[Samba] Setup a new samba AD DC

Dario Lesca d.lesca at solinos.it
Tue Apr 25 12:07:05 UTC 2017

I have setup a new Samba Active Directory DC on Fedora 25 and samba-
4.5.8-1.fc25.x86_64, rebuild from src.rpm with dc option enable.

This system (fedora-addc) is only an AD-DC. In the next days I will
deploy another Centos 7 samba member server with standard samba-4.4.4
rpm (without dc enabled) and join it to Fedora AD-DC for manage data
After install bind dns and samba new rebuild rpms, I have follow this
howto and setting up the AD:  

I have use this samba tool deploy:

    samba-tool domain provision --realm=solinos.loc --domain=solinos \
     --dns-backend=BIND9_DLZ --use-rfc2307 \
     --server-role=dc --function-level=2008_R2 \

This is my current automatic generate smb.conf file:

    # Global parameters
    	    netbios name = FEDORA-ADDC
    	    realm = SOLINOS.LOC
    	    server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc,
    drepl, winbindd, ntp_signd, kcc, dnsupdate
    	    workgroup = SOLINOS
    	    server role = active directory domain controller
    	    idmap_ldb:use rfc2307 = yes

    	    template shell = /bin/bash
    	    template homedir = /home/%U

    	    path = /var/lib/samba/sysvol/solinos.loc/scripts
    	    read only = No

    	    path = /var/lib/samba/sysvol
    	    read only = No

I have also setup ntp like howto.

At this point, in this test environment, all work fine, I can manage
users, groups and dns entry, and join for test some windows client to
it, the new samba users are recognized from Linux:

    [    root at fedora-addc     ~]# id ospite
    uid=3000017(SOLINOS\ospite) gid=100(users)

Now my question is:

There are other thinks I must to do on AD DC?

What parameter is better add to smb.conf?

Why administrator is mapped like root?:
    [    root at fedora-addc     ~]# id
    uid=0(root) gid=0(root) gruppi=0(root)

and if I add administrator to "Domain Admins" nothing change 
    # samba-tool group addmembers 'Domain Admins' Administrator
    # samba-tool group listmembers 'Domain Admins'
    # id administrator
    uid=0(root) gid=0(root) gruppi=0(root)

Please, let me know, this is my first samba AD-DC + samba AD-Member
server implementation, and tomorrow I must deploy all into a servers

Many thanks.

Dario Lesca
(inviato dal mio Linux Fedora 25 Workstation)

More information about the samba mailing list