Windows XP and Samba

by R.M. Schneider
last update 24 May 2004

This document describes our experiences in making Windows XP and Samba to work together for

• file and printer serving, and
• primary domain control. 

This information is not easily found in one place, and therefore this page has been created to provide that information source.  The information covered here works for Samba 2.27.

We have not yet upgraded to Samba 3.x.

Windows XP Service Pack 1 broke some Samba configurations.  See “Failure to Load Roaming Profile after XP Service Pack 1 Update”.  Microsoft plans XP Service Pack 2 for release in July 2004.  It is not yet known by us the impact of this Service Pack on Samba.

Contents

Windows XP and Samba. 1

Contents. 1

News: 12 May 2004:  Microsoft Update Breaks Samba. 1

Introduction to Samba. 2

Basic Configuration of Samba. 2

Summary of XP Client Configurations. 2

Use XP Professional not XP Home. 2

Network "Sign or Seal" Registry Change. 3

Domain Member Policies. 3

Check for Roaming Profile Ownership. 3

To Fix Problem with Files being Opened From Samba Server in "read only". 3

Machine Trust Account Required on Samba Server 4

"Joining" a Samba Domain. 4

Re-joining the Domain. 6

Failure to Load Roaming Profile after XP Service Pack 1 Update. 6

Troubleshooting. 7

News: 12 May 2004: Microsoft Update Breaks Samba

According to The Inquirer, Microsoft update MS04-012 (KB828741) breaks Samba.  The Samba team has released updates.

According to the Inquirer, after applying this Microsoft "fix" to their systems, users that access Samba file servers - most of which run a version of Unix or Linux - suddenly found it impossible to change passwords from windows machines, when prompted to do so as passwords start expiring.  As a result of the operation, they get the friendly message "You do not have permission to change your password".

Described in the Knowledge Base article KB828741, the update changes how Windows deals with passwords, plugging a security hole and breaking critical Samba compatibility in the process

See Samba upgrade 3.0.4 and 2.2.9

Introduction to Samba

Samba is an Open Source/Free Software suite that provides file and print services to SMB/CIFS clients.  SMB is used by Windows machine.   For many organisations, Samba can replace or supplement the use of Windows servers for file and print services.  Samba can also act as a network domain controller for Windows machines.

Samba is freely available under the GNU General Public License.  Samba is included with most Linux distributions, and is available from its home page at http://www.samba.org.  Samba is also used in Apple OS/X and some Unix products.

Basic Configuration of Samba

The basic configuration of Samba is well documented by documents included with Samba, various books, articles, etc.  See Samba Documentation.

A particularly good article about Samba as a Primary Domain Controller by Tom Syroid, is published by IBM.  See this link for all articles on Samba published by IBM.

Summary of XP Client Configurations

The following summarises the special configuration on XP machine required to connect to Samba servers.

Use XP Professional not XP Home

Microsoft XP Home does not have the required software to enable "joining" a network domain.  Microsoft XP Professional does.  If you need to have your computer join a domain, use XP Pro.

However, XP Home will work fine for simple file and printer sharing.  XP Home provides different end-user network utilities for connecting to network resources.  Use of XP Home utilities is not discussed here simply because we have not seen or used XP Home. 

Network "Sign or Seal" Registry Change

The following registry entry needs to be changed:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Netlogon\Parameters]
"requiresignorseal"=dword:00000000
"signsecurechannel"=dword:00000000

Domain Member Policies

1. Run Group Policy editor (gpedit.msc)
2. Computer Configuration \ Windows Settings\ Security Settings \ Local
   Policies \ Security Options:
3. Disable the following:
   Domain Member: Digitally encrypt or sign secure channel data (disable)
   Domain Member: Disable machine account password changes (disable)
   Domain Member: Require strong (Windows 2000 or later) session key (disable).

Check for Roaming Profile Ownership

Used when Samba is configured to provide Primary Domain Control.  See below for details.

1. Run Group Policy editor (gpedit.msc)
2. Select Computer Configuration > Administrative Templates >  System > User Profiles
3. Enable the following:
   Do not check for user ownership of Roaming Profile Folders (Enabled)

(this is also controlled by the Registry key: 

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies \ Microsoft \ Windows \ System]: CompatibleRUPSecurity = dword:00000001

To Fix Problem with Files being Opened From Samba Server in "read only"

In the Samba configuration file  (normally /etc/samba/smb.conf on the Linux server), add a global option

[global]

nt acl support = no

By default Samba sets this "yes".  When set  "yes" when you open files in Windows applications, e.g. Excel, Word, etc. the files are opened in "read only" mode no matter what permissions are applied and controlled by Samba and the Linux server. 

