Software: Apache/2.0.54 (Fedora). PHP/5.0.4 uname -a: Linux mina-info.me 2.6.17-1.2142_FC4smp #1 SMP Tue Jul 11 22:57:02 EDT 2006 i686 uid=48(apache) gid=48(apache) groups=48(apache) Safe-mode: OFF (not secure) /usr/bin/X11/./../../share/doc/samba-3.0.23a/htmldocs/Samba3-HOWTO/ drwxr-xr-x | |
| Viewing file: Select action/file-type: Table of Contents This chapter summarizes the current state of knowledge derived from personal practice and knowledge from Samba mailing list subscribers. Before reproduction of posted information, every effort has been made to validate the information given. Where additional information was uncovered through this validation, it is provided also. When MS Windows NT 3.5 was introduced, the hot new topic was the ability to implement Group Policies for users and groups. Then along came MS Windows NT4 and a few sites started to adopt this capability. How do we know that? By the number of “boo-boos” (or mistakes) administrators made and then requested help to resolve. By the time that MS Windows 2000 and Active Directory was released, administrators got the message: Group Policies are a good thing! They can help reduce administrative costs and actually make happier users. But adoption of the true potential of MS Windows 200x Active Directory and Group Policy Objects (GPOs) for users and machines were picked up on rather slowly. This was obvious from the Samba mailing list back in 2000 and 2001 when there were few postings regarding GPOs and how to replicate them in a Samba environment. Judging by the traffic volume since mid 2002, GPOs have become a standard part of the deployment in many sites. This chapter reviews techniques and methods that can be used to exploit opportunities for automation of control over user desktops and network client workstations. Under MS Windows platforms, particularly those following the release of MS Windows NT4 and MS Windows 95, it is possible to create a type of file that would be placed in the NETLOGON share of a domain controller. As the client logs onto the network, this file is read and the contents initiate changes to the registry of the client machine. This file allows changes to be made to those parts of the registry that affect users, groups of users, or machines.
For MS Windows 9x/Me, this file must be called
MS Windows NT4 server products include the System Policy Editor
under .
For MS Windows NT4 and later clients, this file must be called New with the introduction of MS Windows 2000 was the Microsoft Management Console or MMC. This tool is the new wave in the ever-changing landscape of Microsoft methods for management of network access and security. Every new Microsoft product or technology seems to make the old rules obsolete and introduces newer and more complex tools and methods. To Microsoft's credit, the MMC does appear to be a step forward, but improved functionality comes at a great price. Before embarking on the configuration of network and system policies, it is highly advisable to read the documentation available from Microsoft's Web site regarding Implementing Profiles and Policies in Windows NT 4.0. There are a large number of documents in addition to this old one that should also be read and understood. Try searching on the Microsoft Web site for “Group Policies”. What follows is a brief discussion with some helpful notes. The information provided here is incomplete you are warned.
You need the Windows 98 Group Policy Editor to set up Group Profiles under Windows 9x/Me.
It can be found on the original full-product Windows 98 installation CD-ROM under
Use the Group Policy Editor to create a policy file that specifies the location of
user profiles and/or Further details are covered in the Windows 98 Resource Kit documentation. If you do not take the correct steps, then every so often Windows 9x/Me will check the integrity of the registry and restore its settings from the backup copy of the registry it stores on each Windows 9x/Me machine. So, you will occasionally notice things changing back to the original settings.
Install the Group Policy handler for Windows 9x/Me to pick up Group Policies. Look on the
Windows 98 CD-ROM in
To create or edit
You need The Windows NT Policy Editor is also included with the Service Pack 3 (and later) for Windows NT 4.0. Extract the files using servicepackname /x that's Nt4sp6ai.exe /x for Service Pack 6a. The Policy Editor, poledit.exe, and the associated template files (*.adm) should be extracted as well. It is also possible to download the policy template files for Office97 and get a copy of the Policy Editor. Another possible location is with the Zero Administration Kit available for download from Microsoft.
With NT4-style registry-based policy changes, a large number of settings are not
automatically reversed as the user logs off. The settings that were in the
Windows NT4 system policies allow the setting of registry parameters specific to users, groups, and computers (client workstations) that are members of the NT4-style domain. Such policy files will work with MS Windows 200x/XP clients also. New to MS Windows 2000, Microsoft recently introduced a style of Group Policy that confers a superset of capabilities compared with NT4-style policies. Obviously, the tool used to create them is different, and the mechanism for implementing them is much improved.
