[Samba] Samba 4 "Classic PDC" trusts fail with Win 2012 domain but succeed Win 2008
gaiseric.vandal at gmail.com
Tue Nov 22 18:40:20 UTC 2016
* DomainA Samba classic domain- PDC and BDC are running Samba
4.4.7. The PDC is called "SambaPDC."
* DomainB Windows AD domain , level 2008, domain controller is
Windows 2012 or 2012R2 (you are correct that there are not primary and
backup controllers in AD)
* DomainC Windows AD domain, level 2008, domain controllers are
I need to get trusts established between DomainA and DomainB. (I don't
actually need trusts between DomainA and DomainC, but hoped it might
flush out a working configuration)
I can not setup trusts between DomainA and DomainB in either direction.
The domain controller of domainB just complains that it cannot
establish an RPC connection to DomainA's PDC (The PDC on domainA has
winbind errors relating to domain C.) (On the DomainA PDC, wbinfo isn't
showing trusted users from domainC and I see errors in the winbind log.)
I can partially setup trusts between DomainA and DomainC. The domain
controller of domainC thinks two way trusts are enabled (can verify
them) and I am able to grant DomainA users access to files on DomainC
servers. (On the DomainA PDC, wbinfo isn't showing trusted users from
domainC and I see errors in the winbind log.)
Wondering if I should have complied Samba using "--without-ad-dc" option.
On 11/22/16 12:43, Rowland Penny via samba wrote:
> See inline comments:
> On Tue, 22 Nov 2016 12:04:57 -0500
> Gaiseric Vandal via samba <samba at lists.samba.org> wrote:
>> I am trying to configuring Samba 4 classic PDC to trust Windows
>> 2012 domain "DomainB" - the PDC is running Windows 2012 but the
>> forest and domain functional levels are still Windows 2008. On the
>> Win 2012 PDC I try to set up an incoming trust, but it fails with
>> "The local security authority is unable to obtain an RPC connection
>> to the active directory domain controller SAMBAPDC . "
> Can we confirm what I think the above means:
> You have a NT4-style PDC
> You have 'DomainB' in which there is a Windows 2012 AD DC running as
> domain functional level 2008 (This is NOT a PDC)
> You are trying to set up a trust between the PDC and the AD DC
>> I have an third domain "DomainC" - the PDC is running Windows
>> 2008 , and the forest and domain functional levels are still Windows
>> 2008. On that PDC I am able to configure and verify an incoming trust.
> Again, you have an AD DC running windows 2008 and you can configure a
> trust, but you don't say between what.
>> I am guessing some recent security patch that applies to Windows 2012
>> but not to Windows 2008 is the issue?
> Sounds like it.
>> Since samba is a configured as a classic domain, I would have
>> expected the Windows 2012 DC to see the samba domain as an NT4 domain.
> Should do, but microsoft seems to be trying to make it harder, see
>> I have tried setting the following in smb.conf
>> server services = +smb -s3fs
>> dcerpc endpoint servers = +winreg +srvsvc
> They will not do anything on a PDC, they are meant for an AD DC
More information about the samba