Re: [Samba] Re: XP "logon failure" but still logs on -- no roamingprofile
> > Okay. I guess the next thing to do is try with a fresh installation and
> > then see if it occurs again as elements get added.
>
> our setup... xp-pro (pre sp1) and office2k, local profiles only,
> sign-or-seal; no problems so far.
I didn't have any troubles with local profiles either. My hope was to set
up all the Windoze boxes like the unix ones which would allow everyone to
log in to any machine and get their standard account (though with a speed
penalty since the home directory would be mounted over the network instead
of on the local drive).
We don't have that now on the Win98 boxes and doesn't seem to be much of
a problem, but I'd like to try...
> > Thanks. I've noticed that XP has provisions for requiring passwords to
> > be changed, but didn't look in to it at all. Perhaps a small script which
> > sets the necessary registry entries?
>
> I'm trying to generate more interest in using already builtin Xp policy
> options/features. Why re-invent the wheel? Have you been following this
> thread? comments?...
> Re: [Samba] gpedit.msc as centralized policy for 2k/xp clients
I'm afraid it's all pretty much Greek to me. I have very little understanding
of how group policies work.
Brian
( [EMAIL PROTECTED] )
---
Two roads diverged in a wood, and I -- I took the one less traveled by,
And that has made all the difference. ("The Road Not Taken" -- Robert Frost)
--
To unsubscribe from this list go to the following URL and read the
instructions: http://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Re: XP "logon failure" but still logs on -- no roamingprofile
> Okay. I guess the next thing to do is try with a fresh installation and > then see if it occurs again as elements get added. our setup... xp-pro (pre sp1) and office2k, local profiles only, sign-or-seal; no problems so far. > > Thanks. I've noticed that XP has provisions for requiring passwords to > be changed, but didn't look in to it at all. Perhaps a small script which > sets the necessary registry entries? I'm trying to generate more interest in using already builtin Xp policy options/features. Why re-invent the wheel? Have you been following this thread? comments?... Re: [Samba] gpedit.msc as centralized policy for 2k/xp clients > Our password-expiration policy here involves me going around once seen Xp password expire in group/local policy? > a year and beating on people's heads to give me new passwords which I then > enter in to a program that goes and changes them in the half-dozen or so > places where it's stored: nis, samba, mysql, windoze, etc. ...maybe ldap or mysql password database since you already have it? saw a module for it somewhere... regards, Richard Coates. -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Re: XP "logon failure" but still logs on -- no roamingprofile
> I remember another post where applying the "critical updates" was
> actually the cause of the problem!? can't remember all the details..but
> something about auto-application making incorrect assumptions.
> hope this is of some help, regards
Okay. I guess the next thing to do is try with a fresh installation and
then see if it occurs again as elements get added. Since this was my
first attempt at using XP (or any networking of an NT kernel, for that
matter) it didn't really follow any strategy.
It has had a few software packages installed on it and CygWin to boot (I'm
trying to get Amanda to work). It's possible that one of these is causing
a local file access conflict.
> ps: I like your ideas in logon.bat. Do you have any suggestions/ideas on
> the best way to implement password-age, password-history in Xp/samba
> domain?
Thanks. I've noticed that XP has provisions for requiring passwords to
be changed, but didn't look in to it at all. Perhaps a small script which
sets the necessary registry entries?
Our password-expiration policy here involves me going around once
a year and beating on people's heads to give me new passwords which I then
enter in to a program that goes and changes them in the half-dozen or so
places where it's stored: nis, samba, mysql, windoze, etc.
