<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
Jonathan Young wrote:<br>
<blockquote cite="mid43A4CEC5.2030104@pcphix.com" type="cite">
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
Chris Watt wrote:
<blockquote
cite="mid51e0084b0512171847p5cd82efapa10fc3e5137bb429@mail.gmail.com"
type="cite">
<pre wrap="">Hi Guys,
I'm really quite desperate now to get this machine working properly, I
really urgently need the help of someone who has done this and could
help me on both the Samba and Windows end of things.
If someone is able to offer assistance I would be forever grateful
~Chris</pre>
</blockquote>
When I get home tonight, before I go to sleep, I will compile my notes
into one 'tutorial'.<br>
<br>
I have just been so flat out, but the information I have here has
worked in every single case from Windows 98 to Windows XP unless the
machine itself has been in need of an F&R.<br>
<br>
These will be the best instructions I can offer, but as most of it is
on paper, I have just needed to find the time to *re-type* it... and
that has been the hold up.<br>
<br>
Talk to you later, though I'll post what I come up with to the list for
everyone's future reference (assuming it is useful and/or new
information).<br>
</blockquote>
<br>
Assuming that you have Samba set up correctly and the samba.conf file
reflects the correct shares, and other settings are ready to roll, this
'tutorial' (or more accurately a step by step guide of what has worked
for me), demonstrates how I
have successfully joined Windows 98 and Windows XP computers to a Samba
PDC in the past. I continue to refer to this method when adding more
PCs to my existing Samba PDC based networks and provided your Samba
shares and services are configured properly, this process should get
your Windows boxen logging on.<br>
<br>
A massive part of this documentation has been lifted from a website
belonging to a friend of mine, Les Ritchin and from technical documents
written by Les while he was working for PC-PHIX.<br>
<br>
Over at <a class="moz-txt-link-abbreviated" href="http://www.cr0n.net">www.cr0n.net</a>,
he has an article titled Connecting a Windows
98 PC to a Samba Domain:
<a class="moz-txt-link-freetext"
href="http://www.cr0n.net/articles.php?article=sambaclient">http://www.cr0n.net/articles.php?article=sambaclient</a><br>
<br>
While working for PC-PHIX back in 2004, he headed up the process of
perfecting our Samba controllers for use with Windows and more or less
wrote the rest of this documentation as part of a network document
required to provide ongoing support to one particular client. I have
re-written some of this to make it more generic (i.e. removed specific
references to our client's network), but from a technical point of view
nothing is missing.<br>
<br>
So credit where credit is due... Assuming it all works smoothly - thank
Les! I have however edited these instructions together to provide a
more complete guide for both Windows 98 and Windows XP together. This
really should just work!!!*<br>
<br>
Joining a new PC to the domain is fairly straightforward. In a nutshell
the steps are:<br>
- Create a machine account and user account on the server.<br>
- Configure the client PC to use a domain and give it the machine name
you specified.<br>
- Reboot and login with the account information
you set up.<br>
<br>
Below are the steps required in more detail. Good luck!<br>
<br>
<br>
<br>
**** For Windows XP: ****<br>
<br>
<big><small>Server Configuration:</small><br>
=============<br>
</big><br>
1. Log into the server as root. Create a new machine (or trust) account.<br>
<br>
[root@yourdomain root]# useradd -g machines -d /dev/null -s
/sbin/nologin -u uid machine_name$<br>
<br>
Some of the switches are optional, UIDs are assigned automatically, -g
is the group ("machines") and so on.<br>
Note the $ appended to the machine name - this is important!<br>
<br>
2. Lock the account.<br>
<br>
[root@yourdomain root]# passwd -l machine_name$<br>
Locking password for user machine_name$.<br>
passwd: Success<br>
<br>
3. Create an SMB trust account with the same name.<br>
<br>
[root@yourdomain root]# smbpasswd -a -m machine_name<br>
Added user machine_name$<br>
<br>
4. Create a user account for the new staff member / person who will be
using this PC.<br>
<br>
[root@yourdomain root]# useradd -U uid user<br>
[root@yourdomain root]# passwd user<br>
Changing password for user user.<br>
New UNIX password:<br>
Retype new UNIX password:<br>
passwd: all authentication tokens updated successfully.<br>
<br>
5. Create an SMB user account for the domain. It is a good idea from an
administrative point of view to make the SMB password the same as the
UNIX password.<br>
<br>
[root@yourdomain root]# smbpasswd -a user<br>
New SMB password:<br>
Retype new SMB password:<br>
Added user user.<br>
<br>
The server is now configured, next you need to configure the client.<br>
<br>
Client Configuration:<br>
==============<br>
<br>
Below are the steps required for the Windows XP client in detail. This
assumes you
are running Windows XP Professional.<br>
Please note that Windows XP Home
cannot join a domain. This is a limitation with that particular version
of Windows, not the server.<br>
<br>
