samba - Apr 2015 - realmd and net rpc privileges

I am running a file server off OEL7.1, domain member in a Windows AD. 
The machine was joined using realm join. Samba version is 4.1.12 from 
the yum repo. I am using SSSD, so no winbind here.
  net rpc rights grant 'SAMDOM\Domain Admins' SeDiskOperatorPrivilege 
-U'SAMDOM\administrator' does not work with the errors described in 
https://wiki.samba.org/index.php/Samba_Member_Server_Troubleshooting , 
but the solution does not work. I get the same errors when trying to 
query the assigned privs.
However, I can set ownership and access from Windows even without the 
SeDiskOperator. What am I missing?

so tell us what are your errors? 

It's hard to help without them. 
Please post your smb.conf ( sanitized ) and your resolv.conf and hosts file. 
and.. 
you can try the command : 
net rpc rights grant 'SAMDOM\Domain Admins' SeDiskOperatorPrivilege
-U'SAMDOM\administrator' -S servername.fqdn

greetz, 

Louis


>-----Oorspronkelijk bericht-----
>Van: sequoiamobil at gmx.net 
>[mailto:samba-bounces at lists.samba.org] Namens Sebastian Gabler
>Verzonden: woensdag 29 april 2015 12:46
>Aan: samba at lists.samba.org
>Onderwerp: [Samba] realmd and net rpc privileges
>
>I am running a file server off OEL7.1, domain member in a Windows AD. 
>The machine was joined using realm join. Samba version is 4.1.12 from 
>the yum repo. I am using SSSD, so no winbind here.
>  net rpc rights grant 'SAMDOM\Domain Admins'
SeDiskOperatorPrivilege
>-U'SAMDOM\administrator' does not work with the errors described in 
>https://wiki.samba.org/index.php/Samba_Member_Server_Troubleshooting , 
>but the solution does not work. I get the same errors when trying to 
>query the assigned privs.
>However, I can set ownership and access from Windows even without the 
>SeDiskOperator. What am I missing?
>-- 
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>
>

Am 29.04.2015 um 12:58 schrieb L.P.H. van Belle:
> so tell us what are your errors?
>
> It's hard to help without them.
> Please post your smb.conf ( sanitized ) and your resolv.conf and hosts
file.
> and..
> you can try the command :
> net rpc rights grant 'SAMDOM\Domain Admins' SeDiskOperatorPrivilege
-U'SAMDOM\administrator' -S servername.fqdn
>
> greetz,
>
> Louis
I am getting the error listed here: 
https://wiki.samba.org/index.php/Samba_Member_Server_Troubleshooting:

# net rpc rights grant 'SAMDOM\Domain Admins' SeDiskOperatorPrivilege 
-U'SAMDOM\administrator'
Enter SAMDOM\administrator's password:
Could not connect to server 127.0.0.1
The username or password was not correct.
Connection failed: NT_STATUS_LOGON_FAILURE

resolv.conf is automatically filled by Network Manager here (which gets 
the settings from the DHCP server, which is the DC in my case)
hosts has no entries besides the localhost defaults for 'lo'
hostname returns the fqdn DNS resolsution and ntp sync are perefectly 
fine. Domain users can log on, and get homes. (I don't care about that 
too much, but it's nice to see it working.)

This is the testparm dump, with '#' comments:

[global]
         realm = MYDOMAIN.LOCAL # here is the actual realm value
         server string = Samba Server Version %v
         security = ADS
         username map = /etc/samba/user.map
         kerberos method = system keytab
         log file = /var/log/samba/log.%m
         max log size = 50
         load printers = No
         printcap name = /dev/null
         idmap config * : backend = tdb
         map acl inherit = Yes
         cups options = raw
         vfs objects = acl_xattr

[Acls] # this is my test share
         path = /srv/samba/acls/
         read only = No
Looking at these, it comes to my attention that there is no idmap on 
that machine (I mean, not as a deamon, not as a command). Could that be 
part of the problem?
in the -S option above, does servername.fqdn refer to the DC or to the 
local machine?
Also,  was puzzled if the PW to enter is the root PW or the Domain Amdin 
PW. I tried both, always.

Best,
Sebastian