1<?xml version="1.0" encoding="iso-8859-1"?> 2<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> 3<chapter id="NT4Migration"> 4<chapterinfo> 5 &author.jht; 6 <pubdate>April 3, 2003</pubdate> 7</chapterinfo> 8 9<title>Migration from NT4 PDC to Samba-3 PDC</title> 10 11<para> 12<indexterm><primary>migrate</primary></indexterm> 13<indexterm><primary>domain control</primary></indexterm> 14This is a rough guide to assist those wishing to migrate from NT4 domain control to 15Samba-3-based domain control. 16</para> 17 18<sect1> 19<title>Planning and Getting Started</title> 20 21<para> 22<indexterm><primary>show-stopper-type</primary></indexterm> 23In the IT world there is often a saying that all problems are encountered because of 24poor planning. The corollary to this saying is that not all problems can be anticipated 25and planned for. Then again, good planning will anticipate most show-stopper-type situations. 26</para> 27 28<para> 29<indexterm><primary>migration plan</primary></indexterm> 30Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control 31environment would do well to develop a detailed migration plan. So here are a few pointers to 32help migration get underway. 33</para> 34 35<sect2> 36<title>Objectives</title> 37 38<para> 39<indexterm><primary>migration process</primary></indexterm> 40The key objective for most organizations is to make the migration from MS Windows NT4 41to Samba-3 domain control as painless as possible. One of the challenges you may experience 42in your migration process may well be convincing management that the new environment 43should remain in place. Many who have introduced open source technologies have experienced 44pressure to return to a Microsoft-based platform solution at the first sign of trouble. 45</para> 46 47<para> 48<indexterm><primary>change motivations</primary></indexterm> 49Before attempting a migration to a Samba-3-controlled network, make every possible effort to 50gain all-round commitment to the change. Know precisely <emphasis>why</emphasis> the change 51is important for the organization. Possible motivations to make a change include: 52</para> 53 54<indexterm><primary>manageability</primary></indexterm> 55<indexterm><primary>functionality</primary></indexterm> 56<indexterm><primary>operating costs</primary></indexterm> 57<indexterm><primary>support exposure</primary></indexterm> 58<indexterm><primary>licensing</primary></indexterm> 59 60<itemizedlist> 61 <listitem><para>Improve network manageability.</para></listitem> 62 <listitem><para>Obtain better user-level functionality.</para></listitem> 63 <listitem><para>Reduce network operating costs.</para></listitem> 64 <listitem><para>Reduce exposure caused by Microsoft withdrawal of NT4 support.</para></listitem> 65 <listitem><para>Avoid MS License 6 implications.</para></listitem> 66 <listitem><para>Reduce organization's dependency on Microsoft.</para></listitem> 67</itemizedlist> 68 69<para> 70<indexterm><primary>alternative solution</primary></indexterm> 71<indexterm><primary>advantages</primary></indexterm> 72<indexterm><primary>core values</primary></indexterm> 73<indexterm><primary>migration</primary></indexterm> 74<indexterm><primary>ADS</primary></indexterm> 75<indexterm><primary>without ADS</primary></indexterm> 76Make sure everyone knows that Samba-3 is not MS Windows NT4. Samba-3 offers 77an alternative solution that is both different from MS Windows NT4 and offers 78advantages compared with it. Gain recognition that Samba-3 lacks many of the 79features that Microsoft has promoted as core values in migration from MS Windows NT4 to 80MS Windows 2000 and beyond (with or without Active Directory services). 81</para> 82 83<para> 84What are the features that Samba-3 cannot provide? 85</para> 86 87<indexterm><primary>Active Directory Server</primary></indexterm> 88<indexterm><primary>Group Policy Objects</primary></indexterm> 89<indexterm><primary>Machine Policy Objects</primary></indexterm> 90<indexterm><primary>Logon Scripts</primary></indexterm> 91<indexterm><primary>Access Controls</primary></indexterm> 92 93<itemizedlist> 94 <listitem><para>Active Directory Server.