search for: sidmap

...path = /var/lib/samba/sysvol/medarts.lan/scripts read only = No [sysvol] path = /var/lib/samba/sysvol read only = No Note that the SIDs are out of my specified range below: ldbsearch -H /var/lib/samba/private/idmap.ldb # record 1 dn: CN=S-1-1-0 cn: S-1-1-0 objectClass: sidMap objectSid: S-1-1-0 type: ID_TYPE_BOTH xidNumber: 3000013 distinguishedName: CN=S-1-1-0 # record 2 dn: CN=S-1-5-21-1106274642-2786564146-798650368-501 cn: S-1-5-21-1106274642-2786564146-798650368-501 objectClass: sidMap objectSid: S-1-5-21-1106274642-2786564146-798650368-501 type: ID_TYPE_BOTH xidN...

...read only = No > > [sysvol] > path = /var/lib/samba/sysvol > read only = No > > Note that the SIDs are out of my specified range below: > ldbsearch -H /var/lib/samba/private/idmap.ldb > # record 1 > dn: CN=S-1-1-0 > cn: S-1-1-0 > objectClass: sidMap > objectSid: S-1-1-0 > type: ID_TYPE_BOTH > xidNumber: 3000013 > distinguishedName: CN=S-1-1-0 > > # record 2 > dn: CN=S-1-5-21-1106274642-2786564146-798650368-501 > cn: S-1-5-21-1106274642-2786564146-798650368-501 > objectClass: sidMap > objectSid: S-1-5-21-110627464...

...> path = /var/lib/samba/sysvol > > read only = No > > > > Note that the SIDs are out of my specified range below: > > ldbsearch -H /var/lib/samba/private/idmap.ldb > > # record 1 > > dn: CN=S-1-1-0 > > cn: S-1-1-0 > > objectClass: sidMap > > objectSid: S-1-1-0 > > type: ID_TYPE_BOTH > > xidNumber: 3000013 > > distinguishedName: CN=S-1-1-0 > > > > # record 2 > > dn: CN=S-1-5-21-1106274642-2786564146-798650368-501 > > cn: S-1-5-21-1106274642-2786564146-798650368-501 > > objectCla...

...r/lib/samba/sysvol >>> read only = No >>> >>> Note that the SIDs are out of my specified range below: >>> ldbsearch -H /var/lib/samba/private/idmap.ldb >>> # record 1 >>> dn: CN=S-1-1-0 >>> cn: S-1-1-0 >>> objectClass: sidMap >>> objectSid: S-1-1-0 >>> type: ID_TYPE_BOTH >>> xidNumber: 3000013 >>> distinguishedName: CN=S-1-1-0 >>> >>> # record 2 >>> dn: CN=S-1-5-21-1106274642-2786564146-798650368-501 >>> cn: S-1-5-21-1106274642-2786564146-798650368-...

On Sun, Oct 25, 2020 at 2:38 PM Rowland penny via samba <samba at lists.samba.org> wrote: > So '5035' is a computer, but what is '3000011' ? > You can find out by running this on the DC: > ldbsearch -H /path/to/idmap.ldb '(&(objectClass=sidMap)(xidNumber=3000011))' =================================== # ldbsearch -H /usr/local/samba/private/idmap.ldb '(&(objectClass=sidMap)(xidNumber=3000011))' # record 1 dn: CN=S-1-5-21-546846319-217595157-9522986-1328 cn: S-1-5-21-546846319-217595157-9522986-1328 objectClass: sidMap obje...

...bjectClass: posixGroup objectClass: group msSFU30NisDomain: ccenter uSNChanged: 3798 distinguishedName: CN=Users,CN=Builtin,DC=ads,DC=ccenter,DC=lan > and the same command will show who '3000009' is: > ldbedit -e nano -H /var/lib/samba/private/idmap.ldb > '(&(objectClass=sidMap)(xidNumber=3000009))' > If you haven't get 'ldbedit', install ldb-tools That is one handy tool, I may say! > When you run the second command, what does the line that starts 'cn:' show ? Nothing useful, unfortunately. # ldbedit -e cat -H /var/lib/samba/private/idma...

