#211845 - 2016-08-03 11:09 PM
Upgrade help request for a KiXtart noob
|
rroati
Just in Town
Registered: 2016-07-26
Posts: 3
Loc: AZ, USA
|
Hello KiXtart,
We have been using a KiX script for years. Unfortunately, the KiX experts here have long ago moved on.
We are using (don't laugh) Version 4.02 to map secure and user drives to server and CIF shares based on group membership.
I would like to update us to the latest version.
In the netlogon share\scripts folder there is a logon.bat with the following information:
@echo off
%0\..\Prov-Kix32 logon.kix
In the same folder there are three files:
kix32.exe
Prov-KIX32.exe
WKIX32.exe
and logon.kix, of course.
All three .exe files are dated 10/2/2007.
I read the kix2010_460.doc and it indicates that all you need to do to upgrade is to replace kix32.exe.
I wonder if that is the situation with us?
Thanks for any help you can provide!
Thanks,
RRoati
|
|
Top
|
|
|
|
|
#211848 - 2016-08-04 02:06 AM
Re: Upgrade help request for a KiXtart noob
[Re: Lonkero]
|
rroati
Just in Town
Registered: 2016-07-26
Posts: 3
Loc: AZ, USA
|
Thanks a bunch, Lonkero.
So, 4.02 should work to map drives for Windows 10 clients, for example?
That would be good to hear!
And then, as to whether "everything works." Well. We have an added wrinkle that we built an EMC Linux CIF Server recently.
The Storage guys say we can't have individual shares for each user on the CIF, like we did previously, since we have many more users on the CIF than a single server would have.
Having that many individual shares would bog down the CIF, they say.
So, we share the Users folder and map each user to their folder below the Users share.
The UNC path works all the way to the individual user folder, but sometimes users don't get the individual drive mapped properly.
We weren't sure if an upgrade would resolve this issue or if we should think about all this in a different way.
Thanks again for any help you can provide!
Cheers,
RRoati
|
|
Top
|
|
|
|
|
#211852 - 2016-08-04 12:44 PM
Re: Upgrade help request for a KiXtart noob
[Re: Lonkero]
|
Glenn Barnas
KiX Supporter
Registered: 2003-01-28
Posts: 4403
Loc: New Jersey
|
If you're dealing with remnants of a legacy (NT 3/4) environment with individual shares for the user home folders, I would follow Microsoft's recommendation for securing the Users folder at the NTFS level - Remove the Users access, then grant Users Read/Execute to the Users Folder, subfolders, & files; Create Folders/Append Data to the folder and subfolders; Create files/write data to subfolders only. (sounds counter-intuitive). Make sure that each folder follows the user's login ID. Modify the user profile to remove their home folder definition & save. Modify the user profile again to add the user profile as \\server\users\%USERNAME% (with the environment variable). You will be notified that the home folder(s) exist and be prompted to set the permissions/take ownership - say Yes.
This will set the permissions on each folder, granting the user Full Control (the ONLY time a non-admin account should ever be given Full Control!) The other Users permissions will be removed, leaving only the user, Administrator, and SYSTEM - all with Full Control. (Creator Owner may be present with special permissions.)
This folder will be mapped automatically during logon without any login script assistance. I actually wrote significant code around this to NOT map the home folder during logon, but look it up in AD and map it when run after a logon (like manually invoking the logon script after making a VPN connection).
You can then script the removal of all of the shares. If the folders don't follow the userID names, that can be scripted as well - just prior to the profile updates. I've done this for large organizations - over 25,000 users - over a day or 2.
Glenn
_________________________
Actually I am a Rocket Scientist! 
|
|
Top
|
|
|
|
|
#211860 - 2016-08-05 07:21 PM
Re: Upgrade help request for a KiXtart noob
[Re: Lonkero]
|
rroati
Just in Town
Registered: 2016-07-26
Posts: 3
Loc: AZ, USA
|
These posts are reassuring. The UNC paths work, the NTFS permissions are as stated by Glenn Barnas, we have set the AD profile path for each user, and it sounds like there is no need for us to upgrade our version of kiXtart.
I did misstate something above - on the CIF server, we are sharing the OU folder, rather than Users or Secure. So, if an OU is ABC01, and has Secure and Users folders below it, ABC01 is the share. Users have full access share permissions and read NTFS permissions to the ABC01 share, and read NTFS access to Secure and Users, then full NTFS to their own folders under Users (inherit is disinherited to remove the other users). Does that make sense? Sorry for the mistype. Does it change any of the advice above?
I have one remaining question. Is the fact that we are using Prov-kix32.exe related to the fact that we are using @HOMESHR in the script, or is this done commonly?
For example, here is the script for one OU on the CIF:
;**********************************************************
; Arizona - Tucson Operations - El Dorado
;**********************************************************
IF INGROUP("AZ_TUS_Users") OR INGROUP("AZ_TUS2_Users") OR INGROUP("AZ_TUS3_Users")
? "You are now in the Western\Arizona\Tucson Operations - El Dorado Office"
? "Setting Time"
SetTime "\\DC01"
? "Setting Home Directory"
use u: @HOMESHR
ENDIF
? "Mapping Drives . . ."
use t: "\\Pdprv00nascif01\TUS03\Secure\"
ENDIF
Thanks so much for all of your help!
RRoati
|
|
Top
|
|
|
|
|
#211866 - 2016-08-07 03:56 AM
Re: Upgrade help request for a KiXtart noob
[Re: ShaneEP]
|
Glenn Barnas
KiX Supporter
Registered: 2003-01-28
Posts: 4403
Loc: New Jersey
|
Mapping @HOMESHR is mostly unnecessary - it its defined in the user profile, it should map auto-magically.
You SHOULD remove the reference to SetTime - this was for Wintendo (WFW and Win-9x) platforms that did not know how to sync with a DC. All of the domain-aware platforms since Server 2000 and XP auto-sync time and you should not force time-sync during logon.
Minor thing - "?" is a substitute for @CRLF, which is usually placed at the end of a line. It's not a "print" command (like the old BASIC interpreters). If you put it first, you will leave the cursor hanging at the end of a line when the script ends, which might make a difference if other commands that follow (or the bat file running the Kix script) outputs anything.
Glenn
PS - If you are thinking about OU-based mapping, look at the login script on my site. We provide mapping by group, subnet, OU, Computer-OU, AD Site, user and more, and extend most of those options with the ability to dynamically change the UNC - for example, a single drive mapping can dynamically switch the UNC Path based on site, ou, subnet and more via a lookup table. The full user guide is available, and the script is free for small organizations (under 5 domain controllers) and "damn cheap" for everyone else.
_________________________
Actually I am a Rocket Scientist!
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
0 registered
and 1202 anonymous users online.
|
|
|
