On 11/12/15 15:41, Bob Thomas wrote:> First, Thank you all for this forum, as I am fairly new at both Ubuntu
> and Samba I have found most the answers to my issues here.
>
> Now correct me if I am wrong but Samba 4.3.2 should be able to support
> Domain Trusts. If so maybe you can help me, here is what I have:
>
> NT4 Domain: adc.com (Holds are production servers and user accounts
> for that domain)
>
> Controller = enterprise.abc.com
>
> Samba Domain: cy.abc.biz
> Two Controllers both Ubuntu 14.04 with Samba 4.3.2 running well (I
> think):
>
> Controllers = pdc.cy.abc.biz & sdc.cy.abc.biz
>
> I can ping "enterprise" from both samba controllers and I can
ping
> "pdc" and "sdc" from enterprise.
>
> The two problems I have are first I am unable to create an
> Inter-domain Trust Account:
>
> ####
> root at PDC:/etc# net rpc trustdom add ABC password -U bthomas
> Enter bthomas's password:
> Could not set trust account password: NT_STATUS_ACCESS_DENIED
> ###
>
> and second with samba-tool I get:
>
> #####
> root at PDC:~# samba-tool domain trust create ABC -U bthomas
> LocalDomain Netbios[CY] DNS[cy.abc.biz]
> SID[S-1-5-21-3303530046-412607057-2209094731]
> ERROR: Failed to find a writeable DC for domain 'ABC'
> #####
>
> Here is may smb.conf file:
>
> # Global parameters
> [global]
> workgroup = CY
> realm = CY.ABC.BIZ
> server role = active directory domain controller
> security = USER
> passdb backend = samba_dsdb
> os level = 65
> preferred master = Yes
> domain master = Yes
> wins support = Yes
> winbind nss info = rfc2307
> allow dns updates = nonsecure and secure
> dns forwarder = 10.157.1.178
> server services = dns, s3fs, rpc, nbt, wrepl, ldap, cldap,
> kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate
> rpc_server:tcpip = no
> rpc_daemon:spoolssd = embedded
> rpc_server:spoolss = embedded
> rpc_server:winreg = embedded
> rpc_server:ntsvcs = embedded
> rpc_server:eventlog = embedded
> rpc_server:srvsvc = embedded
> rpc_server:svcctl = embedded
> rpc_server:default = external
> winbindd:use external pipes = true
> idmap config cy:range = 10000-29999
> idmap config cy:schema_mode = rfc2307
> idmap config cy:backend = ad
> idmap config *:range = 5000-9999
> kccsrv:samba_kcc = false
> idmap_ldb:use rfc2307 = yes
> idmap config * : backend = tdb
> map archive = No
> map readonly = no
> store dos attributes = Yes
> vfs objects = dfs_samba4 acl_xattr
>
>
> [netlogon]
> path = /var/lib/samba/sysvol/cy.abc.biz/scripts
> read only = No
>
>
> [sysvol]
> path = /var/lib/samba/sysvol
> read only = No
>
> ##
>
> My ultimate goal is to move totally off the NT Domain and onto the
> Samba-AD-DC but I need the trust established first so I can go step by
> test moving 18 productions servers one at a time so it can be tested.
> I feel it would be too risky to move everything at once.
>
> Any help to get me going in the right direction would be greatly
> appreciated.
>
> Bob Thomas
>
I think you are going about this the wrong way, you are trying to create
a new AD domain and then set up trusts between your old NT4 domain and
your new AD domain, correct?
I think you should be going down the classic-upgrade path instead i.e.
upgrade your original domain to an AD one. I take it all your users are
in the NT domain, if so and their computers see the new AD, they *will*
not go back to the original NT P/BDC, without a complete re-install.
See here for info about the classic-upgrade:
https://wiki.samba.org/index.php/Migrating_a_Samba_NT4_domain_to_a_Samba_AD_domain_%28classic_upgrade%29
Also, quite a lot of what you have added to your DCs smb.conf shouldn't
be there, I would suggest that you put it back to what it was after the
provision.
I hope you are doing this in a test environment.
Rowland