[Samba] Samba AD master browser

Maarten Claes MClaes at baltimoreaircoil.be
Mon Dec 8 01:23:20 MST 2014


Installed: Samba 4.1.13, running as AD

>From time to time, users get disconnected from their shares. At that 
moment, windows explorer is not responding, freezing up the whole PC.
I suspect this issue is caused by samba4 not being the master browser.

Running smbclient -L on the AD server returns nothing for the master 
browser:

[root at BEHESR-FS1 ~]# smbclient -L //localhost -U Administrator
..........
Domain=[BACEU] OS=[] Server=[]

        Server               Comment
        ---------            -------

        Workgroup            Master
        ---------            -------


Running the same command on our current SMB3 server (being migrated to the 
samba AD domain) returns this:

[root at BEHESR-FS1 ~]# smbclient -L //x.x.x.x -U Administrator
..........
        Workgroup            Master
        ---------            -------
.....
        BACEU                H3Q7422

with H3Q7422 being a windows7 client.

with SMB3, with the seperate nmb daemon there was the option to force the 
election (smbcontrol nmbd force-election). How can this be done with 
samba4 AD? 
Also, nothing is logged about the election process. It looks like samba is 
not starting the election process.


smb.conf:

[global]
        dos charset = CP850
        unix charset = UTF-8
        workgroup = BACEU
        realm = BAC.EU
        netbios name = BEHESR-FS1
        netbios aliases =
        netbios scope =
        server string = Samba 4.1.13
        interfaces = x.x.x.x/20, 127.0.0.1/8
        bind interfaces only = Yes
        server role = active directory domain controller
        security = USER
        auth methods =
        encrypt passwords = Yes
        client schannel = Auto
        server schannel = Auto
        allow trusted domains = Yes
        map to guest = Never
        null passwords = No
        obey pam restrictions = No
        password server = *
        smb passwd file = /usr/local/samba/private/smbpasswd
        private dir = /usr/local/samba/private
        passdb backend = samba_dsdb
        algorithmic rid base = 1000
        root directory =
        guest account = nobody
        enable privileges = Yes
        pam password change = No
        passwd program =
        passwd chat = *new*password* %n\n *new*password* %n\n *changed*
        passwd chat debug = No
        passwd chat timeout = 2
        check password script =
        username map =
        username level = 0
        unix password sync = No
        restrict anonymous = 0
        lanman auth = No
        ntlm auth = Yes
        client NTLMv2 auth = Yes
        client lanman auth = No
        client plaintext auth = No
        client use spnego principal = No
        preload modules =
        dedicated keytab file =
        kerberos method = default
        map untrusted to domain = No
        log level = 2
        syslog = 1
        syslog only = No
        log file = /var/log/samba/log.%m
        max log size = 2200
        debug timestamp = Yes
        debug prefix timestamp = No
        debug hires timestamp = Yes
        debug pid = No
        debug uid = No
        debug class = No
        enable core files = Yes
        smb ports = 445, 139
        large readwrite = Yes
        server max protocol = SMB3
        server min protocol = LANMAN1
        client max protocol = SMB3
        client min protocol = CORE
        unicode = Yes
        min receivefile size = 0
        read raw = Yes
        write raw = Yes
        disable netbios = No
        reset on zero vc = Yes
        log writeable files on exit = No
        defer sharing violations = Yes
        nt pipe support = Yes
        nt status support = Yes
        max mux = 50
        max xmit = 16644
        name resolve order = lmhosts, wins, host, bcast
        max ttl = 259200
        max wins ttl = 518400
        min wins ttl = 21600
        time server = No
        unix extensions = No
        use spnego = Yes
        client signing = default
        server signing = default
        client use spnego = Yes
        client ldap sasl wrapping = plain
        enable asu support = No
        svcctl list =
        cldap port = 0
        dgram port = 0
        nbt port = 0
        krb5 port = 0
        kpasswd port = 0
        web port = 0
        rpc big endian = No
        deadtime = 120
        getwd cache = Yes
        keepalive = 60
        lpq cache time = 30
        max smbd processes = 0
        max disk size = 0
        max open files = 16384
        socket options = TCP_NODELAY
        use mmap = Yes
        use ntdb = No
        hostname lookups = No
        name cache timeout = 660
        ctdbd socket =
        cluster addresses =
        clustering = No