I've got this on the backup DC root at bdc:~# wbinfo --sid-to-gid S-1-5-21-1166961617-3197558402-3341820450-516 3000000 while root at bdc:~# ldbedit -H /usr/local/samba/private/idmap.ldb objectsid=S-1-5-21-1166961617-3197558402-3341820450-516 shows correct xid 3000019 and on the primary DC I've got itk at dc:/$ wbinfo --sid-to-gid S-1-5-21-1166961617-3197558402-3341820450-516 3000019

...ing 'ldbedit -e nano -H /var/lib/samba/private/idmap.ldb' > on both machines and then searching for the relevant xidNumber. On the > first DC, I get: > > dn: CN=S-1-5-21-2025076216-3455336656-3842161122-516 > cn: S-1-5-21-2025076216-3455336656-3842161122-516 > objectClass: sidMap > objectSid: S-1-5-21-2025076216-3455336656-3842161122-516 > type: ID_TYPE_BOTH > xidNumber: 3000025 > distinguishedName: CN=S-1-5-21-2025076216-3455336656-3842161122-516 > > On the second DC, I get: > > dn: CN=S-1-5-21-2025076216-3455336656-3842161122-516 > cn: S-1-5-21-...

...;. But when I bring up GUI on the same share, it magically resolve SID's into "Server Operators" which is matching the # ldbsearch -s sub -H /var/lib/samba/private/idmap.ldb '(|(xidNumber=30000)(xidNumber=30001))' # record 1 dn: CN=S-1-5-32-549 cn: S-1-5-32-549 objectClass: sidMap objectSid: S-1-5-32-549 type: ID_TYPE_BOTH xidNumber: 30000 distinguishedName: CN=S-1-5-32-549 # record 2 dn: CN=S-1-5-18 cn: S-1-5-18 objectClass: sidMap objectSid: S-1-5-18 type: ID_TYPE_BOTH xidNumber: 30001 distinguishedName: CN=S-1-5-18 However, there lies the problem: # getent passwd 3000...

...0NisDomain: ccenter >> uSNChanged: 3798 >> distinguishedName: CN=Users,CN=Builtin,DC=ads,DC=ccenter,DC=lan >> >>> and the same command will show who '3000009' is: >>> ldbedit -e nano -H /var/lib/samba/private/idmap.ldb >>> '(&(objectClass=sidMap)(xidNumber=3000009))' >>> If you haven't get 'ldbedit', install ldb-tools >> That is one handy tool, I may say! >> >>> When you run the second command, what does the line that starts 'cn:' show ? >> Nothing useful, unfortunately. > Yes...

...5-18 that is wrong by pointing at proxmox$ (which incidentally, > is one of your computers) > Try backing up idmap.ldb, then open idmap.ldb in ldbedit, find and > delete the stanza that holds CN=S-1-5-18, it will look like this: > > dn: CN=S-1-5-18 > cn: S-1-5-18 > objectClass: sidMap > objectSid: S-1-5-18 > type: ID_TYPE_BOTH > xidNumber: 3000002 # NOTE: your number will be different! > distinguishedName: CN=S-1-5-18 > > Just delete it and then close & save your editor, run 'net cache flush' > and then let Samba recreate the record. So, I did...

...i fix them? Thanks. > Fix what? The owner has to be 'root', and you can find out just who > '3000002' & '3000003' are by opening /var/lib/samba/private/idmap.ldb > with ldbedit and searching for them. # record 48 dn: CN=S-1-5-18 cn: S-1-5-18 objectClass: sidMap objectSid: S-1-5-18 type: ID_TYPE_BOTH xidNumber: 3000002 distinguishedName: CN=S-1-5-18 # record 6 dn: CN=S-1-5-11 cn: S-1-5-11 objectClass: sidMap objectSid: S-1-5-11 type: ID_TYPE_BOTH xidNumber: 3000003 distinguishedName: CN=S-1-5-11 > The 'cn' will contain the win...

