1
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�36.�Migration from NT4 PDC to Samba-3 PDC</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.4.x HOWTO and Reference Guide"><link rel="up" href="migration.html" title="Part�IV.�Migration and Updating"><link rel="prev" href="upgrading-to-3.0.html" title="Chapter�35.�Updating and Upgrading Samba"><link rel="next" href="SWAT.html" title="Chapter�37.�SWAT: The Samba Web Administration Tool"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�36.�Migration from NT4 PDC to Samba-3 PDC</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrading-to-3.0.html">Prev</a>�</td><th width="60%" align="center">Part�IV.�Migration and Updating</th><td width="20%" align="right">�<a accesskey="n" href="SWAT.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="NT4Migration"></a>Chapter�36.�Migration from NT4 PDC to Samba-3 PDC</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">April 3, 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="NT4Migration.html#id2679090">Planning and Getting Started</a></span></dt><dd><dl><dt><span class="sect2"><a href="NT4Migration.html#id2679125">Objectives</a></span></dt><dt><span class="sect2"><a href="NT4Migration.html#id2680070">Steps in Migration Process</a></span></dt></dl></dd><dt><span class="sect1"><a href="NT4Migration.html#id2680306">Migration Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="NT4Migration.html#id2680392">Planning for Success</a></span></dt><dt><span class="sect2"><a href="NT4Migration.html#id2680625">Samba-3 Implementation Choices</a></span></dt></dl></dd></dl></div><p>
2
<a class="indexterm" name="id2679074"></a>
3
<a class="indexterm" name="id2679080"></a>
1
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�36.�Migration from NT4 PDC to Samba-3 PDC</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="The Official Samba 3.4.x HOWTO and Reference Guide"><link rel="up" href="migration.html" title="Part�IV.�Migration and Updating"><link rel="prev" href="upgrading-to-3.0.html" title="Chapter�35.�Updating and Upgrading Samba"><link rel="next" href="SWAT.html" title="Chapter�37.�SWAT: The Samba Web Administration Tool"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�36.�Migration from NT4 PDC to Samba-3 PDC</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrading-to-3.0.html">Prev</a>�</td><th width="60%" align="center">Part�IV.�Migration and Updating</th><td width="20%" align="right">�<a accesskey="n" href="SWAT.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter�36.�Migration from NT4 PDC to Samba-3 PDC"><div class="titlepage"><div><div><h2 class="title"><a name="NT4Migration"></a>Chapter�36.�Migration from NT4 PDC to Samba-3 PDC</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">April 3, 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="NT4Migration.html#id2685152">Planning and Getting Started</a></span></dt><dd><dl><dt><span class="sect2"><a href="NT4Migration.html#id2685187">Objectives</a></span></dt><dt><span class="sect2"><a href="NT4Migration.html#id2686132">Steps in Migration Process</a></span></dt></dl></dd><dt><span class="sect1"><a href="NT4Migration.html#id2686367">Migration Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="NT4Migration.html#id2686454">Planning for Success</a></span></dt><dt><span class="sect2"><a href="NT4Migration.html#id2686687">Samba-3 Implementation Choices</a></span></dt></dl></dd></dl></div><p>
2
<a class="indexterm" name="id2685135"></a>
3
<a class="indexterm" name="id2685142"></a>
4
4
This is a rough guide to assist those wishing to migrate from NT4 domain control to
5
5
Samba-3-based domain control.
6
</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2679090"></a>Planning and Getting Started</h2></div></div></div><p>
7
<a class="indexterm" name="id2679098"></a>
6
</p><div class="sect1" title="Planning and Getting Started"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2685152"></a>Planning and Getting Started</h2></div></div></div><p>
7
<a class="indexterm" name="id2685160"></a>
8
8
In the IT world there is often a saying that all problems are encountered because of
9
9
poor planning. The corollary to this saying is that not all problems can be anticipated
10
10
and planned for. Then again, good planning will anticipate most show-stopper-type situations.
12
<a class="indexterm" name="id2679113"></a>
12
<a class="indexterm" name="id2685175"></a>
13
13
Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control
14
14
environment would do well to develop a detailed migration plan. So here are a few pointers to
15
15
help migration get underway.
16
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2679125"></a>Objectives</h3></div></div></div><p>
17
<a class="indexterm" name="id2679133"></a>
16
</p><div class="sect2" title="Objectives"><div class="titlepage"><div><div><h3 class="title"><a name="id2685187"></a>Objectives</h3></div></div></div><p>
17
<a class="indexterm" name="id2685194"></a>
18
18
The key objective for most organizations is to make the migration from MS Windows NT4
19
19
to Samba-3 domain control as painless as possible. One of the challenges you may experience
20
20
in your migration process may well be convincing management that the new environment
21
21
should remain in place. Many who have introduced open source technologies have experienced
22
22
pressure to return to a Microsoft-based platform solution at the first sign of trouble.
