I would like to convert my classic Samba (NT4 style) to Active
Directory. Since this is a classic domain, I have separate LDAP
server as a samba backend and a separate kerberos KDC for unix clients.
I would actually then like to migrate the DC role from Samba to
Windows 2008/2012.
Using Windows 2008/2012 as the domain controller is the eventual goal
because of what I believe is better support for trusts, the ability to
support child domains (or be merged to another forest) , compatibility
with Exchange schema and the full group policy support.
The current Samba domain has two-way trusts with a Windows 2008 AD domain.
The samba wiki page (
https://wiki.samba.org/index.php/FAQ#Does_Samba_AD_Supports_Trust_Relationship.3F)
states
The trust feature is experimental and has several limitations,
such as:
SID filtering rules are not applied
You cannot add users and groups of a trusted domain into domain
groups
Older notes indicated that Samba AD trusts were only one way (I think
Samba AD domains can trust Windows AD domains but not vice versa) but
the current wiki page does not mention this limitation. The
"experimental" description makes me hesitant to trust it completely.
Moving to Samba as an AD server would also mean that I would get to
(have to) consolidate the separate LDAP and Kerberos servers into Samba.
It does appear that I can have Samba AD domain controllers and Windows
AD domain controllers in the same domain.
(https://wiki.samba.org/index.php/SysVol_replication_(DFS-R) ) This
would presumably let me migrate my domain from classic to Samba AD, add
a Win 2008/2012 domain controller, make the Win DC the FSMO master and
demote the Samba AD server.
Actually, I will probably end up creating a new AD domain with windows
2008/2012 controllers, establish a trust with the classic domain, and
migrate users and computers to the new domain.
Thanks