:-| ls -lnd /opt/samba/var/locks/sysvol drwxrwx---+ 3 0 3000000 4096 Jun 16 13:56 /opt/samba/var/locks/sysvol Em 16-06-2017 13:38, Rowland Penny via samba escreveu: > On Fri, 16 Jun 2017 13:15:19 -0300 > "Carlos A. P. Cunha" <carlos.hollow at gmail.com> wrote: > >> OK, sorry, uncomment a line :-D >> >> Yes exist! >> >> ls -ld

GPO's fail to apply on Windows clients and sysvol permission errors are logged. DC is Samba 4.13.0 created via a classic upgrade. Logged sysvol errors (uid 5025 is the system I ran gpupdate on, don't know what uid 3000011 refers to): =================================== Oct 25 12:17:09 srvr01 smbd[3762]: [2020/10/25 12:17:09.695062, 0]

...hnology FP, Inc > > On 07/02/2015 12:26 PM, Rowland Penny wrote: >> On 02/07/15 16:55, Ryan Ashley wrote: >>> Rowland, here is what I found in the ldb. >>> >>> # record 68 >>> dn: CN=S-1-5-32-544 >>> cn: S-1-5-32-544 >>> objectClass: sidMap >>> objectSid: S-1-5-32-544 >>> type: ID_TYPE_BOTH >>> xidNumber: 3000000 >>> distinguishedName: CN=S-1-5-32-544 >>> >>> # record 70 >>> dn: CN=S-1-5-32-549 >>> cn: S-1-5-32-549 >>> objectClass: sidMap >>> obj...

...his can be checked by running 'ldbedit -e nano -H /var/lib/samba/private/idmap.ldb' on both machines and then searching for the relevant xidNumber. On the first DC, I get: dn: CN=S-1-5-21-2025076216-3455336656-3842161122-516 cn: S-1-5-21-2025076216-3455336656-3842161122-516 objectClass: sidMap objectSid: S-1-5-21-2025076216-3455336656-3842161122-516 type: ID_TYPE_BOTH xidNumber: 3000025 distinguishedName: CN=S-1-5-21-2025076216-3455336656-3842161122-516 On the second DC, I get: dn: CN=S-1-5-21-2025076216-3455336656-3842161122-516 cn: S-1-5-21-2025076216-3455336656-3842161122-516 object...

...: > On Sun, Oct 25, 2020 at 2:38 PM Rowland penny via samba > <samba at lists.samba.org> wrote: >> So '5035' is a computer, but what is '3000011' ? >> You can find out by running this on the DC: >> ldbsearch -H /path/to/idmap.ldb '(&(objectClass=sidMap)(xidNumber=3000011))' > =================================== > # ldbsearch -H /usr/local/samba/private/idmap.ldb > '(&(objectClass=sidMap)(xidNumber=3000011))' > # record 1 > dn: CN=S-1-5-21-546846319-217595157-9522986-1328 > cn: S-1-5-21-546846319-217595157-9522986...

On 02/07/15 16:55, Ryan Ashley wrote: > Rowland, here is what I found in the ldb. > > # record 68 > dn: CN=S-1-5-32-544 > cn: S-1-5-32-544 > objectClass: sidMap > objectSid: S-1-5-32-544 > type: ID_TYPE_BOTH > xidNumber: 3000000 > distinguishedName: CN=S-1-5-32-544 > > # record 70 > dn: CN=S-1-5-32-549 > cn: S-1-5-32-549 > objectClass: sidMap > objectSid: S-1-5-32-549 > type: ID_TYPE_BOTH > xidNumber: 3000001 > distin...

...ators. Production domain (migrated from Samba 3): wbinfo --sid-to-uid=S-1-5-32-544 failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-32-544 to uid ldbsearch -H /var/lib/samba/private/idmap.ldb | grep S-1-5-32-544 -A2 dn: CN=S-1-5-32-544 cn: S-1-5-32-544 objectClass: sidMap objectSid: S-1-5-32-544 type: ID_TYPE_GID xidNumber: 15538 distinguishedName: CN=S-1-5-32-544 Testing lab domain (provisioned from scratch): wbinfo --sid-to-uid=S-1-5-32-544 3000003 ldbsearch -H /usr/local/samba/private/idmap.ldb | grep S-1-5-32-544 -A2 dn: CN=S-1-5-32-544 cn: S-1-5-32-544 object...

...d Penny wrote: >>>> On 02/07/15 16:55, Ryan Ashley wrote: >>>>> Rowland, here is what I found in the ldb. >>>>> >>>>> # record 68 >>>>> dn: CN=S-1-5-32-544 >>>>> cn: S-1-5-32-544 >>>>> objectClass: sidMap >>>>> objectSid: S-1-5-32-544 >>>>> type: ID_TYPE_BOTH >>>>> xidNumber: 3000000 >>>>> distinguishedName: CN=S-1-5-32-544 >>>>> >>>>> # record 70 >>>>> dn: CN=S-1-5-32-549 >>>>> cn...