</para></listitem> 95 <listitem><para>Group Policy Objects (in Active Directory).</para></listitem> 96 <listitem><para>Machine Policy Objects.</para></listitem> 97 <listitem><para>Logon Scripts in Active Directory.</para></listitem> 98 <listitem><para>Software Application and Access Controls in Active Directory.</para></listitem> 99</itemizedlist> 100 101<para> 102The features that Samba-3 does provide and that may be of compelling interest to your site 103include: 104</para> 105 106<indexterm><primary>ownership cost</primary></indexterm> 107<indexterm><primary>Global support</primary></indexterm> 108<indexterm><primary>Dynamic SMB servers</primary></indexterm> 109<indexterm><primary>on-the-fly logon scripts</primary></indexterm> 110<indexterm><primary>on-the-fly policy files</primary></indexterm> 111<indexterm><primary>stability</primary></indexterm> 112<indexterm><primary>reliability</primary></indexterm> 113<indexterm><primary>performance</primary></indexterm> 114<indexterm><primary>availability</primary></indexterm> 115<indexterm><primary>Manageability</primary></indexterm> 116<indexterm><primary>backend authentication</primary></indexterm> 117<indexterm><primary>tdbsam</primary></indexterm> 118<indexterm><primary>ldapsam</primary></indexterm> 119<indexterm><primary>single-sign-on</primary></indexterm> 120<indexterm><primary>distribute authentication systems</primary></indexterm> 121 122<itemizedlist> 123 <listitem><para>Lower cost of ownership.</para></listitem> 124 <listitem><para>Global availability of support with no strings attached.</para></listitem> 125 <listitem><para>Dynamic SMB servers (can run more than one SMB/CIFS server per UNIX/Linux system).</para></listitem> 126 <listitem><para>Creation of on-the-fly logon scripts.</para></listitem> 127 <listitem><para>Creation of on-the-fly policy files.</para></listitem> 128 <listitem><para>Greater stability, reliability, performance, and availability.</para></listitem> 129 <listitem><para>Manageability via an SSH connection.</para></listitem> 130 <listitem><para>Flexible choices of backend authentication technologies (tdbsam, ldapsam).</para></listitem> 131 <listitem><para>Ability to implement a full single-sign-on architecture.</para></listitem> 132 <listitem><para>Ability to distribute authentication systems for absolute minimum wide-area network bandwidth demand.</para></listitem> 133</itemizedlist> 134 135<para> 136<indexterm><primary>successful migration</primary></indexterm> 137Before migrating a network from MS Windows NT4 to Samba-3, consider all necessary factors. Users 138should be educated about changes they may experience so the change will be a welcome one 139and not become an obstacle to the work they need to do. The following sections explain factors that will 140help ensure a successful migration. 141</para> 142 143<sect3> 144<title>Domain Layout</title> 145 146<para> 147<indexterm><primary>domain controller</primary></indexterm> 148<indexterm><primary>backup domain controller</primary></indexterm> 149<indexterm><primary>secondary controller</primary></indexterm> 150<indexterm><primary>domain member</primary></indexterm> 151<indexterm><primary>standalone server</primary></indexterm> 152<indexterm><primary>network security</primary></indexterm> 153<indexterm><primary>domain context</primary></indexterm> 154<indexterm><primary>PDC</primary></indexterm> 155<indexterm><primary>BDCs</primary></indexterm> 156<indexterm><primary>LDAP</primary></indexterm> 157<indexterm><primary>authentication backend</primary></indexterm> 158<indexterm><primary>complex organization</primary></indexterm> 159<indexterm><primary>LDAP database</primary></indexterm> 160<indexterm><primary>master server</primary></indexterm> 161<indexterm><primary>slave servers</primary></indexterm> 162<indexterm><primary>multiple domains</primary></indexterm> 163Samba-3 can be configured as a domain controller, a backup domain controller (probably best called 164a secondary controller), a domain member, or a standalone server. The Windows network security 165domain context should be sized and scoped before implementation. Particular attention needs to be 166paid to the location of the Primary Domain Controller (PDC) as well as backup controllers (BDCs). 