- Timestamp:
- Jun 16, 2009, 5:52:30 PM (16 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.2.x/docs/htmldocs/Samba3-HOWTO/domain-member.html
r231 r272 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 6. Domain Membership</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="type.html" title="Part II. Server Configuration Basics"><link rel="prev" href="samba-bdc.html" title="Chapter 5. Backup Domain Control"><link rel="next" href="StandAloneServer.html" title="Chapter 7. Standalone Servers"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 6. Domain Membership</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="samba-bdc.html">Prev</a> </td><th width="60%" align="center">Part II. Server Configuration Basics</th><td width="20%" align="right"> <a accesskey="n" href="StandAloneServer.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="domain-member"></a>Chapter 6. Domain Membership</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jeremy</span> <span class="orgname">Samba Team</span> <span class="surname">Allison</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="orgname">Samba Team</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Andrew</span> <span class="orgname">Samba Team</span> <span class="surname">Tridgell</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="orgname">The Samba Team</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Guenther</span> <span class="orgname">SuSE</span> <span class="surname">Deschner</span></h3><span class="contrib">LDAP updates</span> <div class="affiliation"><span class="orgname">SuSE<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="domain-member.html#id25691 04">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="domain-member.html#machine-trust-accounts">MS Windows Workstation/Server Machine Trust Accounts</a></span></dt><dd><dl><dt><span class="sect2"><a href="domain-member.html#id2569791">Manual Creation of Machine Trust Accounts</a></span></dt><dt><span class="sect2"><a href="domain-member.html#id2570227">Managing Domain Machine Accounts using NT4 Server Manager</a></span></dt><dt><span class="sect2"><a href="domain-member.html#id2570508">On-the-Fly Creation of Machine Trust Accounts</a></span></dt><dt><span class="sect2"><a href="domain-member.html#id2570614">Making an MS Windows Workstation or Server a Domain Member</a></span></dt></dl></dd><dt><span class="sect1"><a href="domain-member.html#domain-member-server">Domain Member Server</a></span></dt><dd><dl><dt><span class="sect2"><a href="domain-member.html#id2571079">Joining an NT4-type Domain with Samba-3</a></span></dt><dt><span class="sect2"><a href="domain-member.html#id2571815">Why Is This Better Than security = server?</a></span></dt></dl></dd><dt><span class="sect1"><a href="domain-member.html#ads-member">Samba ADS Domain Membership</a></span></dt><dd><dl><dt><span class="sect2"><a href="domain-member.html#id2572097">Configure smb.conf</a></span></dt><dt><span class="sect2"><a href="domain-member.html#id2572288">Configure /etc/krb5.conf</a></span></dt><dt><span class="sect2"><a href="domain-member.html#ads-create-machine-account">Create the Computer Account</a></span></dt><dt><span class="sect2"><a href="domain-member.html#ads-test-server">Testing Server Setup</a></span></dt><dt><span class="sect2"><a href="domain-member.html#ads-test-smbclient">Testing with smbclient</a></span></dt><dt><span class="sect2"><a href="domain-member.html#id2573382">Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="domain-member.html#id2573454">Sharing User ID Mappings between Samba Domain Members</a></span></dt><dt><span class="sect1"><a href="domain-member.html#id2573660">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="domain-member.html#id2573700">Cannot Add Machine Back to Domain</a></span></dt><dt><span class="sect2"><a href="domain-member.html#id2573776">Adding Machine to Domain Fails</a></span></dt><dt><span class="sect2"><a href="domain-member.html#id2574012">I Can't Join a Windows 2003 PDC</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id25690 