[Samba] Rights issue on GPO

lingpanda101 at gmail.com lingpanda101 at gmail.com
Mon Jun 20 18:17:09 UTC 2016


On 6/20/2016 2:10 PM, Rowland penny wrote:
> On 20/06/16 18:49, lingpanda101 at gmail.com wrote:
>> On 6/20/2016 1:19 PM, lists wrote:
>>> Hi all,
>>>
>>> Following this thread with interest, as we are also having some 
>>> issues with GPO (they work on and off, unpredictably)
>>> We checked iddap.ldb on the DCs and noticed differences between DCs.
>>>
>>> We would like to ask some questions:
>>>
>>> On 10-6-2016 9:26, Rowland penny wrote:
>>>> Well, it is and it isn't, yes winbindd will display the user & group
>>>> names for sysvol, but sysvol still isn't replicated between DCs. I 
>>>> think
>>>> this means that when you sync sysvol manually, you will get the ID's
>>>> from the first DC applied to sysvol on the second DC and if there is a
>>>> difference in ID numbers between the DC's, you will either just get a
>>>> number or, even worse, a wrong name returned.
>>>>
>>>> I could be wrong, but I still think you need to keep idmap.ldb in sync
>>>> on all DCs, if you are syncing sysvol.
>>>
>>> We are on sernet-samba-4.4.4 on the DCs, and "winbindd -D" is 
>>> running on DCs.
>>>
>>> We understand we need to keep idmap.ldb in sync. We did this in the 
>>> past, but it seems they have gotten out of sync again.
>>> One question: HOW OFTEN do we need to do manually sync the imap.ldb 
>>> files? After each and every regular user addition/deletion?
>>>
>>> We are currently on sernet-4.4.4 on the 3 DCs, but on our fileserver 
>>> we are still on samba 4.2.11 and sssd. Would that last bit have any 
>>> impact on the GPO situation..? (i don't think so, because GPOs are 
>>> on the DCs and not on the fileserver..?)
>>>
>>> Since our idmap.ldb differs per DC, HOW to choose which one to copy 
>>> to the other DCs? Choosing wrongly will probably have major 
>>> implications..?
>>>
>>> Sorry to ask so many questions, hopefully someone will answer.
>>>
>>> Best regards,
>>> MJ
>>>
>>
>> Mine are also out of sync. Using Samba 4.4.4 on Ubuntu 12.04. I no 
>> longer keep the idmap.ldb in sync as I thought this was no longer 
>> needed since version 4.2 or greater unless using winbind.
>>
>> I also never would reset sysvol on the other DC's when replicating 
>> using rsync. I don't believe it was ever in the wiki. Clarification 
>> from someone would be helpful.
>>
>
> If you use Samba < 4.2.0 with the 'winbind' part of the 'samba' 
> binary, then you had to, but if you use Samba >= 4.2.0, then this uses 
> the separate 'winbindd' binary and this will map the BUILTIN users & 
> groups correctly.
>
> Rowland
>
>
I completely missed the BUILTIN part. That explains my issue. That means 
for all other users idmap.ldb must be kept in sync?


-- 
-James




More information about the samba mailing list