        ctdb timeout = 0
        ctdb locktime warn threshold = 0
        smb2 max read = 1048576
        smb2 max write = 1048576
        smb2 max trans = 1048576
        smb2 max credits = 8192
        load printers = No
        printcap cache time = 0
        printcap name = /dev/null
        cups server =
        cups encrypt = No
        cups connection timeout = 30
        iprint server =
        disable spoolss = No
        addport command =
        enumports command =
        addprinter command =
        deleteprinter command =
        show add printer wizard = Yes
        os2 driver map =
        mangling method = hash2
        mangle prefix = 1
        max stat cache size = 256
        stat cache = Yes
        machine password timeout = 604800
        add user script =
        rename user script =
        delete user script =
        add group script =
        delete group script =
        add user to group script =
        delete user from group script =
        set primary group script =
        add machine script =
        shutdown script =
        abort shutdown script =
        username map script =
        username map cache time = 0
        logon script =
        logon path = \\%N\%U\profile
        logon drive =
        logon home = \\%N\%U
        domain logons = No
        init logon delayed hosts =
        init logon delay = 100
        os level = 255
        lm announce = Auto
        lm interval = 60
        preferred master = Yes
        local master = Yes
        domain master = Yes
        browse list = Yes
        enhanced browsing = Yes
        dns proxy = Yes
        wins proxy = No
        wins server =
        wins support = Yes
        wins hook =
        lock spin time = 200
        oplock break wait time = 0
        ldap admin dn =
        ldap delete dn = No
        ldap group suffix =
        ldap idmap suffix =
        ldap machine suffix =
        ldap passwd sync = no
        ldap replication sleep = 1000
        ldap suffix =
        ldap ssl = start tls
        ldap ssl ads = No
        ldap deref = auto
        ldap follow referral = Auto
        ldap timeout = 15
        ldap connection timeout = 2
        ldap page size = 1024
        ldap user suffix =
        ldap debug level = 0
        ldap debug threshold = 10
        eventlog list =
        add share command =
        change share command =
        delete share command =
        preload =
        lock directory = /usr/local/samba/var/lock
        state directory = /usr/local/samba/var/locks
        cache directory = /usr/local/samba/var/cache
        pid directory = /usr/local/samba/var/run
        ntp signd socket directory =
        utmp directory =
        wtmp directory =
        utmp = No
        default service =
        message command =
        get quota command =
        set quota command =
        remote announce =
        remote browse sync =
        nbt client socket address = 0.0.0.0
        nmbd bind explicit broadcast = Yes
        homedir map = auto.home
        afs username map =
        afs token lifetime = 604800
        log nt token command =
        NIS homedir = No
        registry shares = No
        usershare allow guests = No
        usershare max shares = 0
        usershare owner only = Yes
        usershare path = /usr/local/samba/var/locks/usershares
        usershare prefix allow list =
        usershare prefix deny list =
        usershare template share =
        async smb echo handler = No
        panic action =
        perfcount module =
        host msdfs = Yes
        passdb expand explicit = No
        idmap backend = tdb
        idmap cache time = 604800
        idmap negative cache time = 120
        idmap uid =
        idmap gid =
        template homedir = /home/%D/%U
        template shell = /bin/false
        winbind separator = \
        winbind cache time = 300
        winbind reconnect delay = 30
        winbind request timeout = 60
        winbind max clients = 200
        winbind enum users = Yes
        winbind enum groups = Yes
        winbind use default domain = No
        winbind trusted domains only = No
        winbind nested groups = Yes
        winbind expand groups = 5
        winbind nss info = template
        winbind refresh tickets = No
        winbind offline logon = No
        winbind normalize names = No
        winbind rpc only = No
        create krb5 conf = Yes
        ncalrpc dir = /usr/local/samba/var/run/ncalrpc
        winbind max domain connections = 1
        winbindd socket directory =
        winbindd privileged socket directory =
        winbind sealed pipes = No
        allow dns updates = disabled
        dns forwarder =
        dns update command =
        nsupdate command =
        rndc command =
        multicast dns register = Yes