Brian
( [EMAIL PROTECTED] )
---
Two roads diverged in a wood, and I -- I took the one less traveled by,
And that has made all the difference. ("The Road Not Taken" -- Robert Frost)
--
To unsubscribe from this list go to the following URL and read the
instructions: http://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Re: XP "logon failure" but still logs on -- no roamingprofile
Brian, Did you try a plain and simple logon.bat first, like - @ECHO OFF NET USE X: \\share\tmp /persistent:no - just to make sure your logon.bat isn't faulty ? You could even use a "logoff.bat" (net use * /delete ...) if you suspect the mapped drives to cause the errors. > net use o: \\share\office2000p /persistent:no /yes Wonder what's the /yes switch for, doesn't seem to be documented in the XP net use "manual page" (?) > net time \\share /set /yes At least on Win2k workstations your users need power user privileges to change or set time service settings. As local administrator do the following: - net stop w32time (in case the service is running) - net time /setsntp:192.168.x.x - net start w32time (and/or change service start type) Any errors or warnings in your workstations logs? The XP/Win2k profile issue has been discussed in recent threads, so we added "nt acl support = No" to stop local caching of roaming profiles in our Win2k only domain: [netlogon] comment = ... path = /usr/local/samba/netlogon root preexec = /usr/local/samba/scripts/genlogon.pl %u %g %m root postexec = /usr/local/samba/scripts/genlogoff.pl %u read only = No browseable = No guest ok = Yes locking = No [profile] comment = ... path = /profile/NT5 read only = No guest ok = No browseable = No # fix for Win2k >= SP2: nt acl support = No # fix for XP >= SP1: #csc policy = disable #share modes = No Good luck, Uli -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Re: XP "logon failure" but still logs on -- no roamingprofile
I remember another post where applying the "critical updates" was actually the cause of the problem!? can't remember all the details..but something about auto-application making incorrect assumptions. hope this is of some help, regards Richard Coates. ps: I like your ideas in logon.bat. Do you have any suggestions/ideas on the best way to implement password-age, password-history in Xp/samba domain? On Wed, 2003-03-12 at 04:13, Brian White wrote: > > so if you reboot you get a successful logon? xp -pre sp1 ? > > Usually, yes. I did get one case where it did not but the computer had been > on for a while before I tried to log on. > > SP1 was installed. I just did another update of all critical updatecritical > updatess but > it made no difference. After I reboot, I could logon, logoff, logon, logoff, > but the third time I tried to logon, I got the error. > > On a hunch, I tried removing everything from the logon.bat script. It > didn't help, though. After a reboot, I could logon/off three times and > then I started getting the error. Continuing logon/logoff sequences shows > no discernable pattern, though it only fails about 1/2 to 1/3 of the tries. > > After restoring the content of the logon.bat file, the logon process fails > much more often but not every time. I began to wonder if it had something > to do with network activity/idle periods since when I was typing results > in to this message, it seemed that the next logon attempt would work. > > Taking a more patient approach to this, I've discovered that the problem is > at least somewhat related to how long I stay logged in. With the full > login.bat content (because it makes the problem more obvious) I've discovered > that: > > - Logout immediately after logon (waiting for logon.bat to complete first) >causes a logon failure every time. > > - Waiting 20 seconds after a logon failure before logout will ensure that >the next logon attempt is successful. Waiting only 10 seconds is not >enough. The next logon attempt(after one that was successful) will fail >even if I again wait over 30 _minutes_ before logout. > > - Waiting at the "press CTRL-ALT-DELETE to logon" prompt, even up to 60 >seconds, does not help; it fails every time. > > Attached is the "logon.bat" file renamed to "logon.txt" so it doesn't get > stripped by any virus scanners. In addition to mapping a number of network > drives, it also tries to map H: to /home/userid (if it exists) or to the > users home computer on the network if they're logging in to a different > machine (sort of like a unix automounter would do for home directories on > different machines). > > Brian > ( [EMAIL PROTECTED] ) > > --- >Tired of spam? See what you can do to fight it at: http://www.cauce.org/ > > > :-net accounts /forcelogoff:no /minpwlen:4 /minpwage:0 /maxpwage:unlimited > /uniquepw:5 > > :- > :- Mount the home directory > :- > net use h: /d > subst h: /d > > if exist C:\Home\%USERNAME%\nul.x goto localhome > > :nethome > call "%USERPROFILE%\Network\homedir.bat" > goto donehome > > :localhome > subst h: C:\Home\%USERNAME% > mkdir "%USERPROFILE%\Network" > echo net use h: \\%COMPUTERNAME%\home\%USERNAME% /persistent:no /yes > >"%USERPROFILE%\Network\homedir.bat" > goto donehome > > :donehome > > > :- > :- Mount network drives > :- > net use o: \\share\office2000p /persistent:no /yes > net use p: \\share\precidia /persistent:no /yes > net use s: \\share\win32 /persistent:no /yes > net use t: \\ftp\ftp /persistent:no /yes > net use x: \\share\tmp /persistent:no /yes > > > :- > :- Set some environment variables > :- > mkdir C:\tmp\%USERNAME% > s:\bin\setx TEMP C:\tmp\%USERNAME% > s:\bin\setx TMP C:\tmp\%USERNAME% > :- s:\bin\setx HOMEDRIVE H: > > > :- > :- Update the computers clock > :- > net time \\share /set /yes > > > > > -- > To unsubscribe from this list go to the following URL and read the > instructions: http://lists.samba.org/mailman/listinfo/samba -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
Re: [Samba] Re: XP "logon failure" but still logs on -- no roamingprofile
> hmmm..did you try running ...tcpdump -i eth0 ..on your samba box?
