{"id":13405,"date":"2019-04-02T01:25:41","date_gmt":"2019-04-02T01:25:41","guid":{"rendered":"http:\/\/www.appservgrid.com\/paw92\/?p=13405"},"modified":"2019-04-02T01:27:29","modified_gmt":"2019-04-02T01:27:29","slug":"active-directory-ad","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2019\/04\/02\/active-directory-ad\/","title":{"rendered":"ACTIVE DIRECTORY (AD) Infrastructure with SAMBA4 on Ubuntu"},"content":{"rendered":"

Create an Active Directory Infrastructure with Samba4 on Ubuntu \u2013 Part 1<\/h1>\n

Samba<\/strong>\u00a0is a free Open Source software which provides a standard interoperability between\u00a0Windows OS<\/strong>\u00a0and\u00a0Linux\/Unix<\/strong>\u00a0Operating Systems.<\/p>\n

Samba can operate as a standalone file and print server for Windows and Linux clients through the\u00a0SMB\/CIFS<\/strong>protocol suite or can act as an\u00a0Active Directory Domain Controller<\/strong>\u00a0or joined into a\u00a0Realm<\/strong>\u00a0as a\u00a0Domain Member<\/strong>. The highest\u00a0AD DC<\/strong>\u00a0domain and forest level that currently\u00a0Samba4<\/strong>\u00a0can emulate is\u00a0Windows 2008 R2<\/strong>.<\/p>\n

The series will be titled\u00a0Setting Up Samba4 Active Directory Domain Controller<\/strong>, which covers following topics for\u00a0Ubuntu<\/strong>,\u00a0CentOS<\/strong>, and\u00a0Windows<\/strong>:<\/p>\n

Part 1<\/b>:\u00a0Install Active Directory Infrastructure with SAMBA4 on Ubuntu<\/b><\/div>\n
Part 2<\/b>:\u00a0Manage Samba4 AD Infrastructure from Linux Command Line<\/a><\/div>\n
Part 3<\/b>:\u00a0Manage Samba4 Active Directory Infrastructure from Windows10 via RSAT<\/a><\/div>\n
Part 4<\/b>:\u00a0Manage Samba4 AD Domain Controller DNS and Group Policy from Windows<\/a><\/div>\n
Part 5<\/b>:\u00a0Join an Additional Ubuntu DC to Samba4 AD DC<\/a><\/div>\n
Pare 6<\/b>:\u00a0Setup SysVol Replication Across Two Samba4 AD DC with Rsync<\/a><\/div>\n
Part 7<\/b>:\u00a0Create a Shared Directory on Samba AD DC and Map to Windows\/Linux Clients<\/a><\/div>\n
Part 8<\/b>:\u00a0Integrate Ubuntu 16.04 to AD as a Domain Member with Samba and Winbind<\/a><\/div>\n
Part 9<\/b>:\u00a0Integrate CentOS 7 Desktop to Samba4 AD as a Domain Member<\/a><\/div>\n
Part 10<\/b>:\u00a0How to Install iRedMail on CentOS 7 for Samba4 AD Integration<\/a><\/div>\n
Part 11<\/b>:\u00a0Integrate iRedMail Services to Samba4 AD DC<\/a><\/div>\n
Part 12<\/b>:\u00a0How to Integrate iRedMail Roundcube with Samba4 AD DC<\/a><\/div>\n
Part 13<\/b>:\u00a0How to Configure Thunderbird with iRedMail for Samba4 AD<\/a><\/div>\n
Part 14<\/b>:\u00a0Integrate Ubuntu 16.04 to Samba4 AD DC with SSSD and Realm<\/a><\/div>\n
Part 15<\/b>:\u00a0Integrate CentOS 7 from Command Line to Samba AD DC as a Domain Member<\/a><\/div>\n
Part 16<\/b>:\u00a0Integrate VMware ESXI Host to Samba4 AD Domain Controller<\/a><\/div>\n

This tutorial will start by explaining all the steps you need to take care off in order to install and configure\u00a0Samba4<\/strong>\u00a0as a\u00a0Domain Controller<\/strong>\u00a0on\u00a0Ubuntu 16.04<\/strong>\u00a0and\u00a0Ubuntu 14.04<\/strong>.<\/p>\n

This configuration will provide a central management point for users, machines, volume shares, permissions and other resources in a mixed-up Windows \u2013 Linux infrastructure.<\/p>\n

Requirements:<\/h4>\n
    \n
  1. Ubuntu 16.04 Server Installation<\/a>.<\/li>\n
  2. Ubuntu 14.04 Server Installation<\/a>.<\/li>\n
  3. A static IP Address configured<\/a>\u00a0for your\u00a0AD DC<\/strong>\u00a0server.<\/li>\n<\/ol>\n

    Step 1: Initial Configuration for Samba4<\/h3>\n

    1.<\/strong>\u00a0Before proceeding your\u00a0Samba4 AD DC<\/strong>\u00a0installation first let\u2019s run a few pre-required steps. First make sure the system is up to date with the last security features, kernels and packages by issuing the below command:<\/p>\n

    $ sudo apt-get update \r\n$ sudo apt-get upgrade\r\n$ sudo apt-get dist-upgrade\r\n<\/pre>\n
    2.<\/strong>\u00a0Next, open machine\u00a0\/etc\/fstab<\/strong>\u00a0file and assure that your partitions file system has\u00a0ACLs<\/strong>\u00a0enabled as illustrated on the below screenshot.<\/p>\n
    Usually, common modern Linux file systems such as\u00a0ext3<\/strong>,\u00a0ext4<\/strong>,\u00a0xfs<\/strong>\u00a0or\u00a0btrfs<\/strong>\u00a0support and have ACLs enabled by default. If that\u2019s not the case with your file system just open\u00a0\/etc\/fstab<\/strong>\u00a0file for editing and add\u00a0acl<\/code>\u00a0string at the end of third column and\u00a0reboot<\/strong>\u00a0the machine in order to apply changes.<\/p>\n
    \n
    \"Enable<\/a><\/p>\n
    Enable ACL\u2019s on Linux Filesystem<\/p>\n<\/div>\n
    3.<\/strong>\u00a0Finally\u00a0setup your machine hostname<\/a>\u00a0with a descriptive name, such as\u00a0adc1<\/code>\u00a0used in this example, by editing\u00a0\/etc\/hostname<\/strong>\u00a0file or by issuing.<\/p>\n
    $ sudo hostnamectl set-hostname adc1\r\n<\/pre>\n
    A\u00a0reboot<\/strong>\u00a0is necessary after you\u2019ve changed your machine name in order to apply changes.<\/p>\n
    Step 2: Install Required Packages for Samba4 AD DC<\/h3>\n
    4.<\/strong>\u00a0In order to transform your server into an\u00a0Active Directory Domain Controller<\/strong>, install\u00a0Samba<\/strong>\u00a0and all the required packages on your machine by issuing the below command with\u00a0root<\/strong>\u00a0privileges in a console.<\/p>\n
    $ sudo apt-get install samba krb5-user krb5-config winbind libpam-winbind libnss-winbind\r\n<\/pre>\n
    \n
    \"Install<\/a><\/p>\n
    Install Samba on Ubuntu<\/p>\n<\/div>\n
    5.<\/strong>\u00a0While the installation is running a series of questions will be asked by the installer in order to configure the domain controller.<\/p>\n
    On the first screen you will need to add a name for\u00a0Kerberos<\/strong>\u00a0default\u00a0REALM<\/code>\u00a0in uppercase. Enter the name you will be using for your domain in uppercase and hit\u00a0Enter<\/strong>\u00a0to continue..<\/p>\n
    \n
    \"Configuring<\/a><\/p>\n
    Configuring Kerberos Authentication<\/p>\n<\/div>\n
    6.<\/strong>\u00a0Next, enter the\u00a0hostname<\/strong>\u00a0of\u00a0Kerberos<\/strong>\u00a0server for your domain. Use the same name as for your domain, with lowercases this time and hit\u00a0Enter<\/strong>\u00a0to continue.<\/p>\n
    \n
    \"Set<\/a><\/p>\n
    Set Hostname Kerberos Server<\/p>\n<\/div>\n
    7.<\/strong>\u00a0Finally, specify the\u00a0hostname<\/strong>\u00a0for the administrative server of your\u00a0Kerberos<\/strong>\u00a0realm. Use the same as your domain and hit\u00a0Enter<\/strong>\u00a0to finish the installation.<\/p>\n
    \n
    \"Set<\/a><\/p>\n
    Set Hostname Administrative Server<\/p>\n<\/div>\n
    Step 3: Provision Samba AD DC for Your Domain<\/h3>\n
    8.<\/strong>\u00a0Before starting to configure\u00a0Samba<\/strong>\u00a0for your domain, first run the below commands in order to stop and disable all samba daemons.<\/p>\n
    $ sudo systemctl stop samba-ad-dc.service smbd.service nmbd.service winbind.service\r\n$ sudo systemctl disable samba-ad-dc.service smbd.service nmbd.service winbind.service\r\n<\/pre>\n
    9.<\/strong>\u00a0Next, rename or remove samba original configuration. This step is absolutely required before provisioning\u00a0Samba AD<\/strong>\u00a0because at the provision time\u00a0Samba<\/strong>\u00a0will create a new configuration file from scratch and will throw up some errors in case it finds an old\u00a0smb.conf<\/code>\u00a0file.<\/p>\n
    $ sudo mv \/etc\/samba\/smb.conf \/etc\/samba\/smb.conf.initial\r\n<\/pre>\n
    10.<\/strong>\u00a0Now, start the domain provisioning interactively by issuing the below command with root privileges and accept the default options that Samba provides you.<\/p>\n
    Also, make sure you supply the IP address for a DNS forwarder at your premises (or external) and choose a strong password for Administrator account. If you choose a week password for Administrator account the domain provision will fail.<\/p>\n
    $ sudo samba-tool domain provision --use-rfc2307 --interactive\r\n<\/pre>\n
    \n
    \"Samba<\/a><\/p>\n
    Samba Domain Provisioning<\/p>\n<\/div>\n
    11.<\/strong>\u00a0Finally, rename or remove Kerberos main configuration file from\u00a0\/etc<\/strong>\u00a0directory and replace it using a symlink with Samba newly generated Kerberos file located in\u00a0\/var\/lib\/samba\/private<\/strong>\u00a0path by issuing the below commands:<\/p>\n
    $ sudo mv \/etc\/krb5.conf \/etc\/krb5.conf.initial\r\n$ sudo ln \u2013s \/var\/lib\/samba\/private\/krb5.conf \/etc\/\r\n<\/pre>\n
    \n
    \"Create<\/a><\/p>\n
    Create Kerberos Configuration<\/p>\n<\/div>\n
    12.<\/strong>\u00a0Start and enable\u00a0Samba Active Directory Domain Controller<\/strong>\u00a0daemons.<\/p>\n
    $ sudo systemctl start samba-ad-dc.service\r\n$ sudo systemctl status samba-ad-dc.service\r\n$ sudo systemctl enable samba-ad-dc.service\r\n<\/pre>\n
    \n
    \"Enable<\/a><\/p>\n
    Enable Samba Active Directory Domain Controller<\/p>\n<\/div>\n