52"></a>3 <a class="indexterm" name="id25690 58"></a>4 <a class="indexterm" name="id25690 66"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 6. Domain Membership</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="type.html" title="Part II. Server Configuration Basics"><link rel="prev" href="samba-bdc.html" title="Chapter 5. Backup Domain Control"><link rel="next" href="StandAloneServer.html" title="Chapter 7. Standalone Servers"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 6. Domain Membership</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="samba-bdc.html">Prev</a> </td><th width="60%" align="center">Part II. Server Configuration Basics</th><td width="20%" align="right"> <a accesskey="n" href="StandAloneServer.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="domain-member"></a>Chapter 6. Domain Membership</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jeremy</span> <span class="orgname">Samba Team</span> <span class="surname">Allison</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="orgname">Samba Team</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Andrew</span> <span class="orgname">Samba Team</span> <span class="surname">Tridgell</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="orgname">The Samba Team</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Guenther</span> <span class="orgname">SuSE</span> <span class="surname">Deschner</span></h3><span class="contrib">LDAP updates</span> <div class="affiliation"><span class="orgname">SuSE<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:[email protected]">[email protected]</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="domain-member.html#id25691">I Can't Join a Windows 2003 PDC</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id25690"></a> 3 <a class="indexterm" name="id25690"></a> 4 <a class="indexterm" name="id25690"></a> 5 5 Domain membership is a subject of vital concern. Samba must be able to 6 6 participate as a member server in a Microsoft domain security context, and … … 8 8 otherwise it would not be able to offer a viable option for many users. 9 9 </p><p> 10 <a class="indexterm" name="id25690 81"></a>11 <a class="indexterm" name="id2569 088"></a>10 <a class="indexterm" name="id25690"></a> 11 <a class="indexterm" name="id2569"></a> 12 12 This chapter covers background information pertaining to domain membership, 13 13 the Samba configuration for it, and MS Windows client procedures for joining a … … 17 17 misinformation, incorrect understanding, and lack of knowledge. Hopefully 18 18 this chapter will fill the voids. 19 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25691 04"></a>Features and Benefits</h2></div></div></div><p>20 <a class="indexterm" name="id25691 12"></a>21 <a class="indexterm" name="id25691 19"></a>22 <a class="indexterm" name="id25691 26"></a>19 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25691"></a>Features and Benefits</h2></div></div></div><p> 20 <a class="indexterm" name="id25691"></a> 21 <a class="indexterm" name="id25691"></a> 22 <a class="indexterm" name="id25691"></a> 23 23 MS Windows workstations and servers that want to participate in domain security need to 24 24 be made domain members. Participating in domain security is often called … … 28 28 server) or a Samba server a member of an MS Windows domain security context. 29 29 </p><p> 30 <a class="indexterm" name="id25691 58"></a>31 <a class="indexterm" name="id25691 64"></a>32 <a class="indexterm" name="id25691 71"></a>33 <a class="indexterm" name="id25691 78"></a>30 <a class="indexterm" name="id25691"></a> 31 <a class="indexterm" name="id25691"></a> 32 <a class="indexterm" name="id25691"></a> 33 <a class="indexterm" name="id25691"></a> 34 34 Samba-3 can join an MS Windows NT4-style domain as a native member server, an 35 35 MS Windows Active Directory domain as a native member server, or a Samba domain 36 36 control network. Domain membership has many advantages: 37 37 </p><div class="itemizedlist"><ul type="disc"><li><p> 