search for: rodcs

 Hi,  I am working on a deployment of Samba as a domain controller, with one central domain controller and several read-only DC.  The deployment works, and computers seems to interact with the RODCs as they should, but sometimes computers leave the domain after a password change.  This seems to happen only on RODC where the passwords have been replicated - on one occasion the RODC was not set to store password hashes, and computers connected to this RODC don't seem to have issues....

...so, why ? > RODC's are meant to be used where there are security and/or other > concerns, so if you have RWDC's at the same place, why use RODC's ? > > I have 3 sites and all of them has an RWDC and at least one RODC. I use multiple RWDCs to balance write load and multiples RODCs to reduce replication flow. Because of my database size and number of simultaneous clients, I needed to grow the number of controllers to balance LDAP queries since servers became unresponsive due to LDAP memory leaks. > Rowland > > > > -- > To unsubscribe from this list go to th...

On Tue, 23 Oct 2018 10:07:29 +1300 Garming Sam via samba <samba at lists.samba.org> wrote: > Hi, > > On 20/10/18 1:26 AM, Julien Ropé via samba wrote: > > > >  The deployment works, and computers seems to interact with the > > RODCs as they should, but sometimes computers leave the domain > > after a password change. > > > >  This seems to happen only on RODC where the passwords have been > > replicated - on one occasion the RODC was not set to store password > > hashes, and computers connected to...

> Jakob Curdes via samba<samba at lists.samba.org> wrote: > >> Hello, we have setup a SAMBA4 RODC in our setup where we have two >> exisitng RW Samba4 DC's. >> >> The RODC is joined correctly and can preload user accounts etc. It >> also can resolve its own name and the name of other DC's, also the >> SRV records needed. >> We created

Hello everybody, if I set up a RODC in a different site with an own subnet do I have to replicate the machine-passwords with "samba-tool rodc reload host\$ --server=addc"? Or can a machine always authenticate against a RODC? Greetings Stefan -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 195

Hello Stefan, you need to use "-U" with user from Domain Admin group(maybe it works with other users too, but I didn't test it). Andrej Am 07.08.2018 um 17:00 schrieb Stefan Kania via samba: > When I start the replication from the other DC it works as you can see: > ------- > root at addc-01:~# samba-tool drs replicate rodc-01 addc-01 dc=example,dc=net > Replicate

Hi Garming, > As far I know, all this should work as you would expect. Quite recently, > Andrew Bartlett and I went about testing some of the behaviour of the > KDC and confirming behaviour such as RODC ticket forwarding. thanks for the input. It gives me hope to dig deeper! I have some more time to spend on this issue today, I gonna try some more scenario. > The one thing to check

...t 2018 10:07:29 +1300 > > Garming Sam via samba <samba at lists.samba.org> wrote: > > > >> Hi, > >> > >> On 20/10/18 1:26 AM, Julien Ropé via samba wrote: > >>>  The deployment works, and computers seems to interact with the > >>> RODCs as they should, but sometimes computers leave the domain > >>> after a password change. > >>> > >>>  This seems to happen only on RODC where the passwords have been > >>> replicated - on one occasion the RODC was not set to store > >>> pas...

On Wed, 24 Jan 2024 15:54:38 +0100 Jakob Curdes via samba <samba at lists.samba.org> wrote: > Hello, we have setup a SAMBA4 RODC in our setup where we have two > exisitng RW Samba4 DC's. > > The RODC is joined correctly and can preload user accounts etc. It > also can resolve its own name and the name of other DC's, also the > SRV records needed. > We created

Hello, I just start testing the setup of an RODC with 4.8.3 (I use the packages from Louis). The join works fine. After a reboot of the rodc I can see all Objcts with: ldbsearch --url=/var/lib/samba/private/sam.ldb and all users and groups with: wbinfo -u wbinfo -g But as soon as I try to test the replication I got this message: ----------- root at rodc-01:/var/lib/samba/private# samba-tool drs

...My intuit is just to point out my experience with it. It is my first time with RODC too. :-) I don't know how it works on Windows. Do you know if, on a Window Server, DNS records of RODC are added automatically or manually? But at least for now, I think manually register should be documented so RODCs can function properly, right? > > > > > > > > > - "samba-tool dbcheck" changes instancetype of basically all > > > > objects from 4 to 0. > > > > > > '4' means 'The object is writeable on this directory.', well it...

Am 22.11.18 um 17:51 schrieb Rowland Penny via samba: > On Thu, 22 Nov 2018 17:29:16 +0100 > Stefan Kania via samba <samba at lists.samba.org> wrote: > >> Hello everybody, >> >> if I set up a RODC in a different site with an own subnet do I have to >> replicate the machine-passwords with "samba-tool rodc reload host\$ >> --server=addc"? Or

Hi everyone, I would like to have some input on ressources access from a workstation logged on a RODC server that has to connect on hub site servers. After login in the remote windows workstation, I have LOGONSERVER environment variable set to the local RODC server (workstation and user credentials have been preloaded). Everything works fine on local server. However if I want to connect to

Hi, I've tried replacing some 2012R2 RODC by samba-4.9.4 RODCs. One question about password replication: Samba wiki (https://wiki.samba.org/index.php/Join_a_domain_as_a_RODC) states that samba RODC acts as a proxy server to a writable DC if users are not member of the Allowed RODC Password Replication Group, which is the behavior we knew (and what we want...

...type 4 and dbcheck continues to change them - "samba-tool drs showrepl" exiting with WERR_DS_DRA_ACCESS_DENIED - "samba-tool domain tombstones expunge" is unable to expunge expired deleted objects My setup: - CentOS 7.6 - Samba 4.10.2 by Sernet - Bind 9.9 - PDC using BIND_DLZ - RODCs using BIND native replication I've fixed DNS and SPN records manually. Thank you, --- Emerson Kfuri <emersonkfuri at gmail.com> PGP Key ID: 333CF069

Hi Garming, > > If you don't make much progress on your own, one thing you could do is > turn up the logging level and send in some logs and network traces > (and the steps you took). This is usually the easiest way to diagnose > any obvious issues and gives a much better sense of what is actually > happening. sorry to come back to you so late... It seems inded to be some

When I run "gpresult /R" on one of my domain users the ". . . following security groups" listed at the bottom of the output includes "Denied RODC Password Replication Group". Did a little web search digging and found that RODC stands for Read Only Domain Controller. My domain consists of two DC's and one member server with three W10 workstations. I have never

Hello, we have setup a SAMBA4 RODC in our setup where we have two exisitng RW Samba4 DC's. The RODC is joined correctly and can preload user accounts etc. It also can resolve its own name and the name of other DC's, also the SRV records needed. We created an own site with specific subnet for this RODC "area". But we did not manage to get a join of a Windows server working

...tions: - Does samba 4.0.7 supports caching passwords for users? - What is the preload command for? Caching of passwords? The following link ( http://technet.microsoft.com/en-us/library/dd736918%28v=ws.10%29.aspx) talks about setting up the Next Closest DC in the network in the DC settings to allow RODCs to be trusted, should this be performed as well? Or is it enough to set it up as a GPO?

...are meant to be used where there are security and/or other > > concerns, so if you have RWDC's at the same place, why use RODC's ? > > > > > I have 3 sites and all of them has an RWDC and at least one RODC. I > use multiple RWDCs to balance write load and multiples RODCs to reduce > replication flow. Because of my database size and number of > simultaneous clients, I needed to grow the number of controllers to > balance LDAP queries since servers became unresponsive due to LDAP > memory leaks. That isn't really how RODC's are meant to be used....