I've not yet researched how this change works or if there are any security implications.  However, it does fix the problem we experienced and is therefore documented here.

Machine Trust Account Required on Samba Server

This is fully documented in the Samba documentation.  It is so important it is being re-stated here.

For Windows XP, an account for the "machine" using it's NETBIOS name plus a "$" is required on the Samba Server in the OS (Linux) and in the Samba password file (smbpasswd).

For example, if the XP machine is named “buckeye”, then the machine account name that you setup on the Linux machine would be “buckeye$”.

Without this account previously setup on the server, it is impossible for the client XP machine to "join" the domain nor access any of the Samba resources.

Note:  as of this writing, I am not certain if these machine accounts are required, or not, for client machines that access the Samba server for simple file and print sharing.  To be investigated.

"Joining" a Samba Domain

After the XP machine has had its machine trust account setup, you can configure the XP machine to "join" the Samba domain.

1. Right mouse click on "MyComputer" and pick "properties.
    
2. Under the tab "Computer Name" run the "Network Identification Wizard", or more simply use the button "change...".
   
   
   
3. Enter the name of the domain here, as configured in smb.conf file on the Samba Server:
   
   
   You will be prompted to enter the ID and password authorised to add your machine to the domain.  Enter the "root' ID and password for the Samba server.  This id will have been previously configured when you setup the Samba server.  Using the XP's Administrator ID and password will not work; simply because this ID is not the authorising agent for access to the Samba domain.

Re-joining the Domain

If you make changes to the domain configuration in Samba, it is likely that the XP boxes will no longer be able to connect to the domain.  You will notice this as a problem when you attempt to login to the domain.  You have to re-configure the XP box to re-join the re-configured domain. This will involve a number of steps with two re-boots.

1. Re-peat the steps to join the domain to reach the "Computer Name" dialog box.
2. Unfortunately, it is not possible to push some button to re-join the existing domain.  You need to attach to a "Workgroup".  Select "Workgroup" button and put in any text in the text box.  Press OK to set, then quit out of the My Computer dialog boxes and re-boot as requested.
3. After the computer restarts, go back to the "Computer Name" dialog and select "Domain" button, and enter the name of the domain.  Press OK to set, then quit out of the My Computer dialog boxes and re-boot as requested.

Failure to Load Roaming Profile after XP Service Pack 1 Update

From http://www.jsifaq.com/SUBL/tip5700/rh5745.htm

Prior to SP1, Windows XP did NOT check the permissions on a pre-existing profile folder when a new roaming profile was created.  This means that when you "upgrade" to SP1, your Samba network connection will fail.

Windows XP Service Pack SP1 checks the permissions on a pre-existing profile folder, to prevent persons other than the user and Administrators from being the owner of the profile folder.

Windows XP Service Pack SP1 checks:

1. If the roaming profile folder does not exist, the folder is created in the usual secure manner.
2. If the Do not check for user ownership of Roaming Profile Folders policy is enabled, permissions on a pre-existing profile folder are NOT checked and assumed to be legitimate.
3. If the folder is owned by the user or the Administrators group, the profile is created.
4. If the folder is NOT owned by the user of the Administrators group, a cached profile or a temporary profile is used,  the user receives the standard temporary profile message, and the following event is logged:

Event ID: 1526
Severity: Error
Windows did not load your roaming profile and is attempting to log you on with your local profile. Changes to the profile will not be copied to the server when you logoff. Windows did not load your profile because a server copy of the profile folder already exists that does not have the correct security. Either the current user or the Administrator's group must be the owner of the folder. Contact your network administrator.

To turn off this new security provision, Enable the Do not check for user ownership of Roaming Profile Folders GPO at Computer Configuration / Administrative Templates / System / User Profiles.  See following screen shot.

(double click on image to get larger view)

If the policy is Not Defined, you can enable it using the registry entry:

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies 

\ Microsoft \ Windows \ System]:

"CompatibleRUPSecurity" = dword:00000001

However it is preferable to use the Policy Editor in Windows to make this registry change.

Troubleshooting

Numerous troubleshooting guides exist for fixing problems related to use of Samba.  Following are some overall suggestions.

• Search Google using the words of the symptoms you experience
• Ensure that firewalls on either the Linux box or the XP box are getting in the way of a successful connection.
• Ensure that DNS and other network configurations are correct and functioning properly.