[Samba] Samba 3 PDC - trouble renaming domain member computer

[ryan punt]

Sorry, forgot the obvious stuff:

Samba 3.0.14a on Debian Sarge (stock install).
LDAP backend, using ldapsam_compat.

Everything else works great, so I don't think it's a Samba config problem.

>>> "ryan punt" <rpunt at good-sam.com> 9/15/2006 9:04:09 AM >>>
All,

I've got a Samba 3 PDC serving numerous XP clients, and I'm getting an error I wouldn't have expected. When trying to rename an XP machine joined to the domain (via "netdom renamecomputer"), the command fails unless the specified domain user has UID 0.

The command in question:

netdom renamecomputer %COMPUTERNAME% /newname:%NEWNAME% /userD:DOMAIN\USER  /passwordd:PASSWORD /force

fails with "error 5: Access is denied" for UID >0 accounts, and succeeds for an account with UID 0.

Some background:

I have the following group mappings:
net groupmap list
Domain Administrators (S-1-5-21-1079125125-2089603153-60846589-512) -> Domain Admins
Domain Users (S-1-5-21-1079125125-2089603153-60846589-513) -> Domain Users
Domain Guests (S-1-5-21-1079125125-2089603153-60846589-514) -> Domain Guests

Domain Admins has a few members; among them, account testadmin has UID 0, and account printsetup has UID 12632.

Domain Admins has the following rights:
net rpc rights list "Domain Admins"
SeMachineAccountPrivilege
SePrintOperatorPrivilege
SeAddUsersPrivilege
SeRemoteShutdownPrivilege
SeDiskOperatorPrivilege

"Domain Admins" members have no individual rights assigned; rights are assigned to the group only.

So, it comes down to this: printsetup and testadmin have the same rights, the same group memberships, the same everything except UID. I've looked through the available rights list in the Samba docs and didn't see a specific "rename computer" right, and I would have expected membership in "Domain Admins" to be sufficient. However, I've found that UID >0 accounts can't rename domain computers; UID 0 accounts can.

Is this a known issue? I haven't seen anything in the docs, but I'll be digging in again shortly. High-level debugs available upon request.

Thanks,
Ryan
-------------- next part --------------
-------------------------------------------------

This email transmission and any documents, files or previous

email messages attached to it may contain information that is

confidential or legally privileged. If you are not the intended

recipient, you are hereby notified that any disclosure, copying,

printing, distributing or use of this transmission is strictly

prohibited. If you have received this transmission in error,

please immediately notify the sender by telephone or return

email and delete the original transmission and its attachments

without reading or saving in any manner.



The Evangelical Lutheran Good Samaritan Society.

---------------------------------------------------------