attempt is made to progress the system toward greater capability, just as
-	one might expect would happen in a real business office as that office grows in size and its needs change.
-	</para>
-
-		<sect3 id="anon-ro">
-		<title>Anonymous Read-Only Document Server</title>
-
-		<para>
-		<indexterm><primary>read only</primary><secondary>server</secondary></indexterm>
-		The purpose of this type of server is to make available to any user
-		any documents or files that are placed on the shared resource. The
-		shared resource could be a CD-ROM drive, a CD-ROM image, or a file
-		storage area.
-		</para>
-
-		<itemizedlist>
-			<listitem><para>
-			The file system share point will be <filename>/export</filename>.
-			</para></listitem>
-
-			<listitem><para>
-			All files will be owned by a user called Jack Baumbach.
-			Jack's login name will be <emphasis>jackb</emphasis>. His password will be
-			<emphasis>m0r3pa1n</emphasis> &smbmdash; of course, that's just the example we are
-			using; do not use this in a production environment because
-			all readers of this document will know it.
-			</para></listitem>
-		</itemizedlist>
-
-		<procedure>
-		<title>Installation Procedure: Read-Only Server</title>
-			<step><para>
-			Add user to system (with creation of the user's home directory):
-<screen>
-&rootprompt;<userinput>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</userinput>
-</screen>
-			</para></step>
-
-			<step><para>
-			Create directory, and set permissions and ownership:
-<screen>
-&rootprompt;<userinput>mkdir /export</userinput>
-&rootprompt;<userinput>chmod u+rwx,g+rx,o+rx /export</userinput>
-&rootprompt;<userinput>chown jackb.users /export</userinput>
-</screen>
-			</para></step>
-
-			<step><para>
-			Copy the files that should be shared to the <filename>/export</filename>
-			directory.
-			</para></step>
-
-			<step><para>
-			Install the Samba configuration file (<filename>/etc/samba/smb.conf</filename>)
-			as shown in <link linkend="anon-example">Anonymous Read-Only Server Configuration</link>.
-			</para></step>
-
-<example id="anon-example">
-<title>Anonymous Read-Only Server Configuration</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
-<smbconfoption name="netbios name">HOBBIT</smbconfoption>
-<smbconfoption name="security">user</smbconfoption>
-<smbconfoption name="map to guest">bad user</smbconfoption>
-
-<smbconfsection name="[data]"/>
-<smbconfoption name="comment">Data</smbconfoption>
-<smbconfoption name="path">/export</smbconfoption>
-<smbconfoption name="read only">Yes</smbconfoption>
-<smbconfoption name="guest ok">Yes</smbconfoption>
-</smbconfblock>
-</example>
-
-			<step><para>
-			Test the configuration file by executing the following command:
-<screen>
-&rootprompt;<userinput>testparm</userinput>
-</screen>
-			Alternatively, where you are operating from a master configuration file called
-			<filename>smb.conf.master</filename>, the following sequence of commands might prove
-			more appropriate:
-<screen>
-&rootprompt; cd /etc/samba
-&rootprompt; testparm -s smb.conf.master > smb.conf
-&rootprompt; testparm
-</screen>
-			Note any error messages that might be produced. Proceed only if error-free output has been
-			obtained. An example of typical output that should be generated from the above configuration
-			file is shown here:
-<screen>
-Load smb config files from /etc/samba/smb.conf
-Processing section "[data]"
-Loaded services file OK.
-Server role: ROLE_STANDALONE
-Press enter to see a dump of your service definitions
-<userinput>[Press enter]</userinput>
-
-# Global parameters
-[global]
-	workgroup = MIDEARTH
-	netbios name = HOBBIT
-	security = user
-	map to guest = bad user
-
-[data]
-	comment = Data
-	path = /export
-	read only = Yes
-	guest only = Yes
-</screen>
-			</para></step>
-
-			<step><para>
-			Start Samba using the method applicable to your operating system platform. The method that
-			should be used is platform dependent. Refer to <link linkend="startingSamba">Starting Samba</link>
-			for further information regarding the starting of Samba.
-			</para></step>
-
-			<step><para>
-			Configure your MS Windows client for workgroup <emphasis>MIDEARTH</emphasis>,
-			set the machine name to ROBBINS, reboot, wait a few (2 - 5) minutes,
-			then open Windows Explorer and visit the Network Neighborhood.
-			The machine HOBBIT should be visible. When you click this machine
-			icon, it should open up to reveal the <emphasis>data</emphasis> share. After
-			you click the share, it should open up to reveal the files previously
-			placed in the <filename>/export</filename> directory.
-			</para></step>
-		</procedure>
-
-		<para>
-		The information above (following # Global parameters) provides the complete
-		contents of the <filename>/etc/samba/smb.conf</filename> file.
-		</para>
-
-		</sect3>
-
-		<sect3>
-		<title>Anonymous Read-Write Document Server</title>
-
-		<para>
-		<indexterm><primary>anonymous</primary><secondary>read-write server</secondary></indexterm>
-		We should view this configuration as a progression from the previous example.
-		The difference is that shared access is now forced to the user identity of jackb
-		and to the primary group jackb belongs to. One other refinement we can make is to
-		add the user <emphasis>jackb</emphasis> to the <filename>smbpasswd</filename> file.
-		To do this, execute:
-<screen>
-&rootprompt;<userinput>smbpasswd -a jackb</userinput>
-New SMB password: <userinput>m0r3pa1n</userinput>
-Retype new SMB password: <userinput>m0r3pa1n</userinput>
-Added user jackb.
-</screen>
-		Addition of this user to the <filename>smbpasswd</filename> file allows all files
-		to be displayed in the Explorer Properties boxes as belonging to <emphasis>jackb</emphasis>
-		instead of to <emphasis>User Unknown</emphasis>.
-		</para>
-
-		<para>
-		The complete, modified &smb.conf; file is as shown in <link linkend="anon-rw"/>.
-		</para>
-
-<example id="anon-rw">
-<title>Modified Anonymous Read-Write smb.conf</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
-<smbconfoption name="netbios name">HOBBIT</smbconfoption>
-<smbconfoption name="security">USER</smbconfoption>
-<smbconfoption name="map to guest">bad user</smbconfoption>
-
-<smbconfsection name="[data]"/>
-<smbconfoption name="comment">Data</smbconfoption>
-<smbconfoption name="path">/export</smbconfoption>
-<smbconfoption name="force user">jackb</smbconfoption>
-<smbconfoption name="force group">users</smbconfoption>
-<smbconfoption name="read only">No</smbconfoption>
-<smbconfoption name="guest ok">Yes</smbconfoption>
-</smbconfblock>
-</example>
-
-		</sect3>
-
-		<sect3>
-		<title>Anonymous Print Server</title>
-
-		<para>
-		<indexterm><primary>anonymous</primary><secondary>print server</secondary></indexterm>
-		An anonymous print server serves two purposes:
-		</para>
-
-		<itemizedlist>
-			<listitem><para>
-			It allows printing to all printers from a single location.
-			</para></listitem>
-
-			<listitem><para>
-			It reduces network traffic congestion due to many users trying
-			to access a limited number of printers.
-			</para></listitem>
-		</itemizedlist>
-
-		<para>
-		In the simplest of anonymous print servers, it is common to require the installation
-		of the correct printer drivers on the Windows workstation. In this case the print
-		server will be designed to just pass print jobs through to the spooler, and the spooler
-		should be configured to do raw pass-through to the printer. In other words, the print
-		spooler should not filter or process the data stream being passed to the printer.
-		</para>
-
-		<para>
-		In this configuration, it is undesirable to present the Add Printer Wizard, and we do
-		not want to have automatic driver download, so we disable it in the following
-		configuration. <link linkend="anon-print"></link> is the resulting &smb.conf; file.
-		</para>
-
-<example id="anon-print">
-<title>Anonymous Print Server smb.conf</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
-<smbconfoption name="netbios name">LUTHIEN</smbconfoption>
-<smbconfoption name="security">user</smbconfoption>
-<smbconfoption name="printing">cups</smbconfoption>
-
-<smbconfsection name="[printers]"/>
-<smbconfoption name="comment">All Printers</smbconfoption>
-<smbconfoption name="path">/var/spool/samba</smbconfoption>
-<smbconfoption name="guest ok">Yes</smbconfoption>
-<smbconfoption name="printable">Yes</smbconfoption>
-<smbconfoption name="use client driver">Yes</smbconfoption>
-<smbconfoption name="browseable">No</smbconfoption>
-</smbconfblock>
-</example>
-
-		<para>
-		The above configuration is not ideal. It uses no smart features, and it deliberately
-		presents a less than elegant solution. But it is basic, and it does print. Samba makes
-		use of the direct printing application program interface that is provided by CUPS.
-		When Samba has been compiled and linked with the CUPS libraries, the default printing
-		system will be CUPS. By specifying that the printcap name is CUPS, Samba will use
-		the CUPS library API to communicate directly with CUPS for all printer functions.
-		It is possible to force the use of external printing commands by setting the value
-		of the <parameter>printing</parameter> to either SYSV or BSD, and thus the value of
-		the parameter <parameter>printcap name</parameter> must be set to something other than
-		CUPS. In such case, it could be set to the name of any file that contains a list
-		of printers that should be made available to Windows clients.
-		</para>
-
-		<note><para>
-		Windows users will need to install a local printer and then change the print
-		to device after installation of the drivers. The print to device can then be set to
-		the network printer on this machine.
-		</para></note>
-
-		<para>
-		Make sure that the directory <filename>/var/spool/samba</filename> is capable of being used
-		as intended. The following steps must be taken to achieve this:
-		</para>
-
-		<itemizedlist>
-			<listitem><para>
-			The directory must be owned by the superuser (root) user and group:
-<screen>
-&rootprompt;<userinput>chown root.root /var/spool/samba</userinput>
-</screen>
-			</para></listitem>
-
-			<listitem><para>
-			Directory permissions should be set for public read-write with the
-			sticky bit set as shown:
-<screen>
-&rootprompt;<userinput>chmod a+twrx /var/spool/samba</userinput>
-</screen>
-		The purpose of setting the sticky bit is to prevent who does not own the temporary print file
-		from being able to take control of it with the potential for devious misuse.
-			</para></listitem>
-		</itemizedlist>
-
-
-		<note><para>
-		<indexterm><primary>MIME</primary><secondary>raw</secondary></indexterm>
-		<indexterm><primary>raw printing</primary></indexterm>
-		On CUPS-enabled systems there is a facility to pass raw data directly to the printer without
-		intermediate processing via CUPS print filters. Where use of this mode of operation is desired,
-		it is necessary to configure a raw printing device. It is also necessary to enable the raw mime
-		handler in the <filename>/etc/mime.conv</filename> and <filename>/etc/mime.types</filename>
-		files. Refer to <link linkend="cups-raw"></link>.
-		</para></note>
-
-		</sect3>
-
-		<sect3>
-
-		<title>Secure Read-Write File and Print Server</title>
-
-		<para>
-		We progress now from simple systems to a server that is slightly more complex.
-		</para>
-
-		<para>
-		Our new server will require a public data storage area in which only authenticated
-		users (i.e., those with a local account) can store files, as well as a home directory.
-		There will be one printer that should be available for everyone to use.
-		</para>
-
-		<para>
-		In this hypothetical environment (no espionage was conducted to obtain this data),
-		the site is demanding a simple environment that is <emphasis>secure enough</emphasis>
-		but not too difficult to use. 
-		</para>
-
-		<para>
-		Site users will be Jack Baumbach, Mary Orville, and Amed Sehkah. Each will have
-		a password (not shown in further examples). Mary will be the printer administrator and will
-		own all files in the public share.
-		</para>
-
-		<para>
-		This configuration will be based on <emphasis>user-level security</emphasis> that
-		is the default, and for which the default is to store Microsoft Windows-compatible
-		encrypted passwords in a file called <filename>/etc/samba/smbpasswd</filename>.
-		The default &smb.conf; entry that makes this happen is
-		<smbconfoption name="passdb backend">smbpasswd</smbconfoption>. Since this is the default,
-		it is not necessary to enter it into the configuration file.
-		</para>
-
-
-		<procedure>
-		<title>Installing the Secure Office Server</title>
-			<step><para>
-		<indexterm><primary>office server</primary></indexterm>
-			Add all users to the operating system:
-<screen>
-&rootprompt;<userinput>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</userinput>
-&rootprompt;<userinput>useradd -c "Mary Orville" -m -g users -p secret maryo</userinput>
-&rootprompt;<userinput>useradd -c "Amed Sehkah" -m -g users -p secret ameds</userinput>
-</screen>
-			</para></step>
-
-			<step><para>
-			Configure the Samba &smb.conf; file as shown in <link linkend="OfficeServer"/>.
-			</para></step>
-
-<example id="OfficeServer">
-<title>Secure Office Server smb.conf</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
-<smbconfoption name="netbios name">OLORIN</smbconfoption>
-<smbconfoption name="show add printer wizard">No</smbconfoption>
-<smbconfoption name="printing">cups</smbconfoption>
-
-<smbconfsection name="[homes]"/>
-<smbconfoption name="comment">Home Directories</smbconfoption>
-<smbconfoption name="valid users">%S</smbconfoption>
-<smbconfoption name="read only">No</smbconfoption>
-<smbconfoption name="browseable">No</smbconfoption>
-
-<smbconfsection name="[public]"/>
-<smbconfoption name="comment">Data</smbconfoption>
-<smbconfoption name="path">/export</smbconfoption>
-<smbconfoption name="force user">maryo</smbconfoption>
-<smbconfoption name="force group">users</smbconfoption>
-<smbconfoption name="read only">No</smbconfoption>
-
-<smbconfsection name="[printers]"/>
-<smbconfoption name="comment">All Printers</smbconfoption>
-<smbconfoption name="path">/var/spool/samba</smbconfoption>
-<smbconfoption name="create mask">0600</smbconfoption>
-<smbconfoption name="guest ok">Yes</smbconfoption>
-<smbconfoption name="printable">Yes</smbconfoption>
-<smbconfoption name="use client driver">Yes</smbconfoption>
-<smbconfoption name="browseable">No</smbconfoption>
-</smbconfblock>
-</example>
-
-			<step><para>
-			Initialize the Microsoft Windows password database with the new users:
-<screen>
-&rootprompt;<userinput>smbpasswd -a root</userinput>
-New SMB password: <userinput>bigsecret</userinput>
-Reenter smb password: <userinput>bigsecret</userinput>
-Added user root.
-
-&rootprompt;<userinput>smbpasswd -a jackb</userinput>
-New SMB password: <userinput>m0r3pa1n</userinput>
-Retype new SMB password: <userinput>m0r3pa1n</userinput>
-Added user jackb.
-
-&rootprompt;<userinput>smbpasswd -a maryo</userinput>
-New SMB password: <userinput>secret</userinput>
-Reenter smb password: <userinput>secret</userinput>
-Added user maryo.
-
-&rootprompt;<userinput>smbpasswd -a ameds</userinput>
-New SMB password: <userinput>mysecret</userinput>
-Reenter smb password: <userinput>mysecret</userinput>
-Added user ameds.
-</screen>
-			</para></step>
-
-			<step><para>
-			Install printer using the CUPS Web interface. Make certain that all
-			printers that will be shared with Microsoft Windows clients are installed
-			as raw printing devices.
-			</para></step>
-
-			<step><para>
-			Start Samba using the operating system administrative interface.
-			Alternately, this can be done manually by executing:
-			<indexterm><primary>smbd</primary></indexterm>
-			<indexterm><primary>nmbd</primary></indexterm>
-			<indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
-			<indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
-<screen>
-&rootprompt;<userinput> nmbd; smbd;</userinput>
-</screen>
-			Both applications automatically execute as daemons. Those who are paranoid about
-			maintaining control can add the <constant>-D</constant> flag to coerce them to start
-			up in daemon mode.
-			</para></step>
-
-			<step><para>
-			Configure the <filename>/export</filename> directory:
-<screen>
-&rootprompt;<userinput>mkdir /export</userinput>
-&rootprompt;<userinput>chown maryo.users /export</userinput>
-&rootprompt;<userinput>chmod u=rwx,g=rwx,o-rwx /export</userinput>
-</screen>
-			</para></step>
-
-			<step><para>
-			Check that Samba is running correctly:
-<screen>
-&rootprompt;<userinput>smbclient -L localhost -U%</userinput>
-Domain=[MIDEARTH] OS=[UNIX] Server=[Samba-3.0.20]
-
-Sharename      Type      Comment
----------      ----      -------
-public         Disk      Data
-IPC$           IPC       IPC Service (Samba-3.0.20)
-ADMIN$         IPC       IPC Service (Samba-3.0.20)
-hplj4          Printer   hplj4
-
-Server               Comment
----------            -------
-OLORIN               Samba-3.0.20
-
-Workgroup            Master
----------            -------
-MIDEARTH             OLORIN
-</screen>
-			The following error message indicates that Samba was not running:
-<screen>
-&rootprompt; smbclient -L olorin -U%
-Error connecting to 192.168.1.40 (Connection refused)
-Connection to olorin failed
-</screen>
-			</para></step>
-
-			<step><para>
-			Connect to OLORIN as maryo:
-<screen>
-&rootprompt;<userinput>smbclient //olorin/maryo -Umaryo%secret</userinput>
-OS=[UNIX] Server=[Samba-3.0.20]
-smb: \> <userinput>dir</userinput>
-.                              D        0  Sat Jun 21 10:58:16 2003
-..                             D        0  Sat Jun 21 10:54:32 2003
-Documents                      D        0  Fri Apr 25 13:23:58 2003
-DOCWORK                        D        0  Sat Jun 14 15:40:34 2003
-OpenOffice.org                 D        0  Fri Apr 25 13:55:16 2003
-.bashrc                        H     1286  Fri Apr 25 13:23:58 2003
-.netscape6                    DH        0  Fri Apr 25 13:55:13 2003
-.mozilla                      DH        0  Wed Mar  5 11:50:50 2003
-.kermrc                        H      164  Fri Apr 25 13:23:58 2003
-.acrobat                      DH        0  Fri Apr 25 15:41:02 2003
-
-		55817 blocks of size 524288. 34725 blocks available
-smb: \> <userinput>q</userinput>
-</screen>
-			</para></step>
-		</procedure>
-
-			<para>
-			By now you should be getting the hang of configuration basics. Clearly, it is time to
-			explore slightly more complex examples. For the remainder of this chapter we abbreviate
-			instructions, since there are previous examples.
-			</para>
-
-		</sect3>
-
-	</sect2>
-
-	<sect2>
-	<title>Domain Member Server</title>
-
-	<para>
-	<indexterm><primary>Server Type</primary><secondary>Domain Member</secondary></indexterm>
-	In this instance we consider the simplest server configuration we can get away with
-	to make an accounting department happy. Let's be warned, the users are accountants and they
-	do have some nasty demands. There is a budget for only one server for this department.
-	</para>
-
-	<para>
-	The network is managed by an internal Information Services Group (ISG), to which we belong.
-	Internal politics are typical of a medium-sized organization; Human Resources is of the
-	opinion that they run the ISG because they are always adding and disabling users. Also,
-	departmental managers have to fight tooth and nail to gain basic network resources access for
-	their staff. Accounting is different, though, they get exactly what they want. So this should
-	set the scene.
-	</para>
-
-	<para>
-	We use the users from the last example. The accounting department
-	has a general printer that all departmental users may use. There is also a check printer
-	that may be used only by the person who has authority to print checks. The chief financial
-	officer (CFO) wants that printer to be completely restricted and for it to be located in the
-	private storage area in her office. It therefore must be a network printer.
-	</para>
-
-	<para>
-	The accounting department uses an accounting application called <emphasis>SpytFull</emphasis>
-	that must be run from a central application server. The software is licensed to run only off
-	one server, there are no workstation components, and it is run off a mapped share. The data
-	store is in a UNIX-based SQL backend. The UNIX gurus look after that, so this is not our
-	problem.
-	</para>
-
-	<para>
-	The accounting department manager (maryo) wants a general filing system as well as a separate
-	file storage area for form letters (nastygrams). The form letter area should be read-only to
-	all accounting staff except the manager. The general filing system has to have a structured
-	layout with a general area for all staff to store general documents as well as a separate
-	file area for each member of her team that is private to that person, but she wants full
-	access to all areas. Users must have a private home share for personal work-related files
-	and for materials not related to departmental operations.
-	</para>
-	
-		<sect3>
-		<title>Example Configuration</title>
-		
-		<para>
-		The server <emphasis>valinor</emphasis> will be a member server of the company domain.
-		Accounting will have only a local server. User accounts will be on the domain controllers,
-		as will desktop profiles and all network policy files.
-		</para>
-
-		<procedure>
-			<step><para>
-			Do not add users to the UNIX/Linux server; all of this will run off the
-			central domain.
-			</para></step>
-
-			<step><para>
-			Configure &smb.conf; according to <link linkend="fast-member-server">Member server smb.conf
-			(globals)</link> and <link linkend="fast-memberserver-shares">Member server smb.conf (shares
-			and services)</link>.
-			</para></step>
-
-<example id="fast-member-server">
-<title>Member Server smb.conf (Globals)</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
-<smbconfoption name="netbios name">VALINOR</smbconfoption>
-<smbconfoption name="security">DOMAIN</smbconfoption>
-<smbconfoption name="printcap name">cups</smbconfoption>
-<smbconfoption name="disable spoolss">Yes</smbconfoption>
-<smbconfoption name="show add printer wizard">No</smbconfoption>
-<smbconfoption name="idmap uid">15000-20000</smbconfoption>
-<smbconfoption name="idmap gid">15000-20000</smbconfoption>
-<smbconfoption name="winbind use default domain">Yes</smbconfoption>
-<smbconfoption name="printing">cups</smbconfoption>
-</smbconfblock>
-</example>
-
-<example id="fast-memberserver-shares">
-<title>Member Server smb.conf (Shares and Services)</title>
-<smbconfblock>
-<smbconfsection name="[homes]"/>
-<smbconfoption name="comment">Home Directories</smbconfoption>
-<smbconfoption name="valid users">%S</smbconfoption>
-<smbconfoption name="read only">No</smbconfoption>
-<smbconfoption name="browseable">No</smbconfoption>
-
-<smbconfsection name="[spytfull]"/>
-<smbconfoption name="comment">Accounting Application Only</smbconfoption>
-<smbconfoption name="path">/export/spytfull</smbconfoption>
-<smbconfoption name="valid users">@Accounts</smbconfoption>
-<smbconfoption name="admin users">maryo</smbconfoption>
-<smbconfoption name="read only">Yes</smbconfoption>
-
-<smbconfsection name="[public]"/>
-<smbconfoption name="comment">Data</smbconfoption>
-<smbconfoption name="path">/export/public</smbconfoption>
-<smbconfoption name="read only">No</smbconfoption>
-
-<smbconfsection name="[printers]"/>
-<smbconfoption name="comment">All Printers</smbconfoption>
-<smbconfoption name="path">/var/spool/samba</smbconfoption>
-<smbconfoption name="create mask">0600</smbconfoption>
-<smbconfoption name="guest ok">Yes</smbconfoption>
-<smbconfoption name="printable">Yes</smbconfoption>
-<smbconfoption name="use client driver">Yes</smbconfoption>
-<smbconfoption name="browseable">No</smbconfoption>
-</smbconfblock>
-</example>
-
-			<step><para>
-			<indexterm><primary>net</primary><secondary>rpc</secondary></indexterm>
-			Join the domain. Note: Do not start Samba until this step has been completed!
-<screen>
-&rootprompt;<userinput>net rpc join -Uroot%'bigsecret'</userinput>
-Joined domain MIDEARTH.
-</screen>
-			</para></step>
-
-			<step><para>
-			Make absolutely certain that you disable (shut down) the <command>nscd</command>
-			daemon on any system on which <command>winbind</command> is configured to run.
-			</para></step>
-
-			<step><para>
-			Start Samba following the normal method for your operating system platform.
-			If you wish to do this manually, execute as root:
-			<indexterm><primary>smbd</primary></indexterm>
-			<indexterm><primary>nmbd</primary></indexterm>
-			<indexterm><primary>winbindd</primary></indexterm>
-			<indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
-			<indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
-			<indexterm><primary>starting samba</primary><secondary>winbindd</secondary></indexterm>
-<screen>
-&rootprompt;<userinput>nmbd; smbd; winbindd;</userinput>
-</screen>
-			</para></step>
-
-			<step><para>
-			Configure the name service switch (NSS) control file on your system to resolve user and group names
-			via winbind. Edit the following lines in <filename>/etc/nsswitch.conf</filename>:
-<programlisting>
-passwd: files winbind
-group:  files winbind
-hosts:  files dns winbind
-</programlisting>
-			</para></step>
-
-			<step><para>
-			Set the password for <command>wbinfo</command> to use:
-<screen>
-&rootprompt;<userinput>wbinfo --set-auth-user=root%'bigsecret'</userinput>
-</screen>
-			</para></step>
-
-			<step><para>
-			Validate that domain user and group credentials can be correctly resolved by executing:
-<screen>
-&rootprompt;<userinput>wbinfo -u</userinput>
-MIDEARTH\maryo
-MIDEARTH\jackb
-MIDEARTH\ameds
-...
-MIDEARTH\root
-
-&rootprompt;<userinput>wbinfo -g</userinput>
-MIDEARTH\Domain Users
-MIDEARTH\Domain Admins
-MIDEARTH\Domain Guests
-...
-MIDEARTH\Accounts
-</screen>
-			</para></step>
-
-			<step><para>
-			Check that <command>winbind</command> is working. The following demonstrates correct
-			username resolution via the <command>getent</command> system utility:
-<screen>
-&rootprompt;<userinput>getent passwd maryo</userinput>
-maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false
-</screen>
-			</para></step>
-
-			<step><para>
-			A final test that we have this under control might be reassuring:
-<screen>
-&rootprompt;<userinput>touch /export/a_file</userinput>
-&rootprompt;<userinput>chown maryo /export/a_file</userinput>
-&rootprompt;<userinput>ls -al /export/a_file</userinput>
-...
--rw-r--r--    1 maryo    users       11234 Jun 21 15:32 a_file
-...
-
-&rootprompt;<userinput>rm /export/a_file</userinput>
-</screen>
-			</para></step>
-
-			<step><para>
-			Configuration is now mostly complete, so this is an opportune time
-			to configure the directory structure for this site:
-<screen>
-&rootprompt;<userinput>mkdir -p /export/{spytfull,public}</userinput>
-&rootprompt;<userinput>chmod ug=rwxS,o=x /export/{spytfull,public}</userinput>
-&rootprompt;<userinput>chown maryo.Accounts /export/{spytfull,public}</userinput>
-</screen>
-			</para></step>
-		</procedure>
-
-		</sect3>
-
-	</sect2>
-
-	<sect2>
-	<title>Domain Controller</title>
-
-
-	<para>
-	<indexterm><primary>Server Type</primary><secondary>Domain Controller</secondary></indexterm>
-	For the remainder of this chapter the focus is on the configuration of domain control.
-	The examples that follow are for two implementation strategies. Remember, our objective is
-	to create a simple but working solution. The remainder of this book should help to highlight
-	opportunity for greater functionality and the complexity that goes with it.
-	</para>
-
-	<para>
-	A domain controller configuration can be achieved with a simple configuration using the new
-	tdbsam password backend. This type of configuration is good for small
-	offices, but has limited scalability (cannot be replicated), and performance can be expected
-	to fall as the size and complexity of the domain increases.
-	</para>
-
-	<para>
-	The use of tdbsam is best limited to sites that do not need
-	more than a Primary Domain Controller (PDC). As the size of a domain grows the need
-	for additional domain controllers becomes apparent. Do not attempt to under-resource
-	a Microsoft Windows network environment; domain controllers provide essential
-	authentication services. The following are symptoms of an under-resourced domain control
-	environment:
-	</para>
-
-	<itemizedlist>	
-		<listitem><para>
-		 Domain logons intermittently fail.
-		</para></listitem>
-
-		<listitem><para>
-		File access on a domain member server intermittently fails, giving a permission denied
-		error message.
-		</para></listitem>
-	</itemizedlist>
-
-	<para>
-	A more scalable domain control authentication backend option might use
-	Microsoft Active Directory or an LDAP-based backend. Samba-3 provides
-	for both options as a domain member server. As a PDC, Samba-3 is not able to provide
-	an exact alternative to the functionality that is available with Active Directory.
-	Samba-3 can provide a scalable LDAP-based PDC/BDC solution.
-	</para>
-
-	<para>
-	The tdbsam authentication backend provides no facility to replicate
-	the contents of the database, except by external means (i.e., there is no self-contained protocol
-	in Samba-3 for Security Account Manager database [SAM] replication).
-	</para>
-
-	<note><para>
-	If you need more than one domain controller, do not use a tdbsam authentication backend.
-	</para></note>
-
-		<sect3>
-		<title>Example: Engineering Office</title>
-
-		<para>
-		The engineering office network server we present here is designed to demonstrate use
-		of the new tdbsam password backend. The tdbsam
-		facility is new to Samba-3. It is designed to provide many user and machine account controls
-		that are possible with Microsoft Windows NT4. It is safe to use this in smaller networks.
-		</para>
-
-		<procedure>
-			<step><para>
-			A working PDC configuration using the tdbsam
-			password backend can be found in <link linkend="fast-engoffice-global">Engineering Office smb.conf
-			(globals)</link> together with <link linkend="fast-engoffice-shares">Engineering Office smb.conf
-			(shares and services)</link>:
-			<indexterm><primary>pdbedit</primary></indexterm>
-			</para></step>
-
-<example id="fast-engoffice-global">
-<title>Engineering Office smb.conf (globals)</title>
-<smbconfblock>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
-<smbconfoption name="netbios name">FRODO</smbconfoption>
-<smbconfoption name="passdb backend">tdbsam</smbconfoption>
-<smbconfoption name="printcap name">cups</smbconfoption>
-<smbconfoption name="add user script">/usr/sbin/useradd -m %u</smbconfoption>
-<smbconfoption name="delete user script">/usr/sbin/userdel -r %u</smbconfoption>
-<smbconfoption name="add group script">/usr/sbin/groupadd %g</smbconfoption>
-<smbconfoption name="delete group script">/usr/sbin/groupdel %g</smbconfoption>
-<smbconfoption name="add user to group script">/usr/sbin/groupmod -A %u %g</smbconfoption>
-<smbconfoption name="delete user from group script">/usr/sbin/groupmod -R %u %g</smbconfoption>
-<smbconfoption name="add machine script">/usr/sbin/useradd -s /bin/false -d /var/lib/nobody %u</smbconfoption>
-<smbconfcomment>Note: The following specifies the default logon script.</smbconfcomment>
-<smbconfcomment>Per user logon scripts can be specified in the user account using pdbedit </smbconfcomment>
-<smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
-<smbconfcomment>This sets the default profile path. Set per user paths with pdbedit</smbconfcomment>
-<smbconfoption name="logon path">\\%L\Profiles\%U</smbconfoption>
-<smbconfoption name="logon drive">H:</smbconfoption>
-<smbconfoption name="logon home">\\%L\%U</smbconfoption>
-<smbconfoption name="domain logons">Yes</smbconfoption>
-<smbconfoption name="os level">35</smbconfoption>
-<smbconfoption name="preferred master">Yes</smbconfoption>
-<smbconfoption name="domain master">Yes</smbconfoption>
-<smbconfoption name="idmap uid">15000-20000</smbconfoption>
-<smbconfoption name="idmap gid">15000-20000</smbconfoption>
-<smbconfoption name="printing">cups</smbconfoption>
-</smbconfblock>
-</example>
-
-<example id="fast-engoffice-shares">
-<title>Engineering Office smb.conf (shares and services)</title>
-<smbconfblock>
-<smbconfsection name="[homes]"/>
-<smbconfoption name="comment">Home Directories</smbconfoption>
-<smbconfoption name="valid users">%S</smbconfoption>
-<smbconfoption name="read only">No</smbconfoption>
-<smbconfoption name="browseable">No</smbconfoption>
-
-<smbconfcomment>Printing auto-share (makes printers available thru CUPS)</smbconfcomment>
-<smbconfsection name="[printers]"/>
-<smbconfoption name="comment">All Printers</smbconfoption>
-<smbconfoption name="path">/var/spool/samba</smbconfoption>
-<smbconfoption name="create mask">0600</smbconfoption>
-<smbconfoption name="guest ok">Yes</smbconfoption>
-<smbconfoption name="printable">Yes</smbconfoption>
-<smbconfoption name="browseable">No</smbconfoption>
-
-<smbconfsection name="[print$]"/>
-<smbconfoption name="comment">Printer Drivers Share</smbconfoption>
-<smbconfoption name="path">/var/lib/samba/drivers</smbconfoption>
-<smbconfoption name="write list">maryo, root</smbconfoption>
-
-<smbconfcomment>Needed to support domain logons</smbconfcomment>
-<smbconfsection name="[netlogon]"/>
-<smbconfoption name="comment">Network Logon Service</smbconfoption>
-<smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption>
-<smbconfoption name="admin users">root, maryo</smbconfoption>
-<smbconfoption name="guest ok">Yes</smbconfoption>
-<smbconfoption name="browseable">No</smbconfoption>
-
-<smbconfcomment>For profiles to work, create a user directory under the path</smbconfcomment>
-<smbconfcomment> shown. i.e., mkdir -p /var/lib/samba/profiles/maryo</smbconfcomment>
-<smbconfsection name="[Profiles]"/>
-<smbconfoption name="comment">Roaming Profile Share</smbconfoption>
-<smbconfoption name="path">/var/lib/samba/profiles</smbconfoption>
-<smbconfoption name="read only">No</smbconfoption>
-<smbconfoption name="profile acls">Yes</smbconfoption>
-
-<smbconfcomment>Other resource (share/printer) definitions would follow below.</smbconfcomment>
-</smbconfblock>
-</example>
-
-			<step><para>
-			Create UNIX group accounts as needed using a suitable operating system tool:
-<screen>
-&rootprompt;<userinput>groupadd ntadmins</userinput>
-&rootprompt;<userinput>groupadd designers</userinput>
-&rootprompt;<userinput>groupadd engineers</userinput>
-&rootprompt;<userinput>groupadd qateam</userinput>
-</screen>
-			</para></step>
-
-			<step><para>
-			Create user accounts on the system using the appropriate tool
-			provided with the operating system. Make sure all user home directories
-			are created also. Add users to groups as required for access control
-			on files, directories, printers, and as required for use in the Samba
-			environment.
-			</para></step>
-
-
-			<step><para>
-			<indexterm><primary>net</primary><secondary>groupmap</secondary></indexterm>
-			<indexterm><primary>initGroups.sh</primary></indexterm>
-			Assign each of the UNIX groups to NT groups by executing this shell script
-			(You could name the script <filename>initGroups.sh</filename>):
-<screen>
-#!/bin/bash
-#### Keep this as a shell script for future re-use
-			
-# First assign well known groups
-net groupmap add ntgroup="Domain Admins" unixgroup=ntadmins rid=512 type=d
-net groupmap add ntgroup="Domain Users"  unixgroup=users rid=513 type=
-net groupmap add ntgroup="Domain Guests" unixgroup=nobody rid=514 type=d
-
-# Now for our added Domain Groups
-net groupmap add ntgroup="Designers" unixgroup=designers type=d
-net groupmap add ntgroup="Engineers" unixgroup=engineers type=d
-net groupmap add ntgroup="QA Team"   unixgroup=qateam    type=d
-</screen>
-			</para></step>
-
-			<step><para>
-			Create the <filename>scripts</filename> directory for use in the 
-			<smbconfsection name="[NETLOGON]"/> share:
-<screen>
-&rootprompt;<userinput>mkdir -p /var/lib/samba/netlogon/scripts</userinput>
-</screen>
-			Place the logon scripts that will be used (batch or cmd scripts)
-			in this directory.
-			</para></step>
-		</procedure>
-
-		<para>
-		The above configuration provides a functional PDC
-		system to which must be added file shares and printers as required.
-		</para>
-
-		</sect3>
-
-		<sect3>
-		<title>A Big Organization</title>
-
-		<para>
-		In this section we finally get to review in brief a Samba-3 configuration that
-		uses a Lightweight Directory Access (LDAP)-based authentication backend. The
-		main reasons for this choice are to provide the ability to host primary
-		and Backup Domain Control (BDC), as well as to enable a higher degree of
-		scalability to meet the needs of a very distributed environment.
-		</para>
-
-			<sect4>
-			<title>The Primary Domain Controller</title>
-
-			<para>
-			This is an example of a minimal configuration to run a Samba-3 PDC
-			using an LDAP authentication backend. It is assumed that the operating system
-			has been correctly configured.
-			</para>
-
-			<para>
-			The Idealx scripts (or equivalent) are needed to manage LDAP-based POSIX and/or
-			SambaSamAccounts. The Idealx scripts may be downloaded from the <ulink url="http://www.idealx.org">
-			Idealx</ulink> Web site. They may also be obtained from the Samba tarball. Linux
-			distributions tend to install the Idealx scripts in the 
-			<filename>/usr/share/doc/packages/sambaXXXXXX/examples/LDAP/smbldap-tools</filename> directory.
-			Idealx scripts version <constant>smbldap-tools-0.9.1</constant> are known to work well.
-			</para>
-
-			<procedure>
-				<step><para>
-				Obtain from the Samba sources <filename>~/examples/LDAP/samba.schema</filename>
-				and copy it to the <filename>/etc/openldap/schema/</filename> directory.
-				</para></step>
-
-				<step><para>
-				Set up the LDAP server. This example is suitable for OpenLDAP 2.1.x.
-				The <filename>/etc/openldap/slapd.conf</filename> file.