    13.<\/strong>\u00a0Next,\u00a0use netstat command<\/a>\u00a0in order to verify the list of all services required by an\u00a0Active Directory<\/strong>\u00a0to run properly.<\/p>\n
    $ sudo netstat \u2013tulpn| egrep \u2018smbd|samba\u2019\r\n<\/pre>\n
    \n
    \"Verify<\/a><\/p>\n
    Verify Samba Active Directory<\/p>\n<\/div>\n
    Step 4: Final Samba Configurations<\/h3>\n
    14.<\/strong>\u00a0At this moment\u00a0Samba<\/strong>\u00a0should be fully operational at your premises. The highest domain level\u00a0Samba<\/strong>\u00a0is emulating should be\u00a0Windows AD DC 2008 R2<\/strong>.<\/p>\n
    It can be verified with the help of\u00a0samba-tool<\/strong>\u00a0utility.<\/p>\n
    $ sudo samba-tool domain level show\r\n<\/pre>\n
    \n
    \"Verify<\/a><\/p>\n
    Verify Samba Domain Level<\/p>\n<\/div>\n
    15.<\/strong>\u00a0In order for\u00a0DNS<\/strong>\u00a0resolution to work locally, you need to open end edit network interface settings and point the DNS resolution by modifying\u00a0dns-nameservers<\/strong>\u00a0statement to the IP Address of your\u00a0Domain Controller<\/strong>\u00a0(use\u00a0127.0.0.1<\/strong>\u00a0for local DNS resolution) and\u00a0dns-search<\/strong>\u00a0statement to point to your\u00a0realm<\/strong>.<\/p>\n
    $ sudo cat \/etc\/network\/interfaces\r\n$ sudo cat \/etc\/resolv.conf\r\n<\/pre>\n
    \n
    \"Configure<\/a><\/p>\n
    Configure DNS for Samba AD<\/p>\n<\/div>\n
    When finished,\u00a0reboot<\/strong>\u00a0your server and take a look at your resolver file to make sure it points back to the right DNS name servers.<\/p>\n
    16.<\/strong>\u00a0Finally, test the DNS resolver by issuing queries and pings against some\u00a0AD DC<\/strong>\u00a0crucial records, as in the below excerpt. Replace the domain name accordingly.<\/p>\n
    $ ping \u2013c3 tecmint.lan       #Domain Name<\/strong>\r\n$ ping \u2013c3 adc1.tecmint.lan  #FQDN<\/strong>\r\n$ ping \u2013c3 adc1              #Host<\/strong>\r\n<\/pre>\n
    \n
    \"Check<\/a><\/p>\n
    Check Samba AD DNS Records<\/p>\n<\/div>\n
    Run following few queries against Samba Active Directory Domain Controller..<\/p>\n
    $ host \u2013t A tecmint.lan\r\n$ host \u2013t A adc1.tecmint.lan\r\n$ host \u2013t SRV _kerberos._udp.tecmint.lan  # UDP Kerberos SRV record\r\n$ host -t SRV _ldap._tcp.tecmint.lan # TCP LDAP SRV record\r\n<\/pre>\n
    17.<\/strong>\u00a0Also, verify\u00a0Kerberos<\/strong>\u00a0authentication by requesting a ticket for the domain administrator account and list the cached ticket. Write the domain name portion with uppercase.<\/p>\n
    $ kinit administrator@TECMINT.LAN\r\n$ klist\r\n<\/pre>\n
    \n
    \"Check<\/a><\/p>\n
    Check Kerberos Authentication on Domain<\/p>\n<\/div>\n
    That\u2019s all! Now you have a fully operational\u00a0AD Domain Controller<\/strong>\u00a0installed in your network and you can start integrate\u00a0Windows<\/strong>\u00a0or\u00a0Linux<\/strong>\u00a0machines into\u00a0Samba AD<\/strong>.<\/p>\n
    On the next series we\u2019ll cover other\u00a0Samba AD<\/strong>\u00a0topics, such as how to manage you\u2019re the domain controller from Samba command line, how to integrate Windows 10 into the domain name and manage Samba AD remotely using RSAT and other important topics.<\/p>\n
    How to Manage Samba4 AD Infrastructure from Linux Command Line \u2013 Part 2<\/h1>\n
    This tutorial will cover\u00a0some basic daily commands<\/a>\u00a0you need to use in order to manage\u00a0Samba4 AD Domain Controller<\/strong>\u00a0infrastructure, such as adding, removing, disabling or listing users and groups.<\/p>\n
    We\u2019ll also take a look on how to manage domain security policy and how to bind AD users to local PAM authentication in order for AD users to be able to perform local logins on Linux Domain Controller.<\/p>\n
    Requirements<\/h4>\n
      \n
    1. Create an AD Infrastructure with Samba4 on Ubuntu 16.04 \u2013 Part 1<\/a><\/li>\n
    2. Manage Samba4 Active Directory Infrastructure from Windows10 via RSAT \u2013 Part 3<\/a><\/li>\n
    3. Manage Samba4 AD Domain Controller DNS and Group Policy from Windows \u2013 Part 4<\/a><\/li>\n<\/ol>\n
      Step 1: Manage Samba AD DC from Command Line<\/h3>\n
      1.<\/strong>\u00a0Samba AD DC<\/strong>\u00a0can be managed through\u00a0samba-tool<\/strong>\u00a0command line utility which offers a great interface for administrating your domain.<\/p>\n
      With the help of samba-tool interface you can directly manage domain users and groups, domain Group Policy, domain sites, DNS services, domain replication and other critical domain functions.<\/p>\n
      To review the entire functionality of samba-tool just type the command with root privileges without any option or parameter.<\/p>\n
      # samba-tool -h\r\n<\/pre>\n
      \n
      \"samba-tool<\/a><\/p>\n
      samba-tool \u2013 Manage Samba Administration Tool<\/p>\n<\/div>\n
      2.<\/strong>\u00a0Now, let\u2019s start using\u00a0samba-tool<\/strong>\u00a0utility to administer\u00a0Samba4 Active Directory<\/strong>\u00a0and manage our users.<\/p>\n
      In order to create a user on AD use the following command:<\/p>\n
      # samba-tool user add your_domain_user\r\n<\/pre>\n
      To add a user with several important fields required by AD, use the following syntax:<\/p>\n
      --------- review all options ---------<\/strong> \r\n# samba-tool user add -h  \r\n# samba-tool user add your_domain_user --given-name=your_name --surname=your_username --mail-address=your_domain_user@tecmint.lan --login-shell=\/bin\/bash\r\n<\/pre>\n
      \n
      \"Create<\/a><\/p>\n
      Create User on Samba AD<\/p>\n<\/div>\n
      3.<\/strong>\u00a0A listing of all samba AD domain users can be obtained by issuing the following command:<\/p>\n
      # samba-tool user list\r\n<\/pre>\n
      \n
      \"List<\/a><\/p>\n
      List Samba AD Users<\/p>\n<\/div>\n
      4.<\/strong>\u00a0To delete a\u00a0samba AD domain user<\/strong>\u00a0use the below syntax:<\/p>\n
      # samba-tool user delete your_domain_user\r\n<\/pre>\n
      5.<\/strong>\u00a0Reset a samba domain user password by executing the below command:<\/p>\n
      # samba-tool user setpassword your_domain_user\r\n<\/pre>\n
      6.<\/strong>\u00a0In order to disable or enable an samba AD User account use the below command:<\/p>\n
      # samba-tool user disable your_domain_user\r\n# samba-tool user enable your_domain_user\r\n<\/pre>\n
      7.<\/strong>\u00a0Likewise, samba groups can be managed with the following command syntax:<\/p>\n
      --------- review all options ---------<\/strong> \r\n# samba-tool group add \u2013h  \r\n# samba-tool group add your_domain_group\r\n<\/pre>\n
      8.<\/strong>\u00a0Delete a samba domain group by issuing the below command:<\/p>\n
      # samba-tool group delete your_domain_group\r\n<\/pre>\n
      9.<\/strong>\u00a0To display all samba domain groups run the following command:<\/p>\n
      # samba-tool group list\r\n<\/pre>\n
      10.<\/strong>\u00a0To list all the samba domain members in a specific group use the command:<\/p>\n
      # samba-tool group listmembers \"your_domain group\"\r\n<\/pre>\n
      \n
      \"List<\/a><\/p>\n
      List Samba Domain Members of Group<\/p>\n<\/div>\n
      11.<\/strong>\u00a0Adding\/Removing a member from a samba domain group can be done by issuing one of the following commands:<\/p>\n
      # samba-tool group addmembers your_domain_group your_domain_user\r\n# samba-tool group remove members your_domain_group your_domain_user\r\n<\/pre>\n
      12.<\/strong>\u00a0As mentioned earlier, samba-tool command line interface can also be used to manage your samba domain policy and security.<\/p>\n
      To review your samba domain password settings use the below command:<\/p>\n
      # samba-tool domain passwordsettings show\r\n<\/pre>\n
      \n
      \"Check<\/a><\/p>\n
      Check Samba Domain Password<\/p>\n<\/div>\n
      13.<\/strong>\u00a0In order to modify samba domain password policy, such as the password complexity level, password ageing, length, how many old password to remember and other security features required for a Domain Controller use the below screenshot as a guide.<\/p>\n
      ---------- List all command options ----------<\/strong> \r\n# samba-tool domain passwordsettings -h \r\n<\/pre>\n
      \n
      \"Manage<\/a><\/p>\n
      Manage Samba Domain Password Settings<\/p>\n<\/div>\n
      Never use the password policy rules as illustrated above on a production environment. The above settings are used just for demonstration purposes.<\/p>\n
      Step 2: Samba Local Authentication Using Active Directory Accounts<\/h3>\n
      14.<\/strong>\u00a0By default, AD users cannot perform local logins on the Linux system outside\u00a0Samba AD DC<\/strong>\u00a0environment.<\/p>\n
      In order to login on the system with an\u00a0Active Directory<\/strong>\u00a0account you need to make the following changes on your Linux system environment and modify Samba4 AD DC.<\/p>\n
