Windowsの移動ユーザープロファイル - 版の履歴

Meisina04: /* Windows ACLを使用する */

2019-03-03T12:24:55Z

Windows ACLを使用する

← 古い版		2019年3月3日 (日) 21:24時点における版
61行目:		61行目:
	* 新しいシェアを作成してください。詳細については、[[Windows ACLs を利用して共有を設定する]]を参照してください。以下の権限を設定します。		* 新しいシェアを作成してください。詳細については、[[Windows ACLs を利用して共有を設定する]]を参照してください。以下の権限を設定します。

	:* ~~Share permissi~~:		:* 共有の権限:
	::{\| class="wikitable"		::{\| class="wikitable"
	!Principal		!Principal
105行目:		105行目:

	These settings enable members of the <code>Domain Users</code> group to store their roaming profiles on the share, without being able to access other user's profiles. Members of the <code>Domain Admins</code> group are able to access all directories on the share.		These settings enable members of the <code>Domain Users</code> group to store their roaming profiles on the share, without being able to access other user's profiles. Members of the <code>Domain Admins</code> group are able to access all directories on the share.



	== Using POSIX ACLs on a Unix domain member ==		== Using POSIX ACLs on a Unix domain member ==

Meisina04: /* Setting up the Share on the Samba File Server */

2019-03-03T04:01:38Z

Setting up the Share on the Samba File Server

← 古い版		2019年3月3日 (日) 13:01時点における版
53行目:		53行目:
	\\server\profiles\user_name		\\server\profiles\user_name

	= ~~Setting up the Share on the Samba File Server~~ =		= Sambaファイルサーバーで共有を設定する =

	== ~~Using~~ Windows ~~ACLs~~ ==		== Windows ACLを使用する ==

	~~To create a share, for example,~~ <code>profiles</code> ~~for hosting the roaming profiles on a Samba file server:~~		Sambaファイルサーバーでローミングプロファイルをホストするための<code>profiles</code>のように、共有を作成するには、次の手順を実行します。

	* ~~Create a new share. For details, see~~ [[~~Setting up a Share Using~~ Windows ACLs]]~~. Set the following permissions:~~		* 新しいシェアを作成してください。詳細については、[[Windows ACLs を利用して共有を設定する]]を参照してください。以下の権限を設定します。

	:* Share ~~permissions~~:		:* Share permissi:
	::{\| class="wikitable"		::{\| class="wikitable"
	!Principal		!Principal
146行目:		146行目:

	# smbcontrol all reload-config		# smbcontrol all reload-config





	= Assigning a Roaming Profile to a User =		= Assigning a Roaming Profile to a User =

Meisina04: /* Windows Roaming Profile Versions */

2019-03-03T03:30:03Z

Windows Roaming Profile Versions

← 古い版		2019年3月3日 (日) 12:30時点における版
5行目:		5行目:
	ローミングユーザープロファイルを使用する場合、ユーザーがログインすると、プロファイルのコピーがサーバーからWindowsドメインメンバーにダウンロードされます。ユーザーがログアウトするまで、すべての設定はローカルコピーに保存され、更新されます。ログアウト中に、プロファイルがサーバーにアップロードされます。		ローミングユーザープロファイルを使用する場合、ユーザーがログインすると、プロファイルのコピーがサーバーからWindowsドメインメンバーにダウンロードされます。ユーザーがログアウトするまで、すべての設定はローカルコピーに保存され、更新されます。ログアウト中に、プロファイルがサーバーにアップロードされます。

	= ~~Windows Roaming Profile Versions~~ =		= Windows移動プロファイルのバージョン =

	~~Depending on the operating system version, Windows uses separate profile folders for a user to support Windows version-specific features. Version 2 profiles and later append the~~ <code>.V*</code> ~~suffix to the user's profile folder.~~		オペレーティングシステムのバージョンに応じて、WindowsはユーザーがWindowsのバージョン固有の機能をサポートするために別々のプロファイルフォルダを使用します。バージョン2以降のプロファイルでは、ユーザーのプロファイルフォルダに<code>.V*</code>という接尾辞が追加されます。

	~~The following Windows profile versions exist~~:		以下のWindowsプロファイルバージョンが存在します。:

