[Samba] DC priority, BDC prob with domain groups

[Gaiseric Vandal]

There was an incorrect entry in smb.conf on BDC1 which mean it was not 
registering in WINS as a bdc.  According to the Samba How To 
documentation, all other things being equal, Windows clients will use a 
bdc rather than a pdc.

Now when I logon, I may get any of the three domain controllers.  When I 
get BDC1 (Samba 3.0.37) I don't seem have problems.




So my following problems remain:
      Can I adjust some variable so that one DC is more likely to be 
used by windows clients than another?
      Why does Samba 3.4.3 not seem to handle domain groups as members 
of local groups?


If I connect from XP Pro client GATES

[2009/11/16 17:34:46,  3] auth/auth.c:222(check_ntlm_password)
   check_ntlm_password:  Checking password for unmapped user 
[]\[]@[GATES] with t
he new password interface
[2009/11/16 17:34:46,  3] auth/auth.c:225(check_ntlm_password)
   check_ntlm_password:  mapped user is: [DOMAIN]\[]@[GATES]
...


It also looks like I may not get the same logon server each time I 
logon-  so I guess my PC could have authenticated against one DC, and I 
could authenticate against another.


Thanks



On 11/13/09 19:04, Gaiseric Vandal wrote:
> Setting "announce version = 4.5" in smb.conf on BDC2 did not change
> anything.  (The other samba domain still use 4.9 as the default version.)
> Windows clients will still connect to BDC2 (if it is running.)  On each
> DC, net getdomainsid and getlocalsid show that the local sid on each
> machine is the domain sid.
>
>
> BDC2# net getdomainsid
> SID for local machine BDC2 is: S-1-5-21-xxx-xxx-x99
> SID for domain DOMAIN is: S-1-5-21-xxx-xxx-x99
>
> BDC2# net getlocalsid
> SID for domain BDC is-xxx-xxx-x99
> BDC2#
>
>
> Pdbedit -Lv, wbinfo -u and wbinfo -g all seem to give the same results
>
> Also
>
> BDC# wbinfo -t
> checking the trust secret via RPC calls succeeded
>
>
> Thanks
>
> -----Original Message-----
> From: Gaiseric Vandal [mailto:gaiseric.vandal at gmail.com]
> Sent: Friday, November 13, 2009 12:48 PM
> To: samba at lists.samba.org
> Subject: DC priority, BDC prob with domain groups
>
> I have the following setup:
>       PDC:  Samba 3.0.37 on Solaris 10
>       BDC1: Samba 3.0.37 on Solaris 10
>       BDC2: Samba 3.4.3 on Solaris 10
>
>
> Samba 3.0.37 is the bundled version of Samba.
> Samba 3.4.3 is compiled from source.
>
> BDC2 is a recent addition to the network.
> All machine use LDAP as the backend for everything.  They use winbind to
> handle a domain trust with another domain, but otherwise isn't needed.
>
> If I start samba on BDC2 and logon to an XP  (or Win 2003) Machine, the
> logon will be to BDC2.    This can be verified with echo
> %logonserver%.    Rebooting the XP machine is probably not necessary to
> see this.
>
> If I login as the domain administrator, I am effectively not considered
> a member of the local administrator group.  If I look at the local
> Administrator group I will see the DOMAIN/Administrators as members.
> But I am unable to install software,  see all local files, add users to
> local groups etc.
>
>
> "OS level" on all three DC's was not explictly set, so was 20 by
> default.  I changed BDC2 to "os level=0" and set the PDC to "os
> level=33."  I did not restart samba on PDC.   It seems to be a browsing
> issue.
>
> I still logon to BDC2.
>
> So I have two issues:
>
> 1-  How to make sure that the PDC (or PDC and BDC1) use used in
> preference to BDC2.  I assume that something about BDC2 having a newer
> ver of samba is getting it priority.
>
>
> 2.  What is wrong with the domain members in local users group.   This
> may be a BDC config in general issue (and I just never found it because
> BDC1 never took precendence over PDC) or it may be  something to do with
> Samba 3.4.x vs 3.0.x.
>
>
>
>
> Thanks
>
>
>
>
>