samba - Feb 2019 - samba DC, clear cash guid

On Fri, 15 Feb 2019 12:11:30 +0500
Шигапов Денис Вильданович via samba <samba at lists.samba.org> wrote:
> Will it be enough to clean the files /var/lib/samba/*.tdb? Will this
> not lead to any errors?
> 
> On 15.02.2019 10:56, Шигапов Денис Вильданович via samba wrote:
> > Hi, I set all users guidNumber in DC
> > but the id command displays the cached results, for example
> > id user.pertov displays 3000123, should 100001233.
> > How to clear the cache 
> 
> 
net cache flush

Rowland

thank you very much.
by the way, is it possible to specify arbitrary guid for BUILTIN and /NT 
AUTHORITY/// in samba DC

example guid NT AUTHORITY\Authenticated Users in dc01 = 300002, in dc02 
= 300005
I would like that  to guid dc01 == dc02

On 15.02.2019 14:32, Rowland Penny via samba wrote:
> net cache flush

On Fri, 15 Feb 2019 15:34:14 +0500
Шигапов Денис Вильданович via samba <samba at lists.samba.org> wrote:
> thank you very much.
> by the way, is it possible to specify arbitrary guid for BUILTIN
> and /NT AUTHORITY/// in samba DC
> 
> example guid NT AUTHORITY\Authenticated Users in dc01 = 300002, in
> dc02 = 300005
> I would like that  to guid dc01 == dc02
> 
> On 15.02.2019 14:32, Rowland Penny via samba wrote:
> > net cache flush
> 
> 
Firstly, stop calling it 'guid', a 'GUID' is something else
entirely in
AD ;-)

I think you want your BUILTIN groups to have the same ID's on all DC's,
this is fairly easy, but first, why they are different. These users and
groups are mapped in idmap.ldb and the ID's are allocated on a first
come basis, this means, as you have found out, that users & groups can
have different ID's on different DC's. This wouldn't be a problem,
except for Sysvol, which isn't automatically synced between Samba AD
DC's and before you ask, information on how to do this can be found
here:

https://wiki.samba.org/index.php/SysVol_replication_(DFS-R)

Now you know why they are different, I think you can see that the only
way to get the same ID's is if idmap.ldb files are the same on all
DC's. Instructions on how to do this can be found here:

https://wiki.samba.org/index.php/Joining_a_Samba_DC_to_an_Existing_Active_Directory#Built-in_User_.26_Group_ID_Mappings

Rowland