38 <a class="indexterm" name="id2569 197"></a>38 <a class="indexterm" name="id2569"></a> 39 39 MS Windows workstation users get the benefit of SSO. 40 40 </p></li><li><p> 41 <a class="indexterm" name="id25692 09"></a>42 <a class="indexterm" name="id25692 16"></a>43 <a class="indexterm" name="id25692 23"></a>44 <a class="indexterm" name="id25692 30"></a>41 <a class="indexterm" name="id25692"></a> 42 <a class="indexterm" name="id25692"></a> 43 <a class="indexterm" name="id25692"></a> 44 <a class="indexterm" name="id25692"></a> 45 45 Domain user access rights and file ownership/access controls can be set 46 46 from the single Domain Security Account Manager (SAM) database … … 48 48 that are domain members). 49 49 </p></li><li><p> 50 <a class="indexterm" name="id25692 45"></a>51 <a class="indexterm" name="id25692 52"></a>50 <a class="indexterm" name="id25692"></a> 51 <a class="indexterm" name="id25692"></a> 52 52 Only <span class="application">MS Windows NT4/200x/XP Professional</span> 53 53 workstations that are domain members can use network logon facilities. 54 54 </p></li><li><p> 55 <a class="indexterm" name="id25692 71"></a>56 <a class="indexterm" name="id25692 78"></a>57 <a class="indexterm" name="id2569 285"></a>58 <a class="indexterm" name="id2569 292"></a>55 <a class="indexterm" name="id25692"></a> 56 <a class="indexterm" name="id25692"></a> 57 <a class="indexterm" name="id2569"></a> 58 <a class="indexterm" name="id2569"></a> 59 59 Domain member workstations can be better controlled through the use of 60 60 policy files (<code class="filename">NTConfig.POL</code>) and desktop profiles. 61 61 </p></li><li><p> 62 <a class="indexterm" name="id25693 11"></a>63 <a class="indexterm" name="id25693 18"></a>64 <a class="indexterm" name="id25693 25"></a>62 <a class="indexterm" name="id25693"></a> 63 <a class="indexterm" name="id25693"></a> 64 <a class="indexterm" name="id25693"></a> 65 65 Through the use of logon scripts, users can be given transparent access to network 66 66 applications that run off application servers. 67 67 </p></li><li><p> 68 <a class="indexterm" name="id25693 38"></a>69 <a class="indexterm" name="id25693 45"></a>70 <a class="indexterm" name="id25693 52"></a>71 <a class="indexterm" name="id25693 59"></a>68 <a class="indexterm" name="id25693"></a> 69 <a class="indexterm" name="id25693"></a> 70 <a class="indexterm" name="id25693"></a> 71 <a class="indexterm" name="id25693"></a> 72 72 Network administrators gain better application and user access management 73 73 abilities because there is no need to maintain user accounts on any network … … 76 76 LDAP directory, or via an Active Directory infrastructure). 77 77 </p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="machine-trust-accounts"></a>MS Windows Workstation/Server Machine Trust Accounts</h2></div></div></div><p> 78 <a class="indexterm" name="id2569 387"></a>79 <a class="indexterm" name="id2569 394"></a>80 <a class="indexterm" name="id25694 01"></a>81 <a class="indexterm" name="id25694 08"></a>78 <a class="indexterm" name="id2569"></a> 79 <a class="indexterm" name="id2569"></a> 80 <a class="indexterm" name="id25694"></a> 81 <a class="indexterm" name="id25694"></a> 82 82 A Machine Trust Account is an account that is used to authenticate a client machine (rather than a user) to 83 83 the domain controller server. In Windows terminology, this is known as a “<span class="quote">computer account.</span>” The … … 85 85 access to a domain member workstation. 86 86 </p><p> 87 <a class="indexterm" name="id25694 27"></a>88 <a class="indexterm" name="id25694 36"></a>89 <a class="indexterm" name="id25694 43"></a>90 <a class="indexterm" name="id25694 50"></a>91 <a class="indexterm" name="id25694 58"></a>87 <a class="indexterm" name="id25694"></a> 88 <a class="indexterm" name="id25694"></a> 89 <a class="indexterm" name="id25694"></a> 90 <a class="indexterm" name="id25694"></a> 91 <a class="indexterm" name="id25694"></a> 92 92 The password of a Machine Trust Account acts as the shared secret for secure communication with the domain 93 93 controller. This is a security feature to prevent an unauthorized machine with the same NetBIOS name from … … 97 97 possess a Machine Trust Account, and, thus, has no shared secret with the domain controller. 