> (assuming eth0 is samba lan interface?) then you can "see" what is
> happening at the time..
> regards
Okay... Done. Below is the tcpdump from the time that I got the
error dialog while logging in until I initiated the logoff. It's
about 240kB uncompressed (40kB compressed).
http://bcwhite.dhs.org/~bcwhite/tcp.smbd-logoff_delay.gz
However, in summary...
There is pretty much constant traffic between "watertown" (the client) and
"griffon" (the server) up until:
[...]
18:36:00.011222 griffon.ott.precidia.com.netbios-ssn >
watertown.ott.precidia.com.4451: S 3794220794:3794220794(0) ack 3
18:36:00.011512 griffon.ott.precidia.com.netbios-ssn >
watertown.ott.precidia.com.4451: S 3794220794:3794220794(0) ack 3
18:36:00.011772 watertown.ott.precidia.com.4451 >
griffon.ott.precidia.com.netbios-ssn: R 3385513384:3385513384(0) win 0
18:36:00.424875 watertown.ott.precidia.com.netbios-dgm > 10.0.3.63.netbios-dgm:
18:36:07.211433 griffon.ott.precidia.com.www > watertown.ott.precidia.com.4454: F
837:837(0) ack 305 win 5840 (DF)
18:36:07.211750 griffon.ott.precidia.com.www > watertown.ott.precidia.com.4454: F
837:837(0) ack 305 win 5840 (DF)
18:36:07.212011 watertown.ott.precidia.com.4454 > griffon.ott.precidia.com.www: . ack
838 win 16684 (DF)
There are a few spurts of activity after that:
18:36:10.642363 watertown.ott.precidia.com.4450 > griffon.ott.precidia.com.445: P
18696:18741(45) ack 18030 win 16129 (D
18:36:10.646248 griffon.ott.precidia.com.445 > watertown.ott.precidia.com.4450: P
18030:18069(39) ack 18741 win 2224 (DF
18:36:10.646558 griffon.ott.precidia.com.445 > watertown.ott.precidia.com.4450: P
18030:18069(39) ack 18741 win 2224 (DF
18:36:10.766491 watertown.ott.precidia.com.4450 > griffon.ott.precidia.com.445: . ack
18069 win 16090 (DF)
18:36:11.463568 watertown.ott.precidia.com.4450 > griffon.ott.precidia.com.445: P
18741:18841(100) ack 18069 win 16090 (
18:36:11.497609 griffon.ott.precidia.com.445 > watertown.ott.precidia.com.4450: P
18069:18108(39) ack 18841 win 2224 (DF
18:36:11.497914 griffon.ott.precidia.com.445 > watertown.ott.precidia.com.4450: P
18069:18108(39) ack 18841 win 2224 (DF
18:36:11.669477 watertown.ott.precidia.com.4450 > griffon.ott.precidia.com.445: . ack
18108 win 17520 (DF)
18:36:11.731450 griffon1.ott.precidia.com.route > 10.0.3.63.route: RIPv1-resp [items
8]: {10.0.2.64}(2) {10.0.2.128}(2)