-				<indexterm><primary>/etc/openldap/slapd.conf</primary></indexterm>
-<title>Example slapd.conf File</title>
-<screen>
-# Note commented out lines have been removed
-include         /etc/openldap/schema/core.schema
-include         /etc/openldap/schema/cosine.schema
-include         /etc/openldap/schema/inetorgperson.schema
-include         /etc/openldap/schema/nis.schema
-include         /etc/openldap/schema/samba.schema
-
-pidfile         /var/run/slapd/slapd.pid
-argsfile        /var/run/slapd/slapd.args
-
-database        bdb
-suffix          "dc=quenya,dc=org"
-rootdn          "cn=Manager,dc=quenya,dc=org"
-rootpw          {SSHA}06qDkonA8hk6W6SSnRzWj0/pBcU3m0/P
-# The password for the above is 'nastyon3'
-
-directory     /var/lib/ldap
-
-index   objectClass     eq
-index cn                      pres,sub,eq
-index sn                      pres,sub,eq
-index uid                     pres,sub,eq
-index displayName             pres,sub,eq
-index uidNumber               eq
-index gidNumber               eq
-index memberUid               eq
-index   sambaSID              eq
-index   sambaPrimaryGroupSID  eq
-index   sambaDomainName       eq
-index   default               sub
-</screen>
-				</para></step>
-
-				<step><para>
-				Create the following file <filename>initdb.ldif</filename>:
-				<indexterm><primary>initdb.ldif</primary></indexterm>
-<programlisting>
-# Organization for SambaXP Demo
-dn: dc=quenya,dc=org
-objectclass: dcObject
-objectclass: organization
-dc: quenya
-o: SambaXP Demo
-description: The SambaXP Demo LDAP Tree
-
-# Organizational Role for Directory Management
-dn: cn=Manager,dc=quenya,dc=org
-objectclass: organizationalRole
-cn: Manager
-description: Directory Manager
-
-# Setting up the container for users
-dn: ou=People, dc=quenya, dc=org
-objectclass: top
-objectclass: organizationalUnit
-ou: People
-
-# Set up an admin handle for People OU
-dn: cn=admin, ou=People, dc=quenya, dc=org
-cn: admin
-objectclass: top
-objectclass: organizationalRole
-objectclass: simpleSecurityObject
-userPassword: {SSHA}0jBHgQ1vp4EDX2rEMMfIudvRMJoGwjVb
-# The password for above is 'mordonL8'
-</programlisting>
-				</para></step>
-
-				<step><para>
-				Load the initial data above into the LDAP database:
-<screen>
-&rootprompt;<userinput>slapadd -v -l initdb.ldif</userinput>
-</screen>
-				</para></step>
-
-				<step><para>
-				Start the LDAP server using the appropriate tool or method for
-				the operating system platform on which it is installed.
-				</para></step>
-
-				<step><para>
-				Install the Idealx script files in the <filename>/usr/local/sbin</filename> directory,
-				then configure the smbldap_conf.pm file to match your system configuration.
-				</para></step>
-
-				<step><para>
-				The &smb.conf; file that drives this backend can be found in example <link
-				linkend="fast-ldap">LDAP backend smb.conf for PDC</link>. Add additional stanzas
-				as required.
-				</para></step>
-
-<example id="fast-ldap">
-<title>LDAP backend smb.conf for PDC</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
-<smbconfoption name="netbios name">FRODO</smbconfoption>
-<smbconfoption name="passdb backend">ldapsam:ldap://localhost</smbconfoption>
-<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
-<smbconfoption name="printcap name">cups</smbconfoption>
-<smbconfoption name="add user script">/usr/local/sbin/smbldap-useradd -m '%u'</smbconfoption>
-<smbconfoption name="delete user script">/usr/local/sbin/smbldap-userdel %u</smbconfoption>
-<smbconfoption name="add group script">/usr/local/sbin/smbldap-groupadd -p '%g'</smbconfoption>
-<smbconfoption name="delete group script">/usr/local/sbin/smbldap-groupdel '%g'</smbconfoption>
-<smbconfoption name="add user to group script">/usr/local/sbin/smbldap-groupmod -m '%u' '%g'</smbconfoption>
-<smbconfoption name="delete user from group script">/usr/local/sbin/smbldap-groupmod -x '%u' '%g'</smbconfoption>
-<smbconfoption name="set primary group script">/usr/local/sbin/smbldap-usermod -g '%g' '%u'</smbconfoption>
-<smbconfoption name="add machine script">/usr/local/sbin/smbldap-useradd -w '%u'</smbconfoption>
-<smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
-<smbconfoption name="logon path">\\%L\Profiles\%U</smbconfoption>
-<smbconfoption name="logon drive">H:</smbconfoption>
-<smbconfoption name="logon home">\\%L\%U</smbconfoption>
-<smbconfoption name="domain logons">Yes</smbconfoption>
-<smbconfoption name="os level">35</smbconfoption>
-<smbconfoption name="preferred master">Yes</smbconfoption>
-<smbconfoption name="domain master">Yes</smbconfoption>
-<smbconfoption name="ldap suffix">dc=quenya,dc=org</smbconfoption>
-<smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
-<smbconfoption name="ldap user suffix">ou=People</smbconfoption>
-<smbconfoption name="ldap group suffix">ou=People</smbconfoption>
-<smbconfoption name="ldap idmap suffix">ou=People</smbconfoption>
-<smbconfoption name="ldap admin dn">cn=Manager,dc=quenya,dc=org</smbconfoption>
-<smbconfoption name="ldap ssl">no</smbconfoption>
-<smbconfoption name="ldap passwd sync">Yes</smbconfoption>
-<smbconfoption name="idmap uid">15000-20000</smbconfoption>
-<smbconfoption name="idmap gid">15000-20000</smbconfoption>
-<smbconfoption name="printing">cups</smbconfoption>
-</smbconfblock>
-</example>
-
-				<step><para>
-				Add the LDAP password to the <filename>secrets.tdb</filename> file so Samba can update
-				the LDAP database:
-<screen>
-&rootprompt;<userinput>smbpasswd -w mordonL8</userinput>
-</screen>
-				</para></step>
-
-				<step><para>
-				Add users and groups as required. Users and groups added using Samba tools
-				will automatically be added to both the LDAP backend and the operating
-				system as required.
-				</para></step>
-
-			</procedure>
-
-			</sect4>
-
-			<sect4>
-			<title>Backup Domain Controller</title>
-
-			<para>
-			<link linkend="fast-bdc"/> shows the example configuration for the BDC. Note that
-			the &smb.conf; file does not specify the smbldap-tools scripts &smbmdash; they are
-			not needed on a BDC. Add additional stanzas for shares and printers as required.
-			</para>
-
-			<procedure>
-				<step><para>
-				Decide if the BDC should have its own LDAP server or not. If the BDC is to be
-				the LDAP server, change the following &smb.conf; as indicated. The default
-				configuration in <link linkend="fast-bdc">Remote LDAP BDC smb.conf</link>
-				uses a central LDAP server.
-				</para></step>
-
-<example id="fast-bdc">
-<title>Remote LDAP BDC smb.conf</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">MIDEARTH</smbconfoption>
-<smbconfoption name="netbios name">GANDALF</smbconfoption>
-<smbconfoption name="passdb backend">ldapsam:ldap://frodo.quenya.org</smbconfoption>
-<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
-<smbconfoption name="printcap name">cups</smbconfoption>
-<smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
-<smbconfoption name="logon path">\\%L\Profiles\%U</smbconfoption>
-<smbconfoption name="logon drive">H:</smbconfoption>
-<smbconfoption name="logon home">\\%L\%U</smbconfoption>
-<smbconfoption name="domain logons">Yes</smbconfoption>
-<smbconfoption name="os level">33</smbconfoption>
-<smbconfoption name="preferred master">Yes</smbconfoption>
-<smbconfoption name="domain master">No</smbconfoption>
-<smbconfoption name="ldap suffix">dc=quenya,dc=org</smbconfoption>
-<smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
-<smbconfoption name="ldap user suffix">ou=People</smbconfoption>
-<smbconfoption name="ldap group suffix">ou=People</smbconfoption>
-<smbconfoption name="ldap idmap suffix">ou=People</smbconfoption>
-<smbconfoption name="ldap admin dn">cn=Manager,dc=quenya,dc=org</smbconfoption>
-<smbconfoption name="ldap ssl">no</smbconfoption>
-<smbconfoption name="ldap passwd sync">Yes</smbconfoption>
-<smbconfoption name="idmap uid">15000-20000</smbconfoption>
-<smbconfoption name="idmap gid">15000-20000</smbconfoption>
-<smbconfoption name="printing">cups</smbconfoption>
-</smbconfblock>
-</example>
-
-				<step><para>
-				Configure the NETLOGON and PROFILES directory as for the PDC in <link linkend="fast-bdc"/>.
-				</para></step>
-			</procedure>
-
-			</sect4>
-
-		</sect3>
-
-	</sect2>
-
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-Further-Resources.xml b/docs-xml/Samba3-HOWTO/TOSHARG-Further-Resources.xml
deleted file mode 100644
index 0a9d7d1..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-Further-Resources.xml
+++ /dev/null
@@ -1,174 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="Further-Resources">
-<chapterinfo>
-	&author.jelmer;
-	<pubdate>May 1, 2003</pubdate>
-</chapterinfo>
-
-<title>Further Resources</title>
-
-<sect1>
-	<title>Web sites</title>
-
-<itemizedlist>
-
-	<listitem><para>
-	<ulink url="http://hr.uoregon.edu/davidrl/cifs.txt">
-	<emphasis>CIFS: Common Insecurities Fail Scrutiny</emphasis> by <quote>Hobbit</quote></ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://afr.com/it/2002/10/01/FFXDF43AP6D.html">
-	<emphasis>Doing the Samba on Windows</emphasis> by Financial Review
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://ubiqx.org/cifs/">
-	<emphasis>Implementing CIFS</emphasis> by Christopher R. Hertel
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://samba.anu.edu.au/cifs/docs/what-is-smb.html">
-	<emphasis>Just What Is SMB?</emphasis> by Richard Sharpe
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://www.linux-mag.com/1999-05/samba_01.html">
-	<emphasis>Opening Windows Everywhere</emphasis> by Mike Warfield
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://www.tldp.org/HOWTO/SMB-HOWTO.html">
-	<emphasis>SMB HOWTO</emphasis> by David Wood
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://www.phrack.org/phrack/60/p60-0x0b.txt">
-	<emphasis>SMB/CIFS by The Root</emphasis> by <quote>ledin</quote>
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://www.linux-mag.com/1999-09/samba_01.html">
-	<emphasis>The Story of Samba</emphasis> by Christopher R. Hertel
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://hr.uoregon.edu/davidrl/samba/">
-	<emphasis>The Unofficial Samba HOWTO</emphasis> by David Lechnyr
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://www.linux-mag.com/2001-05/smb_01.html">
-	<emphasis>Understanding the Network Neighborhood</emphasis> by Christopher R. Hertel
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://www.linux-mag.com/2002-02/samba_01.html">
-	<emphasis>Using Samba as a PDC</emphasis> by Andrew Bartlett
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://ru.samba.org/samba/ftp/docs/Samba24Hc13.pdf">
-	<emphasis>PDF version of the Troubleshooting Techniques chapter</emphasis>
-	from the second edition of Sam's Teach Yourself Samba in 24 Hours
-	(publishing date of Dec. 12, 2001)</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://ru.samba.org/samba/ftp/slides/">
-	<emphasis>Slide presentations</emphasis> by Samba Team members
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html">
-	<emphasis>Introduction to Samba-3.0</emphasis> by Motonobu Takahashi 
-	(written in Japanese). </ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://www.linux-mag.com/2001-05/smb_01.html">
-	<emphasis>Understanding the Network Neighborhood</emphasis>, by team member
-	Chris Hertel. This article appeared in the May 2001 issue of 
-	Linux Magazine. 
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="ftp://ftp.stratus.com/pub/vos/customers/samba/">
-	<emphasis>Samba 2.0.x Troubleshooting guide</emphasis> from Paul Green
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://samba.org/samba/docs/10years.html">
-	<emphasis>Ten Years of Samba</emphasis>
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://tldp.org/HOWTO/Samba-Authenticated-Gateway-HOWTO.html">
-		<emphasis>Samba Authenticated Gateway HOWTO</emphasis>
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://samba.org/samba/docs/SambaIntro.html">
-		<emphasis>An Introduction to Samba</emphasis>
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://www.samba.org/cifs/">
-		<emphasis>What is CIFS?</emphasis>
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://support.microsoft.com/support/kb/articles/q92/5/88.asp">
-		<emphasis>WFWG: Password Caching and How It Affects LAN Manager
-			Security</emphasis> at Microsoft Knowledge Base
-	</ulink>
-	</para></listitem>
-
-</itemizedlist>
-
-</sect1>
-
-<sect1>
-	<title>Related updates from Microsoft</title>
-
-<itemizedlist>
-	<listitem><para>
-	<ulink url="http://support.microsoft.com/support/kb/articles/q92/5/88.asp">
-		<emphasis>Enhanced Encryption for Windows 95 Password Cache</emphasis> 
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://support.microsoft.com/support/kb/articles/q136/4/18.asp">
-		<emphasis>Windows '95 File Sharing Updates</emphasis>
-	</ulink>
-	</para></listitem>
-
-	<listitem><para>
-	<ulink url="http://support.microsoft.com/support/kb/articles/q136/4/18.asp">
-		<emphasis>Windows for Workgroups Sharing Updates</emphasis>
-	</ulink>
-	</para></listitem>
-
-</itemizedlist>
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-Group-Mapping.xml b/docs-xml/Samba3-HOWTO/TOSHARG-Group-Mapping.xml
deleted file mode 100644
index e2a0abc..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-Group-Mapping.xml
+++ /dev/null
@@ -1,920 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="groupmapping">
-<chapterinfo>
-	&author.jht;
-	<author>
-		<firstname>Jean François</firstname><surname>Micouleau</surname>
-	</author>
-	&author.jerry;
-</chapterinfo>
-<title>Group Mapping: MS Windows and UNIX</title>
-
-
-	<para>
-<indexterm significance="preferred"><primary>groups</primary><secondary>mapping</secondary></indexterm>
-<indexterm><primary>SID</primary></indexterm>
-<indexterm><primary>associations</primary></indexterm>
-<indexterm><primary>UNIX groups</primary></indexterm>
-<indexterm><primary>groupmap</primary></indexterm>
-<indexterm><primary>net</primary></indexterm>
-	Starting with Samba-3, new group mapping functionality is available to create associations
-	between Windows group SIDs and UNIX group GIDs. The <command>groupmap</command> subcommand
-	included with the &net; tool can be used to manage these associations.
-	</para>
-
-	<para>
-<indexterm><primary>group mapping</primary></indexterm>
-<indexterm><primary>domain groups</primary></indexterm>
-	The new facility for mapping NT groups to UNIX system groups allows the administrator to decide
-	which NT domain groups are to be exposed to MS Windows clients. Only those NT groups that map
-	to a UNIX group that has a value other than the default (<constant>-1</constant>) will be exposed
-	in group selection lists in tools that access domain users and groups.
-	</para>
-
-	<warning>
-	<para>
-	<indexterm><primary>domain admin group</primary></indexterm>
-<indexterm><primary>Windows group</primary></indexterm>
-	The <parameter>domain admin group</parameter> parameter has been removed in Samba-3 and should no longer
-	be specified in &smb.conf;. In Samba-2.2.x, this parameter was used to give the listed users membership in the
-	<constant>Domain Admins</constant> Windows group, which gave local admin rights on their workstations
-	(in default configurations).
-	</para>
-	</warning>
-
-<sect1>
-<title>Features and Benefits</title>
-
-	<para>
-	Samba allows the administrator to create MS Windows NT4/200x group accounts and to
-	arbitrarily associate them with UNIX/Linux group accounts.
-	</para>
-
-	<para>
-	<indexterm><primary>UID</primary></indexterm>
-	<indexterm><primary>GID</primary></indexterm>
-	<indexterm><primary>idmap uid</primary></indexterm>
-<indexterm><primary>MMC</primary></indexterm>
-<indexterm><primary>winbindd</primary></indexterm>
-<indexterm><primary>ID range</primary></indexterm>
-<indexterm><primary>group accounts</primary></indexterm>
-	Group accounts can be managed using the MS Windows NT4 or MS Windows 200x/XP Professional MMC tools.
-	Appropriate interface scripts should be provided in &smb.conf; if it is desired that UNIX/Linux system
-	accounts should be automatically created when these tools are used. In the absence of these scripts, and
-	so long as <command>winbindd</command> is running, Samba group accounts that are created using these
-	tools will be allocated UNIX UIDs and GIDs from the ID range specified by the
-	<smbconfoption name="idmap uid"/>/<smbconfoption name="idmap gid"/>
-	parameters in the &smb.conf; file.
-	</para>
-
-	<figure id="idmap-sid2gid">
-		<title>IDMAP: Group SID-to-GID Resolution.</title>
-		<imagefile scale="50">idmap-sid2gid</imagefile>
-	</figure>
-
-	<figure id="idmap-gid2sid">
-		<title>IDMAP: GID Resolution to Matching SID.</title>
-	<imagefile scale="50">idmap-gid2sid</imagefile>
-	</figure>
-
-	<para>
-	<indexterm><primary>IDMAP</primary></indexterm>
-<indexterm><primary>SID-to-GID</primary></indexterm>
-<indexterm><primary>net</primary><secondary>groupmap</secondary></indexterm>
-<indexterm><primary>group mappings</primary></indexterm>
-	In both cases, when winbindd is not running, only locally resolvable groups can be recognized. Please refer to
-	<link linkend="idmap-sid2gid">IDMAP: Group SID-to-GID Resolution</link> and <link
-	linkend="idmap-gid2sid">IDMAP: GID Resolution to Matching SID</link>.  The <command>net groupmap</command> is
-	used to establish UNIX group to NT SID mappings as shown in <link linkend="idmap-store-gid2sid">IDMAP: storing
-	group mappings</link>.
-	</para>
-
-	<figure id="idmap-store-gid2sid">
-		<title>IDMAP Storing Group Mappings.</title>
-		<imagefile scale="50">idmap-store-gid2sid</imagefile>
-	</figure>
-
-	<para>
-	<indexterm><primary>groupadd</primary></indexterm>
-	<indexterm><primary>groupdel</primary></indexterm>
-<indexterm><primary>shadow utilities</primary></indexterm>
-<indexterm><primary>groupmod</primary></indexterm>
-	Administrators should be aware that where &smb.conf; group interface scripts make
-	direct calls to the UNIX/Linux system tools (the shadow utilities, <command>groupadd</command>,
-	<command>groupdel</command>, and <command>groupmod</command>), the resulting UNIX/Linux group names will be subject
-	to any limits imposed by these tools. If the tool does not allow uppercase characters
-	or space characters, then the creation of an MS Windows NT4/200x-style group of
-	<literal>Engineering Managers</literal> will attempt to create an identically named
-	UNIX/Linux group, an attempt that will of course fail.
-	</para>
-
-	<para>
-	<indexterm><primary>GID</primary></indexterm>
-	<indexterm><primary>SID</primary></indexterm>
-	There are several possible workarounds for the operating system tools limitation. One
-	method is to use a script that generates a name for the UNIX/Linux system group that
-	fits the operating system limits and that then just passes the UNIX/Linux group ID (GID)
-	back to the calling Samba interface. This will provide a dynamic workaround solution.
-	</para>
-
-	<para>
-<indexterm><primary>net</primary><secondary>groupmap</secondary></indexterm>
-	Another workaround is to manually create a UNIX/Linux group, then manually create the
-	MS Windows NT4/200x group on the Samba server, and then use the <command>net groupmap</command>
-	tool to connect the two to each other.
-	</para>
-
-</sect1>
-
-<sect1>
-<title>Discussion</title>
-
-	<para>
-<indexterm><primary>Windows NT4/200x</primary></indexterm>
-<indexterm><primary>group privileges</primary></indexterm>
-	When you install <application>MS Windows NT4/200x</application> on a computer, the installation
-	program creates default users and groups, notably the <constant>Administrators</constant> group,
-	and gives that group privileges necessary to perform essential system tasks,
-	such as the ability to change the date and time or to kill (or close) any process running on the
-	local machine.
-	</para>
-	
-	<para>
-	<indexterm><primary>Administrator</primary></indexterm>
-	The <constant>Administrator</constant> user is a member of the <constant>Administrators</constant> group, and thus inherits
-	<constant>Administrators</constant> group privileges. If a <constant>joe</constant> user is created to be a member of the
-	<constant>Administrators</constant> group, <constant>joe</constant> has exactly the same rights as the user
-	<constant>Administrator</constant>.
-	</para>
-
-	<para>
-<indexterm><primary>domain member</primary></indexterm>
-<indexterm><primary>Domain Admins</primary></indexterm>
-<indexterm><primary>inherits rights</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-	When an MS Windows NT4/200x/XP machine is made a domain member, the <quote>Domain Admins</quote> group of the
-	PDC is added to the local <constant>Administrators</constant> group of the workstation. Every member of the
-	<constant>Domain Admins</constant> group inherits the rights of the local <constant>Administrators</constant> group when
-	logging on the workstation.
-	</para>
-
-	<para>
-<indexterm><primary>Domain Admins</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-	The following steps describe how to make Samba PDC users members of the <constant>Domain Admins</constant> group.
-	</para>
-
-	<orderedlist>
-		<listitem><para>
-		Create a UNIX group (usually in <filename>/etc/group</filename>); let's call it <constant>domadm</constant>.
-		</para></listitem>
-
-		<listitem><para>
-<indexterm><primary>/etc/group</primary></indexterm>
-		Add to this group the users that must be <quote>Administrators</quote>. For example,
-		if you want <constant>joe, john</constant>, and <constant>mary</constant> to be administrators,
-		your entry in <filename>/etc/group</filename> will look like this:
-		</para>
-
-		<para><programlisting>
-		domadm:x:502:joe,john,mary
-		</programlisting>
-		</para></listitem>
-
-		<listitem><para>
-		Map this domadm group to the <quote>Domain Admins</quote> group by executing the command:
-		</para>
-
-		<para>
-<screen>
-&rootprompt;<userinput>net groupmap add ntgroup="Domain Admins" unixgroup=domadm rid=512 type=d</userinput>
-</screen>
-		</para>
-		
-		<para>
-		<indexterm><primary>Domain Admins group</primary></indexterm>
-		The quotes around <quote>Domain Admins</quote> are necessary due to the space in the group name.
-		Also make sure to leave no white space surrounding the equal character (=).
-		</para></listitem>
-	</orderedlist>
-
-	<para>
-	Now <constant>joe, john</constant>, and <constant>mary</constant> are domain administrators.
-	</para>
-
-	<para>
-	<indexterm><primary>groups</primary><secondary>domain</secondary></indexterm>
-	It is possible to map any arbitrary UNIX group to any Windows NT4/200x group as well as
-	to make any UNIX group a Windows domain group. For example, if you wanted to include a
-	UNIX group (e.g., acct) in an ACL on a local file or printer on a Domain Member machine,
-	you would flag that group as a domain group by running the following on the Samba PDC:
-	</para>
-
-	<para>
-<screen>
-&rootprompt;<userinput>net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct type=d</userinput>
-</screen>
-	The <literal>ntgroup</literal> value must be in quotes if it contains space characters to prevent
-	the space from being interpreted as a command delimiter.
-	</para>
-
-	<para>
-<indexterm><primary>RID</primary></indexterm>
-<indexterm><primary>assigned RID</primary></indexterm>
-	Be aware that the RID parameter is an unsigned 32-bit integer that should
-	normally start at 1000. However, this RID must not overlap with any RID assigned
-	to a user. Verification for this is done differently depending on the passdb backend
-	you are using. Future versions of the tools may perform the verification automatically,
-	but for now the burden is on you.
-	</para>
-
-	<sect2>
-	<title>Warning: User Private Group Problems</title>
-
-	<para>
-<indexterm><primary>group accounts</primary></indexterm>
-<indexterm><primary>Red Hat Linux</primary></indexterm>
-<indexterm><primary>private groups</primary></indexterm>
-	Windows does not permit user and group accounts to have the same name.
-	This has serious implications for all sites that use private group accounts.
-	A private group account is an administrative practice whereby users are each
-	given their own group account. Red Hat Linux, as well as several free distributions
-	of Linux, by default create private groups.
-	</para>
-
-	<para>
-<indexterm><primary>UNIX/Linux group</primary></indexterm>
-<indexterm><primary>Windows group</primary></indexterm>
-	When mapping a UNIX/Linux group to a Windows group account, all conflict can
-	be avoided by assuring that the Windows domain group name does not overlap
-	with any user account name.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Nested Groups: Adding Windows Domain Groups to Windows Local Groups</title>
-
-	<indexterm><primary>groups</primary><secondary>nested</secondary></indexterm>
-
-	<para>
-<indexterm><primary>nested groups</primary></indexterm>
-	This functionality is known as <constant>nested groups</constant> and was first added to
-	Samba-3.0.3.
-	</para>
-
-	<para>
-<indexterm><primary>nested groups</primary></indexterm>
-	All MS Windows products since the release of Windows NT 3.10 support the use of nested groups.
-	Many Windows network administrators depend on this capability because it greatly simplifies security
-	administration.
-	</para>
-
-	<para>
-<indexterm><primary>nested group</primary></indexterm>
-<indexterm><primary>group membership</primary></indexterm>
-<indexterm><primary>domain security</primary></indexterm>
-<indexterm><primary>domain member server</primary></indexterm>
-<indexterm><primary>local groups</primary></indexterm>
-<indexterm><primary>domain global groups</primary></indexterm>
-<indexterm><primary>domain global users</primary></indexterm>
-	The nested group architecture was designed with the premise that day-to-day user and group membership
-	management should be performed on the domain security database. The application of group security
-	should be implemented on domain member servers using only local groups. On the domain member server,
-	all file system security controls are then limited to use of the local groups, which will contain
-	domain global groups and domain global users.
-	</para>
-
-	<para>
-<indexterm><primary>individual domain user</primary></indexterm>
-<indexterm><primary>domain group settings</primary></indexterm>
-<indexterm><primary>Account Unknown</primary></indexterm>
-	You may ask, What are the benefits of this arrangement? The answer is obvious to those who have plumbed
-	the dark depths of Windows networking architecture. Consider for a moment a server on which are stored
-	200,000 files, each with individual domain user and domain group settings. The company that owns the
-	file server is bought by another company, resulting in the server being moved to another location, and then
-	it is made a member of a different domain. Who would you think now owns all the files and directories?
-	Answer: Account Unknown.
-	</para>
-
-	<para>
-<indexterm><primary>directory access control</primary></indexterm>
-<indexterm><primary>local groups</primary></indexterm>
-<indexterm><primary>ACL</primary></indexterm>
-<indexterm><primary>Account Unknown</primary></indexterm>
-	Unraveling the file ownership mess is an unenviable administrative task that can be avoided simply
-	by using local groups to control all file and directory access control. In this case, only the members
-	of the local groups will have been lost. The files and directories in the storage subsystem will still
-	be owned by the local groups. The same goes for all ACLs on them. It is administratively much simpler
-	to delete the <constant>Account Unknown</constant> membership entries inside local groups with appropriate
-	entries for domain global groups in the new domain that the server has been made a member of.
-	</para>
-
-	<para>
-<indexterm><primary>nested groups</primary></indexterm>
-<indexterm><primary>administrative privileges</primary></indexterm>
-<indexterm><primary>domain member workstations</primary></indexterm>
-<indexterm><primary>domain member servers</primary></indexterm>
-<indexterm><primary>member machine</primary></indexterm>
-<indexterm><primary>full rights</primary></indexterm>
-<indexterm><primary>Domain Admins</primary></indexterm>
-<indexterm><primary>local administrative privileges</primary></indexterm>
-	Another prominent example of the use of nested groups involves implementation of administrative privileges
-	on domain member workstations and servers. Administrative privileges are given to all members of the
-	built-in local group <constant>Administrators</constant> on each domain member machine. To ensure that all domain
-	administrators have full rights on the member server or workstation, on joining the domain, the
-	<constant>Domain Admins</constant> group is added to the local Administrators group. Thus everyone who is
-	logged into the domain as a member of the Domain Admins group is also granted local administrative
-	privileges on each domain member.
-	</para>
-
-	<para>
-<indexterm><primary>nested groups</primary></indexterm>
-<indexterm><primary>auxiliary members</primary></indexterm>
-<indexterm><primary>/etc/group</primary></indexterm>
-<indexterm><primary>winbind</primary></indexterm>
-	UNIX/Linux has no concept of support for nested groups, and thus Samba has for a long time not supported
-	them either. The problem is that you would have to enter UNIX groups as auxiliary members of a group in
-	<filename>/etc/group</filename>. This does not work because it was not a design requirement at the time
-	the UNIX file system security model was implemented. Since Samba-2.2, the winbind daemon can provide
-	<filename>/etc/group</filename> entries on demand by obtaining user and group information from the domain
-	controller that the Samba server is a member of.
-	</para>
-
-	<para>
-<indexterm><primary>/etc/group</primary></indexterm>
-<indexterm><primary>libnss_winbind</primary></indexterm>
-<indexterm><primary>local groups</primary></indexterm>
-<indexterm><primary>Domain Users</primary></indexterm>
-<indexterm><primary>alias group</primary></indexterm>
-	In effect, Samba supplements the <filename>/etc/group</filename> data via the dynamic
-	<command>libnss_winbind</command> mechanism. Beginning with Samba-3.0.3, this facility is used to provide
-	local groups in the same manner as Windows. It works by expanding the local groups on the
-	fly as they are accessed. For example, the <constant>Domain Users</constant> group of the domain is made
-	a member of the local group <constant>demo</constant>. Whenever Samba needs to resolve membership of the
-	<constant>demo</constant> local (alias) group, winbind asks the domain controller for demo members of the Domain Users
-	group. By definition, it can only contain user objects, which can then be faked to be member of the
-	UNIX/Linux group <constant>demo</constant>.
-	</para>
-
-	<para>
-<indexterm><primary>nested groups</primary></indexterm>
-<indexterm><primary>winbindd</primary></indexterm>
-<indexterm><primary>NSS</primary></indexterm>
-<indexterm><primary>winbind</primary></indexterm>
-<indexterm><primary>local groups</primary></indexterm>
-<indexterm><primary>Domain User Manager</primary></indexterm>
-<indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>group</tertiary></indexterm>
-	To enable the use of nested groups, <command>winbindd</command> must be used with NSS winbind.
-	Creation and administration of the local groups is done best via the Windows Domain User Manager or its
-	Samba equivalent, the utility <command>net rpc group</command>. Creating the local group
-	<constant>demo</constant> is achieved by executing:
-	<screen>
-	&rootprompt; net rpc group add demo -L -Uroot%not24get
-	</screen>
-<indexterm><primary>addmem</primary></indexterm>
-<indexterm><primary>delmem</primary></indexterm>
-	Here the -L switch means that you want to create a local group. It may be necessary to add -S and -U
-	switches for accessing the correct host with appropriate user or root privileges. Adding and removing
-	group members can be done via the <constant>addmem</constant> and <constant>delmem</constant> subcommands of
-	<command>net rpc group</command> command. For example, addition of <quote>DOM\Domain Users</quote> to the
-	local group <constant>demo</constant> is done by executing:
-	<screen>
-	net rpc group addmem demo "DOM\Domain Users"
-	</screen>
-<indexterm><primary>getent group demo</primary></indexterm>
-<indexterm><primary>trusted domain</primary></indexterm>
-<indexterm><primary>foreign domain</primary></indexterm>
-<indexterm><primary>local access permissions</primary></indexterm>
-	Having completed these two steps, the execution of <command>getent group demo</command> will show demo
-	members of the global <constant>Domain Users</constant> group as members of  the group
-	<constant>demo</constant>.  This also works with any local or domain user. In case the domain DOM trusts
-	another domain, it is also possible to add global users and groups of the trusted domain as members of
-	<constant>demo</constant>. The users from the foreign domain who are members of the group that has been
-	added to the <constant>demo</constant> group now have the same local access permissions as local domain
-	users have. 
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Important Administrative Information</title>
-
-	<para>
-	Administrative rights are necessary in two specific forms:
-	</para>
-
-	<orderedlist>
-		<listitem><para>For Samba-3 domain controllers and domain member servers/clients.</para></listitem>
-		<listitem><para>To manage domain member Windows workstations.</para></listitem>
-	</orderedlist>
-
-	<para>
-<indexterm><primary>rights and privileges</primary></indexterm>
-<indexterm><primary>domain member client</primary></indexterm>
-<indexterm><primary>group account</primary></indexterm>
-	Versions of Samba up to and including 3.0.10 do not provide a means for assigning rights and privileges
-	that are necessary for system administration tasks from a Windows domain member client machine, so
-	domain administration tasks such as adding, deleting, and changing user and group account information, and
-	managing workstation domain membership accounts, can be handled by any account other than root.
-	</para>
-
-	<para>
-<indexterm><primary>privilege management</primary></indexterm>
-<indexterm><primary>delegated</primary></indexterm>
-<indexterm><primary>Administrator</primary></indexterm>
-	Samba-3.0.11 introduced a new privilege management interface (see <link linkend="rights">User Rights and Privileges</link>)
-	that permits these tasks to be delegated to non-root (i.e., accounts other than the equivalent of the
-	MS Windows Administrator) accounts.
-	</para>
-
-	<para>
-<indexterm><primary>mapped</primary></indexterm>
-<indexterm><primary>Domain Admins</primary></indexterm>
-	Administrative tasks on a Windows domain member workstation can be done by anyone who is a member of the
-	<constant>Domain Admins</constant> group. This group can be mapped to any convenient UNIX group.
-	</para>
-
-	<sect3>
-	<title>Applicable Only to Versions Earlier than 3.0.11</title>
-
-	<para>
-<indexterm><primary>privilege</primary></indexterm>
-	Administrative tasks on UNIX/Linux systems, such as adding users or groups, requires
-	<constant>root</constant>-level privilege. The addition of a Windows client to a Samba domain involves the
-	addition of a user account for the Windows client.
-	</para>
-
-	<para>
-<indexterm><primary>system security</primary></indexterm>
-<indexterm><primary>privileges</primary></indexterm>
-	Many UNIX administrators continue to request that the Samba Team make it possible to add Windows workstations, or 
-	the ability to add, delete, or modify user accounts, without requiring <constant>root</constant> privileges. 
-	Such a request violates every understanding of basic UNIX system security.
-	</para>
-
-	<para>
-<indexterm><primary>privileges</primary></indexterm>
-<indexterm><primary>/etc/passwd</primary></indexterm>
-<indexterm><primary>Domain Server Manager</primary></indexterm>
-<indexterm><primary>Domain User Manager</primary></indexterm>
-<indexterm><primary>manage share-level ACL</primary></indexterm>
-<indexterm><primary>share-level ACLs</primary></indexterm>
-	There is no safe way to provide access on a UNIX/Linux system without providing
-	<constant>root</constant>-level privileges. Provision of <constant>root</constant> privileges can be done
-	either by logging on to the Domain as the user <constant>root</constant> or by permitting particular users to
-	use a UNIX account that has a UID=0 in the <filename>/etc/passwd</filename> database. Users of such accounts
-	can use tools like the NT4 Domain User Manager and the NT4 Domain Server Manager to manage user and group
-	accounts as well as domain member server and client accounts. This level of privilege is also needed to manage
-	share-level ACLs.
-	</para>
-
-	</sect3>
-
-	</sect2>
-
-	<sect2>
-	<title>Default Users, Groups, and Relative Identifiers</title>
-
-	<para>
-	<indexterm><primary>Relative Identifier</primary><see>RID</see></indexterm>
-	<indexterm><primary>RID</primary></indexterm>
-<indexterm><primary>Windows NT4/200x/XP</primary></indexterm>
-<indexterm><primary>well-known RID</primary></indexterm>
-<indexterm><primary>domain groups</primary></indexterm>
-<indexterm><primary>tdbsam</primary></indexterm>
-<indexterm><primary>LDAP</primary></indexterm>
-<indexterm><primary>NT groups</primary></indexterm>
-	When first installed, Windows NT4/200x/XP are preconfigured with certain user, group, and
-	alias entities. Each has a well-known RID. These must be preserved for continued
-	integrity of operation. Samba must be provisioned with certain essential domain groups that require
-	the appropriate RID value. When Samba-3 is configured to use <constant>tdbsam</constant>, the essential
-	domain groups are automatically created. It is the LDAP administrator's responsibility to create
-	(provision) the default NT groups.
-	</para>
-
-	<para>
-<indexterm><primary>default users</primary></indexterm>
-<indexterm><primary>default groups</primary></indexterm>
-<indexterm><primary>default aliases</primary></indexterm>
-<indexterm><primary>RID</primary></indexterm>
-	Each essential domain group must be assigned its respective well-known RID. The default users, groups,
-	aliases, and RIDs are shown in <link linkend="WKURIDS">Well-Known User Default RIDs</link>.
-	</para>
-
-	<note><para>
-<indexterm><primary>passdb backend</primary></indexterm>
-<indexterm><primary>LDAP</primary></indexterm>
-<indexterm><primary>ldapsam</primary></indexterm>
-<indexterm><primary>domain groups</primary></indexterm>
-<indexterm><primary>RID</primary></indexterm>
-	It is the administrator's responsibility to create the essential domain groups and to assign each
-	its default RID.
-	</para></note>
-
-	<para>
-<indexterm><primary>domain groups</primary></indexterm>
-<indexterm><primary>RID</primary></indexterm>
-	It is permissible to create any domain group that may be necessary; just make certain that the essential
-	domain groups (well known) have been created and assigned their default RIDs. Other groups you create may
-	be assigned any arbitrary RID you care to use.
-	</para>
-
-	<para>
-	Be sure to map each domain group to a UNIX system group. That is the only way to ensure that the group
-	will be available for use as an NT domain group.
