[Samba] Samba + Winbind help

Mike Hobbs
Mon, 17 Nov 2025 19:39:03 -0000

Hi,

We do not have two domains but we do have two active directory servers
for the same domain, gotta have a backup/spare!? I assumed we needed an
entry for each server.

A lot of the options in my current smb.conf file I believe are defaults
and can be removed, most of my file is legacy hold over stuff from a
long time ago, like the "wide links" option.? At one point we needed
it
for AMD (auto mount daemon)? to work correctly.? Since we moved to
autofs we may not actually need it.

I know NIS is old, I can not turn it off.? We actually use it for our
Linux authentication.? This will change at some point, probably should
have moved to something else years ago.

I can try your changes and get back to you.? Thank you!

mike

On 11/17/2025 2:14 PM, Rowland Penny via samba wrote:
> Lets start by discussing these lines:
>
> workgroup = MYWINDOMAIN
>
> idmap config * : backend = tdb
> idmap config * : range = 10000 - 499999
> idmap config server1.my.domain : backend = tdb
> idmap config server1.my.domain : range = 500000 - 1000000
> idmap config server2.my.domain : backend = tdb
> idmap config server2.my.domain: range = 1000001 - 1999999
>
> Do you have two domains ?
> If you do not and want Samba to map your users & groups from the RID,
> then I would expect idmap config lines something like these:
>
> idmap config * : backend = tdb
> idmap config * : range = 3000 - 7999
> idmap config MYWINDOMAIN : backend = rid
> idmap config MYWINDOMAIN : range = 10000 - 9999999
>
> NOTE: you will probably have to run 'net cache flush' after you
change
> the smb.conf and restarted Samba.
>
> I would also suggest you do two things:
> 1) open a copy of the smb.conf manpage (man smb.conf) in a terminal and
> read about the other parameters you are using, there are others that
> you could remove.
>
> 2) Turn NIS off, it is dead and you very probably do not need it.