[Samba] Extending Samba-4 Schema to get Microsoft LAPS working

Christian Naumer cn at brain-biotech.de
Wed Jul 24 05:55:53 UTC 2019

I just did this a view days agon. These where the ldifs I used.


dn: CN=ms-MCS-AdmPwd,CN=Schema,cn=configuration,DC=X
changetype: add
objectClass: attributeSchema
ldapDisplayName: ms-MCS-AdmPwd
adminDisplayName: ms-MCS-AdmPwd
adminDescription: Stores password of local Administrator account on
omSyntax: 19
isSingleValued: TRUE
systemOnly: FALSE
searchFlags: 648
isMemberOfPartialAttributeSet: FALSE
showInAdvancedViewOnly: FALSE

dn: CN=ms-MCS-AdmPwdExpirationTime,CN=Schema,cn=configuration,DC=X
changetype: add
objectClass: attributeSchema
ldapDisplayName: ms-MCS-AdmPwdExpirationTime
adminDisplayName: ms-MCS-AdmPwdExpirationTime
adminDescription: Stores timestamp of last password change
omSyntax: 65
isSingleValued: TRUE
systemOnly: FALSE
searchFlags: 0
isMemberOfPartialAttributeSet: FALSE
showInAdvancedViewOnly: FALSE


dn: CN=computer,CN=Schema,cn=configuration,DC=X
changetype: Modify
add: mayContain
mayContain: ms-MCS-AdmPwd
mayContain: ms-MCS-AdmPwdExpirationTime

Exchange X with your data.

Applied them with:

ldbmodify -H /path_to_samba/sam.ldb laps_1.ldif --option="dsdb:schema
update allowed"=true

ldbmodify -H /path_to_samba/sam.ldb laps_2.ldif --option="dsdb:schema
update allowed"=true



Am 23.07.19 um 13:53 schrieb Stefan G. Weichinger via samba:
> Am 01.07.19 um 07:48 schrieb Stefan G. Weichinger via samba:
>> Am 23.11.18 um 03:33 schrieb Ardos via samba:
>>> Hi,
>>> Thank you very much for your support.
>>> With your ldif, one of the attributes got added to computer container.
>>> Second one is having a trouble. The modification command is reporting it
>>> is not able to find the attribute although it is very much in the
>>> schema. I am checking this part out. Any suggestions to figure out
>>> what's wrong and correct it?
>> Getting into LAPS now as well, after hours of installing WMF-4.0 onto a
>> W2008R2SP1 server (don't ask, it will be replaced soon) ... I get to
>> adding the AD attributes.
>> Could someone share the latest and working ldif, please?
>> Above report makes me wonder ...
> a polite and tiny "bump" here ...

Dr. Christian Naumer
Unit Head Bioprocess Development
B.R.A.I.N Aktiengesellschaft
Darmstaedter Str. 34-36, D-64673 Zwingenberg
e-mail cn at brain-biotech.de, homepage www.brain-biotech.de
fon +49-6251-9331-30  /   fax +49-6251-9331-11

Sitz der Gesellschaft: Zwingenberg/Bergstrasse
Registergericht AG Darmstadt, HRB 24758
Vorstand: Dr. Juergen Eck (Vorsitzender), Manfred Bender,
Ludger Roedder
Aufsichtsratsvorsitzender: Dr. Georg Kellinghusen

More information about the samba mailing list