[Samba] Samba 4 "Classic PDC" trusts fail with Win 2012 domain but succeed Win 2008

Gaiseric Vandal gaiseric.vandal at gmail.com
Tue Nov 22 18:40:20 UTC 2016


In summary

  * DomainA    Samba classic domain-  PDC and BDC are running Samba 
4.4.7.  The PDC is called "SambaPDC."
  * DomainB    Windows AD domain , level 2008, domain controller is 
Windows 2012   or 2012R2 (you are correct that there are not primary and 
backup controllers in AD)
  * DomainC    Windows AD domain, level 2008, domain controllers are  
Windows 2008


I need to get trusts established between DomainA and DomainB. (I don't 
actually need trusts between DomainA and DomainC, but hoped it might 
flush out a working configuration)



I can not  setup trusts between DomainA and DomainB in either direction. 
     The domain controller of domainB  just complains that it cannot 
establish an RPC connection to DomainA's PDC (The PDC on domainA has 
winbind errors relating to domain C.)  (On the DomainA PDC, wbinfo isn't 
showing trusted users from domainC and I see errors in the winbind log.)



I can partially setup trusts between DomainA and DomainC.   The domain 
controller of domainC  thinks two way trusts are enabled (can verify 
them)  and I am able to grant DomainA users access to files on DomainC 
servers.  (On the DomainA PDC, wbinfo isn't showing trusted users from 
domainC and I see errors in the winbind log.)


Wondering if I should have complied Samba using "--without-ad-dc" option.





On 11/22/16 12:43, Rowland Penny via samba wrote:
> See inline comments:
>
> On Tue, 22 Nov 2016 12:04:57 -0500
> Gaiseric Vandal via samba <samba at lists.samba.org> wrote:
>
>> I am trying to configuring  Samba 4 classic PDC to trust  Windows
>> 2012 domain "DomainB" -  the PDC is running Windows 2012 but the
>> forest and domain functional levels are still Windows 2008.  On the
>> Win 2012 PDC I try to set up an incoming trust, but it fails with
>> "The local security authority is unable to obtain an RPC connection
>> to the active directory domain controller SAMBAPDC .  "
> Can we confirm what I think the above means:
>
> You have a NT4-style PDC
> You have 'DomainB' in which there is a Windows 2012 AD DC running as
> domain functional level 2008 (This is NOT a PDC)
> You are trying to set up a trust between the PDC and the AD DC
>
>>
>>
>> I have an third domain "DomainC"  -   the PDC is running Windows
>> 2008 , and  the forest and domain functional levels are still Windows
>> 2008. On that PDC I am able to configure and verify an incoming trust.
>>
> Again, you have an AD DC running windows 2008 and you can configure a
> trust, but you don't say between what.
>   
>> I am guessing some recent security patch that applies to Windows 2012
>> but not to Windows 2008 is the issue?
>>
> Sounds like it.
>   
>> Since samba is a configured as a classic domain, I would have
>> expected the Windows 2012 DC to see the samba domain as an NT4 domain.
>>
> Should do, but microsoft seems to be trying to make it harder, see
> here:
>
>    https://social.technet.microsoft.com/Forums/en-US/f2bf83d8-6dcc-45de-a99d-fe5d83a83e12/can-i-join-an-nt4-workstation-to-a-windows-2012-domain?forum=winserverDS
>
>> I have tried setting the following in smb.conf
>>
>>      server services = +smb -s3fs
>>      dcerpc endpoint servers = +winreg +srvsvc
> They will not do anything on a PDC, they are meant for an AD DC
>
> Rowland
>




More information about the samba mailing list