24
<a class="indexterm" name="id2679150"></a>
24
<a class="indexterm" name="id2685212"></a>
25
25
Before attempting a migration to a Samba-3-controlled network, make every possible effort to
26
26
gain all-round commitment to the change. Know precisely <span class="emphasis"><em>why</em></span> the change
27
27
is important for the organization. Possible motivations to make a change include:
28
</p><a class="indexterm" name="id2679166"></a><a class="indexterm" name="id2679173"></a><a class="indexterm" name="id2679180"></a><a class="indexterm" name="id2679187"></a><a class="indexterm" name="id2679194"></a><div class="itemizedlist"><ul type="disc"><li><p>Improve network manageability.</p></li><li><p>Obtain better user-level functionality.</p></li><li><p>Reduce network operating costs.</p></li><li><p>Reduce exposure caused by Microsoft withdrawal of NT4 support.</p></li><li><p>Avoid MS License 6 implications.</p></li><li><p>Reduce organization's dependency on Microsoft.</p></li></ul></div><p>
29
<a class="indexterm" name="id2679237"></a>
30
<a class="indexterm" name="id2679244"></a>
31
<a class="indexterm" name="id2679251"></a>
32
<a class="indexterm" name="id2679258"></a>
33
<a class="indexterm" name="id2679264"></a>
34
<a class="indexterm" name="id2679271"></a>
28
</p><a class="indexterm" name="id2685228"></a><a class="indexterm" name="id2685235"></a><a class="indexterm" name="id2685242"></a><a class="indexterm" name="id2685249"></a><a class="indexterm" name="id2685256"></a><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Improve network manageability.</p></li><li class="listitem"><p>Obtain better user-level functionality.</p></li><li class="listitem"><p>Reduce network operating costs.</p></li><li class="listitem"><p>Reduce exposure caused by Microsoft withdrawal of NT4 support.</p></li><li class="listitem"><p>Avoid MS License 6 implications.</p></li><li class="listitem"><p>Reduce organization's dependency on Microsoft.</p></li></ul></div><p>
29
<a class="indexterm" name="id2685299"></a>
30
<a class="indexterm" name="id2685306"></a>
31
<a class="indexterm" name="id2685312"></a>
32
<a class="indexterm" name="id2685319"></a>
33
<a class="indexterm" name="id2685326"></a>
34
<a class="indexterm" name="id2685333"></a>
35
35
Make sure everyone knows that Samba-3 is not MS Windows NT4. Samba-3 offers
36
36
an alternative solution that is both different from MS Windows NT4 and offers
37
37
advantages compared with it. Gain recognition that Samba-3 lacks many of the
39
39
MS Windows 2000 and beyond (with or without Active Directory services).
41
41
What are the features that Samba-3 cannot provide?
42
</p><a class="indexterm" name="id2679290"></a><a class="indexterm" name="id2679297"></a><a class="indexterm" name="id2679304"></a><a class="indexterm" name="id2679311"></a><a class="indexterm" name="id2679318"></a><div class="itemizedlist"><ul type="disc"><li><p>Active Directory Server.</p></li><li><p>Group Policy Objects (in Active Directory).</p></li><li><p>Machine Policy Objects.</p></li><li><p>Logon Scripts in Active Directory.</p></li><li><p>Software Application and Access Controls in Active Directory.</p></li></ul></div><p>
42
</p><a class="indexterm" name="id2685351"></a><a class="indexterm" name="id2685358"></a><a class="indexterm" name="id2685366"></a><a class="indexterm" name="id2685373"></a><a class="indexterm" name="id2685380"></a><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Active Directory Server.</p></li><li class="listitem"><p>Group Policy Objects (in Active Directory).</p></li><li class="listitem"><p>Machine Policy Objects.</p></li><li class="listitem"><p>Logon Scripts in Active Directory.</p></li><li class="listitem"><p>Software Application and Access Controls in Active Directory.</p></li></ul></div><p>
43
43
The features that Samba-3 does provide and that may be of compelling interest to your site
45
</p><a class="indexterm" name="id2679358"></a><a class="indexterm" name="id2679365"></a><a class="indexterm" name="id2679372"></a><a class="indexterm" name="id2679379"></a><a class="indexterm" name="id2679386"></a><a class="indexterm" name="id2679393"></a><a class="indexterm" name="id2679400"></a><a class="indexterm" name="id2679407"></a><a class="indexterm" name="id2679413"></a><a class="indexterm" name="id2679420"></a><a class="indexterm" name="id2679427"></a><a class="indexterm" name="id2679434"></a><a class="indexterm" name="id2679441"></a><a class="indexterm" name="id2679448"></a><a class="indexterm" name="id2679455"></a><div class="itemizedlist"><ul type="disc"><li><p>Lower cost of ownership.</p></li><li><p>Global availability of support with no strings attached.</p></li><li><p>Dynamic SMB servers (can run more than one SMB/CIFS server per UNIX/Linux system).</p></li><li><p>Creation of on-the-fly logon scripts.</p></li><li><p>Creation of on-the-fly policy files.</p></li><li><p>Greater stability, reliability, performance, and availability.</p></li><li><p>Manageability via an SSH connection.</p></li><li><p>Flexible choices of backend authentication technologies (tdbsam, ldapsam).</p></li><li><p>Ability to implement a full single-sign-on architecture.</p></li><li><p>Ability to distribute authentication systems for absolute minimum wide-area network bandwidth demand.</p></li></ul></div><p>
