[Samba] Domain password policy with Samba AD DC
miles at atmos.eu
Tue Aug 29 10:58:00 UTC 2023
On 27.08.2023 23:45, Andrew Bartlett wrote:
> On Sat, 2023-08-26 at 11:49 +0200, Peter Milesson via samba wrote:
>> Hi folks,
>> I just wonder why it is not possible to set domain password policies
>> with GPO, using the Windows RSAT Group Policy Manager? For most
>> settings, using GPOs through RSAT works.
>> For somebody who sets up a Samba AD DC infrequently, this is a huge
>> trap. There should be a very visible warning on the AD DC setup wiki
>> page, that you *must* setup password policies with samba-tool, if
>> plan to change the default password policies (which I assume most
>> do). It should also be very clearly noted that it is not possible to
>> this with RSAT (as lots of people will try that anyway). This
>> should also be displayed on the Group Policy wiki page. If there are
>> other GPO policies that can not be set with RSAT, those should also
> Thanks Peter for reaching out on this,
> So, the challenge is that in the past, Samba didn't know how to read
> these, and the settings were just ignored.
> Now it can, but given there are now existing domains, which setting
> should be primary, the one in the DB or the one in the GPO?
> That is why the smb.conf setting "apply group policies" needs to be set
> to Yes if the GPO approach is to be taken.
> Feel free to ask for a wiki account to point out this if you feel it
> would be helpful.
> Andrew Bartlett
I've tried to get password policies setting using the Windows GPMC from
RSAT working. Unfortunately, no change. It just does not work. Here is
the smb.conf for the AD DC:
# Global parameters
dns forwarder = 188.8.131.52
netbios name = TESTADC1
realm = TESTDOM.TALPS
server role = active directory domain controller
workgroup = TESTDOM
idmap_ldb:use rfc2307 = yes
apply group policies = yes
path = /var/lib/samba/sysvol
read only = No
path = /var/lib/samba/sysvol/testdom.talps/scripts
read only = No
The only way to set password policies for the domain, still seems to be
through samba-tool domain passwordsettings and the parameter "apply
group policies" has got no effect at all.
If I create a gpresult.html file on a Windows member PC, it shows the
settings I have set with the Windows Group Policy Management Editor
(GPME), but when setting a password for a user in Active Directory Users
and Computers, the settings are not honored.
In GPME there is also the folder Samba\smb.conf, where the different
password policy parameters can be set. No effect at all.
In practice, this is not a big deal. You probably set the domain
password policies once, and forget about it.
I'm not going to waste more time on this. Just use samba-tool domain
passwordsettings for setting password policies, and forget about GPMC.
More information about the samba