-	</para>
-
-	<para>
-	<table frame="all" id="WKURIDS">
-	<title>Well-Known User Default RIDs</title>
-		<tgroup cols="4" align="left">
-			<colspec align="left"/>
-			<colspec align="left"/>
-			<colspec align="left"/>
-			<colspec align="center"/>
-			<thead>
-				<row>
-					<entry>Well-Known Entity</entry>
-					<entry>RID</entry>
-					<entry>Type</entry>
-					<entry>Essential</entry>
-				</row>
-			</thead>
-			<tbody>
-				<row>
-					<entry>Domain Administrator</entry>
-					<entry>500</entry>
-					<entry>User</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Domain Guest</entry>
-					<entry>501</entry>
-					<entry>User</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Domain KRBTGT</entry>
-					<entry>502</entry>
-					<entry>User</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Domain Admins</entry>
-					<entry>512</entry>
-					<entry>Group</entry>
-					<entry>Yes</entry>
-				</row>
-				<row>
-					<entry>Domain Users</entry>
-					<entry>513</entry>
-					<entry>Group</entry>
-					<entry>Yes</entry>
-				</row>
-				<row>
-					<entry>Domain Guests</entry>
-					<entry>514</entry>
-					<entry>Group</entry>
-					<entry>Yes</entry>
-				</row>
-				<row>
-					<entry>Domain Computers</entry>
-					<entry>515</entry>
-					<entry>Group</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Domain Controllers</entry>
-					<entry>516</entry>
-					<entry>Group</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Domain Certificate Admins</entry>
-					<entry>517</entry>
-					<entry>Group</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Domain Schema Admins</entry>
-					<entry>518</entry>
-					<entry>Group</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Domain Enterprise Admins</entry>
-					<entry>519</entry>
-					<entry>Group</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Domain Policy Admins</entry>
-					<entry>520</entry>
-					<entry>Group</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Builtin Admins</entry>
-					<entry>544</entry>
-					<entry>Alias</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Builtin users</entry>
-					<entry>545</entry>
-					<entry>Alias</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Builtin Guests</entry>
-					<entry>546</entry>
-					<entry>Alias</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Builtin Power Users</entry>
-					<entry>547</entry>
-					<entry>Alias</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Builtin Account Operators</entry>
-					<entry>548</entry>
-					<entry>Alias</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Builtin System Operators</entry>
-					<entry>549</entry>
-					<entry>Alias</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Builtin Print Operators</entry>
-					<entry>550</entry>
-					<entry>Alias</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Builtin Backup Operators</entry>
-					<entry>551</entry>
-					<entry>Alias</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Builtin Replicator</entry>
-					<entry>552</entry>
-					<entry>Alias</entry>
-					<entry>No</entry>
-				</row>
-				<row>
-					<entry>Builtin RAS Servers</entry>
-					<entry>553</entry>
-					<entry>Alias</entry>
-					<entry>No</entry>
-				</row>
-			</tbody>
-		</tgroup>
-	</table>
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Example Configuration</title>
-
-		<para>
-<indexterm><primary>net</primary><secondary>groupmap</secondary><tertiary>list</tertiary></indexterm>
-		You can list the various groups in the mapping database by executing
-		<command>net groupmap list</command>. Here is an example:
-		</para>
-
-		<para>
-<indexterm><primary>net</primary><secondary>groupmap</secondary></indexterm>
-<screen>
-&rootprompt; <userinput>net groupmap list</userinput>
-Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin
-Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser
-Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest
-</screen>
-		</para>
-
-		<para>
-		For complete details on <command>net groupmap</command>, refer to the net(8) man page.
-		</para>
-
-	</sect2>
-
-</sect1>
-
-<sect1>
-<title>Configuration Scripts</title>
-
-	<para>
-	Everyone needs tools. Some of us like to create our own, others prefer to use canned tools
-	(i.e., prepared by someone else for general use). 
-	</para>
-
-	<sect2>
-	<title>Sample &smb.conf; Add Group Script</title>
-
-		<para>
-		<indexterm><primary>smbgrpadd.sh</primary></indexterm>
-		<indexterm><primary>groupadd limitations</primary></indexterm>
-		<indexterm><primary>smbgrpadd.sh</primary></indexterm>
-<indexterm><primary>/etc/group</primary></indexterm>
-<indexterm><primary>groupadd</primary></indexterm>
-		A script to create complying group names for use by the Samba group interfaces
-		is provided in <link linkend="smbgrpadd.sh">smbgrpadd.sh</link>. This script
-		adds a temporary entry in the <filename>/etc/group</filename> file and then renames
-		it to the desired name. This is an example of a method to get around operating
-		system maintenance tool limitations such as those present in some version of the
-		<command>groupadd</command> tool.
-<example id="smbgrpadd.sh">
-<title>smbgrpadd.sh</title>
-<programlisting>
-#!/bin/bash
-
-# Add the group using normal system groupadd tool.
-groupadd smbtmpgrp00
-
-thegid=`cat /etc/group | grep ^smbtmpgrp00 | cut -d ":" -f3`
-
-# Now change the name to what we want for the MS Windows networking end
-cp /etc/group /etc/group.bak
-cat /etc/group.bak | sed "s/^smbtmpgrp00/$1/g" > /etc/group
-rm /etc/group.bak
-
-# Now return the GID as would normally happen.
-echo $thegid
-exit 0
-</programlisting>
-</example>
-</para>
-
-		<para>
-		The &smb.conf; entry for the above script shown in <link linkend="smbgrpadd">the configuration of
-		&smb.conf; for the add group Script</link> demonstrates how it may be used.
-
-<example id="smbgrpadd">
-<title>Configuration of &smb.conf; for the add group Script</title>
-<smbconfblock>
-<smbconfsection name="[global]"/>
-<smbconfoption name="add group script">/path_to_tool/smbgrpadd.sh "%g"</smbconfoption>
-</smbconfblock>
-</example>
-		</para>
-
-	</sect2>
-	
-	<sect2>
-	<title>Script to Configure Group Mapping</title>
-
-	<para>
-<indexterm><primary>initGroups.sh</primary></indexterm>
-	In our example we have created a UNIX/Linux group called <literal>ntadmin</literal>.
-	Our script will create the additional groups <literal>Orks</literal>, <literal>Elves</literal>, and <literal>Gnomes</literal>.
-	It is a good idea to save this shell script for later use just in case you ever need to rebuild your mapping database.
-	For the sake of convenience we elect to save this script as a file called <filename>initGroups.sh</filename>.
-	This script is given in <link linkend="set-group-map">intGroups.sh</link>.
-<indexterm><primary>initGroups.sh</primary></indexterm>
-<example id="set-group-map">
-<title>Script to Set Group Mapping</title>
-<programlisting>
-#!/bin/bash
-
-net groupmap add ntgroup="Domain Admins" unixgroup=ntadmin rid=512 type=d
-net groupmap add ntgroup="Domain Users" unixgroup=users rid=513 type=d
-net groupmap add ntgroup="Domain Guests" unixgroup=nobody rid=514 type=d
-
-groupadd Orks
-groupadd Elves
-groupadd Gnomes
-
-net groupmap add ntgroup="Orks"   unixgroup=Orks   type=d
-net groupmap add ntgroup="Elves"  unixgroup=Elves  type=d
-net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d
-</programlisting>
-</example>
-	</para>
-
-	<para>
-	Of course it is expected that the administrator will modify this to suit local needs.
-	For information regarding the use of the <command>net groupmap</command> tool please
-	refer to the man page.
-	</para>
-
-	<note><para>
-	Versions of Samba-3 prior to 3.0.23 automatically create default group mapping for the
-	<literal>Domain Admins, Domain Users</literal> and <literal>Domain Guests</literal> Windows
-	groups, but do not map them to UNIX GIDs. This was a cause of administrative confusion and 
-	trouble. Commencing with Samba-3.0.23 this anomaly has been fixed - thus all Windows groups
-	must now be manually and explicitly created and mapped to a valid UNIX GID by the Samba 
-	administrator.
-	</para></note>
-
-	</sect2>
-
-</sect1>
-
-<sect1>
-<title>Common Errors</title>
-
-<para>
-At this time there are many little surprises for the unwary administrator. In a real sense
-it is imperative that every step of automated control scripts be carefully tested
-manually before putting it into active service.
-</para>
-
-	<sect2>
-	<title>Adding Groups Fails</title>
-
-		<para>
-<indexterm><primary>groupadd</primary></indexterm>
-		This is a common problem when the <command>groupadd</command> is called directly
-		by the Samba interface script for the <smbconfoption name="add group script"/> in
-		the &smb.conf; file.
-		</para>
-
-		<para>
-<indexterm><primary>uppercase character</primary></indexterm>
-<indexterm><primary>space character</primary></indexterm>
-		The most common cause of failure is an attempt to add an MS Windows group account
-		that has an uppercase character and/or a space character in it.
-		</para>
-
-		<para>
-<indexterm><primary>groupadd</primary></indexterm>
-		There are three possible workarounds. First, use only group names that comply
-		with the limitations of the UNIX/Linux <command>groupadd</command> system tool.
-		Second, it involves the use of the script mentioned earlier in this chapter, and
-		third is the option is to manually create a UNIX/Linux group account that can substitute
-		for the MS Windows group name, then use the procedure listed above to map that group
-		to the MS Windows group.
-		</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Adding Domain Users to the Workstation Power Users Group</title>
-
-		<para><quote>
-		What must I do to add domain users to the Power Users group?
-		</quote></para>
-
-		<para>
-<indexterm><primary>Domain Users group</primary></indexterm>
-		The Power Users group is a group that is local to each Windows 200x/XP Professional workstation.
-		You cannot add the Domain Users group to the Power Users group automatically, it must be done on
-		each workstation by logging in as the local workstation <emphasis>administrator</emphasis> and
-		then using the following procedure:
-		</para>
-
-		<procedure>
-			<step><para>
-			Click <guimenu>Start -> Control Panel -> Users and Passwords</guimenu>.
-			</para></step>
-
-			<step><para>
-			Click the <guimenuitem>Advanced</guimenuitem> tab.
-			</para></step>
-
-			<step><para>
-			Click the <guibutton>Advanced</guibutton> button.
-			</para></step>
-
-			<step><para>
-			Click <constant>Groups</constant>.
-			</para></step>
-
-			<step><para>
-			Double-click <constant>Power Users</constant>. This will launch the panel to add users or groups
-			to the local machine <constant>Power Users</constant> group.
-			</para></step>
-
-			<step><para>
-			Click the <guibutton>Add</guibutton> button.
-			</para></step>
-
-			<step><para>
-			Select the domain from which the <constant>Domain Users</constant> group is to be added.
-			</para></step>
-
-			<step><para>
-			Double-click the <constant>Domain Users</constant> group.
-			</para></step>
-
-			<step><para>
-			Click the <guibutton>OK</guibutton> button. If a logon box is presented during this process, 
-			please remember to enter the connect as <constant>DOMAIN\UserName</constant>, that is, for the
-			domain <constant>MIDEARTH</constant> and the user <constant>root</constant> enter
-			<constant>MIDEARTH\root</constant>.
-			</para></step>
-		</procedure>
-	</sect2>
-
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-IDMAP.xml b/docs-xml/Samba3-HOWTO/TOSHARG-IDMAP.xml
deleted file mode 100644
index 89bdec7..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-IDMAP.xml
+++ /dev/null
@@ -1,1122 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="idmapper">
-<chapterinfo>
-	&author.jht;
-</chapterinfo>
-
-<title>Identity Mapping (IDMAP)</title>
-
-<para>
-<indexterm><primary>Windows</primary></indexterm>
-<indexterm><primary>interoperability</primary></indexterm>
-<indexterm><primary>IDMAP</primary></indexterm>
-<indexterm><primary>Windows Security Identifiers</primary><see>SID</see></indexterm>
-<indexterm><primary>SID</primary></indexterm>
-<indexterm><primary>UID</primary></indexterm>
-<indexterm><primary>GID</primary></indexterm>
-The Microsoft Windows operating system has a number of features that impose specific challenges
-to interoperability with the operating systems on which Samba is implemented. This chapter deals
-explicitly with the mechanisms Samba-3 (version 3.0.8 and later) uses to overcome one of the
-key challenges in the integration of Samba servers into an MS Windows networking environment.
-This chapter deals with identity mapping (IDMAP) of Windows security identifiers (SIDs)
-to UNIX UIDs and GIDs.
-</para>
-
-<para>
-To ensure sufficient coverage, each possible Samba deployment type is discussed.
-This is followed by an overview of how the IDMAP facility may be implemented.
-</para>
-
-<para>
-<indexterm><primary>network client</primary></indexterm>
-<indexterm><primary>IDMAP</primary></indexterm>
-<indexterm><primary>IDMAP infrastructure</primary></indexterm>
-<indexterm><primary>default behavior</primary></indexterm>
-The IDMAP facility is of concern where more than one Samba server (or Samba network client)
-is installed in a domain. Where there is a single Samba server, do not be too concerned regarding
-the IDMAP infrastructure &smbmdash; the default behavior of Samba is nearly always sufficient.
-Where multiple Samba servers are used it is often necessary to move data off one server and onto
-another, and that is where the fun begins!
-</para>
-
-<para>
-<indexterm><primary>UID</primary></indexterm>
-<indexterm><primary>GID</primary></indexterm>
-<indexterm><primary>LDAP</primary></indexterm>
-<indexterm><primary>NSS</primary></indexterm>
-<indexterm><primary>nss_ldap</primary></indexterm>
-<indexterm><primary>NT4 domain members</primary></indexterm>
-<indexterm><primary>ADS domain members</primary></indexterm>
-<indexterm><primary>security name-space</primary></indexterm>
-Where user and group account information is stored in an LDAP directory every server can have the same
-consistent UID and GID for users and groups. This is achieved using NSS and the nss_ldap tool. Samba
-can be configured to use only local accounts, in which case the scope of the IDMAP problem is somewhat
-reduced. This works reasonably well if the servers belong to a single domain, and interdomain trusts
-are not needed. On the other hand, if the Samba servers are NT4 domain members, or ADS  domain members,
-or if there is a need to keep the security name-space separate (i.e., the user
-<literal>DOMINICUS\FJones</literal> must not be given access to the account resources of the user 
-<literal>FRANCISCUS\FJones</literal><footnote><para>Samba local account mode results in both
-<literal>DOMINICUS\FJones</literal> and <literal>FRANCISCUS\FJones</literal> mapping to the UNIX user
-<literal>FJones</literal>.</para></footnote> free from inadvertent cross-over, close attention should be given
-to the way that the IDMAP facility is configured.
-</para>
-
-<para>
-<indexterm><primary>IDMAP</primary></indexterm>
-<indexterm><primary>domain access</primary></indexterm>
-<indexterm><primary>SID</primary></indexterm>
-<indexterm><primary>UID</primary></indexterm>
-<indexterm><primary>GID</primary></indexterm>
-<indexterm><primary>one domain</primary></indexterm>
-The use of IDMAP is important where the Samba server will be accessed by workstations or servers from
-more than one domain, in which case it is important to run winbind so it can handle the resolution (ID mapping)
-of foreign SIDs to local UNIX UIDs and GIDs.
-</para>
-
-<para>
-<indexterm><primary>winbindd</primary></indexterm>
-The use of the IDMAP facility requires the execution of the <command>winbindd</command> upon Samba startup.
-</para>
-
-<sect1>
-<title>Samba Server Deployment Types and IDMAP</title>
-
-<para>
-<indexterm><primary>Server Types</primary></indexterm>
-There are four basic server deployment types, as documented in <link linkend="ServerType">the chapter
-on Server Types and Security Modes</link>.
-</para>
-
-	<sect2>
-	<title>Standalone Samba Server</title>
-
-	<para>
-	<indexterm><primary>stand-alone server</primary></indexterm>
-	<indexterm><primary>Active Directory</primary></indexterm>
-	<indexterm><primary>NT4 Domain</primary></indexterm>
-	A standalone Samba server is an implementation that is not a member of a Windows NT4 domain,
-	a Windows 200X Active Directory domain, or a Samba domain.
-	</para>
-
-	<para>
-	<indexterm><primary>IDMAP</primary></indexterm>
-	<indexterm><primary>identity</primary></indexterm>
-	<indexterm><primary>local user</primary></indexterm>
-	By definition, this means that users and groups will be created and controlled locally, and
-	the identity of a network user must match a local UNIX/Linux user login. The IDMAP facility
-	is therefore of little to no interest, winbind will not be necessary, and the IDMAP facility
-	will not be relevant or of interest.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Domain Member Server or Domain Member Client</title>
-
-	<para>
-	<indexterm><primary>PDC</primary></indexterm>
-	<indexterm><primary>BDC</primary></indexterm>
-	<indexterm><primary>NT4</primary></indexterm>
-	<indexterm><primary>SID</primary></indexterm>
-	<indexterm><primary>Active Directory</primary></indexterm>
-	Samba-3 can act as a Windows NT4 PDC or BDC, thereby providing domain control protocols that
-	are compatible with Windows NT4. Samba-3 file and print sharing protocols are compatible with
-	all versions of MS Windows products. Windows NT4, as with MS Active Directory,
-	extensively makes use of Windows SIDs.
-	</para>
-
-	<para>
-	<indexterm><primary>MS Windows SID</primary></indexterm>
-	<indexterm><primary>UID</primary></indexterm>
-	<indexterm><primary>GID</primary></indexterm>
-	Samba-3 domain member servers and clients must interact correctly with MS Windows SIDs. Incoming
-	Windows SIDs must be translated to local UNIX UIDs and GIDs. Outgoing information from the Samba
-	server must provide to MS Windows clients and servers appropriate SIDs.
-	</para>
-
-	<para>
-	<indexterm><primary>ADS</primary></indexterm>
-	<indexterm><primary>winbind</primary></indexterm>
-	A Samba member of a Windows networking domain (NT4-style or ADS) can be configured to handle 
-	identity mapping in a variety of ways. The mechanism it uses depends on whether or not
-	the <command>winbindd</command> daemon is used and how the winbind functionality is configured.
-	The configuration options are briefly described here:
-	</para>
-
-	<variablelist>
-		<varlistentry><term>Winbind is not used; users and groups are local: </term>
-			<listitem>
-				<para>
-				<indexterm><primary>winbindd</primary></indexterm>
-				<indexterm><primary>smbd</primary></indexterm>
-				<indexterm><primary>network traffic</primary></indexterm>
-				<indexterm><primary>LoginID</primary></indexterm>
-				<indexterm><primary>account name</primary></indexterm>
-				<indexterm><primary>getpwnam</primary></indexterm>
-				<indexterm><primary>NSS</primary></indexterm>
-				<indexterm><primary>local users</primary></indexterm>
-				<indexterm><primary>local groups</primary></indexterm>
-				<indexterm><primary>/etc/passwd</primary></indexterm>
-				<indexterm><primary>/etc/group</primary></indexterm>
-				Where <command>winbindd</command> is not used Samba (<command>smbd</command>)
-				uses the underlying UNIX/Linux mechanisms to resolve the identity of incoming
-				network traffic. This is done using the LoginID (account name) in the
-				session setup request and passing it to the getpwnam() system function call.
-				This call is implemented using the name service switch (NSS) mechanism on
-				modern UNIX/Linux systems. By saying "users and groups are local,"
-				we are implying that they are stored only on the local system, in the
-				<filename>/etc/passwd</filename> and <filename>/etc/group</filename> respectively.
-				</para>
-
-				<para>
-				<indexterm><primary>SessionSetupAndX</primary></indexterm>
-				<indexterm><primary>/etc/passwd</primary></indexterm>
-				For example, when the user <literal>BERYLIUM\WambatW</literal> tries to open a
-				connection to a Samba server the incoming SessionSetupAndX request will make a 
-				system call to look up the user <literal>WambatW</literal> in the
-				<filename>/etc/passwd</filename> file.
-				</para>
-
-				<para>
-				<indexterm><primary>standalone</primary></indexterm>
-				<indexterm><primary>domain member server</primary></indexterm>
-				<indexterm><primary>NT4</primary></indexterm>
-				<indexterm><primary>ADS</primary></indexterm>
-				<indexterm><primary>PDC</primary></indexterm>
-				<indexterm><primary>smbpasswd</primary></indexterm>
-				<indexterm><primary>tdbsam</primary></indexterm>
-				<indexterm><primary>passdb backend</primary></indexterm>
-				This configuration may be used with standalone Samba servers, domain member
-				servers (NT4 or ADS), and for a PDC that uses either an smbpasswd
-				or a tdbsam-based Samba passdb backend.
-				</para>
-			</listitem>
-		</varlistentry>
-	
-		<varlistentry><term>Winbind is not used; users and groups resolved via NSS: </term>
-			<listitem>
-				<para>
-				<indexterm><primary>user accounts</primary></indexterm>
-				<indexterm><primary>group accounts</primary></indexterm>
-				<indexterm><primary>local accounts</primary></indexterm>
-				<indexterm><primary>repository</primary></indexterm>
-				<indexterm><primary>NIS</primary></indexterm>
-				<indexterm><primary>LDAP</primary></indexterm>
-				In this situation user and group accounts are treated as if they are local
-				accounts. The only way in which this differs from having local accounts is
-				that the accounts are stored in a repository that can be shared. In practice
-				this means that they will reside in either an NIS-type database or else in LDAP.
-				</para>
-
-				<para>
-				<indexterm><primary>standalone</primary></indexterm>
-				<indexterm><primary>domain member server</primary></indexterm>
-				<indexterm><primary>NT4</primary></indexterm>
-				<indexterm><primary>ADS</primary></indexterm>
-				<indexterm><primary>PDC</primary></indexterm>
-				<indexterm><primary>smbpasswd</primary></indexterm>
-				<indexterm><primary>tdbsam</primary></indexterm>
-				This configuration may be used with standalone Samba servers, domain member
-				servers (NT4 or ADS), and for a PDC that uses either an smbpasswd
-				or a tdbsam-based Samba passdb backend.
-				</para>
-			</listitem>
-		</varlistentry>
-
-		<varlistentry><term>Winbind/NSS with the default local IDMAP table: </term>
-			<listitem>
-				<para>
-				<indexterm><primary>NT4 domain</primary></indexterm>
-				<indexterm><primary>ADS domain</primary></indexterm>
-				<indexterm><primary>winbind</primary></indexterm>
-				<indexterm><primary>domain control</primary></indexterm>
-				There are many sites that require only a simple Samba server or a single Samba
-				server that is a member of a Windows NT4 domain or an ADS domain. A typical example
-				is an appliance like file server on which no local accounts are configured and
-				winbind is used to obtain account credentials from the domain controllers for the
-				domain. The domain control can be provided by Samba-3, MS Windows NT4, or MS Windows
-				Active Directory.
-				</para>
-
-				<para>
-				<indexterm><primary>UID numbers</primary></indexterm>
-				<indexterm><primary>GID numbers</primary></indexterm>
-				<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
-				<indexterm><primary>winbind</primary></indexterm>
-				<indexterm><primary>SID</primary></indexterm>
-				Winbind is a great convenience in this situation. All that is needed is a range of
-				UID numbers and GID numbers that can be defined in the &smb.conf; file. The
-				<filename>/etc/nsswitch.conf</filename> file is configured to use <command>winbind</command>,
-				which does all the difficult work of mapping incoming SIDs to appropriate UIDs and GIDs.
-				The SIDs are allocated a UID/GID in the order in which winbind receives them.
-				</para>
-
-				<para>
-				<indexterm><primary>UID</primary></indexterm>
-				<indexterm><primary>GID</primary></indexterm>
-				<indexterm><primary>IDMAP</primary></indexterm>
-				<indexterm><primary>corrupted file</primary></indexterm>
-				This configuration is not convenient or practical in sites that have more than one
-				Samba server and that require the same UID or GID for the same user or group across
-				all servers. One of the hazards of this method is that in the event that the winbind
-				IDMAP file becomes corrupted or lost, the repaired or rebuilt IDMAP file may allocate
-				UIDs and GIDs to different users and groups from what was there previously with the
-				result that MS Windows files that are stored on the Samba server may now not belong to
-				the rightful owners.
-				</para>
-			</listitem>
-		</varlistentry>
-
-		<varlistentry><term>Winbind/NSS uses RID based IDMAP: </term>
-			<listitem>
-				<para>
-				<indexterm><primary>RID</primary></indexterm>
-				<indexterm><primary>idmap_rid</primary></indexterm>
-				<indexterm><primary>ADS</primary></indexterm>
-				<indexterm><primary>LDAP</primary></indexterm>
-				The IDMAP_RID facility is new to Samba version 3.0.8. It was added to make life easier
-				for a number of sites that are committed to use of MS ADS, that do not apply
-				an ADS schema extension, and that do not have an installed an LDAP directory server just for
-				the purpose of maintaining an IDMAP table. If you have a single ADS domain (not a forest of
-				domains, and not multiple domain trees) and you want a simple cookie-cutter solution to the
-				IDMAP table problem, then IDMAP_RID is an obvious choice.
-				</para>
-
-				<para>
-				<indexterm><primary>idmap_rid</primary></indexterm>
-				<indexterm><primary>idmap uid</primary></indexterm>
-				<indexterm><primary>idmap gid</primary></indexterm>
-				<indexterm><primary>RID</primary></indexterm>
-				<indexterm><primary>SID</primary></indexterm>
-				<indexterm><primary>UID</primary></indexterm>
-				<indexterm><primary>idmap backend</primary></indexterm>
-				<indexterm><primary>automatic mapping</primary></indexterm>
-				This facility requires the allocation of the <parameter>idmap uid</parameter> and the
-				<parameter>idmap gid</parameter> ranges, and within the <parameter>idmap uid</parameter>
-				it is possible to allocate a subset of this range for automatic mapping of the relative
-				identifier (RID) portion of the SID directly to the base of the UID plus the RID value.
-				For example, if the <parameter>idmap uid</parameter> range is <constant>1000-100000000</constant>
-				and the <parameter>idmap backend = idmap_rid:DOMAIN_NAME=1000-50000000</parameter>, and
-				a SID is encountered that has the value <constant>S-1-5-21-34567898-12529001-32973135-1234</constant>,
-				the resulting UID will be <constant>1000 + 1234 = 2234</constant>.
-				</para>
-			</listitem>
-		</varlistentry>
-
-		<varlistentry><term>Winbind with an NSS/LDAP backend-based IDMAP facility: </term>
-			<listitem>
-				<para>
-				<indexterm><primary>Domain Member</primary></indexterm>
-				<indexterm><primary>winbind</primary></indexterm>
-				<indexterm><primary>SID</primary></indexterm>
-				<indexterm><primary>UID</primary></indexterm>
-				<indexterm><primary>GID</primary></indexterm>
-				<indexterm><primary>idmap gid</primary></indexterm>
-				<indexterm><primary>idmap uid</primary></indexterm>
-				<indexterm><primary>LDAP</primary></indexterm>
-				In this configuration <command>winbind</command> resolved SIDs to UIDs and GIDs from
-				the <parameter>idmap uid</parameter> and <parameter>idmap gid</parameter> ranges specified
-				in the &smb.conf; file, but instead of using a local winbind IDMAP table, it is stored
-				in an LDAP directory so that all domain member machines (clients and servers) can share
-				a common IDMAP table.
-				</para>
-
-				<para>
-				<indexterm><primary>idmap backend</primary></indexterm>
-				<indexterm><primary>LDAP server</primary></indexterm>
-				<indexterm><primary>LDAP redirects</primary></indexterm>
-				It is important that all LDAP IDMAP clients use only the master LDAP server because the
-				<parameter>idmap backend</parameter> facility in the &smb.conf; file does not correctly
-				handle LDAP redirects.
-				</para>
-			</listitem>
-		</varlistentry>
-
-		<varlistentry><term>Winbind with NSS to resolve UNIX/Linux user and group IDs: </term>
-			<listitem>
-				<para>
-				The use of LDAP as the passdb backend is a smart solution for PDC, BDC, and
-				domain member servers. It is a neat method for assuring that UIDs, GIDs, and the matching
-				SIDs are consistent across all servers.
-				</para>
-
-				<para>
-				<indexterm><primary>LDAP</primary></indexterm>
-				<indexterm><primary>PADL</primary></indexterm>
-				The use of the LDAP-based passdb backend requires use of the PADL nss_ldap utility or
-				an equivalent. In this situation winbind is used to handle foreign SIDs, that is, SIDs from
-				standalone Windows clients (i.e., not a member of our domain) as well as SIDs from 
-				another domain. The foreign UID/GID is mapped from allocated ranges (idmap uid and idmap gid)
-				in precisely the same manner as when using winbind with a local IDMAP table.
-				</para>
-
-				<para>
-				<indexterm><primary>nss_ldap</primary></indexterm>
-				<indexterm><primary>AD4UNIX</primary></indexterm>
-				<indexterm><primary>MMC</primary></indexterm>
-				The nss_ldap tool set can be used to access UIDs and GIDs via LDAP as well as via Active
-				Directory. In order to use Active Directory, it is necessary to modify the ADS schema by
-				installing either the AD4UNIX schema extension or using the Microsoft Services for UNIX
-				version 3.5 or later to extend the ADS schema so it maintains UNIX account credentials.
-				Where the ADS schema is extended, a Microsoft Management Console (MMC) snap-in is also
-				installed to permit the UNIX credentials to be set and managed from the ADS User and Computer
-				Management tool. Each account must be separately UNIX-enabled before the UID and GID data can
-				be used by Samba.
-				</para>
-			</listitem>
-		</varlistentry>
-
-	</variablelist>
-
-	</sect2>
-
-	<sect2>
-	<title>Primary Domain Controller</title>
-
-	<para>
-	<indexterm><primary>domain security</primary></indexterm>
-	<indexterm><primary>SID</primary></indexterm>
-	<indexterm><primary>RID</primary></indexterm>
-	<indexterm><primary>algorithmic mapping</primary></indexterm>
-	Microsoft Windows domain security systems generate the user and group SID as part
-	of the process of creation of an account. Windows does not have a concept of the UNIX UID or a GID; rather,
-	it has its own type of security descriptor. When Samba is used as a domain controller, it provides a method
-	of producing a unique SID for each user and group. Samba generates a machine and a domain SID to which it
-	adds an RID that is calculated algorithmically from a base value that can be specified
-	in the &smb.conf; file, plus twice (2x) the UID or GID. This method is called <quote>algorithmic mapping</quote>.
-	</para>
-
-	<para>
-	<indexterm><primary>RID base</primary></indexterm>
-	For example, if a user has a UID of 4321, and the algorithmic RID base has a value of 1000, the RID will
-	be <literal>1000 + (2 x 4321) = 9642</literal>. Thus, if the domain SID is
-	<literal>S-1-5-21-89238497-92787123-12341112</literal>, the resulting SID is
-	<literal>S-1-5-21-89238497-92787123-12341112-9642</literal>.
-	</para>
-
-	<para>
-	<indexterm><primary>on-the-fly</primary></indexterm>
-	<indexterm><primary>SID</primary></indexterm>
-	<indexterm><primary>passdb backend</primary></indexterm>
-	<indexterm><primary>ldapsam</primary></indexterm>
-	The foregoing type of SID is produced by Samba as an automatic function and is either produced on the fly
-	(as is the case when using a <parameter>passdb backend = [tdbsam | smbpasswd]</parameter>), or may be stored
-	as a permanent part of an account in an LDAP-based ldapsam.
-	</para>
-
-	<para>
-	<indexterm><primary>SFU 3.5</primary></indexterm>
-	<indexterm><primary>ADS</primary></indexterm>
-	<indexterm><primary>directory schema</primary></indexterm>
-	<indexterm><primary>account attributes</primary></indexterm>
-	<indexterm><primary>UID</primary></indexterm>
-	<indexterm><primary>GID</primary></indexterm>
-	<indexterm><primary>ADS schema</primary></indexterm>
-	<indexterm><primary>account management</primary></indexterm>
-	<indexterm><primary>MMC</primary></indexterm>
-	ADS uses a directory schema that can be extended to accommodate additional
-	account attributes such as UIDs and GIDs. The installation of Microsoft Service for UNIX 3.5 will expand
-	the normal ADS schema to include UNIX account attributes. These must of course be managed separately
-	through a snap-in module to the normal ADS account management MMC interface.
-	</para>
-
-	<para>
-	<indexterm><primary>PDC</primary></indexterm>
-	<indexterm><primary>passdb backend</primary></indexterm>
-	<indexterm><primary>BDC</primary></indexterm>
-	<indexterm><primary>LDAP backend</primary></indexterm>
-	Security identifiers used within a domain must be managed to avoid conflict and to preserve integrity.
-	In an NT4 domain context, the PDC manages the distribution of all security credentials to the backup
-	domain controllers (BDCs). At this time the only passdb backend for a Samba domain controller that is suitable
-	for such information is an LDAP backend.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Backup Domain Controller</title>
-
-	<para>
-	<indexterm><primary>BDC</primary></indexterm>
-	<indexterm><primary>read-only access</primary></indexterm>
-	<indexterm><primary>security credentials</primary></indexterm>
-	<indexterm><primary>LDAP</primary></indexterm>
-	<indexterm><primary>group account</primary></indexterm>
-	<indexterm><primary>write changes</primary></indexterm>
-	<indexterm><primary>directory</primary></indexterm>
-	BDCs have read-only access to security credentials that are stored in LDAP.
-	Changes in user or group account information are passed by the BDC to the PDC. Only the PDC can write
-	changes to the directory.
-	</para>
-
-	<para>
-	IDMAP information can be written directly to the LDAP server so long as all domain controllers
-	have access to the master (writable) LDAP server. Samba-3 at this time does not handle LDAP redirects
-	in the IDMAP backend. This means that it is is unsafe to use a slave (replicate) LDAP server with
-	the IDMAP facility.
-	</para>
-
-	</sect2>
-
-</sect1>
-
-<sect1>
-<title>Examples of IDMAP Backend Usage</title>
-
-<para>
-<indexterm><primary>Domain Member Server</primary><see>DMS</see></indexterm>
-<indexterm><primary>Domain Member Client</primary><see>DMC</see></indexterm>
-<indexterm><primary>DMS</primary></indexterm>
-<indexterm><primary>DMC</primary></indexterm>
-<indexterm><primary>winbind</primary></indexterm>
-Anyone who wishes to use <command>winbind</command> will find the following example configurations helpful.
-Remember that in the majority of cases <command>winbind</command> is of primary interest for use with
-domain member servers (DMSs) and domain member clients (DMCs).
-</para>
-
-	<sect2>
-	<title>Default Winbind TDB</title>
-
-	<para>
-	Two common configurations are used:
-	</para>
-
-	<itemizedlist>
-		<listitem><para>
-		Networks that have an NT4 PDC (with or without BDCs) or a Samba PDC (with or without BDCs).
-		</para></listitem>
-
-		<listitem><para>
-		Networks that use MS Windows 200x ADS.
-		</para></listitem>
-	</itemizedlist>
-
-	<sect3>
-	<title>NT4-Style Domains (Includes Samba Domains)</title>
-
-	<para>
-	<link linkend="idmapnt4dms">NT4 Domain Member Server smb.con</link> is a simple example of an NT4 DMS
-	&smb.conf; file that shows only the global section.
-	</para>
-
-<example id="idmapnt4dms">
-<title>NT4 Domain Member Server smb.conf</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">MEGANET2</smbconfoption>
-<smbconfoption name="security">DOMAIN</smbconfoption>
-<smbconfoption name="idmap uid">10000-20000</smbconfoption>
-<smbconfoption name="idmap gid">10000-20000</smbconfoption>
-<smbconfoption name="template primary group">"Domain Users"</smbconfoption>
-<smbconfoption name="template shell">/bin/bash</smbconfoption>
-</smbconfblock>
-</example>
-
-	<para>
-	<indexterm><primary>winbind</primary></indexterm>
-	<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
-	The use of <command>winbind</command> requires configuration of NSS. Edit the <filename>/etc/nsswitch.conf</filename>
-	so it includes the following entries:
-<screen>
-...
-passwd: files winbind
-shadow: files winbind
-group:  files winbind
-...
-hosts:  files [dns] wins
-...
-</screen>
-	The use of DNS in the hosts entry should be made only if DNS is used on site.
-	</para>
-
-	<para>
-	The creation of the DMS requires the following steps:
-	</para>
-
-	<procedure>
-		<step><para>
-		Create or install an &smb.conf; file with the above configuration.
-		</para></step>
-
-		<step><para>
-		Execute:
-<screen>
-&rootprompt; net rpc join -UAdministrator%password
-Joined domain MEGANET2.
-</screen>
-	<indexterm><primary>join</primary></indexterm>
-	The success of the join can be confirmed with the following command:
-<screen>
-&rootprompt; net rpc testjoin
-Join to 'MIDEARTH' is OK
-</screen>
-		A failed join would report an error message like the following:
-		<indexterm><primary>failed join</primary></indexterm>
-<screen>
-&rootprompt; net rpc testjoin
-[2004/11/05 16:34:12, 0] utils/net_rpc_join.c:net_rpc_join_ok(66)
-Join to domain 'MEGANET2' is not valid
-</screen>
-		</para></step>
-
-		<step><para>
-		<indexterm><primary>nmbd</primary></indexterm>
-		<indexterm><primary>winbind</primary></indexterm>
-		<indexterm><primary>smbd</primary></indexterm>
-		Start the <command>nmbd, winbind,</command> and <command>smbd</command> daemons in the order shown.
-		</para></step>
-	</procedure>
-
-	</sect3>
-
-	<sect3>
-	<title>ADS Domains</title>
-
-	<para>
-	<indexterm><primary>domain join</primary></indexterm>
-	<indexterm><primary>ADS domain</primary></indexterm>
-	The procedure for joining an ADS domain is similar to the NT4 domain join, except the &smb.conf; file
-	will have the contents shown in <link linkend="idmapadsdms">ADS Domain Member Server smb.conf</link>
-	</para>
-
-<example id="idmapadsdms">
-<title>ADS Domain Member Server smb.conf</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">BUTTERNET</smbconfoption>
-<smbconfoption name="netbios name">GARGOYLE</smbconfoption>
-<smbconfoption name="realm">BUTTERNET.BIZ</smbconfoption>
-<smbconfoption name="security">ADS</smbconfoption>
-<smbconfoption name="template shell">/bin/bash</smbconfoption>
-<smbconfoption name="idmap uid">500-10000000</smbconfoption>
-<smbconfoption name="idmap gid">500-10000000</smbconfoption>
-<smbconfoption name="winbind use default domain">Yes</smbconfoption>
-<smbconfoption name="winbind nested groups">Yes</smbconfoption>
-</smbconfblock>
-</example>
-
-	<para>
-	<indexterm><primary>KRB</primary></indexterm>
-	<indexterm><primary>kerberos</primary></indexterm>
-	<indexterm><primary>/etc/krb5.conf</primary></indexterm>
-	<indexterm><primary>MIT</primary></indexterm>
-	<indexterm><primary>MIT kerberos</primary></indexterm>
-	<indexterm><primary>Heimdal</primary></indexterm>
-	<indexterm><primary>Heimdal kerberos</primary></indexterm>
-	ADS DMS operation requires use of kerberos (KRB). For this to work, the <filename>krb5.conf</filename>
-	must be configured. The exact requirements depends on which version of MIT or Heimdal Kerberos is being
-	used. It is sound advice to use only the latest version, which at this time are MIT Kerberos version
-	1.3.5 and Heimdal 0.61.
-	</para>
-
-	<para>
-	The creation of the DMS requires the following steps:
-	</para>
-
-	<procedure>
-		<step><para>
-		Create or install an &smb.conf; file with the above configuration.
-		</para></step>
-
-		<step><para>
-		Edit the <filename>/etc/nsswitch.conf</filename> file as shown above.
