samba - Sep 2017 - BUILTIN\Administrators - failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND

>On Wed, 06 Sep 2017 11:24:17 +0200>Jiří Černý via samba <samba at
lists.samba.org
( https://lists.samba.org/mailman/listinfo/samba) > wrote:>>> I feel
this all has something to do with the classicupgrade, the>> command
works for me, does 'wbinfo
--sid-to-gid="S-1-5-32-544"'>> work ?>> Yes.
Take a look:wbinfo --sid-to-gid="S-1-5-32-544"> 15538wbinfo
--gid-info=15538> BUILTIN\administrators:x:15538:>>> I haven't
received
it yet, but will examine and comment on it when>> I do.I sent it to
<rpenny at samba.org>, so I hope that antispam>> filters do their
job
not so hard;) >>> Yes, but is this set on the>> computers object
in
sam.ldb as a gidNumber or in idmap.ldb as a>> xidNumber ?>> I mean
in
ADUC, i didn't inspected databases. I was NIS> domain and GIDs in UNIX
Attributes tab of ADUC.> So it was definetely gidNumber. Stored propably
in sam.ldb.>>If you don't have any Unix machine (other than the Samba
AD
DC) you do>not need any uidNumber or gidNumber attributes in AD.We have
5 linux fileservers, so we really need this function. Also we use LDAP
login to our intranet (Plone) of which plugin uses UIDs/GIDs.
I presonally use Fedora laptop and desktop joined to domain by realmd
and sssd, which work well. In past I made some work on project of
'CentOS linux desktop', so there is chance, that we will need UNIX
attributes at least for user acounts and Domain Users group as primary
group. But we don't need set numeric IDs for other "default"
domain
groups like BUILTIN and Domain\xxxxx.> > Is enough to just set NIS
domnain to <none> in ADUC to "clear" GID at> groups/users
which
shouldn't have it?>> No, sorry that will not work.Probably yes or
maybe
we don't understand each other.
I tested it in lab domain (Samba 4.7rc4) by ldbsearch in sam.ldb. If I
set NIS domain and GID (in ADUC), then there appear msSFU30NisDomain:
and gidNumber: attributes.
When I set NIS domain to <none>, both attributes disappear.>> A
gidNumber can be used on any Unix machine in the domain, a>> xidNumber
will only be used on the DC. >> Finally I got it. Forgive me, sometimes
it takes quite long time than> my brain assembles all information
together:D> >>No problem>>RowlandCan I have the proposal?
Is it possible to edit wiki page about Classic upgrade?
At least add some warning about possibility of problems with ID map
ranges migrated from ancient Samba 3.X+LDAP systems?

And second. Is possible to change Classic upgrade scripts to have
option of not copying of GIDs to "default" groups?
I think it should be enough. migration script copy members of that
groups but skip copying of GIDs.Not for us, it will be difficult to fix
our domain (but I believe that amazing guys here help me to fix that
goddamn BUILTIN Admins;)), but for another people who will migrate S3
NT4 domain to S4 AD.

On Wed, 06 Sep 2017 15:15:57 +0200
Jiří Černý via samba <samba at lists.samba.org> wrote:
> >On Wed, 06 Sep 2017 11:24:17 +0200>Jiří Černý via samba <samba at
> lists.samba.org
> ( https://lists.samba.org/mailman/listinfo/samba) > wrote:>>> I
feel
> this all has something to do with the classicupgrade, the>> command
> works for me, does 'wbinfo
--sid-to-gid="S-1-5-32-544"'>> work ?>>
> Yes. Take a look:wbinfo --sid-to-gid="S-1-5-32-544">
15538wbinfo
> --gid-info=15538> BUILTIN\administrators:x:15538:>>> I
haven't
> received it yet, but will examine and comment on it when>> I do.I
> sent it to <rpenny at samba.org>, so I hope that antispam>>
filters
> do their job not so hard;) >>> Yes, but is this set on the>>
> computers object in sam.ldb as a gidNumber or in idmap.ldb as a>>
> xidNumber ?>> I mean in ADUC, i didn't inspected databases. I was
> NIS> domain and GIDs in UNIX Attributes tab of ADUC.> So it was
> NIS> definetely gidNumber. Stored propably
> in sam.ldb.>>If you don't have any Unix machine (other than the
Samba
> AD DC) you do>not need any uidNumber or gidNumber attributes in AD.We
> have 5 linux fileservers, so we really need this function. Also we
> use LDAP login to our intranet (Plone) of which plugin uses UIDs/GIDs.
> I presonally use Fedora laptop and desktop joined to domain by realmd
> and sssd, which work well. In past I made some work on project of
> 'CentOS linux desktop', so there is chance, that we will need UNIX
> attributes at least for user acounts and Domain Users group as primary
> group. But we don't need set numeric IDs for other "default"
domain
> groups like BUILTIN and Domain\xxxxx.> > Is enough to just set NIS
> domnain to <none> in ADUC to "clear" GID at>
groups/users which
> shouldn't have it?>> No, sorry that will not work.Probably yes or
> maybe we don't understand each other.
> I tested it in lab domain (Samba 4.7rc4) by ldbsearch in sam.ldb. If I
> set NIS domain and GID (in ADUC), then there appear msSFU30NisDomain:
> and gidNumber: attributes.
> When I set NIS domain to <none>, both attributes disappear.>> A
> gidNumber can be used on any Unix machine in the domain, a>>
xidNumber
> will only be used on the DC. >> Finally I got it. Forgive me,
> sometimes it takes quite long time than> my brain assembles all
> information together:D> >>No problem>>RowlandCan I have the
proposal?
> Is it possible to edit wiki page about Classic upgrade?
> At least add some warning about possibility of problems with ID map
> ranges migrated from ancient Samba 3.X+LDAP systems?
> 
> And second. Is possible to change Classic upgrade scripts to have
> option of not copying of GIDs to "default" groups?
> I think it should be enough. migration script copy members of that
> groups but skip copying of GIDs.Not for us, it will be difficult to
> fix our domain (but I believe that amazing guys here help me to fix
> that goddamn BUILTIN Admins;)), but for another people who will
> migrate S3 NT4 domain to S4 AD.
This was hard to decipher, but I think I understand it

You need to make some choices about your fileservers, do you need to
move data between them ? if you do, then you need to use the winbind
'ad' backend to ensure the data retains the correct ownership. If you
don't, then you can use the 'rid' backend, this doesn't add
anything to
AD.

Rowland