search for: ryandbair

I've been playing with a MIT powered DC. There are two DCs, an existing Heimdal based one running Samba 4.5 and a new MIT based one running 4.7.6. There are clients running Windows 7 and 10, a 2012R2 server, and a Samba 4.5 file server. Once the new MIT DC is brought online, clients can no longer connect to the Windows server by hostname. Connections still work via IP address which makes me

I apologize if this is a really silly question but I've been messing with this for awhile now and cannot see any typos that would prevent these shares from showing up. I'm trying two things I've never done before so I want to make sure to point them out: 1) I am using groups in the "valid users" section 2) I am using preexec and postexec on each share Example: [Media]

I just noticed I'm getting some pretty extreme CPU usage on my Samba server when transferring files. The Samba server has a quad core 2.0gHz Core2. During transfers, CPU use spikes to 100-200% with a throughput around 30MB/s. I'm using the registry config backend. [global] use kerberos keytab = True server string = X dns proxy = yes log file =

Running Samba 3.2.3 on Debian Lenny, amd64. I'm joined to an AD realm, authentication works fine for Windows clients. I'm able to see that the clients are using Kerberos, not NTLM to authenticate to the shares. However when I look at the keytab, my entries have the short names like "service/shortname@REALM" instead of "service/fqdn@REALM". Looking at Windows servers on

I'm attempting to get an old NT4 client participating in a Samba4 domain. Users can logon to the machine locally and access network shares on other machines in the network. However, no one can access shares on the NT4 machine using the machine name. Attempting this results in an error "The account is not authorized to log in from this station." Using the IP address does work however.

The services and their port numbers and protocols are defined in /etc/services. You should be able to use that file to map from port numbers to services if you want to use the service names instead. This is not something new with firewalld, iptables has had this option forever as well. On Thu, Aug 27, 2015 at 12:20 AM, Robert Moskowitz <rgm at htt-consult.com> wrote: > Now with

I was attempting to view enctypes of various principals on my domain after getting some errors like "KDC has no support for encryption type" on a DC running Samba 4.7.6 with MIT KDC . Running `net ads enctypes list MACHINEACCOUNT$` gives an error: kinit: Client 'WORKGROUP at AD.DOMAIN.NAME' not found in Kerberos database while getting initial credentials What could cause this

I have a Debian Etch AMD64 server running Samba 3.0.24. It is joined to an active directory domain. Most everything works quite well. I had set up a user for a scanner but forgot to add it to a group so that it could access the target folder, so the scans failed. I then added the account to the group, but for some reason it is still denied access to the directory. I su'ed to the user, and

>From what I'm reading, in 3.2 you need to have the SePrintOperatorPrivilege in order to install drivers. Is there anyway around this to allow certain users/groups to install without requiring the privilege? I've tried using the printer admin option, but it doesn't seem to have any effect. Thanks

I'm running Samba 4.0.7 on CentOS 6.4 as a AD DC with s3fs. I have a shared directory with the setgid bit set. From the shell on the server, new files and directories inherit the group as expected. However, new items created through samba get the user's primary group instead. Config for the share is super simple: [test] path = /srv/test read only = no Sounds like a

I migrated over a Samba 3/LDAP domain to Samba 4 in a test environment. After a few bumps due to not having all my machine accounts as posixAccounts and clashing user/group names, the migration went relatively smoothly. Great work, Samba team! I have a few standing issues that I haven't been able to shake out: 1. wbinfo returns various errors when run on the DC. wbinfo -D MYDOMAIN returns a

I attempted to set up unsolicited remote assistance via group policy, but connections to the client machines fail. A network trace show the 'expert' machine doing a TGS-REQ to the DC which responds with a KRB5KDC_ERR_POLICY. This seems to be the origin of the problem. I noticed in the request, the username of the 'novice' is given as the Server Name but is otherwise pretty

I'm running Samba 4.0.7 on CentOS 6.4 running double duty as DC and file server. OS X clients are taking a _long_ time to list long directories. One directory with 10K entries is taking 3-4 minutes to display the entries in Finder. I captured a few seconds worth of packets and noticed that it's doing three requests per file: 1. NTCreateAndX - just opens the file 2. Close 3. FIND_FIRST2 -

Running 4.1.6-SerNet-RedHat-7.el6 on CentOS 6.5. I've been bumping my head against GPO issues and am now wondering if its connected to my BUILTIN groups not mapping on my DC. For instance on DC: sh-4.1# wbinfo --gid-info=544 failed to call wbcGetgrgid: WBC_ERR_DOMAIN_NOT_FOUND Could not get info for gid 544 But on a member: sh-4.1# wbinfo --gid-info=544 BUILTIN\administrators:x:544:

Hi Ralph, Thanks for the reply and thank you for your work on vfs_fruit. On Fri, Jan 29, 2016 at 11:09 AM, Ralph Boehme <rb at sernet.de> wrote: > Hi, > > On Thu, Jan 28, 2016 at 10:40:32PM -0500, Ryan Bair wrote: > > I have a share with approximately 5000 folders in the base directory. The > > performance on an OS X client is somewhat less than exciting. I compiled

I have a share with approximately 5000 folders in the base directory. The performance on an OS X client is somewhat less than exciting. I compiled the latest Samba 4.3 tarball and enabled fruit per the modules man page, however directory listing performance still takes a few seconds. I've cranked the fruit debug level up to 10 and can see that it is getting used ("fruit_stat called for

I have a domain that I upgraded from a Samba 3/LDAP set up about a year ago. I haven't done anything too interesting with it and it's generally been working OK. I attempted to create a new GPO for my domain. From a Win 7 client I get an error "This security ID may not be assigned as the owner of this object". Thinking this was an issue with sysvol acls, I ran "samba-tool