[Samba] Samba-4.3 FreeBSD-10.3 Roaming Profiles and User Home Drive Shares

[James B. Byrne]

We have set up a Samba-4.3 AD-DC on a FreeBSD-10.3 BHyve guest
configured with UFS stoarge. The samba_server is provisioned and we
can join the Domain and configure the server remotely using MMC
snap-ins running on a MS Win-v7Pro workstation.

We are at the point where we are implementing roaming profiles. We
have followed the instructions found at:

https://wiki.samba.org/index.php/Implementing_roaming_profiles

and

https://wiki.samba.org/index.php/Shares_with_Windows_ACLs

And have checked and double checked the ACLs that the ones we have
assigned match exactly those given in the examples. However, when we
create a new test account no roaming profile directory is created.

The contents of our smb4.conf file are:

cat /usr/local/etc/smb4.conf
# Global parameters
[global]
workgroup = BROCKLEY-2016
realm = BROCKLEY-2016.HARTE-LYNE.CA
netbios name = SAMBA-01
server role = active directory domain controller
dns forwarder = 216.185.71.33
idmap_ldb:use rfc2307 = yes

[netlogon]
path = /var/db/samba4/sysvol/brockley-2016.harte-lyne.ca/scripts
read only = No

[sysvol]
path = /var/db/samba4/sysvol
read only = No

[PROFILES]
path = /var/samba4/BROCKLEY-2016/PROFILES/
read only = No

[USERS]
path = /var/samba4/BROCKLEY-2016/USERS/
read only = No


The getfacl utility reports this:

getfacl /var/samba4/BROCKLEY-2016/*
# file: /var/samba4/BROCKLEY-2016/PROFILES
# owner: root
# group: BROCKLEY-2016\domain admins
user::rwx
user:root:rwx
group::---
group:staff:r-x
group:BROCKLEY-2016\domain admins:---
mask::rwx
other::---

# file: /var/samba4/BROCKLEY-2016/USERS
# owner: root
# group: BROCKLEY-2016\domain admins
user::rwx
group::rwx
other::r-x

This is what ls has to say:

ll /var/samba4/BROCKLEY-2016/
total 12
drwxrwx---+ 2 root BROCKLEY-2016\domain admins 512 Jul 20 13:35
PROFILES
drwxrwxr-x 2 root BROCKLEY-2016\domain admins 512 Jul 20 13:35 USERS


We create a new user via the RSAT MMC snap-ins and add the roaming
profile using this string: '\\SAMBA-01\PROFILES\%USERNAME%'. When we
press Apply we get no error but the user's roaming profile directory
is not created. We get the same result whether we have previously set
the UNIX Attributes for the new user or not.

Now, we can create the user's home drive mapping. Using this string:
'\\SAMBA-01\PROFILES\%USERNAME%'. When we map this to U: drive and
press Apply then the USER share sub-directory is created:

ll /var/samba4/BROCKLEY-2016/USERS
total 8
drwxrwxr-x+ 2 BUILTIN\administrators staff 512 Jul 21 10:03 testing4

getfacl /var/samba4/BROCKLEY-2016/USERS/testing4
# file: /var/samba4/BROCKLEY-2016/USERS/testing4
# owner: BUILTIN\administrators
# group: staff
user::rwx
user:BROCKLEY-2016\testing4:rwx
group::r-x
group:staff:r-x
group:BUILTIN\administrators:rwx
mask::rwx
other::r-x

There does not seem to be anything logged in /var/log/samba4 relating
to the event of adding a user and I can find no other log entries
generated anywhere when we add the roaming profile or user home drive
mapping. I am at a loss as to how to proceed at this point.

Is there anything in the set-up of roaming profiles that I have
missed? Is there a configuration option I have over looked? Is the
attempt[t to create the profile logged anywhere? Is there any way of
checking if the server is even making an attempt to create it?

This is the very last bit of configuration that we need to move our
domain off of our Windows server and it seems to me that it must be
something simple that we are overlooking. Can anyone tell me what it
is?

Sincerely,
--
*** e-Mail is NOT a SECURE channel ***
Do NOT transmit sensitive data via e-Mail
Do NOT open attachments nor follow links sent by e-Mail

James B. Byrne mailto:***@Harte-Lyne.ca
Harte & Lyne Limited http://www.harte-lyne.ca
9 Brockley Drive vox: [phone]
Hamilton, Ontario fax: [phone]
Canada L8E 3C3