[Samba] samba DC, clear cash guid

Rowland Penny rpenny at samba.org
Fri Feb 15 10:58:31 UTC 2019

On Fri, 15 Feb 2019 15:34:14 +0500
Шигапов Денис Вильданович via samba <samba at lists.samba.org> wrote:

> thank you very much.
> by the way, is it possible to specify arbitrary guid for BUILTIN
> and /NT AUTHORITY/// in samba DC
> example guid NT AUTHORITY\Authenticated Users in dc01 = 300002, in
> dc02 = 300005
> I would like that  to guid dc01 == dc02
> On 15.02.2019 14:32, Rowland Penny via samba wrote:
> > net cache flush

Firstly, stop calling it 'guid', a 'GUID' is something else entirely in
AD ;-)

I think you want your BUILTIN groups to have the same ID's on all DC's,
this is fairly easy, but first, why they are different. These users and
groups are mapped in idmap.ldb and the ID's are allocated on a first
come basis, this means, as you have found out, that users & groups can
have different ID's on different DC's. This wouldn't be a problem,
except for Sysvol, which isn't automatically synced between Samba AD
DC's and before you ask, information on how to do this can be found


Now you know why they are different, I think you can see that the only
way to get the same ID's is if idmap.ldb files are the same on all
DC's. Instructions on how to do this can be found here:



More information about the samba mailing list