	:{\| class="wikitable"		:{\| class="wikitable"
48行目:		48行目:
	\|}		\|}

	: <nowiki>*</nowiki> ~~Using the default settings, Windows~~ 8.~~1 and Windows~~ Server 2012 ~~R2 use V3 profiles. However, the profiles are incompatible with Windows~~ 8.~~0 and Windows~~ Server ~~2012. For this reason it is recommended that you configure Windows~~ 8.~~1 and Windows~~ Server 2012 ~~R2 to use V4 profiles. For further details, see:~~ [https://support.microsoft.com/en-us/help/2890783/incompatibility-between-windows-8.1-roaming-user-profiles-and-those-in-earlier-versions-of-windows ~~Incompatibility between~~ Windows 8.~~1 roaming user profiles and those in earlier versions of Windows~~].		: <nowiki>*</nowiki>デフォルト設定を使用すると、Windows 8.1およびWindows Server 2012 R2はV3プロファイルを使用します。ただし、プロファイルはWindows 8.0およびWindows Server 2012とは互換性がありません。このため、Windows 8.1およびWindows Server 2012 R2をV4プロファイルを使用するように構成することをお勧めします。詳細については、以下を参照してください。[https://support.microsoft.com/en-us/help/2890783/incompatibility-between-windows-8.1-roaming-user-profiles-and-those-in-earlier-versions-of-windows Windows 8.1ローミングユーザープロファイルと以前のバージョンのWindowsのユーザープロファイルとの間の非互換性]。

	~~When you set the profile path for a user, you always set the path without any version suffix. For example~~:		ユーザーのプロファイルパスを設定するときは、必ずバージョンサフィックスを付けずにパスを設定します。例えば:
	\\server\profiles\user_name		\\server\profiles\user_name





	= Setting up the Share on the Samba File Server =		= Setting up the Share on the Samba File Server =

Meisina04: /* Introduction */

2019-03-03T03:24:41Z

Introduction

← 古い版		2019年3月3日 (日) 12:24時点における版
1行目:		1行目:
	= ~~Introduction~~ =		= はじめに =

	A Windows profile is a set of files that contains all settings of a user including per-user configuration files and registry settings. In an Active Directory or NT4 domain you can set that the profile of a user is stored on a server. This enables the user to log on to different Windows domain members and use the same settings.

	When using roaming user profiles, a copy of the profile is downloaded from the server to the Windows domain member when a user logs into. Until the user logs out, all settings are stored and updated in the local copy. During the log out, the profile is uploaded to the server.



			Windowsプロファイルは、ユーザーごとの構成ファイルやレジストリ設定など、ユーザーのすべての設定を含む一連のファイルです。 Active DirectoryまたはNT4ドメインでは、ユーザーのプロファイルをサーバーに保存するように設定できます。これにより、ユーザーは異なるWindowsドメインメンバーにログオンして同じ設定を使用できます。

			ローミングユーザープロファイルを使用する場合、ユーザーがログインすると、プロファイルのコピーがサーバーからWindowsドメインメンバーにダウンロードされます。ユーザーがログアウトするまで、すべての設定はローカルコピーに保存され、更新されます。ログアウト中に、プロファイルがサーバーにアップロードされます。

	= Windows Roaming Profile Versions =		= Windows Roaming Profile Versions =

Meisina04: ページの作成:「= Introduction = A Windows profile is a set of files that contains all settings of a user including per-user configuration files and registry settings. In an Active Dire…」

2019-03-02T16:08:43Z

ページの作成:「= Introduction = A Windows profile is a set of files that contains all settings of a user including per-user configuration files and registry settings. In an Active Dire…」

新規ページ

= Introduction =

A Windows profile is a set of files that contains all settings of a user including per-user configuration files and registry settings. In an Active Directory or NT4 domain you can set that the profile of a user is stored on a server. This enables the user to log on to different Windows domain members and use the same settings.

When using roaming user profiles, a copy of the profile is downloaded from the server to the Windows domain member when a user logs into. Until the user logs out, all settings are stored and updated in the local copy. During the log out, the profile is uploaded to the server.

= Windows Roaming Profile Versions =

Depending on the operating system version, Windows uses separate profile folders for a user to support Windows version-specific features. Version 2 profiles and later append the <code>.V*</code> suffix to the user's profile folder.