18:36:11.731741 griffon1.ott.precidia.com.route > 10.0.3.63.route: RIPv1-resp [items
8]: {10.0.2.64}(2) {10.0.2.128}(2)
Then there is a delay until I start the logoff procedure:
18:36:20.664208 watertown.ott.precidia.com.4450 > griffon.ott.precidia.com.445: P
18841:18884(43) ack 18108 win 17520 (D
18:36:20.666867 griffon.ott.precidia.com.445 > watertown.ott.precidia.com.4450: P
18108:18151(43) ack 18884 win 2224 (DF
18:36:20.667168 griffon.ott.precidia.com.445 > watertown.ott.precidia.com.4450: P
18108:18151(43) ack 18884 win 2224 (DF
18:36:20.667428 watertown.ott.precidia.com.4450 > griffon.ott.precidia.com.445: P
18884:18923(39) ack 18151 win 17477 (D
18:36:20.670643 griffon.ott.precidia.com.445 > watertown.ott.precidia.com.4450: P
18151:18190(39) ack 18923 win 2224 (DF
18:36:20.670941 griffon.ott.precidia.com.445 > watertown.ott.precidia.com.4450: P
18151:18190(39) ack 18923 win 2224 (DF
18:36:20.799476 watertown.ott.precidia.com.4450 > griffon.ott.precidia.com.445: . ack
18190 win 17438 (DF)
18:36:22.141603 watertown.ott.precidia.com.4450 > griffon.ott.precidia.com.445: P
18923:19023(100) ack 18190 win 17438 (
18:36:22.149477 griffon.ott.precidia.com.445 > watertown.ott.precidia.com.4450: P
18190:18297(107) ack 19023 win 2224 (D
18:36:22.149785 griffon.ott.precidia.com.445 > watertown.ott.precidia.com.4450: P
18190:18297(107) ack 19023 win 2224 (D
18:36:22.150432 watertown.ott.precidia.com.4450 > griffon.ott.precidia.com.445: P
19023:19163(140) ack 18297 win 17331 (
18:36:22.162845 griffon.ott.precidia.com.445 > watertown.ott.precidia.com.4450: P
18297:18348(51) ack 19163 win 2224 (DF
[...]
In this case, I counted 25 seconds before logging off since things seemed
to be running a bit slower (probably due to having the log level set to 20)
and didn't work the first time when I only waited 20 seconds. It might
be related to idle time on the network before beginning logout.
I correlated these times to the log.smbd file (4060kB uncompressed,
215kB compressed), which I've placed here:
http://bcwhite.dhs.org/~bcwhite/tcp.smbd-logoff_delay.gz
The end of the login sequence is:
[2003/03/14 18:35:59, 10] lib/util_sock.c:read_smb_length_return_keepalive(539)
got smb length of 41
[2003/03/14 18:35:59, 6] smbd/process.c:process_smb(859)
got message type 0x0 of len 0x29
[2003/03/14 18:35:59, 3] smbd/process.c:process_smb(860)
Transaction 2235 of length 45
[...]
