similar to: Cleanup after site deleted

I have this warning message when I try to logon using a domain user to the DC itself: "Failed to establish your Kerberos Ticket cache due time differences with the domain controller. Please verify the system time." I have set up PAM using this file: /usr/share/pam-configs/winbind: Name: Winbind NT/Active Directory authentication Default: yes Priority: 192 Auth-Type: Primary Auth:

On Wed, 2018-02-07 at 18:38 +0100, Denis Cardon via samba wrote: > Hi Roy, > > > First some background: > > ================== > > I had a test environment which had two samba DCs (running v 4.8.0rc2) and 1 > > Windows Server 2008R2 DC. The samba DCs had been upgraded from v 4.6x and the > > secrets database was not encrypted (as far as I know). I decided

Hi, I have a samba domain based on Samba version 4.7.4 compiled from sources running on Debian Stretch v 9.3. The domain is working fine, but when I try to add another DC (a Windows Server 2008 Standard Edition) using the Wiki at https://wiki.samba.org/index.php/Joining_a_Windows_Server_2008_/_2008_R2_DC_to_a _Samba_AD it fails with the error: "The operation failed because: The functional

On 11/04/2020 11:00, Rowland penny wrote: > > Just confirmed that pam_mkhomedir is not enabled, created a new user test2 using ADUC. Set the Home folder on the Profile tab > to > > connect H: to \\<server name>\users\test2 and the folder is created on the server. > > > > Regards, > > > > Roy > > > > > That is NOT the users home

> -----Original Message----- > From: Tim Beale [mailto:timbeale at catalyst.net.nz] > Sent: 29 August 2019 22:08 > To: Roy Eastwood; samba at lists.samba.org > Subject: Re: [Samba] Online Backup Fails - list index out of range > > On 30/08/19 4:20 AM, Roy Eastwood via samba wrote: > > INFO 2019-08-29 17:04:06,889 pid:13945 /usr/lib/python3/dist-packages/samba/join.py

Thanks Rowland. > -----Original Message----- > From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of Rowland > Penny via samba > Sent: 21 July 2018 18:04 > To: samba at lists.samba.org > Subject: Re: [Samba] Failed to establish your Kerberos Ticket cache due time > differences with the domain controller > > On Sat, 21 Jul 2018 17:36:14 +0100 > Roy

In another thread on this list (https://lists.samba.org/archive/samba/2019-August/225607.html), Rowland suggested that the following command doesn't work ie it still requests the password: samba-tool domain backup online --targetdir=<output-dir> --server=<DC-server> -k yes However, I tried it out on one of my DCs and found it created the backup but failed at the end as this

Hai Roy, Hmm, i dont know for sure, but based on my google magic, i say your correct. Lowering the samba DC domain level should help you out. If someone can confirm this, thanks! But i must mention. Adding a "unsupported" ms 2008 server as dc... wil cost you ms licenses.. I suggest if possible, add a new samba AD DC. Add the windows server as member, and you dont have to lower

[snip] > Samba AD with MIT Kerberos > -------------------------- > > After four years of development, Samba finally supports compiling and > running Samba AD with MIT Kerberos. You can enable it with: > > ./configure --with-system-mitkrb5 > > Samba requires version 1.15.1 of MIT Kerberos to build with AD DC support. > The krb5-devel and krb5-server packages

> -----Original Message----- > From: Rowland Penny [mailto:rpenny at samba.org] > Sent: 01 December 2017 17:40 > To: samba at lists.samba.org > Cc: Roy Eastwood > Subject: Re: [Samba] Restricting AD group logging on to Servers > > On Fri, 1 Dec 2017 17:06:42 -0000 > Roy Eastwood via samba <samba at lists.samba.org> wrote: > > > Hi, > > I have a

Rowland, In the Wiki page "User Home Folders", Section 2.1 "Using Windows ACLs" correctly describes how to set permissions to allow the Windows program Active Directory Users and Computers to automatically create the user's home folder. But in the next section "Creating the Home folder for a New User" 3.1 "Using Windows ACLs", the blue box states

Hi, I have a Debian Stretch system running a self-compiled version 4.7.3 of Samba. Having followed the Samba WiKi to allow AD users to log onto the servers using PAM authentication, I now want to restrict access to specified group(s). So I created a linuxadmins group and made some test users members of the group. Initially I tried to restrict access by modifying /etc/security/access.conf

Thanks Rowland, our messages crossed in the post; as you see I worked it out - eventually :-) Roy > -----Original Message----- > From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of > Rowland penny via samba > Sent: 15 May 2019 16:04 > To: samba at lists.samba.org > Subject: Re: [Samba] ImportError: No module named 'dns' > > On 15/05/2019 15:44, Roy

On 10/04/2020 19:22 Rowland penny wrote: > On 10/04/2020 18:02, Roy Eastwood via samba wrote: > > Rowland, > > > > In the Wiki page "User Home Folders", Section 2.1 "Using Windows ACLs" > > correctly describes how to set permissions to allow the Windows > > program Active Directory Users and Computers to automatically create the user's home

On 18/09/2019 13:10, Rowland penny via samba wrote: > On 18/09/2019 12:34, Roy Eastwood via samba wrote: > > I used the DC rejoin method as described in the WiKi to upgrade one of my DCs to version 4.11.0. Following the steps, when I came > > to rejoin the domain, it initially failed, complaining that the DC already existed, but to force the rejoin, remove the files: > >

On Fri, Jun 8, 2018 at 12:25 PM Rowland Penny via samba <samba at lists.samba.org> wrote: > > > I have update the Time Synchronisation Wikipage: > > https://wiki.samba.org/index.php/Time_Synchronisation > > It now includes information for the 'chrony' time server. > > If you spot any errors or omissions, or if you think that something > could be said

Hi , Need to see if it is possible to do * Restrict local Storage use - Means how to restrict via group policy so that logon user in Samba AD will not be able to save any files on local storage of C: of D: drives . He can save on mapped Drive ( From Samba File Server ) . * Restrict web Access via any Browser via Group Policy We have used samba-4.8.3 and windows version is win

[snip] > > > try adding the 'require_membership_of' line to the winbind auth line in > > > PAM. > > > Rowland > > Thanks Rowland, that did the trick and is the simplest solution. > > > > Found that only one \ was required to separate the domain part from the group name part - ie DOMAIN\linuxadmins rather than > > DOMAIN\\linuxadmins.

After updating my samba version to 4.10.3 (from a self-compiled 4.10.2 version) on a DC running on Debian Stretch, I notice errors in the logs when samba_dnsupdate is run. Manually running it produces: root at debian-vb:~# samba_dnsupdate --verbose Traceback (most recent call last): File "/usr/local/samba/sbin/samba_dnsupdate", line 56, in <module> import dns.resolver

I used the DC rejoin method as described in the WiKi to upgrade one of my DCs to version 4.11.0. Following the steps, when I came to rejoin the domain, it initially failed, complaining that the DC already existed, but to force the rejoin, remove the files: secrets.ldb and secrets.tdb. I assume you don't demote the DC before the upgrade, as there's no mention of this? Anyway, I