      First, open samba main configuration file and add the below lines, if missing, as illustrated on the below screenshot.<\/p>\n
      $ sudo nano \/etc\/samba\/smb.conf\r\n<\/pre>\n
      Make sure the following statements appear on the configuration file:<\/p>\n
      winbind enum users = yes\r\nwinbind enum groups = yes\r\n<\/pre>\n
      \n
      \"Samba<\/a><\/p>\n
      Samba Authentication Using Active Directory User Accounts<\/p>\n<\/div>\n
      15.<\/strong>\u00a0After you\u2019ve made the changes, use\u00a0testparm<\/strong>\u00a0utility to make sure no errors are found on samba configuration file and restart samba daemons by issuing the below command.<\/p>\n
      $ testparm\r\n$ sudo systemctl restart samba-ad-dc.service\r\n<\/pre>\n
      \n
      \"Check<\/a><\/p>\n
      Check Samba Configuration for Errors<\/p>\n<\/div>\n
      16.<\/strong>\u00a0Next, we need to modify local PAM configuration files in order for\u00a0Samba4 Active Directory<\/strong>\u00a0accounts to be able to authenticate and open a session on the local system and create a home directory for users at first login.<\/p>\n
      Use the\u00a0pam-auth-update<\/strong>\u00a0command to open PAM configuration prompt and make sure you enable all PAM profiles using\u00a0[space]<\/code>\u00a0key as illustrated on the below screenshot.<\/p>\n
      When finished hit\u00a0[Tab]<\/code>\u00a0key to move to\u00a0Ok<\/strong>\u00a0and apply changes.<\/p>\n
      $ sudo pam-auth-update\r\n<\/pre>\n
      \n
      \"Configure<\/a><\/p>\n
      Configure PAM for Samba4 AD<\/p>\n<\/div>\n
      \n
      \"Enable<\/a><\/p>\n
      Enable PAM Authentication Module for Samba4 AD Users<\/p>\n<\/div>\n
      17.<\/strong>\u00a0Now, open\u00a0\/etc\/nsswitch.conf<\/strong>\u00a0file with a text editor and add\u00a0winbind statement<\/strong>\u00a0at the end of the password and group lines as illustrated on the below screenshot.<\/p>\n
      $ sudo vi \/etc\/nsswitch.conf\r\n<\/pre>\n
      \n
      \"Add<\/a><\/p>\n
      Add Windbind Service Switch for Samba<\/p>\n<\/div>\n
      18.<\/strong>\u00a0Finally, edit\u00a0\/etc\/pam.d\/common-password<\/strong>\u00a0file, search for the below line as illustrated on the below screenshot and remove the\u00a0use_authtok<\/strong>\u00a0statement.<\/p>\n
      This setting assures that Active Directory users can change their password from command line while authenticated in Linux. With this setting on, AD users authenticated locally on Linux cannot change their password from console.<\/p>\n
      password       [success=1 default=ignore]      pam_winbind.so try_first_pass\r\n<\/pre>\n
      \n
      \"Allow<\/a><\/p>\n
      Allow Samba AD Users to Change Passwords<\/p>\n<\/div>\n
      Remove\u00a0use_authtok<\/strong>\u00a0option each time PAM updates are installed and applied to PAM modules or each time you execute\u00a0pam-auth-update<\/strong>\u00a0command.<\/p>\n
      19.<\/strong>\u00a0Samba4 binaries comes with a\u00a0winbindd<\/strong>\u00a0daemon built-in and enabled by default.<\/p>\n
      For this reason you\u2019re no longer required to separately enable and run\u00a0winbind<\/strong>\u00a0daemon provided by\u00a0winbind<\/strong>package from official Ubuntu repositories.<\/p>\n
      In case the old and deprecated\u00a0winbind<\/strong>\u00a0service is started on the system make sure you disable it and stop the service by issuing the below commands:<\/p>\n
      $ sudo systemctl disable winbind.service\r\n$ sudo systemctl stop winbind.service\r\n<\/pre>\n
      Although, we no longer need to run old winbind daemon, we still need to install Winbind package from repositories in order to install and use\u00a0wbinfo<\/strong>\u00a0tool.<\/p>\n
      Wbinfo<\/strong>\u00a0utility can be used to query Active Directory users and groups from\u00a0winbindd<\/strong>\u00a0daemon point of view.<\/p>\n
      The following commands illustrates how to query AD users and groups using\u00a0wbinfo<\/strong>.<\/p>\n
      $ wbinfo -g\r\n$ wbinfo -u\r\n$ wbinfo -i your_domain_user\r\n<\/pre>\n
      \n
      \"Check<\/a><\/p>\n
      Check Samba4 AD Information<\/p>\n<\/div>\n
      \n
      \"Check<\/a><\/p>\n
      Check Samba4 AD User Info<\/p>\n<\/div>\n
      20.<\/strong>\u00a0Apart from\u00a0wbinfo<\/strong>\u00a0utility you can also use\u00a0getent<\/strong>\u00a0command line utility to query Active Directory database from Name Service Switch libraries which are represented in\u00a0\/etc\/nsswitch.conf<\/strong>\u00a0file.<\/p>\n
      Pipe\u00a0getent<\/strong>\u00a0command through a\u00a0grep<\/strong>\u00a0filter in order to narrow the results regarding just your AD realm user or group database.<\/p>\n
      # getent passwd | grep TECMINT\r\n# getent group | grep TECMINT\r\n<\/pre>\n
      \n
      \"Get<\/a><\/p>\n
      Get Samba4 AD Details<\/p>\n<\/div>\n
      Step 3: Login in Linux with an Active Directory User<\/h3>\n
      21.<\/strong>\u00a0In order to authenticate on the system with a\u00a0Samba4 AD<\/strong>\u00a0user, just use the\u00a0AD username<\/strong>\u00a0parameter after\u00a0su -<\/code>\u00a0command.<\/p>\n
      At the first login a message will be displayed on the console which notifies you that a home directory has been created on\u00a0\/home\/$DOMAIN\/<\/code>\u00a0system path with the mane of your AD username.<\/p>\n
      Use\u00a0id command<\/strong>\u00a0to display extra information about the authenticated user.<\/p>\n
      # su - your_ad_user\r\n$ id\r\n$ exit\r\n<\/pre>\n
      \n
      \"Check<\/a><\/p>\n
      Check Samba4 AD User Authentication on Linux<\/p>\n<\/div>\n
      22.<\/strong>\u00a0To change the password for an authenticated AD user type\u00a0passwd command<\/strong>\u00a0in console after you have successfully logged into the system.<\/p>\n
      $ su - your_ad_user\r\n$ passwd\r\n<\/pre>\n
      \n
      \"Change<\/a><\/p>\n
      Change Samba4 AD User Password<\/p>\n<\/div>\n
      23.<\/strong>\u00a0By default,\u00a0Active Directory<\/strong>\u00a0users are not granted with root privileges in order to perform administrative tasks on Linux.<\/p>\n
      To grant root powers to an AD user you must add the username to the local\u00a0sudo<\/strong>\u00a0group by issuing the below command.<\/p>\n
      Make sure you enclose the\u00a0realm<\/strong>,\u00a0slash<\/strong>\u00a0and\u00a0AD username<\/strong>\u00a0with single\u00a0ASCII<\/strong>\u00a0quotes.<\/p>\n
      # usermod -aG sudo 'DOMAIN\\your_domain_user'\r\n<\/pre>\n
      To test if AD user has root privileges on the local system, login and run a command, such as\u00a0apt-get update<\/strong>, with sudo permissions.<\/p>\n
      # su - tecmint_user\r\n$ sudo apt-get update\r\n<\/pre>\n
      \n
      \"Grant<\/a><\/p>\n
      Grant sudo Permission to Samba4 AD User<\/p>\n<\/div>\n
      24.<\/strong>\u00a0In case you want to add root privileges for all accounts of an Active Directory group, edit\u00a0\/etc\/sudoers<\/strong>\u00a0file using\u00a0visudo<\/strong>\u00a0command and add the below line after root privileges line, as illustrated on the below screenshot:<\/p>\n
      %DOMAIN\\your_domain\\  group ALL=(ALL:ALL) ALL\r\n<\/pre>\n
      Pay attention to\u00a0sudoers<\/strong>\u00a0syntax so you don\u2019t break things out.<\/p>\n
      Sudoers file doesn\u2019t handles very well the use of\u00a0ASCII<\/strong>\u00a0quotation marks, so make sure you use\u00a0%<\/code>\u00a0to denote that you\u2019re referring to a group and use a backslash to escape the first slash after the domain name and another backslash to escape spaces if your group name contains spaces (most of AD built-in groups contain spaces by default). Also, write the realm with uppercases.<\/p>\n
      \n
      \"Give<\/a><\/p>\n
      Give Sudo Access to All Samba4 AD Users<\/p>\n<\/div>\n
      That\u2019s all for now!\u00a0Managing Samba4 AD<\/strong>\u00a0infrastructure can be also achieved with several tools from Windows environment, such as\u00a0ADUC<\/strong>,\u00a0DNS Manager<\/strong>,\u00a0GPM<\/strong>\u00a0or other, which can be obtained by installing\u00a0RSAT<\/strong>\u00a0package from Microsoft download page.<\/p>\n
      To administer\u00a0Samba4 AD DC<\/strong>\u00a0through\u00a0RSAT<\/strong>\u00a0utilities, it\u2019s absolutely necessary to join the Windows system into\u00a0Samba4 Active Directory<\/strong>.<\/p>\n
      Manage Samba4 Active Directory Infrastructure from Windows10 via RSAT \u2013 Part 3<\/h1>\n
      In this part of the\u00a0Samba4 AD DC infrastructure series<\/a>\u00a0we will talk on how join a\u00a0Windows 10<\/strong>\u00a0machine into a\u00a0Samba4<\/strong>\u00a0realm and how to administer the domain from a\u00a0Windows 10<\/strong>\u00a0workstation.<\/p>\n
      Once a\u00a0Windows 10<\/strong>\u00a0system has been joined to\u00a0Samba4 AD DC<\/strong>\u00a0we can create, remove or disable domain users and groups, we can create new\u00a0Organizational Units<\/strong>, we can create, edit and manage domain policy or we can manage Samba4 domain DNS service.<\/p>\n
