[Samba] ADS Domain Member Workgroup vs Realm
lists at kiuni.de
Tue Feb 24 00:25:14 MST 2015
I would say that workgroup = ZARTMAN should be right. Workgroups normally don't have dots in their name.
Than you should also try:
idmap config ZARTMAN:backend = ad
idmap config ZARTMAN:schema_mode = rfc2307
idmap config ZARTMAN:range = 10000-99999
One more thing is that it's not recommended to have a .local domain realm.
Have a look at this above glibc...
Am 24. Februar 2015 07:28:11 MEZ, schrieb Greg Zartman <gzartman at koozali.org>:
>I'm working to setup Samba as a domain member to a Windows Server
>directory, and I keep hitting road blocks. There's some real
>hurdles in the wiki.
>In a nutshell, my problem is this: I setup a Windows 2012 Essentials
>domain and I ended up with zartman.local for my "domain" in Windows.
>I've got a dns zone in windows server that is domain.local and my
>domain for ADS membership is zartman.local.
>On the Samba side, I'm not sure what needs to be specified for "realm"
>"workgroup". If I set workgroup = zartman.local and
>samba bellyaches and says I can't have workgroup=zartman.local. If I
>workgroup = zartman, then the Samba netbios domain is "zartman" and not
>The membership details look find for net ads info:
>[root at cos6 ~]# net ads info
>LDAP server: 192.168.0.15
>LDAP server name: pdc.zartman.local
>Bind Path: dc=ZARTMAN,dc=LOCAL
>LDAP port: 389
>Server time: Mon, 23 Feb 2015 22:25:32 PST
>KDC server: 192.168.0.15
>Server time offset: 1
>If I check the domain with net domain, I get:
>[root at cos6 ~]# net domain -U admin
>Enter admin's password:
> Domain name Server name of Browse Master
> ------------- ----------------------------
> ZARTMAN COS6
>This isn't correct. It thinks my domain member is the master browser.
>For completeness sake, here is my smb.conf:
>[root at cos6 ~]# cat /etc/samba/smb.conf
>workgroup = zartman
>realm = ZARTMAN.LOCAL
>security = ads
>dedicated keytab file = /etc/krb5.keytab
>kerberos method = secrets and keytab
>idmap config *:backend = tdb
>idmap config *:range = 2000-9999
>idmap config ZARTMAN.LOCAL:backend = ad
>idmap config ZARTMAN.LOCAL:schema_mode = rfc2307
>idmap config ZARTMAN.LOCAL:range = 10000-99999
>winbind nss info = rfc2307
>winbind trusted domains only = no
>winbind use default domain = yes
>winbind enum users = yes
>winbind enum groups = yes
>winbind refresh tickets = Yes
>Greg J. Zartman
>Koozali SME Server
>SME Server user, contributor, and community member since 2000
>To unsubscribe from this list go to the following URL and read the
More information about the samba