The next blips of traffic are: (nothing shows for 18:36:07)
[2003/03/14 18:36:10, 10] lib/util_sock.c:rea
Re: [Samba] Re: XP "logon failure" but still logs on -- no roamingprofile
hmmm..did you try running ...tcpdump -i eth0 ..on your samba box? (assuming eth0 is samba lan interface?) then you can "see" what is happening at the time.. regards Richard Coates. On Wed, 2003-03-12 at 04:13, Brian White wrote: > > so if you reboot you get a successful logon? xp -pre sp1 ? > > Usually, yes. I did get one case where it did not but the computer had been > on for a while before I tried to log on. > > SP1 was installed. I just did another update of all critical updates but > it made no difference. After I reboot, I could logon, logoff, logon, logoff, > but the third time I tried to logon, I got the error. > > On a hunch, I tried removing everything from the logon.bat script. It > didn't help, though. After a reboot, I could logon/off three times and > then I started getting the error. Continuing logon/logoff sequences shows > no discernable pattern, though it only fails about 1/2 to 1/3 of the tries. > > After restoring the content of the logon.bat file, the logon process fails > much more often but not every time. I began to wonder if it had something > to do with network activity/idle periods since when I was typing results > in to this message, it seemed that the next logon attempt would work. > > Taking a more patient approach to this, I've discovered that the problem is > at least somewhat related to how long I stay logged in. With the full > login.bat content (because it makes the problem more obvious) I've discovered > that: > > - Logout immediately after logon (waiting for logon.bat to complete first) >causes a logon failure every time. > > - Waiting 20 seconds after a logon failure before logout will ensure that >the next logon attempt is successful. Waiting only 10 seconds is not >enough. The next logon attempt(after one that was successful) will fail >even if I again wait over 30 _minutes_ before logout. > > - Waiting at the "press CTRL-ALT-DELETE to logon" prompt, even up to 60 >seconds, does not help; it fails every time. > > Attached is the "logon.bat" file renamed to "logon.txt" so it doesn't get > stripped by any virus scanners. In addition to mapping a number of network > drives, it also tries to map H: to /home/userid (if it exists) or to the > users home computer on the network if they're logging in to a different > machine (sort of like a unix automounter would do for home directories on > different machines). > > Brian > ( [EMAIL PROTECTED] ) > > --- >Tired of spam? See what you can do to fight it at: http://www.cauce.org/ > > > :-net accounts /forcelogoff:no /minpwlen:4 /minpwage:0 /maxpwage:unlimited > /uniquepw:5 > > :- > :- Mount the home directory > :- > net use h: /d > subst h: /d > > if exist C:\Home\%USERNAME%\nul.x goto localhome > > :nethome > call "%USERPROFILE%\Network\homedir.bat" > goto donehome > > :localhome > subst h: C:\Home\%USERNAME% > mkdir "%USERPROFILE%\Network" > echo net use h: \\%COMPUTERNAME%\home\%USERNAME% /persistent:no /yes > >"%USERPROFILE%\Network\homedir.bat" > goto donehome > > :donehome > > > :- > :- Mount network drives > :- > net use o: \\share\office2000p /persistent:no /yes > net use p: \\share\precidia /persistent:no /yes > net use s: \\share\win32 /persistent:no /yes > net use t: \\ftp\ftp /persistent:no /yes > net use x: \\share\tmp /persistent:no /yes > > > :- > :- Set some environment variables > :- > mkdir C:\tmp\%USERNAME% > s:\bin\setx TEMP C:\tmp\%USERNAME% > s:\bin\setx TMP C:\tmp\%USERNAME% > :- s:\bin\setx HOMEDRIVE H: > > > :- > :- Update the computers clock > :- > net time \\share /set /yes > > > > > -- > To unsubscribe from this list go to the following URL and read the > instructions: http://lists.samba.org/mailman/listinfo/samba -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
[Samba] Re: XP "logon failure" but still logs on -- no roamingprofile
> so if you reboot you get a successful logon? xp -pre sp1 ? Usually, yes. I did get one case where it did not but the computer had been on for a while before I tried to log on. SP1 was installed. I just did another update of all critical updates but it made no difference. After I reboot, I could logon, logoff, logon, logoff, but the third time I tried to logon, I got the error. On a hunch, I tried removing everything from the logon.bat script. It didn't help, though. After a reboot, I could logon/off three times and then I started getting the error. Continuing logon/logoff sequences shows no discernable pattern, though it only fails about 1/2 to 1/3 of the tries. After restoring the content of the logon.bat file, the logon process fails much more often but not every time. I began to wonder if it had something to do with network