samba - Nov 2005 - how to migrate to samba-ldap transparently?

We are in the point of change our samba 3.0.5 PDC setup in order to make 
it authenticate its users against openldap 2.3.11.

We already have the openldap server working with all the PDC users data 
and we also have already tested the wanted scenario using an identical PDC 
setuped up with the same SID and its netbios name changed and some PCs for 
testing as domain clients (we outsourced this task).

Somebody of you know if this process can be made transparently without 
rejoin every PC to the domain? how?. We have disabled the roaming profiles 
option.  We have some 100 clients/users.

Thanks in advance,

Pablo Chamorro C.

-- 
Tel: +57 (2) 7314752/3222/2595 - Fax: +57 (2) 7310514
Carrera 31 #18-07 Parque Infantil - PO Box 1795 - Pasto

On Thu, 2005-11-10 at 11:43 -0500, Pablo Chamorro C.
wrote:
> We are in the point of change our samba 3.0.5 PDC setup in order to make 
> it authenticate its users against openldap 2.3.11.
> 
> We already have the openldap server working with all the PDC users data 
> and we also have already tested the wanted scenario using an identical PDC 
> setuped up with the same SID and its netbios name changed and some PCs for 
> testing as domain clients (we outsourced this task).
> 
> Somebody of you know if this process can be made transparently without 
> rejoin every PC to the domain? how?. We have disabled the roaming profiles 
> option.  We have some 100 clients/users.
----
I'm not sure if anyone responded to this today or not.

Nowhere do you say what type of system is currently the PDC and that
probably matters.

There are guides for migrating from Samba 2 PDC and WinNT4 PDC in the
office Samba How-To (see samba.org documentation)

Since you've already set up users, your ability to migrate may be an
issue but you could probably back up the portions of your openldap db,
do a vampire type operation, back that up and merge it all together to
get the machine account info into your openldap db. It's tricky but it
certainly can be done by someone who understands openldap.

Craig


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.