167One way in which Samba-3 differs from Microsoft technology is that if one chooses to use an LDAP 168authentication backend, then the same database can be used by several different domains. In a 169complex organization, there can be a single LDAP database, which itself can be distributed (have 170a master server and multiple slave servers) that can simultaneously serve multiple domains. 171</para> 172 173<para> 174<indexterm><primary>network bandwidth</primary></indexterm> 175From a design perspective, the number of users per server as well as the number of servers per 176domain should be scaled taking into consideration server capacity and network bandwidth. 177</para> 178 179<para> 180<indexterm><primary>network segment</primary></indexterm> 181<indexterm><primary>multiple network segments</primary></indexterm> 182<indexterm><primary>domain controller</primary></indexterm> 183<indexterm><primary>ping</primary></indexterm> 184<indexterm><primary>BDC</primary></indexterm> 185<indexterm><primary>remote segment</primary></indexterm> 186A physical network segment may house several domains. Each may span multiple network segments. 187Where domains span routed network segments, consider and test the performance implications of 188the design and layout of a network. A centrally located domain controller that is designed to 189serve multiple routed network segments may result in severe performance problems. Check the 190response time (ping timing) between the remote segment and the PDC. If it's long (more than 100 ms), 191locate a BDC on the remote segment to serve as the local authentication and access control server. 192</para> 193</sect3> 194 195<sect3> 196<title>Server Share and Directory Layout</title> 197 198<para> 199<indexterm><primary>Simplicity is king</primary></indexterm> 200<indexterm><primary>well-controlled network</primary></indexterm> 201There are cardinal rules to effective network design that cannot be broken with impunity. 202The most important rule: Simplicity is king in every well-controlled network. Every part of 203the infrastructure must be managed; the more complex it is, the greater will be the demand 204of keeping systems secure and functional. 205</para> 206 207<para> 208<indexterm><primary>disk space</primary></indexterm> 209<indexterm><primary>backed up</primary></indexterm> 210<indexterm><primary>tape</primary></indexterm> 211<indexterm><primary>backup</primary></indexterm> 212<indexterm><primary>validate every backup</primary></indexterm> 213<indexterm><primary>disaster recovery</primary></indexterm> 214Keep in mind the nature of how data must be shared. Physical disk space layout should be considered 215carefully. Some data must be backed up. The simpler the disk layout, the easier it will be to 216keep track of backup needs. Identify what backup media will meet your needs; consider backup to tape, 217CD-ROM or DVD-ROM, or other offline storage medium. Plan and implement for minimum 218maintenance. Leave nothing to chance in your design; above all, do not leave backups to chance: 219backup, test, and validate every backup; create a disaster recovery plan and prove that it works. 220</para> 221 222<para> 223<indexterm><primary>access control needs</primary></indexterm> 224<indexterm><primary>group permissions</primary></indexterm> 225<indexterm><primary>sticky bit</primary></indexterm> 226Users should be grouped according to data access control needs. File and directory access 227is best controlled via group permissions, and the use of the <quote>sticky bit</quote> on group-controlled 228directories may substantially avoid file access complaints from Samba share users. 