samba - Nov 2024 - samba support of KB5020276 workaround

Hi everybody,

since a couple of years, user X can't join a computer to AD if the 
computer object has been created by user Y.

It is KB5020276?Netjoin: Domain join hardening changes [1].

The documentation suggests a workaround, basically a group policy 
applied to all the domain controllers.

Is it that possibile to apply group policies to a samba DC?

The group policy I'm talking about requires a 2012R2 schema, but before 
raising the schema I would like to understand if it could possibly work ;)

thank you so much,

Francesco

[1] 
https://support.microsoft.com/en-us/topic/kb5020276-netjoin-domain-join-hardening-changes-2b65a0f3-1f4c-42ef-ac0f-1caaf421baf8

I?ve spent a lot of time working on this. There?s no workaround that actually
works.

The machine account must me deleted and recreated by the new user. I use a
generic user to own these new account so I keep it even if the employee adding
machines leaves.

LP
On 6 Nov 2024 at 10:37 +0000, Francesco Malvezzi via samba <samba at
lists.samba.org>, wrote:
> Hi everybody,
>
> since a couple of years, user X can't join a computer to AD if the
> computer object has been created by user Y.
>
> It is KB5020276?Netjoin: Domain join hardening changes [1].
>
> The documentation suggests a workaround, basically a group policy
> applied to all the domain controllers.
>
> Is it that possibile to apply group policies to a samba DC?
>
> The group policy I'm talking about requires a 2012R2 schema, but before
> raising the schema I would like to understand if it could possibly work ;)
>
> thank you so much,
>
> Francesco
>
> [1]
>
https://support.microsoft.com/en-us/topic/kb5020276-netjoin-domain-join-hardening-changes-2b65a0f3-1f4c-42ef-ac0f-1caaf421baf8
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba

On Wed, 6 Nov 2024 11:37:23 +0100
Francesco Malvezzi via samba <samba at lists.samba.org> wrote:
> Hi everybody,
> 
> since a couple of years, user X can't join a computer to AD if the 
> computer object has been created by user Y.
Why pre-create the computer object before the join ?
The 'net ads join' command will create it for you and if you want it
created in a different OU to the standard CN, then the
'createcomputer=OU' option will do it for you.

Also, why are you letting normal users join computers ?

Rowland