[Samba] Schema Update to store TPM data in AD DS

[Johannes Engel]

Hi Andrew,

thanks a lot, that does indeed help me one step further. However, I do not
seem to get the schema upgrade running using samba-tool either:

> # samba-tool domain schemaupgrade -U Administrator
> Temporarily overriding 'dsdb:schema update allowed' setting
> ERROR(<type 'exceptions.OSError'>): uncaught exception - [Errno 2] No such
> file or directory
>   File "/usr/lib64/python2.7/site-packages/samba/netcmd/__init__.py", line
> 176, in _run
>     return self.run(*args, **kwargs)
>   File "/usr/lib64/python2.7/site-packages/samba/netcmd/domain.py", line
> 4161, in run
>     stderr=subprocess.PIPE, cwd=temp_folder)
>   File "/usr/lib64/python2.7/subprocess.py", line 390, in __init__
>     errread, errwrite)
>   File "/usr/lib64/python2.7/subprocess.py", line 1025, in _execute_child
>     raise child_exception
>

and if I run it with basedir:

> # samba-tool domain schemaupgrade -U Administrator
> --base-dir=/usr/share/samba/setup/ad-schema/
> Temporarily overriding 'dsdb:schema update allowed' setting
> Applying Sch48.ldf updates...
> Exception: [Errno 2] No such file or directory:
> '/usr/share/samba/setup/ad-schema/Sch48.ldf'
> Error encountered, aborting schema upgrade
> ERROR: Failed to upgrade schema
>

Any suggestions?
Thanks a lot!

Best regards
Johannes


Am Fr., 7. Sep. 2018 um 20:35 Uhr schrieb Andrew Bartlett <
abartlet at samba.org>:

> On Fri, 2018-09-07 at 18:14 +0200, Johannes Engel via samba wrote:
> > Hi all,
> >
> > has anyone here experience with storing BitLocker and TPM data in AD DS
> on
> > Samba?
> > I have stumbled across this Microsoft page (
> >
> https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-8.1-and-8/jj635854%28v%3dws.11%29
> )
> > stating that Windows 2008 R2 needs a schema extension to handle this.
> Since
> > this is not listed as a safe update in the wiki (
> > https://wiki.samba.org/index.php/Samba_AD_schema_extensions), I would
> like
> > to know if anybody has already tried this, since I do not have any
> > experience with restoring a schema after a failed import. ;)
> > Thanks a lot for your input.
>
> We actually have a fully tested (just not widely deployed) upgrade tool
> for schema, and a fully tested upgrade to the 2012 schema.
>
> From the testsuite:
>
> $BINDIR/samba-tool domain schemaupgrade -H
> tdb://$PREFIX_ABS/2008R2_schema/private/sam.ldb --schema=2012_R2
>
> I hope this helps,
>
> Andrew Bartlett
> --
> Andrew Bartlett                       http://samba.org/~abartlet/
> Authentication Developer, Samba Team  http://samba.org
> Samba Developer, Catalyst IT
> http://catalyst.net.nz/services/samba
>
>
>