46
<a class="indexterm" name="id2679521"></a>
45
</p><a class="indexterm" name="id2685420"></a><a class="indexterm" name="id2685427"></a><a class="indexterm" name="id2685434"></a><a class="indexterm" name="id2685441"></a><a class="indexterm" name="id2685448"></a><a class="indexterm" name="id2685455"></a><a class="indexterm" name="id2685462"></a><a class="indexterm" name="id2685468"></a><a class="indexterm" name="id2685475"></a><a class="indexterm" name="id2685482"></a><a class="indexterm" name="id2685489"></a><a class="indexterm" name="id2685496"></a><a class="indexterm" name="id2685503"></a><a class="indexterm" name="id2685510"></a><a class="indexterm" name="id2685517"></a><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Lower cost of ownership.</p></li><li class="listitem"><p>Global availability of support with no strings attached.</p></li><li class="listitem"><p>Dynamic SMB servers (can run more than one SMB/CIFS server per UNIX/Linux system).</p></li><li class="listitem"><p>Creation of on-the-fly logon scripts.</p></li><li class="listitem"><p>Creation of on-the-fly policy files.</p></li><li class="listitem"><p>Greater stability, reliability, performance, and availability.</p></li><li class="listitem"><p>Manageability via an SSH connection.</p></li><li class="listitem"><p>Flexible choices of backend authentication technologies (tdbsam, ldapsam).</p></li><li class="listitem"><p>Ability to implement a full single-sign-on architecture.</p></li><li class="listitem"><p>Ability to distribute authentication systems for absolute minimum wide-area network bandwidth demand.</p></li></ul></div><p>
46
<a class="indexterm" name="id2685583"></a>
47
47
Before migrating a network from MS Windows NT4 to Samba-3, consider all necessary factors. Users
48
48
should be educated about changes they may experience so the change will be a welcome one
49
49
and not become an obstacle to the work they need to do. The following sections explain factors that will
50
50
help ensure a successful migration.
51
</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2679535"></a>Domain Layout</h4></div></div></div><p>
52
<a class="indexterm" name="id2679543"></a>
53
<a class="indexterm" name="id2679550"></a>
54
<a class="indexterm" name="id2679557"></a>
55
<a class="indexterm" name="id2679564"></a>
56
<a class="indexterm" name="id2679571"></a>
57
<a class="indexterm" name="id2679578"></a>
58
<a class="indexterm" name="id2679584"></a>
59
<a class="indexterm" name="id2679591"></a>
60
<a class="indexterm" name="id2679598"></a>
61
<a class="indexterm" name="id2679605"></a>
62
<a class="indexterm" name="id2679612"></a>
63
<a class="indexterm" name="id2679619"></a>
64
<a class="indexterm" name="id2679626"></a>
65
<a class="indexterm" name="id2679633"></a>
66
<a class="indexterm" name="id2679640"></a>
67
<a class="indexterm" name="id2679646"></a>
51
</p><div class="sect3" title="Domain Layout"><div class="titlepage"><div><div><h4 class="title"><a name="id2685596"></a>Domain Layout</h4></div></div></div><p>
52
<a class="indexterm" name="id2685604"></a>
53
<a class="indexterm" name="id2685611"></a>
54
<a class="indexterm" name="id2685618"></a>
55
<a class="indexterm" name="id2685625"></a>
56
<a class="indexterm" name="id2685632"></a>
57
<a class="indexterm" name="id2685639"></a>
58
<a class="indexterm" name="id2685646"></a>
59
<a class="indexterm" name="id2685653"></a>
60
<a class="indexterm" name="id2685660"></a>
61
<a class="indexterm" name="id2685666"></a>
62
<a class="indexterm" name="id2685673"></a>
63
<a class="indexterm" name="id2685680"></a>
64
<a class="indexterm" name="id2685687"></a>
65
<a class="indexterm" name="id2685694"></a>
66
<a class="indexterm" name="id2685701"></a>
67
<a class="indexterm" name="id2685708"></a>
68
68
Samba-3 can be configured as a domain controller, a backup domain controller (probably best called
69
69
a secondary controller), a domain member, or a standalone server. The Windows network security
70
70
domain context should be sized and scoped before implementation. Particular attention needs to be
74
74
complex organization, there can be a single LDAP database, which itself can be distributed (have
75
75
a master server and multiple slave servers) that can simultaneously serve multiple domains.
77
<a class="indexterm" name="id2679670"></a>
77
<a class="indexterm" name="id2685731"></a>
78
78
From a design perspective, the number of users per server as well as the number of servers per
79
79
domain should be scaled taking into consideration server capacity and network bandwidth.