      All of the above functions and other complex tasks concerning domain administration can be achieved via any modern Windows platform with the help of\u00a0RSAT \u2013 Microsoft Remote Server Administration Tools<\/strong>.<\/p>\n
      Requirements<\/h4>\n
        \n
      1. Create an AD Infrastructure with Samba4 on Ubuntu 16.04 \u2013 Part 1<\/a><\/li>\n
      2. Manage Samba4 AD Infrastructure from Linux Command Line \u2013 Part 2<\/a><\/li>\n
      3. Manage Samba4 AD Domain Controller DNS and Group Policy from Windows \u2013 Part 4<\/a><\/li>\n<\/ol>\n
        Step 1: Configure Domain Time Synchronization<\/h3>\n
        1.<\/strong>\u00a0Before starting to administer\u00a0Samba4 ADDC<\/strong>\u00a0from\u00a0Windows 10<\/strong>\u00a0with the help of\u00a0RSAT<\/strong>\u00a0tools, we need to know and take care of a crucial piece of service required for an\u00a0Active Directory<\/strong>\u00a0and this service refers to\u00a0accurate time synchronization<\/a>.<\/p>\n
        Time synchronization can be offered by\u00a0NTP<\/strong>\u00a0daemon in most of the Linux distributions. The default maximum time period discrepancy an AD can support is about\u00a05<\/strong>\u00a0minutes.<\/p>\n
        If the divergence time period is greater than\u00a05<\/strong>\u00a0minutes you should start experience various errors, most important concerning AD users, joined machines or share access.<\/p>\n
        To install\u00a0Network Time Protocol<\/strong>\u00a0daemon and\u00a0NTP<\/strong>\u00a0client utility in\u00a0Ubuntu<\/strong>, execute the below command.<\/p>\n
        $ sudo apt-get install ntp ntpdate\r\n<\/pre>\n
        \n
        \"Install<\/a><\/p>\n
        Install NTP on Ubuntu<\/p>\n<\/div>\n
        2.<\/strong>\u00a0Next, open and edit NTP configuration file and replace the default NTP pool server list with a new list of NTP servers which are geographically located near your current physical equipment location.<\/p>\n
        The list of NTP servers can be obtained by visiting official NTP Pool Project webpage\u00a0http:\/\/www.pool.ntp.org\/en\/<\/a>.<\/p>\n
        $ sudo nano \/etc\/ntp.conf\r\n<\/pre>\n
        Comment the default server list by adding a\u00a0#<\/code>\u00a0in front of each pool line and add the below pool lines with your proper NTP servers as illustrated on the below screenshot.<\/p>\n
        pool 0.ro.pool.ntp.org iburst\r\npool 1.ro.pool.ntp.org iburst\r\npool 2.ro.pool.ntp.org iburst\r\n\r\n# Use Ubuntu's ntp server as a fallback.\r\npool 3.ro.pool.ntp.org\r\n<\/pre>\n
        \n
        \"Configure<\/a><\/p>\n
        Configure NTP Server in Ubuntu<\/p>\n<\/div>\n
        3.<\/strong>\u00a0Now, don\u2019t close the file yet. Move to the top at the file and add the below line after the driftfile statement. This setup allows the clients to query the server using AD signed NTP requests.<\/p>\n
        ntpsigndsocket \/var\/lib\/samba\/ntp_signd\/\r\n<\/pre>\n
        \n
        \"Sync<\/a><\/p>\n
        Sync AD with NTP<\/p>\n<\/div>\n
        4.<\/strong>\u00a0Finally, move to the bottom of the file and add the below line, as illustrated on the below screenshot, which will allow network clients only to query the time on the server.<\/p>\n
        restrict default kod nomodify notrap nopeer mssntp\r\n<\/pre>\n
        \n
        \"Query<\/a><\/p>\n
        Query Clients to NTP Server<\/p>\n<\/div>\n
        5.<\/strong>\u00a0When finished, save and close the NTP configuration file and grant NTP service with the proper permissions in order to read the ntp_signed directory.<\/p>\n
        This is the system path where\u00a0Samba NTP<\/strong>\u00a0socket is located. Afterwards, restart NTP daemon to apply changes and verify if NTP has open sockets in your system network table using\u00a0netstat command<\/a>\u00a0combined with\u00a0grep filter<\/a>.<\/p>\n
        $ sudo chown root:ntp \/var\/lib\/samba\/ntp_signd\/\r\n$ sudo chmod 750 \/var\/lib\/samba\/ntp_signd\/\r\n$ sudo systemctl restart ntp\r\n$ sudo netstat \u2013tulpn | grep ntp\r\n<\/pre>\n
        \n
        \"Grant<\/a><\/p>\n
        Grant Permission to NTP<\/p>\n<\/div>\n
        Use the\u00a0ntpq<\/strong>\u00a0command line utility to monitor NTP daemon along with the\u00a0-p<\/code>\u00a0flag in order to print a summary of peers state.<\/p>\n
        $ ntpq -p\r\n<\/pre>\n
        \n
        \"Monitor<\/a><\/p>\n
        Monitor NTP Server Pool<\/p>\n<\/div>\n
        Step 2: Troubleshoot NTP Time Issues<\/h3>\n
        6.<\/strong>\u00a0Sometimes the NTP daemon gets stuck in calculations while trying to synchronize time with an upstream ntp server peer, resulting the following error messages when manually trying to force time synchronization by running\u00a0ntpdate<\/strong>\u00a0utility on a client side:<\/p>\n
        # ntpdate -qu adc1\r\nntpdate[4472]: no server suitable for synchronization found<\/strong>\r\n<\/pre>\n
        \n
        \"NTP<\/a><\/p>\n
        NTP Time Synchronization Error<\/p>\n<\/div>\n
        when using\u00a0ntpdate<\/strong>\u00a0command with\u00a0-d<\/code>\u00a0flag.<\/p>\n
        # ntpdate -d adc1.tecmint.lan\r\nServer dropped: Leap not in sync<\/strong>\r\n<\/pre>\n
        \n
        \"NTP<\/a><\/p>\n
        NTP Server Dropped Leap Not in Sync<\/p>\n<\/div>\n
        7.<\/strong>\u00a0To circumvent this issue, use the following trick to solve the problem: On the server, stop the NTP service and use the\u00a0ntpdate<\/strong>\u00a0client utility to manually force time synchronization with an external peer using the\u00a0-b<\/code>\u00a0flag as shown below:<\/p>\n
        # systemctl stop ntp.service\r\n# ntpdate -b 2.ro.pool.ntp.org<\/strong>  [your_ntp_peer<\/strong>]\r\n# systemctl start ntp.service\r\n# systemctl status ntp.service\r\n<\/pre>\n
        \n
        \"Force<\/a><\/p>\n
        Force NTP Time Synchronization<\/p>\n<\/div>\n
        8.<\/strong>\u00a0After the time has been accurately synchronized, start the NTP daemon on the server and verify from the client side if the service is ready to serve time for local clients by issuing the following command:<\/p>\n
        # ntpdate -du adc1.tecmint.lan    [your_adc_server<\/strong>]\r\n<\/pre>\n
        \n
        \"Verify<\/a><\/p>\n
        Verify NTP Time Synchronization<\/p>\n<\/div>\n
        By now, NTP server should work as expected.<\/p>\n
        Step 3: Join Windows 10 into Realm<\/h3>\n
        9.<\/strong>\u00a0As we saw in our previous tutorial,\u00a0Samba4 Active Directory can be managed from command line using samba-tool<\/a>\u00a0utility interface which can be accessed directly from server\u2019s VTY console or remotely connected through SSH.<\/p>\n
        Other, more intuitively and flexible alternative, would be to manage our\u00a0Samba4 AD Domain Controller<\/strong>\u00a0via\u00a0Microsoft Remote Server Administration Tools (RSAT)<\/strong>\u00a0from a Windows workstation integrated into the domain. These tools are available in almost all modern Windows systems.<\/p>\n
        The process of joining\u00a0Windows 10<\/strong>\u00a0or older versions of\u00a0Microsoft OS into Samba4 AD DC<\/strong>\u00a0is very simple. First, make sure that your Windows 10 workstation has the correct\u00a0Samba4 DNS IP<\/strong>\u00a0address configured in order to query the proper realm resolver.<\/p>\n
        Open\u00a0Control panel<\/strong>\u00a0->\u00a0Network and Internet<\/strong>\u00a0->\u00a0Network and Sharing Center<\/strong>\u00a0->\u00a0Ethernet card<\/strong>\u00a0->\u00a0Properties<\/strong>\u00a0->\u00a0IPv4<\/strong>\u00a0->\u00a0Properties<\/strong>\u00a0-> Use the following DNS server addresses and manually place Samba4 AD IP Address to the network interface as illustrated in the below screenshots.<\/p>\n
        \n
        \"join<\/a><\/p>\n
        join Windows to Samba4 AD<\/p>\n<\/div>\n
        \n
        \"Add<\/a><\/p>\n
        Add DNS and Samba4 AD IP Address<\/p>\n<\/div>\n
        Here,\u00a0192.168.1.254<\/strong>\u00a0is the IP Address of\u00a0Samba4 AD Domain Controller<\/strong>\u00a0responsible for DNS resolution. Replace the IP Address accordingly.<\/p>\n
        10.<\/strong>\u00a0Next, apply the network settings by hitting on\u00a0OK<\/strong>\u00a0button, open a\u00a0Command Prompt<\/strong>\u00a0and issue a\u00a0ping<\/strong>\u00a0against the generic domain name and Samba4 host FQDN in order to test if the realm is reachable through DNS resolution.<\/p>\n
        ping tecmint.lan\r\nping adc1.tecmint.lan\r\n<\/pre>\n
        \n
        \"Check<\/a><\/p>\n
        Check Network Connectivity Between Windows and Samba4 AD<\/p>\n<\/div>\n
        11.<\/strong>\u00a0If the resolver correctly responds to Windows client DNS queries, then, you need to assure that the time is accurately synchronized with the realm.<\/p>\n
        Open\u00a0Control Panel<\/strong>\u00a0->\u00a0Clock<\/strong>,\u00a0Language<\/strong>\u00a0and\u00a0Region<\/strong>\u00a0->\u00a0Set Time and Date<\/strong>\u00a0->\u00a0Internet Time tab<\/strong>\u00a0->\u00a0Change Settings<\/strong>\u00a0and write your domain name on Synchronize with and Internet time server field.<\/p>\n