The older NT4-style registry-based policies are known as Administrative Templates
in MS Windows 2000/XP GPOs. The latter includes the ability to set various security
configurations, enforce Internet Explorer browser settings, change and redirect aspects of the
users desktop (including the location of
Remember, NT4 policy files are named Windows 200x GPOs are feature-rich. They are not stored in the NETLOGON share, but rather part of a Windows 200x policy file is stored in the Active Directory itself and the other part is stored in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active Directory domain controllers. The part that is stored in the Active Directory itself is called the Group Policy Container (GPC), and the part that is stored in the replicated share called SYSVOL is known as the Group Policy Template (GPT). With NT4 clients, the policy file is read and executed only as each user logs onto the network. MS Windows 200x policies are much more complex GPOs are processed and applied at client machine startup (machine specific part), and when the user logs onto the network, the user-specific part is applied. In MS Windows 200x-style policy management, each machine and/or user may be subject to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows the administrator to also set filters over the policy settings. No such equivalent capability exists with NT4-style policy files. Instead of using the tool called the System Policy Editor, commonly called Poledit (from the executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console (MMC) snap-in as follows:
All policy configuration options are controlled through the use of policy administrative templates. These files have an .adm extension, both in NT4 as well as in Windows 200x/XP. Beware, however, the .adm files are not interchangeable across NT4 and Windows 200x. The latter introduces many new features as well as extended definition capabilities. It is well beyond the scope of this documentation to explain how to program .adm files; for that, refer to the Microsoft Windows Resource Kit for your particular version of MS Windows. Over the past year, there has been a bit of talk regarding the creation of customized templates for the Windows Sytem Policy Editor. A recent announcement on the Samba mailing list is worthy of mention. Mike Petersen has announced the availability of a template file he has created. This custom System Policy Editor Template will allow you to successfully control Microsoft Windows workstations from an SMB server, such as Samba. This template has been tested on a few networks, although if you find any problems with any of these policies, or have any ideas for additional policies, let me know at mailto:mgpeter@pcc-services.com. This Template includes many policies for Windows XP to allow it to behave better in a professional environment. For further information please see the Petersen Computer Consulting web site. There is a download link for the template file. Policies can define a specific user's settings or the settings for a group of users. The resulting policy file contains the registry settings for all users, groups, and computers that will be using the policy file. Separate policy files for each user, group, or computer are not necessary.
If you create a policy that will be automatically downloaded from validating domain controllers,
you should name the file
When a Windows NT4/200x/XP machine logs onto the network, the client looks in the NETLOGON share on
the authenticating domain controller for the presence of the
MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally
acquire policy settings through GPOs that are defined and stored in Active Directory
itself. The key benefit of using AD GPOs is that they impose no registry spoiling effect.
This has considerable advantage compared with the use of In addition to user access controls that may be imposed or applied via system and/or group policies in a manner that works in conjunction with user profiles, the user management environment under MS Windows NT4/200x/XP allows per-domain as well as per-user account restrictions to be applied. Common restrictions that are frequently used include:
Samba-3.0.20 does not yet implement all account controls that are common to MS Windows NT4/200x/XP.
While it is possible to set many controls using the Domain User Manager for MS Windows NT4, only password
expiry is functional today. Most of the remaining controls at this time have only stub routines
that may eventually be completed to provide actual control. Do not be misled by the fact that a
parameter can be set using the NT4 Domain User Manager or in the Anyone who wishes to create or manage Group Policies will need to be familiar with a number of tools. The following sections describe a few key tools that will help you to create a low-maintenance user environment.
A new tool called editreg is under development. This tool can be used
to edit registry files (called The tools that may be used to configure these types of controls from the MS Windows environment are the NT4 User Manager for Domains, the NT4 System and Group Policy Editor, and the Registry Editor (regedt32.exe). Under MS Windows 200x/XP, this is done using the MMC with appropriate “snap-ins,” the registry editor, and potentially also the NT4 System and Group Policy Editor. The following attempts to document the order of processing the system and user policies following a system reboot and as part of the user logon:
Policy-related problems can be quite difficult to diagnose and even more difficult to rectify. The following collection demonstrates only basic issues.
“We have created the
Policy files are not portable between Windows 9x/Me and MS Windows NT4/200x/XP-based platforms. You need to
use the NT4 Group Policy Editor to create a file called |
:: Command execute :: | |
--[ c99shell v. 1.0 pre-release build #16 powered by Captain Crunch Security Team | http://ccteam.ru | Generation time: 0.0033 ]-- |