-		</para></step>
-
-		<step><para>
-		Execute:
-		<indexterm><primary>net</primary><secondary>ads</secondary><tertiary>join</tertiary></indexterm>
-<screen>
-&rootprompt; net ads join -UAdministrator%password
-Joined domain BUTTERNET.
-</screen>
-	The success or failure of the join can be confirmed with the following command:
-<screen>
-&rootprompt; net ads testjoin
-Using short domain name -- BUTTERNET
-Joined 'GARGOYLE' to realm 'BUTTERNET.BIZ'
-</screen>
-	</para>
-
-	<para>
-	An invalid or failed join can be detected by executing:
-<screen>
-&rootprompt; net ads testjoin
-GARGOYLE$@'s password:
-[2004/11/05 16:53:03, 0] utils/net_ads.c:ads_startup(186)
-  ads_connect: No results returned
-Join to domain is not valid
-</screen>
-		<indexterm><primary>error message</primary></indexterm>
-		<indexterm><primary>failure</primary></indexterm>
-		<indexterm><primary>log level</primary></indexterm>
-		<indexterm><primary>identify</primary></indexterm>
-		The specific error message may differ from the above because it depends on the type of failure that
-		may have occurred. Increase the <parameter>log level</parameter> to 10, repeat the test,
-		and then examine the log files produced to identify the nature of the failure.
-		</para></step>
-
-		<step><para>
-		Start the <command>nmbd</command>, <command>winbind</command>, and <command>smbd</command> daemons in the order shown.
-		</para></step>
-
-	</procedure>
-
-	</sect3>
-	</sect2>
-
-	<sect2>
-	<title>IDMAP_RID with Winbind</title>
-
-	<para>
-	<indexterm><primary>idmap_rid</primary></indexterm>
-	<indexterm><primary>SID</primary></indexterm>
-	<indexterm><primary>RID</primary></indexterm>
-	<indexterm><primary>IDMAP</primary></indexterm>
-	The <command>idmap_rid</command> facility is a new tool that, unlike native winbind, creates a
-	predictable mapping of MS Windows SIDs to UNIX UIDs and GIDs. The key benefit of this method
-	of implementing the Samba IDMAP facility is that it eliminates the need to store the IDMAP data
-	in a central place. The downside is that it can be used only within a single ADS domain and
-	is not compatible with trusted domain implementations.
-	</para>
-
-	<para>
-	<indexterm><primary>SID</primary></indexterm>
-	<indexterm><primary>allow trusted domains</primary></indexterm>
-	<indexterm><primary>idmap uid</primary></indexterm>
-	<indexterm><primary>idmap gid</primary></indexterm>
-	This alternate method of SID to UID/GID  mapping can be achieved using the idmap_rid
-        plug-in. This plug-in uses the RID of the user SID to derive the UID and GID by adding the
-        RID to a base value specified. This utility requires that the parameter
-        <quote>allow trusted domains = No</quote> be specified, as it is not compatible
-        with multiple domain environments. The <parameter>idmap uid</parameter> and 
-	<parameter>idmap gid</parameter> ranges must be specified.
-	</para>
-
-	<para>
-	<indexterm><primary>idmap_rid</primary></indexterm>
-	<indexterm><primary>realm</primary></indexterm>
-	The idmap_rid facility can be used both for NT4/Samba-style domains and Active Directory.
-	To use this with an NT4 domain, do not include the <parameter>realm</parameter> parameter; additionally, the
-	method used to join the domain uses the <constant>net rpc join</constant> process.
-	</para>
-
-	<para>
-	An example &smb.conf; file for and ADS domain environment is shown in <link linkend="idmapadsridDMS">ADS
-	Domain Member smb.conf using idmap_rid</link>.
-	</para>
-
-<example id="idmapadsridDMS">
-<title>ADS Domain Member smb.conf using idmap_rid</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">KPAK</smbconfoption>
-<smbconfoption name="netbios name">BIGJOE</smbconfoption>
-<smbconfoption name="realm">CORP.KPAK.COM</smbconfoption>
-<smbconfoption name="server string">Office Server</smbconfoption>
-<smbconfoption name="security">ADS</smbconfoption>
-<smbconfoption name="allow trusted domains">No</smbconfoption>
-<smbconfoption name="idmap backend">idmap_rid:KPAK=500-100000000</smbconfoption>
-<smbconfoption name="idmap uid">500-100000000</smbconfoption>
-<smbconfoption name="idmap gid">500-100000000</smbconfoption>
-<smbconfoption name="template shell">/bin/bash</smbconfoption>
-<smbconfoption name="winbind use default domain">Yes</smbconfoption>
-<smbconfoption name="winbind enum users">No</smbconfoption>
-<smbconfoption name="winbind enum groups">No</smbconfoption>
-<smbconfoption name="winbind nested groups">Yes</smbconfoption>
-</smbconfblock>
-</example>
-
-	<para>
-	<indexterm><primary>large domain</primary></indexterm>
-	<indexterm><primary>Active Directory</primary></indexterm>
-	<indexterm><primary>response</primary></indexterm>
-	<indexterm><primary>getent</primary></indexterm>
-	In a large domain with many users it is imperative to disable enumeration of users and groups.
-	For example, at a site that has 22,000 users in Active Directory the winbind-based user and
-	group resolution is unavailable for nearly 12 minutes following first startup of 
-	<command>winbind</command>. Disabling enumeration resulted in instantaneous response.
-	The disabling of user and group enumeration means that it will not be possible to list users
-	or groups using the <command>getent passwd</command> and <command>getent group</command>
-	commands. It will be possible to perform the lookup for individual users, as shown in the following procedure.
-	</para>
-
-	<para>
-	<indexterm><primary>NSS</primary></indexterm>
-	<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
-	The use of this tool requires configuration of NSS as per the native use of winbind. Edit the
-	<filename>/etc/nsswitch.conf</filename> so it has the following parameters:
-<screen>
-...
-passwd: files winbind
-shadow: files winbind
-group:  files winbind
-...
-hosts:  files wins
-...
-</screen>
-	</para>
-
-	<para>
-	The following procedure can use the idmap_rid facility:
-	</para>
-
-	<procedure>
-		<step><para>
-		Create or install an &smb.conf; file with the above configuration.
-		</para></step>
-
-		<step><para>
-		Edit the <filename>/etc/nsswitch.conf</filename> file as shown above.
-		</para></step>
-
-		<step><para>
-		Execute:
-<screen>
-&rootprompt; net ads join -UAdministrator%password
-Using short domain name -- KPAK
-Joined 'BIGJOE' to realm 'CORP.KPAK.COM'
-</screen>
-		</para>
-
-		<para>
-		<indexterm><primary>failed join</primary></indexterm>
-		An invalid or failed join can be detected by executing:
-<screen>
-&rootprompt; net ads testjoin
-BIGJOE$@'s password:
-[2004/11/05 16:53:03, 0] utils/net_ads.c:ads_startup(186)
-  ads_connect: No results returned
-Join to domain is not valid
-</screen>
-		The specific error message may differ from the above because it depends on the type of failure that
-		may have occurred. Increase the <parameter>log level</parameter> to 10, repeat the test,
-		and then examine the log files produced to identify the nature of the failure.
-		</para></step>
-
-		<step><para>
-		Start the <command>nmbd</command>, <command>winbind</command>, and <command>smbd</command> daemons in the order shown.
-		</para></step>
-
-		<step><para>
-		Validate the operation of this configuration by executing:
-		<indexterm><primary></primary></indexterm>
-<screen>
-&rootprompt; getent passwd administrator
-administrator:x:1000:1013:Administrator:/home/BE/administrator:/bin/bash
-</screen>
-		</para></step>
-	</procedure>
-
-	</sect2>
-
-	<sect2>
-	<title>IDMAP Storage in LDAP Using Winbind</title>
-
-	<para>
-	<indexterm><primary>ADAM</primary></indexterm>
-	<indexterm><primary>ADS</primary></indexterm>
-	The storage of IDMAP information in LDAP can be used with both NT4/Samba-3-style domains and
-	ADS domains. OpenLDAP is a commonly used LDAP server for this purpose, although any
-	standards-complying LDAP server can be used. It is therefore possible to deploy this IDMAP
-	configuration using the Sun iPlanet LDAP server, Novell eDirectory, Microsoft ADS plus ADAM,
-	and so on.
-	</para>
-
-	<para>
-	An example is for an ADS domain is shown in <link linkend="idmapldapDMS">ADS Domain Member Server using
-	LDAP</link>.
-	</para>
-
-<example id="idmapldapDMS">
-<title>ADS Domain Member Server using LDAP</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">SNOWSHOW</smbconfoption>
-<smbconfoption name="netbios name">GOODELF</smbconfoption>
-<smbconfoption name="realm">SNOWSHOW.COM</smbconfoption>
-<smbconfoption name="server string">Samba Server</smbconfoption>
-<smbconfoption name="security">ADS</smbconfoption>
-<smbconfoption name="log level">1 ads:10 auth:10 sam:10 rpc:10</smbconfoption>
-<smbconfoption name="ldap admin dn">cn=Manager,dc=SNOWSHOW,dc=COM</smbconfoption>
-<smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
-<smbconfoption name="ldap suffix">dc=SNOWSHOW,dc=COM</smbconfoption>
-<smbconfoption name="idmap backend">ldap:ldap://ldap.snowshow.com</smbconfoption>
-<smbconfoption name="idmap uid">150000-550000</smbconfoption>
-<smbconfoption name="idmap gid">150000-550000</smbconfoption>
-<smbconfoption name="template shell">/bin/bash</smbconfoption>
-<smbconfoption name="winbind use default domain">Yes</smbconfoption>
-</smbconfblock>
-</example>
-
-	<para>
-	<indexterm><primary>realm</primary></indexterm>
-	In the case of an NT4 or Samba-3-style domain the <parameter>realm</parameter> is not used, and the
-	command used to join the domain is <command>net rpc join</command>. The above example also demonstrates
-	advanced error-reporting techniques that are documented in <link linkend="dbglvl">Reporting Bugs</link>.
-	</para>
-
-	<para>
-	<indexterm><primary>MIT kerberos</primary></indexterm>
-	<indexterm><primary>Heimdal kerberos</primary></indexterm>
-	<indexterm><primary>/etc/krb5.conf</primary></indexterm>
-	Where MIT kerberos is installed (version 1.3.4 or later), edit the <filename>/etc/krb5.conf</filename> 
-	file so it has the following contents:
-<screen>
-[logging]
- default = FILE:/var/log/krb5libs.log
- kdc = FILE:/var/log/krb5kdc.log
- admin_server = FILE:/var/log/kadmind.log
-
-[libdefaults]
- default_realm = SNOWSHOW.COM
- dns_lookup_realm = false
- dns_lookup_kdc = true
-
-[appdefaults]
- pam = {
-   debug = false
-   ticket_lifetime = 36000
-   renew_lifetime = 36000
-   forwardable = true
-   krb4_convert = false
- }
-</screen>
-	</para>
-
-	<para>
-	Where Heimdal kerberos is installed, edit the <filename>/etc/krb5.conf</filename>
-        file so it is either empty (i.e., no contents) or it has the following contents:
-<screen>
-[libdefaults]
-        default_realm = SNOWSHOW.COM
-        clockskew = 300
-
-[realms]
-        SNOWSHOW.COM = {
-                kdc = ADSDC.SHOWSHOW.COM
-        }
-        
-[domain_realm]
-        .snowshow.com = SNOWSHOW.COM
-</screen>
-	</para>
-
-	<note><para>
-	Samba cannot use the Heimdal libraries if there is no <filename>/etc/krb5.conf</filename> file.
-	So long as there is an empty file, the Heimdal kerberos libraries will be usable. There is no
-	need to specify any settings because Samba, using the Heimdal libraries, can figure this out automatically.
-	</para></note>
-
-	<para>
-	Edit the NSS control file <filename>/etc/nsswitch.conf</filename> so it has the following entries:
-<screen>
-...
-passwd: files ldap
-shadow: files ldap
-group:  files ldap
-...
-hosts:  files wins
-...
-</screen>
-	</para>
-
-	<para>
-	<indexterm><primary>PADL</primary></indexterm>
-	<indexterm><primary>/etc/ldap.conf</primary></indexterm>
-	You will need the <ulink url="http://www.padl.com">PADL</ulink> <command>nss_ldap</command> 
-	tool set for this solution. Configure the <filename>/etc/ldap.conf</filename> file so it has 
-	the information needed. The following is an example of a working file:
-<screen>
-host    192.168.2.1
-base    dc=snowshow,dc=com
-binddn  cn=Manager,dc=snowshow,dc=com
-bindpw  not24get
-
-pam_password exop
-
-nss_base_passwd ou=People,dc=snowshow,dc=com?one
-nss_base_shadow ou=People,dc=snowshow,dc=com?one
-nss_base_group  ou=Groups,dc=snowshow,dc=com?one
-ssl     no
-</screen>
-	</para>
-
-	<para>
-	The following procedure may be followed to effect a working configuration:
-	</para>
-
-	<procedure>
-		<step><para>
-		Configure the &smb.conf; file as shown above.
-		</para></step>
-
-		<step><para>
-		Create the <filename>/etc/krb5.conf</filename> file as shown above.
-		</para></step>
-
-		<step><para>
-		Configure the <filename>/etc/nsswitch.conf</filename> file as shown above.
-		</para></step>
-
-		<step><para>
-		Download, build, and install the PADL nss_ldap tool set. Configure the 
-		<filename>/etc/ldap.conf</filename> file as shown above.
-		</para></step>
-
-		<step><para>
-		Configure an LDAP server and initialize the directory with the top-level entries needed by IDMAP,
-		shown in the following LDIF file:
-<screen>
-dn: dc=snowshow,dc=com
-objectClass: dcObject
-objectClass: organization
-dc: snowshow
-o: The Greatest Snow Show in Singapore.
-description: Posix and Samba LDAP Identity Database
-
-dn: cn=Manager,dc=snowshow,dc=com
-objectClass: organizationalRole
-cn: Manager
-description: Directory Manager
-
-dn: ou=Idmap,dc=snowshow,dc=com
-objectClass: organizationalUnit
-ou: idmap
-</screen>
-		</para></step>
-
-		<step><para>
-		Execute the command to join the Samba DMS to the ADS domain as shown here:
-<screen>
-&rootprompt; net ads testjoin
-Using short domain name -- SNOWSHOW
-Joined 'GOODELF' to realm 'SNOWSHOW.COM'
-</screen>
-		</para></step>
-
-		<step><para>
-		Store the LDAP server access password in the Samba <filename>secrets.tdb</filename> file as follows:
-<screen>
-&rootprompt; smbpasswd -w not24get
-</screen>
-		</para></step>
-
-		<step><para>
-		Start the <command>nmbd</command>, <command>winbind</command>, and <command>smbd</command> daemons in the order shown.
-		</para></step>
-	</procedure>
-
-	<para>
-	<indexterm><primary>diagnostic</primary></indexterm>
-	Follow the diagnositic procedures shown earlier in this chapter to identify success or failure of the join.
-	In many cases a failure is indicated by a silent return to the command prompt with no indication of the
-	reason for failure.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</title>
-
-	<para>
-	<indexterm><primary>rfc2307bis</primary></indexterm>
-	<indexterm><primary>schema</primary></indexterm>
-	The use of this method is messy. The information provided in the following is for guidance only
-	and is very definitely not complete. This method does work; it is used in a number of large sites
-	and has an acceptable level of performance.
-	</para>
-
-	<para>
-	An example &smb.conf; file is shown in <link linkend="idmaprfc2307">ADS Domain Member Server using
-RFC2307bis Schema Extension Date via NSS</link>.
-	</para>
-
-<example id="idmaprfc2307">
-<title>ADS Domain Member Server using RFC2307bis Schema Extension Date via NSS</title>
-<smbconfblock>
-<smbconfcomment>Global parameters</smbconfcomment>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">BOBBY</smbconfoption>
-<smbconfoption name="realm">BOBBY.COM</smbconfoption>
-<smbconfoption name="security">ADS</smbconfoption>
-<smbconfoption name="idmap uid">150000-550000</smbconfoption>
-<smbconfoption name="idmap gid">150000-550000</smbconfoption>
-<smbconfoption name="template shell">/bin/bash</smbconfoption>
-<smbconfoption name="winbind cache time">5</smbconfoption>
-<smbconfoption name="winbind use default domain">Yes</smbconfoption>
-<smbconfoption name="winbind trusted domains only">Yes</smbconfoption>
-<smbconfoption name="winbind nested groups">Yes</smbconfoption>
-</smbconfblock>
-</example>
-
-	<para>
-	<indexterm><primary>nss_ldap</primary></indexterm>
-	The DMS must be joined to the domain using the usual procedure. Additionally, it is necessary
-	to build and install the PADL nss_ldap tool set. Be sure to build this tool set with the
-	following:
-<screen>
-./configure --enable-rfc2307bis --enable-schema-mapping
-make install
-</screen> 
-	</para>
-
-	<para>
-	<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
-	The following <filename>/etc/nsswitch.conf</filename> file contents are required:
-<screen>
-...
-passwd: files ldap
-shadow: files ldap
-group:  files ldap
-...
-hosts:  files wins
-...
-</screen>
-	</para>
-
-	<para>
-	<indexterm><primary>/etc/ldap.conf</primary></indexterm>
-	<indexterm><primary>nss_ldap</primary></indexterm>
-	The <filename>/etc/ldap.conf</filename> file must be configured also. Refer to the PADL documentation
-	and source code for nss_ldap to specific instructions.
-	</para>
-
-	<para>
-	The next step involves preparation of the ADS schema. This is briefly discussed in the remaining
-	part of this chapter.
-	</para>
-
-		<sect3>
-		<title>IDMAP, Active Directory, and MS Services for UNIX 3.5</title>
-
-		<para>
-		<indexterm><primary>SFU</primary></indexterm>
-		The Microsoft Windows Service for UNIX (SFU) version 3.5 is available for free 
-		<ulink url="http://www.microsoft.com/windows/sfu/">download</ulink>
-		from the Microsoft Web site. You will need to download this tool and install it following
-		Microsoft instructions.
-		</para>
-
-		</sect3>
-
-		<sect3>
-		<title>IDMAP, Active Directory and AD4UNIX</title>
-
-		<para>
-		Instructions for obtaining and installing the AD4UNIX tool set can be found from the
-		<ulink url="http://www.geekcomix.com/cgi-bin/classnotes/wiki.pl?LDAP01/An_Alternative_Approach">
-		Geekcomix</ulink> Web site.
-		</para>
-
-		</sect3>
-
-	</sect2>
-
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-Install.xml b/docs-xml/Samba3-HOWTO/TOSHARG-Install.xml
deleted file mode 100644
index 88e0ed8..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-Install.xml
+++ /dev/null
@@ -1,687 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="install">
-<chapterinfo>
-	&author.tridge;
-	&author.jelmer;
-	&author.jht;
-	&author.kauer;
-	&author.danshearer;
-	<!-- Isn't some of this written by others as well? -->
-
-</chapterinfo>
-
-<title>How to Install and Test SAMBA</title>
-
-<sect1>
-	<title>Obtaining and Installing Samba</title>
-
-	<para>
-	<indexterm><primary>packages</primary></indexterm>
-	Binary packages of Samba are included in almost any Linux or UNIX distribution. There are also some
-	packages available at <ulink url="http://samba.org/">the Samba home page</ulink>. Refer to the manual of your
-	operating system for details on installing packages for your specific operating system.
-	</para>
-
-	<para>
-	<indexterm><primary>compile</primary></indexterm>
-	If you need to compile Samba from source, check <link linkend="compiling">How to Compile Samba</link>.
-	</para>
-
-</sect1>
-
-<sect1>
-	<title>Configuring Samba (smb.conf)</title>
-
-	<para>
-	<indexterm><primary>/etc/samba/smb.conf</primary></indexterm>
-	<indexterm><primary>SWAT</primary></indexterm>
-	Samba's configuration is stored in the &smb.conf; file, which usually resides in
-	<filename>/etc/samba/smb.conf</filename> or <filename>/usr/local/samba/lib/smb.conf</filename>. You can either
-	edit this file yourself or do it using one of the many graphical tools that are available, such as the
-	Web-based interface SWAT, that is included with Samba.
-	</para>
-
-	<sect2>
-	<title>Configuration File Syntax</title>
-
-	<para>
-	<indexterm><primary>section name</primary></indexterm>
-	The &smb.conf; file uses the same syntax as the various old <filename>.ini</filename> files in Windows
-	3.1: Each file consists of various sections, which are started by putting the section name between brackets
-	(<literal>[]</literal>) on a new line. Each contains zero or more key/value pairs separated by an equality
-	sign (<literal>=</literal>). The file is just a plaintext file, so you can open and edit it with your favorite
-	editing tool.
-	</para>
-
-	<para>
-	<indexterm><primary>meta-service</primary></indexterm>
-	<indexterm><primary>print</primary><secondary>queue</secondary></indexterm>
-	<indexterm><primary>share</primary></indexterm>
-	<indexterm><primary>spooler.</primary></indexterm>
-	<indexterm><primary>print</primary><secondary>spooler</secondary></indexterm>
-	<indexterm><primary>spool</primary><secondary>directory</secondary></indexterm>
-	Each section in the &smb.conf; file represents either a share or a meta-service on the Samba server. The
-	section <literal>[global]</literal> is special, since it contains settings that apply to the whole Samba
-	server.  Samba supports a number of meta-services, each of which serves its own purpose. For example, the
-	<literal>[homes]</literal> share is a meta-service that causes Samba to provide a personal home share for
-	each user. The <literal>[printers]</literal> share is a meta-service that establishes print queue support
-	and that specifies the location of the intermediate spool directory into which print jobs are received
-	from Windows clients prior to being dispatched to the UNIX/Linux print spooler.
-	</para>
-
-	<para>
-<indexterm><primary>printers</primary></indexterm>
-<indexterm><primary>meta-service</primary></indexterm>
-<indexterm><primary>printcap</primary></indexterm>
-<indexterm><primary>lpstat</primary></indexterm>
-<indexterm><primary>CUPS API</primary></indexterm>
-<indexterm><primary>browseable</primary></indexterm>
-	The <literal>printers</literal> meta-service will cause every printer that is either specified in a
-	<literal>printcap</literal> file, via the <command>lpstat</command>,  or via the CUPS API, to be
-	published as a shared print queue. The <literal>printers</literal> stanza in the &smb.conf; file can
-	be set as not browseable. If it is set to be browseable, then it will be visible as if it is a share.
-	That makes no sense given that this meta-service is responsible only for making UNIX system printers
-	available as Windows print queues. If a <literal>comment</literal> parameter is specified, the value
-	of it will be displayed as part of the printer name in Windows Explorer browse lists.
-	</para>
-
-	<para>
-	<indexterm><primary>stanza</primary></indexterm>
-	Each section of the &smb.conf; file that specifies a share, or a meta-service, is called a stanza.
-	The <literal>global</literal> stanza specifies settings that affect all the other stanzas in the
-	&smb.conf; file. Configuration parameters are documented in the &smb.conf; man page. Some parameters
-	can be used only in the <literal>global</literal> stanza, some only in share or meta-service stanzas,
-	and some can be used globally or just within a share or meta-service stanza.
-	</para>
-
-	<para>
-	<indexterm><primary>minimal</primary><secondary>configuration</secondary></indexterm>
-	<link linkend="smbconfminimal">A minimal smb.conf</link> contains a very minimal &smb.conf;.
-	<indexterm><primary>minimal configuration</primary></indexterm>
-	</para>
-
-	<example id="smbconfminimal">
-		<title>A minimal smb.conf</title>
-		<smbconfblock>
-
-		<smbconfsection name="[global]"/>
-		<smbconfoption name="workgroup">WKG</smbconfoption>
-		<smbconfoption name="netbios name">MYNAME</smbconfoption>
-		<smbconfsection name="[share1]"/>
-		<smbconfoption name="path">/tmp</smbconfoption>
-
-		<smbconfsection name="[share2]"/>
-		<smbconfoption name="path">/my_shared_folder</smbconfoption>
-		<smbconfoption name="comment">Some random files</smbconfoption>
-	</smbconfblock>
-	</example>
-
-</sect2>
-
-<sect2 id="tdbdocs">
-	<title>TDB Database File Information</title>
-
-	<para>
-	This section contains brief descriptions of the databases that are used by Samba-3.
-	</para>
-
-	<para>
-<indexterm><primary>tdb file locations</primary></indexterm>
-	The directory in which Samba stores the tdb files is determined by compile-time directives. Samba-3 stores
-	tdb files in two locations. The best way to determine these locations is to execute the following
-	command:
-<screen>
-&rootprompt; smbd -b | grep PRIVATE_DIR
-   PRIVATE_DIR: /etc/samba/private
-</screen>
-	This means that the confidential tdb files are stored in the <filename>/etc/samba/private</filename>
-	directory. Samba-3 also uses a number of tdb files that contain more mundane data. The location of
-	these files can be found by executing:
-<screen>
-&rootprompt; smbd -b | grep LOCKDIR
-   LOCKDIR: /var/lib/samba
-</screen>
-	Therefore the remaining control files will, in the example shown, be stored in the
-	<filename>/var/lib/samba</filename> directory.
-	</para>
-
-	<para>
-<indexterm><primary>tdb file descriptions</primary></indexterm>
-	The persistent tdb files are described in <link linkend="tdbpermfiledesc">the Persistent TDB File
-	Descriptions table</link>. All persistent tdb files should be regularly backed up. Use the
-	<command>tdbbackup</command> utility to backup the tdb files. All persistent tdb files must be
-	preserved during machine migrations, updates and upgrades.
-	</para>
-
-	<para>
-	The temporary tdb files do not need to be backed up, nor do they need to be preseved across machine
-	migrations, updates or upgrades. The temporary tdb files are described in <link linkend="tdbtempfiledesc">
-	the Temporary TDB File Descriptions</link>.
-	</para>
-
-        <table frame='all' id="tdbpermfiledesc"><title>Persistent TDB File Descriptions</title>
-        <tgroup cols='2'>
-			<colspec align="left"/>
-			<colspec align="justify" colwidth="1*"/>
-			<colspec align="left"/>
-                <thead>
-                <row>
-                        <entry align="left">Name</entry>
-                        <entry align="justify">Description</entry>
-                </row>
-                </thead>
-                <tbody>
-		<row>
-			<entry>account_policy</entry>
-			<entry><para>Samba/NT account policy settings, includes password expiration settings.</para></entry>
-		</row>
-		<row>
-			<entry>group_mapping</entry>
-			<entry><para>Mapping table from Windows groups/SID to UNIX groups.</para></entry>
-		</row>
-		<row>
-			<entry>ntdrivers</entry>
-			<entry><para>Stores per-printer installed driver information.</para></entry>
-		</row>
-		<row>
-			<entry>ntforms</entry>
-			<entry><para>Stores per-printer installed forms information.</para></entry>
-		</row>
-		<row>
-			<entry>ntprinters</entry>
-			<entry><para>Stores the per-printer devmode configuration settings.</para></entry>
-		</row>
-		<row>
-			<entry>passdb</entry>
-			<entry><para>
-				Exists only when the tdbsam passwd backend is used. This file stores the
-				SambaSAMAccount information. Note: This file requires that user POSIX account information is
-				available from either the /etc/passwd file, or from an alternative system source.
-			</para></entry>
-		</row>
-		<row>
-			<entry>registry</entry>
-			<entry><para>
-				Read-only Samba database of a Windows registry skeleton that provides support for exporting 
-				various database tables via the winreg RPCs.
-			</para></entry>
-		</row>
-		<row>
-			<entry>secrets</entry>
-			<entry><para>
-				This file stores the Workgroup/Domain/Machine SID, the LDAP directory update password, and
-				a further collection of critical environmental data that is necessary for Samba to operate
-				correctly. This file contains very sensitive information that must be protected. It is stored
-				in the PRIVATE_DIR directory.
-			</para></entry>
-		</row>
-		<row>
-			<entry>share_info</entry>
-			<entry><para>Stores per-share ACL information.</para></entry>
-		</row>
-		<row>
-			<entry>winbindd_idmap</entry>
-			<entry><para>Winbindd's local IDMAP database.</para></entry>
-		</row>
-		</tbody>
-	</tgroup>
-	</table>
-
-        <table frame='all' id="tdbtempfiledesc"><title>Temporary TDB File Descriptions</title>
-        <tgroup cols='3'>
-			<colspec align="left"/>
-			<colspec align="justify" colwidth="1*"/>
-			<colspec align="left"/>
-                <thead>
-                <row>
-                        <entry align="left">Name</entry>
-                        <entry align="justify">Description</entry>
-                        <entry align="center">Backup</entry>
-                </row>
-                </thead>
-                <tbody>
-		<row>
-			<entry>brlock</entry>
-			<entry><para>Byte-range locking information.</para></entry>
-			<entry>No</entry>
-		</row>
-		<row>
-			<entry>connections</entry>
-			<entry><para>A temporary cache for current connection information used to enforce max connections.</para></entry>
-			<entry>no</entry>
-		</row>
-		<row>
-			<entry>eventlog/*tdb</entry>
-			<entry><para>Records of eventlog entries. In most circumstances this is just a cache of system logs.</para></entry>
-			<entry>no</entry>
-		</row>
-		<row>
-			<entry>gencache</entry>
-			<entry><para>Generic caching database for dead WINS servers and trusted domain data.</para></entry>
-			<entry>no</entry>
-		</row>
-		<row>
-			<entry>login_cache</entry>
-			<entry><para>A temporary cache for login information, in particular bad password attempts.</para></entry>
-			<entry>no</entry>
-		</row>
-		<row>
-			<entry>messages</entry>
-			<entry><para>Temporary storage of messages being processed by smbd.</para></entry>
-			<entry>no</entry>
-		</row>
-		<row>
-			<entry>netsamlogon_cache</entry>
-			<entry><para>Caches user net_info_3 structure data from net_samlogon requests (as a domain member).</para></entry>
-			<entry>no</entry>
-		</row>
-		<row>
-			<entry>perfmon/*.tdb</entry>
-			<entry><para>Performance counter information.</para></entry>
-			<entry>no</entry>
-		</row>
-		<row>
-			<entry>printing/*.tdb</entry>
-			<entry><para>Cached output from lpq command created on a per-print-service basis.</para></entry>
-			<entry>no</entry>
-		</row>
-		<row>
-			<entry>schannel_store</entry>
-			<entry><para>
-				A confidential file, stored in the PRIVATE_DIR, containing crytographic connection
-				information so that clients that have temporarily disconnected can reconnect without
-				needing to renegotiate the connection setup process.
-			</para></entry>
-			<entry>no</entry>
-		</row>
-		<row>
-			<entry>sessionid</entry>
-			<entry><para>Temporary cache for miscellaneous session information and for utmp handling.</para></entry>
-			<entry>no</entry>
-		</row>
-		<row>
-			<entry>unexpected</entry>
-			<entry><para>Stores packets received for which no process is actively listening.</para></entry>
-			<entry>no</entry>
-		</row>
-		<row>
-			<entry>winbindd_cache</entry>
-			<entry><para>Cache of Identity information received from an NT4 domain or from ADS. Includes user
-				lists, etc.</para></entry>
-			<entry>yes</entry>
-		</row>
-		</tbody>
-	</tgroup>
-	</table>
-
-</sect2>
-
-<sect2>
-	<title>Starting Samba</title>
-
-	<para>
-	<indexterm><primary>daemon</primary></indexterm>
-	Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services.
-	An example of a service is the Apache Web server for which the daemon is called <command>httpd</command>. In the case of Samba there
-	are three daemons, two of which are needed as a minimum.
-	</para>
-
-	<para>
-	The Samba server is made up of the following daemons:
-	</para>
-
-	<variablelist>
-		<varlistentry><term>nmbd</term>
-			<listitem><para>
-			<indexterm><primary>nmbd</primary></indexterm>
-			<indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
-			This daemon handles all name registration and resolution requests. It is the primary vehicle involved
-			in network browsing. It handles all UDP-based protocols. The <command>nmbd</command> daemon should
-			be the first command started as part of the Samba startup process.
-			</para></listitem>
-		</varlistentry>
-
-		<varlistentry><term>smbd</term>
-			<listitem><para>
-			<indexterm><primary>smbd</primary></indexterm>
-			<indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
-			This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also
-			manages local authentication. It should be started immediately following the startup of <command>nmbd</command>.
-			</para></listitem>
-		</varlistentry>
-
-		<varlistentry><term>winbindd</term>
-			<listitem><para>
-			<indexterm><primary>winbindd</primary></indexterm>
-			<indexterm><primary>starting samba</primary><secondary>winbindd</secondary></indexterm>
-			This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when
-			Samba has trust relationships with another domain. The <command>winbindd</command> daemon will check the
-			&smb.conf; file for the presence of the <parameter>idmap uid</parameter> and <parameter>idmap gid</parameter>
-			parameters. If they are are found, <command>winbindd</command> will use the values specified for
-			for UID and GID allocation. If these parameters are not specified, <command>winbindd</command>
-			will start but it will not be able to allocate UIDs or GIDs.
-			</para></listitem>
-		</varlistentry>
-	</variablelist>
-
-	<para>
-	<indexterm><primary>startup</primary><secondary>process</secondary></indexterm>
-	When Samba has been packaged by an operating system vendor, the startup process is typically a custom feature of its
-	integration into the platform as a whole. Please refer to your operating system platform administration manuals for
-	specific information pertaining to correct management of Samba startup.
-	</para>
-
-</sect2>
-	
-<sect2>
-	<title>Example Configuration</title>
-	
-	<para>
-	<indexterm><primary>examples</primary></indexterm>
-	<indexterm><primary>source code</primary></indexterm>
-	<indexterm><primary>distribution</primary></indexterm>
-	<indexterm><primary>tarball</primary></indexterm>
-	<indexterm><primary>package</primary></indexterm>
-	There are sample configuration files in the examples subdirectory in the source code distribution tarball
-	package. It is suggested you read them carefully so you can see how the options go together in practice. See
-	the man page for all the options.  It might be worthwhile to start out with the
-	<filename>smb.conf.default</filename> configuration file and adapt it to your needs. It contains plenty of comments.
-	</para>
-
-	<para>
-	<indexterm><primary>simplest</primary><secondary>configuration</secondary></indexterm>
-	The simplest useful configuration file would contain something like that shown in
-	<link linkend="simple-example">Another simple smb.conf File</link>.
-	<indexterm><primary>simple configuration</primary></indexterm>
-	</para>
-
-<example id="simple-example">
-<title>Another simple smb.conf File</title>
-<smbconfblock>
-<smbconfsection name="[global]"/>
-<smbconfoption name="workgroup">&example.workgroup;</smbconfoption>
-
-<smbconfsection name="[homes]"/>
-<smbconfoption name="guest ok">no</smbconfoption>
-<smbconfoption name="read only">no</smbconfoption>
-</smbconfblock>
-</example>
-	
-	<para>
-	<indexterm><primary>connections</primary></indexterm>
-	<indexterm><primary>account</primary></indexterm>
-	<indexterm><primary>login name</primary></indexterm>
-	<indexterm><primary>service name</primary></indexterm>
-	This will allow connections by anyone with an account on the server, using either
-	their login name or <smbconfsection name="homes"/> as the service name.
-	(Note: The workgroup that Samba should appear in must also be set. The default
-	workgroup name is WORKGROUP.)
-	</para>
-	
-	<para>
-	<indexterm><primary>smbd</primary></indexterm>
-	Make sure you put the &smb.conf; file in the correct place. Note, the correct location of this file
-	depends on how the binary files were built. You can discover the correct location by executing from
-	the directory that contains the <command>smbd</command> command file:
-<screen>
-&rootprompt; smbd -b | grep smb.conf
-</screen>
-	</para>
-
-	<para>
-	<indexterm><primary>security</primary><secondary>settings</secondary></indexterm>
-	For more information about security settings for the <smbconfsection name="[homes]"/> share, please refer to 
-	<link linkend="securing-samba">Securing Samba</link>.
-	</para>
-
-<sect3>
-	<title>Test Your Config File with <command>testparm</command></title>
-
-	<para>
-	<indexterm><primary>validate</primary></indexterm>
-	<indexterm><primary>testparm</primary></indexterm>
-	<indexterm><primary>misconfigurations</primary></indexterm>
-	It's important to validate the contents of the &smb.conf; file using the &testparm; program.
-	If testparm runs correctly, it will list the loaded services. If not, it will give an error message.
-	Make sure it runs correctly and that the services look reasonable before proceeding. Enter the command: 
-	<screen>
-	&rootprompt; testparm /etc/samba/smb.conf
-	</screen>
-	Testparm will parse your configuration file and report any unknown parameters or incorrect syntax.
-	It also performs a check for common misconfigurations and will issue a warning if one is found.
-	</para>
-
-	<para>
-	Always run testparm again whenever the &smb.conf; file is changed!
-	</para>
-
-	<para>
-	<indexterm><primary>smbd</primary></indexterm>
-	<indexterm><primary>nmbd</primary></indexterm>
-	<indexterm><primary>winbindd</primary></indexterm>
-	<indexterm><primary>configuration</primary><secondary>documentation</secondary></indexterm>
-	The &smb.conf; file is constantly checked by the Samba daemons <command>smbd</command> and every instance of
-	itself that it spawns, <command>nmbd</command> and <command>winbindd</command>. It is good practice to
-	keep this file as small as possible. Many administrators prefer to document Samba configuration settings
-	and thus the need to keep this file small goes against good documentation wisdom. One solution that may
-	be adopted is to do all documentation and configuration in a file that has another name, such as
-	<filename>smb.conf.master</filename>. The <command>testparm</command> utility can be used to generate a
-	fully optimized &smb.conf; file from this master configuration and documentation file as shown here:
-<screen>
-&rootprompt; testparm -s smb.conf.master > smb.conf
-</screen>
-	This administrative method makes it possible to maintain detailed configuration change records while at
-	the same time keeping the working &smb.conf; file size to the minimum necessary.
-	</para>
-
-</sect3>
-</sect2>
-
-<sect2>
-	<title>SWAT</title>
-
-	<para>
-	<indexterm><primary>swat</primary></indexterm>
-	SWAT is a Web-based interface that can be used to facilitate the configuration of Samba.  SWAT might not
-	be available in the Samba package that shipped with your platform, but in a separate package. If you need to build SWAT please read the SWAT man page regarding compilation, installation, and
-	configuration of SWAT from the source code.
