samba - Feb 2019 - winbind offline logon

On Tue, 19 Feb 2019 17:20:10 +0100
"L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:
> Hai Pivial, 
> 
> > -----Oorspronkelijk bericht-----
> > Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> > Piviul via samba
> > Verzonden: dinsdag 19 februari 2019 14:58
> > Aan: samba at lists.samba.org
> > Onderwerp: Re: [Samba] winbind offline logon
> > 
> > Il 19/02/19 12:02, L.P.H. van Belle via samba ha scritto:
> > > [...]
> > > Everything, you can do in NTDOM, you can in AD DOM.
> > you are saying me that an AD domain can be configured to 
> > allow a domain user to move the time back of one year or more 
> > (what I have seen today for example) in a member PC of a AD domain? 
> 
> Ah, here it starts.. Why would you allow a user to set the time back
> a year? That is an Administrator it task, not a user in my opinion. 
> In a normal NTDomain setup, this is also not allowed by default. 
I used to work for a firm that every month end used to wind the time
back a few days, they did this because they hadn't finished booking
things in and out, so could not run the month end routines.
This wasn't on a domain, it was on the Unix that thought it owned Linux.

I suppose you could do something similar on AD, but you would have to
wind back every machine in the domain.

Rowland

Il 19/02/19 17:41, Rowland Penny via samba ha scritto:
> [...]
> I suppose you could do something similar on AD, but you would have to
> wind back every machine in the domain.
do you mean that if one user have to wind back the time of his PC all pc 
of the domain must have wind back?

Piviul

On Wed, 20 Feb 2019 12:56:38 +0100
Piviul via samba <samba at lists.samba.org> wrote:
> Il 19/02/19 17:41, Rowland Penny via samba ha scritto:
> > [...]
> > I suppose you could do something similar on AD, but you would have
> > to wind back every machine in the domain.
> do you mean that if one user have to wind back the time of his PC all
> pc of the domain must have wind back?
> 
> Piviul
> 
All Domain computers have to be within 5 minutes of each other, so yes.

There is a big problem with this though, AD is littered with
timestamps, so it probably will not work.

Rowland