        Hit on\u00a0Update Now<\/strong>\u00a0button to force time synchronization with the realm and hit\u00a0OK<\/strong>\u00a0to close the window.<\/p>\n
        \n
        \"Synchronize<\/a><\/p>\n
        Synchronize Time with Internet Server<\/p>\n<\/div>\n
        12.<\/strong>\u00a0Finally, join the domain by opening\u00a0System Properties<\/strong>\u00a0->\u00a0Change<\/strong>\u00a0->\u00a0Member of Domain<\/strong>, write your domain name, hit\u00a0OK<\/strong>, enter your domain administrative account credentials and hit\u00a0OK<\/strong>\u00a0again.<\/p>\n
        A new pop-up window should open informing you\u2019re a member of the domain. Hit\u00a0OK<\/strong>\u00a0to close the pop-up window and\u00a0reboot<\/strong>\u00a0the machine in order to apply domain changes.<\/p>\n
        The below screenshot will illustrate these steps.<\/p>\n
        \n
        \"Join<\/a><\/p>\n
        Join Windows Domain to Samba4 AD<\/p>\n<\/div>\n
        \n
        \"Enter<\/a><\/p>\n
        Enter Domain Administration Login<\/p>\n<\/div>\n
        \n
        \"Domain<\/a><\/p>\n
        Domain Joined to Samba4 AD Confirmation<\/p>\n<\/div>\n
        \n
        \"Restart<\/a><\/p>\n
        Restart Windows Server for Changes<\/p>\n<\/div>\n
        13.<\/strong>\u00a0After restart, hit on\u00a0Other<\/strong>\u00a0user and logon to Windows with a Samba4 domain account with administrative privileges and you should be ready to move to the next step.<\/p>\n
        \n
        \"Login<\/a><\/p>\n
        Login to Windows Using Samba4 AD Account<\/p>\n<\/div>\n
        Step 4: Administer Samba4 AD DC with RSAT<\/h4>\n
        14.<\/strong>\u00a0Microsoft Remote Server Administration Tools (RSAT)<\/strong>, which will be further used to administer\u00a0Samba4 Active Directory<\/strong>, can be downloaded from the following links, depending on your Windows version:<\/p>\n
          \n
        1. Windows 10<\/strong>:\u00a0https:\/\/www.microsoft.com\/en-us\/download\/details.aspx?id=45520<\/a><\/li>\n
        2. Windows 8.1<\/strong>:\u00a0http:\/\/www.microsoft.com\/en-us\/download\/details.aspx?id=39296<\/a><\/li>\n
        3. Windows 8<\/strong>:\u00a0http:\/\/www.microsoft.com\/en-us\/download\/details.aspx?id=28972<\/a><\/li>\n
        4. Windows 7<\/strong>:\u00a0http:\/\/www.microsoft.com\/en-us\/download\/details.aspx?id=7887<\/a><\/li>\n<\/ol>\n
          Once the update standalone installer package for\u00a0Windows 10<\/strong>\u00a0has been downloaded on your system, run the installer, wait for the installation to finish and restart the machine to apply all updates.<\/p>\n
          After\u00a0reboot<\/strong>, open\u00a0Control Panel<\/strong>\u00a0->\u00a0Programs<\/strong>\u00a0(Uninstall a Program<\/strong>) ->\u00a0Turn Windows features on or off<\/strong>\u00a0and check all\u00a0Remote Server Administration Tools<\/strong>.<\/p>\n
          Click\u00a0OK<\/strong>\u00a0to start the installation and after the installation process finishes, restart the system.<\/p>\n
          \n
          \"Administer<\/a><\/p>\n
          Administer Samba4 AD from Windows<\/p>\n<\/div>\n
          15.<\/strong>\u00a0To access\u00a0RSAT<\/strong>\u00a0tools go to\u00a0Control Panel<\/strong>\u00a0->\u00a0System and Security<\/strong>\u00a0->\u00a0Administrative Tools<\/strong>.<\/p>\n
          The tools can also be found in the\u00a0Administrative<\/strong>\u00a0tools menu from start menu. Alternatively, you can open\u00a0Windows MMC<\/strong>\u00a0and add Snap-ins using the\u00a0File<\/strong>\u00a0->\u00a0Add\/Remove<\/strong>\u00a0Snap-in menu.<\/p>\n
          \n
          \"Access<\/a><\/p>\n
          Access Remote Server Administration Tools<\/p>\n<\/div>\n
          The most used tools, such as\u00a0AD UC<\/strong>,\u00a0DNS<\/strong>\u00a0and\u00a0Group Policy Management<\/strong>\u00a0can be launched directly from Desktop by creating shortcuts using Send to feature from menu.<\/p>\n
          16.<\/strong>\u00a0You can verify\u00a0RSAT<\/strong>\u00a0functionality by opening\u00a0AD UC<\/strong>\u00a0and list domain Computers (newly joined windows machine should appear in the list), create a new\u00a0Organizational Unit<\/strong>\u00a0or a new user or group.<\/p>\n
          Verify if the users or groups had been properly created by issuing\u00a0wbinfo<\/strong>\u00a0command from Samba4 server side.<\/p>\n
          \n
          \"Active<\/a><\/p>\n
          Active Directory Users and Computers<\/p>\n<\/div>\n
          \n
          \"Create<\/a><\/p>\n
          Create Organizational Units and New Users<\/p>\n<\/div>\n
          \n
          \"Confirm<\/a><\/p>\n
          Confirm Samba4 AD Users<\/p>\n<\/div>\n
          That\u2019s it! On the next part of this topic we will cover other important aspects of a\u00a0Samba4 Active Directory<\/strong>which can be administered via\u00a0RSAT<\/strong>, such as, how to manage DNS server, add DNS records and create a reverse DNS lookup zone, how to manage and apply domain policy and how to create an interactive logon banner for your domain users.<\/p>\n
          Manage Samba4 AD Domain Controller DNS and Group Policy from Windows \u2013 Part 4<\/h1>\n
          Continuing the previous tutorial on\u00a0how to administer Samba4 from Windows 10 via RSAT<\/a>, in this part we\u2019ll see how to remotely manage our Samba AD Domain controller DNS server from Microsoft DNS Manager, how to create DNS records, how to create a Reverse Lookup Zone and how to create a domain policy via Group Policy Management tool.<\/p>\n
          Requirements<\/h4>\n
            \n
          1. Create an AD Infrastructure with Samba4 on Ubuntu 16.04 \u2013 Part 1<\/a><\/li>\n
          2. Manage Samba4 AD Infrastructure from Linux Command Line \u2013 Part 2<\/a><\/li>\n
          3. Manage Samba4 Active Directory Infrastructure from Windows10 via RSAT \u2013 Part 3<\/a><\/li>\n<\/ol>\n
            Step 1: Manage Samba DNS Server<\/h3>\n
            Samba4 AD DC<\/strong>\u00a0uses an internal DNS resolver module which is created during the initial domain provision (if\u00a0BIND9 DLZ<\/strong>\u00a0module is not specifically used).<\/p>\n
            Samba4<\/strong>\u00a0internal\u00a0DNS<\/strong>\u00a0module supports the basic features needed for an\u00a0AD Domain Controller<\/strong>. The domain DNS server can be managed in two ways, directly from command line through samba-tool interface or remotely from a Microsoft workstation which is part of the domain via\u00a0RSAT DNS Manager<\/strong>.<\/p>\n
            Here, we\u2019ll cover the second method because it\u2019s more intuitive and not so prone to errors.<\/p>\n
            1.<\/strong>\u00a0To administer the DNS service for your domain controller via\u00a0RSAT<\/strong>, go to your Windows machine, open\u00a0Control Panel<\/strong>\u00a0-><\/strong>\u00a0System and Security<\/strong>\u00a0->\u00a0Administrative Tools<\/strong>\u00a0and run\u00a0DNS Manager<\/strong>\u00a0utility.<\/p>\n
            Once the tool opens, it will ask you on what DNS running server you want to connect. Choose The following computer, type your\u00a0domain name<\/strong>\u00a0in the field (or\u00a0IP Address<\/strong>\u00a0or\u00a0FQDN<\/strong>\u00a0can be used as well), check the box that says \u2018Connect to the specified computer now<\/strong>\u2019 and hit\u00a0OK<\/strong>\u00a0to open your\u00a0Samba DNS<\/strong>\u00a0service.<\/p>\n
            \n
            \"Connect<\/a><\/p>\n
            Connect Samba4 DNS on Windows<\/p>\n<\/div>\n
            2.<\/strong>\u00a0In order to add a DNS record (as an example we will add an\u00a0A<\/code>\u00a0record that will point to our LAN gateway), navigate to domain\u00a0Forward Lookup Zone<\/strong>, right click on the right plane and choose\u00a0New Host<\/strong>\u00a0(A<\/code>\u00a0or\u00a0AAA<\/code>).<\/p>\n
            \n
            \"Add<\/a><\/p>\n
            Add DNS A Record on Windows<\/p>\n<\/div>\n
            3.<\/strong>\u00a0On the New host opened window, type the\u00a0name<\/strong>\u00a0and the\u00a0IP Address<\/strong>\u00a0of your DNS resource. The\u00a0FQDN<\/strong>\u00a0will be automatically written for you by DNS utility. When finished, hit the\u00a0Add Host<\/strong>\u00a0button and a pop-up window will inform you that your\u00a0DNS A<\/strong>\u00a0record has been successfully created.<\/p>\n
            Make sure you add\u00a0DNS A<\/strong>\u00a0records only for those resources in your network\u00a0configured with static IP Addresses<\/a>. Don\u2019t add\u00a0DNS A<\/strong>\u00a0records for hosts which are configured to acquire network configurations from a\u00a0DHCP<\/strong>\u00a0server or their\u00a0IP Addresses<\/strong>\u00a0change often.<\/p>\n
            \n
            \"Configure<\/a><\/p>\n
            Configure Samba Host on Windows<\/p>\n<\/div>\n
            To update a\u00a0DNS<\/strong>\u00a0record just double click on it and write your modifications. To delete the record right click on the\u00a0record<\/strong>\u00a0and choose\u00a0delete<\/strong>\u00a0from the menu.<\/p>\n
