similar to: member domain idmap config ad/rid

> > Yes, you have got it wrong ;-) :( If you do not want to add anything to AD, then you use the 'rid' > backend and 'ID' numbers will be calculated for you. You will also have > to place 'template' shell & homedir lines in smb.conf > If you want/need some of your users to have different login shells or > home directories, you will need to use the

> > Simple answer: > Administrator, No > Domain Admins, Yes Ok. It was already that way. root at fileserver:/etc/samba# getent group ... domain admins:x:10004: domain users:x:10000: dap:x:10003: dti:x:10001: For some reason with the administrator user is not working, I put my user as domain admin and include him as a member of unix and now I can access the security tab.

root at fileserver:~# getfacl /home/dados/ getfacl: Removing leading '/' from absolute path names # file: home/dados/ # owner: root # group: domain\040admins user::rwx group::rwx other::--- Still with the same problem. No security tab on windows machine. :( The "Administrator" and "Domain Admins" also need to have an unix attribute? On Tue, May 30, 2017 at 4:08 PM,

Rowland, AD: 4.5.8 Fileserver: 4.6.3 root at fileserver:~# samba -Version Version 4.6.3-Debian root at fileserver:~# net rpc rights list privileges SeDiskOperatorPrivilege -U "ADDC\administrator" Enter ADDC\administrator's password: SeDiskOperatorPrivilege: ADDC\Domain Admins BUILTIN\Administrators chown root:Domain\ Admins /mnt/dados >>>> ok chmod 0770

> > If you run getent passwd administrator on a DC, you should get > something like this: > root at dc1:~# getent passwd administrator > SAMDOM\administrator:*:0:10000::/home/administrator:/bin/bash On my DC getent passwd administrator show nothing. :( Is it necessary to map the root user to ADDC as well? There is however a gotcha, on any domain > joined windows machine there

> > Who are logged into the win7 machine as, Administrator or a member of > Domain Admins ? As administrator. I take it /mnt/dados is a mount from somewhere else, how is it mounted > and where from ? For now it is mounted on the folder /mnt/dados in the same HD of the fileserver. Later I'll add another HD with more space. root at fileserver:~# cd /mnt/dados/ root at

Rowland, I checked and got the entry for root in idmap.ldb To get 'getent' to show users on the DC, you need to have > libnss_winbind set up just like on a domain member. Okay. I installed the libnss-winbind package, configured the links to the lib, and now the getent passwd administrator works. Now, when running the testparm the error occurs: idmap range not specified for domain

On Mon, 29 May 2017 19:37:44 -0300 Elias Pereira via samba <samba at lists.samba.org> wrote: > Hello, > > If my AD will only provide service for machines with windows operating > system I can use the *idmap config ADDC: backend = ad*, correct or > did I get it all wrong? > > For both unix and windows machines I need *idmap config ADDC: backend > = rid* ? Yes, you

Hello guys, I configured the recycle in my fileserver, but when I logged in with normal user and delete some files, folders, etc, the errors occurs. ./addc-pc-01.log:28251: recycle: mkdir failed for .recycle with error: Permission denied ./addc-pc-01.log:28252:[2017/06/13 14:15:11.816085, 3] ../source3/modules/vfs_recycle.c:582(recycle_unlink) ./addc-pc-01.log:28253: recycle: Could not create

hello guys, In my tests lab did the migration ldap base of the old samba3 to Samba4 ADCD. It's possible to migrate directories and files from users of the old samba3 to Samba4 ADDC? -- Elias Pereira

Thanks for the feedback too Andrew!!! I will analyze and verify the least impactful way to try to solve this problem. On Wed, Nov 15, 2017 at 4:25 PM, Andrew Bartlett <abartlet at samba.org> wrote: > On Tue, 2017-11-14 at 16:05 -0200, Elias Pereira via samba wrote: > > Hello guys, > > > > I work at an institution where the domain is institute.edu.br. We have a >

> > No, you have hit a known bug. The 'idmap config ' work done for 4.6.0 > seems to be causing this, you can safely ignore this error. Ok Rowland, thanks!! Mas mesmo conseguindo corrigir os problemas acima, não consigo ter acesso a aba security com o usuario administrator. Verificando nos logs, aparece a mensagem abaixo. On Wed, May 31, 2017 at 11:59 AM, Rowland Penny via

Hello, Thanks for the feedback Garming!!! 👍 On Wed, Apr 17, 2019 at 12:35 AM Garming Sam <garming at catalyst.net.nz> wrote: > Hi, > > While I think we have most of the 2012 schema problems under control > now, there's still quite a bit of work to get the functional level > things working. In order to actually raise the level, we still need to > implement a number of

Hello, I upgrade the schema for our main ADDC and everything works properly, but the member DC (DC to an Existing AD) fails. Both servers are in version 4.10.2 Distro: Debian 9.8 *Main ADDC:* [2019/04/16 15:43:03.814846, 0] ../../source4/rpc_server/drsuapi/getncchanges.c:2919(dcesrv_drsuapi_DsGetNCChanges) ../../source4/rpc_server/drsuapi/getncchanges.c:2919: DsGetNCChanges 2nd replication

Thanks Rowland and Garming for your help!! How about "another DC", or 'a second DC' ? Ok. Got it! :D Alternatively, re-joining the domain controller (or joining a new DC and > demoting the old one) probably works because I believe there is code to > handle this case. I re-joined (remove secrets.tdb and .lbd, copy idmap from existing DC...) and now works properly!

Hello, I provisioned an samba AD with the bind_dlz option. So far so good. Followed the samba wiki. I have a DNS for our external access services (website, moodle, etc) and I'm using it as a forwarder to AD but it is not working. In a win7 I configured the AD IP as primary DNS and put it in the domain. When I try to access, for example, "wiki.samba.org" it opens normally, but when

Hello guys, I work at an institution where the domain is institute.edu.br. We have a main dns that answers for the internal and external services that we have. Firstly the staff here configured samba as domain institute.edu.br, but this way it is conflicting in the resolution of internal and external service names, since samba wants to respond for all requests and, even inserting a forward zone,

Rowland, Seeing as BIND_DLZ uses the same info in AD as SAMBA_INTERNAL does, > then no, using the internal dns server will not make any difference. Ok. Which ever dns server you use, it must be authoritative for the AD > domain and if required it should be a subdomain of your registered > domain, see here: > > https://wiki.samba.org/index.php/Active_Directory_Naming_FAQ >

hello list, What kind of hashing/encryption samba4 ADDC uses for user passwords? base64? Thanks! -- Elias Pereira

> > Sorry, must have missed that. No problem! :D OK, your dns domain is 'mydomain.edu' and your AD dns domain is 'addc.mydomain.edu', so far so good, but is the AD REALM set to 'ADDC.MYDOMAIN.EDU <http://addc.mydomain.edu/>' ? Yes, my AD REALM is ADDC.MYDOMAIN.EDU Yes, your AD DC should be the authoritative dns server for the AD dns > domain. ok.