The following Windows profile versions exist:

:{| class="wikitable"
!Windows Client OS Version
!Windows Server OS Version
!Profile Suffix
!Example Profile Folder Name
|-
|Windows NT 4.0 - Windows Vista
|Windows NT Server 4.0 - Windows Server 2008
|''none''
|user
|-
|Windows 7
|Windows Server 2008 R2
|V2
|user.V2
|-
|Windows 8.0 - 8.1*
|Windows Server 2012 - 2012 R2*
|V3
|user.V3
|-
|Windows 8.1*
|Windows Server 2012 R2*
|V4
|user.V4
|-
|Windows 10 (1507 to 1511)
|Windows Server 2016
|V5
|user.V5
|-
|Windows 10 (1607 and later)
|
|V6
|user.V6
|}

: <nowiki>*</nowiki> Using the default settings, Windows 8.1 and Windows Server 2012 R2 use V3 profiles. However, the profiles are incompatible with Windows 8.0 and Windows Server 2012. For this reason it is recommended that you configure Windows 8.1 and Windows Server 2012 R2 to use V4 profiles. For further details, see: [https://support.microsoft.com/en-us/help/2890783/incompatibility-between-windows-8.1-roaming-user-profiles-and-those-in-earlier-versions-of-windows Incompatibility between Windows 8.1 roaming user profiles and those in earlier versions of Windows].

When you set the profile path for a user, you always set the path without any version suffix. For example:
\\server\profiles\user_name

= Setting up the Share on the Samba File Server =

== Using Windows ACLs ==

To create a share, for example, <code>profiles</code> for hosting the roaming profiles on a Samba file server:

* Create a new share. For details, see [[Setting up a Share Using Windows ACLs]]. Set the following permissions:

:* Share permissions:
::{| class="wikitable"
!Principal
!Access
|-
|Domain Users
|Change
|-
|Domain Admins
|Full Control
|}

:* File system permissions on the root of the <code>profiles</code> share:

::{| class="wikitable"
!Principal
!Access
!Applies to
|- style="vertical-align:top;"
|Domain Users *
|Traverse folder / execute file<br />List folder / read data<br />Create folder / append data
|This folder only
|-
|CREATOR OWNER
|Full control
|Subfolders and files only
|-
|Domain Admins
|Full control
|This folder, subfolders and files
|-
|SYSTEM **
|Full control
|This folder, subfolders and files
|}
::<nowiki>*</nowiki> You can alternatively set other groups, to enable the group members to store their user profile on the share. When using different groups, apply the permissions as displayed for <code>Domain Users</code> in the previous example.

::<nowiki>**</nowiki> For details, see [[The SYSTEM Account]].

:: Verify that permission inheritance is disabled on the root of the share. If any permission entry in the <code>Advanced Security Settings</code> window displays a path in the <code>Inherited from</code> column, click the <code>Disable inheritance</code> button. On Windows 7, unselect the <code>Include inheritable permissions from this object's parent</code> check box to set the same setting.

::[[Image:Profiles_Folder_File_System_ACLs.png]]

These settings enable members of the <code>Domain Users</code> group to store their roaming profiles on the share, without being able to access other user's profiles. Members of the <code>Domain Admins</code> group are able to access all directories on the share.

== Using POSIX ACLs on a Unix domain member ==

On a Unix domain member server, you can set up the <code>profiles</code> share using POSIX ACLs instead of using Windows access control lists (ACL). This will not work on a Samba Active Directory Controller.

{{Imbox
| type = warning
| text = When setting up the share on a Samba Active Directory (AD) domain controller (DC), you cannot use POSIX ACLs. On an Samba DC, only shares using extended ACLs are supported. For further details, see [[Setting_up_a_Share_Using_Windows_ACLs#Enable_Extended_ACL_Support_in_the_smb.conf_File|Enable Extended ACL Support in the smb.conf File]]. To set up the share on a Samba AD DC, see [[#Using_Windows_ACLs|Setting up the Profiles Share on the Samba File Server - Using Windows ACLs]].
}}

* Add the following share configuration section to your <code>smb.conf</code> file:

[profiles]
comment = Users profiles
path = /srv/samba/profiles/
browseable = No
read only = No
force create mode = 0600
force directory mode = 0700
csc policy = disable
store dos attributes = yes
vfs objects = acl_xattr

: For details about the parameters used, see the descriptions in the <code>smb.conf(5)</code> man page.

* Create the directory and set permissions:

# mkdir -p /srv/samba/profiles/
# chgrp -R "Domain Users" /srv/samba/profiles/
# chmod 1750 /srv/samba/profiles/

: These settings enable members of the <code>Domain Users</code> group to store their roaming profiles on the share, without being able to access other user's profiles. Alternatively, you can set a different group.

* Reload Samba:

# smbcontrol all reload-config

= Assigning a Roaming Profile to a User =

Depending on the Windows version, Windows uses different folders to store the roaming profile of a user. However, when you set the profile path for a user, you always set the path to the folder without any version suffix. For example:
\\server\profiles\user_name

For further details, see [[#The_Windows_Roaming_Profile_Versions|The Windows Roaming Profile Versions]].

Note that you must not set a trailing backslash.