            In the same way you can add other types of\u00a0DNS<\/strong>\u00a0records for your domain, such as\u00a0CNAME<\/strong>\u00a0(also known as\u00a0DNS alias<\/strong>\u00a0record)\u00a0MX<\/strong>\u00a0records (very useful for mail servers) or other type of records (SPF<\/strong>,\u00a0TXT<\/strong>,\u00a0SRV<\/strong>\u00a0etc).<\/p>\n
            Step 2: Create a Reverse Lookup Zone<\/h3>\n
            By default,\u00a0Samba4 Ad DC<\/strong>\u00a0doesn\u2019t automatically add a reverse lookup zone and PTR records for your domain because these types of records are not crucial for a domain controller to function correctly.<\/p>\n
            Instead, a DNS reverse zone and its PTR records are crucial for the functionality of some important network services, such as an e-mail service because these type of records can be used to verify the identity of clients requesting a service.<\/p>\n
            Practically, PTR records are just the opposite of standard DNS records. The clients know the IP address of a resource and queries the DNS server to find out their registered DNS name.<\/p>\n
            4.<\/strong>\u00a0In order to a create a reverse lookup zone for\u00a0Samba AD DC<\/strong>, open\u00a0DNS Manager<\/strong>, right click on\u00a0Reverse Lookup Zone<\/strong>\u00a0from the left plane and choose\u00a0New Zone<\/strong>\u00a0from the menu.<\/p>\n
            \n
            \"Create<\/a><\/p>\n
            Create Reverse Lookup DNS Zone<\/p>\n<\/div>\n
            5.<\/strong>\u00a0Next, hit\u00a0Next<\/strong>\u00a0button and choose\u00a0Primary<\/strong>\u00a0zone from\u00a0Zone Type Wizard<\/strong>.<\/p>\n
            \n
            \"Select<\/a><\/p>\n
            Select DNS Zone Type<\/p>\n<\/div>\n
            6.<\/strong>\u00a0Next, choose To all\u00a0DNS<\/strong>\u00a0servers running on domain controllers in this domain from the\u00a0AD Zone Replication Scope<\/strong>, chose\u00a0IPv4 Reverse Lookup Zone<\/strong>\u00a0and hit\u00a0Next<\/strong>\u00a0to continue.<\/p>\n
            \n
            \"Select<\/a><\/p>\n
            Select DNS for Samba Domain Controller<\/p>\n<\/div>\n
            \n
            \"Add<\/a><\/p>\n
            Add Reverse Lookup Zone Name<\/p>\n<\/div>\n
            7.<\/strong>\u00a0Next, type the IP network address for your\u00a0LAN<\/strong>\u00a0in\u00a0Network ID<\/strong>\u00a0filed and hit\u00a0Next<\/strong>\u00a0to continue.<\/p>\n
            All\u00a0PTR<\/strong>\u00a0records added in this zone for your resources will point back only to\u00a0192.168.1.0\/24<\/strong>\u00a0network portion. If you want to create a PTR record for a server that does not reside in this network segment (for example mail server which is located in\u00a010.0.0.0\/24<\/strong>\u00a0network), then you\u2019ll need to create a new reverse lookup zone for that network segment as well.<\/p>\n
            \n
            \"Add<\/a><\/p>\n
            Add IP Address of Reverse Lookup DNS Zone<\/p>\n<\/div>\n
            8.<\/strong>\u00a0On the next screen choose to\u00a0Allow<\/strong>\u00a0only secure dynamic updates, hit next to continue and, finally hit on\u00a0finish<\/strong>to complete zone creation.<\/p>\n
            \n
            \"Enable<\/a><\/p>\n
            Enable Secure Dynamic Updates<\/p>\n<\/div>\n
            \n
            \"New<\/a><\/p>\n
            New DNS Zone Summary<\/p>\n<\/div>\n
            9.<\/strong>\u00a0At this point you have a valid DNS reverse lookup zone configured for your domain. In order to add a\u00a0PTR<\/strong>record in this zone, right click on the right\u00a0plane<\/strong>\u00a0and choose to create a\u00a0PTR<\/strong>\u00a0record for a network resource.<\/p>\n
            In this case we\u2019ve created a pointer for our gateway. In order to test if the record was properly added and works as expected from client\u2019s point of view, open a\u00a0Command Prompt<\/strong>\u00a0and issue a\u00a0nslookup<\/strong>\u00a0query against the name of the resource and another query for its IP Address.<\/p>\n
            Both queries should return the correct answer for your DNS resource.<\/p>\n
            nslookup gate.tecmint.lan\r\nnslookup 192.168.1.1\r\nping gate\r\n<\/pre>\n
            \n
            \"Add<\/a><\/p>\n
            Add DNS PTR Record and Query PTR<\/p>\n<\/div>\n
            Step 3: Domain Group Policy Management<\/h3>\n
            10.<\/strong>\u00a0An important aspect of a domain controller is its ability to control system resources and security from a single central point. This type of task can be easily achieved in a domain controller with the help of\u00a0Domain Group Policy<\/strong>.<\/p>\n
            Unfortunately, the only way to edit or manage group policy in a samba domain controller is through\u00a0RSAT GPM<\/strong>console provided by Microsoft.<\/p>\n
            In the below example we\u2019ll see how simple can be to manipulate group policy for our samba domain in order to create an interactive logon banner for our domain users.<\/p>\n
            In order to access group policy console, go to\u00a0Control Panel<\/strong>\u00a0-><\/strong>\u00a0System and Security<\/strong>\u00a0-><\/strong>\u00a0Administrative Tools<\/strong>\u00a0and open\u00a0Group Policy Management<\/strong>\u00a0console.<\/p>\n
            Expand the fields for your domain and right click on\u00a0Default Domain Policy<\/strong>. Choose\u00a0Edit<\/strong>\u00a0from the menu and a new windows should appear.<\/p>\n
            \n
            \"Manage<\/a><\/p>\n
            Manage Samba Domain Group Policy<\/p>\n<\/div>\n
            11.<\/strong>\u00a0On\u00a0Group Policy Management Editor<\/strong>\u00a0window go to\u00a0Computer Configuration<\/strong>\u00a0-><\/strong>\u00a0Policies<\/strong>\u00a0-><\/strong>\u00a0Windows Settings<\/strong>-><\/strong>\u00a0Security settings<\/strong>\u00a0-><\/strong>\u00a0Local Policies<\/strong>\u00a0->\u00a0Security Options<\/strong>\u00a0and a new options list should appear in the right plane.<\/p>\n
            In the right plane search and edit with your custom settings following two entries presented on the below screenshot.<\/p>\n
            \n
            \"Configure<\/a><\/p>\n
            Configure Samba Domain Group Policy<\/p>\n<\/div>\n
            12.<\/strong>\u00a0After finishing editing the two entries, close all windows, open an elevated Command prompt and force group policy to apply on your machine by issuing the below command:<\/p>\n
            gpupdate \/force\r\n<\/pre>\n
            \n
            \"Update<\/a><\/p>\n
            Update Samba Domain Group Policy<\/p>\n<\/div>\n
            13.<\/strong>\u00a0Finally, reboot your computer and you\u2019ll see the logon banner in action when you\u2019ll try to perform logon.<\/p>\n
            \n
            \"Samba4<\/a><\/p>\n
            Samba4 AD Domain Controller Logon Banner<\/p>\n<\/div>\n
            That\u2019s all!\u00a0Group Policy<\/strong>\u00a0is a very complex and sensitive subject and should be treated with maximum care by system admins. Also, be aware that group policy settings won\u2019t apply in any way to Linux systems integrated into the realm.<\/p>\n
            Join an Additional Ubuntu DC to Samba4 AD DC for FailOver Replication \u2013 Part 5<\/h1>\n
            This tutorial will show you how to add a second\u00a0Samba4<\/strong>\u00a0domain controller, provisioned on\u00a0Ubuntu 16.04<\/strong>\u00a0server, to the existing\u00a0Samba AD DC<\/strong>\u00a0forest in order to provide a degree of load balancing\/failover for some crucial AD DC services, especially for services such as DNS and AD DC LDAP schema with SAM database.<\/p>\n
            Requirements<\/h4>\n
              \n
            1. Create an Active Directory Infrastructure with Samba4 on Ubuntu \u2013 Part 1<\/a><\/li>\n<\/ol>\n
              This article is a\u00a0Part-5<\/strong>\u00a0of\u00a0Samba4 AD DC<\/strong>\u00a0series as follows:<\/p>\n
              Part 2<\/b>:\u00a0Manage Samba4 AD Infrastructure from Linux Command Line<\/a><\/div>\n
              Part 3<\/b>:\u00a0Manage Samba4 Active Directory Infrastructure from Windows10 via RSAT<\/a><\/div>\n
              Part 4<\/b>:\u00a0Manage Samba4 AD Domain Controller DNS and Group Policy from Windows<\/a><\/div>\n
              Step 1: Initial Configuration for Samba4 Setup<\/h3>\n
              1.<\/strong>\u00a0Before you start to actually perform domain joining for the second DC, you need to take care of few initial settings. First, make sure the\u00a0hostname<\/strong>\u00a0of the system which will be integrated into\u00a0Samba4 AD DC<\/strong>\u00a0contains a descriptive name.<\/p>\n
              Assuming that the\u00a0hostname<\/strong>\u00a0of the first provisioned realm is called\u00a0adc1<\/code>, you can name the second DC with\u00a0adc2<\/code>\u00a0in order to provide a consistent naming scheme across your Domain Controllers.<\/p>\n
              To change the system\u00a0hostname<\/strong>\u00a0you can issue the below command.<\/p>\n
              # hostnamectl set-hostname adc2\r\n<\/pre>\n
