[Samba] MMC issue

[Rowland Penny]

On Wed, 6 Dec 2017 11:59:44 +0100
Christian Naumer <cn at brain-biotech.de> wrote:

> Am 06.12.2017 um 11:22 schrieb Rowland Penny via samba:
> 
> > I have libnss_winbind set up on the DC, do you ?
> >
> 
> not on the DCs only on the DMs
> 
> 
> > My only thought at this time is, do you have a user in AD called
> > 'root' ?
> 
> no. definitely not.
> 
> 
> Is it normal that Administrator maps to different SIDs on DCs and DMs?
> 

No, the SID-RID for 'Administrator' should be in the form:

   S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-500

Where 'S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx' is the domain SID
and '500' is the RID. The SID should be the same on all domain
computers: DCs, windows PCs or Unix domain members, if you are getting
different SIDs on some machines then that machine doesn't seem to be a
member of the AD domain.

Rowland