similar to: samba4 in AD with multiple domains

I'm testing out our samba 4 migration process and when the initial forest/domain was created, it was created without using --use-rfc2307: sudo samba-tool domain provision --domain netdirect --function-level=2008_R2 --realm=ad.netdirect.ca Now that it's in place and we have machines joined, what do I need to do to add the unix attribute and NIS maps to an existing samba4 domain so

I was hoping this would be simpler. I'd like to prepopulate an RODC with all users accounts that are permitted. But I can only pre-populate one at a time: samba-tool rodc preload (<SID>|<DN>|<accountname>) sles-shire:~ # samba-tool group listmembers 'Allowed RODC Password Replication Group - Shire' Allowed RODC Password Replication Group - Global WIN7-SHIRE$ bilbo

We have a couple Samba4 AD domains we've implemented and I've noticed a difference between how users look when created via ADUC versus samba-tool. Created via ADUC, the following extra attributes are added: msSFU30Name: bilbo msSFU30NisDomain: netdirect unixHomeDirectory: /home/bilbo unixUserPassword: ABCD!efgh12345$67890 Created via samba-tool, the following extra attributes are added:

OK! I'm getting farther and farther! :) I've managed to preload user and computer passwords onto a samba RODC: *sles-shire:/var/lib/samba/sysvol # samba-tool rodc preload 'win7-shire$' --server main.adlab.netdirect.ca** *Replicating DN CN=WIN7-SHIRE,CN=Computers,DC=main,DC=adlab,DC=netdirect,DC=ca Exop on[CN=WIN7-SHIRE,CN=Computers,DC=main,DC=adlab,DC=netdirect,DC=ca]

I've configured a new RHEL DC with sernet samba 4.1.4 and a domain just upgraded from classic with an LDAP backend. I need to configure the DC with user accounts and since: * I can't use winbind on a DC * I can't use SSSD with the sernet packages it looks like the best thing to use is LDAP. I've configured it with: authconfig --enableldap --enableldapauth

OK, further to my previous message I've configured BIND, but when I try to run samba_dnsupdate I get the following: Nov 18 16:19:23 sles-shire named[6112]: samba b9_putrr: unhandled record type 0 Nov 18 16:19:24 sles-shire named[6112]: samba_dlz: starting transaction on zone _msdcs.main.adlab.netdirect.ca Nov 18 16:19:24 sles-shire named[6112]: samba_dlz: disallowing update of

Is this a problem? Does this mean no replication links exist? michael at sles-bree:~> samba-tool drs showrepl -k yes Bree\SLES-BREE DSA Options: 0x00000025 DSA object GUID: 7ea641b0-d418-4c74-a4fa-c15b852467b8 DSA invocationId: 1017ff29-756c-4777-b395-b481f4b5387c ==== INBOUND NEIGHBORS ==== ==== OUTBOUND NEIGHBORS ==== ==== KCC CONNECTION OBJECTS ==== Connection -- Connection name:

We've joined an RODC to the domain (Windows 2008R2 running a W2003 FFL/DFL AD) but are getting these errors on first startup. It was joined with: samba-tool domain join main.adlab.netdirect.ca RODC --realm=main.adlab.netdirect.ca --username=administrator at main.adlab.netdirect.ca --dns-backend=BIND9_DLZ but we get these errors right after startup: Nov 28 12:35:27 sles-bree samba[3939]:

I just checked the SOA records on my samba DCs and noticed a few oddities: michael at sles-bree:~> for i in ad{1..4} sles-bree sles-shire; do host -t soa main.adlab.netdirect.ca $i | grep SOA; done main.adlab.netdirect.ca has SOA record ad1.main.adlab.netdirect.ca. hostmaster.main.adlab.netdirect.ca. 177 900 600 86400 3600 main.adlab.netdirect.ca has SOA record ad2.main.adlab.netdirect.ca.

