samba - Jan 2016 - Samba AD with Microsoft Account

> On 12 Jan 2016, at 01:25, Jean-Philippe Steinmetz <caskater47 at
gmail.com> wrote:
> 
> I was able to find this thread that seems to be the same problem I am
> having.
> 
>
https://social.technet.microsoft.com/Forums/en-US/d861e179-6515-4322-a628-b7e73b2335e8/cannot-add-a-microsoft-account-to-domain-account-with-roaming-profiles?forum=win10itprogeneral
> 
> When provisioning a new AD domain controller in samba, I assume the default
> behavior is that all user profiles are set to roaming?
No. Like I said, I'm pretty sure Samba's not to blame here.

I also think that a MS account cannot be linked to any kind of admin account -
for a good reason. It's the same with Edge or MS Store, they won't open
on an admin account.

Create a regular user and try again.

Viktor
> 
> On Mon, Jan 11, 2016 at 3:16 PM, Jean-Philippe Steinmetz <
> caskater47 at gmail.com> wrote:
> 
>> In a related problem. I've tried linking my Office365 account. I
get
>> through the sign-in process but when it is attempting to link the
device I
>> can an error message stating:
>> 
>> *We weren't able to register your device and add your account to
Windows.
>> Your access to org resources may be limited.*
>> 
>> The domain account I am logged in with is part of the Domain Admins
group
>> so I don't think this should be a problem.
>> 
>> On Mon, Jan 11, 2016 at 3:13 PM, Jean-Philippe Steinmetz <
>> caskater47 at gmail.com> wrote:
>> 
>>> Viktor is correct. That is what I am trying to accomplish.
>>> 
>>> The reason why I suspect it's a samba issue is because on the
workstation
>>> I use at my company I am able to successfully link my Microsoft
account to
>>> the domain profile. The company uses a Windows Server 2008 for
Active
>>> Directory. So it would stand to reason the only difference here is
the type
>>> of server being used.
>>> 
>>> Thank you for the link to the profile migration tool however. That
did
>>> help with a different problem. I tried migrating my existing local
profile
>>> which did have my MS account linked. The profile is now migrated
but i've
>>> lost the link to the MS account.
>>> 
>>> When I go to add it back I get the same behavior as before. It just
>>> doesn't work. If I open the Store app and try to sign-in with
the MS
>>> account I get the error message "We encountered an error.
Please try
>>> signing in again later."
>>> 
>>> On Mon, Jan 11, 2016 at 3:00 PM, Viktor Trojanovic <viktor at
troja.ch>
>>> wrote:
>>> 
>>>> 
>>>> 
>>>>> On 11.01.2016 20:37, Rowland penny wrote:
>>>>> 
>>>>>> On 11/01/16 19:26, Jean-Philippe Steinmetz wrote:
>>>>>> 
>>>>>> Yes I have provisioned the samba server as an Active
Directory domain
>>>>>> controller (I mentioned that in the first e-mail).
>>>>>> 
>>>>>> The reason for linking the two is to provide easy
access to additional
>>>>>> MS
>>>>>> services that won't be hosted internally (e.g.
OneDrive, Skype, MS
>>>>>> Store).
>>>>>> 
>>>>>> Ultimately I am using this as a private domain at home
to simplify
>>>>>> device
>>>>>> management but I want to continue be able to use
existing MS services
>>>>>> as
>>>>>> well.
>>>>>> 
>>>>>> On Mon, Jan 11, 2016 at 11:13 AM, Rowland penny
<rpenny at samba.org>
>>>>>> wrote:
>>>>>> 
>>>>>>> On 11/01/16 19:04, Jean-Philippe Steinmetz wrote:
>>>>>>> 
>>>>>>> Sure. In short, I am trying to link a Microsoft
Account to a domain
>>>>>>>> profile on the workstation.
>>>>>>>> 
>>>>>>>> I log in to the workstation with the user
profile controlled by the
>>>>>>>> samba
>>>>>>>> AD server (e.g. MYDOMAIN\MyUser). Then once
logged in I attempt to
>>>>>>>> link an
>>>>>>>> existing Microsoft Account to that user
profile. I do this by going
>>>>>>>> to
>>>>>>>> Settings->Accounts->Add a Microsoft
account.
>>>>> I think I understand now, you want to change a local
profile to a
>>>>> domain profile (I don't think you can just link them),
if so, have a look
>>>>> here:
>>>>> 
>>>>> http://www.forensit.com/downloads.html
>>>>> 
>>>>> Rowland
>>>>> 
>>>>> I am not sure you understand him yet. Microsoft, similar to
Google and
>>>> Apple, offers various cloud services that can all be reached
through one
>>>> single account, see
https://en.wikipedia.org/wiki/Microsoft_account for
>>>> details. A Microsoft account to Windows is what an Apple ID is
to iOS (or
>>>> at least that's where Microsoft is headed).
>>>> 
>>>> JP wants to achieve single sign-on for these services by
linking his
>>>> Microsoft account to his AD user account. If it's possible,
I don't know.
>>>> But I'm pretty sure it's not a Samba matter.
>>>> 
>>>> Viktor
>>>> 
>>>> 
>>>> 
>>>> 
>>>> --
>>>> To unsubscribe from this list go to the following URL and read
the
>>>> instructions:  https://lists.samba.org/mailman/options/samba
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba

Well I tried using a regular user and no improvement. I was also having
problems creating users using the Active Directory Users and Computers tool
from within Windows. I had to log into the AD and create the user from the
shell directly. I am however able to make changes to existing users and
groups as well as add new groups through the Windows tools.

I've also found some errors with some of the other tools. Is this normal
behavior? I would expect all the RSAT tools work correctly.

On Tue, Jan 12, 2016 at 12:13 PM, Viktor Trojanovic <viktor at troja.ch>
wrote:
>
> No. Like I said, I'm pretty sure Samba's not to blame here.
>
> I also think that a MS account cannot be linked to any kind of admin
> account - for a good reason. It's the same with Edge or MS Store, they
> won't open on an admin account.
>
> Create a regular user and try again.
>
> Viktor
>

No, that's not normal behavior, and I assume that's what's
responsible for those other issues you're experiencing.

I suggest you analyze your Samba installation thorougly using the information in
the Wiki (there is a lot and in 90% problems can be solved or at least clearly
identified with it). If it's just a lab setup, you might consider
provisioning a new AD entirely. If you can't solve it on your own, start a
new thread explaining your installation (network setup, smb.conf, dns etc), what
you did to troubleshoot including the results, and where you're stuck. Leave
out the MS or Office account stuff for now as it's not Samba relevant.

Viktor
> On 13 Jan 2016, at 06:11, Jean-Philippe Steinmetz <caskater47 at
gmail.com> wrote:
> 
> Well I tried using a regular user and no improvement. I was also having
> problems creating users using the Active Directory Users and Computers tool
> from within Windows. I had to log into the AD and create the user from the
> shell directly. I am however able to make changes to existing users and
> groups as well as add new groups through the Windows tools.
> 
> I've also found some errors with some of the other tools. Is this
normal
> behavior? I would expect all the RSAT tools work correctly.
> 
>> On Tue, Jan 12, 2016 at 12:13 PM, Viktor Trojanovic <viktor at
troja.ch> wrote:
>> 
>> 
>> No. Like I said, I'm pretty sure Samba's not to blame here.
>> 
>> I also think that a MS account cannot be linked to any kind of admin
>> account - for a good reason. It's the same with Edge or MS Store,
they
>> won't open on an admin account.
>> 
>> Create a regular user and try again.
>> 
>> Viktor
>> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba