similar to: Users/admin unable to reset passwords

On Sun Jan 28 19:28:58 2024 Andrew Bartlett <abartlet at samba.org> wrote: > > On Wed, 2024-01-24 at 16:02 -0500, Mark Foley via samba wrote: > > > > It looks like I'm having a serious problem with passwords and domain > > credentials. > > After joining the office Windows workstations as domain members to > > the new AD, Iused ADUC to set

New related issue. I upgraded the Domain Controller from 4.8.2 to 4.18.9 about 90 days ago, and set the 'Maximum password age' to 90 days. Today, two of the users' passwords were expired when they tried to log in this morning. They got the messaage that their password was expired and to change it, but when doing so they keep getting "your password has expired." I've

Louis - thanks for this response. Unbeknownst to me my mail filter was not working and I've seen your message only today. I'm still struggling with this problem and have not found any answers yet. I'm interested in trying your solution, but need a bit of clarification. You wrote: > When i remove the user folder, and reappy it again from RSAT, but now with the UID/GID set, >

On Thu, 14 Jun 2018 16:03:35 -0400 Mark Foley via samba <samba at lists.samba.org> wrote: > Nevertheless, 'ls' does give names though I don't seem to have either > libnss-winbind or libpam-winbind files on my AD/DC. I keep forgetting that you use slackware, I suppose it uses something different, but do you have any file like: libnss_winbind.so.2 > > Circling back

With help from kjhambrick at linuxquestions.org I did figure out how to authenticate from a Window domain member to a samba share using AD credentials. My smb.conf is listed below. I was able to map the share from Windows using domain credentials and create a file on the share. Here's my next challenge: All the UID.GIDs on the share (287G and +105K files) are currently the non-AD values of

On Thu, 22 Aug 2019 08:04:10 +0100 Rowland penny <rpenny at samba.org> wrote: > > On 21/08/2019 22:47, Mark Foley via samba wrote: > > I have a NAS (Linux/Slackware 14.2) that is a domain member. "Normal" AD Windows users can map > > shared directories just fine without having to enter Credentials. If I try doing that with the > > domain Administrator it

>From your Global config I see no IDMAP settings. You need that for Linux to recognize your ad users. See my blog top post for example: Monklinux.blogspot.com Try my configuration, should work perfectly. Soz 4 short reply, typing on phone. Lemme know if it works. Note, pay attention to section under installing samba. On Sep 19, 2017 22:19, "Jamie McParland via samba" <samba at

On Thu, 14 Jun 2018 20:10:03 -0400 Mark Foley via samba <samba at lists.samba.org> wrote: > On Thu, 14 Jun 2018 21:37:58 +0100 Rowland Penny wrote: > > > > On Thu, 14 Jun 2018 16:03:35 -0400 > > Mark Foley via samba <samba at lists.samba.org> wrote: > > > > > Nevertheless, 'ls' does give names though I don't seem to have > > >

Rowland - thanks for your reply. I did send a message after this one you responded to with several other questions, but I'll pursue questioning on GID/UID in this reply as that is what you've mainly discussed. But, please check out that next email for other questions. Thanks. For a particular domain user in the AD, wbinfo gives: $ wbinfo -i mark HPRS\mark:*:3000026:100:Mark

Not quite 4 years ago I replaced our office SBS 2008 server with Samba4. I added Group Policies one of which was for Redirected Folders. I created a new GPO, "HPRS Groups" and did Edit > User Configuration > Policies > Windows Settings > Folder Redirection > right-click on Documents > Properties > Target = Settings Basic - Redirect everyone's folder to the same

Imo, this is a left over of an old bug, just remove the file Registry.po imo, i'll bet its never used. The computer looks for Registry.pol not Registry.po. > -rwxrwx--- 1 root users 958 2014-09-13 04:01 Registry.po* > -rwxrwx--- 1 3000000 users 958 2014-09-13 04:01 Registry.pol* Look at the date 2014, and i do remember something about this. But... What does getfacl say about

On Sat, 10 Oct 2015 16:07 Andrew Bartlett wrote > For the pain that you are about to endure, I can only offer my apologies. Apologies accepted! :) Seriously though, the Samba team has done a great job with the AD stuff. I was pretty much able to drop Samba4 in as a replacement for our SBS 2008 with virtually no issues. What issues I had were mostly Microsoft idiosyncracies (refer to my GPO

On Fri, 15 Jun 2018 12:32:52 +0200 L.P.H. van Belle wrote: > > > OK, Everyone is currently set to FULL CONTROL. I'll set that to READ. > > Ai, now... Nobody can write over the share, pc's wil complain. > Some GPO setting will stop working. But, when I ran your samba-check-set-sysvol.sh script it told me to set EVERYONE: READ. See below: > > $

On Sat, 10 Oct 2015 10:18 Rowland Penny wrote > ... the two ranges ('idmap config *' & 'idmap config HPRS') have to be separate > ranges that do not overlap, but there is also another range that doesn't appear > in smb.conf, this is the local users & groups that start at 0 and your idmap > ranges must not overlap this range as well and how do you do this

Thanks again for your quick reply ... You wrote: > > $ wbinfo -i mark > > HPRS\mark:*:3000026:100:Mark Foley:/home/HPRS/mark:/bin/false > > Ah but those numbers *do not* come from AD, they come from 'idmap.ldb' Hmmm, so my Samba4 assigned them when I ADUC-added the user? Maybe this is not an answerable question, but why is it picking those GID/UIDs? Why is it not

More experimentation ... I stopped Samaba, ldbedit'ed the /var/lib/samba/private/idmap.ldb and changed the line xidNumber: 3000026 to xidNumber: 10001 killed the cache and restarted Samba. As I hoped, the wbinfo now showed $ wbinfo -i mark HPRS\mark:*:10001:10000:Mark Foley:/home/HPRS/mark:/bin/bash which was NOT the case in my message below after killing the cache. In that previous

On Thu Apr 25 05:02:39 2024 Rowland Penny via samba <samba at lists.samba.org> wrote: > > On Mon, 22 Apr 2024 08:56:41 -0400 > Mark Foley via samba <samba at lists.samba.org> wrote: > > > New related issue. > > > > I upgraded the Domain Controller from 4.8.2 to 4.18.9 about 90 days > > ago, and set the 'Maximum password age' to 90 days.

On Fri, 15 Dec 2023 02:36:33 -0500 Mark Foley via samba <samba at lists.samba.org> wrote: > On Thu Dec 14 22:49:33 2023 Mark Foley via samba > <samba at lists.samba.org> wrote: > > > > On Thu Dec 14 19:27:29 2023 Matt Savin <matt at tegers.com> wrote: > > > I do not know who 'Matt Savin' is, but would he please reply to the list and not

I have a NAS (Linux/Slackware 14.2) that is a domain member. "Normal" AD Windows users can map shared directories just fine without having to enter Credentials. If I try doing that with the domain Administrator it prompts me for the credentials, then fails. On the NAS I can get an "OK" status with ntlm_auth using the administrator credentials. I cannot 'su -' to the

I have a Samba4 AD Domain with one of the file servers as a domain member. This file server host the main network shares for the domain. Currently, Windows users mapping this share are authenticated using their AD domain credentials. That all works just fine. What I want to do now is ALSO allow a user on a network host which IS NOT a domain member, and the user is not domain users to also