Windows User Home Folders

Introduction

Home folders contain files of an individual account. Using Samba, you can share the directories to enable network users to store own files on their home folder on the file server.

This documentation does not use the Samba built-in [homes] section that dynamically shares the user's home directory using the \\server\user_name\ path. While this can be helpful in certain scenarios, it has some disadvantages:

• Windows does not support this feature, and certain settings, such as folder redirection in an Active Directory (AD), require a workaround instead and you cannot use the official solution.
• You must create each new user's home directory manually.
• The [homes] feature is not supported running on a Samba Active Directory (AD) domain controller (DC).

In the following, the directory containing the home folders are shared using the users share name. Each user's home directory is created as a subdirectory on the \\server\users\ share, such as, \\server\users\user_name. This is the same format used in a Microsoft Windows environment and requires no additional work to set up.

Setting up the Share on the Samba File Server

Using Windows ACLs

Setting extended access control lists (ACL) on the share that hosts home directories enables you to create new users in the Active Directory Users and Computers application without manually creating the user's home folder and setting permissions.

To create the users share on the Samba file server:

• Set up the users share. For details, see Setting up a Share Using Windows ACLs. Set the following permissions:

• Share permissions:

Principal	Access
Authenticated Users	Read & execute
Domain Admins	Full control

• File system permissions on the root of the users share:

• Share permissions:

Principal	Access	Applies to
Authenticated Users	Read & execute	This folder only
CREATOR OWNER	Full control	Subfolders and files only
Domain Admins	Full control	This folder, subfolders and files

Additionally, disable the inheritance of permissions from the parent folder by clicking the Disable inheritance button.

These settings enable members of the Domain Admins group to set the user home folder in the Active Directory Users and Computers application, that automatically creates the home folder and sets the correct permissions.

Using POSIX ACLs

When using POSIX access control lists (ACL) to set permissions, you must create the home directory for each new user manually and set permissions.

When setting up the share on a Samba Active Directory (AD) domain controller (DC), you cannot use POSIX ACLs. On an Samba DC, only shares using extended ACLs are supported. For further details, see Enable Extended ACL Support in the smb.conf File. To set up the share on a Samba AD DC, see Setting up the Home Folder Share on the Samba File Server - Using Windows ACLs.

To create the users share on the Samba file server:

• Add the following share configuration section to your smb.conf file:

 [users]
         path = /srv/samba/users/
         read only = no
         force create mode = 0600
         force directory mode = 0700

Do not use homes as name of the share. For further details, see Introduction.

• Create the directory and set the correct permissions:

# mkdir -p /srv/samba/users/
# chgrp -R "Domain Users" /srv/samba/users/
# chmod 2750 /srv/samba/users/

• Reload Samba:

# smbcontrol all reload-config

Creating the Home Folder for a New User

Using Windows ACLs

If you are using the Active Directory Users and Computers application, the user's home directory is automatically created and the correct permissions applied when you set the path to the user folder in the application. If you are not using Active Directory Users and Computers, you must create the folder manually and set the correct permissions. For example:

• Log in to a Windows machine using an account that has permissions to create new folders on the \\server\users\ share.

• Navigate to the \\server\users\ share.

• Create a new home folder for the user.

• Add the user to the access control list (ACL) of the folder and grant Full control to the user. For details, see Setting ACLs on a Folder.

Using POSIX ACLs

When you set up the users share using POSIX access control lists (ACL), you must create the home folder for each new user manually. To create the home folder for the demo user:

• Create the directory:

# mkdir /srv/samba/users/demo/

• Set the following permissions to only enable the demo user to access the directory:

# chown user_name /srv/samba/users/demo/
# chmod 700 /srv/samba/users/demo/

Assigning a Home Folder to a User

In an Active Directory

Using Active Directory Users and Computers

In an Active Directory, you can use the Active Directory Users and Computers Windows application to set the path to the user home folder and the assigned drive letter. If you are not having the Remote Server Administration Tools (RSAT) installed, see Installing RSAT.

To assign the \\server\users\demo\ path as home folder to the demo account:

• Log in to a computer using an account that is enabled to edit user permissions.

• Open the Active Directory Users and Computers application.

• Navigate to the directory container that contains the demo account.

• Right-click to the demo user account and select Properties.

• Select the Profile tab.

• Select Connect, the drive letter Windows assigns the mapped home folder to, and enter the path to the home folder into the To field.

.

• Click OK.

If a warning is displayed when saving the settings that the home folder was not created:

• the permissions on the users share were incorrectly set when you set up the share using Windows access control lists (ACL). To fix the problem, set the permissions described in Using Windows ACLs.
• you set up the share using POSIX ACL. To fix the problem, create the directory manually. See Creating the Home Folder for a New User - Using POSIX ACLs.

Using a Group Policy Preference

Using group policy preferences, you can assign settings to organizational units (OU) or the domain. This enables you, for example, to automatically assign home folder paths to each user in this OU or domain, and to dynamically change the settings by moving the user to different OU or domain. In this case, you do not have to assign the settings to each user account individually.

To create a group policy object (GPO) for the domain that automatically assigns the \\server\users\user_name path to each user:

• Log in to a computer using an account that is allowed you to edit group policies, such as the AD domain Administrator account.

• Open the Group Policy Management Console. If you are not having the Remote Server Administration Tools (RSAT) installed on this computer, see Installing RSAT.

• Right-click to your AD domain and select Create a GPO in this domain, and Link it here.

• Enter a name for the GPO, such as Home folders on server. The new GPO is shown below the domain entry.

• Right-click to the newly-created GPO and select Edit to open the Group Policy Management Editor.

• Navigate to the User Configuration → Preferences → Windows Settings → Drive Maps entry.

• Right-click to the Drive Maps entry and select New → Mapped Drive.

• Set the following:

• On the General tab:

• Action: Create
• Location: \\server\users\%LogonUser%

Windows automatically replaces the %LogonUser% variable when a user logs in

• Select Reconnect
• Label: Enter a string. For example: Home
• Use: Select a drive letter the home folder is mapped to.

• On the Common tab:

• Select Run in logged-on user's security context (user policy option)

• Click OK.

• Close the Group Policy Management Editor. The GPOs are automatically saved on the Sysvol share on the domain controller (DC).

• Close the Group Policy Management Console.

The policy is applied to users in the OU or domain, the policy is assigned to, during the next log in.

Using ldbedit on the Domain Controller

On a domain controller (DC), for example, to assign the \\server\users\demo path as home folder to the demo account and set the assigned drive letter to H:

• Edit the demouser account:

# ldbedit -H /usr/local/samba/private/sam.ldb 'sAMAccountName=demo'

• The accounts attributes are displayed in an editor. Append the following attributes and values to the end of the list:

homeDrive: H:
homeDirectory: \\server\users\demo\

• Save the changes.

In an NT4 Domain

In an Samba NT4 domain, to set \\server\users\%U as path to the home folder and to map the drive to the H: drive letter:

• Add the following parameters to the [global] section in your smb.conf file:

logon drive = H:
logon home = \\server\users\%U

During logging in to the domain member, Samba automatically replaces the %U variable with the session user name. For further details, see the Variable Substitutions section in the smb.conf(5) man page.

• Reload Samba:

# smbcontrol all reload-config