98 98 </p><p> 99 <a class="indexterm" name="id25694 78"></a>100 <a class="indexterm" name="id2569 485"></a>101 <a class="indexterm" name="id2569 492"></a>102 <a class="indexterm" name="id2569 498"></a>99 <a class="indexterm" name="id25694"></a> 100 <a class="indexterm" name="id2569"></a> 101 <a class="indexterm" name="id2569"></a> 102 <a class="indexterm" name="id2569"></a> 103 103 A Windows NT4 PDC stores each Machine Trust Account in the Windows Registry. 104 104 The introduction of MS Windows 2000 saw the introduction of Active Directory, … … 108 108 109 109 </p><div class="itemizedlist"><ul type="disc"><li><p> 110 <a class="indexterm" name="id25695 16"></a>111 <a class="indexterm" name="id25695 23"></a>112 <a class="indexterm" name="id25695 30"></a>110 <a class="indexterm" name="id25695"></a> 111 <a class="indexterm" name="id25695"></a> 112 <a class="indexterm" name="id25695"></a> 113 113 A domain security account (stored in the <a class="link" href="smb.conf.5.html#PASSDBBACKEND" target="_top">passdb backend</a>) that has been configured in 114 114 the <code class="filename">smb.conf</code> file. The precise nature of the account information that is stored depends on the type of 115 115 backend database that has been chosen. 116 116 </p><p> 117 <a class="indexterm" name="id25695 61"></a>118 <a class="indexterm" name="id25695 68"></a>119 <a class="indexterm" name="id25695 75"></a>120 <a class="indexterm" name="id2569 582"></a>121 <a class="indexterm" name="id2569 588"></a>122 <a class="indexterm" name="id2569 596"></a>117 <a class="indexterm" name="id25695"></a> 118 <a class="indexterm" name="id25695"></a> 119 <a class="indexterm" name="id25695"></a> 120 <a class="indexterm" name="id2569"></a> 121 <a class="indexterm" name="id2569"></a> 122 <a class="indexterm" name="id2569"></a> 123 123 The older format of this data is the <code class="filename">smbpasswd</code> database 124 124 that contains the UNIX login ID, the UNIX user identifier (UID), and the … … 126 126 this file that we do not need to concern ourselves with here. 127 127 </p><p> 128 <a class="indexterm" name="id25696 18"></a>129 <a class="indexterm" name="id25696 24"></a>130 <a class="indexterm" name="id25696 31"></a>131 <a class="indexterm" name="id25696 38"></a>128 <a class="indexterm" name="id25696"></a> 129 <a class="indexterm" name="id25696"></a> 130 <a class="indexterm" name="id25696"></a> 131 <a class="indexterm" name="id25696"></a> 132 132 The two newer database types are called ldapsam and tdbsam. Both store considerably more data than the older 133 133 <code class="filename">smbpasswd</code> file did. The extra information enables new user account controls to be 134 134 implemented. 135 135 </p></li><li><p> 136 <a class="indexterm" name="id25696 58"></a>137 <a class="indexterm" name="id25696 65"></a>136 <a class="indexterm" name="id25696"></a> 137 <a class="indexterm" name="id25696"></a> 138 138 A corresponding UNIX account, typically stored in <code class="filename">/etc/passwd</code>. Work is in progress to 139 139 allow a simplified mode of operation that does not require UNIX user accounts, but this has not been a feature … … 141 141 </p></li></ul></div><p> 142 142 </p><p> 143 <a class="indexterm" name="id2569 691"></a>143 <a class="indexterm" name="id2569"></a> 144 144 There are three ways to create Machine Trust Accounts: 145 145 </p><div class="itemizedlist"><ul type="disc"><li><p> 146 <a class="indexterm" name="id25697 08"></a>146 <a class="indexterm" name="id25697"></a> 147 147 Manual creation from the UNIX/Linux command line. Here, both the Samba and 148 148 corresponding UNIX account are created by hand. 149 149 </p></li><li><p> 150 <a class="indexterm" name="id25697 21"></a>151 <a class="indexterm" name="id25697 28"></a>150 <a class="indexterm" name="id25697"></a> 151 <a class="indexterm" name="id25697"></a> 152 152 Using the MS Windows NT4 Server Manager, either from an NT4 domain member 153 153 server or using the Nexus toolkit available from the Microsoft Web site. … … 155 155 logged on as the administrator account. 