activity/idle periods since when I was typing results in to this message, it seemed that the next logon attempt would work. Taking a more patient approach to this, I've discovered that the problem is at least somewhat related to how long I stay logged in. With the full login.bat content (because it makes the problem more obvious) I've discovered that: - Logout immediately after logon (waiting for logon.bat to complete first) causes a logon failure every time. - Waiting 20 seconds after a logon failure before logout will ensure that the next logon attempt is successful. Waiting only 10 seconds is not enough. The next logon attempt(after one that was successful) will fail even if I again wait over 30 _minutes_ before logout. - Waiting at the "press CTRL-ALT-DELETE to logon" prompt, even up to 60 seconds, does not help; it fails every time. Attached is the "logon.bat" file renamed to "logon.txt" so it doesn't get stripped by any virus scanners. In addition to mapping a number of network drives, it also tries to map H: to /home/userid (if it exists) or to the users home computer on the network if they're logging in to a different machine (sort of like a unix automounter would do for home directories on different machines). Brian ( [EMAIL PROTECTED] ) --- Tired of spam? See what you can do to fight it at: http://www.cauce.org/:-net accounts /forcelogoff:no /minpwlen:4 /minpwage:0 /maxpwage:unlimited /uniquepw:5 :- :- Mount the home directory :- net use h: /d subst h: /d if exist C:\Home\%USERNAME%\nul.x goto localhome :nethome call "%USERPROFILE%\Network\homedir.bat" goto donehome :localhome subst h: C:\Home\%USERNAME% mkdir "%USERPROFILE%\Network" echo net use h: \\%COMPUTERNAME%\home\%USERNAME% /persistent:no /yes >"%USERPROFILE%\Network\homedir.bat" goto donehome :donehome :- :- Mount network drives :- net use o: \\share\office2000p /persistent:no /yes net use p: \\share\precidia /persistent:no /yes net use s: \\share\win32 /persistent:no /yes net use t: \\ftp\ftp /persistent:no /yes net use x: \\share\tmp /persistent:no /yes :- :- Set some environment variables :- mkdir C:\tmp\%USERNAME% s:\bin\setx TEMP C:\tmp\%USERNAME% s:\bin\setx TMP C:\tmp\%USERNAME% :- s:\bin\setx HOMEDRIVE H: :- :- Update the computers clock :- net time \\share /set /yes -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
[Samba] Re: XP "logon failure" but still logs on -- no roamingprofile
> sorry I've deleted your original message... ahh maybe we need to start > again. Could I suggest you follow the diagnostic procedure in the docs. > From memory its diagnosis.txt ..its very logical and explains things as > you go. Then we'll have something to go on. Attached is the original message I posted (including the links to the log file captures I made). >From the Diagnosis File (everything looks good to me) ~~ Test1: no errors (one warning about some share names being longer than 8 characters) Test2: Both machines can ping the other (time=0.5ms). Test3: Anonymous login successful (no password). All shares are shown. The client can map and access all drives. Test4: Primary IP address of server is returned. The client sits on a second ethernet card and thus different subnet that the primary address, but this doesn't seem to make any difference. The server has no firewall rules and forwards all packets between interfaces. Test5: The client IP address is returned correctly. Test6: This did a broadcast test on the primary ethernet interface and thus received responses from the two servers (the local machine and one other) instead of a response from the client on the second ethernet subnet. I added a "-B 10.0.3.63" (6 bit subnet) and then received a response from the client XP machine. Test7: Connection to "tmp" works with both anonymous (guest) login and for a real userid. Test8: The "net view" works when logged in to the XP client as me, but not when logged in as Administrator. It also worked when telnetting in to cygwin as root. Test9: Connection to \\BIGSERVER\TMP worked fine though I was not prompted for a password. I was able to create and delete a file from the mapped directory. Test10: The server was found as the master browser. Again, I had to add "-B 10.0.3.63" to get it to look on the secondary ethernet. Test11: The XP client can browse the server and see shares. It sees it under "My Network Places/Entire Network/Microsoft Windows Network/precidia" but I assmue this is correct. Also at the same level as the "precidia" domain is "workgroup" which is the workgroup (not domain) managed by the other server. Clicking on that shows no machines under that workgroup even though the other server knows about many. Brian ( [EMAIL PROTECTED] ) --- Tired of spam? See what you can do to fight it at: http://www.cauce.org/-- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