229</para> 230 231<para> 232<indexterm><primary>network administrators</primary></indexterm> 233<indexterm><primary>document design</primary></indexterm> 234<indexterm><primary>simple access controls</primary></indexterm> 235<indexterm><primary>obtuse complexity</primary></indexterm> 236<indexterm><primary>document design</primary></indexterm> 237Inexperienced network administrators often attempt elaborate techniques to set access 238controls on files, directories, shares, as well as in share definitions. 239Keep your design and implementation simple and document your design extensively. Have others 240audit your documentation. Do not create a complex mess that your successor will not understand. 241Remember, job security through complex design and implementation may cause loss of operations 242and downtime to users as the new administrator learns to untangle your knots. Keep access 243controls simple and effective, and make sure that users will never be interrupted by obtuse 244complexity. 245</para> 246</sect3> 247 248<sect3> 249<title>Logon Scripts</title> 250 251<para> 252<indexterm><primary>Logon scripts</primary></indexterm> 253Logon scripts can help to ensure that all users gain the share and printer connections they need. 254</para> 255 256<para> 257Logon scripts can be created on the fly so all commands executed are specific to the 258rights and privileges granted to the user. The preferred controls should be effected through 259group membership so group information can be used to create a custom logon script using 260the <smbconfoption name="root preexec"/> parameters to the <smbconfsection name="NETLOGON"/> share. 261</para> 262 263<para> 264<indexterm><primary>kixstart</primary></indexterm> 265Some sites prefer to use a tool such as <command>kixstart</command> to establish a controlled 266user environment. In any case, you may wish to do a Google search for logon script process controls. 267In particular, you may wish to explore the use of the Microsoft Knowledge Base article KB189105 that 268deals with how to add printers without user intervention via the logon script process. 269</para> 270</sect3> 271 272<sect3> 273<title>Profile Migration/Creation</title> 274 275<para> 276User and group profiles may be migrated using the tools described in the section titled Desktop Profile 277Management. 278</para> 279 280 281<para> 282<indexterm><primary>SID</primary></indexterm> 283<indexterm><primary>NTuser.DAT</primary></indexterm> 284Profiles may also be managed using the Samba-3 tool <command>profiles</command>. This tool allows the MS 285Windows NT-style security identifiers (SIDs) that are stored inside the profile 286<filename>NTuser.DAT</filename> file to be changed to the SID of the Samba-3 domain. 287</para> 288</sect3> 289 290<sect3> 291<title>User and Group Accounts</title> 292 293<para> 294<indexterm><primary>migrate account settings</primary></indexterm> 295<indexterm><primary>migrate user</primary></indexterm> 296<indexterm><primary>migrate group</primary></indexterm> 297<indexterm><primary>map</primary></indexterm> 298It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before 299attempting to migrate user and group accounts, you are STRONGLY advised to create in Samba-3 the 300groups that are present on the MS Windows NT4 domain <emphasis>AND</emphasis> to map them to 301suitable UNIX/Linux groups. By following this simple advice, all user and group attributes 302should migrate painlessly. 303</para> 304</sect3> 305 306</sect2> 307 308<sect2> 309<title>Steps in Migration Process</title> 310 311<para> 312The approximate migration process is described below. 313</para> 314 315<itemizedlist> 316 <listitem><para> 317 You have an NT4 PDC that has the users, groups, policies, and profiles to be migrated. 318 </para></listitem> 319 320 <listitem><para> 321<indexterm><primary>domain controller</primary></indexterm> 322<indexterm><primary>netlogon share</primary></indexterm> 323<indexterm><primary>BDC</primary></indexterm> 324 Samba-3 is set up as a domain controller with netlogon share, profile share, and so on. Configure the &smb.conf; file 325 to function as a BDC: <parameter>domain master = No</parameter>. 