        samba kcc command =
        server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, 
winbind, ntp_signd, kcc, dnsupdate
        dcerpc endpoint servers =
        spn update command =
        share backend =
        tls enabled = No
        tls keyfile =
        tls certfile =
        tls cafile =
        tls crlfile =
        tls dh params file =
        rpc_server:tcpip = no
        rpc_daemon:spoolssd = embedded
        rpc_server:spoolss = embedded
        rpc_server:winreg = embedded
        rpc_server:ntsvcs = embedded
        rpc_server:eventlog = embedded
        rpc_server:srvsvc = embedded
        rpc_server:svcctl = embedded
        rpc_server:default = external
        idmap_ldb:use rfc2307 = yes
        idmap config * : backend = tdb
        comment =
        path =
        username =
        invalid users =
        valid users = +BAC.EU\BEHE
        admin users =
        read list =
        write list =
        force user =
        force group =
        read only = Yes
        acl check permissions = Yes
        acl group control = No
        acl map full control = Yes
        acl allow execute always = No
        create mask = 0770
        force create mode = 00
        directory mask = 0770
        force directory mode = 00
        force unknown acl user = No
        inherit permissions = No
        inherit acls = No
        inherit owner = No
        guest only = No
        administrative share = No
        guest ok = No
        only user = No
        hosts allow =
        hosts deny =
        allocation roundup size = 1048576
        aio read size = 0
        aio write size = 0
        aio write behind =
        ea support = No
        nt acl support = Yes
        profile acls = No
        map acl inherit = No
        afs share = No
        smb encrypt = default
        durable handles = Yes
        block size = 1024
        change notify = Yes
        directory name cache size = 100
        kernel change notify = Yes
        max connections = 0
        min print space = 0
        strict allocate = No
        strict sync = No
        sync always = No
        use sendfile = No
        write cache size = 0
        max reported print jobs = 0
        max print jobs = 1000
        printable = No
        print notify backchannel = Yes
        print ok = No
        printing = cups
        cups options =
        print command =
        lpq command = %p
        lprm command =
        lppause command =
        lpresume command =
        queuepause command =
        queueresume command =
        printer name =
        use client driver = No
        default devmode = Yes
        force printername = No
        printjob username = %U
        default case = lower
        case sensitive = Auto
        preserve case = Yes
        short preserve case = Yes
        mangling char = ~
        hide dot files = Yes
        hide special files = No
        hide unreadable = No
        hide unwriteable files = No
        delete veto files = No
        veto files =
        hide files = /~*/
        veto oplock files =
        map archive = No
        map hidden = No
        map system = No
        map readonly = no
        mangled names = Yes
        store dos attributes = Yes
        dmapi support = No
        browseable = Yes
        access based share enum = No
        blocking locks = No
        csc policy = manual
        fake oplocks = No
        kernel oplocks = Yes
        kernel share modes = Yes
        locking = No
        oplocks = Yes
        level2 oplocks = No
        oplock contention limit = 2
        posix locking = No
        strict locking = No
        dfree cache time = 0
        dfree command =
        copy =
        preexec =
        preexec close = No
        postexec =
        root preexec =
        root preexec close = No
        root postexec =
        available = Yes
        volume =
        fstype = NTFS
        wide links = Yes
        follow symlinks = Yes
        dont descend =
        magic script =
        magic output =
        delete readonly = Yes
        dos filemode = No
        dos filetimes = Yes
        dos filetime resolution = No
        fake directory create times = No
        vfs objects = dfs_samba4, acl_xattr
        msdfs root = No
        msdfs proxy =
        ntvfs handler =

This message is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone or e-mail, and delete the electronic version of the message from your system. Thank you. 

______________________________________________________________________
This email has been scanned by the IT101 / Symantec.cloud Email Security System.
For more information please visit http://www.it101.be 
______________________________________________________________________


More information about the samba mailing list