-	</para>
-
-	<para>
-	To launch SWAT, just run your favorite Web browser and point it to
-	<ulink url="http://localhost:901/" noescape="1">http://localhost:901/</ulink>.
-	Replace <replaceable>localhost</replaceable> with the name of the computer on which
-	Samba is running if that is a different computer than your browser.
-	</para>
-
-	<para>
-	SWAT can be used from a browser on any IP-connected machine, but be aware that connecting from a remote
-	machine leaves your connection open to password sniffing because passwords will be sent over the wire in the clear.
-	</para>
-
-	<para>
-	Please note that re-writing the configuration file using SWAT will
-	remove all comments!
-	More information about SWAT can be found in <link linkend="SWAT">The Samba Web Administration Tool</link>.
-	</para>
-
-</sect2>
-
-</sect1>
-
-<sect1>
-	<title>List Shares Available on the Server</title>
-
-	<para>
-	To list shares that are available from the configured Samba server, execute the
-	following command:
-	</para>
-
-<para><screen>
-&prompt;<userinput>smbclient -L <replaceable>yourhostname</replaceable></userinput>
-</screen></para>
-
-	<para>
-	You should see a list of shares available on your server. If you do not, then
-	something is incorrectly configured. This method can also be used to see what shares 
-	are available on other SMB servers, such as Windows 2000.
-	</para>
-
-	<para>
-	If you choose user-level security, you may find that Samba requests a password
-	before it will list the shares. See the <command>smbclient</command> man page for details.
-	You can force it to list the shares without a password by adding the option
-	<option>-N</option> to the command line. 
-	</para>
-</sect1>
-
-<sect1>
-	<title>Connect with a UNIX Client</title>
-	
-	<para>
-	Enter the following command:
-<screen>
-&prompt;<userinput>smbclient <replaceable> //yourhostname/aservice</replaceable></userinput>
-</screen></para>
-	
-	<para>Typically <replaceable>yourhostname</replaceable> is the name of the host on which &smbd;
-	has been installed. The <replaceable>aservice</replaceable> is any service that has been defined in the &smb.conf;
-	file. Try your username if you just have a <smbconfsection name="[homes]"/> section in the &smb.conf; file.</para>
-
-	<para>Example: If the UNIX host is called <replaceable>bambi</replaceable> and a valid login name
-	is <replaceable>fred</replaceable>, you would type:</para>
-
-<para><screen>
-&prompt;<userinput>smbclient //<replaceable>bambi</replaceable>/<replaceable>fred</replaceable></userinput>
-</screen></para>
-</sect1>
-
-<sect1>
-	<title>Connect from a Remote SMB Client</title>
-
-	<para>
-	Now that Samba is working correctly locally, you can try to access it from other clients. Within a few
-	minutes, the Samba host should be listed in the Network Neighborhood on all Windows clients of its subnet.
-	Try browsing the server from another client or "mounting" it.
-	</para>
-
-	<para>
-	Mounting disks from a DOS, Windows, or OS/2 client can be done by running a command such as:
-<screen>
-&dosprompt;<userinput>net use m: \\servername\service</userinput>
-</screen>
-	Where the drive letter m: is any available drive letter. It is important to double-check that the
-	service (share) name that you used does actually exist.
-	</para>
-
-	<para>
-	Try printing, for example,
-<screen>
-&dosprompt;<userinput>net use lpt1:	\\servername\spoolservice</userinput>
-</screen>
-	The <literal>spoolservice</literal> is the name of the printer (actually the print queue) on the target
-	server. This will permit all print jobs that are captured by the lpt1: port on the Windows client to
-	be sent to the printer that owns the spoolservice that has been specified.
-	</para>
-
-<para>
-<screen>&dosprompt;<userinput>print filename</userinput>
-</screen></para>
-
-	<sect2>
-	<title>What If Things Don't Work?</title>
-	
-	<para>
-	You might want to read <link linkend="diagnosis">The Samba Checklist</link>.  If you are still
-	stuck, refer to <link linkend="problems">Analyzing and Solving Samba Problems</link>.  Samba has
-	been successfully installed at thousands of sites worldwide.  It is unlikely that your particular problem is
-	unique, so it might be productive to perform an Internet search to see if someone else has encountered your
-	problem and has found a way to overcome it.
-	</para>
-
-	<para>
-	If you are new to Samba, and particularly if you are new to Windows networking, or to UNIX/Linux,
-	the book <quote>Samba-3 by Example</quote> will help you to create a validated network environment.
-	Simply choose from the first five chapters the network design that most closely matches site needs,
-	then follow the simple step-by-step procedure to deploy it. Later, when you have a working network
-	you may well want to refer back to this book for further insight into opportunities for improvement.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Still Stuck?</title>
-
-	<para>
-	The best advice under the stress of abject frustration is to cool down! That may be challenging
-	of itself, but while you are angry or annoyed your ability to seek out a solution is somewhat
-	undermined. A cool head clears the way to finding the answer you are looking for. Just remember,
-	every problem has a solution &smbmdash; there is a good chance that someone else has found it
-	even though you can't right now. That will change with time, patience and learning.
-	</para>
-
-	<para>
-	Now that you have cooled down a bit, please refer to <link linkend="diagnosis">the Samba Checklist</link>
-	for a process that can be followed to identify the cause of your problem.
-	</para>
-
-	</sect2>
-
-</sect1>
-
-<sect1>
-<title>Common Errors</title>
-
-<para>
-The following questions and issues are raised repeatedly on the Samba mailing list.
-</para>
-
-<sect2>
-	<title>Large Number of smbd Processes</title>
-
-	<para>
-	Samba consists of three core programs: &nmbd;, &smbd;, and &winbindd;. &nmbd; is the name server message daemon,
-	&smbd; is the server message daemon, and &winbindd; is the daemon that handles communication with domain controllers.
-	</para>
-
-	<para>
-	If Samba is <emphasis>not</emphasis> running as a WINS server, then there will be one single instance of
-	 &nmbd; running on your system. If it is running as a WINS server, then there will be
-	two instances &smbmdash; one to handle the WINS requests.
-	</para>
-
-	<para>
-	&smbd; handles all connection requests. It spawns a new process for each client
-	connection made. That is why you may see so many of them, one per client connection.
-	</para>
-
-	<para>
-	&winbindd; will run as many processes depending in part on how many
-	domains it needs to contact.
-	</para>
-
-	</sect2>
-
-	<sect2>
-		<title><quote><errorname>The network name cannot be found</errorname></quote></title>
-
-		<para>
-		This error can be caused by one of these misconfigurations:
-		</para>
-
-		<itemizedlist>
-			<listitem><para>You specified a nonexisting path
-			for the share in &smb.conf;.</para></listitem>
-
-			<listitem><para>The user you are trying to access the share with does not 
-			have sufficient permissions to access the path for
-			the share. Both read (r) and access (x) should be possible.</para></listitem>
-
-			<listitem><para>The share you are trying to access does not exist.</para></listitem>
-	</itemizedlist>
-
-	</sect2>
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-Integrating-with-Windows.xml b/docs-xml/Samba3-HOWTO/TOSHARG-Integrating-with-Windows.xml
deleted file mode 100644
index 68b9d49..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-Integrating-with-Windows.xml
+++ /dev/null
@@ -1,745 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="integrate-ms-networks">
- 
-<chapterinfo>
-	&author.jht;
-        <pubdate> (Jan 01 2001) </pubdate>
-</chapterinfo>
- 
-<title>Integrating MS Windows Networks with Samba</title>
- 
-<para>
-<indexterm><primary>NetBIOS</primary></indexterm>
-This chapter deals with NetBIOS over TCP/IP name to IP address resolution. If
-your MS Windows clients are not configured to use NetBIOS over TCP/IP, then this
-section does not apply to your installation. If your installation involves the use of
-NetBIOS over TCP/IP, then this chapter may help you to resolve networking problems.
-</para>
-
-<note>
-<para>
-<indexterm><primary>NetBEUI</primary></indexterm>
-<indexterm><primary>LLC</primary></indexterm>
-NetBIOS over TCP/IP has nothing to do with NetBEUI. NetBEUI is NetBIOS
-over Logical Link Control (LLC). On modern networks it is highly advised
-to not run NetBEUI at all. Note also that there is no such thing as
-NetBEUI over TCP/IP &smbmdash; the existence of such a protocol is a complete
-and utter misapprehension.
-</para>
-</note>
-
-<sect1>
-<title>Features and Benefits</title>
-
-<para>
-Many MS Windows network administrators have never been exposed to basic TCP/IP
-networking as it is implemented in a UNIX/Linux operating system. Likewise, many UNIX and
-Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP-based
-networking (and may have no desire to be, either).
-</para>
-
-<para>
-This chapter gives a short introduction to the basics of how a name can be resolved to 
-its IP address for each operating system environment.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Background Information</title>
-
-<para>
-<indexterm><primary>NetBIOS over TCP/IP</primary></indexterm>
-<indexterm><primary>UDP port 137</primary></indexterm>
-<indexterm><primary>TCP port 139</primary></indexterm>
-<indexterm><primary>TCP port 445</primary></indexterm>
-<indexterm><primary>UDP port 137</primary></indexterm>
-Since the introduction of MS Windows 2000, it is possible to run MS Windows networking
-without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS
-name resolution and uses TCP port 139 for NetBIOS session services. When NetBIOS over
-TCP/IP is disabled on MS Windows 2000 and later clients, then only the TCP port 445 is
-used, and the UDP port 137 and TCP port 139 are not.
-</para>
-
-<note>
-<para>
-When using Windows 2000 or later clients, if NetBIOS over TCP/IP is not disabled, then
-the client will use UDP port 137 (NetBIOS Name Service, also known as the Windows Internet
-Name Service, or WINS), TCP port 139, and TCP port 445 (for actual file and print traffic).
-</para>
-</note>
-
-<para>
-<indexterm><primary>DNS</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-<indexterm><primary>DDNS</primary></indexterm>
-<indexterm><primary>SRV RR</primary></indexterm>
-<indexterm><primary>IXFR</primary></indexterm>
-<indexterm><primary>DHCP</primary></indexterm>
-When NetBIOS over TCP/IP is disabled, the use of DNS is essential. Most installations that disable NetBIOS
-over TCP/IP today use MS Active Directory Service (ADS). ADS requires
-<indexterm><primary>DNS</primary><secondary>Dynamic</secondary></indexterm> dynamic DNS with Service Resource
-Records (SRV RR) and with Incremental Zone Transfers (IXFR).  <indexterm><primary>DHCP</primary></indexterm>
-Use of DHCP with ADS is recommended as a further means of maintaining central control over the client
-workstation network configuration.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Name Resolution in a Pure UNIX/Linux World</title>
-
-<para>
-The key configuration files covered in this section are:
-</para>
-
-<indexterm><primary>/etc/hosts</primary></indexterm>
-<indexterm><primary>/etc/resolv.conf</primary></indexterm>
-<indexterm><primary>/etc/host.conf</primary></indexterm>
-<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
-
-<itemizedlist>
-	<listitem><para><filename>/etc/hosts</filename></para></listitem>
-	<listitem><para><filename>/etc/resolv.conf</filename></para></listitem>
-	<listitem><para><filename>/etc/host.conf</filename></para></listitem>
-	<listitem><para><filename>/etc/nsswitch.conf</filename></para></listitem>
-</itemizedlist>
-
-<sect2>
-<title><filename>/etc/hosts</filename></title>
-
-<para>
-This file contains a static list of IP addresses and names.
-<programlisting>
-127.0.0.1	localhost localhost.localdomain
-192.168.1.1	bigbox.quenya.org	bigbox	alias4box
-</programlisting>
-</para>
-
-<para>
-<indexterm><primary>/etc/hosts></primary></indexterm>
-<indexterm><primary>name resolution</primary></indexterm>
-The purpose of <filename>/etc/hosts</filename> is to provide a 
-name resolution mechanism so users do not need to remember 
-IP addresses.
-</para>
-
-<para>
-<indexterm><primary>IP addresses</primary></indexterm>
-<indexterm><primary>MAC address</primary></indexterm>
-<indexterm><primary>physical network transport layer</primary></indexterm>
-Network packets that are sent over the physical network transport 
-layer communicate not via IP addresses but rather using the Media 
-Access Control address, or MAC address. IP addresses are currently 
-32 bits in length and are typically presented as four decimal 
-numbers that are separated by a dot (or period) &smbmdash; for example, 168.192.1.1.
-</para>
-
-<para>
-<indexterm><primary>MAC Addresses</primary></indexterm>
-MAC addresses use 48 bits (or 6 bytes) and are typically represented 
-as two-digit hexadecimal numbers separated by colons: 40:8e:0a:12:34:56.
-</para>
-
-<para>
-Every network interface must have a MAC address. Associated with a MAC address may be one or more IP
-addresses. There is no relationship between an IP address and a MAC address; all such assignments are
-arbitrary or discretionary in nature. At the most basic level, all network communications take place using MAC
-addressing. Since MAC addresses must be globally unique and generally remain fixed for any particular
-interface, the assignment of an IP address makes sense from a network management perspective. More than one IP
-address can be assigned per MAC address. One address must be the primary IP address &smbmdash; this is the
-address that will be returned in the Address Resolution Protocol (ARP) reply.
-</para>
-
-<para>
-<indexterm><primary>machine name</primary></indexterm>
-When a user or a process wants to communicate with another machine, 
-the protocol implementation ensures that the <quote>machine name</quote> or <quote>host 
-name</quote> is resolved to an IP address in a manner that is controlled 
-by the TCP/IP configuration control files. The file 
-<filename>/etc/hosts</filename> is one such file.
-</para>
-
-<para>
-<indexterm><primary>ARP/RARP</primary></indexterm>
-When the IP address of the destination interface has been determined, a protocol called ARP/RARP is used to
-identify the MAC address of the target interface. ARP is a broadcast-oriented method that uses User Datagram
-Protocol (UDP) to send a request to all interfaces on the local network segment using the all 1s MAC address.
-Network interfaces are programmed to respond to two MAC addresses only; their own unique address and the
-address ff:ff:ff:ff:ff:ff. The reply packet from an ARP request will contain the MAC address and the primary
-IP address for each interface.
-</para>
-
-<para>
-<indexterm><primary>/etc/hosts</primary></indexterm>
-The <filename>/etc/hosts</filename> file is foundational to all 
-UNIX/Linux TCP/IP installations and as a minimum will contain 
-the localhost and local network interface IP addresses and the 
-primary names by which they are known within the local machine. 
-This file helps to prime the pump so a basic level of name 
-resolution can exist before any other method of name resolution 
-becomes available.
-</para>
-
-</sect2>
-
-
-<sect2>
-<title><filename>/etc/resolv.conf</filename></title>
-
-<para>
-This file tells the name resolution libraries:
-</para>
-
-<itemizedlist>
-	<listitem><para>The name of the domain to which the machine 
-	belongs.
-	</para></listitem>
-	
-	<listitem><para>The name(s) of any domains that should be 
-	automatically searched when trying to resolve unqualified 
-	host names to their IP address.
-	</para></listitem>
-	
-	<listitem><para>The name or IP address of available domain 
-	name servers that may be asked to perform name-to-address 
-	translation lookups.
-	</para></listitem>
-</itemizedlist>
-
-</sect2>
-
-
-<sect2>
-<title><filename>/etc/host.conf</filename></title>
-
-
-<para>
-<indexterm><primary>/etc/host.conf</primary></indexterm>
-<filename>/etc/host.conf</filename> is the primary means by which the setting in
-<filename>/etc/resolv.conf</filename> may be effected. It is a critical configuration file. This file controls
-the order by which name resolution may proceed. The typical structure is:
-<programlisting>
-order hosts,bind
-multi on
-</programlisting></para>
-
-<para>Both addresses should be returned. Please refer to the 
-man page for <filename>host.conf</filename> for further details.
-</para>
-
-</sect2>
-
-
-<sect2>
-<title><filename>/etc/nsswitch.conf</filename></title>
-
-<para>
-<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
-This file controls the actual name resolution targets. The 
-file typically has resolver object specifications as follows:
-<programlisting>
-# /etc/nsswitch.conf
-#
-# Name Service Switch configuration file.
-#
-
-passwd:		compat
-# Alternative entries for password authentication are:
-# passwd:	compat files nis ldap winbind
-shadow:		compat
-group:		compat
-
-hosts:		files nis dns
-# Alternative entries for host name resolution are:
-# hosts:	files dns nis nis+ hesiod db compat ldap wins
-networks:	nis files dns
-
-ethers:		nis files
-protocols:	nis files
-rpc:		nis files
-services:	nis files
-</programlisting></para>
-
-<para>
-Of course, each of these mechanisms requires that the appropriate 
-facilities and/or services are correctly configured.
-</para>
-
-<para>
-It should be noted that unless a network request/message must be 
-sent, TCP/IP networks are silent. All TCP/IP communications assume a 
-principal of speaking only when necessary.
-</para>
-
-
-<para>
-<indexterm><primary>libnss_wins.so</primary></indexterm>
-<indexterm><primary>NetBIOS names</primary></indexterm>
-<indexterm><primary>make</primary></indexterm>
-<indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
-<indexterm><primary>wins</primary></indexterm>
-Starting with version 2.2.0, Samba has Linux support for extensions to 
-the name service switch infrastructure so Linux clients will 
-be able to obtain resolution of MS Windows NetBIOS names to IP 
-addresses. To gain this functionality, Samba needs to be compiled 
-with appropriate arguments to the make command (i.e., <userinput>make 
-nsswitch/libnss_wins.so</userinput>). The resulting library should 
-then be installed in the <filename>/lib</filename> directory, and 
-the <parameter>wins</parameter> parameter needs to be added to the <quote>hosts:</quote> line in 
-the <filename>/etc/nsswitch.conf</filename> file. At this point, it 
-will be possible to ping any MS Windows machine by its NetBIOS 
-machine name, as long as that machine is within the workgroup to 
-which both the Samba machine and the MS Windows machine belong.
-</para>
-
-</sect2>
-</sect1>
-
-
-<sect1>
-<title>Name Resolution as Used within MS Windows Networking</title>
-
-<para>
-<indexterm><primary>computer name</primary></indexterm>
-<indexterm><primary>machine name</primary></indexterm>
-<indexterm><primary>NetBIOS name</primary></indexterm>
-<indexterm><primary>SMB name</primary></indexterm>
-MS Windows networking is predicated on the name each machine is given. This name is known variously (and
-inconsistently) as the <quote>computer name,</quote> <quote>machine name,</quote> <quote>networking
-name,</quote> <quote>NetBIOS name,</quote> or <quote>SMB name.</quote> All terms mean the same thing with the
-exception of <quote>NetBIOS name,</quote> which can also apply to the name of the workgroup or the domain
-name. The terms <quote>workgroup</quote> and <quote>domain</quote> are really just a simple name with which
-the machine is associated. All NetBIOS names are exactly 16 characters in length. The
-16<superscript>th</superscript> character is reserved.  It is used to store a 1-byte value that indicates
-service level information for the NetBIOS name that is registered. A NetBIOS machine name is therefore
-registered for each service type that is provided by the client/server.
-</para>
-
-<para>
-<link linkend="uniqnetbiosnames">Unique NetBIOS names</link> and <link linkend="netbiosnamesgrp">group names</link> tables 
-list typical NetBIOS name/service type registrations.
-</para>
-
-<table frame="all" id="uniqnetbiosnames">
-<title>Unique NetBIOS Names</title>
-<tgroup cols="2">
-<colspec align="left"/>
-<colspec align="justify"/>
-<tbody>
-<row><entry>MACHINENAME<00></entry><entry>Server Service is running on MACHINENAME</entry></row>
-<row><entry>MACHINENAME<03></entry><entry>Generic machine name (NetBIOS name)</entry></row>
-<row><entry>MACHINENAME<20></entry><entry>LanMan server service is running on MACHINENAME</entry></row>
-<row><entry>WORKGROUP<1b></entry><entry>Domain master browser</entry></row>
-</tbody>
-</tgroup>
-</table>
-
-<table frame="all" id="netbiosnamesgrp">
-<title>Group Names</title>
-<tgroup cols="2">
-<colspec align="left"/>
-<colspec align="justify"/>
-<tbody>
-<row><entry>WORKGROUP<03></entry><entry>Generic name registered by all members of WORKGROUP</entry></row>
-<row><entry>WORKGROUP<1c></entry><entry>Domain cntrollers/netlogon servers</entry></row>
-<row><entry>WORKGROUP<1d></entry><entry>Local master browsers</entry></row>
-<row><entry>WORKGROUP<1e></entry><entry>Browser election service</entry></row>
-</tbody>
-</tgroup>
-</table>
-
-<para>
-<indexterm><primary>NetBIOS</primary></indexterm>
-It should be noted that all NetBIOS machines register their own 
-names as per <link linkend="uniqnetbiosnames">Unique NetBIOS names</link> and <link
-linkend="netbiosnamesgrp">group names</link>. This is in vast contrast to TCP/IP 
-installations where the system administrator traditionally 
-determines in the <filename>/etc/hosts</filename> or in the DNS database what names 
-are associated with each IP address.
-</para>
-
-<para>
-<indexterm><primary>NetBIOS</primary></indexterm>
-<indexterm><primary>/etc/hosts</primary></indexterm>
-<indexterm><primary>NetBIOS name</primary></indexterm>
-One further point of clarification should be noted. The <filename>/etc/hosts</filename> 
-file and the DNS records do not provide the NetBIOS name information 
-that MS Windows clients depend on to locate the type of service that may 
-be needed. An example of this is what happens when an MS Windows client 
-wants to locate a domain logon server. It finds this service and the IP 
-address of a server that provides it by performing a lookup (via a 
-NetBIOS broadcast) for enumeration of all machines that have 
-registered the name type *<1C>. A logon request is then sent to each 
-IP address that is returned in the enumerated list of IP addresses.
-Whichever machine first replies, it then ends up providing the logon services.
-</para>
-
-<para>
-<indexterm><primary>domain</primary></indexterm>
-<indexterm><primary>workgroup</primary></indexterm>
-The name <quote>workgroup</quote> or <quote>domain</quote> really can be confusing, since these 
-have the added significance of indicating what is the security 
-architecture of the MS Windows network. The term <quote>workgroup</quote> indicates 
-that the primary nature of the network environment is that of a 
-peer-to-peer design. In a workgroup, all machines are responsible for 
-their own security, and generally such security is limited to the use of 
-just a password (known as share-level security). In most situations 
-with peer-to-peer networking, the users who control their own machines 
-will simply opt to have no security at all. It is possible to have 
-user-level security in a workgroup environment, thus requiring the use 
-of a username and a matching password.
-</para>
-
-<para>
-<indexterm><primary>SMB</primary></indexterm>
-<indexterm><primary>Network Basic Input/Output System</primary><see>NetBIOS</see></indexterm>
-<indexterm><primary>Logical Link Control</primary><see>LLC</see></indexterm>
-<indexterm><primary>Network Basic Extended User Interface</primary><see>NetBEUI</see></indexterm>
-<indexterm><primary>Internetworking Packet Exchange</primary><see>IPX</see></indexterm>
-<indexterm><primary>NetWare</primary></indexterm>
-<indexterm><primary>NetBT</primary></indexterm>
-<indexterm><primary>NBT</primary></indexterm>
-MS Windows networking is thus predetermined to use machine names 
-for all local and remote machine message passing. The protocol used is 
-called Server Message Block (SMB), and this is implemented using 
-the NetBIOS protocol (Network Basic Input/Output System). NetBIOS can 
-be encapsulated using LLC (Logical Link Control) protocol &smbmdash; in which case 
-the resulting protocol is called NetBEUI (Network Basic Extended User 
-Interface). NetBIOS can also be run over IPX (Internetworking Packet 
-Exchange) protocol as used by Novell NetWare, and it can be run 
-over TCP/IP protocols &smbmdash; in which case the resulting protocol is called 
-NBT or NetBT, the NetBIOS over TCP/IP.
-</para>
-
-<para>
-MS Windows machines use a complex array of name resolution mechanisms. 
-Since we are primarily concerned with TCP/IP, this demonstration is 
-limited to this area.
-</para>
-
-<sect2>
-<title>The NetBIOS Name Cache</title>
-
-<para>
-<indexterm><primary>n-memory buffer</primary></indexterm>
-<indexterm><primary>local cache</primary></indexterm>
-<indexterm><primary></primary></indexterm>
-All MS Windows machines employ an in-memory buffer in which is 
-stored the NetBIOS names and IP addresses for all external 
-machines that machine has communicated with over the 
-past 10 to 15 minutes. It is more efficient to obtain an IP address 
-for a machine from the local cache than it is to go through all the 
-configured name resolution mechanisms.
-</para>
-
-<para>
-<indexterm><primary>name lookup</primary></indexterm>
-If a machine whose name is in the local name cache is shut 
-down before the name is expired and flushed from the cache, then 
-an attempt to exchange a message with that machine will be subject 
-to timeout delays. Its name is in the cache, so a name resolution 
-lookup will succeed, but the machine cannot respond. This can be 
-frustrating for users but is a characteristic of the protocol.
-</para>
-
-<para>
-<indexterm><primary>nbtstat</primary></indexterm>
-<indexterm><primary>nmblookup</primary></indexterm>
-<indexterm><primary>NetBIOS</primary></indexterm>
-The MS Windows utility that allows examination of the NetBIOS 
-name cache is called <quote>nbtstat.</quote> The Samba equivalent
-is called <command>nmblookup</command>.
-</para>
-
-</sect2>
-
-<sect2>
-<title>The LMHOSTS File</title>
-
-<para>
-<indexterm><primary>LMHOSTS</primary></indexterm>
-This file is usually located in MS Windows NT 4.0 or Windows 200x/XP in the directory
-<filename>%SystemRoot%\SYSTEM32\DRIVERS\ETC</filename> and contains the IP address
-and the machine name in matched pairs. The <filename>LMHOSTS</filename> file
-performs NetBIOS name to IP address mapping.
-</para>
-
-<para>
-It typically looks like this:
-</para>
-
-<para><programlisting>
-# Copyright (c) 1998 Microsoft Corp.
-#
-# This is a sample LMHOSTS file used by the Microsoft Wins Client (NetBIOS
-# over TCP/IP) stack for Windows98
-#
-# This file contains the mappings of IP addresses to NT computer names
-# (NetBIOS) names. Each entry should be kept on an individual line.
-# The IP address should be placed in the first column followed by the
-# corresponding computer name. The address and the computer name
-# should be separated by at least one space or tab. The "#" character
-# is generally used to denote the start of a comment (see the exceptions
-# below).
-#
-# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
-# files and offers the following extensions:
-#
-#      #PRE
-#      #DOM:<domain>
-#      #INCLUDE <filename>
-#      #BEGIN_ALTERNATE
-#      #END_ALTERNATE
-#      \0xnn (non-printing character support)
-#
-# Following any entry in the file with the characters "#PRE" will cause
-# the entry to be preloaded into the name cache. By default, entries are
-# not preloaded, but are parsed only after dynamic name resolution fails.
-#
-# Following an entry with the "#DOM:<domain>" tag will associate the
-# entry with the domain specified by <domain>. This effects how the
-# browser and logon services behave in TCP/IP environments. To preload
-# the host name associated with #DOM entry, it is necessary to also add a
-# #PRE to the line. The <domain> is always pre-loaded although it will not
-# be shown when the name cache is viewed.
-#
-# Specifying "#INCLUDE <filename>" will force the RFC NetBIOS (NBT)
-# software to seek the specified <filename> and parse it as if it were
-# local. <filename> is generally a UNC-based name, allowing a
-# centralized lmhosts file to be maintained on a server.
-# It is ALWAYS necessary to provide a mapping for the IP address of the
-# server prior to the #INCLUDE. This mapping must use the #PRE directive.
-# In addition the share "public" in the example below must be in the
-# LanMan Server list of "NullSessionShares" in order for client machines to
-# be able to read the lmhosts file successfully. This key is under
-# \machine\system\currentcontrolset\services\lanmanserver\
-# parameters\nullsessionshares
-# in the registry. Simply add "public" to the list found there.
-#
-# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
-# statements to be grouped together. Any single successful include
-# will cause the group to succeed.
-#
-# Finally, non-printing characters can be embedded in mappings by
-# first surrounding the NetBIOS name in quotations, then using the
-# \0xnn notation to specify a hex value for a non-printing character.
-#
-# The following example illustrates all of these extensions:
-#
-# 102.54.94.97     rhino     #PRE #DOM:networking  #net group's DC
-# 102.54.94.102    "appname  \0x14"       #special app server
-# 102.54.94.123    popular   #PRE         #source server
-# 102.54.94.117    localsrv  #PRE         #needed for the include
-#
-# #BEGIN_ALTERNATE
-# #INCLUDE \\localsrv\public\lmhosts
-# #INCLUDE \\rhino\public\lmhosts
-# #END_ALTERNATE
-#
-# In the above example, the "appname" server contains a special
-# character in its name, the "popular" and "localsrv" server names are
-# pre-loaded, and the "rhino" server name is specified so it can be used
-# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
-# system is unavailable.
-#
-# Note that the whole file is parsed including comments on each lookup,
-# so keeping the number of comments to a minimum will improve performance.
-# Therefore it is not advisable to simply add lmhosts file entries onto the
-# end of this file.
-</programlisting></para>
-
-</sect2>
-
-<sect2>
-<title>HOSTS File</title>
-
-<para>
-This file is usually located in MS Windows NT 4.0 or Windows 200x/XP in 
-the directory <filename>%SystemRoot%\SYSTEM32\DRIVERS\ETC</filename> and contains 
-the IP address and the IP hostname in matched pairs. It can be 
-used by the name resolution infrastructure in MS Windows, depending 
-on how the TCP/IP environment is configured. This file is in 
-every way the equivalent of the UNIX/Linux <filename>/etc/hosts</filename> file.
-</para>
-</sect2>
-
-
-<sect2>
-<title>DNS Lookup</title>
-
-
-<para>
-<indexterm><primary>DNS</primary></indexterm>
-This capability is configured in the TCP/IP setup area in the network 
-configuration facility. If enabled, an elaborate name resolution sequence 
-is followed, the precise nature of which is dependent on how the NetBIOS 
-Node Type parameter is configured. A Node Type of 0 means that
-NetBIOS broadcast (over UDP broadcast) is used if the name 
-that is the subject of a name lookup is not found in the NetBIOS name 
-cache. If that fails, then DNS, HOSTS, and LMHOSTS are checked. If set to 
-Node Type 8, then a NetBIOS Unicast (over UDP Unicast) is sent to the 
-WINS server to obtain a lookup before DNS, HOSTS, LMHOSTS, or broadcast 
-lookup is used.
-</para>
-
-</sect2>
-
-<sect2>
-<title>WINS Lookup</title>
-
-
-<para>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>Windows Internet Name Server</primary><see>WINS</see></indexterm>
-<indexterm><primary>NetBIOS Name Server</primary><see>NBNS</see></indexterm>
-A WINS (Windows Internet Name Server) service is the equivalent of the 
-rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores 
-the names and IP addresses that are registered by a Windows client 
-if the TCP/IP setup has been given at least one WINS server IP address.
-</para>
-
-<para>
-To configure Samba to be a WINS server, the following parameter needs 
-to be added to the &smb.conf; file:
-</para>
-
-<para><smbconfblock>
-<smbconfoption name="wins support">Yes</smbconfoption>
-</smbconfblock></para>
-
-<para>
-<indexterm><primary>WINS</primary></indexterm>
-To configure Samba to use a WINS server, the following parameters are 
-needed in the &smb.conf; file:
-</para>
-
-<para><smbconfblock>
-<smbconfoption name="wins support">No</smbconfoption>
-<smbconfoption name="wins server">xxx.xxx.xxx.xxx</smbconfoption>
-</smbconfblock></para>
-
-<para>
-where <replaceable>xxx.xxx.xxx.xxx</replaceable> is the IP address 
-of the WINS server.
-</para>
-
-<para>For information about setting up Samba as a WINS server, read 
-<link linkend="NetworkBrowsing">Network Browsing</link>.</para>
-
-</sect2>
-</sect1>
-
-<sect1>
-<title>Common Errors</title>
-
-<para>
-TCP/IP network configuration problems find every network administrator sooner or later.
-The cause can be anything from keyboard mishaps to forgetfulness to simple mistakes to
-carelessness. Of course, no one is ever deliberately careless!
-</para>
-
-	<sect2>
-		<title>Pinging Works Only One Way</title>
-
-	<para>
-	<quote>I can ping my Samba server from Windows, but I cannot ping my Windows
-	machine from the Samba server.</quote>
-	</para>
-
-	<para>
-	The Windows machine was at IP address 192.168.1.2 with netmask 255.255.255.0, the
-	Samba server (Linux) was at IP address 192.168.1.130 with netmask 255.255.255.128.
-	The machines were on a local network with no external connections.
-	</para>
-
-	<para>
-	Due to inconsistent netmasks, the Windows machine was on network 192.168.1.0/24, while
-	the Samba server was on network 192.168.1.128/25 &smbmdash; logically a different network.
-	</para>
-
-	</sect2>
-
-	<sect2>
-	<title>Very Slow Network Connections</title>
-
-	<para>
-	A common cause of slow network response includes:
-	</para>
-
-	<itemizedlist>
-		<listitem><para>Client is configured to use DNS and the DNS server is down.</para></listitem>
-		<listitem><para>Client is configured to use remote DNS server, but the
-		remote connection is down.</para></listitem>
-		<listitem><para>Client is configured to use a WINS server, but there is no WINS server.</para></listitem>
-		<listitem><para>Client is not configured to use a WINS server, but there is a WINS server.</para></listitem>
-		<listitem><para>Firewall is filtering out DNS or WINS traffic.</para></listitem>
-	</itemizedlist>
-
-	</sect2>
-
-	<sect2>
-	<title>Samba Server Name-Change Problem</title>
-
-	<para>
-	<quote>The name of the Samba server was changed, Samba was restarted, and now the Samba server cannot be
-	pinged by its new name from an MS Windows NT4 workstation, but it does still respond to pinging using
-	the old name. Why?</quote>
-	</para>
-
-	<para>
-	From this description, three things are obvious:
-	</para>
-
-	<itemizedlist>
-		<listitem><para>WINS is not in use; only broadcast-based name resolution is used.</para></listitem>
-		<listitem><para>The Samba server was renamed and restarted within the last 10 or 15 minutes.</para></listitem>
-		<listitem><para>The old Samba server name is still in the NetBIOS name cache on the MS Windows NT4 workstation.</para></listitem>
-	</itemizedlist>
-
-	<para>
-	To find what names are present in the NetBIOS name cache on the MS Windows NT4 machine,
-	open a <command>cmd</command> shell and then:
-	</para>
-
-	<para>
-<screen>
-&dosprompt;<userinput>nbtstat -n</userinput>
-
-              NetBIOS Local Name Table
-
-   Name                 Type          Status
-------------------------------------------------
-&example.workstation.windows;            <03>  UNIQUE      Registered
-ADMINISTRATOR     <03>  UNIQUE      Registered
-&example.workstation.windows;            <00>  UNIQUE      Registered
-SARDON           <00>  GROUP       Registered
-&example.workstation.windows;            <20>  UNIQUE      Registered
-&example.workstation.windows;            <1F>  UNIQUE      Registered
-
-
-&dosprompt;nbtstat -c
-
-             NetBIOS Remote Cache Name Table
-
-   Name                 Type       Host Address     Life [sec]
---------------------------------------------------------------
-&example.server.samba;	<20>  UNIQUE      192.168.1.1          240
-
-&dosprompt;
-</screen>
-	</para>
-
-	<para>
-	In this example, &example.server.samba; is the Samba server and &example.workstation.windows; is the MS Windows NT4 workstation.
-	The first listing shows the contents of the Local Name Table (i.e., identity information on
-	the MS Windows workstation), and the second shows the NetBIOS name in the NetBIOS name cache.
-	The name cache contains the remote machines known to this workstation.
-	</para>
-
-	</sect2>
-
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-InterdomainTrusts.xml b/docs-xml/Samba3-HOWTO/TOSHARG-InterdomainTrusts.xml
deleted file mode 100644
index 3ea527b..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-InterdomainTrusts.xml
+++ /dev/null
@@ -1,602 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="InterdomainTrusts">
-<chapterinfo>
-	&author.jht;
-	&author.mimir;
-	<author>&person.jelmer;<contrib>drawing</contrib></author>
-        <author>
-                <firstname>Stephen</firstname><surname>Langasek</surname>
-                <affiliation>
-                        <address><email>vorlon at netexpress.net</email></address>
-                </affiliation>
-        </author>
-	<pubdate>April 3, 2003</pubdate>
-</chapterinfo>
-
-<title>Interdomain Trust Relationships</title>
-
-
-<para>
-<indexterm><primary>Interdomain Trusts</primary></indexterm>
-<indexterm><primary>LDAP</primary></indexterm>
-<indexterm><primary>trusts</primary></indexterm>
-<indexterm><primary>samba-to-samba trusts</primary></indexterm>
-<indexterm><primary>Active Directory</primary></indexterm>
-<indexterm><primary>NT4-style domain</primary></indexterm>
-<indexterm><primary>trust relationships</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-<indexterm><primary>LDAP-based</primary></indexterm>
-Samba-3 supports NT4-style domain trust relationships. This is a feature that many sites
-will want to use if they migrate to Samba-3 from an NT4-style domain and do not want to
-adopt Active Directory or an LDAP-based authentication backend. This chapter explains
-some background information regarding trust relationships and how to create them. It is now
-possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba-to-Samba 
-trusts.
-</para>
-
-<para>
-<indexterm><primary>winbind</primary></indexterm>
-<indexterm><primary>UID range</primary></indexterm>
-<indexterm><primary>GID range</primary></indexterm>
-<indexterm><primary>daemon</primary></indexterm>
-<indexterm><primary>winbindd</primary></indexterm>
-The use of interdomain trusts requires use of <command>winbind</command>, so the
-<command>winbindd</command> daemon must be running. Winbind operation in this mode is
-dependent on the specification of a valid UID range and a valid GID range in the &smb.conf; file.
-These are specified respectively using:
-<smbconfblock>
-<smbconfoption name="idmap uid">10000-20000</smbconfoption>
-<smbconfoption name="idmap gid">10000-20000</smbconfoption>
-</smbconfblock>
-<indexterm><primary>passdb backend</primary></indexterm>
-<indexterm><primary>POSIX user accounts</primary></indexterm>
-<indexterm><primary>maximum value</primary></indexterm>
-<indexterm><primary>4294967295</primary></indexterm>
-The range of values specified must not overlap values used by the host operating system and must
-not overlap values used in the passdb backend for POSIX user accounts. The maximum value is
-limited by the upper-most value permitted by the host operating system. This is a UNIX kernel
-limited parameter. Linux kernel 2.6-based systems support a maximum value of 4294967295 
-(32-bit unsigned variable).