== In an Active Directory ==

=== Using <code>Active Directory Users and Computers</code> ===

In an Active Directory, you can use the <code>Active Directory Users and Computers</code> Windows application to set the path to the user's profile folder. If you do not have the Remote Server Administration Tools (RSAT) installed, see [[Installing RSAT|Installing RSAT]].

To assign <code>\\server\profiles\demo</code> as profile folder to the <code>demo</code> account:

* Log in to a computer using an account that is enabled to edit user accounts.

* Open the <code>Active Directory Users and Computers</code> application.

* Navigate to the directory container that contains the <code>demo</code> account.

* Right-click to the <code>demo</code> user account and select <code>Properties</code>.

* Select the <code>Profile</code> tab.

* Fill the path to the home folder into the <code>Profile path</code> field.
: Set the path always without any profile version suffix and without trailing backslash. For details, see [[#The_Windows_Roaming_Profile_Versions|The Windows Roaming Profile Versions]].

:[[Image:ADUC_Set_Profile_Folder.png]].

* Click <code>OK</code>.

The setting is applied the next time the user logs in.

=== Using a Group Policy Object ===

Using group policy objects (GPO), you can assign settings to organizational units (OU) or to a domain. This enables you, for example, to automatically assign profile paths to all users that log on to a computer that is a member of the OU or domain. If you move the computer to a different OU or domain, the setting is removed or updated. Using this way, you do not have to assign manually the settings to each user account.

{{Imbox
| type = note
| text = Windows only supports assigning a profile path using GPOs on a per-computer basis. This means that the path is also applied to local users on domain members, which have no access to the profile share. To set the profile path on a per-user basis, see [[#Using_Active_Directory_Users_and_Computers|Using Active Directory Users and Computers]].
}}

To create a group policy object (GPO) for the domain that automatically assigns the <code>\\server\path\''user_name''</code> path to every user that logs on to a Windows domain member:

* Log in to a computer using an account that is allowed to edit group policies, such as the AD domain <code>Administrator</code> account.

* Open the <code>Group Policy Management Console</code>. If you are not having the Remote Server Administration Tools (RSAT) installed on this computer, see [[Installing RSAT|Installing RSAT]].

* Right-click to your AD domain and select <code>Create a GPO in this domain, and Link it here</code>.

:[[Image:GPMC_Create_GPO.png]]

* Enter a name for the GPO, such as <code>Profiles on ''server''</code>. The new GPO is shown below the domain entry.

* Right-click to the newly-created GPO and select <code>Edit</code> to open the <code>Group Policy Management Editor</code>.

* Navigate to the <code>Computer Configuration</code> → <code>Policies</code> → <code>Administrative Templates</code> → <code>System</code> → <code>User Profiles</code> entry.

* Double-click the <code>Set roaming profile path for all users logging onto this computer</code> policy to edit:

:* Enable the policy and set the profile path. For example:

\\server\profiles\%USERNAME%

:: Windows replaces the <code>%USERNAME%</code> variable with the user name during login. Set the path without trailing backslash.

::[[Image:GPME_Set_Profiles_Properties.png]]

:* Click <code>OK</code>.

* Close the <code>Group Policy Management Editor</code>. The GPOs are automatically saved on the <code>Sysvol</code> share on the domain controller (DC).

* Close the <code>Group Policy Management Console</code>.

The GPO is applied at the next reboot of the Windows domain members or when they reload the group policies.

=== Using <code>ldbedit</code> on a Domain Controller ===

On a domain controller (DC), to assign, for example, the <code>\\server\profiles\demo\</code> path as profile folder to the <code>demo</code> account:

* Edit the <code>demo</code> user account:

# ldbedit -H /usr/local/samba/private/sam.ldb 'sAMAccountName=demo'

* The accounts attributes are displayed in an editor. Append the following attribute and value to the end of the list:

profilePath: \\server\profiles\demo

: You must not set a trailing backslash to the path.

* Save the changes.

The setting is applied the next time the user logs in.

== In an NT4 Domain ==

In an Samba NT4 domain, to set <code>\\server\profiles\%U</code> as path to the profile folder:

* Add the following parameter to the <code>[global]</code> section in your <code>smb.conf</code> file:

logon path = \\%L\Profiles\%U

: During logging in to the domain member, Samba automatically replaces the <code>%U</code> variable with the session user name. For further details, see the <code>Variable Substitutions</code> section in the <code>smb.conf(5)</code> man page.

* Reload Samba:

# smbcontrol all reload-config

= Configuring Windows Profile Folder Redirections =

See [[Configuring Windows Profile Folder Redirections]].