Unplug the LAN cable from the client PC before starting. These
instructions assume you have already installed all required software
as local Administrator before joining the domain.<br>
<br>
1. Start Windows XP.<br>
<br>
2. Log in as Administrator (not an equivalent account).<br>
<br>
3. Run the WXP_SignOrSeal.reg patch** on
the client PC.<br>
<br>
4. Go to Start->Run and type gpedit.msc<br>
<br>
5. Under Computer Configuration->Administrative
Templates->System->User Profiles double click on Only allow local
profiles. Select Enabled and click Apply and OK. Also enable Prevent
Roaming Profile changes from propagating to the server.<br>
<br>
6. Right click My Computer, choose properties and flip to Computer Name.<br>
<br>
7. Click Change.<br>
<br>
8. Change the computer name to the same name as set up in Server setup
(step 1).<br>
<br>
9. Click OK, OK, and Yes to restart.<br>
<br>
10. Press CTRL-ALT-DEL and log in as Administrator (not an equivalent
account).<br>
<br>
11. Right click My Computer, choose properties and flip to Computer
Name.<br>
<br>
12. Click Change.<br>
<br>
13. Plug in the LAN cable, select the domain button and type YOURDOMAIN
in the domain field. Press enter or click OK.<br>
<br>
14. In the dialog box, type the Domain Administrator's username and
password.<br>
<br>
15. A message appears welcoming you to the YOURDOMAIN domain. Restart
your computer.<br>
<br>
16. Press CTRL-ALT-DEL and log in as Administrator (not an equivalent
account).<br>
<br>
17. Go to Start->Settings->Control Panel->User Accounts and
click Add... Type in the user name that will be logging into the
computer. In the domain field type YOURDOMAIN and set this user as an
Administrator. This ensures that when that user connects to that domain
he or she will be able to install programs, set the time etc.<br>
<br>
18. Log Off.<br>
<br>
19. Press CTRL-ALT-DEL and log in using the username and password as
set up in Server setup (steps 4 & 5). Make sure that Log On To: is
set to YOURDOMAIN<br>
<br>
.....You're done!!<br>
<br>
Notes:<br>
=====<br>
<br>
- I seem to remember that you need to actually supply the server's root
password and the username 'root' at some point instead of
Administrator. Try this for 14 if 'administrator' does not work.<br>
- The signorseal patch may or may not be required (see footnotes below).<br>
- It is a good idea to set the local PC (Windows) Administrator
password to something before joining the domain because while the PC is
part of the domain you can stop unauthorised logins, but off the domain
(or removed from the domain) you could still log in with no password
(since Microsoft won't make you create a 'root' password by default).
Please remember to record your new password somewhere.<br>
<br>
<br>
<br>
**** For Windows 98: ****<br>
<br>
by Les Ritchin (<a class="moz-txt-link-abbreviated"
href="mailto:les@cr0n.net">les@cr0n.net</a>); edited by Jonathan Young
(<a class="moz-txt-link-abbreviated" href="mailto:jonathan@pcphix.com">jonathan@pcphix.com</a>)<big><small><small><br>
</small><br>
[NB: The 'Server Configuration' is repeated / very similar to the
outline
given above. I recommend reading both and double checking any
differences to ensure the process you use is best suited to your
particular situation. - Jonathan]</small></big><br>
<big><br>
</big>Ewww. Windows 98! Yeah I know. But the fact is that most
businesses
still have a few old 98 machines still chugging along. I can't really
blame them though, most companies are sick and tired of paying the
Microsoft tax year after year - so do your part - introduce them to
Linux ;)<br>
<br>
Holy wars aside, this article describes step by step
how to get a Windows 98 PC onto a Samba domain. I'm basing this on a
few Samba DC's that I built in my days as a network technician. Keep in
mind I had to play it by ear, so my particular Samba DC's may not be
the most elegant ones around. They do, however, Just Work(tm) and that
is usually what the client is interested in. What this means is that
Your Mileage May Vary quite considerably. As always, follow this at
your own risk. I can't be responsible if your system gets hosed. It's
your responsibility to make sure nothing harmful happens to your
computer. Now let's get started!<br>
<br>
<big><small>Server Configuration:<br>
==============<br>
<br>
The first thing you'll need is root access to the Samba server. This
can be at a physical console, or over SSH. I like SSH, because I'm lazy
and don't like to get out of my chair.<br>
<br>
First we will create the Samba credentials. For this step, decide what
your Windows 98 PC should be called, like "reception", and decide who
will be using it like "jsmith". We need to provide the Samba server
these details. SSH to the Samba server as root.<br>
<br>
1. Create the machine account on the server:<br>
<br>
useradd -d /dev/null -s /sbin/nologin reception$<br>
<br>
Note the $ sign on the end. This is very important.<br>
<br>
2. Now lock the account to prevent password changes: <br>
<br>
passwd -l reception$<br>
<br>
3. Add the newly created machine account to Samba's authentication
list. Note that in this example, you DO NOT add the $ sign. The -m
switch tells smbpasswd that this is a machine account. <br>