156 156 </p></li><li><p> 157 <a class="indexterm" name="id25697 44"></a>158 <a class="indexterm" name="id25697 51"></a>157 <a class="indexterm" name="id25697"></a> 158 <a class="indexterm" name="id25697"></a> 159 159 “<span class="quote">On-the-fly</span>” creation. The Samba Machine Trust Account is automatically 160 160 created by Samba at the time the client is joined to the domain. … … 162 162 account may be created automatically or manually. 163 163 </p></li></ul></div><p> 164 <a class="indexterm" name="id25697 70"></a>165 <a class="indexterm" name="id25697 77"></a>164 <a class="indexterm" name="id25697"></a> 165 <a class="indexterm" name="id25697"></a> 166 166 Neither MS Windows NT4/200x/XP Professional, nor Samba, provide any method for enforcing the method of machine 167 167 trust account creation. This is a matter of the administrator's choice. 168 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2569 791"></a>Manual Creation of Machine Trust Accounts</h3></div></div></div><p>169 <a class="indexterm" name="id2569 799"></a>170 <a class="indexterm" name="id25698 06"></a>171 <a class="indexterm" name="id25698 11"></a>172 <a class="indexterm" name="id25698 18"></a>168 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2569"></a>Manual Creation of Machine Trust Accounts</h3></div></div></div><p> 169 <a class="indexterm" name="id2569"></a> 170 <a class="indexterm" name="id25698"></a> 171 <a class="indexterm" name="id25698"></a> 172 <a class="indexterm" name="id25698"></a> 173 173 The first step in manually creating a Machine Trust Account is to manually 174 174 create the corresponding UNIX account in <code class="filename">/etc/passwd</code>. … … 184 184 </pre><p> 185 185 </p><p> 186 <a class="indexterm" name="id2569 887"></a>187 <a class="indexterm" name="id2569 894"></a>188 <a class="indexterm" name="id25699 00"></a>186 <a class="indexterm" name="id2569"></a> 187 <a class="indexterm" name="id2569"></a> 188 <a class="indexterm" name="id25699"></a> 189 189 In the example above there is an existing system group “<span class="quote">machines</span>” which is used 190 190 as the primary group for all machine accounts. In the following examples the “<span class="quote">machines</span>” group 191 191 numeric GID is 100. 192 192 </p><p> 193 <a class="indexterm" name="id25699 20"></a>194 <a class="indexterm" name="id25699 27"></a>193 <a class="indexterm" name="id25699"></a> 194 <a class="indexterm" name="id25699"></a> 195 195 On *BSD systems, this can be done using the <code class="literal">chpass</code> utility: 196 196 </p><pre class="screen"> … … 199 199 </pre><p> 200 200 </p><p> 201 <a class="indexterm" name="id25699 68"></a>202 <a class="indexterm" name="id25699 75"></a>203 <a class="indexterm" name="id25 69982"></a>204 <a class="indexterm" name="id25 69988"></a>201 <a class="indexterm" name="id25699"></a> 202 <a class="indexterm" name="id25699"></a> 203 <a class="indexterm" name="id25"></a> 204 <a class="indexterm" name="id25"></a> 205 205 The <code class="filename">/etc/passwd</code> entry will list the machine name 206 206 with a “<span class="quote">$</span>” appended, and will not have a password, will have a null shell and no … … 211 211 </pre><p> 212 212 </p><p> 213 <a class="indexterm" name="id25700 31"></a>214 <a class="indexterm" name="id25700 38"></a>215 <a class="indexterm" name="id25700 45"></a>213 <a class="indexterm" name="id25700"></a> 214 <a class="indexterm" name="id25700"></a> 215 <a class="indexterm" name="id25700"></a> 216 216 in which <em class="replaceable"><code>machine_nickname</code></em> can be any 217 217 descriptive name for the client, such as BasementComputer. … … 221 221 this as a Machine Trust Account. 