similar to: samba support of KB5020276 workaround

Hi everybody, since a couple of years, user X can't join a computer to AD if the computer object has been created by user Y. It is KB5020276?Netjoin: Domain join hardening changes [1]. The documentation suggests a workaround, basically a group policy applied to all the domain controllers. Is it that possibile to apply group policies to a samba DC? The group policy I'm talking about

> I?ve spent a lot of time working on this. There?s no workaround that actually works. > > The machine account must me deleted and recreated by the new user. I use a generic user to own these new account so I keep it even if the employee adding machines leaves. > > LP thank you a lot: you're saving me a lot of time! Francesco

Hi, Not sure of the etiquette of this, so apologies if this is frowned upon, but a couple of months ago, this[1] question was asked. I'm trying to join a Samba 4.2.2 server to a Samba 3.4.7 PDC (e.g. Think NT4, not AD), which is also our OpenLDAP principal server. I'm failing because, although my "net rpc join" command seems to succeed, and the host entry is added to the

Just a pointer.. try with settings like : client lanman auth = yes client NTLMv2 auth = no client plaintext auth = yes i dont know the exact setting are which you need, but look in the man of smb.conf man smb.conf search for NT4, you see more settings. Greetz, Louis >-----Oorspronkelijk bericht----- >Van: dmorgan at westquad.med.harvard.edu >[mailto:samba-bounces at

I'm trying to install samba4 with openldap, as from http://wiki.samba.org/index.php/Samba4/LDAP_Backend/OpenLDAP, I have got the yesterday realease, last git commit: commit 2024d4fb27514869d78e9bb39085f98e80413529 Date: Mon Jan 25 12:41:48 2010 +0100 My system is GNU/Debian Linux Lenny. ./configure --prefix=/opt/samba4 make sudo make install all worked ./setup/provision from the source4

Hi all, I am having problems with using XP Pro to connect to a samba share. All I get from XP are repated dialogs asking for my username and password. My linux box has been joined to the local windows domain. I am using encrypted passwords and the security level is set to user. If I set the log level to 10 I can see that LM and NT4 MD password checks failed on the challenge returned by the XP

Hai, And you are not looking for this? https://wiki.samba.org/index.php/Delegation/Joining_Machines_to_a_Domain Greetz, Louis > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens > Osipov, Michael via samba > Verzonden: donderdag 10 januari 2019 16:23 > Aan: samba at lists.samba.org > Onderwerp: [Samba] Running off pre-created

> On Fri, 16 Feb 2018 12:12:32 +0100 > Francesco Malvezzi via samba <samba at lists.samba.org> wrote: > >> dear experts, >> >> I would like to setup idmap config ad. I have already the uidNumber >> attribute populated on AD. >> >> But there is something very basic wrong with my config: > > Yes, there is something wrong ;-) > See below

On 03/06/15 13:42, Francesco Malvezzi wrote: > Il 03/06/15 13:58, Rowland Penny ha scritto: >> On 03/06/15 12:42, Francesco Malvezzi wrote: >>>> Hmm, '--with-ldap' is the default, so you don't really need to give it, >>>> what OS are you compiling on ? what extra packages did you install >>>> before you compiled samba ? >>>>

Il 03/06/15 13:58, Rowland Penny ha scritto: > On 03/06/15 12:42, Francesco Malvezzi wrote: >>> Hmm, '--with-ldap' is the default, so you don't really need to give it, >>> what OS are you compiling on ? what extra packages did you install >>> before you compiled samba ? >>> >>> Rowland >> >> it is Debian GNU/Linux Wheezy,

Il 16/02/18 12:58, Rowland Penny via samba ha scritto: > On Fri, 16 Feb 2018 12:39:37 +0100 > Francesco Malvezzi via samba <samba at lists.samba.org> wrote: > [...] >> >> should I remove tout-court this part? > > Not sure I understand that, but it sounds like you are asking if you > should remove the lines, if so, the answer is yes. You understood correctly.

Hello all, I'm having problems getting Samba to join a Windows AD. I am delegated OU admin, and have no direct access to the domain controller. We have 3 DCs in one domain where my OU exists. The users I wish to authenticate are in a different domain. I have set up Kerberos and can receive tickets correctly. I run net -d 4 ads join createcomputer=[Delegated OU] -U [account with join

The config looks ok, thats great. :-) Its not needed to stop samba running : net cache flush If you run: net cache list and have a look, then flush it and look again. You see its empty. If you need to copy the idmap than it is needed to stop samba. Can you show me an output of. dpkg -l | egrep "tevent|tdb|ldb|talloc|cmocka" Im running latest versions of these. Own compile or

Quoting Dan Oriani via samba <samba at lists.samba.org>: > Quoting Dan Oriani via samba <samba at lists.samba.org>: > >> Quoting Rowland Penny via samba <samba at lists.samba.org>: >> >>> On Tue, 06 Feb 2018 14:09:08 -0500 >>> Dan Oriani via samba <samba at lists.samba.org> wrote: >>> >>>> >>>> I'm

Il 16/02/18 13:43, Rowland Penny via samba ha scritto: > On Fri, 16 Feb 2018 13:10:16 +0100 > Francesco Malvezzi via samba <samba at lists.samba.org> wrote: > >> >> So just to recap: there were two problems: >> >> 1) the syntax mistake in smb.conf pointed up before; > > This wouldn't have helped. > >> 2) a logical mistake because wbinfo

Il 04/09/18 06:00, Volker Lendecke ha scritto: > Hi! > > Technical description below, but the exec summary is: Yes, we have a > performance problem with gencache. > > On Wed, Aug 29, 2018 at 10:28:05AM +0200, Francesco Malvezzi via samba wrote: >> Hi all, >> >> I have a midsize AD domain with some 50k users but only 100 workstations >> joined. >>

Hi all, Playing with delegation today we delegated rights to some user on some OU and its contents for it can modify users inside that OU and children. We used "advanced view" in ADUC then "properties" on our delegated OU, then "security" tab, and finally we gave rights to our user. Perhaps this process is not correct but we believe it is a valid process to delegate

Hi, Following that link https://support.microsoft.com/en-us/kb/932455 we created a delegation to permit some group to add computers into AD. That works except if some computer with same name was already added (even if this computer with same name was previously cleanly removed from AD). Anyone who has idea what we missed? Cheers, M.

On Fri, 16 Feb 2018 12:39:37 +0100 Francesco Malvezzi via samba <samba at lists.samba.org> wrote: > > On Fri, 16 Feb 2018 12:12:32 +0100 > > Francesco Malvezzi via samba <samba at lists.samba.org> wrote: > > > >> dear experts, > >> > >> I would like to setup idmap config ad. I have already the uidNumber > >> attribute populated

On Fri, 16 Feb 2018 14:26:57 +0100 Francesco Malvezzi via samba <samba at lists.samba.org> wrote: > Il 16/02/18 13:43, Rowland Penny via samba ha scritto: > > On Fri, 16 Feb 2018 13:10:16 +0100 > > Francesco Malvezzi via samba <samba at lists.samba.org> wrote: > > > >> > >> So just to recap: there were two problems: > >> > >>