samba - Sep 2004 - PDC from 2 to 3, SID headaches

Hello,
I'm doing a migration of a PDC from Samba 2.2.8a on Mandrake Linux 9.0 to 
Samba 3.0.6 on Debian Woody (stable), both on the same machine, different 
partitions, they do not run simultaneously. And I really need help. :-/

I could not find a detailed guide, so after having a look at the migration 
chapter of the official howto, I adapted my smb.conf keeping the same host 
and domain name, copied needed users by hand (by copy&paste from/to 
passwd, shadow, group, gshadow and smbpasswd files, verifying that no IDs 
conflicted), got the 2.2.8a domain SID with smbpasswd -X and imported it
in the 3.0.6 domain with net setlocalsid.
I don't think I have anything else necessary, in other tdb files.

Now, maybe the problem was the last step: after doing it on the Samba 3 
domain, "net getlocalsid" and "net getlocalsid
<domain_name>" returned two
different values, which is not a good thing according to 
www.richardsharpe.com. Indeed, with net setlocalsid I did set the SID for 
the server, but HOW can I set the SID for the domain??

Anyway, the result was that Win2000 clients (I tested only one) could not 
load user profiles from the server, because "a copy with wrong permissions 
already exists on the server" or something like that. But users could 
access shares regularly.
I could not find any special hints in logs at level 4.

So I removed the client from the domain, and then made it join again. The 
result: no more errors at login, but most user settings are not loaded, 
and all local user/group mappings on the client have disappeared! This is 
a disaster for me, as domain users need to belong to the local Power Users 
group to use some crap applications, and I really do not like the idea of 
going through all clients again to assign users to groups. 8-/

I then tried making domain and server SID the same, copying the domain SID 
to the server (so both were different from the 2.2.8a one, but 
unfortunately I can't find a way to do the opposite). Had to remove/join 
the client again, and the problem stays the same, if not even worse.

I also tried copying secrets.tdb over from the 2.2.8a installation, but
nothing seemed to change.

I then rebooted back on Mandrake with the old version, rejoined the client
in the old domain, and everything started working fine again, including
user/group mappings.

I really need some detailed suggestions on what I might be missing.
Thank you very much.

I'm also having problems with VFS modules and charsets, but these will 
come later. ;) Making the new PDC basically work is my current priority.

-- 
Ciao,
  Marco.

..."Stupid Dream", Porcupine Tree 1999

Hi,

I had this very same issue and posted this problem many months ago to no
avail.

Since user profs and envs are critical in my env, what I did was

1) Ensure that a local version of the domain prof exsisted and that it was
local vs roaming using the Windows profile tool.

2) I then made the identical user on the local machine account (if your
machine is named foo, then your local acc would be foo\user).

* login once on foo\user to ensure profile account creation.

3) Using the profile copy tool in Windows, I then copied the domain profile
to the local machine account profile.

4) I then logged on as foo\user to ensure the env was as it should be.

5) I then copied the foo\user account to the domain account using the
Windows tool and I was then able to migrate to v3 and keep my profs and env
for each user.

* Be admin when doing the profile migration or atleast another user with
admin privs.

Ofcourse a tedious thing for 30+ users but it was critical as they are in FX
industry and are very picky about there env.

Its ultimatly up to you on wether you want to go this extra step but I felt
that it was my responability to provide this level of service.

Bri-
Network Consulting Services

Il 12/09/2004, alle ore 2:05, Brian Krusic ha scritto:
> Since user profs and envs are critical in my env, what I did was
[...cut...]

Thanks but oh, no, please someone DO tell me that a way exists to copy the
domain SID and avoid all this trouble! :-(

Where does Samba 3 store the domain SID? I tried deleting
/etc/samba/secrets.tdb, to no avail.

-- 
Ciao,
  Marco.

..."Outside", David Bowie 1995