-</para>
-
-<note><para>
-<indexterm><primary>winbind</primary></indexterm>
-<indexterm><primary>trusting domain</primary></indexterm>
-<indexterm><primary>trusted domain</primary></indexterm>
-The use of winbind is necessary only when Samba is the trusting domain, not when it is the
-trusted domain.
-</para></note>
-
-<sect1>
-<title>Features and Benefits</title>
-
-<para>
-<indexterm><primary>scalability</primary></indexterm>
-<indexterm><primary>trust relationships</primary></indexterm>
-Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4-style
-trust relationships. This imparts to Samba scalability similar to that with MS Windows NT4.
-</para>
-
-<para>
-<indexterm><primary>scalable backend</primary></indexterm>
-<indexterm><primary>authentication database</primary></indexterm>
-<indexterm><primary>LDAP</primary></indexterm>
-<indexterm><primary>interdomain trusts</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-Given that Samba-3 can function with a scalable backend authentication database such as LDAP, and given its
-ability to run in primary as well as backup domain control modes, the administrator would be well-advised to
-consider alternatives to the use of interdomain trusts simply because, by the very nature of how trusts
-function, this system is fragile.  That was, after all, a key reason for the development and adoption of
-Microsoft Active Directory.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Trust Relationship Background</title>
-
-<para>
-<indexterm><primary>security domains</primary></indexterm>
-<indexterm><primary>nonhierarchical</primary></indexterm>
-<indexterm><primary>security structure</primary></indexterm>
-<indexterm><primary>large organizations</primary></indexterm>
-<indexterm><primary>delegation</primary></indexterm>
-<indexterm><primary>administrative responsibilities</primary></indexterm>
-MS Windows NT3/4-type security domains employ a nonhierarchical security structure.
-The limitations of this architecture as it effects the scalability of MS Windows networking
-in large organizations is well known. Additionally, the flat namespace that results from
-this design significantly impacts the delegation of administrative responsibilities in
-large and diverse organizations.
-</para>
-
-<para>
-<indexterm><primary>ADS</primary></indexterm>
-<indexterm><primary>Kerberos</primary></indexterm>
-<indexterm><primary>LDAP</primary></indexterm>
-<indexterm><primary>limitations</primary></indexterm>
-<indexterm><primary>domain security</primary></indexterm>
-Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means
-of circumventing the limitations of the older technologies. Not every organization is ready
-or willing to embrace ADS. For small companies the older NT4-style domain security paradigm
-is quite adequate, and so there remains an entrenched user base for whom there is no direct
-desire to go through a disruptive change to adopt ADS.
-</para>
-
-<para>
-<indexterm><primary>security domains</primary></indexterm>
-<indexterm><primary>access rights</primary></indexterm>
-<indexterm><primary>privileges</primary></indexterm>
-<indexterm><primary>trusts</primary></indexterm>
-<indexterm><primary>trusted domain</primary></indexterm>
-<indexterm><primary>trusting domain</primary></indexterm>
-<indexterm><primary>one direction</primary></indexterm>
-With Windows NT, Microsoft introduced the ability to allow different security domains
-to effect a mechanism so users from one domain may be given access rights and privileges
-in another domain. The language that describes this capability is couched in terms of
-<emphasis>trusts</emphasis>. Specifically, one domain will <emphasis>trust</emphasis> the users
-from another domain. The domain from which users can access another security domain is
-said to be a trusted domain. The domain in which those users have assigned rights and privileges
-is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only,
-so if users in both domains are to have privileges and rights in each others' domain, then it is
-necessary to establish two relationships, one in each direction.
-</para>
-
-<para>
-<indexterm><primary>security domain</primary></indexterm>
-<indexterm><primary>nontransitive</primary></indexterm>
-<indexterm><primary>trust relationship</primary></indexterm>
-<indexterm><primary>transitive</primary></indexterm>
-<indexterm><primary>explicit trust</primary></indexterm>
-Further, in an NT4-style MS security domain, all trusts are nontransitive. This means that if there are three
-domains (let's call them red, white, and blue), where red and white have a trust relationship, and white and
-blue have a trust relationship, then it holds that there is no implied trust between the red and blue domains.
-Relationships are explicit and not transitive.
-</para>
-
-<para>
-<indexterm><primary>ADS</primary></indexterm>
-<indexterm><primary>security contexts</primary></indexterm>
-<indexterm><primary>trust relationships</primary></indexterm>
-<indexterm><primary>two-way trust</primary></indexterm>
-<indexterm><primary>Windows 2000</primary></indexterm>
-<indexterm><primary>security domains</primary></indexterm>
-<indexterm><primary>NT4-style domains</primary></indexterm>
-New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way by default.
-Also, all inter-ADS domain trusts are transitive. In the case of the red, white, and blue domains, with
-Windows 2000 and ADS, the red and blue domains can trust each other. This is an inherent feature of ADS
-domains. Samba-3 implements MS Windows NT4-style interdomain trusts and interoperates with MS Windows 200x ADS
-security domains in similar manner to MS Windows NT4-style domains.
-</para>
-
-</sect1>
-
-<sect1>
-<title>Native MS Windows NT4 Trusts Configuration</title>
-
-<para>
-<indexterm><primary>Interdomain Trusts</primary><secondary>creating</secondary></indexterm>
-<indexterm><primary>two-way trust</primary></indexterm>
-<indexterm><primary>security credentials</primary></indexterm>
-There are two steps to creating an interdomain trust relationship. To effect a two-way trust
-relationship, it is necessary for each domain administrator to create a trust account for the 
-other domain to use in verifying security credentials.
-</para>
-
-
-<sect2>
-<title>Creating an NT4 Domain Trust</title>
-
-<para>
-<indexterm><primary>domain trust</primary></indexterm>
-<indexterm><primary>trust relationships</primary></indexterm>
-<indexterm><primary>>Domain User Manager</primary></indexterm>
-<indexterm><primary>remote domain</primary></indexterm>
-<indexterm><primary>standard confirmation</primary></indexterm>
-For MS Windows NT4, all domain trust relationships are configured using the 
-<application>Domain User Manager</application>. This is done from the Domain User Manager Policies
-entry on the menu bar. From the <guimenu>Policy</guimenu> menu, select
-<guimenuitem>Trust Relationships</guimenuitem>. Next to the lower box labeled
-<guilabel>Permitted to Trust this Domain</guilabel> are two buttons, <guibutton>Add</guibutton>
-and <guibutton>Remove</guibutton>. The <guibutton>Add</guibutton> button will open a panel in which
-to enter the name of the remote domain that will be able to assign access rights to users in 
-your domain. You will also need to enter a password for this trust relationship, which the 
-trusting domain will use when authenticating users from the trusted domain.
-The password needs to be typed twice (for standard confirmation).
-</para>
-
-</sect2>
-
-
-<sect2>
-<title>Completing an NT4 Domain Trust</title>
-
-<para>
-<indexterm><primary>trust relationship</primary></indexterm>
-<indexterm><primary>trusting domain</primary></indexterm>
-<indexterm><primary>trusted domain</primary></indexterm>
-<indexterm><primary>remote domain</primary></indexterm>
-<indexterm><primary>password assigned</primary></indexterm>
-<indexterm><primary>Interdomain Trusts</primary><secondary>Completing</secondary></indexterm>
-A trust relationship will work only when the other (trusting) domain makes the appropriate connections
-with the trusted domain. To consummate the trust relationship, the administrator launches the
-Domain User Manager from the menu selects <guilabel>Policies</guilabel>, then select
-<guilabel>Trust Relationships</guilabel>, and clicks on the <guibutton>Add</guibutton> button
-next to the box that is labeled <guilabel>Trusted Domains</guilabel>. A panel opens in which
-must be entered the name of the remote domain as well as the password assigned to that trust.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Interdomain Trust Facilities</title>
-
-
-<para>
-<indexterm><primary>two-way trust</primary></indexterm>
-<indexterm><primary>trust relationship</primary></indexterm>
-<indexterm><primary>trust established</primary></indexterm>
-<indexterm><primary>one-way trust</primary></indexterm>
-<indexterm><primary>Windows NT4 domains</primary></indexterm>
-<indexterm><primary>Interdomain Trusts</primary><secondary>Facilities</secondary></indexterm>
-A two-way trust relationship is created when two one-way trusts are created, one in each direction.
-Where a one-way trust has been established between two MS Windows NT4 domains (let's call them
-DomA and DomB), the following facilities are created:
-</para>
-
-<figure id="trusts1">
-	<title>Trusts overview.</title>
-	<imagefile>trusts1</imagefile>
-</figure>
-
-<itemizedlist>
-	<listitem><para>
-	DomA (completes the trust connection) <parameter>Trusts</parameter> DomB.
-	</para></listitem>
-
-	<listitem><para>
-	DomA is the <parameter>Trusting</parameter> domain.
-	</para></listitem>
-
-	<listitem><para>
-	DomB is the <parameter>Trusted</parameter> domain (originates the trust account).
-	</para></listitem>
-
-	<listitem><para>
-	Users in DomB can access resources in DomA.
-	</para></listitem>
-
-	<listitem><para>
-	Users in DomA cannot access resources in DomB.
-	</para></listitem>
-
-	<listitem><para>
-	Global groups from DomB can be used in DomA.
-	</para></listitem>
-
-	<listitem><para>
-	Global groups from DomA cannot be used in DomB.
-	</para></listitem>
-
-	<listitem><para>
-	DomB does appear in the logon dialog box on client workstations in DomA.
-	</para></listitem>
-
-	<listitem><para>
-	DomA does not appear in the logon dialog box on client workstations in DomB.
-	</para></listitem>
-</itemizedlist>
-
-<itemizedlist>
-	<listitem><para>
-	Users and groups in a trusting domain cannot be granted rights, permissions, or access
-	to a trusted domain.
-	</para></listitem>
-
-	<listitem><para>
-	The trusting domain can access and use accounts (users/global groups) in the
-	trusted domain.
-	</para></listitem>
-
-	<listitem><para>
-	Administrators of the trusted domain can be granted administrative rights in the 
-	trusting domain.
-	</para></listitem>
-
-	<listitem><para>
-	Users in a trusted domain can be given rights and privileges in the trusting
-	domain.
-	</para></listitem>
-
-	<listitem><para>
-	Trusted domain global groups can be given rights and permissions in the trusting
-	domain.
-	</para></listitem>
-
-	<listitem><para>
-	Global groups from the trusted domain can be made members in local groups on
-	MS Windows domain member machines.
-	</para></listitem>
-</itemizedlist>
-
-</sect2>
-
-</sect1>
-
-<sect1>
-<title>Configuring Samba NT-Style Domain Trusts</title>
-
-<para>
-<indexterm><primary>interdomain trust</primary></indexterm>
-This description is meant to be a fairly short introduction about how to set up a Samba server so
-that it can participate in interdomain trust relationships. Trust relationship support in Samba
-is at an early stage, so do not be surprised if something does not function as it should.
-</para>
-
-<para>
-<indexterm><primary>peer domain</primary></indexterm>
-<indexterm><primary>trust relationship</primary></indexterm>
-<indexterm><primary>Windows NT4 Server</primary></indexterm>
-<indexterm><primary>between domains</primary></indexterm>
-Each of the procedures described next assumes the peer domain in the trust relationship is controlled by a
-Windows NT4 server. However, the remote end could just as well be another Samba-3  domain. It can be clearly
-seen, after reading this document, that combining Samba-specific parts of what's written in the following
-sections leads to trust between domains in a purely Samba environment.
-</para>
-
-<sect2 id="samba-trusted-domain">
-<title>Samba as the Trusted Domain</title>
-
-<para>
-<indexterm><primary>trusted party</primary></indexterm>
-<indexterm><primary>special account</primary></indexterm>
-<indexterm><primary>trusting party</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>smbpasswd</primary></indexterm>
-In order to set the Samba PDC to be the trusted party of the relationship, you first need
-to create a special account for the domain that will be the trusting party. To do that,
-you can use the <command>smbpasswd</command> utility. Creating the trusted domain account is 
-similar to creating a trusted machine account. Suppose, your domain is
-called SAMBA, and the remote domain is called RUMBA. The first step
-will be to issue this command from your favorite shell:
-</para>
-
-<para>
-<screen>
-&rootprompt; <userinput>smbpasswd -a -i rumba</userinput>
-New SMB password: <userinput>XXXXXXXX</userinput>
-Retype SMB password: <userinput>XXXXXXXX</userinput>
-Added user rumba$
-</screen>
-
-where <option>-a</option> means to add a new account into the
-passdb database and <option>-i</option> means to <quote>create this
-account with the Interdomain trust flag</quote>.
-</para>
-
-<para>
-<indexterm><primary>account name</primary></indexterm>
-<indexterm><primary>remote domain</primary></indexterm>
-<indexterm><primary>password database</primary></indexterm>
-<indexterm><primary>/etc/passwd</primary></indexterm>
-The account name will be <quote>rumba$</quote> (the name of the remote domain).
-If this fails, you should check that the trust account has been added to the system
-password database (<filename>/etc/passwd</filename>). If it has not been added, you
-can add it manually and then repeat the previous step.
-</para>
-
-<para>
-<indexterm><primary>password</primary></indexterm>
-<indexterm><primary>new account</primary></indexterm>
-<indexterm><primary>confirm the trust</primary></indexterm>
-<indexterm><primary>Windows NT Server</primary></indexterm>
-After issuing this command, you will be asked to enter the password for the account. You can use any password
-you want, but be aware that Windows NT will not change this password until 7 days following account creation.
-After the command returns successfully, you can look at the entry for the new account (in the standard way as
-appropriate for your configuration) and see that the account's name is really RUMBA$ and it has the
-<quote>I</quote> flag set in the flags field. Now you are ready to confirm the trust by establishing it from
-Windows NT Server.
-</para>
-
-
-<para>
-<indexterm><primary>User Manager</primary></indexterm>
-<indexterm><primary>trusted domain name</primary></indexterm>
-<indexterm><primary>relationship password</primary></indexterm>
-<indexterm><primary>remote domain</primary></indexterm>
-<indexterm><primary>established</primary></indexterm>
-Open <application>User Manager for Domains</application> and from the <guimenu>Policies</guimenu> menu, select
-<guimenuitem>Trust Relationships...</guimenuitem>.  Beside the <guilabel>Trusted domains</guilabel> list box,
-click the <guimenu>Add...</guimenu> button. You will be prompted for the trusted domain name and the
-relationship password. Type in SAMBA, as this is the name of the remote domain and the password used at the
-time of account creation.  Click on <guibutton>OK</guibutton> and, if everything went without incident, you
-will see the <computeroutput>Trusted domain relationship successfully established</computeroutput> message.
-</para>
-
-</sect2>
-<sect2>
-<title>Samba as the Trusting Domain</title>
-
-<para>
-<indexterm><primary>NT-controlled domain</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-This time activities are somewhat reversed. Again, we'll assume that your domain
-controlled by the Samba PDC is called SAMBA and the NT-controlled domain is called RUMBA.
-</para>
-
-<para>
-The very first step is to add an account for the SAMBA domain on RUMBA's PDC.
-</para>
-
-
-<para>
-<indexterm><primary>User Manager</primary></indexterm>
-<indexterm><primary>trusted domain</primary></indexterm>
-<indexterm><primary>password</primary></indexterm>
-Launch the <application>Domain User Manager</application>, then from the menu select
-<guimenu>Policies</guimenu>, <guimenuitem>Trust Relationships</guimenuitem>.
-Now, next to the <guilabel>Trusting Domains</guilabel> box, press the <guibutton>Add</guibutton>
-button and type in the name of the trusted domain (SAMBA) and the password to use in securing
-the relationship.
-</para>
-
-<para>
-<indexterm><primary>password</primary></indexterm>
-<indexterm><primary>confirm the password</primary></indexterm>
-The password can be arbitrarily chosen. It is easy to change the password from the Samba server whenever you
-want. After you confirm the password, your account is ready for use. Now its Samba's turn.
-</para>
-
-<para>
-Using your favorite shell while logged in as root, issue this command:
-<indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>trustdom establish</tertiary></indexterm>
-</para>
-
-<para>
-&rootprompt;<userinput>net rpc trustdom establish rumba</userinput>
-</para>
-
-<para>
-<indexterm><primary>password</primary></indexterm>
-<indexterm><primary>interdomain connection</primary></indexterm>
-<indexterm><primary>ordinary connection</primary></indexterm>
-You will be prompted for the password you just typed on your Windows NT4 Server box.
-An error message, <literal>"NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT,"</literal>
-that may be reported periodically is of no concern and may safely be ignored.
-It means the password you gave is correct and the NT4 server says the account is ready for
-interdomain connection and not for ordinary connection.  After that, be patient;
-it can take a while (especially in large networks), but eventually you should see
-the <literal>Success</literal> message. Congratulations! Your trust
-relationship has just been established.
-</para>
-
-<note><para>
-You have to run this command as root because you must have write access to
-the <filename>secrets.tdb</filename> file.
-</para></note>
-
-</sect2>
-</sect1>
-
-<sect1>
-<title>NT4-Style Domain Trusts with Windows 2000</title>
-
-<para>
-<indexterm><primary>trust relationship</primary></indexterm>
-<indexterm><primary>Windows 2000 server</primary></indexterm>
-<indexterm><primary>NT4-style</primary></indexterm>
-<indexterm><primary>mixed mode</primary></indexterm>
-Although <application>Domain User Manager</application> is not present in Windows 2000, it is 
-also possible to establish an NT4-style trust relationship with a Windows 2000 domain 
-controller running in mixed mode as the trusting server. It should also be possible for 
-Samba to trust a Windows 2000 server; however, more testing is still needed in this area.
-</para>
-
-<para>
-<indexterm><primary>interdomain trust</primary></indexterm>
-<indexterm><primary>trust account</primary></indexterm>
-<indexterm><primary>not transitive</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-After <link linkend="samba-trusted-domain">creating the interdomain trust account on the Samba server</link>
-as described previously, open <application>Active Directory Domains and Trusts</application> on the AD
-controller of the domain whose resources you wish Samba users to have access to. Remember that since NT4-style
-trusts are not transitive, if you want your users to have access to multiple mixed-mode domains in your AD
-forest, you will need to repeat this process for each of those domains. With <application>Active Directory
-domains and trusts</application> open, right-click on the name of the Active Directory domain that will trust
-our Samba domain and choose <guimenuitem>Properties</guimenuitem>, then click on the
-<guilabel>Trusts</guilabel> tab. In the upper part of the panel, you will see a list box labeled
-<guilabel>Domains trusted by this domain:</guilabel> and an <guilabel>Add...</guilabel> button next to it.
-Press this button and, just as with NT4, you will be prompted for the trusted domain name and the relationship
-password. Press <emphasis>OK</emphasis> and after a moment, Active Directory will respond with
-<computeroutput>The trusted domain has been added and the trust has been verified.</computeroutput> Your
-Samba users can now be granted access to resources in the AD domain.
-</para>
-</sect1>
-
-<sect1>
-<title>Common Errors</title>
-
-<para>
-Interdomain trust relationships should not be attempted on networks that are unstable
-or that suffer regular outages. Network stability and integrity are key concerns with
-distributed trusted domains.
-</para>
-
-<sect2>
-<title>Browsing of Trusted Domain Fails</title>
-
-<para>
-<emphasis>Browsing from a machine in a trusted Windows 200x domain to a Windows 200x member of
-a trusting Samba domain, I get the following error:</emphasis>
-<screen>
-The system detected a possible attempt to compromise security. Please
-ensure that you can contact the server that authenticated you.
-</screen>
-</para>
-
-<para>
-<emphasis>The event logs on the box I'm trying to connect to have entries regarding group
-policy not being applied because it is a member of a down-level domain.</emphasis>
-</para>
-
-<para>If there is a computer account in the Windows
-200x domain for the machine in question, and it is disabled, this problem can
-occur.  If there is no computer account (removed or never existed), or if that 
-account is still intact (i.e., you just joined it to another domain), everything 
-seems to be fine. By default, when you unjoin a domain (the Windows 200x 
-domain), the computer tries to automatically disable the computer account in 
-the domain.  If you are running as an account that has privileges to do this 
-when you unjoin the machine, it is done; otherwise it is not done.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Problems with LDAP ldapsam and Older Versions of smbldap-tools</title>
-
-<para>
-If you use the <command>smbldap-useradd</command> script to create a trust
-account to set up interdomain trusts, the process of setting up the trust will
-fail. The account that was created in the LDAP database will have an account
-flags field that has <literal>[W          ]</literal>, when it must have
-<literal>[I          ]</literal> for interdomain trusts to work.
-</para>
-
-<para>Here is a simple solution.
-Create a machine account as follows:
-<screen>
-&rootprompt; smbldap-useradd -w domain_name
-</screen>
-Then set the desired trust account password as shown here:
-<screen>
-&rootprompt; smbldap-passwd domain_name\$
-</screen>
-Using a text editor, create the following file:
-<screen>
-dn: uid=domain_name$,ou=People,dc={your-domain},dc={your-top-level-domain}
-changetype: modify
-sambaAcctFlags: [I         ]
-</screen>
-Then apply the text file to the LDAP database as follows:
-<screen>
-&rootprompt; ldapmodify -x -h localhost \
- -D "cn=Manager,dc={your-domain},dc={your-top-level-domain}" \
- -W -f /path-to/foobar
-</screen>
-Create a single-sided trust under the NT4 Domain User Manager, then execute:
-<screen>
-&rootprompt; net rpc trustdom establish domain_name
-</screen>
-</para>
-
-<para>
-It works with Samba-3  and NT4 domains, and also with Samba-3 and Windows 200x ADS in mixed mode.
-Both domain controllers, Samba and NT must have the same WINS server; otherwise,
-the trust will never work. 
-</para>
-
-</sect2>
-
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-IntroSMB.xml b/docs-xml/Samba3-HOWTO/TOSHARG-IntroSMB.xml
deleted file mode 100644
index dec4638..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-IntroSMB.xml
+++ /dev/null
@@ -1,224 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE preface PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<preface id="IntroSMB">
-<prefaceinfo>
-	&author.jht;
-	<pubdate>June 29, 2003</pubdate>
-</prefaceinfo>
-
-<title>Introduction</title>
-
-<para><quote>
-A man's gift makes room for him before great men. Gifts are like hooks that can catch
-hold of the mind taking it beyond the reach of forces that otherwise might constrain it.
-</quote> --- Anon.
-</para>
-
-
-<para>
-This is a book about Samba. It is a tool, a derived work of the labors
-of many and of the diligence and goodwill of more than a few.
-This book contains material that has been contributed in a persistent belief
-that each of us can add value to our neighbors as well as to those who will
-follow us.
-</para>
-
-<para>
-This book is designed to meet the needs of the Microsoft network administrator.
-UNIX administrators will benefit from this book also, though they may complain
-that it is hard to find the information they think they need. So if you are a
-Microsoft certified specialist, this book should meet your needs rather well.
-If you are a UNIX or Linux administrator, there is no need to feel badly &smbmdash; you
-should have no difficulty finding answers to your current concerns also.
-</para>
-
-<sect1>
-<title>What Is Samba?</title>
-
-	<para>
-	Samba is a big, complex project. The Samba project is ambitious and exciting.
-	The team behind Samba is a group of some thirty individuals who are spread
-	the world over and come from an interesting range of backgrounds. This team
-	includes scientists, engineers, programmers, business people, and students.
-	</para>
-
-	<para>
-	Team members were drawn into active participation through the desire to help
-	deliver an exciting level of transparent interoperability between Microsoft
-	Windows and the non-Microsoft information
-	technology world. 
-	</para>
-
-	<para>
-	The slogan that unites the efforts behind the Samba project says:
-	<emphasis>Samba, Opening Windows to a Wider World!</emphasis> The goal
-	behind the project is one of removing barriers to interoperability.
-	</para>
-
-	<para>
-	Samba provides file and print services for Microsoft Windows clients. These
-	services may be hosted off any TCP/IP-enabled platform. The original deployment
-	platforms were UNIX and Linux, though today it is in common use across
-	a broad variety of systems.
-	</para>
-
-	<para>
-	The Samba project includes not only an impressive feature set in file and print
-	serving capabilities, but has been extended to include client functionality,
-	utilities to ease migration to Samba, tools to aid interoperability with
-	Microsoft Windows, and administration tools.
-	</para>
-
-	<para>
-	The real people behind Samba are users like you. You have inspired the
-	developers (the Samba Team) to do more than any of them imagined could or should
-	be done. User feedback drives Samba development. Samba-3 in particular incorporates
-	a huge amount of work done as a result of user requests, suggestions and direct
-	code contributions.
-	</para>
-
-</sect1>
-
-<sect1>
-<title>Why This Book?</title>
-
-	<para>
-	There is admittedly a large number of Samba books on the market today and
-	each book has its place. Despite the apparent plethora of books, Samba
-	as a project continues to receive much criticism for failing to provide
-	sufficient documentation. Samba is also criticized for being too complex
-	and too difficult to configure. In many ways this is evidence of the
-	success of Samba as there would be no complaints if it was not successful.
-	</para>
-
-	<para>
-	The Samba Team members work predominantly with UNIX and Linux, so
-	it is hardly surprising that existing Samba documentation should reflect
-	that orientation. The original HOWTO text documents were intended to provide
-	some tips, a few golden nuggets, and if they helped anyone then that was
-	just wonderful. But the HOWTO documents lacked structure and context. They were
-	isolated snapshots of information that were written to pass information
-	on to someone else who might benefit. They reflected a need to transmit
-	more information that could be conveniently put into manual pages.
-	</para>
-
-	<para>
-	The original HOWTO documents were written by different authors. Most HOWTO
-	documents are the result of feedback and contributions from numerous
-	authors. In this book we took care to preserve as much original content as
-	possible. As you read this book you will note that chapters were written by
-	multiple authors, each of whom has his own style. This demonstrates
-	the nature of the Open Source software development process.
-	</para>
-
-	<para>
-	Out of the original HOWTO documents sprang a collection of unofficial
-	HOWTO documents that are spread over the Internet. It is sincerely intended
-	that this work will <emphasis>not</emphasis> replace the valuable unofficial 
-	HOWTO work that continues to flourish. If you are involved in unofficial 
-	HOWTO production then please continue your work!
-	</para>
-
-	<para>
-	Those of you who have dedicated your labors to the production of unofficial
-	HOWTOs, to Web page information regarding Samba, or to answering questions
-	on the mailing lists or elsewhere, may be aware that this is a labor
-	of love. We would like to know about your contribution and willingly receive
-	the precious pearls of wisdom you have collected. Please email your contribution to
-	<ulink noescape="1" url="mailto:jht at samba.org">John H. Terpstra (jht at samba.org)</ulink>.
-	As a service to other users we will gladly adopt material that is technically accurate.
-	</para>
-
-	<para>
-	Existing Samba books are largely addressed to the UNIX administrator.
-	From the perspective of this target group the existing books serve
-	an adequate purpose, with one exception &smbmdash; now that Samba-3 is out
-	they need to be updated!
-	</para>
-
-	<para>
-	This book, the <emphasis>Official Samba-3 HOWTO and Reference Guide</emphasis>,
-	includes the Samba-HOWTO-Collection.pdf that ships with Samba.
-	These documents have been written with a new design intent and purpose.
-	</para>
-
-	<para>
-	Over the past two years many Microsoft network administrators have adopted
-	Samba and have become interested in its deployment. Their information needs
-	are very different from that of the UNIX administrator. This book has been
-	arranged and the information presented from the perspective of someone with previous
-	Microsoft Windows network administrative training and experience.
-	</para>
-
-</sect1>
-
-<sect1>
-<title>Book Structure and Layout</title>
-
-	<para>
-	This book is presented in six parts:
-	</para>
-
-	<variablelist>
-		<varlistentry><term>General Installation</term>
-			<listitem><para>
-			Designed to help you get Samba-3 running quickly.
-			The Fast Start chapter is a direct response to requests from
-			Microsoft network administrators for some sample configurations
-			that <emphasis>just work</emphasis>.
-			</para></listitem>
-		</varlistentry>
-
-		<varlistentry><term>Server Configuration Basics</term>
-			<listitem><para>
-			The purpose of this section is to aid the transition from existing
-			Microsoft Windows network knowledge to Samba terminology and norms.
-			The chapters in this part each cover the installation of one type of 
-			Samba server.
-			</para></listitem>
-		</varlistentry>
-
-		<varlistentry><term>Advanced Configuration</term>
-			<listitem><para>
-			The mechanics of network browsing have long been the Achilles heel of
-			all Microsoft Windows users. Samba-3 introduces new user and machine
-			account management facilities, a new way to map UNIX groups and Windows
-			groups, Interdomain trusts, new loadable file system drivers (VFS), and
-			more. New with this document is expanded printing documentation, as well
-			as a wealth of information regarding desktop and user policy handling,
-			use of desktop profiles, and techniques for enhanced network integration.
-			This section makes up the core of the book. Read and enjoy.
-			</para></listitem>
-		</varlistentry>
-
-		<varlistentry><term>Migration and Updating</term>
-			<listitem><para>
-			A much requested addition to the book is information on how to migrate
-			from Microsoft Windows NT4 to Samba-3, as well as an overview of what the
-			issues are when moving from Samba-2.x to Samba-3.
-			</para></listitem>
-		</varlistentry>
-
-		<varlistentry><term>Troubleshooting</term>
-			<listitem><para>
-			This short section should help you when all else fails.
-			</para></listitem>
-		</varlistentry>
-
-		<varlistentry><term>Reference Section</term>
-			<listitem><para>
-			Here you will find a collection of things that are either too peripheral
-			for most users, or are a little left of field to be included in the
-			main body of information.
-			</para></listitem>
-		</varlistentry>
-	</variablelist>
-		
-<para>
-Welcome to Samba-3 and the first published document to help you and your users to enjoy a whole
-new world of interoperability between Microsoft Windows and the rest of the world.
-</para>
-
-</sect1>
-
-</preface>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-LargeFile.xml b/docs-xml/Samba3-HOWTO/TOSHARG-LargeFile.xml
deleted file mode 100644
index 5fdbe7a..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-LargeFile.xml
+++ /dev/null
@@ -1,89 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="largefile">
-<chapterinfo>
-	&author.jeremy;
-	&author.jht;
-	<pubdate>March 5, 2005</pubdate>
-</chapterinfo>
-<title>Handling Large Directories</title>
-
-<para>
-<indexterm><primary>performance degradation</primary></indexterm>
-<indexterm><primary>large numbers of files</primary></indexterm>
-<indexterm><primary>large directory</primary></indexterm>
-Samba-3.0.12 and later implements a solution for sites that have experienced performance degradation due to the
-problem of using Samba-3 with applications that need large numbers of files (100,000 or more) per directory.
-</para>
-
-<para>
-<indexterm><primary>read directory into memory</primary></indexterm>
-<indexterm><primary>strange delete semantics</primary></indexterm>
-The key was fixing the directory handling to read only the current list requested instead of the old
-(up to samba-3.0.11) behavior of reading the entire directory into memory before doling out names.
-Normally this would have broken OS/2 applications, which have very strange delete semantics, but by
-stealing logic from Samba4 (thanks, Tridge), the current code in 3.0.12 handles this correctly.
-</para>
-
-<para>
-<indexterm><primary>large directory</primary></indexterm>
-<indexterm><primary>performance</primary></indexterm>
-To set up an application that needs large numbers of files per directory in a way that does not
-damage performance unduly, follow these steps:
-</para>
-
-<para>
-<indexterm><primary>canonicalize files</primary></indexterm>
-First, you need to canonicalize all the files in the directory to have one case, upper or lower &smbmdash; take your
-pick (I chose upper because all my files were already uppercase names). Then set up a new custom share for the
-application as follows:
-<smbconfblock>
-<smbconfsection name="[bigshare]"/>
-<smbconfoption name="path">/data/manyfilesdir</smbconfoption>
-<smbconfoption name="read only">no</smbconfoption>
-<smbconfoption name="case sensitive">True</smbconfoption>
-<smbconfoption name="default case">upper</smbconfoption>
-<smbconfoption name="preserve case">no</smbconfoption>
-<smbconfoption name="short preserve case">no</smbconfoption>
-</smbconfblock>
-</para>
-
-<para>
-<indexterm><primary>case options</primary></indexterm>
-<indexterm><primary>match case</primary></indexterm>
-<indexterm><primary>uppercase</primary></indexterm>
-Of course, use your own path and settings, but set the case options to match the case of all the files in your
-directory. The path should point at the large directory needed for the application &smbmdash; any new files created in
-there and in any paths under it will be forced by smbd into uppercase, but smbd will no longer have to scan
-the directory for names: it knows that if a file does not exist in uppercase, then it doesn't exist at all.
-</para>
-
-<para>
-<indexterm><primary>case-insensitive</primary></indexterm>
-<indexterm><primary>consistent case</primary></indexterm>
-<indexterm><primary>smbd</primary></indexterm>
-The secret to this is really in the <smbconfoption name="case sensitive">True</smbconfoption>
-line. This tells smbd never to scan for case-insensitive versions of names. So if an application asks for a file
-called <filename>FOO</filename>, and it cannot be found by a simple stat call, then smbd will return file not
-found immediately without scanning the containing directory for a version of a different case. The other
-<filename>xxx case xxx</filename> lines make this work by forcing a consistent case on all files created by
-&smbd;.
-</para>
-
-<para>
-<indexterm><primary>uppercase</primary></indexterm>
-<indexterm><primary>stanza</primary></indexterm>
-<indexterm><primary>lowercase filenames</primary></indexterm>
-Remember, all files and directories under the <parameter>path</parameter> directory must be in uppercase
-with this &smb.conf; stanza because &smbd; will not be able to find lowercase filenames with these settings. Also
-note that this is done on a per-share basis, allowing this parameter to be set only for a share servicing an application with
-this problematic behavior (using large numbers of entries in a directory) &smbmdash; the rest of your &smbd; shares
-don't need to be affected.
-</para>
-
-<para>
-This makes smbd much faster when dealing with large directories.  My test case has over 100,000 files, and
-smbd now deals with this very efficiently.
-</para>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-NT4Migration.xml b/docs-xml/Samba3-HOWTO/TOSHARG-NT4Migration.xml
deleted file mode 100644
index 2688e06..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-NT4Migration.xml
+++ /dev/null
@@ -1,631 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="NT4Migration">
-<chapterinfo>
-	&author.jht;
-	<pubdate>April 3, 2003</pubdate>
-</chapterinfo>
-
-<title>Migration from NT4 PDC to Samba-3 PDC</title>
-
-<para>
-<indexterm><primary>migrate</primary></indexterm>
-<indexterm><primary>domain control</primary></indexterm>
-This is a rough guide to assist those wishing to migrate from NT4 domain control to
-Samba-3-based domain control.
-</para>
-
-<sect1>
-<title>Planning and Getting Started</title>
-
-<para>
-<indexterm><primary>show-stopper-type</primary></indexterm>
-In the IT world there is often a saying that all problems are encountered because of
-poor planning. The corollary to this saying is that not all problems can be anticipated
-and planned for. Then again, good planning will anticipate most show-stopper-type situations.
-</para>
-
-<para>
-<indexterm><primary>migration plan</primary></indexterm>
-Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control
-environment would do well to develop a detailed migration plan. So here are a few pointers to
-help migration get underway.
-</para>
-
-<sect2>
-<title>Objectives</title>
-
-<para>
-<indexterm><primary>migration process</primary></indexterm>
-The key objective for most organizations is to make the migration from MS Windows NT4 
-to Samba-3 domain control as painless as possible. One of the challenges you may experience
-in your migration process may well be convincing management that the new environment
-should remain in place. Many who have introduced open source technologies have experienced
-pressure to return to a Microsoft-based platform solution at the first sign of trouble. 
-</para>
-
-<para>
-<indexterm><primary>change motivations</primary></indexterm>
-Before attempting a migration to a Samba-3-controlled network, make every possible effort to
-gain all-round commitment to the change. Know precisely <emphasis>why</emphasis> the change
-is important for the organization. Possible motivations to make a change include:
-</para>
-
-<indexterm><primary>manageability</primary></indexterm>
-<indexterm><primary>functionality</primary></indexterm>
-<indexterm><primary>operating costs</primary></indexterm>
-<indexterm><primary>support exposure</primary></indexterm>
-<indexterm><primary>licensing</primary></indexterm>
-
-<itemizedlist>
-    <listitem><para>Improve network manageability.</para></listitem>
-    <listitem><para>Obtain better user-level functionality.</para></listitem>
-    <listitem><para>Reduce network operating costs.</para></listitem>
-    <listitem><para>Reduce exposure caused by Microsoft withdrawal of NT4 support.</para></listitem>
-    <listitem><para>Avoid MS License 6 implications.</para></listitem>
-    <listitem><para>Reduce organization's dependency on Microsoft.</para></listitem>
-</itemizedlist>
-
-<para>
-<indexterm><primary>alternative solution</primary></indexterm>
-<indexterm><primary>advantages</primary></indexterm>
-<indexterm><primary>core values</primary></indexterm>
-<indexterm><primary>migration</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-<indexterm><primary>without ADS</primary></indexterm>
-Make sure everyone knows that Samba-3 is not MS Windows NT4. Samba-3 offers
-an alternative solution that is both different from MS Windows NT4 and offers 
-advantages compared with it. Gain recognition that Samba-3 lacks many of the
-features that Microsoft has promoted as core values in migration from MS Windows NT4 to 
-MS Windows 2000 and beyond (with or without Active Directory services).
-</para>
-
-<para>
-What are the features that Samba-3 cannot provide?