81
<a class="indexterm" name="id2679683"></a>
82
<a class="indexterm" name="id2679690"></a>
83
<a class="indexterm" name="id2679697"></a>
84
<a class="indexterm" name="id2679704"></a>
85
<a class="indexterm" name="id2679711"></a>
86
<a class="indexterm" name="id2679717"></a>
81
<a class="indexterm" name="id2685745"></a>
82
<a class="indexterm" name="id2685752"></a>
83
<a class="indexterm" name="id2685759"></a>
84
<a class="indexterm" name="id2685766"></a>
85
<a class="indexterm" name="id2685772"></a>
86
<a class="indexterm" name="id2685779"></a>
87
87
A physical network segment may house several domains. Each may span multiple network segments.
88
88
Where domains span routed network segments, consider and test the performance implications of
89
89
the design and layout of a network. A centrally located domain controller that is designed to
90
90
serve multiple routed network segments may result in severe performance problems. Check the
91
91
response time (ping timing) between the remote segment and the PDC. If it's long (more than 100 ms),
92
92
locate a BDC on the remote segment to serve as the local authentication and access control server.
93
</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2679736"></a>Server Share and Directory Layout</h4></div></div></div><p>
94
<a class="indexterm" name="id2679744"></a>
95
<a class="indexterm" name="id2679751"></a>
93
</p></div><div class="sect3" title="Server Share and Directory Layout"><div class="titlepage"><div><div><h4 class="title"><a name="id2685798"></a>Server Share and Directory Layout</h4></div></div></div><p>
94
<a class="indexterm" name="id2685806"></a>
95
<a class="indexterm" name="id2685813"></a>
96
96
There are cardinal rules to effective network design that cannot be broken with impunity.
97
97
The most important rule: Simplicity is king in every well-controlled network. Every part of
98
98
the infrastructure must be managed; the more complex it is, the greater will be the demand
99
99
of keeping systems secure and functional.
101
<a class="indexterm" name="id2679767"></a>
102
<a class="indexterm" name="id2679774"></a>
103
<a class="indexterm" name="id2679780"></a>
104
<a class="indexterm" name="id2679787"></a>
105
<a class="indexterm" name="id2679794"></a>
106
<a class="indexterm" name="id2679801"></a>
101
<a class="indexterm" name="id2685828"></a>
102
<a class="indexterm" name="id2685835"></a>
103
<a class="indexterm" name="id2685842"></a>
104
<a class="indexterm" name="id2685849"></a>
105
<a class="indexterm" name="id2685856"></a>
106
<a class="indexterm" name="id2685863"></a>
107
107
Keep in mind the nature of how data must be shared. Physical disk space layout should be considered
108
108
carefully. Some data must be backed up. The simpler the disk layout, the easier it will be to
109
109
keep track of backup needs. Identify what backup media will meet your needs; consider backup to tape,
111
111
maintenance. Leave nothing to chance in your design; above all, do not leave backups to chance:
112
112
backup, test, and validate every backup; create a disaster recovery plan and prove that it works.
114
<a class="indexterm" name="id2679830"></a>
115
<a class="indexterm" name="id2679838"></a>
116
<a class="indexterm" name="id2679844"></a>
114
<a class="indexterm" name="id2685892"></a>
115
<a class="indexterm" name="id2685899"></a>
116
<a class="indexterm" name="id2685906"></a>
117
117
Users should be grouped according to data access control needs. File and directory access
118
is best controlled via group permissions, and the use of the “<span class="quote">sticky bit</span>” on group-controlled
118
is best controlled via group permissions, and the use of the <span class="quote">“<span class="quote">sticky bit</span>”</span> on group-controlled
119
119
directories may substantially avoid file access complaints from Samba share users.
121
<a class="indexterm" name="id2679862"></a>
122
<a class="indexterm" name="id2679870"></a>
123
<a class="indexterm" name="id2679876"></a>
124
<a class="indexterm" name="id2679884"></a>
125
<a class="indexterm" name="id2679890"></a>
121
<a class="indexterm" name="id2685924"></a>
122
<a class="indexterm" name="id2685931"></a>
123
<a class="indexterm" name="id2685938"></a>
124
<a class="indexterm" name="id2685945"></a>
125
<a class="indexterm" name="id2685952"></a>
126
126
Inexperienced network administrators often attempt elaborate techniques to set access
127
127
controls on files, directories, shares, as well as in share definitions.
128
128
Keep your design and implementation simple and document your design extensively. Have others
140
140
group membership so group information can be used to create a custom logon script using
141
141
the <a class="link" href="smb.conf.5.html#ROOTPREEXEC" target="_top">root preexec</a> parameters to the <em class="parameter"><code>NETLOGON</code></em> share.
143
<a class="indexterm" name="id2679957"></a>
143
<a class="indexterm" name="id2686019"></a>
144
144
Some sites prefer to use a tool such as <code class="literal">kixstart</code> to establish a controlled
145
145
user environment. In any case, you may wish to do a Google search for logon script process controls.
146
146
In particular, you may wish to explore the use of the Microsoft Knowledge Base article KB189105 that
147
147
deals with how to add printers without user intervention via the logon script process.
