samba - Sep 2018 - Schema Update to store TPM data in AD DS

Hi all,

has anyone here experience with storing BitLocker and TPM data in AD DS on
Samba?
I have stumbled across this Microsoft page (
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-8.1-and-8/jj635854%28v%3dws.11%29)
stating that Windows 2008 R2 needs a schema extension to handle this. Since
this is not listed as a safe update in the wiki (
https://wiki.samba.org/index.php/Samba_AD_schema_extensions), I would like
to know if anybody has already tried this, since I do not have any
experience with restoring a schema after a failed import. ;)
Thanks a lot for your input.

Best regards
Johannes

On Fri, 2018-09-07 at 18:14 +0200, Johannes Engel via samba
wrote:
> Hi all,
> 
> has anyone here experience with storing BitLocker and TPM data in AD DS on
> Samba?
> I have stumbled across this Microsoft page (
>
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-8.1-and-8/jj635854%28v%3dws.11%29)
> stating that Windows 2008 R2 needs a schema extension to handle this. Since
> this is not listed as a safe update in the wiki (
> https://wiki.samba.org/index.php/Samba_AD_schema_extensions), I would like
> to know if anybody has already tried this, since I do not have any
> experience with restoring a schema after a failed import. ;)
> Thanks a lot for your input.
We actually have a fully tested (just not widely deployed) upgrade tool
for schema, and a fully tested upgrade to the 2012 schema.
>From the testsuite:
$BINDIR/samba-tool domain schemaupgrade -H
tdb://$PREFIX_ABS/2008R2_schema/private/sam.ldb --schema=2012_R2

I hope this helps,

Andrew Bartlett
-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

Hi Andrew,

thanks a lot, that does indeed help me one step further. However, I do not
seem to get the schema upgrade running using samba-tool either:
> # samba-tool domain schemaupgrade -U Administrator
> Temporarily overriding 'dsdb:schema update allowed' setting
> ERROR(<type 'exceptions.OSError'>): uncaught exception -
[Errno 2] No such
> file or directory
>   File
"/usr/lib64/python2.7/site-packages/samba/netcmd/__init__.py", line
> 176, in _run
>     return self.run(*args, **kwargs)
>   File
"/usr/lib64/python2.7/site-packages/samba/netcmd/domain.py", line
> 4161, in run
>     stderr=subprocess.PIPE, cwd=temp_folder)
>   File "/usr/lib64/python2.7/subprocess.py", line 390, in
__init__
>     errread, errwrite)
>   File "/usr/lib64/python2.7/subprocess.py", line 1025, in
_execute_child
>     raise child_exception
>
and if I run it with basedir:
> # samba-tool domain schemaupgrade -U Administrator
> --base-dir=/usr/share/samba/setup/ad-schema/
> Temporarily overriding 'dsdb:schema update allowed' setting
> Applying Sch48.ldf updates...
> Exception: [Errno 2] No such file or directory:
> '/usr/share/samba/setup/ad-schema/Sch48.ldf'
> Error encountered, aborting schema upgrade
> ERROR: Failed to upgrade schema
>
Any suggestions?
Thanks a lot!

Best regards
Johannes


Am Fr., 7. Sep. 2018 um 20:35 Uhr schrieb Andrew Bartlett <
abartlet at samba.org>:
> On Fri, 2018-09-07 at 18:14 +0200, Johannes Engel via samba wrote:
> > Hi all,
> >
> > has anyone here experience with storing BitLocker and TPM data in AD
DS
> on
> > Samba?
> > I have stumbled across this Microsoft page (
> >
>
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-8.1-and-8/jj635854%28v%3dws.11%29
> )
> > stating that Windows 2008 R2 needs a schema extension to handle this.
> Since
> > this is not listed as a safe update in the wiki (
> > https://wiki.samba.org/index.php/Samba_AD_schema_extensions), I would
> like
> > to know if anybody has already tried this, since I do not have any
> > experience with restoring a schema after a failed import. ;)
> > Thanks a lot for your input.
>
> We actually have a fully tested (just not widely deployed) upgrade tool
> for schema, and a fully tested upgrade to the 2012 schema.
>
> From the testsuite:
>
> $BINDIR/samba-tool domain schemaupgrade -H
> tdb://$PREFIX_ABS/2008R2_schema/private/sam.ldb --schema=2012_R2
>
> I hope this helps,
>
> Andrew Bartlett
> --
> Andrew Bartlett                       http://samba.org/~abartlet/
> Authentication Developer, Samba Team  http://samba.org
> Samba Developer, Catalyst IT
> http://catalyst.net.nz/services/samba
>
>
>