[Samba] Can not add a new NT Workstation to a new (vampired) samba domain

[Stephen Vermeulen]

Stephen Vermeulen wrote:
> I am replacing an old NT4.0 Server with a debian 4.0R1 etch Linux 
> server (samba 3.0.24).
>
> This was with a completely fresh install of debian.
>
> My smb.conf is pretty simple:
>
> [global]
>     workgroup = BUTLER
>     netbios name = STAR3
>     passdb backend = tdbsam
>     domain master = No
>     domain logons = Yes
>     os level = 33
>     add user script = /usr/sbin/useradd -m '%u'
>     delete user script = /usr/sbin/userdel -r '%u'
>     add group script = /usr/sbin/groupadd '%g'
>     delete group script = /usr/sbin/groupdel '%g'
>     add user to group script = /usr/sbin/usermod -G '%g' '%u'
>     add machine script = /usr/sbin/useradd -s /bin/false -d /dev/null 
> '%u'
> #     wins server = [IP of wins server]
>
> [files]
>        comment = SAMBA File Server
>        path = /home/files
>        read only = No
>
> In addition I have the following smbusers file:
>
> star3:/etc/samba# cat smbusers
> root = Administrator
>
>
> testparm tells me this setup will give me a BDC.
>
> I first added the samba server (star3) to the old NT4 PDC using the 
> server manager tool
> and then did a:
>
> net rpc join -S nova -UAdministrator%password
>
> This worked and I was able to access the machine from the PDC.
>
> I then did a vampire:
>
> net rpc vampire -S nova -W BUTLER -UAdministrator%password
>
> and this worked for most of the user accounts and machine accounts 
> (there were some that
> had errors, but these were mostly for old users or machines that were 
> long since gone), these
> errors look like:
>
> Creating account: chris
> [2007/12/08 21:03:36, 0] passdb/pdb_tdb.c:tdb_update_samacct_only(1258)
>  Unable to modify passwd TDB! Error: Record does not exist occured 
> while storing the main record (USER_chris)
> Creating account: ECLIPSE$
> [2007/12/08 21:03:36, 0] passdb/pdb_tdb.c:tdb_update_samacct_only(1258)
>  Unable to modify passwd TDB! Error: Record does not exist occured 
> while storing the main record (USER_eclipse$)
> Creating account: GALAXY$
> [2007/12/08 21:03:36, 0] passdb/pdb_tdb.c:tdb_update_samacct_only(1258)
>  Unable to modify passwd TDB! Error: Record does not exist occured 
> while storing the main record (USER_galaxy$)
>
> In the case of GALAXY$, this is a current machine and it did seem to 
> function afterwards, though maybe
> its using stored credentials still?
>
> After the vampiring I shut down the NT4 PDC (nova) and did various 
> login and file sharing tests
> and the main accounts (including Administrator) all seemed to work. 
> The samba box was still
> functioning in BDC role.
>
> I then decided to try adding a new Windows XP Pro workstation to the 
> domain (it had previously
> been a member, but I had removed it from the old domain to experiment 
> with moving user profiles between
> domains).
>
> When I told it to join the domain it returned an error telling me that 
> it could not find the domain.
> So I thought "maybe a BDC cannot join new machines to the domain". 
> (The NT4 PDC was switched
> off at this time).
>
> So then I stopped samba and set:
>
> domain master = yes
> wins support = yes
>
> and restarted samba.
>
> Then when I tried to add the machine I got a Windows error dialog saying:
>
>   The following error occurred while attempting to join the domain 
> "Butler":
>   The user name could not be found.
>
> I was using the "Administrator" user name, and I was able to log into
> the BUTLER domain on another Windows box as the Administrator and
> access the file share on the samba box and create new files in the folder
> owned by Administrator.
>
> I googled this for a bit last night and found quite a few references 
> to this
> error, but nothing really conclusive.
>
> Any suggestions?
>
> Thanks
>
> Stephen.
>
I believe I have this working now as I have been able to add new
machines to my samba-based PDC in a couple of tests.  I still need
to do another pass through everything to make certain, but it appears
that doing the following three commands on the Linux box as root
was all that was needed:

star4:/etc/samba# net rpc getsid -S nova -UAdministrator%password
Storing SID S-1-5-21-1965320917-1955335400-7473742 for Domain BUTLER in 
secrets.tdb

star4:/etc/samba# net setlocalsid S-1-5-21-1965320917-1955335400-7473742

star4:/etc/samba# smbpasswd

Now if you review procedure 36.1 (in Chapter 36: Migration of NT4 PDC to 
Samba-3 PDC
in the Official Samba 3.2.x HOWTO and Reference Guide) you'll see that it:

1. does not mention the need to set the "smbpasswd"
2. does not mention the need to copy the NT4 PDC SID into the BDC

and to add to the confusion the "net rpc getsid" utility SAYS is is 
storing the domain's SID
into the BDC's secrets.tdb, but when I did a "net getlocalsid" 
afterwards I found that the BDC's
SID has NOT been changed and for this reason I needed to do the "net 
setlocalsid".

Thinking about this I'm guessing that because the smbpasswd for root had 
not been
set (as that was not in the migration guide steps) the "set rpc getsid" 
actually was not
able to write to the secrets.tdb file and it should have written an 
error instead of the
incorrect success message.

Perhaps the "net rpc vampire" should have copied the domain SID into the 
BDC as well,
and perhaps that had also silently failed because the smbpasswd had not 
been set?  It
could also be that vampiring intentionally does not copy the SID, so 
that if you are vampiring
from several domains you don't get confused?

The next step for me will be to repeat these tests with a fresh Linux 
install to see what is
really missing from Procedure 36.1.  I'm thinking that a:

Step 0: smbpasswd

is required, and then I'll check the BDC's SID after step 3 (net rpc 
vampire) to see if
the domain SID was copied across, and if not, then I'll copy it across 
into the BDC
as step 3.1.

Thanks,

Stephen