148
</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2679977"></a>Profile Migration/Creation</h4></div></div></div><p>
148
</p></div><div class="sect3" title="Profile Migration/Creation"><div class="titlepage"><div><div><h4 class="title"><a name="id2686039"></a>Profile Migration/Creation</h4></div></div></div><p>
149
149
User and group profiles may be migrated using the tools described in the section titled Desktop Profile
152
<a class="indexterm" name="id2679990"></a>
153
<a class="indexterm" name="id2679997"></a>
152
<a class="indexterm" name="id2686052"></a>
153
<a class="indexterm" name="id2686059"></a>
154
154
Profiles may also be managed using the Samba-3 tool <code class="literal">profiles</code>. This tool allows the MS
155
155
Windows NT-style security identifiers (SIDs) that are stored inside the profile
156
156
<code class="filename">NTuser.DAT</code> file to be changed to the SID of the Samba-3 domain.
157
</p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2680021"></a>User and Group Accounts</h4></div></div></div><p>
158
<a class="indexterm" name="id2680029"></a>
159
<a class="indexterm" name="id2680036"></a>
160
<a class="indexterm" name="id2680043"></a>
161
<a class="indexterm" name="id2680050"></a>
157
</p></div><div class="sect3" title="User and Group Accounts"><div class="titlepage"><div><div><h4 class="title"><a name="id2686083"></a>User and Group Accounts</h4></div></div></div><p>
158
<a class="indexterm" name="id2686091"></a>
159
<a class="indexterm" name="id2686098"></a>
160
<a class="indexterm" name="id2686105"></a>
161
<a class="indexterm" name="id2686112"></a>
162
162
It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before
163
163
attempting to migrate user and group accounts, you are STRONGLY advised to create in Samba-3 the
164
164
groups that are present on the MS Windows NT4 domain <span class="emphasis"><em>AND</em></span> to map them to
165
165
suitable UNIX/Linux groups. By following this simple advice, all user and group attributes
166
166
should migrate painlessly.
167
</p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2680070"></a>Steps in Migration Process</h3></div></div></div><p>
167
</p></div></div><div class="sect2" title="Steps in Migration Process"><div class="titlepage"><div><div><h3 class="title"><a name="id2686132"></a>Steps in Migration Process</h3></div></div></div><p>
168
168
The approximate migration process is described below.
169
</p><div class="itemizedlist"><ul type="disc"><li><p>
169
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
170
170
You have an NT4 PDC that has the users, groups, policies, and profiles to be migrated.
172
<a class="indexterm" name="id2680092"></a>
173
<a class="indexterm" name="id2680098"></a>
174
<a class="indexterm" name="id2680105"></a>
171
</p></li><li class="listitem"><p>
172
<a class="indexterm" name="id2686153"></a>
173
<a class="indexterm" name="id2686160"></a>
174
<a class="indexterm" name="id2686167"></a>
175
175
Samba-3 is set up as a domain controller with netlogon share, profile share, and so on. Configure the <code class="filename">smb.conf</code> file
176
176
to function as a BDC: <em class="parameter"><code>domain master = No</code></em>.
177
</p></li></ul></div><div class="procedure"><a name="id2680128"></a><p class="title"><b>Procedure�36.1.�The Account Migration Process</b></p><a class="indexterm" name="id2680216"></a><ol type="1"><li><p>
178
<a class="indexterm" name="id2680140"></a>
177
</p></li></ul></div><div class="procedure" title="Procedure�36.1.�The Account Migration Process"><a name="id2686190"></a><p class="title"><b>Procedure�36.1.�The Account Migration Process</b></p><a class="indexterm" name="id2686278"></a><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
178
<a class="indexterm" name="id2686201"></a>
179
179
Create a BDC account in the old NT4 domain for the Samba server using NT Server Manager.
180
180
<span class="emphasis"><em>Samba must not be running.</em></span>
182
<a class="indexterm" name="id2680158"></a>
181
</p></li><li class="step" title="Step 2"><p>
182
<a class="indexterm" name="id2686220"></a>
183
183
<strong class="userinput"><code>net rpc join -S <em class="replaceable"><code>NT4PDC</code></em> -w <em class="replaceable"><code>DOMNAME</code></em> -U
184
184
Administrator%<em class="replaceable"><code>passwd</code></em></code></strong>
186
<a class="indexterm" name="id2680192"></a>
185
</p></li><li class="step" title="Step 3"><p>
186
<a class="indexterm" name="id2686254"></a>
187
187
<strong class="userinput"><code>net rpc vampire -S <em class="replaceable"><code>NT4PDC</code></em> -U
188
188
administrator%<em class="replaceable"><code>passwd</code></em></code></strong>
189
</p></li><li><p><strong class="userinput"><code>pdbedit -L</code></strong></p><p>Note: Did the users migrate?</p></li><li><p>
190
<a class="indexterm" name="id2680244"></a>
191
<a class="indexterm" name="id2680253"></a>
189
</p></li><li class="step" title="Step 4"><p><strong class="userinput"><code>pdbedit -L</code></strong></p><p>Note: Did the users migrate?</p></li><li class="step" title="Step 5"><p>
190
<a class="indexterm" name="id2686305"></a>
191
<a class="indexterm" name="id2686314"></a>
192
192
Now assign each of the UNIX groups to NT groups:
193
193
(It may be useful to copy this text to a script called <code class="filename">initGroups.sh</code>)
194
194
</p><pre class="programlisting">
205
205
net groupmap add ntgroup="Engineers" unixgroup=engineers type=d
206
206
net groupmap add ntgroup="QA Team" unixgroup=qateam type=d
208
</p></li><li><p><strong class="userinput"><code>net groupmap list</code></strong></p><p>Check that all groups are recognized.
