[Samba] Yearly attempt at 'vampire' of NT4 domain

[Daniel Kasak]

Hi all.

Since our NT4 PDC is on it's last legs, I've been motivated to once 
again try to use samba's vampire functionality. Unfortunately I'm 
actually doing worse than last year ...

My smb.conf:

[global]
        socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
        interfaces = 10.146.0.254/255.255.0.0
        encrypt passwords = yes
        printing = cups
        name resolve order = wins lmhosts bcast
        server string = Samba Server %v
        debug level = 9
        os level = 33
        bind interfaces only = true
        max log size = 50
        log file = /var/log/samba3/log.%m

        password server = NUS_AUST_NT

        security = domain
        workgroup = NUSAUS
        netbios name = screamer
        wins server = 10.146.0.2
        domain master = no
        domain logons = no

        local master = no
        preferred master = no

        add user script = /usr/sbin/useradd -m '%u'
        delete user script = /usr/sbin/userdel -r '%u'
        add group script = /usr/local/bin/smbgrpdadd.sh '%g
        delete group script = /usr/sbin/groupdel '%g'
        add user to group script = /usr/sbin/usermod -G '%g' '%u'
        add machine script = /usr/sbin/useradd -s /bin/false -d 
/dev/null '%u'


If I add an account for screamer ( normal account ) in the NT4 PDC, I 
can join the domain and people can access my shares ( not listed ). 
However if I run:

> net rpc vampire -S NUS_AUST_NT -W NUSAUS -U administrator

I get:

> Cannot import users from NUSAUS at this time, as the current domain:
>         SCREAMER: S-1-5-21-2979890208-4094237718-1229784985
> conflicts with the remote domain
>         NUSAUS: S-1-5-21-667748849-896033114-1233803906
> Perhaps you need to set:
>
>         security=user
>         workgroup=NUSAUS
>
>  in your smb.conf?

Also, if I remove this server from the domain and add it as a BDC ( as 
some places have suggested ), and also change the line in my smb.conf:

        domain logons = no
to:
        domain logons = yes

I'm unable to join the domain at all ... I get a message about 
conflicting credentials. The *only* way I can join is as a normal 
workstation AND domain logins = no

Who knows what's going on?

-- 
Daniel Kasak
IT Developer
NUS Consulting Group
Level 5, 77 Pacific Highway
North Sydney, NSW, Australia 2060
T: (+61) 2 9922-7676 / F: (+61) 2 9922 7989
email: dkasak at nusconsulting.com.au
website: http://www.nusconsulting.com.au