326 </para></listitem> 327</itemizedlist> 328 329<procedure> 330<title>The Account Migration Process</title> 331 332 <step><para> 333 <indexterm><primary>pdbedit</primary></indexterm> 334 Create a BDC account in the old NT4 domain for the Samba server using NT Server Manager. 335 <emphasis>Samba must not be running.</emphasis> 336 </para></step> 337 338 <step><para> 339 <indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>join</tertiary></indexterm> 340 <userinput>net rpc join -S <replaceable>NT4PDC</replaceable> -w <replaceable>DOMNAME</replaceable> -U 341 Administrator%<replaceable>passwd</replaceable></userinput> 342 </para></step> 343 344 <step><para> 345<indexterm><primary>net</primary><secondary>rpc</secondary><tertiary>vampire</tertiary></indexterm> 346 <userinput>net rpc vampire -S <replaceable>NT4PDC</replaceable> -U 347 administrator%<replaceable>passwd</replaceable></userinput> 348 </para></step> 349 350<indexterm><primary>pdbedit</primary></indexterm> 351 <step><para><userinput>pdbedit -L</userinput></para> 352 <para>Note: Did the users migrate?</para> 353 </step> 354 355 <step><para> 356 <indexterm><primary>net</primary><secondary>groupmap</secondary></indexterm> 357 <indexterm><primary>initGroups.sh</primary></indexterm> 358 Now assign each of the UNIX groups to NT groups: 359 (It may be useful to copy this text to a script called <filename>initGroups.sh</filename>) 360 <programlisting> 361#!/bin/bash 362#### Keep this as a shell script for future re-use 363 364# First assign well known domain global groups 365net groupmap add ntgroup="Domain Admins" unixgroup=root rid=512 type=d 366net groupmap add ntgroup="Domain Users" unixgroup=users rid=513 type=d 367net groupmap add ntgroup="Domain Guests" unixgroup=nobody rid=514 type=d 368 369# Now for our added domain global groups 370net groupmap add ntgroup="Designers" unixgroup=designers type=d 371net groupmap add ntgroup="Engineers" unixgroup=engineers type=d 372net groupmap add ntgroup="QA Team" unixgroup=qateam type=d 373</programlisting> 374 </para></step> 375 376 <step><para><userinput>net groupmap list</userinput></para> 377 <para>Check that all groups are recognized. 378 </para></step> 379</procedure> 380 381<para> 382Migrate all the profiles, then migrate all policy files. 383</para> 384 385</sect2> 386</sect1> 387 388<sect1> 389<title>Migration Options</title> 390 391<para> 392Sites that wish to migrate from MS Windows NT4 domain control to a Samba-based solution 393generally fit into three basic categories. <link linkend="majtypes">Following table</link> shows the possibilities. 394</para> 395 396<table frame="all" id="majtypes"><title>The Three Major Site Types</title> 397<tgroup cols="2"> 398 <colspec align="left"/> 399 <colspec align="justify"/> 400 <thead> 401 <row><entry>Number of Users</entry><entry>Description</entry></row> 402 </thead> 403 <tbody> 404 <row><entry>< 50</entry><entry><para>Want simple conversion with no pain.</para></entry></row> 405 <row><entry>50 - 250</entry><entry><para>Want new features; can manage some inhouse complexity.</para></entry></row> 406 <row><entry>> 250</entry><entry><para>Solution/implementation must scale well; complex needs. 407 Cross-departmental decision process. Local expertise in most areas.</para></entry></row> 408 </tbody> 409</tgroup> 410</table> 411 412<sect2> 413<title>Planning for Success</title> 414 415<para> 416There are three basic choices for sites that intend to migrate from MS Windows NT4 417to Samba-3: 418</para> 419 420<itemizedlist> 421 <listitem><para> 422 Simple conversion (total replacement). 423 </para></listitem> 424 425 <listitem><para> 426 Upgraded conversion (could be one of integration). 427 </para></listitem> 428 429 <listitem><para> 430 Complete redesign (completely new solution). 