samba - Oct 2016 - Error joining Linux member to 4.5.0 DC: Indicates the SID structure is not valid

On 10/20/2016 01:52 PM, Rowland Penny via samba wrote
> Have you given Administrator a uidNumber attribute ?
Yes, I have.
>
> It might still help to see the smb.conf
Here: http://pastebin.com/M9m8x1DZ


This e-mail and any attachments may contain CONFIDENTIAL information, including
PROTECTED HEALTH INFORMATION. If you are not the intended recipient, any use or
disclosure of this information is STRICTLY PROHIBITED; you are requested to
delete this e-mail and any attachments, notify the sender immediately, and
notify the Mediture Privacy Officer at privacyofficer at mediture.com.

On Thu, 20 Oct 2016 14:06:18 -0500
Arthur Ramsey via samba <samba at lists.samba.org> wrote:
> On 10/20/2016 01:52 PM, Rowland Penny via samba wrote
> > Have you given Administrator a uidNumber attribute ?
> Yes, I have.
> >
> > It might still help to see the smb.conf
> 
> Here: http://pastebin.com/M9m8x1DZ
> 
> 
> This e-mail and any attachments may contain CONFIDENTIAL information,
> including PROTECTED HEALTH INFORMATION. If you are not the intended
> recipient, any use or disclosure of this information is STRICTLY
> PROHIBITED; you are requested to delete this e-mail and any
> attachments, notify the sender immediately, and notify the Mediture
> Privacy Officer at privacyofficer at mediture.com.
> 
> 
I would suggest you remove the 'password server' line, this will allow
Samba to find the best DC to use.

I also don't understand why you have a 10 million range for the BUILTIN
users and only a 39,999 range for the domain users.

Other than that, joining with 'net ads join -U Administrator' should
work.

Rowland

On Thu, 20 Oct 2016 20:21:17 +0100
Rowland Penny via samba <samba at lists.samba.org> wrote:
> On Thu, 20 Oct 2016 14:06:18 -0500
> Arthur Ramsey via samba <samba at lists.samba.org> wrote:
> 
> > On 10/20/2016 01:52 PM, Rowland Penny via samba wrote
> > > Have you given Administrator a uidNumber attribute ?
> > Yes, I have.
> > >
> > > It might still help to see the smb.conf
> > 
> > Here: http://pastebin.com/M9m8x1DZ
> > 
> > 
> > This e-mail and any attachments may contain CONFIDENTIAL
> > information, including PROTECTED HEALTH INFORMATION. If you are not
> > the intended recipient, any use or disclosure of this information
> > is STRICTLY PROHIBITED; you are requested to delete this e-mail and
> > any attachments, notify the sender immediately, and notify the
> > Mediture Privacy Officer at privacyofficer at mediture.com.
> > 
> > 
> 
> I would suggest you remove the 'password server' line, this will
allow
> Samba to find the best DC to use.
> 
> I also don't understand why you have a 10 million range for the
> BUILTIN users and only a 39,999 range for the domain users.
> 
> Other than that, joining with 'net ads join -U Administrator'
should
> work.
> 
> Rowland
>  
> 
I also forgot to say, remove the uidNumber from Administrator, add this
line to smb.conf:

    username map = /etc/samba/user.map

Then create '/etc/samba/user.map' with this content:

!root = MEDITURE\Administrator MEDITURE\administrator
Administrator administrator

This will then ensure that Administrator gets mapped to root.

Rowland