<br>
smbpasswd -a -m reception<br>
<br>
That's it for the machine account.<br>
<br>
4. Now we must add a human user <br>
<br>
useradd jsmith<br>
<br>
5. Give jsmith a password <br>
<br>
passwd jsmith<br>
<br>
6. jsmith will, by default, belong only to the jsmith group. If your
Samba server uses group based security (which I've found to be very
easy to set up) you'll probably want to add this user to one of those
groups so that he can access the stuff he needs to access. For example,
if the Samba server uses a group such as docsonly, and jsmith needed
access to stuff in the docsonly group, add him to the group using the
usermod command. CAUTION: If the user is currently a member of a group
which is not listed, the user will be removed from the group: <br>
<br>
usermod jsmith -G jsmith docsonly<br>
<br>
7. Now add the jsmith to Samba's authentication list <br>
<br>
smbpasswd -a jsmith<br>
<br>
That's it for the server side, now we must connect the Windows 98
machine.<br>
<br>
</small></big><big><small>Client Configuration:<br>
==============<br>
</small><br>
</big>For this step, I'll assume you are already familiar with
Windows 98.<br>
<br>
You
will need to go to Start->Settings>Control Panel. <br>
<br>
Double Click
the network icon and make sure that the following networking items are
installed:<br>
<br>
- Client for Microsoft Networks<br>
- Network Adapter<br>
- TCP/IP<br>
<br>
Click
the Identification tab and give the computer the correct name (as in
reception). Fill in the workgroup name with your domain name (yeah I
know - it's like Start->Shutdown). Optionally add in a comment.<br>
<br>
Now
go back to configuration and select Client for Microsoft Networks, and
click Properties. Check the box that says "Log onto NT Domain" and type
the domain name in the text field. Click OK and OK again.<br>
<br>
Restart
your PC. At logon, make sure that the domain shows up correctly, and
type the username and password you specified in server setup for the
user. Windows should log onto the domain and run the applicable logon
script that is stored on the server.<br>
<br>
Notes:<br>
=====<br>
<br>
- The steps to be carried out on the server are not OS specific, so
make
sure you carry them out either way before doing the client side. Les'
version may be a little different to mine and were
probably tested using different versions of Samba. Provided you
believe you understand them, there will be solid information in both
sections / versions.<br>
- It is a good idea to set the local PC (Windows) Administrator
password to something before joining the domain because while the PC is
part of the domain you can stop unauthorised logins, but off the domain
(or removed from the domain) you could still log in with no password
(since Microsoft won't make you create a 'root' password by default).
Please remember to record your new password somewhere.<br>
<br>
<br>
<br>
**** Footnotes: ****<br>
<br>
* May not work for you, please don't hold me responsible just
because I
tried to help you out!<br>
** The Windows XP 'Signorseal' Patch is more or less a registry hack.
It may not be required if you have SP2 and other updates installed. It
can be found at various locations online such as this one:
<a class="moz-txt-link-freetext"
href="http://www.see.ed.ac.uk/it/network/domain/signorseal.reg">http://www.see.ed.ac.uk/it/network/domain/signorseal.reg</a>
(found by
Googling 'signorseal patch').<br>
<br>
The contents of .reg files can be checked for 'nasty' intentions fairly
easily. This one appears to do the following:<br>
<br>
REGEDIT4<br>
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters]<br>
"requiresignorseal"=dword:00000000<br>
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters]<br>
"signsecurechannel"=dword:00000000<br>
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]<br>
"CompatibleRUPSecurity"=dword:00000001<br>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group
Policy Objects\LocalMachine\Software\Policies\Microsoft\Windows\System]<br>
"CompatibleRUPSecurity"=dword:00000001<br>
<br>
So of course, you could make those changes manually...<br>
<br>
============================<br>
<br>
That's about it. Unfortunately I have not done this exercise
frequently enough to have perfected it just yet. Even now, these
instructions are a work in progress. But if you see something new or
something different; something that you haven't checked out yet, well,
that's probably what the problem is!<br>
<br>
Good luck and if anyone wants to improve on these notes, I'd love to
hear from you!<br>
<br>
<div class="moz-signature">-- <br>
<font face="Verdana" size="2">Jonathan Young<br>
Director of PC-PHIX<br>
<a class="moz-txt-link-abbreviated" href="mailto:jonathan@pcphix.com">jonathan@pcphix.com</a><br>
<br>
Phone: 0410 455 674<br>
Web: <a class="moz-txt-link-freetext" href="http://www.pcphix.com/">http://www.pcphix.com/</a><br>
<br>
</font>
<title>Jonathan Young of PC-PHIX</title>
<meta http-equiv="Content-Type" content="text/html; ">
<meta http-equiv="Content-Language" content="en-us">
<meta name="Signature" content="Jonathan Young">
<meta name="Copyright" content="Copyright 1997 to 2004 PC-PHIX">
</div>
</body>
</html>