[Samba] Moving a Server - Best Practice

[Andrew Walker]

On Mon, Jan 25, 2021 at 11:19 AM L.P.H. van Belle via samba <
samba at lists.samba.org> wrote:

> What i did was.
>
> setup new server, move data, (if needed, reapply rights/acl's)
> Down old server.
> Add CNAME of old servername to new server.
> Done.
>
> BUT, i have everything configured with hostnames.
> And make sure you have PTR set for the new server before you add the CNAME
> ;-)
>
>
> greetz,
>
> Louis
>
>
>
> > -----Oorspronkelijk bericht-----
> > Van: samba [mailto:samba-bounces at lists.samba.org] Namens Marco
> > Shmerykowsky via samba
> > Verzonden: maandag 25 januari 2021 17:12
> > Aan: samba at lists.samba.org
> > Onderwerp: [Samba] Moving a Server - Best Practice
> >
> > I need to move a file server to a new computer.
> >
> > What is the best way to do this while maintaining
> > file shares?
> >
> > Setup the new server, copy data, take the old
> > server offline and then rename the new server
> > to use the old name?
> >
> > or
> >
> > do you start fresh and redefine all the
> > file shares to point to the new server?
> >
> > Thanks.
> >
> > --
> > To unsubscribe from this list go to the following URL and read the
> > instructions:  https://lists.samba.org/mailman/options/samba
>
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba


With AD member server, if you leave the domain on the old server `net ads
leave` and then add the old server's netbios name as a `netbios alias` on
the new one before joining, then libnet will add the relevant kerberos SPN
entry in AD so that kerberos auth still works via the old name. If you
perform a simple cname record addition without moving the kerberos spn,
then more often than not clients will not be able to authenticate (won't
downgrade from kerberos to ntlm). But generally in an AD environment I
prefer to use GPO to manage mapped shares on Windows clients so that the
majority of client reconfiguration just happens via group policy update.