431 </para></listitem> 432</itemizedlist> 433 434<para> 435Minimize downstream problems by: 436</para> 437 438<itemizedlist> 439 <listitem><para> 440 Taking sufficient time. 441 </para></listitem> 442 443 <listitem><para> 444 Avoiding panic. 445 </para></listitem> 446 447 <listitem><para> 448 Testing all assumptions. 449 </para></listitem> 450 451 <listitem><para> 452 Testing the full roll-out program, including workstation deployment. 453 </para></listitem> 454</itemizedlist> 455 456<para><link linkend="natconchoices">Following table</link> lists the conversion choices given the type of migration 457being contemplated. 458</para> 459 460<table frame="all" id="natconchoices"><title>Nature of the Conversion Choices</title> 461<tgroup cols="3"> 462 <colspec align="justify" colwidth="1*"/> 463 <colspec align="justify" colwidth="1*"/> 464 <colspec align="justify" colwidth="1*"/> 465 <thead> 466 <row><entry>Simple Install</entry><entry>Upgrade Decisions</entry><entry>Redesign Decisions</entry></row> 467 </thead> 468 <tbody> 469 <row> 470 <entry><para>Make use of minimal OS-specific features</para></entry> 471 <entry><para>Translate NT4 features to new host OS features</para></entry> 472 <entry><para>Improve on NT4 functionality, enhance management capabilities</para></entry> 473 </row> 474 <row> 475 <entry><para>Move all accounts from NT4 into Samba-3</para></entry> 476 <entry><para>Copy and improve</para></entry> 477 <entry><para>Authentication regime (database location and access)</para></entry> 478 </row> 479 <row> 480 <entry><para>Make least number of operational changes</para></entry> 481 <entry><para>Make progressive improvements</para></entry> 482 <entry><para>Desktop management methods</para></entry> 483 </row> 484 <row> 485 <entry><para>Take least amount of time to migrate</para></entry> 486 <entry><para>Minimize user impact</para></entry> 487 <entry><para>Better control of Desktops/Users</para></entry> 488 </row> 489 <row> 490 <entry><para>Live versus isolated conversion</para></entry> 491 <entry><para>Maximize functionality</para></entry> 492 <entry><para>Identify Needs for: <emphasis>Manageability, Scalability, Security, Availability</emphasis></para></entry> 493 </row> 494 <row> 495 <entry><para>Integrate Samba-3, then migrate while users are active, then change of control (swap out)</para></entry> 496 <entry><para>Take advantage of lower maintenance opportunity</para></entry> 497 <entry><para></para></entry> 498 </row> 499 </tbody> 500</tgroup> 501</table> 502</sect2> 503 504<sect2> 505<title>Samba-3 Implementation Choices</title> 506 507<variablelist> 508 <varlistentry><term>Authentication Database/Backend</term><listitem> 509 <para> 510 Samba-3 can use an external authentication backend: 511 </para> 512 513 <para> 514 <itemizedlist> 515 <listitem><para>Winbind (external Samba or NT4/200x server).</para></listitem> 516 <listitem><para>External server could use Active Directory or NT4 domain.</para></listitem> 517 <listitem><para>Can use pam_mkhomedir.so to autocreate home directories.</para></listitem> 518 <listitem><para> Samba-3 can use a local authentication backend: <parameter>smbpasswd</parameter>, 519 <parameter>tdbsam</parameter>, <parameter>ldapsam</parameter> 520 </para></listitem> 521 </itemizedlist></para></listitem> 522 </varlistentry> 523 524 <varlistentry><term>Access Control Points</term><listitem> 525 <para> 526 Samba permits Access Control points to be set: 527 </para> 528 529<indexterm><primary>share ACLs</primary></indexterm> 530<indexterm><primary>UNIX permissions</primary></indexterm> 531<indexterm><primary>POSIX ACLS</primary></indexterm> 532<indexterm><primary>share stanza controls</primary></indexterm> 533 534 <itemizedlist> 535 <listitem><para>On the share itself &smbmdash; using share ACLs.</para></listitem> 536 <listitem><para>On the file system &smbmdash; using UNIX permissions on files and directories.</para> 537 <para>Note: Can enable Posix ACLs in file system also.</para></listitem> 538 <listitem><para>Through Samba share parameters &smbmdash; not recommended except as last resort.