-</para>
-
-<indexterm><primary>Active Directory Server</primary></indexterm>
-<indexterm><primary>Group Policy Objects</primary></indexterm>
-<indexterm><primary>Machine Policy Objects</primary></indexterm>
-<indexterm><primary>Logon Scripts</primary></indexterm>
-<indexterm><primary>Access Controls</primary></indexterm>
-
-<itemizedlist>
-	<listitem><para>Active Directory Server.</para></listitem>
-	<listitem><para>Group Policy Objects (in Active Directory).</para></listitem>
-	<listitem><para>Machine Policy Objects.</para></listitem>
-	<listitem><para>Logon Scripts in Active Directory.</para></listitem>
-	<listitem><para>Software Application and Access Controls in Active Directory.</para></listitem>
-</itemizedlist>
-
-<para>
-The features that Samba-3 does provide and that may be of compelling interest to your site
-include:
-</para>
-
-<indexterm><primary>ownership cost</primary></indexterm>
-<indexterm><primary>Global support</primary></indexterm>
-<indexterm><primary>Dynamic SMB servers</primary></indexterm>
-<indexterm><primary>on-the-fly logon scripts</primary></indexterm>
-<indexterm><primary>on-the-fly policy files</primary></indexterm>
-<indexterm><primary>stability</primary></indexterm>
-<indexterm><primary>reliability</primary></indexterm>
-<indexterm><primary>performance</primary></indexterm>
-<indexterm><primary>availability</primary></indexterm>
-<indexterm><primary>Manageability</primary></indexterm>
-<indexterm><primary>backend authentication</primary></indexterm>
-<indexterm><primary>tdbsam</primary></indexterm>
-<indexterm><primary>ldapsam</primary></indexterm>
-<indexterm><primary>single-sign-on</primary></indexterm>
-<indexterm><primary>distribute authentication systems</primary></indexterm>
-
-<itemizedlist>
-	<listitem><para>Lower cost of ownership.</para></listitem>
-	<listitem><para>Global availability of support with no strings attached.</para></listitem>
-	<listitem><para>Dynamic SMB servers (can run more than one SMB/CIFS server per UNIX/Linux system).</para></listitem>
-	<listitem><para>Creation of on-the-fly logon scripts.</para></listitem>
-	<listitem><para>Creation of on-the-fly policy files.</para></listitem>
-	<listitem><para>Greater stability, reliability, performance, and availability.</para></listitem>
-	<listitem><para>Manageability via an SSH connection.</para></listitem>
-	<listitem><para>Flexible choices of backend authentication technologies (tdbsam, ldapsam).</para></listitem>
-	<listitem><para>Ability to implement a full single-sign-on architecture.</para></listitem>
-	<listitem><para>Ability to distribute authentication systems for absolute minimum wide-area network bandwidth demand.</para></listitem>
-</itemizedlist>
-
-<para>
-<indexterm><primary>successful migration</primary></indexterm>
-Before migrating a network from MS Windows NT4 to Samba-3, consider all necessary factors. Users
-should be educated about changes they may experience so the change will be a welcome one
-and not become an obstacle to the work they need to do. The following sections explain factors that will 
-help ensure a successful migration.
-</para>
-
-<sect3>
-<title>Domain Layout</title>
-
-<para>
-<indexterm><primary>domain controller</primary></indexterm>
-<indexterm><primary>backup domain controller</primary></indexterm>
-<indexterm><primary>secondary controller</primary></indexterm>
-<indexterm><primary>domain member</primary></indexterm>
-<indexterm><primary>standalone server</primary></indexterm>
-<indexterm><primary>network security</primary></indexterm>
-<indexterm><primary>domain context</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>BDCs</primary></indexterm>
-<indexterm><primary>LDAP</primary></indexterm>
-<indexterm><primary>authentication backend</primary></indexterm>
-<indexterm><primary>complex organization</primary></indexterm>
-<indexterm><primary>LDAP database</primary></indexterm>
-<indexterm><primary>master server</primary></indexterm>
-<indexterm><primary>slave servers</primary></indexterm>
-<indexterm><primary>multiple domains</primary></indexterm>
-Samba-3 can be configured as a domain controller, a backup domain controller (probably best called
-a secondary controller), a domain member, or a standalone server. The Windows network security
-domain context should be sized and scoped before implementation. Particular attention needs to be
-paid to the location of the Primary Domain Controller (PDC) as well as backup controllers (BDCs).
-One way in which Samba-3 differs from Microsoft technology is that if one chooses to use an LDAP
-authentication backend, then the same database can be used by several different domains. In a
-complex organization, there can be a single LDAP database, which itself can be distributed (have
-a master server and multiple slave servers) that can simultaneously serve multiple domains.
-</para>
-
-<para>
-<indexterm><primary>network bandwidth</primary></indexterm>
-From a design perspective, the number of users per server as well as the number of servers per
-domain should be scaled taking into consideration server capacity and network bandwidth.
-</para>
-
-<para>
-<indexterm><primary>network segment</primary></indexterm>
-<indexterm><primary>multiple network segments</primary></indexterm>
-<indexterm><primary>domain controller</primary></indexterm>
-<indexterm><primary>ping</primary></indexterm>
-<indexterm><primary>BDC</primary></indexterm>
-<indexterm><primary>remote segment</primary></indexterm>
-A physical network segment may house several domains. Each may span multiple network segments.
-Where domains span routed network segments, consider and test the performance implications of
-the design and layout of a network. A centrally located domain controller that is designed to
-serve multiple routed network segments may result in severe performance problems. Check the
-response time (ping timing) between the remote segment and the PDC. If it's long (more than 100 ms),
-locate a BDC on the remote segment to serve as the local authentication and access control server.
-</para>
-</sect3>
-
-<sect3>
-<title>Server Share and Directory Layout</title>
-
-<para>
-<indexterm><primary>Simplicity is king</primary></indexterm>
-<indexterm><primary>well-controlled network</primary></indexterm>
-There are cardinal rules to effective network design that cannot be broken with impunity.
-The most important rule: Simplicity is king in every well-controlled network. Every part of
-the infrastructure must be managed; the more complex it is, the greater will be the demand
-of keeping systems secure and functional.
-</para>
-
-<para>
-<indexterm><primary>disk space</primary></indexterm>
-<indexterm><primary>backed up</primary></indexterm>
-<indexterm><primary>tape</primary></indexterm>
-<indexterm><primary>backup</primary></indexterm>
-<indexterm><primary>validate every backup</primary></indexterm>
-<indexterm><primary>disaster recovery</primary></indexterm>
-Keep in mind the nature of how data must be shared. Physical disk space layout should be considered
-carefully. Some data must be backed up. The simpler the disk layout, the easier it will be to
-keep track of backup needs. Identify what backup media will meet your needs; consider backup to tape,
-CD-ROM or DVD-ROM, or other offline storage medium. Plan and implement for minimum
-maintenance. Leave nothing to chance in your design; above all, do not leave backups to chance:
-backup, test, and validate every backup; create a disaster recovery plan and prove that it works.
-</para>
-
-<para>
-<indexterm><primary>access control needs</primary></indexterm>
-<indexterm><primary>group permissions</primary></indexterm>
-<indexterm><primary>sticky bit</primary></indexterm>
-Users should be grouped according to data access control needs. File and directory access 
-is best controlled via group permissions, and the use of the <quote>sticky bit</quote> on group-controlled
-directories may substantially avoid file access complaints from Samba share users.
-</para>
-
-<para>
-<indexterm><primary>network administrators</primary></indexterm>
-<indexterm><primary>document design</primary></indexterm>
-<indexterm><primary>simple access controls</primary></indexterm>
-<indexterm><primary>obtuse complexity</primary></indexterm>
-<indexterm><primary>document design</primary></indexterm>
-Inexperienced  network administrators often attempt elaborate techniques to set access
-controls on files, directories, shares, as well as in share definitions.
-Keep your design and implementation simple and document your design extensively. Have others
-audit your documentation. Do not create a complex mess that your successor will not understand.
-Remember, job security through complex design and implementation may cause loss of operations
-and downtime to users as the new administrator learns to untangle your knots. Keep access
-controls simple and effective, and make sure that users will never be interrupted by obtuse
-complexity.
-</para>
-</sect3>
-
-<sect3>
-<title>Logon Scripts</title>
-
-<para>
-<indexterm><primary>Logon scripts</primary></indexterm>
-Logon scripts can help to ensure that all users gain the share and printer connections they need.
-</para>
-
-<para>
-Logon scripts can be created on the fly so all commands executed are specific to the
-rights and privileges granted to the user. The preferred controls should be effected through
-group membership so group information can be used to create a custom logon script using
-the <smbconfoption name="root preexec"/> parameters to the <smbconfsection name="NETLOGON"/> share.
-</para>
-
-<para>
-<indexterm><primary>kixstart</primary></indexterm>
-Some sites prefer to use a tool such as <command>kixstart</command> to establish a controlled
-user environment. In any case, you may wish to do a Google search for logon script process controls.
-In particular, you may wish to explore the use of the Microsoft Knowledge Base article KB189105 that
-deals with how to add printers without user intervention via the logon script process.
-</para>
-</sect3>
-
-<sect3>
-<title>Profile Migration/Creation</title>
-
-<para>
-User and group profiles may be migrated using the tools described in the section titled Desktop Profile
-Management.
-</para>
-
-
-<para>
-<indexterm><primary>SID</primary></indexterm>
-<indexterm><primary>NTuser.DAT</primary></indexterm>
-Profiles may also be managed using the Samba-3 tool <command>profiles</command>. This tool allows the MS
-Windows NT-style security identifiers (SIDs) that are stored inside the profile
-<filename>NTuser.DAT</filename> file to be changed to the SID of the Samba-3 domain.
-</para>
-</sect3>
-
-<sect3>
-<title>User and Group Accounts</title>
-
-<para>
-<indexterm><primary>migrate account settings</primary></indexterm>
-<indexterm><primary>migrate user</primary></indexterm>
-<indexterm><primary>migrate group</primary></indexterm>
-<indexterm><primary>map</primary></indexterm>
-It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before
-attempting to migrate user and group accounts, you are STRONGLY advised to create in Samba-3 the
-groups that are present on the MS Windows NT4 domain <emphasis>AND</emphasis> to map them to
-suitable UNIX/Linux groups. By following this simple advice, all user and group attributes
-should migrate painlessly.
-</para>
-</sect3>
-
-</sect2>
-
-<sect2>
-<title>Steps in Migration Process</title>
-
-<para>
-The approximate migration process is described below.
-</para>
-
-<itemizedlist>
-	<listitem><para>
-	You have an NT4 PDC that has the users, groups, policies, and profiles to be migrated.
-	</para></listitem>
-
-	<listitem><para>
-<indexterm><primary>domain controller</primary></indexterm>
-<indexterm><primary>netlogon share</primary></indexterm>
-<indexterm><primary>BDC</primary></indexterm>
-	Samba-3 is set up as a domain controller with netlogon share, profile share, and so on. Configure the &smb.conf; file
-	to function as a BDC: <parameter>domain master = No</parameter>.
-	</para></listitem>
-</itemizedlist>
-
-<procedure>
-<title>The Account Migration Process</title>
-
-	<step><para>
-	<indexterm><primary>pdbedit</primary></indexterm>
-	Create a BDC account in the old NT4 domain for the Samba server using NT Server Manager.
-	<emphasis>Samba must not be running.</emphasis>
-	</para></step>
-
-	<step><para>
-	<indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>join</tertiary></indexterm>
-	<userinput>net rpc join -S <replaceable>NT4PDC</replaceable> -w <replaceable>DOMNAME</replaceable> -U
-	Administrator%<replaceable>passwd</replaceable></userinput>
-	</para></step>
-
-	<step><para>
-<indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>vampire</tertiary></indexterm>
-	<userinput>net rpc vampire -S <replaceable>NT4PDC</replaceable> -U 
-	administrator%<replaceable>passwd</replaceable></userinput>
-	</para></step>
-
-<indexterm><primary>pdbedit</primary></indexterm>
-	<step><para><userinput>pdbedit -L</userinput></para>
-		<para>Note: Did the users migrate?</para>
-	</step>
-
-	<step><para>
-	<indexterm><primary>net</primary><secondary>groupmap</secondary></indexterm>
-	<indexterm><primary>initGroups.sh</primary></indexterm>
-	Now assign each of the UNIX groups to NT groups:
-	(It may be useful to copy this text to a script called <filename>initGroups.sh</filename>)
-	<programlisting>
-#!/bin/bash
-#### Keep this as a shell script for future re-use
-			
-# First assign well known domain global groups
-net groupmap add ntgroup="Domain Admins" unixgroup=root rid=512 type=d
-net groupmap add ntgroup="Domain Users"  unixgroup=users rid=513 type=d
-net groupmap add ntgroup="Domain Guests" unixgroup=nobody rid=514 type=d
-
-# Now for our added domain global groups
-net groupmap add ntgroup="Designers" unixgroup=designers type=d
-net groupmap add ntgroup="Engineers" unixgroup=engineers type=d
-net groupmap add ntgroup="QA Team"   unixgroup=qateam    type=d
-</programlisting>
-	</para></step>
-
-	<step><para><userinput>net groupmap list</userinput></para>
-		<para>Check that all groups are recognized.
-	</para></step>
-</procedure>
-
-<para>
-Migrate all the profiles, then migrate all policy files.
-</para>
-
-</sect2>
-</sect1>
-
-<sect1>
-<title>Migration Options</title>
-
-<para>
-Sites that wish to migrate from MS Windows NT4 domain control to a Samba-based solution
-generally fit into three basic categories. <link linkend="majtypes">Following table</link> shows the possibilities.
-</para>
-
-<table frame="all" id="majtypes"><title>The Three Major Site Types</title>
-<tgroup cols="2">
-	<colspec align="left"/>
-	<colspec align="justify"/> 
-	<thead>
-	<row><entry>Number of Users</entry><entry>Description</entry></row>
-	</thead>
-	<tbody>
-	<row><entry>< 50</entry><entry><para>Want simple conversion with no pain.</para></entry></row>
-	<row><entry>50 - 250</entry><entry><para>Want new features; can manage some inhouse complexity.</para></entry></row>
-	<row><entry>> 250</entry><entry><para>Solution/implementation must scale well; complex needs.
-		Cross-departmental decision process. Local expertise in most areas.</para></entry></row>
-	</tbody>
-</tgroup>
-</table>
-
-<sect2>
-<title>Planning for Success</title>
-
-<para>
-There are three basic choices for sites that intend to migrate from MS Windows NT4
-to Samba-3:
-</para>
-
-<itemizedlist>
-	<listitem><para>
-	Simple conversion (total replacement).
-	</para></listitem>
-
-	<listitem><para>
-	Upgraded conversion (could be one of integration).
-	</para></listitem>
-
-	<listitem><para>
-	Complete redesign (completely new solution).
-	</para></listitem>
-</itemizedlist>
-
-<para>
-Minimize downstream problems by:
-</para>
-
-<itemizedlist>
-	<listitem><para>
-	Taking sufficient time.
-	</para></listitem>
-
-	<listitem><para>
-	Avoiding panic.
-	</para></listitem>
-
-	<listitem><para>
-	Testing all assumptions.
-	</para></listitem>
-
-	<listitem><para>
-	Testing the full roll-out program, including workstation deployment.
-	</para></listitem>
-</itemizedlist>
-
-<para><link linkend="natconchoices">Following table</link> lists the conversion choices given the type of migration
-being contemplated.
-</para>
-
-<table frame="all" id="natconchoices"><title>Nature of the Conversion Choices</title>
-<tgroup cols="3">
-	<colspec align="justify" colwidth="1*"/>
-	<colspec align="justify" colwidth="1*"/>
-	<colspec align="justify" colwidth="1*"/>
-	<thead>
-	<row><entry>Simple Install</entry><entry>Upgrade Decisions</entry><entry>Redesign Decisions</entry></row>
-	</thead>
-	<tbody>
-	<row>
-	<entry><para>Make use of minimal OS-specific features</para></entry>
-	<entry><para>Translate NT4 features to new host OS features</para></entry>
-	<entry><para>Improve on NT4 functionality, enhance management capabilities</para></entry>
-	</row>
-	<row>
-	<entry><para>Move all accounts from NT4 into Samba-3</para></entry>
-	<entry><para>Copy and improve</para></entry>
-	<entry><para>Authentication regime (database location and access)</para></entry>
-	</row>
-	<row>
-	<entry><para>Make least number of operational changes</para></entry>
-	<entry><para>Make progressive improvements</para></entry>
-	<entry><para>Desktop management methods</para></entry>
-	</row>
-	<row>
-	<entry><para>Take least amount of time to migrate</para></entry>
-	<entry><para>Minimize user impact</para></entry>
-	<entry><para>Better control of Desktops/Users</para></entry>
-	</row>
-	<row>
-	<entry><para>Live versus isolated conversion</para></entry>
-	<entry><para>Maximize functionality</para></entry>
-	<entry><para>Identify Needs for: <emphasis>Manageability, Scalability, Security, Availability</emphasis></para></entry>
-	</row>
-	<row>
-	<entry><para>Integrate Samba-3, then migrate while users are active, then change of control (swap out)</para></entry>
-	<entry><para>Take advantage of lower maintenance opportunity</para></entry>
-	<entry><para></para></entry>
-	</row>
-	</tbody>
-</tgroup>
-</table>
-</sect2>
-
-<sect2>
-<title>Samba-3 Implementation Choices</title>
-
-<variablelist>
-		<varlistentry><term>Authentication Database/Backend</term><listitem>
-		<para>
-		Samba-3 can use an external authentication backend:
-		</para>
-
-		<para>
-		<itemizedlist>
-			<listitem><para>Winbind (external Samba or NT4/200x server).</para></listitem>
-			<listitem><para>External server could use Active Directory or NT4 domain.</para></listitem>
-			<listitem><para>Can use pam_mkhomedir.so to autocreate home directories.</para></listitem>
-			<listitem><para> Samba-3 can use a local authentication backend: <parameter>smbpasswd</parameter>,
-				<parameter>tdbsam</parameter>, <parameter>ldapsam</parameter>
-			</para></listitem>
-		</itemizedlist></para></listitem>
-		</varlistentry>
-
-        <varlistentry><term>Access Control Points</term><listitem>
-		<para>
-		Samba permits Access Control points to be set:
-		</para>
-
-<indexterm><primary>share ACLs</primary></indexterm>
-<indexterm><primary>UNIX permissions</primary></indexterm>
-<indexterm><primary>POSIX ACLS</primary></indexterm>
-<indexterm><primary>share stanza controls</primary></indexterm>
-
-		<itemizedlist>
-			<listitem><para>On the share itself &smbmdash; using share ACLs.</para></listitem>
-			<listitem><para>On the file system &smbmdash; using UNIX permissions on files and directories.</para>
-			<para>Note: Can enable Posix ACLs in file system also.</para></listitem>
-			<listitem><para>Through Samba share parameters &smbmdash; not recommended except as last resort.</para></listitem>
-		</itemizedlist></listitem>
-        </varlistentry>
-
-        <varlistentry><term>Policies (migrate or create new ones)</term><listitem>
-		<para>
-<indexterm><primary>policies</primary></indexterm>
-<indexterm><primary>NTConfig.POL</primary></indexterm>
-		Exercise great caution when making registry changes; use the right tool and be aware
-		that changes made through NT4-style <filename>NTConfig.POL</filename> files can leave
-		permanent changes.
-<indexterm><primary>Group Policy Editor</primary></indexterm>
-<indexterm><primary>tattoo effect</primary></indexterm>
-<indexterm><primary>permanent changes</primary></indexterm>
-		</para>
-                <itemizedlist>
-                        <listitem><para>Using Group Policy Editor (NT4).</para></listitem>
-                        <listitem><para>Watch out for tattoo effect.</para></listitem>
-		</itemizedlist>
-                </listitem>
-        </varlistentry>
-
-        <varlistentry><term>User and Group Profiles</term><listitem>
-		<para>
-<indexterm><primary>NTUser.DAT</primary></indexterm>
-<indexterm><primary>SIDs</primary></indexterm>
-		Platform-specific, so use platform tool to change from a local to a roaming profile.
-		Can use new profiles tool to change SIDs (<filename>NTUser.DAT</filename>).
-		</para>
-                </listitem>
-        </varlistentry>
-
-        <varlistentry><term>Logon Scripts</term><listitem>
-                <para>
-		Know how they work.
-		</para>
-                </listitem>
-        </varlistentry>
-
-
-        <varlistentry><term>User and Group Mapping to UNIX/Linux</term><listitem>
-		<para>
-		<indexterm><primary>pdbedit</primary></indexterm>
-		User and group mapping code is new. Many problems have been experienced as network administrators
-		who are familiar with Samba-2.2.x migrate to Samba-3. Carefully study the chapters that document
-		the new password backend behavior and the new group mapping functionality.
-		</para>
-			<itemizedlist>
-				<listitem><para>The <parameter>username map</parameter> facility may be needed.</para></listitem>
-				<listitem><para>Use <command>net groupmap</command> to connect NT4 groups to UNIX groups.</para></listitem>
-				<listitem><para>
-					Use <command>pdbedit</command> to set/change user configuration.
-					</para>
-
-					<para>
-					When migrating to LDAP backend, it may be easier to dump the initial
-					LDAP database to LDIF, edit, then reload into LDAP.
-					</para></listitem>
-			</itemizedlist></listitem>
-        </varlistentry>
-
-        <varlistentry><term>OS-Specific Scripts/Programs May be Needed</term><listitem>
-		<para>
-		Every operating system has its peculiarities. These are the result of engineering decisions
-		that were based on the experience of the designer and may have side effects that were not
-		anticipated. Limitations that may bite the Windows network administrator include:
-		</para>
-                <itemizedlist>
-                        <listitem><para>Add/Delete Users: Note OS limits on size of name
-				(Linux 8 chars, NT4 up to 254 chars).</para></listitem>
-                        <listitem><para>Add/Delete Machines: Applied only to domain members
-				(Note: machine names may be limited to 16 characters).</para></listitem>
-                        <listitem><para>Use <command>net groupmap</command> to connect NT4 groups to UNIX groups.</para></listitem>
-                        <listitem><para>Add/Delete Groups: Note OS limits on size and nature.
-				Linux limit is 16 char, no spaces, and no uppercase chars (<command>groupadd</command>).</para></listitem>
-		</itemizedlist></listitem>
-        </varlistentry>
-
-        <varlistentry><term>Migration Tools</term><listitem>
-                <para>
-				<indexterm><primary>pdbedit</primary></indexterm>
-				Domain Control (NT4-Style) Profiles, Policies, Access Controls, Security
-				<itemizedlist>
-					 <listitem><para>Samba: <command>net, rpcclient, smbpasswd, pdbedit, profiles</command></para></listitem>
-					 <listitem><para>Windows: <command>NT4 Domain User Manager, Server Manager (NEXUS)</command></para></listitem>
-				</itemizedlist></para></listitem>
-        </varlistentry>
-</variablelist>
-
-</sect2>
-
-</sect1>
-
-</chapter>
diff --git a/docs-xml/Samba3-HOWTO/TOSHARG-NetworkBrowsing.xml b/docs-xml/Samba3-HOWTO/TOSHARG-NetworkBrowsing.xml
deleted file mode 100644
index d732f3a..0000000
--- a/docs-xml/Samba3-HOWTO/TOSHARG-NetworkBrowsing.xml
+++ /dev/null
@@ -1,2223 +0,0 @@
-<?xml version="1.0" encoding="iso-8859-1"?>
-<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
-<chapter id="NetworkBrowsing">
-<chapterinfo>
-	&author.jht;
-	&author.jelmer;
-	<author>
-		<firstname>Jonathan</firstname><surname>Johnson</surname>
-		<affiliation>
-			<orgname>Sutinen Consulting, Inc.</orgname>
-                        <address><email>jon at sutinen.com</email></address>
-		</affiliation>
-	</author>
-	<pubdate>July 5, 1998</pubdate>
-	<pubdate>Updated: September 20, 2006</pubdate>
-</chapterinfo>
-
-<title>Network Browsing</title>
-
-<para>
-<indexterm><primary>browsing across subnets</primary></indexterm>
-<indexterm><primary>resolution of NetBIOS names</primary></indexterm>
-<indexterm><primary>browse list handling</primary></indexterm>
-<indexterm><primary>WINS</primary></indexterm>
-This chapter contains detailed information as well as a fast-track guide to
-implementing browsing across subnets and/or across workgroups (or domains).
-WINS is the best tool for resolution of NetBIOS names to IP addresses; however, WINS is
-not involved in browse list handling except by way of name-to-address resolution.
-</para>
-
-<note><para>
-<indexterm><primary>WINS</primary></indexterm>
-What is WINS?
-</para>
-<para>
-WINS is a facility that provides resolution of a NetBIOS name to its IP address. WINS is like a
-Dynamic-DNS service for NetBIOS networking names.
-</para></note>
-
-<note><para>
-<indexterm><primary>Windows 2000</primary></indexterm>
-<indexterm><primary>NetBIOS over TCP/IP</primary></indexterm>
-<indexterm><primary>DNS</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-MS Windows 2000 and later versions can be configured to operate with no NetBIOS
-over TCP/IP. Samba-3 and later versions also support this mode of operation.
-When the use of NetBIOS over TCP/IP has been disabled, the primary
-means for resolution of MS Windows machine names is via DNS and Active Directory.
-The following information assumes that your site is running NetBIOS over TCP/IP.
-</para></note>
-
-<sect1>
-<title>Features and Benefits</title>
-
-<para>
-Charles Dickens once referred to the past in these words: <quote><emphasis>It was the best of times,
-it was the worst of times.</emphasis></quote> The more we look back, the more we long for what was and
-hope it never returns.
-</para>
-
-
-<para>
-<indexterm><primary>NetBIOS</primary></indexterm>
-<indexterm><primary>NetBIOS networking</primary></indexterm>
-<indexterm><primary>fickle</primary></indexterm>
-For many MS Windows network administrators, that statement sums up their feelings about
-NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle
-nature was just par for the course. For those who never quite managed to tame its
-lusty features, NetBIOS is like Paterson's Curse.
-</para>
-
-<para>
-For those not familiar with botanical problems in Australia, Paterson's Curse,
-<emphasis>Echium plantagineum</emphasis>, was introduced to Australia from Europe during the mid-19th
-century. Since then it has spread rapidly. The high seed production, with densities of
-thousands of seeds per square meter, a seed longevity of more than 7 years, and an
-ability to germinate at any time of year, given the right conditions, are some of the
-features that make it such a persistent weed.
-</para>
-
-<para>
-<indexterm><primary>Network Basic Input/Output System</primary><see>NetBIOS</see></indexterm>
-<indexterm><primary>SMB</primary></indexterm>
-<indexterm><primary>NetBIOS</primary></indexterm>
-<indexterm><primary>TCP/IP</primary></indexterm>
-<indexterm><primary>Windows network clients</primary></indexterm>
-In this chapter we explore vital aspects of Server Message Block (SMB) networking with
-a particular focus on SMB as implemented through running NetBIOS (Network Basic
-Input/Output System) over TCP/IP. Since Samba does not implement SMB or NetBIOS over
-any other protocols, we need to know how to configure our network environment and simply
-remember to use nothing but TCP/IP on all our MS Windows network clients.
-</para>
-
-<para>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>MS WINS</primary></indexterm>
-Samba provides the ability to implement a WINS (Windows Internetworking Name Server)
-and implements extensions to Microsoft's implementation of WINS. These extensions
-help Samba to effect stable WINS operations beyond the normal scope of MS WINS.
-</para>
-
-<para>
-<indexterm><primary>NetBIOS over TCP/IP</primary></indexterm>
-<indexterm><primary>NetBIOS disabled</primary></indexterm>
-<indexterm><primary>WINS</primary></indexterm>
-WINS is exclusively a service that applies only to those systems
-that run NetBIOS over TCP/IP. MS Windows 200x/XP have the capacity to operate with
-support for NetBIOS disabled, in which case WINS is of no relevance. Samba supports this also.
-</para>
-
-<para>
-<indexterm><primary>NetBIOS disabled</primary></indexterm>
-<indexterm><primary>DNS</primary></indexterm>
-<indexterm><primary>WINS</primary></indexterm>
-For those networks on which NetBIOS has been disabled (i.e., WINS is not required),
-the use of DNS is necessary for hostname resolution.
-</para>
-
-</sect1>
-
-<sect1>
-<title>What Is Browsing?</title>
-
-<para>
-<indexterm><primary>browsing</primary></indexterm>
-<indexterm><primary>Network Neighborhood</primary></indexterm>
-<indexterm><primary>shares</primary></indexterm>
-<indexterm><primary>printers available</primary></indexterm>
-To most people, browsing means they can see the MS Windows and Samba servers
-in the Network Neighborhood, and when the computer icon for a particular server is
-clicked, it opens up and shows the shares and printers available on the target server.
-</para>
-
-<para>
-What seems so simple is in fact a complex interaction of different technologies.
-The technologies (or methods) employed in making all of this work include:
-</para>
-
-<itemizedlist>
-	<listitem><para>MS Windows machines register their presence to the network.</para></listitem>
-	<listitem><para>Machines announce themselves to other machines on the network.</para></listitem>
-	<listitem><para>One or more machines on the network collate the local announcements.</para></listitem>
-	<listitem><para>The client machine finds the machine that has the collated list of machines.</para></listitem>
-	<listitem><para>The client machine is able to resolve the machine names to IP addresses.</para></listitem>
-	<listitem><para>The client machine is able to connect to a target machine.</para></listitem>
-</itemizedlist>
-
-<para>
-<indexterm><primary>browse list management</primary></indexterm>
-<indexterm><primary>name resolution</primary></indexterm>
-<indexterm><primary>nmbd</primary></indexterm>
-The Samba application that controls browse list management and name resolution is
-called <filename>nmbd</filename>. The configuration parameters involved in nmbd's operation are:
-</para>
-
-<para>
-Browsing options:
-</para>
-<itemizedlist>
-	<listitem><smbconfoption name="os level"/></listitem>
-	<listitem><smbconfoption name="lm announce"/></listitem>
-	<listitem><smbconfoption name="lm interval"/></listitem>
-	<listitem><smbconfoption name="preferred master"/>(*)</listitem>
-	<listitem><smbconfoption name="local master"/>(*)</listitem>
-	<listitem><smbconfoption name="domain master"/>(*)</listitem>
-	<listitem><smbconfoption name="browse list"/></listitem>
-	<listitem><smbconfoption name="enhanced browsing"/></listitem>
-</itemizedlist>
-
-<para>
-Name Resolution Method:
-</para>
-<itemizedlist>
-	<listitem><smbconfoption name="name resolve order"/>(*)</listitem>
-</itemizedlist>
-
-<para>
-WINS options:
-</para>
-<itemizedlist>
-	<listitem><smbconfoption name="dns proxy"/></listitem>
-	<listitem><smbconfoption name="wins proxy"/></listitem>
-	<listitem><smbconfoption name="wins server"/>(*)</listitem>
-	<listitem><smbconfoption name="wins support"/>(*)</listitem>
-	<listitem><smbconfoption name="wins hook"/></listitem>
-</itemizedlist>
-
-<para>
-Those marked with an (*) are the only options that commonly may need to be modified. Even if none of these
-parameters is set, <filename>nmbd</filename> will still do its job.
-</para>
-
-<para>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>WINS Server</primary></indexterm>
-<indexterm><primary>WINS Support</primary></indexterm>
-<indexterm><primary>nmbd</primary></indexterm>
-<indexterm><primary>mutually exclusive options</primary></indexterm>
-For Samba, the WINS Server and WINS Support are mutually exclusive options. When <command>nmbd</command> is
-started it will fail to execute if both options are set in the &smb.conf; file. The <command>nmbd</command>
-understands that when it spawns an instance of itself to run as a WINS server that it has to use its own WINS
-server also.
-</para>
-
-</sect1>
-
-<sect1 id="netdiscuss">
-<title>Discussion</title>
-
-<para>
-<indexterm><primary>SMB-based messaging</primary></indexterm>
-<indexterm><primary>NetBIOS</primary></indexterm>
-<indexterm><primary>NetBIOS</primary></indexterm>
-<indexterm><primary>phasing out NetBIOS</primary></indexterm>
-All MS Windows networking uses SMB-based messaging.  SMB messaging may be implemented with or without NetBIOS.
-MS Windows 200x supports NetBIOS over TCP/IP for backwards compatibility. Microsoft appears intent on phasing
-out NetBIOS support.
-</para>
-
-<sect2>
-<title>NetBIOS over TCP/IP</title>
-
-<para>
-<indexterm><primary>encapsulating</primary></indexterm>
-<indexterm><primary>broadcast</primary></indexterm>
-<indexterm><primary>unicast</primary></indexterm>
-<indexterm><primary>UDP</primary></indexterm>
-Samba implements NetBIOS, as does MS Windows NT/200x/XP, by encapsulating it over TCP/IP.
-NetBIOS-based networking uses broadcast messaging to effect browse list management. When running NetBIOS over
-TCP/IP, this uses UDP-based messaging.  UDP messages can be broadcast or unicast.
-</para>
-
-<para>
-<indexterm><primary>UDP</primary></indexterm>
-Normally, only unicast UDP messaging can be forwarded by routers. The <smbconfoption name="remote announce"/>
-parameter to smb.conf helps to project browse announcements to remote network segments via unicast UDP.
-Similarly, the <smbconfoption name="remote browse sync"/> parameter of &smb.conf; implements browse list
-collation using unicast UDP.
-</para>
-
-<para>
-The methods used by MS Windows to perform name lookup requests (name resolution) is determined by a
-configuration parameter called the NetBIOS node-type. There are four basic NetBIOS node types:
-</para>
-
-<indexterm><primary>b-node</primary></indexterm>
-<indexterm><primary>p-node</primary></indexterm>
-<indexterm><primary>m-node</primary></indexterm>
-<indexterm><primary>h-node</primary></indexterm>
-<indexterm><primary>node-type</primary></indexterm>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>broadcast</primary></indexterm>
-<indexterm><primary>unicast</primary></indexterm>
-<itemizedlist>
-	<listitem><para><emphasis>b-node (type 0x01):</emphasis> The Windows client will use only
-	NetBIOS broadcast requests using UDP broadcast.</para></listitem>
-	<listitem><para><emphasis>p-node (type 0x02):</emphasis> The Windows client will use point-to-point
-	(NetBIOS unicast) requests using UDP unicast directed to a WINS server.</para></listitem>
-	<listitem><para><emphasis>m-node (type 0x04):</emphasis> The Windows client will first use
-	NetBIOS broadcast requests using UDP broadcast, then it will use (NetBIOS unicast)
-	requests using UDP unicast directed to a WINS server.</para></listitem>
-	<listitem><para><emphasis>h-node (type 0x08):</emphasis> The Windows client will use
-	(NetBIOS unicast) requests using UDP unicast directed to a WINS server, then it will use
-	NetBIOS broadcast requests using UDP broadcast.</para></listitem>
-</itemizedlist>
-
-<para>
-<indexterm><primary>h-node</primary></indexterm>
-<indexterm><primary>hybrid</primary></indexterm>
-<indexterm><primary>enables NetBIOS over TCP/IP</primary></indexterm>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>broadcast-based</primary></indexterm>
-<indexterm><primary>name resolution</primary></indexterm>
-The default Windows network client (or server) network configuration enables NetBIOS over TCP/IP
-and b-node configuration. The use of WINS makes most sense with h-node (hybrid mode) operation so that
-in the event of a WINS breakdown or non-availability, the client can use broadcast-based name resolution.
-</para>
-
-<para>
-<indexterm><primary>LMB</primary><see>Local Master Browser</see></indexterm>
-<indexterm><primary>Local Master Browser</primary></indexterm>
-<indexterm><primary>SMB</primary></indexterm>
-<indexterm><primary>nmbd</primary></indexterm>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>cross-segment browsing</primary></indexterm>
-<indexterm><primary>network segment</primary></indexterm>
-In those networks where Samba is the only SMB server technology, wherever possible <filename>nmbd</filename>
-should be configured on one machine as the WINS server. This makes it easy to manage the browsing environment.
-If each network segment is configured with its own Samba WINS server, then the only way to get cross-segment
-browsing to work is by using the <smbconfoption name="remote announce"/> and the <smbconfoption name="remote
-browse sync"/> parameters to your &smb.conf; file.
-</para>
-
-<para>
-<indexterm><primary>WINS</primary></indexterm>
-If only one WINS server is used for an entire multisegment network, then
-the use of the <smbconfoption name="remote announce"/> and the
-<smbconfoption name="remote browse sync"/> parameters should not be necessary.
-</para>
-
-<para>
-<indexterm><primary>replication</primary><secondary>WINS</secondary></indexterm>
-As of Samba-3, WINS replication is being worked on. The bulk of the code has been committed, but it still
-needs maturation. This is not a supported feature of the Samba-3.0.20 release. Hopefully, this will become a
-supported feature of one of the Samba-3 release series. The delay is caused by the fact that this feature has
-not been of sufficient significance to inspire someone to pay a developer to complete it.
-</para>
-
-<para>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>MS-WINS replication</primary></indexterm>
-<indexterm><primary>redundancy</primary></indexterm>
-<indexterm><primary>DNS</primary></indexterm>
-<indexterm><primary>NetBIOSless SMB over TCP/IP</primary></indexterm>
-<indexterm><primary>local names</primary></indexterm>
-<indexterm><primary>subnets</primary></indexterm>
-<indexterm><primary>multiple WINS servers</primary></indexterm>
-Right now Samba WINS does not support MS-WINS replication. This means that when setting up Samba as a WINS
-server, there must only be one <filename>nmbd</filename> configured as a WINS server on the network. Some
-sites have used multiple Samba WINS servers for redundancy (one server per subnet) and then used
-<smbconfoption name="remote browse sync"/> and <smbconfoption name="remote announce"/> to effect browse list
-collation across all segments. Note that this means clients will only resolve local names and must be
-configured to use DNS to resolve names on other subnets in order to resolve the IP addresses of the servers
-they can see on other subnets. This setup is not recommended but is mentioned as a practical consideration
-(i.e., an <quote>if all else fails</quote> scenario). NetBIOS over TCP/IP is an ugly and difficult to manage
-protocol. Its replacement, NetBIOSless SMB over TCP/IP is not without its own manageability concerns. NetBIOS
-based networking is a life of compromise and trade-offs. WINS stores information that cannot be stored in
-DNS; consequently, DNS is a poor substitute for WINS given that when NetBIOS over TCP/IP is used, Windows
-clients are designed to use WINS.
-</para>
-
-<para>
-<indexterm><primary>broadcast messages</primary></indexterm>
-<indexterm><primary>repeated intervals</primary></indexterm>
-<indexterm><primary>across network segments</primary></indexterm>
-Lastly, take note that browse lists are a collection of unreliable broadcast
-messages that are repeated at intervals of not more than 15 minutes. This means
-that it will take time to establish a browse list, and it can take up to 45
-minutes to stabilize, particularly across network segments.
