On 14/07/16 13:32, Carlos A. P. Cunha wrote:> > Hello! > Any opinion on that? > Thank you > > > Em 13-07-2016 10:52, Carlos A. P. Cunha escreveu: >> >> Thank you for the explanation. >> Yes, it was a mistake to leave my two faxias that way, by the ID >> exchange reason the low range will leave as it was to have no problems >> idmap config SERVERAD: range = 5000-33554431 >> >> The range of up'm thinking of changing to something >> idmap config *: range = 2000-4500 >> >> Not to be superimposed. >> >> But it will it not cause problem ids trading again? Since it was >> before both inciado in 50000 >> >> The procimo server will not make this mistake. >> >> Final doubt, I promise heheh :-D >> >> Thanks >> >> >> Em 13-07-2016 10:32, Rowland penny escreveu: >>> On 13/07/16 13:33, Carlos A. P. Cunha wrote: >>>> >>>> I got it, so it must have been the problem .. >>>> Strange that changed it more than one month at least. >>>> Having these values now, how do you think I do? >>>> Leave it or change at least the idmap config * values: range? >>>> >>>> I understand the parameters: >>>> >>>> idmap config *: range = Range of the Ids are User system >>>> >>>> idmap config SERVERAD: range: DC User Range >>>> >>>> Thank you >>>> >>>> >>>> Em 13-07-2016 05:16, Rowland penny escreveu: >>>>> On 13/07/16 03:20, Carlos A. P. Cunha wrote: >>>>>> >>>>>> Can return old id, returning the old values (changed the most at >>>>>> least two months) >>>>>> >>>>>> idmap config *: backend = tdb >>>>>> idmap config *:range = 5000-16777216 >>>>>> idmap config SERVERAD: backend = rid >>>>>> idmap config SERVERAD: range = 5000-33554431 >>>>>> >>>>>> The error parrou also, but I think the fact that a group with the >>>>>> same ID / GID if the User to the fact that the idmap values be >>>>>> crossing, even so I changed them (mentioned above) >>>>>> >>>>>> Thank you >>>>>> >>>>>> >>>>> >>>>> Do not change the lower range value on a Samba fileserver once >>>>> set, you can raise the upper value, but there is a proviso, the >>>>> ranges must not overlap. This means your lines above are invalid, >>>>> they both start at '5000' and the entire '*' range is inside the >>>>> 'SERVERAD' range. >>>>> >>>>> If you change the lower range and you are using the 'rid' backend, >>>>> all your IDs will change. >>>>> >>>>> Rowland >>>>> >>>> >>> >>> OK, you need to find out just who owns what on your systems, if you >>> find that something belongs to a number or to a user that it >>> shouldn't, then you have problems. >>> >>> If you look on the Samba wiki page for setting up a domain member, >>> you will find this for using the 'rid' backend: >>> >>> # Default idmap config used for BUILTIN and local accounts/groups >>> idmap config *:backend = tdb >>> idmap config *:range = 2000-9999 >>> >>> # idmap config for domain SAMDOM >>> idmap config SAMDOM:backend = rid >>> idmap config SAMDOM:range = 10000-99999 >>> >>> The ranges were chosen for a reason, the '*' range '2000-9999' is >>> large enough for any windows SID-RIDS that need mapping and leaves >>> room below the range for any local Unix users that may be required. >>> The domain range starts at '10000', this is also the standard start >>> number if you use ADUC & the Unix Attributes tab. If needed, the >>> range can be extended by raising '99999' to whatever is required, >>> this can be done whenever required, just don't change '10000' >>> >>> If practicable, you could use the above ranges, but if it takes less >>> work to keep the ranges you are using now, then stay with them, what >>> I am trying to say is, go with whatever is easiest, just make sure >>> that ranges do not overlap. >>> >>> Rowland >>> >> >Sorry, didn't realise you were asking a question :-[ As long as the ranges do not overlap and you can work around any possible problems (note: I am not saying you will have problems, but possibly may have problems), then, the range you suggest will work. Rowland
Hello!! Hehehe Then, as already changed the values and problem had my idei and leave everything as it was, the two idmap config *: range = 5000-16777216 idmap config SERVERAD: range = 5000-33554431 It is running more than one year and occurred only problems that I changed, I know the right and leave the range as you passed, but I can not have the ID change issues again (caused much headache). So I was in doubt even if the only change idmap config *: range to a lower value as 2000-4500, which impacts can I have? Since this is not the range of DC User. Thank you again. Em 14-07-2016 09:36, Rowland penny escreveu:> On 14/07/16 13:32, Carlos A. P. Cunha wrote: >> >> Hello! >> Any opinion on that? >> Thank you >> >> >> Em 13-07-2016 10:52, Carlos A. P. Cunha escreveu: >>> >>> Thank you for the explanation. >>> Yes, it was a mistake to leave my two faxias that way, by the ID >>> exchange reason the low range will leave as it was to have no problems >>> idmap config SERVERAD: range = 5000-33554431 >>> >>> The range of up'm thinking of changing to something >>> idmap config *: range = 2000-4500 >>> >>> Not to be superimposed. >>> >>> But it will it not cause problem ids trading again? Since it was >>> before both inciado in 50000 >>> >>> The procimo server will not make this mistake. >>> >>> Final doubt, I promise heheh :-D >>> >>> Thanks >>> >>> >>> Em 13-07-2016 10:32, Rowland penny escreveu: >>>> On 13/07/16 13:33, Carlos A. P. Cunha wrote: >>>>> >>>>> I got it, so it must have been the problem .. >>>>> Strange that changed it more than one month at least. >>>>> Having these values now, how do you think I do? >>>>> Leave it or change at least the idmap config * values: range? >>>>> >>>>> I understand the parameters: >>>>> >>>>> idmap config *: range = Range of the Ids are User system >>>>> >>>>> idmap config SERVERAD: range: DC User Range >>>>> >>>>> Thank you >>>>> >>>>> >>>>> Em 13-07-2016 05:16, Rowland penny escreveu: >>>>>> On 13/07/16 03:20, Carlos A. P. Cunha wrote: >>>>>>> >>>>>>> Can return old id, returning the old values (changed the most at >>>>>>> least two months) >>>>>>> >>>>>>> idmap config *: backend = tdb >>>>>>> idmap config *:range = 5000-16777216 >>>>>>> idmap config SERVERAD: backend = rid >>>>>>> idmap config SERVERAD: range = 5000-33554431 >>>>>>> >>>>>>> The error parrou also, but I think the fact that a group with >>>>>>> the same ID / GID if the User to the fact that the idmap values >>>>>>> be crossing, even so I changed them (mentioned above) >>>>>>> >>>>>>> Thank you >>>>>>> >>>>>>> >>>>>> >>>>>> Do not change the lower range value on a Samba fileserver once >>>>>> set, you can raise the upper value, but there is a proviso, the >>>>>> ranges must not overlap. This means your lines above are invalid, >>>>>> they both start at '5000' and the entire '*' range is inside the >>>>>> 'SERVERAD' range. >>>>>> >>>>>> If you change the lower range and you are using the 'rid' >>>>>> backend, all your IDs will change. >>>>>> >>>>>> Rowland >>>>>> >>>>> >>>> >>>> OK, you need to find out just who owns what on your systems, if you >>>> find that something belongs to a number or to a user that it >>>> shouldn't, then you have problems. >>>> >>>> If you look on the Samba wiki page for setting up a domain member, >>>> you will find this for using the 'rid' backend: >>>> >>>> # Default idmap config used for BUILTIN and local accounts/groups >>>> idmap config *:backend = tdb >>>> idmap config *:range = 2000-9999 >>>> >>>> # idmap config for domain SAMDOM >>>> idmap config SAMDOM:backend = rid >>>> idmap config SAMDOM:range = 10000-99999 >>>> >>>> The ranges were chosen for a reason, the '*' range '2000-9999' is >>>> large enough for any windows SID-RIDS that need mapping and leaves >>>> room below the range for any local Unix users that may be required. >>>> The domain range starts at '10000', this is also the standard start >>>> number if you use ADUC & the Unix Attributes tab. If needed, the >>>> range can be extended by raising '99999' to whatever is required, >>>> this can be done whenever required, just don't change '10000' >>>> >>>> If practicable, you could use the above ranges, but if it takes >>>> less work to keep the ranges you are using now, then stay with >>>> them, what I am trying to say is, go with whatever is easiest, just >>>> make sure that ranges do not overlap. >>>> >>>> Rowland >>>> >>> >> > > Sorry, didn't realise you were asking a question :-[ > > As long as the ranges do not overlap and you can work around any > possible problems (note: I am not saying you will have problems, but > possibly may have problems), then, the range you suggest will work. > > Rowland >
