[Samba] NT4-Samba Migration Test Results

[John H Terpstra]

On Tue, 30 Sep 2003, Larry Liu wrote:

Larry,

I have found that the easiest way to migrate from NT4 to SAmba3 is to:

1. Use tdbsam as a medium for migration.
2. Before migrating accounts:
	i. Make sure that you configure your smb.conf carefully
	ii. Include all the "user/group/machine scripts"
	iii. Do NOT run smbd before vampire is run.
3. Set up the smb.conf for a Samba-BDC
4. Join the domain before running vampire
5. Then finally run vampire.

IF you want to use an LDAP or smbpasswd backend, use pdbedit to migrate
the database.

- John T.

> John,
>
> We previously corresponded on our testing of Samba 3.0.0 RC4. Since
> then,
> we have downloaded the Samba 3.0.0 Release version for testing with some
>
> interesting results.
>
> The Setup
> Major Networks: Solaris (NIS), Windows Native NT4 Domain
>
> Our Test Plan
> We are testing Samba 3.0 as a candidate for replacing the old NT4
> Domain.
> Being a complex production networking environment, we replicated the
> networking scenario for testing in our lab.
>
> Current Test Results:
>
> Test 1:
> passwd backend = smbpasswd
>
> First,  we followed your instructions in Chapter 31 of the Samba HOWTO
> Collection. When we ran the exact syntax for "net rpc vampire",  no
> accounts
> migrated from the NT4 PDC to our Samba v3.0 Samba PDC running on
> Solaris.
>
> Test 2:
> passwd backend = smbpasswd
> Problem Resolution:
>
> We imported all the NIS accounts and NT4 machine accounts into the local
>
> account database of the Solaris server.  Then, we ran "net rpc vampire"
> again.
> This time only 2620 of our 5000+ NT4 accounts migrated.
>
> After choking, the following error message was generated:
>
> [2003/09/29 12:36:51, 0]
> utils/net_rpc_samsync.c:fetch_group_mem_info(591)
>   Could not find global group 512
> [2003/09/29 12:36:51, 0]
> utils/net_rpc_samsync.c:fetch_group_mem_info(591)
>   Could not find global group 513
> Failed to fetch domain database: NT code 0x00000001
>
> Test 3:
> passwd backend = tdbsam
> Problem Resolution:
>
> We reread your Chapter 11 Part III Advanced Configuration documentation
> from May 24, 2003 and the tdbsam password backend looked interesting.
> Although it warned that it should be limited to <250 accounts, we
> decided to
> try it. It ran perfectly! All 5000+ NT4 accounts migrated.
>
> We tested NT4 and Win2K machine accounts  and user logins. All were
> good,
> no extra configuration required.
>
>
> Comments
> Vampire is very cool indeed! Perhaps there have been changes in the
> password
> backends since the May 24th documentation. However, smbpasswd didn't
> work
> in our tests and tdbsam did.
>
> Questions
>
> 1. We are inquiring if there are any warnings or known gotcha's with the
> tdbsam
> or any updates to the smbpasswd? If there are no issues we will likely
> use the
> tdbsam scenario for our actual production NT4 migration.
>
> 2. We invented the part about pre-importing the NIS and machine accounts
> into the
> local OS. Does that sound like a best practice, or is there a better
> way?
>
>
> So far, so good. Samba 3 is pretty cool...
> We are looking forward to your thoughts and comments on the 2 questions.
>
>
>
> Larry Liu
> Robert Inerbickler
>
> NT Migration Team
> Sun Microsystems
>
>

-- 
John H Terpstra
Email: jht at samba.org