222 222 </p><p> 223 <a class="indexterm" name="id25700 70"></a>224 <a class="indexterm" name="id25700 77"></a>225 <a class="indexterm" name="id2570 084"></a>223 <a class="indexterm" name="id25700"></a> 224 <a class="indexterm" name="id25700"></a> 225 <a class="indexterm" name="id2570"></a> 226 226 Now that the corresponding UNIX account has been created, the next step is to create 227 227 the Samba account for the client containing the well-known initial … … 233 233 </pre><p> 234 234 </p><p> 235 <a class="indexterm" name="id25701 26"></a>236 <a class="indexterm" name="id25701 33"></a>237 <a class="indexterm" name="id25701 40"></a>238 <a class="indexterm" name="id25701 46"></a>235 <a class="indexterm" name="id25701"></a> 236 <a class="indexterm" name="id25701"></a> 237 <a class="indexterm" name="id25701"></a> 238 <a class="indexterm" name="id25701"></a> 239 239 where <em class="replaceable"><code>machine_name</code></em> is the machine's NetBIOS 240 240 name. The RID of the new machine account is generated from the UID of 241 241 the corresponding UNIX account. 242 242 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Join the client to the domain immediately</h3><p> 243 <a class="indexterm" name="id25701 68"></a>244 <a class="indexterm" name="id25701 75"></a>245 <a class="indexterm" name="id2570 182"></a>246 <a class="indexterm" name="id2570 189"></a>247 <a class="indexterm" name="id2570 196"></a>243 <a class="indexterm" name="id25701"></a> 244 <a class="indexterm" name="id25701"></a> 245 <a class="indexterm" name="id2570"></a> 246 <a class="indexterm" name="id2570"></a> 247 <a class="indexterm" name="id2570"></a> 248 248 Manually creating a Machine Trust Account using this method is the 249 249 equivalent of creating a Machine Trust Account on a Windows NT PDC using 250 <a class="indexterm" name="id25702 05"></a>250 <a class="indexterm" name="id25702"></a> 251 251 the <span class="application">Server Manager</span>. From the time at which the 252 252 account is created to the time the client joins the domain and … … 255 255 trusts members of the domain and will serve out a large degree of user 256 256 information to such clients. You have been warned! 257 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25702 27"></a>Managing Domain Machine Accounts using NT4 Server Manager</h3></div></div></div><p>258 <a class="indexterm" name="id25702 36"></a>259 <a class="indexterm" name="id25702 43"></a>260 <a class="indexterm" name="id25702 50"></a>257 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25702"></a>Managing Domain Machine Accounts using NT4 Server Manager</h3></div></div></div><p> 258 <a class="indexterm" name="id25702"></a> 259 <a class="indexterm" name="id25702"></a> 260 <a class="indexterm" name="id25702"></a> 261 261 A working <a class="link" href="smb.conf.5.html#ADDMACHINESCRIPT" target="_top">add machine script</a> is essential 262 262 for machine trust accounts to be automatically created. This applies no matter whether 263 263 you use automatic account creation or the NT4 Domain Server Manager. 264 264 </p><p> 265 <a class="indexterm" name="id25702 76"></a>266 <a class="indexterm" name="id2570 283"></a>267 <a class="indexterm" name="id2570 289"></a>268 <a class="indexterm" name="id2570 296"></a>265 <a class="indexterm" name="id25702"></a> 266 <a class="indexterm" name="id2570"></a> 267 <a class="indexterm" name="id2570"></a> 268 <a class="indexterm" name="id2570"></a> 269 269 If the machine from which you are trying to manage the domain is an 270 270 <span class="application">MS Windows NT4 workstation or MS Windows 200x/XP Professional</span>, … … 273 273 and <code class="literal">UsrMgr.exe</code> (both are domain management tools for MS Windows NT4 workstation). 