Hello, I'm trying to get samba4 up and running as a DC in a lab environment. I have a freshly installed AD environment (W2012R2 servers, W2008R2 functional level) and I'm trying to join samba4 to it as a domain controller. When I try, I get this: # samba-tool domain join ad.netdirect.ca DC -Uadministrator --realm=AD.NETDIRECT.CA -W AD Finding a writeable DC for domain

I would like to get samba4 working with AD and rfc2307 attributes, while allowing the nice remote management available via samba4. Using sernet-samba packages on 4.1.3-7.el6.x86_64 CentOS 6. I have samba4 configured as follows: krb5.conf: [libdefaults] default_realm = MAIN.ADLAB.NETDIRECT.CA dns_lookup_realm = true dns_lookup_kdc = true ticket_lifetime = 24h renew_lifetime = 7d forwardable =

Oh Boy. User 'Administrator' in your existing directory has SID S-1-5-21-2070472328-935435760-1634736958-1000, expected it to be S-1-5-21-2070472328-935435760-1634736958-500 ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception - ProvisioningError: User 'Administrator' in your existing directory does not have SID ending in -500 It's not all

I'm hitting the 'cannot find stripe size' bug: [2013-04-29 17:42:24.508332] E [stripe-helpers.c:268:stripe_ctx_handle] 0-gv0-stripe-0: Failed to get stripe-size [2013-04-29 17:42:24.513013] W [fuse-bridge.c:968:fuse_err_cbk] 0-glusterfs-fuse: 867: FSYNC() ERR => -1 (Invalid argument) Is there a fix for this in 3.3.1 or do we need to move to git HEAD to make this work? M. --

I've set up a lab for testing Samba 4.1 as an RODC emulating a satellite office setup, using the sernet packages on SLES11SP2. ## Problem 1 samba_dnsupdate is failing: ==> /var/log/samba/log.samba <== [2013/11/18 13:22:37.416193, 0] ../lib/util/util_runcmd.c:317(samba_runcmd_io_handler) /usr/sbin/samba_dnsupdate: ; TSIG error with server: tsig verify failure [2013/11/18

I'm guessing that this is just not implemented yet: http://msdn.microsoft.com/en-us/library/aa746475%28VS.85%29.aspx Specifically, the LDAP_MATCHING_RULE_IN_CHAIN search modifier. I'm trying to do a group membership search via LDAP that traverses subgroups. Against Windows AD I'd use: (memberof:1.2.840.113556.1.4.1941:=(cn=Group1,OU=groupsOU,DC=x)) But that doesn't work against

Hello list, perhaps someone can guide me, finding out what's going wrong in the following scenario (Active Directory , Samba 3.0.20b same with 3.0.28a): CHILD1.CONTOSO.COM <-trusts-> CONTOSO.COM <-trusts->CHILD2.CONTOSO.COM | | | User: CHILD1\testtest | Samba

======================================================== "It is time that we all see gender as a spectrum instead of two sets of opposing ideals. We should stop defining each other by what we are not and start defining ourselves by who we are." Emma Watson ======================================================== Release Announcements --------------------- This is

======================================================== "It is time that we all see gender as a spectrum instead of two sets of opposing ideals. We should stop defining each other by what we are not and start defining ourselves by who we are." Emma Watson ======================================================== Release Announcements --------------------- This is

Hi all, We're still experimenting with the samba3 -> samba4 upgrade. Lot's of nice progression. :-) ANyway: my question is how to deal with the userPrincipalName AD field. The classicupgrade does not fill this field. Reading up on it, tells me that it appears to be required, and should be something like username at samba4.domain Is this correct? How do you generally deal with

Hi all. I have installed Samba 4.5.0 in CentOS 7 for testing Samba AD for my organisation. Almost all is OK, except trusts. When I setup trust on Samba4 domain side, at once GPO stops working. In windows event log on the domain members I see error with event id 1110: "The processing of Group Policy failed. Windows could not determine if the user and computer accounts are in the same forest.