Hello! I changed to idmap config *: range = 2000-4500 The BUILTIN: uid=5500(administrator) gid=5513(domain users) groups=5513(domain users),5500(administrator),5520(group policy creator owners),5519(enterprise admins),9130(servad-1 $ acronis remote users),6530(kladmins),5518(schema admins),5512(domain admins),*2001(BUILTIN\users),2000(BUILTIN\administrators)* I think this will get better then, so do not have overlapping values Em 14-07-2016 10:16, Carlos A. P. Cunha escreveu:> > Hello!! Hehehe > Then, as already changed the values and problem had my idei and leave > everything as it was, the two > > idmap config *: range = 5000-16777216 > idmap config SERVERAD: range = 5000-33554431 > > > It is running more than one year and occurred only problems that I > changed, I know the right and leave the range as you passed, but I can > not have the ID change issues again (caused much headache). > > So I was in doubt even if the only change > idmap config *: range > to a lower value as 2000-4500, which impacts can I have? > Since this is not the range of DC User. > > Thank you again. > > > Em 14-07-2016 09:36, Rowland penny escreveu: >> On 14/07/16 13:32, Carlos A. P. Cunha wrote: >>> >>> Hello! >>> Any opinion on that? >>> Thank you >>> >>> >>> Em 13-07-2016 10:52, Carlos A. P. Cunha escreveu: >>>> >>>> Thank you for the explanation. >>>> Yes, it was a mistake to leave my two faxias that way, by the ID >>>> exchange reason the low range will leave as it was to have no problems >>>> idmap config SERVERAD: range = 5000-33554431 >>>> >>>> The range of up'm thinking of changing to something >>>> idmap config *: range = 2000-4500 >>>> >>>> Not to be superimposed. >>>> >>>> But it will it not cause problem ids trading again? Since it was >>>> before both inciado in 50000 >>>> >>>> The procimo server will not make this mistake. >>>> >>>> Final doubt, I promise heheh :-D >>>> >>>> Thanks >>>> >>>> >>>> Em 13-07-2016 10:32, Rowland penny escreveu: >>>>> On 13/07/16 13:33, Carlos A. P. Cunha wrote: >>>>>> >>>>>> I got it, so it must have been the problem .. >>>>>> Strange that changed it more than one month at least. >>>>>> Having these values now, how do you think I do? >>>>>> Leave it or change at least the idmap config * values: range? >>>>>> >>>>>> I understand the parameters: >>>>>> >>>>>> idmap config *: range = Range of the Ids are User system >>>>>> >>>>>> idmap config SERVERAD: range: DC User Range >>>>>> >>>>>> Thank you >>>>>> >>>>>> >>>>>> Em 13-07-2016 05:16, Rowland penny escreveu: >>>>>>> On 13/07/16 03:20, Carlos A. P. Cunha wrote: >>>>>>>> >>>>>>>> Can return old id, returning the old values (changed the most >>>>>>>> at least two months) >>>>>>>> >>>>>>>> idmap config *: backend = tdb >>>>>>>> idmap config *:range = 5000-16777216 >>>>>>>> idmap config SERVERAD: backend = rid >>>>>>>> idmap config SERVERAD: range = 5000-33554431 >>>>>>>> >>>>>>>> The error parrou also, but I think the fact that a group with >>>>>>>> the same ID / GID if the User to the fact that the idmap values >>>>>>>> be crossing, even so I changed them (mentioned above) >>>>>>>> >>>>>>>> Thank you >>>>>>>> >>>>>>>> >>>>>>> >>>>>>> Do not change the lower range value on a Samba fileserver once >>>>>>> set, you can raise the upper value, but there is a proviso, the >>>>>>> ranges must not overlap. This means your lines above are >>>>>>> invalid, they both start at '5000' and the entire '*' range is >>>>>>> inside the 'SERVERAD' range. >>>>>>> >>>>>>> If you change the lower range and you are using the 'rid' >>>>>>> backend, all your IDs will change. >>>>>>> >>>>>>> Rowland >>>>>>> >>>>>> >>>>> >>>>> OK, you need to find out just who owns what on your systems, if >>>>> you find that something belongs to a number or to a user that it >>>>> shouldn't, then you have problems. >>>>> >>>>> If you look on the Samba wiki page for setting up a domain member, >>>>> you will find this for using the 'rid' backend: >>>>> >>>>> # Default idmap config used for BUILTIN and local accounts/groups >>>>> idmap config *:backend = tdb >>>>> idmap config *:range = 2000-9999 >>>>> >>>>> # idmap config for domain SAMDOM >>>>> idmap config SAMDOM:backend = rid >>>>> idmap config SAMDOM:range = 10000-99999 >>>>> >>>>> The ranges were chosen for a reason, the '*' range '2000-9999' is >>>>> large enough for any windows SID-RIDS that need mapping and leaves >>>>> room below the range for any local Unix users that may be >>>>> required. The domain range starts at '10000', this is also the >>>>> standard start number if you use ADUC & the Unix Attributes tab. >>>>> If needed, the range can be extended by raising '99999' to >>>>> whatever is required, this can be done whenever required, just >>>>> don't change '10000' >>>>> >>>>> If practicable, you could use the above ranges, but if it takes >>>>> less work to keep the ranges you are using now, then stay with >>>>> them, what I am trying to say is, go with whatever is easiest, >>>>> just make sure that ranges do not overlap. >>>>> >>>>> Rowland >>>>> >>>> >>> >> >> Sorry, didn't realise you were asking a question :-[ >> >> As long as the ranges do not overlap and you can work around any >> possible problems (note: I am not saying you will have problems, but >> possibly may have problems), then, the range you suggest will work. >> >> Rowland >> >