274 274 </p><p> 275 <a class="indexterm" name="id25703 34"></a>276 <a class="indexterm" name="id25703 41"></a>275 <a class="indexterm" name="id25703"></a> 276 <a class="indexterm" name="id25703"></a> 277 277 If your workstation is a <span class="application">Microsoft Windows 9x/Me</span> family product, 278 278 you should download the <code class="literal">Nexus.exe</code> package from the Microsoft Web site. … … 284 284 <a class="ulink" href="http://support.microsoft.com/default.aspx?scid=kb;en-us;172540" target="_top">172540</a> 285 285 </p><p> 286 <a class="indexterm" name="id2570 385"></a>287 <a class="indexterm" name="id2570 392"></a>286 <a class="indexterm" name="id2570"></a> 287 <a class="indexterm" name="id2570"></a> 288 288 Launch the <code class="literal">srvmgr.exe</code> (Server Manager for Domains) and follow these steps: 289 </p><div class="procedure"><a name="id25704 07"></a><p class="title"><b>Procedure 6.1. Server Manager Account Machine Account Management</b></p><ol type="1"><li><p>289 </p><div class="procedure"><a name="id25704"></a><p class="title"><b>Procedure 6.1. Server Manager Account Machine Account Management</b></p><ol type="1"><li><p> 290 290 From the menu select <span class="guimenu">Computer</span>. 291 291 </p></li><li><p> … … 304 304 enter the machine name in the field provided, and click the 305 305 <span class="guibutton">Add</span> button. 306 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25705 08"></a>On-the-Fly Creation of Machine Trust Accounts</h3></div></div></div><p>307 <a class="indexterm" name="id25705 16"></a>306 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25705"></a>On-the-Fly Creation of Machine Trust Accounts</h3></div></div></div><p> 307 <a class="indexterm" name="id25705"></a> 308 308 The third (and recommended) way of creating Machine Trust Accounts is simply to allow the Samba server to 309 309 create them as needed when the client is joined to the domain. 310 310 </p><p> 311 <a class="indexterm" name="id25705 32"></a>312 <a class="indexterm" name="id25705 42"></a>313 <a class="indexterm" name="id25705 48"></a>311 <a class="indexterm" name="id25705"></a> 312 <a class="indexterm" name="id25705"></a> 313 <a class="indexterm" name="id25705"></a> 314 314 Since each Samba Machine Trust Account requires a corresponding UNIX account, a method 315 315 for automatically creating the UNIX account is usually supplied; this requires configuration of the … … 317 317 accounts may also be created manually. 318 318 </p><p> 319 <a class="indexterm" name="id25705 70"></a>320 <a class="indexterm" name="id25705 77"></a>319 <a class="indexterm" name="id25705"></a> 320 <a class="indexterm" name="id25705"></a> 321 321 Here is an example for a Red Hat Linux system: 322 </p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2570 599"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -d /var/lib/nobody -g 100 -s /bin/false -M %u</code></em></td></tr></table><p>323 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25706 14"></a>Making an MS Windows Workstation or Server a Domain Member</h3></div></div></div><p>322 </p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2570"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -d /var/lib/nobody -g 100 -s /bin/false -M %u</code></em></td></tr></table><p> 323 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25706"></a>Making an MS Windows Workstation or Server a Domain Member</h3></div></div></div><p> 324 324 The procedure for making an MS Windows workstation or server a member of the domain varies 325 325 with the version of Windows. 326 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25706 25"></a>Windows 200x/XP Professional Client</h4></div></div></div><p>327 <a class="indexterm" name="id25706 33"></a>328 <a class="indexterm" name="id25706 40"></a>329 <a class="indexterm" name="id25706 49"></a>330 <a class="indexterm" name="id25706 56"></a>326 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25706"></a>Windows 200x/XP Professional Client</h4></div></div></div><p> 327 <a class="indexterm" name="id25706"></a> 328 <a class="indexterm" name="id25706"></a> 329 <a class="indexterm" name="id25706"></a> 330 <a class="indexterm" name="id25706"></a> 331 331 When the user elects to make the client a domain member, Windows 200x prompts for 332 332 an account and password that has privileges to create machine accounts in the domain.