              else you can manually edit\u00a0\/etc\/hostname<\/strong>\u00a0file and add a new line with the desired name.<\/p>\n
              # nano \/etc\/hostname\r\n<\/pre>\n
              Here add the hostname.<\/p>\n
              adc2\r\n<\/pre>\n
              2.<\/strong>\u00a0Next, open local system resolution file and add an entry with the IP address witch points to the short name and\u00a0FQDN<\/strong>\u00a0of the main domain controller, as illustrated in the below screenshot.<\/p>\n
              Through this tutorial, the primary DC name is\u00a0adc1.tecmint.lan<\/code>\u00a0and it resolves to\u00a0192.168.1.254<\/strong>\u00a0IP address.<\/p>\n
              # nano \/etc\/hosts\r\n<\/pre>\n
              Add the following line:<\/p>\n
              IP_of_main_DC\t\tFQDN_of_main_DC \tshort_name_of_main_DC\r\n<\/pre>\n
              \n
              \"Set<\/a><\/p>\n
              Set Hostname for Samba4 AD DC<\/p>\n<\/div>\n
              3.<\/strong>\u00a0On the next step, open\u00a0\/etc\/network\/interfaces<\/strong>\u00a0and assign a static IP address for your system as illustrated in the below screenshot.<\/p>\n
              Pay attention to\u00a0dns-nameservers<\/strong>\u00a0and\u00a0dns-search<\/strong>\u00a0variables. These values should be configured to point back to the IP address of the primary\u00a0Samba4 AD DC<\/strong>\u00a0and realm in order for DNS resolution to work correctly.<\/p>\n
              Restart the network daemon in order to reflect changes. Verify\u00a0\/etc\/resolv.conf<\/strong>\u00a0file to assure that both DNS values from your network interface are updated to this file.<\/p>\n
              # nano \/etc\/network\/interfaces\r\n<\/pre>\n
              Edit and replace with your custom IP settings:<\/p>\n
              auto ens33\r\niface ens33 inet static\r\n        address 192.168.1.253\r\n        netmask 255.255.255.0\r\n        brodcast 192.168.1.1\r\n        gateway 192.168.1.1\r\n        dns-nameservers 192.168.1.254\r\n        dns-search tecmint.lan\r\n<\/pre>\n
              Restart network service and confirm changes.<\/p>\n
              # systemctl restart networking.service\r\n# cat \/etc\/resolv.conf\r\n<\/pre>\n
              \n
              \"Configure<\/a><\/p>\n
              Configure DNS for Samba4 AD<\/p>\n<\/div>\n
              The\u00a0dns-search<\/strong>\u00a0value will automatically append the domain name when you query a host by its short name (will form the FQDN).<\/p>\n
              4.<\/strong>\u00a0In order to test if DNS resolution is working as expected, issue a series of\u00a0ping<\/strong>\u00a0commands against your domain short name, FQDN and realm as shown in the below screenshot.<\/p>\n
              In all these cases\u00a0Samba4 AD DC DNS<\/strong>\u00a0server should reply with the IP address of your main DC.<\/p>\n
              \n
              \"Verify<\/a><\/p>\n
              Verify DNS Resolution for Samba4 AD<\/p>\n<\/div>\n
              5.<\/strong>\u00a0The final additional step that you need to take care off is time synchronization with your main Domain Controller. This can be accomplished by installing\u00a0NTP<\/strong>\u00a0client utility on your system by issuing the below command:<\/p>\n
              # apt-get install ntpdate\r\n<\/pre>\n
              6.<\/strong>\u00a0Assuming that you want to manually force time synchronization with\u00a0samba4 AD DC<\/strong>, run\u00a0ntpdate<\/strong>\u00a0command against the primary DC by issuing the following command.<\/p>\n
              # ntpdate adc1\r\n<\/pre>\n
              \n
              \"Time<\/a><\/p>\n
              Time Synchronize with Samba4 AD<\/p>\n<\/div>\n
              Step 2: Install Samba4 with Required Dependencies<\/h3>\n
              7.<\/strong>\u00a0In order to enroll\u00a0Ubuntu 16.04<\/strong>\u00a0system into your domain, first install\u00a0Samba4<\/strong>,\u00a0Kerberos<\/strong>\u00a0client and a few other important packages for later use from Ubuntu official repositories by issuing the below command:<\/p>\n
              # apt-get install samba krb5-user krb5-config winbind libpam-winbind libnss-winbind\r\n<\/pre>\n
              \n
              \"Install<\/a><\/p>\n
              Install Samba4 in Ubuntu<\/p>\n<\/div>\n
              8.<\/strong>\u00a0During the installation you will need to provide Kerberos realm name. Write your domain name with upper cases and press\u00a0[Enter]<\/strong>\u00a0key to finish the installation process.<\/p>\n
              \n
              \"Configure<\/a><\/p>\n
              Configure Kerberos Authentication for Samba4<\/p>\n<\/div>\n
              9.<\/strong>\u00a0After the packages installation finishes, verify the settings by requesting a Kerberos ticket for a domain administrator using\u00a0kinit<\/strong>\u00a0command. Use\u00a0klist<\/strong>\u00a0command to list granted Kerberos ticket.<\/p>\n
              # kinit domain-admin-user@YOUR_DOMAIN.TLD\r\n# klist\r\n<\/pre>\n
              \n
              \"Verify<\/a><\/p>\n
              Verify Kerberos on Samba4 Domain<\/p>\n<\/div>\n
              Step 3: Join to Samba4 AD DC as a Domain Controller<\/h3>\n
              10.<\/strong>\u00a0Before integrating your machine into\u00a0Samba4 DC<\/strong>, first make sure all Samba4 daemons running on your system are stopped and, also, rename the default Samba configuration file in order to start clean. While provisioning the domain controller, samba will create a new configuration file from scratch.<\/p>\n
              # systemctl stop samba-ad-dc smbd nmbd winbind\r\n# mv \/etc\/samba\/smb.conf \/etc\/samba\/smb.conf.initial\r\n<\/pre>\n
              11.<\/strong>\u00a0In order to start the domain joining process, first start only\u00a0samba-ad-dc<\/strong>\u00a0daemon, after which you will run\u00a0samba-tool<\/strong>\u00a0command to join the realm using an account with administrative privileges on your domain.<\/p>\n
              # samba-tool domain join your_domain DC -U \"your_domain_admin\"\r\n<\/pre>\n
              Domain integration excerpt:<\/p>\n
              # samba-tool domain join tecmint.lan DC -U\"tecmint_user\"\r\n<\/pre>\n
              Sample Output<\/h5>\n
              Finding a writeable DC for domain 'tecmint.lan'\r\nFound DC adc1.tecmint.lan\r\nPassword for [WORKGROUP\\tecmint_user]:\r\nworkgroup is TECMINT\r\nrealm is tecmint.lan\r\nchecking sAMAccountName\r\nDeleted CN=ADC2,CN=Computers,DC=tecmint,DC=lan\r\nAdding CN=ADC2,OU=Domain Controllers,DC=tecmint,DC=lan\r\nAdding CN=ADC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=tecmint,DC=lan\r\nAdding CN=NTDS Settings,CN=ADC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=tecmint,DC=lan\r\nAdding SPNs to CN=ADC2,OU=Domain Controllers,DC=tecmint,DC=lan\r\nSetting account password for ADC2$\r\nEnabling account\r\nCalling bare provision\r\nLooking up IPv4 addresses\r\nLooking up IPv6 addresses\r\nNo IPv6 address will be assigned\r\nSetting up share.ldb\r\nSetting up secrets.ldb\r\nSetting up the registry\r\nSetting up the privileges database\r\nSetting up idmap db\r\nSetting up SAM db\r\nSetting up sam.ldb partitions and settings\r\nSetting up sam.ldb rootDSE\r\nPre-loading the Samba 4 and AD schema\r\nA Kerberos configuration suitable for Samba 4 has been generated at \/var\/lib\/samba\/private\/krb5.conf\r\nProvision OK for domain DN DC=tecmint,DC=lan\r\nStarting replication\r\nSchema-DN[CN=Schema,CN=Configuration,DC=tecmint,DC=lan] objects[402\/1550] linked_values[0\/0]\r\nSchema-DN[CN=Schema,CN=Configuration,DC=tecmint,DC=lan] objects[804\/1550] linked_values[0\/0]\r\nSchema-DN[CN=Schema,CN=Configuration,DC=tecmint,DC=lan] objects[1206\/1550] linked_values[0\/0]\r\nSchema-DN[CN=Schema,CN=Configuration,DC=tecmint,DC=lan] objects[1550\/1550] linked_values[0\/0]\r\nAnalyze and apply schema objects\r\nPartition[CN=Configuration,DC=tecmint,DC=lan] objects[402\/1614] linked_values[0\/0]\r\nPartition[CN=Configuration,DC=tecmint,DC=lan] objects[804\/1614] linked_values[0\/0]\r\nPartition[CN=Configuration,DC=tecmint,DC=lan] objects[1206\/1614] linked_values[0\/0]\r\nPartition[CN=Configuration,DC=tecmint,DC=lan] objects[1608\/1614] linked_values[0\/0]\r\nPartition[CN=Configuration,DC=tecmint,DC=lan] objects[1614\/1614] linked_values[28\/0]\r\nReplicating critical objects from the base DN of the domain\r\nPartition[DC=tecmint,DC=lan] objects[97\/97] linked_values[24\/0]\r\nPartition[DC=tecmint,DC=lan] objects[380\/283] linked_values[27\/0]\r\nDone with always replicated NC (base, config, schema)\r\nReplicating DC=DomainDnsZones,DC=tecmint,DC=lan\r\nPartition[DC=DomainDnsZones,DC=tecmint,DC=lan] objects[45\/45] linked_values[0\/0]\r\nReplicating DC=ForestDnsZones,DC=tecmint,DC=lan\r\nPartition[DC=ForestDnsZones,DC=tecmint,DC=lan] objects[18\/18] linked_values[0\/0]\r\nCommitting SAM database\r\nSending DsReplicaUpdateRefs for all the replicated partitions\r\nSetting isSynchronized and dsServiceName\r\nSetting up secrets database\r\nJoined domain TECMINT (SID S-1-5-21-715537322-3397311598-55032968) as a DC\r\n<\/pre>\n
              \n
              \"Join<\/a><\/p>\n
              Join Domain to Samba4 AD DC<\/p>\n<\/div>\n