-</para>
-
-<para>
-<indexterm><primary>Windows 200x/XP</primary></indexterm>
-When an MS Windows 200x/XP system attempts to resolve a host name to an IP address, it follows a defined path:
-</para>
-
-<orderedlist>
-	<listitem><para>
-	Checks the <filename>hosts</filename> file. It is located in <filename>%SystemRoot%\System32\Drivers\etc</filename>.
-	</para></listitem>
-
-	<listitem><para>
-	Does a DNS lookup.
-	</para></listitem>
-
-	<listitem><para>
-	Checks the NetBIOS name cache.
-	</para></listitem>
-
-	<listitem><para>
-	Queries the WINS server.
-	</para></listitem>
-
-	<listitem><para>
-	Does a broadcast name lookup over UDP.
-	</para></listitem>
-
-	<listitem><para>
-	Looks up entries in LMHOSTS, located in <filename>%SystemRoot%\System32\Drivers\etc</filename>.
-	</para></listitem>
-</orderedlist>
-
-<para>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>NetBIOS over TCP/IP</primary></indexterm>
-<indexterm><primary>name lookups</primary></indexterm>
-<indexterm><primary>DNS</primary></indexterm>
-Given the nature of how the NetBIOS over TCP/IP protocol is implemented, only WINS is capable of resolving
-with any reliability name lookups for service-oriented names such as TEMPTATION<1C> &smbmdash; a NetBIOS
-name query that seeks to find network logon servers. DNS has no concept of service-oriented names such as
-this. In fact, the Microsoft ADS implementation specifically manages a whole range of extended
-service-oriented DNS entries. This type of facility is not implemented and is not supported for the NetBIOS
-over TCP/IP protocol namespace.
-</para>
-
-</sect2>
-
-<sect2>
-<title>TCP/IP without NetBIOS</title>
-
-<para>
-<indexterm><primary>NetBIOS</primary></indexterm>
-<indexterm><primary>NetBIOS-less</primary></indexterm>
-<indexterm><primary>DNS</primary></indexterm>
-All TCP/IP-enabled systems use various forms of hostname resolution. The primary
-methods for TCP/IP hostname resolution involve either a static file (<filename>/etc/hosts</filename>)
-or the Domain Name System (DNS). DNS is the technology that makes
-the Internet usable. DNS-based hostname resolution is supported by nearly all
-TCP/IP-enabled systems. Only a few embedded TCP/IP systems do not support DNS.
-</para>
-
-<para>
-<indexterm><primary>DNS</primary></indexterm>
-<indexterm><primary>DDNS</primary></indexterm>
-<indexterm><primary>ipconfig</primary></indexterm>
-<indexterm><primary>Dynamic DNS</primary><see>DDNS</see></indexterm>
-Windows 200x/XP can register its hostname with a Dynamic DNS server (DDNS). It is possible to force register with a
-dynamic DNS server in Windows 200x/XP using <command>ipconfig /registerdns</command>.
-</para>
-
-<para>
-<indexterm><primary>ADS</primary></indexterm>
-<indexterm><primary>DNS</primary></indexterm>
-<indexterm><primary>severely impaired</primary></indexterm>
-With Active Directory, a correctly functioning DNS server is absolutely essential. In the absence of a working
-DNS server that has been correctly configured, MS Windows clients and servers will be unable to locate each
-other, so network services consequently will be severely impaired.
-</para>
-
-<para>
-<indexterm><primary>raw SMB over TCP/IP</primary></indexterm>
-<indexterm><primary>No NetBIOS layer</primary></indexterm>
-<indexterm><primary>NetBIOS</primary></indexterm>
-<indexterm><primary>domain member server</primary></indexterm>
-<indexterm><primary>DNS</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-Use of raw SMB over TCP/IP (No NetBIOS layer) can be done only with Active Directory domains. Samba is not an
-Active Directory domain controller: ergo, it is not possible to run Samba as a domain controller and at the same
-time <emphasis>not</emphasis> use NetBIOS. Where Samba is used as an Active Directory domain member server
-(DMS) it is possible to configure Samba to not use NetBIOS over TCP/IP. A Samba DMS can integrate fully into
-an Active Directory domain, however, if NetBIOS over TCP/IP is disabled, it is necessary to manually create
-appropriate DNS entries for the Samba DMS because they will not be automatically generated either by Samba, or
-by the ADS environment.
-</para>
-
-</sect2>
-
-<sect2 id="adsdnstech">
-<title>DNS and Active Directory</title>
-
-<para>
-<indexterm><primary>DNS</primary><secondary>Active Directory</secondary></indexterm>
-<indexterm><primary>DDNS</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-<indexterm><primary>SRV records</primary></indexterm>
-<indexterm><primary>DNS</primary><secondary>SRV records</secondary></indexterm>
-Occasionally we hear from UNIX network administrators who want to use a UNIX-based DDNS server in place
-of the Microsoft DNS server. While this might be desirable to some, the MS Windows 200x DNS server is
-autoconfigured to work with Active Directory. It is possible to use BIND version 8 or 9, but it will almost
-certainly be necessary to create service records (SRV records) so MS Active Directory clients can resolve
-hostnames to locate essential network services.  The following are some of the default service records that
-Active Directory requires:
-</para>
-
-<para>
-<indexterm><primary>DDNS</primary></indexterm>
-<indexterm><primary>ADS</primary></indexterm>
-<indexterm><primary>BIND9</primary></indexterm>
-The use of DDNS is highly recommended with Active Directory, in which case the use of BIND9 is preferred for
-its ability to adequately support the SRV (service) records that are needed for Active Directory. Of course,
-when running ADS, it makes sense to use Microsoft's own DDNS server because of the natural affinity between ADS
-and MS DNS.
-</para>
-
-<variablelist>
-<varlistentry>
-	<term>_ldap._tcp.pdc._msdcs.<emphasis>Domain</emphasis></term>
-	<listitem>
-	<para>
-	This provides the address of the Windows NT PDC for the domain.
-	</para>
-	</listitem>
-</varlistentry>
-<varlistentry>
-	<term>_ldap._tcp.pdc._msdcs.<emphasis>DomainTree</emphasis></term>
-	<listitem>
-        <para>
-	Resolves the addresses of global catalog servers in the domain.
-        </para>
-	</listitem>
-</varlistentry>
-<varlistentry>
-        <term>_ldap._tcp.<emphasis>site</emphasis>.sites.writable._msdcs.<emphasis>Domain</emphasis></term>
-	<listitem>
-        <para>
-	Provides list of domain controllers based on sites.
-        </para>
-	</listitem>
-</varlistentry>
-<varlistentry>
-        <term>_ldap._tcp.writable._msdcs.<emphasis>Domain</emphasis></term>
-	<listitem>
-        <para>
-	Enumerates list of domain controllers that have the writable copies of the Active Directory data store.
-        </para>
-	</listitem>
-</varlistentry>
-<varlistentry>
-	<term>_ldap._tcp.<emphasis>GUID</emphasis>.domains._msdcs.<emphasis>DomainTree</emphasis></term>
-	<listitem>
-	<para>
-	Entry used by MS Windows clients to locate machines using the global unique identifier.
-	</para>
-	</listitem>
-</varlistentry>
-<varlistentry>
-	<term>_ldap._tcp.<emphasis>Site</emphasis>.gc._msdcs.<emphasis>DomainTree</emphasis></term>
-	<listitem>
-	<para>
-	Used by Microsoft Windows clients to locate the site configuration-dependent global catalog server.
-	</para>
-	</listitem>
-</varlistentry>
-</variablelist>
-
-	<para>
-	Specific entries used by Microsoft clients to locate essential services for an example domain
-	called <constant>quenya.org</constant> include:
-	</para>
-
-	<itemizedlist>
-		<listitem><para>
-		_kerberos._udp.quenya.org &smbmdash; Used to contact the KDC server via UDP.
-		This entry must list port 88 for each KDC.
-		</para></listitem>
-
-		<listitem><para>
-		_kpasswd._udp.quenya.org &smbmdash; Used to locate the <constant>kpasswd</constant> server
-		when a user password change must be processed. This record must list port 464 on the
-		master KDC.
-		</para></listitem>
-
-		<listitem><para>
-		_kerberos._tcp.quenya.org &smbmdash; Used to locate the KDC server via TCP.
-		This entry must list port 88 for each KDC.
-		</para></listitem>
-
-		<listitem><para>
-		_ldap._tcp.quenya.org &smbmdash; Used to locate the LDAP service on the PDC.
-		This record must list port 389 for the PDC.
-		</para></listitem>
-
-		<listitem><para>
-		_kpasswd._tcp.quenya.org &smbmdash; Used to locate the <constant>kpasswd</constant> server
-		to permit user password changes to be processed. This must list port 464.
-		</para></listitem>
-
-		<listitem><para>
-		_gc._tcp.quenya.org &smbmdash; Used to locate the global catalog server  for the
-		top of the domain. This must list port 3268.
-		</para></listitem>
-	</itemizedlist>
-
-	<para>
-	The following records are also used by the Windows domain member client to locate vital
-	services on the Windows ADS domain controllers.
-	</para>
-
-	<itemizedlist>
-		<listitem><para>
-		_ldap._tcp.pdc._msdcs.quenya.org
-		</para></listitem>
-
-		<listitem><para>
-		_ldap.gc._msdcs.quenya.org
-		</para></listitem>
-
-		<listitem><para>
-		_ldap.default-first-site-name._sites.gc._msdcs.quenya.org
-		</para></listitem>
-
-		<listitem><para>
-		_ldap.{SecID}.domains._msdcs.quenya.org
-		</para></listitem>
-
-		<listitem><para>
-		_ldap._tcp.dc._msdcs.quenya.org
-		</para></listitem>
-
-		<listitem><para>
-		_kerberos._tcp.dc._msdcs.quenya.org
-		</para></listitem>
-
-		<listitem><para>
-		_ldap.default-first-site-name._sites.dc._msdcs.quenya.org
-		</para></listitem>
-
-		<listitem><para>
-		_kerberos.default-first-site-name._sites.dc._msdcs.queyna.org
-		</para></listitem>
-
-		<listitem><para>
-		SecID._msdcs.quenya.org
-		</para></listitem>
-	</itemizedlist>
-
-	<para>
-	Presence of the correct DNS entries can be validated by executing:
-<screen>
-&rootprompt; dig @frodo -t any _ldap._tcp.dc._msdcs.quenya.org
-
-; <lt;>> DiG 9.2.2 <lt;>> @frodo -t any _ldap._tcp.dc._msdcs.quenya.org
-;; global options:  printcmd
-;; Got answer:
-;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3072
-;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2
-
-
-;; QUESTION SECTION:
-;_ldap._tcp.dc._msdcs.quenya.org. IN        ANY
-
-
-;; ANSWER SECTION:
-_ldap._tcp.dc._msdcs.quenya.org. 600 IN SRV 0 100 389 frodo.quenya.org.
-_ldap._tcp.dc._msdcs.quenya.org. 600 IN SRV 0 100 389 noldor.quenya.org.
-
-
-;; ADDITIONAL SECTION:
-frodo.quenya.org.  3600  IN      A       10.1.1.16
-noldor.quenya.org. 1200  IN      A       10.1.1.17
-
-
-;; Query time: 0 msec
-;; SERVER: frodo#53(10.1.1.16)
-;; WHEN: Wed Oct  7 14:39:31 2004
-;; MSG SIZE  rcvd: 171
-</screen>
-	</para>
-
-</sect2>
-
-</sect1>
-
-<sect1>
-<title>How Browsing Functions</title>
-
-<para>
-<indexterm><primary>register NetBIOS names</primary></indexterm>
-<indexterm><primary>LMHOSTS</primary></indexterm>
-<indexterm><primary>DNS</primary></indexterm>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>WINS server address</primary></indexterm>
-MS Windows machines register their NetBIOS names (i.e., the machine name for each service type in operation)
-on startup.  The exact method by which this name registration takes place is determined by whether or not the
-MS Windows client/server has been given a WINS server address, whether or not LMHOSTS lookup is enabled,
-whether or not DNS for NetBIOS name resolution is enabled, and so on.
-</para>
-
-<para>
-<indexterm><primary>WINS server</primary></indexterm>
-<indexterm><primary>name lookups</primary></indexterm>
-<indexterm><primary>UDP</primary></indexterm>
-In the case where there is no WINS server, all name registrations as well as name lookups are done by UDP
-broadcast. This isolates name resolution to the local subnet, unless LMHOSTS is used to list all names and IP
-addresses. In such situations, Samba provides a means by which the Samba server name may be forcibly injected
-into the browse list of a remote MS Windows network (using the <smbconfoption name="remote announce"/>
-parameter).
-</para>
-
-<para>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>UDP unicast</primary></indexterm>
-<indexterm><primary>name resolution across routed networks</primary></indexterm>
-Where a WINS server is used, the MS Windows client will use UDP unicast to register with the WINS server. Such
-packets can be routed, and thus WINS allows name resolution to function across routed networks.
-</para>
-
-<para>
-<indexterm><primary>LMB</primary></indexterm>
-<indexterm><primary>local master browser</primary><see>LMB</see></indexterm>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>LMHOSTS</primary></indexterm>
-<indexterm><primary>DMB</primary></indexterm>
-<indexterm><primary>browse list</primary></indexterm>
-<indexterm><primary>election</primary></indexterm>
-<indexterm><primary>election criteria</primary></indexterm>
-During the startup process, an election takes place to create a local master browser (LMB) if one does not
-already exist. On each NetBIOS network one machine will be elected to function as the domain master browser
-(DMB). This domain browsing has nothing to do with MS security Domain Control.  Instead, the DMB serves the
-role of contacting each LMB (found by asking WINS or from LMHOSTS) and exchanging browse list contents. This
-way every master browser will eventually obtain a complete list of all machines that are on the network. Every
-11 to 15 minutes an election is held to determine which machine will be the master browser. By the nature of
-the election criteria used, the machine with the highest uptime, or the most senior protocol version or other
-criteria, will win the election as DMB.
-</para>
-
-<para>
-<indexterm><primary>WINS server</primary></indexterm>
-<indexterm><primary>DMB</primary></indexterm>
-<indexterm><primary>NetBIOS name type</primary></indexterm>
-<indexterm><primary>n security context</primary></indexterm>
-<indexterm><primary>network segment</primary></indexterm>
-<indexterm><primary>authoritive</primary></indexterm>
-<indexterm><primary>browse list maintainers</primary></indexterm>
-<indexterm><primary>LMB</primary></indexterm>
-Where a WINS server is used, the DMB registers its IP address with the WINS server using the name of the
-domain and the NetBIOS name type 1B (e.g., DOMAIN<1B>). All LMBs register their IP addresses with the WINS
-server, also with the name of the domain and the NetBIOS name type of 1D. The 1B name is unique to one
-server within the domain security context, and only one 1D name is registered for each network segment.
-Machines that have registered the 1D name will be authoritive browse list maintainers for the network segment
-they are on. The DMB is responsible for synchronizing the browse lists it obtains from the LMBs.
-</para>
-
-<para>
-<indexterm><primary>name resolution</primary></indexterm>
-Clients wishing to browse the network make use of this list but also depend on the availability of correct
-name resolution to the respective IP address or addresses.
-</para>
-
-<para>
-<indexterm><primary>browsing intrinsics</primary></indexterm>
-Any configuration that breaks name resolution and/or browsing intrinsics will annoy users because they will
-have to put up with protracted inability to use the network services.
-</para>
-
-<para>
-<indexterm><primary>forced synchronization</primary></indexterm>
-<indexterm><primary>LMB</primary></indexterm>
-<indexterm><primary>bridges networks</primary></indexterm>
-<indexterm><primary>cross-subnet browsing</primary></indexterm>
-<indexterm><primary>DNS</primary></indexterm>
-<indexterm><primary>/etc/hosts</primary></indexterm>
-Samba supports a feature that allows forced synchronization of browse lists across routed networks using the
-<smbconfoption name="remote browse sync"/> parameter in the &smb.conf; file. This causes Samba to contact the
-LMB on a remote network and to request browse list synchronization. This effectively bridges two networks that
-are separated by routers. The two remote networks may use either broadcast-based name resolution or WINS-based
-name resolution, but it should be noted that the <smbconfoption name="remote browse sync"/> parameter provides
-browse list synchronization &smbmdash; and that is distinct from name-to-address resolution. In other words,
-for cross-subnet browsing to function correctly, it is essential that a name-to-address resolution mechanism
-be provided. This mechanism could be via DNS, <filename>/etc/hosts</filename>, and so on.
-</para>
-
-<sect2 id="DMB">
-<title>Configuring Workgroup Browsing</title>
-
-<para>
-<indexterm><primary>cross-subnet browsing</primary></indexterm>
-<indexterm><primary>DMB</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>LMB</primary></indexterm>
-<indexterm><primary>isolated workgroup</primary></indexterm>
-<indexterm><primary>workgroup</primary></indexterm>
-To configure cross-subnet browsing on a network containing machines in a workgroup, not an NT domain, you need
-to set up one Samba server to be the DMB (note that this is not the same as a Primary Domain Controller,
-although in an NT domain the same machine plays both roles). The role of a DMB is to collate the browse lists
-from LMB on all the subnets that have a machine participating in the workgroup. Without one machine configured
-as a DMB, each subnet would be an isolated workgroup unable to see any machines on another subnet. It is the
-presence of a DMB that makes cross-subnet browsing possible for a workgroup.
-</para>
-
-<para>
-<indexterm><primary>DMB</primary></indexterm>
-In a workgroup environment the DMB must be a Samba server, and there must only be one DMB per workgroup name.
-To set up a Samba server as a DMB, set the following option in the <smbconfsection name="[global]"/> section
-of the &smb.conf; file:
-</para>
-
-<para>
-<smbconfblock>
-<smbconfoption name="domain master">yes</smbconfoption>
-</smbconfblock>
-</para>
-
-<para>
-<indexterm><primary>DMB</primary></indexterm>
-<indexterm><primary>LMB</primary></indexterm>
-The DMB should preferably be the LMB for its own subnet. In order to achieve this, set the following options
-in the <smbconfsection name="[global]"/> section of the &smb.conf; file as shown in <link
-linkend="dmbexample">Domain Master Browser smb.conf</link>
-</para>
-
-<example id="dmbexample">
-<title>Domain Master Browser smb.conf</title>
-<smbconfblock>
-<smbconfsection name="[global]"/>
-<smbconfoption name="domain master">yes</smbconfoption>
-<smbconfoption name="local master">yes</smbconfoption>
-<smbconfoption name="preferred master">yes</smbconfoption>
-<smbconfoption name="os level">65</smbconfoption>
-</smbconfblock>
-</example>
-
-<para>
-<indexterm><primary>DMB</primary></indexterm>
-<indexterm><primary>WINS server</primary></indexterm>
-The DMB may be the same machine as the WINS server, if necessary.
-</para>
-
-<para>
-<indexterm><primary>subnets</primary></indexterm>
-<indexterm><primary>LMB</primary></indexterm>
-<indexterm><primary>rebooted</primary></indexterm>
-Next, you should ensure that each of the subnets contains a machine that can act as an LMB for the workgroup.
-Any MS Windows NT/200x/XP machine should be able to do this, as will Windows 9x/Me machines (although these
-tend to get rebooted more often, so it is not such a good idea to use them). To make a Samba server an LMB,
-set the following options in the <smbconfsection name="[global]"/> section of the &smb.conf; file as shown in
-<link linkend="lmbexample">Local master browser smb.conf</link>
-</para>
-
-<example id="lmbexample">
-<title>Local master browser smb.conf</title>
-<smbconfblock>
-<smbconfsection name="[global]"/>
-<smbconfoption name="domain master">no</smbconfoption>
-<smbconfoption name="local master">yes</smbconfoption>
-<smbconfoption name="preferred master">yes</smbconfoption>
-<smbconfoption name="os level">65</smbconfoption>
-</smbconfblock>
-</example>
-
-<para>
-<indexterm><primary>LMB</primary></indexterm>
-Do not do this for more than one Samba server on each subnet, or they will war with
-each other over which is to be the LMB.
-</para>
-
-<para>
-<indexterm><primary>LMB</primary></indexterm>
-<indexterm><primary>browser election</primary></indexterm>
-The <smbconfoption name="local master"/> parameter allows Samba to act as a
-LMB. The <smbconfoption name="preferred master"/> causes <command>nmbd</command>
-to force a browser election on startup and the <smbconfoption name="os level"/>
-parameter sets Samba high enough so it should win any browser elections.
-</para>
-
-<para>
-<indexterm><primary>disable LMB</primary></indexterm>
-If you have an NT machine on the subnet that you wish to be the LMB, you can disable Samba from
-becoming an LMB by setting the following options in the <smbconfsection name="[global]"/> section of the
-&smb.conf; file as shown in <link linkend="nombexample">smb.conf for Not Being a Master Browser</link>.
-</para>
-
-<para>
-<example id="nombexample">
-<title>smb.conf for Not Being a Master Browser</title>
-<smbconfblock>
-<smbconfsection name="[global]"/>
-<smbconfoption name="domain master">no</smbconfoption>
-<smbconfoption name="local master">no</smbconfoption>
-<smbconfoption name="preferred master">no</smbconfoption>
-<smbconfoption name="os level">0</smbconfoption>
-</smbconfblock>
-</example>
-</para>
-
-</sect2>
-
-<sect2>
-<title>Domain Browsing Configuration</title>
-
-<para>
-<indexterm><primary>DMB</primary></indexterm>
-<indexterm><primary>PDC</primary></indexterm>
-<indexterm><primary>registers</primary></indexterm>
-<indexterm><primary>WINS</primary></indexterm>
-If you are adding Samba servers to a Windows NT domain, then you must not set up a Samba server as a DMB.  By
-default, a Windows NT PDC for a domain is also the DMB for that domain. Network browsing may break if a Samba
-server other than the PDC registers the DMB NetBIOS name (<replaceable>DOMAIN</replaceable><1B>) with
-WINS.
-</para>
-
-<para>
-<indexterm><primary>Local Master Browser</primary></indexterm>
-For subnets other than the one containing the Windows NT PDC, you may set up Samba servers as LMBs as
-described. To make a Samba server a Local Master Browser, set the following options in the <smbconfsection
-name="[global]"/> section of the &smb.conf; file as shown in <link linkend="remsmb">Local Master Browser
-smb.conf</link>
-</para>
-
-<example id="remsmb">
-<title>Local Master Browser smb.conf</title>
-<smbconfblock>
-<smbconfsection name="[global]"/>
-<smbconfoption name="domain master">no</smbconfoption>
-<smbconfoption name="local master">yes</smbconfoption>
-<smbconfoption name="preferred master">yes</smbconfoption>
-<smbconfoption name="os level">65</smbconfoption>
-</smbconfblock>
-</example>
-
-<para>
-<indexterm><primary>election</primary></indexterm>
-<indexterm><primary>LMB</primary></indexterm>
-If you wish to have a Samba server fight the election with machines on the same subnet, you may set the
-<smbconfoption name="os level"/> parameter to lower levels.  By doing this you can tune the order of machines
-that will become LMBs if they are running. For more details on this, refer to <link
-linkend="browse-force-master">Forcing Samba to Be the Master</link>.
-</para>
-
-<para>
-<indexterm><primary>domain members</primary></indexterm>
-<indexterm><primary>browser elections</primary></indexterm>
-<indexterm><primary>LMB</primary></indexterm>
-If you have Windows NT machines that are members of the domain on all subnets and you are sure they will
-always be running, you can disable Samba from taking part in browser elections and ever becoming an LMB by
-setting the following options in the <smbconfsection name="[global]"/> section of the &smb.conf; file as shown
-in <link linkend="xremmb">&smb.conf; for Not Being a master browser</link>
-</para>
-
-<para>
-<example id="xremmb">
-<title>&smb.conf; for Not Being a master browser</title>
-<smbconfblock>
-<smbconfsection name="[global]"/>
-<smbconfoption name="domain master">no</smbconfoption>
-<smbconfoption name="local master">no</smbconfoption>
-<smbconfoption name="preferred master">no</smbconfoption>
-<smbconfoption name="os level">0</smbconfoption>
-</smbconfblock>
-</example>
-</para>
-
-</sect2>
-
-<sect2 id="browse-force-master">
-<title>Forcing Samba to Be the Master</title>
-
-<para>
-<indexterm><primary>master browser</primary></indexterm>
-<indexterm><primary>election process</primary></indexterm>
-<indexterm><primary>broadcasts</primary></indexterm>
-<indexterm><primary>election packet</primary></indexterm>
-<indexterm><primary>bias</primary></indexterm>
-<indexterm><primary>election</primary></indexterm>
-<indexterm><primary>precedence</primary></indexterm>
-Who becomes the master browser is determined by an election process using broadcasts. Each election packet
-contains a number of parameters that determine what precedence (bias) a host should have in the election. By
-default Samba uses a low precedence and thus loses elections to just about every Windows network server or
-client.
-</para>
-
-<para>
-If you want Samba to win elections, set the <smbconfoption name="os level"/> global option in &smb.conf; to a
-higher number. It defaults to 20. Using 34 would make it win all elections over every other system (except
-other Samba systems).
-</para>
-
-<para>
-An <smbconfoption name="os level"/> of two would make it beat Windows for Workgroups and Windows 9x/Me, but
-not MS Windows NT/200x Server. An MS Windows NT/200x Server domain controller uses level 32. The maximum os
-level is 255.
-</para>
-
-<para>
-<indexterm><primary>force an election</primary></indexterm>
-<indexterm><primary>potential master browsers</primary></indexterm>
-<indexterm><primary>local subnet</primary></indexterm>
-<indexterm><primary>LMB</primary></indexterm>
-If you want Samba to force an election on startup, set the <smbconfoption name="preferred master"/> global
-option in &smb.conf; to <constant>yes</constant>.  Samba will then have a slight advantage over other
-potential master browsers that are not preferred master browsers.  Use this parameter with care, because if
-you have two hosts (whether they are Windows 9x/Me or NT/200x/XP or Samba) on the same local subnet both set
-with <smbconfoption name="preferred master"/> to <constant>yes</constant>, then periodically and continually
-they will force an election in order to become the LMB.
-</para>
-
-<para>
-<indexterm><primary>DMB</primary></indexterm>
-<indexterm><primary>LAN</primary></indexterm>
-<indexterm><primary>WAN</primary></indexterm>
-<indexterm><primary>LMB</primary></indexterm>
-<indexterm><primary>broadcast isolated subnet</primary></indexterm>
-If you want Samba to be a <emphasis>DMB</emphasis>, then it is recommended that you also set <smbconfoption
-name="preferred master"/> to <constant>yes</constant>, because Samba will not become a DMB for the whole of
-your LAN or WAN if it is not also a LMB on its own broadcast isolated subnet.
-</para>
-
-<para>
-<indexterm><primary>DMB</primary></indexterm>
-<indexterm><primary>automatic redundancy</primary></indexterm>
-<indexterm><primary>UDP</primary></indexterm>
-<indexterm><primary>network bandwidth</primary></indexterm>
-<indexterm><primary>browser elections</primary></indexterm>
-It is possible to configure two Samba servers to attempt to become the DMB for a domain. The first server that
-comes up will be the DMB. All other Samba servers will attempt to become the DMB every 5 minutes. They will
-find that another Samba server is already the DMB and will fail. This provides automatic redundancy should the
-current DMB fail. The network bandwidth overhead of browser elections is relatively small, requiring
-approximately four UDP packets per machine per election. The maximum size of a UDP packet is 576 bytes.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Making Samba the Domain Master</title>
-
-<para>
-<indexterm><primary>DMB</primary></indexterm>
-<indexterm><primary>collating</primary></indexterm>
-<indexterm><primary>browse lists</primary></indexterm>
-<indexterm><primary>browsing</primary></indexterm>
-The domain master browser is responsible for collating the browse lists of multiple subnets so browsing can
-occur between subnets. You can make Samba act as the domain master browser by setting <smbconfoption name="domain
-master">yes</smbconfoption> in &smb.conf;. By default it will not be a domain master browser.
-</para>
-
-<para>
-<indexterm><primary>workgroup</primary></indexterm>
-<indexterm><primary>network browsing problems</primary></indexterm>
-Do not set Samba to be the domain master for a workgroup that has the same name as an NT/200x domain.  If
-Samba is configured to be the domain master for a workgroup that is present on the same network as a Windows
-NT/200x domain that has the same name, network browsing problems will certainly be experienced.
-</para>
-
-<para>
-When Samba is the domain master and the master browser, it will listen for master announcements (made roughly
-every 12 minutes) from LMBs on other subnets and then contact them to synchronize browse lists.
-</para>
-
-<para>
-<indexterm><primary>win election</primary></indexterm>
-<indexterm><primary>force election</primary></indexterm>
-If you want Samba to be the domain master, you should also set the <smbconfoption name="os level"/> high
-enough to make sure it wins elections, and set <smbconfoption name="preferred master"/> to
-<constant>yes</constant>, to get Samba to force an election on startup.
-</para>
-
-<para>
-<indexterm><primary>WINS server</primary></indexterm>
-<indexterm><primary>resolve NetBIOS names</primary></indexterm>
-All servers (including Samba) and clients should be using a WINS server to resolve NetBIOS names. If your
-clients are only using broadcasting to resolve NetBIOS names, then two things will occur:
-</para>
-
-<orderedlist>
-<listitem>
-	<para>
-<indexterm><primary>LMB</primary></indexterm>
-<indexterm><primary>DMB</primary></indexterm>
-	LMBs will be unable to find a DMB because they will be looking only on the local subnet.
-	</para>
-</listitem>
-
-<listitem>
-	<para>
-<indexterm><primary>domain-wide browse list</primary></indexterm>
-	If a client happens to get hold of a domain-wide browse list and a user attempts to access a
-	host in that list, it will be unable to resolve the NetBIOS name of that host.
-	</para>
-</listitem>
-</orderedlist>
-
-<para>
-<indexterm><primary>WINS</primary></indexterm>
-If, however, both Samba and your clients are using a WINS server, then:
-</para>
-
-<orderedlist>
-<listitem>
-	<para>
-	LMBs will contact the WINS server and, as long as Samba has registered that it is a DMB with the WINS
-	server, the LMB will receive Samba's IP address as its DMB.
-	</para>
-</listitem>
-
-<listitem>
-	<para>
-	When a client receives a domain-wide browse list and a user attempts to access a host in that list, it will
-	contact the WINS server to resolve the NetBIOS name of that host. As long as that host has registered its
-	NetBIOS name with the same WINS server, the user will be able to see that host..
-	</para>
-</listitem>
-</orderedlist>
-
-</sect2>
-
-<sect2>
-<title>Note about Broadcast Addresses</title>
-
-<para>
-<indexterm><primary>zero-based broadcast</primary></indexterm>
-If your network uses a zero-based broadcast address (for example, if it ends in a 0), then you will strike
-problems. Windows for Workgroups does not seem to support a zeros broadcast, and you will probably find that
-browsing and name lookups will not work.
-</para>
-</sect2>
-
-<sect2>
-<title>Multiple Interfaces</title>
-
-<para>
-<indexterm><primary>multiple network interfaces</primary></indexterm>
-Samba supports machines with multiple network interfaces. If you have multiple interfaces, you will
-need to use the <smbconfoption name="interfaces"/> option in &smb.conf; to configure them. For example, the
-machine you are working with has 4 network interfaces; <literal>eth0</literal>, <literal>eth1</literal>,
-<literal>eth2</literal>, <literal>eth3</literal> and only interfaces <literal>eth1</literal> and
-<literal>eth4</literal> should be used by Samba. In this case, the following &smb.conf; file entries would
-permit that intent:
-<smbconfblock>
-<smbconfoption name="interfaces">eth1, eth4</smbconfoption>
-<smbconfoption name="bind interfaces only">Yes</smbconfoption>
-</smbconfblock>
-<indexterm><primary>port 135</primary></indexterm>
-<indexterm><primary>port 137</primary></indexterm>
-<indexterm><primary>port 138</primary></indexterm>
-<indexterm><primary>port 139</primary></indexterm>
-<indexterm><primary>port 445</primary></indexterm>
-<indexterm><primary>UDP</primary></indexterm>
-<indexterm><primary>TCP</primary></indexterm>
-The <smbconfoption name="bind interfaces only">Yes</smbconfoption> is necessary to exclude TCP/IP session
-services (ports 135, 139, and 445) over the interfaces that are not specified. Please be aware that
-<command>nmbd</command> will listen for incoming UDP port 137 packets on the unlisted interfaces, but it will
-not answer them. It will, however, send its broadcast packets over the unlisted interfaces. Total isolation of
-ethernet interface requires the use of a firewall to block ports 137 and 138 (UDP), and ports 135, 139, and
-445 (TCP) on all network interfaces that must not be able to access the Samba server.
-</para>
-
-</sect2>
-
-<sect2>
-<title>Use of the Remote Announce Parameter</title>
-<para>
-The <smbconfoption name="remote announce"/> parameter of &smb.conf; can be used to forcibly ensure that all
-the NetBIOS names on a network get announced to a remote network.  The syntax of the <smbconfoption
-name="remote announce"/> parameter is:
-<smbconfblock>
-<smbconfoption name="remote announce">192.168.12.23 [172.16.21.255] ...</smbconfoption>
-</smbconfblock>
-<emphasis>or</emphasis>
-<smbconfblock>
-<smbconfoption name="remote announce">192.168.12.23/MIDEARTH [172.16.21.255/ELVINDORF] ...</smbconfoption>
-</smbconfblock>
-
-where:
-<variablelist>
-	<varlistentry><term><replaceable>192.168.12.23</replaceable> and <replaceable>172.16.21.255</replaceable></term>
-		<listitem><para>
-<indexterm><primary>LMB</primary><see>Local Master Browser</see></indexterm>
-<indexterm><primary>Local Master Browser</primary></indexterm>
-		is either the LMB IP address or the broadcast address of the remote network.
-		That is, the LMB is at 192.168.1.23, or the address could be given as 172.16.21.255 where the netmask
-		is assumed to be 24 bits (255.255.255.0). When the remote announcement is made to the broadcast
-		address of the remote network, every host will receive our announcements. This is noisy and therefore
-		undesirable but may be necessary if we do not know the IP address of the remote LMB.
-		</para></listitem>
-	</varlistentry>
-
-	<varlistentry>
-		<term><replaceable>WORKGROUP</replaceable></term>
-		<listitem><para>is optional and can be either our own workgroup or that of the remote network. If you use the
-		workgroup name of the remote network, our NetBIOS machine names will end up looking like
-		they belong to that workgroup. This may cause name resolution problems and should be avoided.
-		</para></listitem>
-	</varlistentry>
-</variablelist>
-</para>
-
-</sect2>
-
-<sect2>
-<title>Use of the Remote Browse Sync Parameter</title>
-
-<para>
-<indexterm><primary>LMB</primary></indexterm>
-<indexterm><primary>synchronize</primary></indexterm>
-The <smbconfoption name="remote browse sync"/> parameter of &smb.conf; is used to announce to another LMB that
-it must synchronize its NetBIOS name list with our Samba LMB. This works only if the Samba server that has
-this option is simultaneously the LMB on its network segment.
-</para>
-
-<para>
-The syntax of the <smbconfoption name="remote browse sync"/> parameter is:
-
-<smbconfblock>
-<smbconfoption name="remote browse sync"><replaceable>192.168.10.40</replaceable></smbconfoption>
-</smbconfblock>
-<indexterm><primary>LMB</primary></indexterm>
-<indexterm><primary>remote segment</primary></indexterm>
-where <replaceable>192.168.10.40</replaceable> is either the IP address of the
-remote LMB or the network broadcast address of the remote segment.
-</para>
-
-</sect2>
-
-</sect1>
-
-<sect1>
-<title>WINS: The Windows Internetworking Name Server</title>
-
-<para>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>name_type</primary></indexterm>
-<indexterm><primary>LanManager-compatible</primary></indexterm>
-Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly
-recommended. Every NetBIOS machine registers its name together with a
-name_type value for each of several types of service it has available.
-It registers its name directly as a unique (the type 0x03) name.
-It also registers its name if it is running the LanManager-compatible
-server service (used to make shares and printers available to other users)
-by registering the server (the type 0x20) name.
-</para>
-
-<para>
-<indexterm><primary>NetBIOS name length</primary></indexterm>
-<indexterm><primary>name_type</primary></indexterm>
-All NetBIOS names are up to 15 characters in length. The name_type variable
-is added to the end of the name, thus creating a 16 character name. Any
-name that is shorter than 15 characters is padded with spaces to the 15th
-character. Thus, all NetBIOS names are 16 characters long (including the
-name_type information).
-</para>
-
-<para>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>registered</primary></indexterm>
-<indexterm><primary>NetLogon service</primary></indexterm>
-<indexterm><primary>lmhosts</primary></indexterm>
-WINS can store these 16-character names as they get registered. A client
-that wants to log onto the network can ask the WINS server for a list
-of all names that have registered the NetLogon service name_type. This saves
-broadcast traffic and greatly expedites logon processing. Since broadcast
-name resolution cannot be used across network segments, this type of
-information can only be provided via WINS or via a statically configured
-<filename>lmhosts</filename> file that must reside on all clients in the
-absence of WINS.
-</para>
-
-<para>
-<indexterm><primary>synchronization</primary></indexterm>
-<indexterm><primary>LMB</primary></indexterm>
-<indexterm><primary>DMB</primary></indexterm>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>browse list</primary></indexterm>
-WINS also forces browse list synchronization by all LMBs. LMBs must synchronize their browse list with the
-DMB, and WINS helps the LMB to identify its DMB. By definition this will work only within a single workgroup.
-Note that the DMB has nothing to do with what is referred to as an MS Windows NT domain. The latter is a
-reference to a security environment, while the DMB refers to the master controller for browse list information
-only.
-</para>
-
-<para>
-<indexterm><primary>WINS</primary></indexterm>
-<indexterm><primary>TCP/IP protocol stack</primary></indexterm>
-<indexterm><primary>WINS servers</primary></indexterm>
-<indexterm><primary>name-to-address</primary></indexterm>
-WINS will work correctly only if every client TCP/IP protocol stack
-is configured to use the WINS servers. Any client that is not
-configured to use the WINS server will continue to use only broadcast-based
-name registration, so WINS may never get to know about it. In any case,
-machines that have not registered with a WINS server will fail name-to-address
-lookup attempts by other clients and will therefore cause workstation access
-errors.
-</para>
-
-<para>
-To configure Samba as a WINS server, just add
-<smbconfo