[Samba] Re: net rpc vampire - cannot login to migrated computer accounts

[John H Terpstra]

On Sunday 13 November 2005 12:50, Christoph Peus wrote:
> John H Terpstra wrote:
> ...
> > NT4 domain accounts can be migrated without need for domain members to be
> > rejoined to the domain. The "net rpc vampire" is inherently an NT4-style
> > migration process.
> >
> > Samba-3 is not capable of being an ADS server, hence the need for domain
> > members to be re-joined to the domain.
>
> I know that "net rpc vampire" is NT4-style and that samba-3 is not capable
> of being an ADS server, but does this imply that the migration of maschine
> accounts (which work afterwards) from a mixed mode AD is not possible? My
> understanding of "AD in mixed mode" has been that it's NT4-compatible to
> some degree and I doubt that the typical user (e.g. myself) has enough
> knowledge of the AD internals to know that this compatibility applies to
> users and groups but not to maschine accounts.

If you migrate the domain membership trust account for an NT4 Workstation or 
Server from ADS to Samba-3 the client does not need to be re-joined to the 
domain. It will work just fine because the client (NT4) is capable only of 
using an NT4-style domain interaction.

Windows 2000/2003/XP Pro client domain members of an ADS domain store 
credentials that are membership credentials that are specific to ADS. When 
the ADS domain accounts are migrated to a Samba-3 domain, the client tries to 
log onto the Samba-3 domain using ADS credentials - and logically, that 
fails. This has nothing to do with ADS-mixed mode, it is the result of the 
client having used the more advanced AD protocols when it was joined to the 
domain.

> Another point: The fact that "net rpc vampire" offers no option for a
> "user/group accounts only" migration suggests that migrating maschine
> accounts is generally sensefull, but what are maschine accounts worth, when
> maschines cannot login to them afterwards and which have to be recreated
> anyway by rejoining the domain?

The documentation does not address migration of ADS to Samab-3. Sorry. Maybe 
someone should contribute a chapter on that subject. :-)

> I read the migration chapters of your books carefully and found no
> reference to a "net rpc vampire" migration from a mixed mode AD. I searched

Correct. I do believe that the documentation is quite specific. We do support 
migration of NT4 domains to Samba-3. It is possible to migrate ADS domain 
accounts to Samba-3, but Samba-3 can not be an ADS server. I believe that is 
also very clearly documented, but I am willing to be proven wrong.

> the internet up and down for further information regarding my migration
> project, found a lot of Howtos and newsgroup postings, but nothing which
> said that migration of maschine accounts isn't possible in this
> environment, and I asked a samba team member at the SambaXP conference, who
> personally told me that "net rpc vampire works for AD/mixed mode", which
> means to me, that it works *completely*.

OK. Understood, sorry to hear that you have been mislead. I'll clarify the 
documentation further.

> So, I just write all this to point out that I'm not in the situation I'm in
> now because I've ignored the available documentation - to answer your other
> posting in this thread - but because I read it carefully and listened to
> the gurus. Obviously this wasn't sufficient.

Ah ah, the documentation clearly points out that Samba-3 is not capable of 
being an ADS server. I guess that is not clear enough so I'll fix it.

> Please:
>
> - Add one sentence to the migration chapters of your books, which point out
> that maschine accounts won't work afterwards when migrated from a mixed
> mode AD and that maschines will have to rejoin the domain.

OK. I'll add that.

> - "net rpc vampire" should offer an "skip maschine accounts" option for
> those users who want to migrate from mixed mode AD.

Please file a bug report on https://bugzilla.samba.org/ so this comes to the 
attention of the developers and does not get lost in the woodwork.

> Thanks!
>
> >>BTW: I'm not the first to encounter this problem. Another samba user
> >> (Kang Sun) reported exactly the same problem about a year ago, but
> >> didn't get an answer.
> >
> > The mailing list is a subscriber supported facility. If anyone has an
> > urgent need for answers they should obtain paid support. Please refer to
> > the Samba web site for information regarding paid support sources.
>
> I didn't mention this to claim that it's your duty to answer every question
> in a newsgroup (of course it's not!), but to point out that this question
> may be worth answering in general, esspecially because you can run into
> this problem though you have read the docs carefully, as I've tried to
> explain above.

I understand your point. I apologise for not stating more clearly what are the 
consequences of Samba not being able to be an ADS server. 

> PS: Is it known what's the cause for this maschine account incompatibility
> in detail? No way of reverting a client to a NT4-style trust to the
> samba-PDC?

Yes - the fact that the client was joined to ADS using Kerberos and LDAP 
protocols that Samba-3 does not support, except when used as a member of an 
ADS domain.

- John T.