208
</p></li><li class="step" title="Step 6"><p><strong class="userinput"><code>net groupmap list</code></strong></p><p>Check that all groups are recognized.
209
209
</p></li></ol></div><p>
210
210
Migrate all the profiles, then migrate all policy files.
211
</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2680306"></a>Migration Options</h2></div></div></div><p>
211
</p></div></div><div class="sect1" title="Migration Options"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2686367"></a>Migration Options</h2></div></div></div><p>
212
212
Sites that wish to migrate from MS Windows NT4 domain control to a Samba-based solution
213
213
generally fit into three basic categories. <a class="link" href="NT4Migration.html#majtypes" title="Table�36.1.�The Three Major Site Types">Following table</a> shows the possibilities.
214
214
</p><div class="table"><a name="majtypes"></a><p class="title"><b>Table�36.1.�The Three Major Site Types</b></p><div class="table-contents"><table summary="The Three Major Site Types" border="1"><colgroup><col align="left"><col align="justify"></colgroup><thead><tr><th align="left">Number of Users</th><th align="justify">Description</th></tr></thead><tbody><tr><td align="left">< 50</td><td align="justify"><p>Want simple conversion with no pain.</p></td></tr><tr><td align="left">50 - 250</td><td align="justify"><p>Want new features; can manage some inhouse complexity.</p></td></tr><tr><td align="left">> 250</td><td align="justify"><p>Solution/implementation must scale well; complex needs.
215
Cross-departmental decision process. Local expertise in most areas.</p></td></tr></tbody></table></div></div><br class="table-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2680392"></a>Planning for Success</h3></div></div></div><p>
215
Cross-departmental decision process. Local expertise in most areas.</p></td></tr></tbody></table></div></div><br class="table-break"><div class="sect2" title="Planning for Success"><div class="titlepage"><div><div><h3 class="title"><a name="id2686454"></a>Planning for Success</h3></div></div></div><p>
216
216
There are three basic choices for sites that intend to migrate from MS Windows NT4
218
</p><div class="itemizedlist"><ul type="disc"><li><p>
218
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
219
219
Simple conversion (total replacement).
220
</p></li><li class="listitem"><p>
221
221
Upgraded conversion (could be one of integration).
222
</p></li><li class="listitem"><p>
223
223
Complete redesign (completely new solution).
224
224
</p></li></ul></div><p>
225
225
Minimize downstream problems by:
226
</p><div class="itemizedlist"><ul type="disc"><li><p>
226
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
227
227
Taking sufficient time.
228
</p></li><li class="listitem"><p>
230
</p></li><li class="listitem"><p>
231
231
Testing all assumptions.
232
</p></li><li class="listitem"><p>
233
233
Testing the full roll-out program, including workstation deployment.
234
234
</p></li></ul></div><p><a class="link" href="NT4Migration.html#natconchoices" title="Table�36.2.�Nature of the Conversion Choices">Following table</a> lists the conversion choices given the type of migration
235
235
being contemplated.
236
</p><div class="table"><a name="natconchoices"></a><p class="title"><b>Table�36.2.�Nature of the Conversion Choices</b></p><div class="table-contents"><table summary="Nature of the Conversion Choices" border="1"><colgroup><col align="justify"><col align="justify"><col align="justify"></colgroup><thead><tr><th align="justify">Simple Install</th><th align="justify">Upgrade Decisions</th><th align="justify">Redesign Decisions</th></tr></thead><tbody><tr><td align="justify"><p>Make use of minimal OS-specific features</p></td><td align="justify"><p>Translate NT4 features to new host OS features</p></td><td align="justify"><p>Improve on NT4 functionality, enhance management capabilities</p></td></tr><tr><td align="justify"><p>Move all accounts from NT4 into Samba-3</p></td><td align="justify"><p>Copy and improve</p></td><td align="justify"><p>Authentication regime (database location and access)</p></td></tr><tr><td align="justify"><p>Make least number of operational changes</p></td><td align="justify"><p>Make progressive improvements</p></td><td align="justify"><p>Desktop management methods</p></td></tr><tr><td align="justify"><p>Take least amount of time to migrate</p></td><td align="justify"><p>Minimize user impact</p></td><td align="justify"><p>Better control of Desktops/Users</p></td></tr><tr><td align="justify"><p>Live versus isolated conversion</p></td><td align="justify"><p>Maximize functionality</p></td><td align="justify"><p>Identify Needs for: <span class="emphasis"><em>Manageability, Scalability, Security, Availability</em></span></p></td></tr><tr><td align="justify"><p>Integrate Samba-3, then migrate while users are active, then change of control (swap out)</p></td><td align="justify"><p>Take advantage of lower maintenance opportunity</p></td><td align="justify"><p></p></td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2680625"></a>Samba-3 Implementation Choices</h3></div></div></div><div class="variablelist"><dl><dt><span class="term">Authentication Database/Backend</span></dt><dd><p>