</para></listitem> 539 </itemizedlist></listitem> 540 </varlistentry> 541 542 <varlistentry><term>Policies (migrate or create new ones)</term><listitem> 543 <para> 544<indexterm><primary>policies</primary></indexterm> 545<indexterm><primary>NTConfig.POL</primary></indexterm> 546 Exercise great caution when making registry changes; use the right tool and be aware 547 that changes made through NT4-style <filename>NTConfig.POL</filename> files can leave 548 permanent changes. 549<indexterm><primary>Group Policy Editor</primary></indexterm> 550<indexterm><primary>tattoo effect</primary></indexterm> 551<indexterm><primary>permanent changes</primary></indexterm> 552 </para> 553 <itemizedlist> 554 <listitem><para>Using Group Policy Editor (NT4).</para></listitem> 555 <listitem><para>Watch out for tattoo effect.</para></listitem> 556 </itemizedlist> 557 </listitem> 558 </varlistentry> 559 560 <varlistentry><term>User and Group Profiles</term><listitem> 561 <para> 562<indexterm><primary>NTUser.DAT</primary></indexterm> 563<indexterm><primary>SIDs</primary></indexterm> 564 Platform-specific, so use platform tool to change from a local to a roaming profile. 565 Can use new profiles tool to change SIDs (<filename>NTUser.DAT</filename>). 566 </para> 567 </listitem> 568 </varlistentry> 569 570 <varlistentry><term>Logon Scripts</term><listitem> 571 <para> 572 Know how they work. 573 </para> 574 </listitem> 575 </varlistentry> 576 577 578 <varlistentry><term>User and Group Mapping to UNIX/Linux</term><listitem> 579 <para> 580 <indexterm><primary>pdbedit</primary></indexterm> 581 User and group mapping code is new. Many problems have been experienced as network administrators 582 who are familiar with Samba-2.2.x migrate to Samba-3. Carefully study the chapters that document 583 the new password backend behavior and the new group mapping functionality. 584 </para> 585 <itemizedlist> 586 <listitem><para>The <parameter>username map</parameter> facility may be needed.</para></listitem> 587 <listitem><para>Use <command>net groupmap</command> to connect NT4 groups to UNIX groups.</para></listitem> 588 <listitem><para> 589 Use <command>pdbedit</command> to set/change user configuration. 590 </para> 591 592 <para> 593 When migrating to LDAP backend, it may be easier to dump the initial 594 LDAP database to LDIF, edit, then reload into LDAP. 595 </para></listitem> 596 </itemizedlist></listitem> 597 </varlistentry> 598 599 <varlistentry><term>OS-Specific Scripts/Programs May be Needed</term><listitem> 600 <para> 601 Every operating system has its peculiarities. These are the result of engineering decisions 602 that were based on the experience of the designer and may have side effects that were not 603 anticipated. Limitations that may bite the Windows network administrator include: 604 </para> 605 <itemizedlist> 606 <listitem><para>Add/Delete Users: Note OS limits on size of name 607 (Linux 8 chars, NT4 up to 254 chars).</para></listitem> 608 <listitem><para>Add/Delete Machines: Applied only to domain members 609 (Note: machine names may be limited to 16 characters).</para></listitem> 610 <listitem><para>Use <command>net groupmap</command> to connect NT4 groups to UNIX groups.</para></listitem> 611 <listitem><para>Add/Delete Groups: Note OS limits on size and nature. 612 Linux limit is 16 char, no spaces, and no uppercase chars (<command>groupadd</command>).</para></listitem> 613 </itemizedlist></listitem> 614 </varlistentry> 615 616 <varlistentry><term>Migration Tools</term><listitem> 617 <para> 618 <indexterm><primary>pdbedit</primary></indexterm> 619 Domain Control (NT4-Style) Profiles, Policies, Access Controls, Security 620 <itemizedlist> 621 <listitem><para>Samba: <command>net, rpcclient, smbpasswd, pdbedit, profiles</command></para></listitem> 622 <listitem><para>Windows: <command>NT4 Domain User Manager, Server Manager (NEXUS)</command></para></listitem> 623 </itemizedlist></para></listitem> 624 </varlistentry> 625</variablelist> 626 627</sect2> 628 629</sect1> 630 631</chapter> 632