samba - May 2017 - Initial AD Setup

Hi list,

My company is trying to migrate from NT4-style domains to Active Directory
domains. We've read the Samba Docs and Wiki, inside and out, but are having
issues setting it up as per what we are thinking is "expected".

Our expectation:

1 instance running the DC
1 instance running a replicated DC (2 DCs in total)
1 instance "joined" to the domain to serve files

We can do the first two, but we cannot, for the life of us, get the member
server to allow users on the DC to access shares on the file server.

Although I do not have access to the smb.conf files (the servers are in
another building and turned off at the moment, since we're only testing), I
can tell you what we've tried:

1. Get the first DC up. Kerberos authenticates perfectly, internal DNS
working. Client computers can join the domain, and log in with our newly
created AD accounts.
2. Running "net ads join -u Administrator" works on the member server.
Verified in AD Users and Computers as a Computer (not a domain controller)
3. Create the share in smb.conf on the file server. Security is already set
to ads, the idmap entries added, etc.
4. Anyone tries to connect to the share, Access is Denied. The only way we
can access it is by using a user map for Administrator to root, and using
the AD Administrator account. Domain Admins cannot access the shared
folder, either.
5. On the member server, wb-info works, getent does not, for verifying
users and groups existing.

1. Are we on the right path for setting up AD correctly?
2. How bad would it be to share the folders from the DC itself? We would
have anywhere between 20 and 1000 users logged in at a time, all from
Windows 7, 8.1 and 10 computers.

Thanks in advance! Once I get the smb.conf files, I'll get them posted as
well.

On Thu, 4 May 2017 13:53:31 -0700
Luke Barone via samba <samba at lists.samba.org> wrote:

> 5. On the member server, wb-info works, getent does not, for verifying
> users and groups existing.
This is undoubtedly your problem, if getent does not show your windows
users as Unix users, they will not be able to connect to the domain
member.
 
> 
> 1. Are we on the right path for setting up AD correctly?
It sounds like it.
> 2. How bad would it be to share the folders from the DC itself? We
> would have anywhere between 20 and 1000 users logged in at a time,
> all from Windows 7, 8.1 and 10 computers.
Your proposed way with 2 DCs and a domain member is the best way to go.
> 
> Thanks in advance! Once I get the smb.conf files, I'll get them
> posted as well.
Post the smb.conf files, especially the domain member one, this is
probably where your problems lie.

Rowland