[Samba] Samba + Winbind help

[Mike Hobbs]

Hi,

We do not have two domains but we do have two active directory servers 
for the same domain, gotta have a backup/spare!  I assumed we needed an 
entry for each server.

A lot of the options in my current smb.conf file I believe are defaults 
and can be removed, most of my file is legacy hold over stuff from a 
long time ago, like the "wide links" option.  At one point we needed it 
for AMD (auto mount daemon)  to work correctly.  Since we moved to 
autofs we may not actually need it.

I know NIS is old, I can not turn it off.  We actually use it for our 
Linux authentication.  This will change at some point, probably should 
have moved to something else years ago.

I can try your changes and get back to you.  Thank you!

mike

On 11/17/2025 2:14 PM, Rowland Penny via samba wrote:
> Lets start by discussing these lines:
>
> workgroup = MYWINDOMAIN
>
> idmap config * : backend = tdb
> idmap config * : range = 10000 - 499999
> idmap config server1.my.domain : backend = tdb
> idmap config server1.my.domain : range = 500000 - 1000000
> idmap config server2.my.domain : backend = tdb
> idmap config server2.my.domain: range = 1000001 - 1999999
>
> Do you have two domains ?
> If you do not and want Samba to map your users & groups from the RID,
> then I would expect idmap config lines something like these:
>
> idmap config * : backend = tdb
> idmap config * : range = 3000 - 7999
> idmap config MYWINDOMAIN : backend = rid
> idmap config MYWINDOMAIN : range = 10000 - 9999999
>
> NOTE: you will probably have to run 'net cache flush' after you change
> the smb.conf and restarted Samba.
>
> I would also suggest you do two things:
> 1) open a copy of the smb.conf manpage (man smb.conf) in a terminal and
> read about the other parameters you are using, there are others that
> you could remove.
>
> 2) Turn NIS off, it is dead and you very probably do not need it.