[Samba] Trying to establish a unidirectional Trust between windows 2003 and samba 3

Administrator admin at bbs1emden.de
Thu Nov 11 01:31:39 MST 2010

i am trying to establish a unidirection trust between win2k3 and samba3. 
I followed 
I want windows to trust samba so that i can access the windows shares 
with my samba-users.
The Linux system is CentOS 5.5 with samba3.x86_64 3.5.6-43.el5 from the 
sernet-samba repository. Accounts are stored in ldap with help of 
The samba domain is MY_DOMAIN, server is platin. Win2k3's domain is 
MYDOM.local, server is messing.
What I did is:
start domain.msc, establish new trust, fill in the samba domain name 
MY_DOMAIN, say its "unidirectioal outgoing"/"unidirektional ausgehend", 
mark that it is "domain wide authentication"/"Domänenweite 
Authentifizierung", fill in a trust password "not_24get" and mark "not 
confirm outgoing trust". The trust was succesfully created. A message 
dialog tells me that the SID-filter is activated, should i deactivate that?
On samba side:
net -I rpc trustdom add messing not_24get 
-Uadministrator%not24getEither -d 1
returns no errors, acount messing$ is created. The Paramater -i is added because samba doesn't listen to localhost.
However when i try to check the status of the trust i get the error 
"The trust could not be confirmed, access denied"/"Die Bestätigung der 
Vertrauensstellung zwischen der Domäne MYDOM.local und MY_DOM konnte 
nicht einwandfrei durchgeführt werden. Grund: Zugriff verweigert. 
Entfernen Sie die Vertrauensstellung auf beiden Seiten, und fügen Sie 
sie erneut hinzu."

I set my log level = 2 in smb.conf but my server is busy and i see many 
messages. Searching for "messing" in the logfile gave no helpful hints.
Accessing shares from a samba domain memeber failes with "trust between 
primary domain and trusting domain could not be established".

What did i do wrong? What can i do next to track down the error?

Thanks a lot
Malte Müller

More information about the samba mailing list