236
</p><div class="table"><a name="natconchoices"></a><p class="title"><b>Table�36.2.�Nature of the Conversion Choices</b></p><div class="table-contents"><table summary="Nature of the Conversion Choices" border="1"><colgroup><col align="justify"><col align="justify"><col align="justify"></colgroup><thead><tr><th align="justify">Simple Install</th><th align="justify">Upgrade Decisions</th><th align="justify">Redesign Decisions</th></tr></thead><tbody><tr><td align="justify"><p>Make use of minimal OS-specific features</p></td><td align="justify"><p>Translate NT4 features to new host OS features</p></td><td align="justify"><p>Improve on NT4 functionality, enhance management capabilities</p></td></tr><tr><td align="justify"><p>Move all accounts from NT4 into Samba-3</p></td><td align="justify"><p>Copy and improve</p></td><td align="justify"><p>Authentication regime (database location and access)</p></td></tr><tr><td align="justify"><p>Make least number of operational changes</p></td><td align="justify"><p>Make progressive improvements</p></td><td align="justify"><p>Desktop management methods</p></td></tr><tr><td align="justify"><p>Take least amount of time to migrate</p></td><td align="justify"><p>Minimize user impact</p></td><td align="justify"><p>Better control of Desktops/Users</p></td></tr><tr><td align="justify"><p>Live versus isolated conversion</p></td><td align="justify"><p>Maximize functionality</p></td><td align="justify"><p>Identify Needs for: <span class="emphasis"><em>Manageability, Scalability, Security, Availability</em></span></p></td></tr><tr><td align="justify"><p>Integrate Samba-3, then migrate while users are active, then change of control (swap out)</p></td><td align="justify"><p>Take advantage of lower maintenance opportunity</p></td><td align="justify"><p></p></td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" title="Samba-3 Implementation Choices"><div class="titlepage"><div><div><h3 class="title"><a name="id2686687"></a>Samba-3 Implementation Choices</h3></div></div></div><div class="variablelist"><dl><dt><span class="term">Authentication Database/Backend</span></dt><dd><p>
237
237
Samba-3 can use an external authentication backend:
239
</p><div class="itemizedlist"><ul type="disc"><li><p>Winbind (external Samba or NT4/200x server).</p></li><li><p>External server could use Active Directory or NT4 domain.</p></li><li><p>Can use pam_mkhomedir.so to autocreate home directories.</p></li><li><p> Samba-3 can use a local authentication backend: <em class="parameter"><code>smbpasswd</code></em>,
239
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Winbind (external Samba or NT4/200x server).</p></li><li class="listitem"><p>External server could use Active Directory or NT4 domain.</p></li><li class="listitem"><p>Can use pam_mkhomedir.so to autocreate home directories.</p></li><li class="listitem"><p> Samba-3 can use a local authentication backend: <em class="parameter"><code>smbpasswd</code></em>,
240
240
<em class="parameter"><code>tdbsam</code></em>, <em class="parameter"><code>ldapsam</code></em>
241
241
</p></li></ul></div></dd><dt><span class="term">Access Control Points</span></dt><dd><p>
242
242
Samba permits Access Control points to be set:
243
</p><a class="indexterm" name="id2680699"></a><a class="indexterm" name="id2680706"></a><a class="indexterm" name="id2680712"></a><a class="indexterm" name="id2680719"></a><div class="itemizedlist"><ul type="disc"><li><p>On the share itself using share ACLs.</p></li><li><p>On the file system using UNIX permissions on files and directories.</p><p>Note: Can enable Posix ACLs in file system also.</p></li><li><p>Through Samba share parameters not recommended except as last resort.</p></li></ul></div></dd><dt><span class="term">Policies (migrate or create new ones)</span></dt><dd><p>
244
<a class="indexterm" name="id2680767"></a>
245
<a class="indexterm" name="id2680774"></a>
243
</p><a class="indexterm" name="id2686760"></a><a class="indexterm" name="id2686767"></a><a class="indexterm" name="id2686774"></a><a class="indexterm" name="id2686781"></a><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>On the share itself using share ACLs.</p></li><li class="listitem"><p>On the file system using UNIX permissions on files and directories.</p><p>Note: Can enable Posix ACLs in file system also.</p></li><li class="listitem"><p>Through Samba share parameters not recommended except as last resort.</p></li></ul></div></dd><dt><span class="term">Policies (migrate or create new ones)</span></dt><dd><p>
244
<a class="indexterm" name="id2686829"></a>
245
<a class="indexterm" name="id2686835"></a>
246
246
Exercise great caution when making registry changes; use the right tool and be aware
247
247
that changes made through NT4-style <code class="filename">NTConfig.POL</code> files can leave
248
248
permanent changes.
