similar to: security = user: how to log-off from windows workstation

There is a network with windows 2008 AD DC and about 9 workstations plus some printers. The plan is to decomission the Win 2008 DC and reuse the hardware for other purposes at a later time (may be a samba AD DC, not important now). Samba Standalone is to take the role of a File and Print Server in this existing network. Questions: 1. Can Samba 4.5 "standalone" be started temporarily in

Hi All, It is unclear to me what group membership should \\server\users (or /srv/samba/users) get if it is planned to be ina standalone role... and using only POSIX ACLs. The relevant wiki instructions are stating: "Create the directory and set the correct permissions: # mkdir -p /srv/samba/users/ # chgrp -R "Domain Users" /srv/samba/users/ # chmod 2750 /srv/samba/users/"

There are two ubuntu 16.04 samba 4.5 servers. Ubuntu ADDC and a Member (ubuntu-dm1) >From Member "wbinfo -u" shows shows users of ADDC >From Member "net ads join -U administrator" was successfull with no errors. The dns A record was added in ADDC. But getent passwd <user> shows no results. DMember's /etc/nsswitch.conf passwd: compat winbind group:

Hi all,   can I freely create an account for the Wiki and do changes? Or should I notify someone (Rowland)? I found a small error in https://wiki.samba.org/index.php/User_Home_Folders . The wiki mentions as rights on the share Read and Execute for Authenticated Users, but on that level I see only Full Control, Change and Read. My assumption is that it should be Change and Read for Authenticated

Both ubuntu machines have iptables -L: Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination And the windows server firewall off How can that happen to me... I am speechless Lin

Hello, ldbsearch -H .... fails with a message that samba_dsdb is not found and LDB_MODULES_PATH needs to be set. Fixing it temporarily with: export LDB_MODULES_PATH=/usr/lib64/samba/ldb allows ldbseach command to work. Is it critical for ADDC operation though? [root at feddc ~]# rpm -q samba libldb ldb-tools samba-dc samba-4.7.0-12.fc27.x86_64 libldb-1.2.2-1.fc27.x86_64

Hi, The following problem: [root]#kinit administrator kinit: Cannot contact any KDC for realm 'DC-STATIC.LUUFORPROS.COM' while getting initial credentials A restart of samba.service finally starts krb5kdc: [root]#systemctrl restart samba [root]# ps axf |grep krb 1249 pts/0 S+ 0:00 \_ grep --color=auto krb 1212 ? S 0:00 | \_ /usr/sbin/krb5kdc -n

Thank you for your guidance. I must have something seriously wrong in the settings. Here is the eACL share: root at ubuntu-dm1:~# ls -l /srv/samba/eACLshare/ -d drwxr-xr-x 2 root domain admins 4096 Feb 21 09:00 /srv/samba/eACLshare/ >From Windows as an administrator of the domain, Comp Management - Connect to another computer -> System Tools I get UBUNTU-DM1 cannot be connected.... But

I made the changes you proposed but still my system must be messed up. Please have a look at the screenshots below... may be you or some other guru would know how to come out of this mess. http://pasteboard.co/Ba9Ex0NQD.png http://pasteboard.co/3Iq39El98.png By the way, is there a clean way to reset ADDC and DM so that I could start fresh? those two virt machines are just lab machines. I can do

On Tue, 26 Sep 2017 20:19:03 +0200 Marc Muehlfeld <mmuehlfeld at samba.org> wrote: > Hi, > > As you said: It's Fedora 27 _rawhide_. You should report a bug: > https://bugzilla.redhat.com/ > Please don't forget to attach logs, etc. Ok, I just opened a bug over there. But in the meantime found out that: Systemctl status samba.service shows the following as well:

Hi, I try to follow the instructions (https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs#File_System_ACLs_in_the_Back_End) A big screen pops up with when an attempt is made to connect to member server, then connection is granted but I am suspitious if changes can be made. SeDiskOperatorPrivilege on ADDC is granted to BUILTIN\Administrators and Domain Admins But the Member

Is using ADUC from a windows machine a complete substitute of what the wiki below explains? https://wiki.samba.org/index.php/LDB#ldbmodify Just curiuos because it seems beyond me at the moment to dig into it. Regards

Hi, Just curious if fedora samba packages which are curently at version 4.5.5 are AD DC and can be used as Ubuntu 4.3.11 as AD DC? -- best regards linforpros

When checking on the UNIX attributes of the Domain Admins group I get the warning "Unwilling to perform" Is this something I should resolve first? Lin

I have given the SeDiskOperatorPrivilege on the domain member but it did not help. The connection warning persists when I click on the "Shared Folders" + shared. It says to check network path, firewall rules. dismissing the window takes me to the domain member and shared folder can be selected and viewed. An attempt to modify and pressing "apply" results in another warning that

root at ubuntu-dm1:~# getent group Domain\ Admins domain admins:x:10004:

Here are ADDC files you requested to help me out: ++++++++++ /etc/hostname:dc1 /etc/hosts:127.0.0.1 localhost /etc/hosts:192.168.0.31 dc1.siouxfalls.samdom.org dc1 /etc/hosts: /etc/krb5.conf:[libdefaults] /etc/krb5.conf: default_realm = ${REALM} /etc/krb5.conf: dns_lookup_realm = false /etc/krb5.conf: dns_lookup_kdc = true /etc/resolv.conf:nameserver 192.168.0.31 /etc/resolv.conf:search

On Fri, 17 Feb 2017 07:02:23 -0600 Lin Pro <linforpros at gmail.com> wrote: > Hi, thank for the reply. Here is the smb.conf on the Domain Member > [global] > > idmap uid = 10000-20000 > idmap gid = 10000-20000 Remove the above lines, they are replaced by the 'idmap config' lines and you shouldn't have both. > client use spnego = yes > client ntlmv2 auth

On Fri, 17 Feb 2017 12:04:43 -0600 Lin Pro <linforpros at gmail.com> wrote: > >>> You are using the winbind 'ad' backend, do your users have a > 'uidNumber' attribute containing a unique number inside the range > '10000-999999' ? > Does 'Domain Users' have a 'gidNumber' attribute inside the same > range ? <<< >

On Fri, 17 Feb 2017 15:37:27 -0600 Lin Pro <linforpros at gmail.com> wrote: > ////ldbsearch does though, or ADUC on a windows version less than > 10//// > > Are you saying then that the problem would be in the group ID numbers > and user ID numbers in the case that I'm describing? What I am saying is that it looks like your users in AD do not have a uidNumber attribute