249
<a class="indexterm" name="id2680790"></a>
250
<a class="indexterm" name="id2680796"></a>
251
<a class="indexterm" name="id2680803"></a>
252
</p><div class="itemizedlist"><ul type="disc"><li><p>Using Group Policy Editor (NT4).</p></li><li><p>Watch out for tattoo effect.</p></li></ul></div></dd><dt><span class="term">User and Group Profiles</span></dt><dd><p>
253
<a class="indexterm" name="id2680835"></a>
254
<a class="indexterm" name="id2680841"></a>
249
<a class="indexterm" name="id2686851"></a>
250
<a class="indexterm" name="id2686858"></a>
251
<a class="indexterm" name="id2686865"></a>
252
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Using Group Policy Editor (NT4).</p></li><li class="listitem"><p>Watch out for tattoo effect.</p></li></ul></div></dd><dt><span class="term">User and Group Profiles</span></dt><dd><p>
253
<a class="indexterm" name="id2686896"></a>
254
<a class="indexterm" name="id2686903"></a>
255
255
Platform-specific, so use platform tool to change from a local to a roaming profile.
256
256
Can use new profiles tool to change SIDs (<code class="filename">NTUser.DAT</code>).
257
257
</p></dd><dt><span class="term">Logon Scripts</span></dt><dd><p>
258
258
Know how they work.
259
259
</p></dd><dt><span class="term">User and Group Mapping to UNIX/Linux</span></dt><dd><p>
260
<a class="indexterm" name="id2680880"></a>
260
<a class="indexterm" name="id2686941"></a>
261
261
User and group mapping code is new. Many problems have been experienced as network administrators
262
262
who are familiar with Samba-2.2.x migrate to Samba-3. Carefully study the chapters that document
263
263
the new password backend behavior and the new group mapping functionality.
264
</p><div class="itemizedlist"><ul type="disc"><li><p>The <em class="parameter"><code>username map</code></em> facility may be needed.</p></li><li><p>Use <code class="literal">net groupmap</code> to connect NT4 groups to UNIX groups.</p></li><li><p>
264
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>The <em class="parameter"><code>username map</code></em> facility may be needed.</p></li><li class="listitem"><p>Use <code class="literal">net groupmap</code> to connect NT4 groups to UNIX groups.</p></li><li class="listitem"><p>
265
265
Use <code class="literal">pdbedit</code> to set/change user configuration.
267
267
When migrating to LDAP backend, it may be easier to dump the initial
270
270
Every operating system has its peculiarities. These are the result of engineering decisions
271
271
that were based on the experience of the designer and may have side effects that were not
272
272
anticipated. Limitations that may bite the Windows network administrator include:
273
</p><div class="itemizedlist"><ul type="disc"><li><p>Add/Delete Users: Note OS limits on size of name
274
(Linux 8 chars, NT4 up to 254 chars).</p></li><li><p>Add/Delete Machines: Applied only to domain members
275
(Note: machine names may be limited to 16 characters).</p></li><li><p>Use <code class="literal">net groupmap</code> to connect NT4 groups to UNIX groups.</p></li><li><p>Add/Delete Groups: Note OS limits on size and nature.
273
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Add/Delete Users: Note OS limits on size of name
274
(Linux 8 chars, NT4 up to 254 chars).</p></li><li class="listitem"><p>Add/Delete Machines: Applied only to domain members
275
(Note: machine names may be limited to 16 characters).</p></li><li class="listitem"><p>Use <code class="literal">net groupmap</code> to connect NT4 groups to UNIX groups.</p></li><li class="listitem"><p>Add/Delete Groups: Note OS limits on size and nature.
276
276
Linux limit is 16 char, no spaces, and no uppercase chars (<code class="literal">groupadd</code>).</p></li></ul></div></dd><dt><span class="term">Migration Tools</span></dt><dd><p>
277
<a class="indexterm" name="id2680997"></a>
277
<a class="indexterm" name="id2687059"></a>
278
278
Domain Control (NT4-Style) Profiles, Policies, Access Controls, Security
279
</p><div class="itemizedlist"><ul type="disc"><li><p>Samba: <code class="literal">net, rpcclient, smbpasswd, pdbedit, profiles</code></p></li><li><p>Windows: <code class="literal">NT4 Domain User Manager, Server Manager (NEXUS)</code></p></li></ul></div></dd></dl></div></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="upgrading-to-3.0.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="migration.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="SWAT.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�35.�Updating and Upgrading Samba�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�37.�SWAT: The Samba Web Administration Tool</td></tr></table></div></body></html>
279
</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Samba: <code class="literal">net, rpcclient, smbpasswd, pdbedit, profiles</code></p></li><li class="listitem"><p>Windows: <code class="literal">NT4 Domain User Manager, Server Manager (NEXUS)</code></p></li></ul></div></dd></dl></div></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="upgrading-to-3.0.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="migration.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="SWAT.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�35.�Updating and Upgrading Samba�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�37.�SWAT: The Samba Web Administration Tool</td></tr></table></div></body></html>
added
removed
docs/htmldocs/Samba3-HOWTO/NT4Migration.html