              12.<\/strong>\u00a0After the Ubuntu with samba4 software has been integrated into the domain, open samba main configuration file and add the following lines:<\/p>\n
              # nano \/etc\/samba\/smb.conf\r\n<\/pre>\n
              Add following excerpt to smb.conf file.<\/p>\n
              dns forwarder = 192.168.1.1\r\nidmap_ldb:use rfc2307 = yes\r\n\r\n   template shell = \/bin\/bash\r\n   winbind use default domain = true\r\n   winbind offline logon = false\r\n   winbind nss info = rfc2307\r\n        winbind enum users = yes\r\n        winbind enum groups = yes\r\n<\/pre>\n
              Replace\u00a0dns forwarder IP<\/strong>\u00a0address with your own DNS forwarder IP. Samba will forward all DNS resolution queries that are outside your domain authoritative zone to this IP address.<\/p>\n
              13.<\/strong>\u00a0Finally, restart samba daemon to reflect changes and check active directory replication by executing the following commands.<\/p>\n
              # systemctl restart samba-ad-dc\r\n# samba-tool drs showrepl\r\n<\/pre>\n
              \n
              \"Configure<\/a><\/p>\n
              Configure Samba4 DNS<\/p>\n<\/div>\n
              14.<\/strong>\u00a0Additionally, rename initial Kerberos configuration file from\u00a0\/etc<\/strong>\u00a0path and replace it with the new\u00a0krb5.conf<\/strong>configuration file generated by samba while provisioning the domain.<\/p>\n
              The file is located in\u00a0\/var\/lib\/samba\/private<\/strong>\u00a0directory. Use Linux symlink to link this file to\u00a0\/etc<\/strong>\u00a0directory.<\/p>\n
              # mv \/etc\/krb5.conf \/etc\/krb5.conf.initial\r\n# ln -s \/var\/lib\/samba\/private\/krb5.conf \/etc\/\r\n# cat \/etc\/krb5.conf\r\n<\/pre>\n
              \n
              \"Configure<\/a><\/p>\n
              Configure Kerberos<\/p>\n<\/div>\n
              15.<\/strong>\u00a0Also, verify Kerberos authentication with samba\u00a0krb5.conf<\/strong>\u00a0file. Request a ticket for an administrator user and list the cached ticket by issuing the below commands.<\/p>\n
              # kinit administrator\r\n# klist\r\n<\/pre>\n
              \n
              \"Verify<\/a><\/p>\n
              Verify Kerberos Authentication with Samba<\/p>\n<\/div>\n
              Step 4: Additional Domain Services Validations<\/h3>\n
              16.<\/strong>\u00a0The first test you need to perform is\u00a0Samba4 DC DNS<\/strong>\u00a0resolution. To validate your domain DNS resolution, query the domain name using\u00a0host<\/strong>\u00a0command against a few crucial AD DNS records as presented on the below screenshot.<\/p>\n
              The DNS server should replay by now with a pair of two IP addresses for each query.<\/p>\n
              # host your_domain.tld\r\n# host -t SRV _kerberos._udp.your_domain.tld  # UDP Kerberos SRV record\r\n# host -t SRV _ldap._tcp.your_domain.tld  # TCP LDAP SRV record\r\n<\/pre>\n
              \n
              \"Verify<\/a><\/p>\n
              Verify Samba4 DC DNS<\/p>\n<\/div>\n
              17.<\/strong>\u00a0These DNS records should also be visible from an enrolled\u00a0Windows machine with RSAT tools installed<\/a>. Open DNS Manager and expand to your domain tcp records as shown in the below image.<\/p>\n
              \n
              \"Verify<\/a><\/p>\n
              Verify DNS Records on Windows RSAT Tool<\/p>\n<\/div>\n
              18.<\/strong>\u00a0The next test should indicate if domain LDAP replication works as expected. Using\u00a0samba-tool<\/strong>, create an account on the second domain controller and verify if the account is automatically replicated on the first Samba4 AD DC.<\/p>\n
              On adc2:<\/h5>\n
              # samba-tool user add test_user\r\n<\/pre>\n
              On adc1:<\/h5>\n
              # samba-tool user list | grep test_user\r\n<\/pre>\n
              \n
              \"Create<\/a><\/p>\n
              Create User Account on Samba4 AD<\/p>\n<\/div>\n
              \n
              \"Verify<\/a><\/p>\n
              Verify Replication on Samba4 AD<\/p>\n<\/div>\n
              19.<\/strong>\u00a0You can also create an account from a\u00a0Microsoft AD UC<\/strong>\u00a0console and verify if the account appears on both domain controllers.<\/p>\n
              By default, the account should be automatically created on both samba domain controllers. Query the account name from\u00a0adc1<\/code>\u00a0using\u00a0wbinfo<\/strong>\u00a0command.<\/p>\n
              \n
              \"Create<\/a><\/p>\n
              Create Account from Microsoft AD UC<\/p>\n<\/div>\n
              \n
              \"Verify<\/a><\/p>\n
              Verify Account Replication On Samba4 AD<\/p>\n<\/div>\n
              20.<\/strong>\u00a0As a fact, open\u00a0AD UC<\/strong>\u00a0console from Windows, expand to Domain Controllers and you should see both enrolled DC machines.<\/p>\n
              \n
              \"Verify<\/a><\/p>\n
              Verify Samba4 Domain Controllers<\/p>\n<\/div>\n
              Step 5: Enable Samba4 AD DC Service<\/h3>\n
              21.<\/strong>\u00a0In order to enable samba4 AD DC services system-wide, first disable some old and unused Samba daemons and enable only\u00a0samba-ad-dc<\/strong>\u00a0service by running the below commands:<\/p>\n
              # systemctl disable smbd nmbd winbind\r\n# systemctl enable samba-ad-dc\r\n<\/pre>\n
              \n
              \"Enable<\/a><\/p>\n
              Enable Samba4 AD DC Services<\/p>\n<\/div>\n
              22.<\/strong>\u00a0If you remotely administer Samba4 domain controller from a Microsoft client or you have other Linux or Windows clients integrated into your domain, make sure you mention the IP address of the\u00a0adc2<\/code>\u00a0machine to their network interface DNS server IP settings in order to gain a level of redundancy.<\/p>\n
              The below screenshots illustrates the configurations required for a Windows or a Debian\/Ubuntu client.<\/p>\n
              \n
              \"Configure<\/a><\/p>\n
              Configure Client to Administer Samba4 DC<\/p>\n<\/div>\n
              \n
              \"Configure<\/a><\/p>\n
              Configure Linux Client to Administer Samba4 DC<\/p>\n<\/div>\n
              Assuming that the first\u00a0DC<\/strong>\u00a0with\u00a0192.168.1.254<\/strong>\u00a0goes offline, reverse the order of the DNS server IP addresses in the configuration file so it won\u2019t try to query first an unavailable DNS server.<\/p>\n
              Finally, in case you want to perform local authentication on a Linux system with a Samba4 Active Directory account or grant root privileges for AD LDAP accounts in Linux, read the steps 2 and 3 from the tutorial\u00a0Manage Samba4 AD Infrastructure from Linux Command Line<\/a>.<\/p>\n
              Setup SysVol Replication Across Two Samba4 AD DC with Rsync \u2013 Part 6<\/h1>\n
              This topic will cover\u00a0SysVol<\/strong>\u00a0replication across two\u00a0Samba4 Active Directory Domain Controllers<\/strong>\u00a0performed with the help of a few powerful Linux tools, such as\u00a0Rsync file synchronization utility<\/a>,\u00a0Cron scheduling daemon<\/a>\u00a0and\u00a0SSH protocol<\/a>.<\/p>\n
              Requirements:<\/h4>\n
                \n
              1. Join Ubuntu 16.04 as Additional Domain Controller to Samba4 AD DC \u2013 Part 5<\/a><\/li>\n<\/ol>\n
                Step 1: Accurate Time Synchronization Across DCs<\/h3>\n
                1.<\/strong>\u00a0Before starting to replicate the contents of the\u00a0sysvol<\/strong>\u00a0directory across both domain controllers you need to provide an accurate time for these machines.<\/p>\n
                If the delay is greater than 5 minutes on both directions and their clocks are not properly in sync, you should start experiencing various problems with AD accounts and domain replication.<\/p>\n
                To overcome the problem of time drifting between two or more domain controllers, you need to\u00a0install and configure NTP server<\/a>\u00a0on your machine by executing the below command.<\/p>\n
                # apt-get install ntp\r\n<\/pre>\n
                2.<\/strong>\u00a0After NTP daemon has been installed, open the main configuration file, comment the default pools (add a\u00a0#<\/strong>\u00a0in front of each pool line) and add a new pool which will point back to the main\u00a0Samba4 AD DC FQDN<\/strong>\u00a0with\u00a0NTP<\/strong>server installed, as suggested on the below example.<\/p>\n
                # nano \/etc\/ntp.conf\r\n<\/pre>\n
                Add following lines to\u00a0ntp.conf<\/strong>\u00a0file.<\/p>\n
                pool 0.ubuntu.pool.ntp.org iburst\r\n#pool 1.ubuntu.pool.ntp.org iburst\r\n#pool 2.ubuntu.pool.ntp.org iburst\r\n#pool 3.ubuntu.pool.ntp.org iburst\r\n\r\npool adc1.tecmint.lan\r\n\r\n# Use Ubuntu's ntp server as a fallback.\r\npool ntp.ubuntu.com\r\n<\/pre>\n
                \n
                \"Configure<\/a><\/p>\n
                Configure NTP for Samba4<\/p>\n<\/div>\n
                3.<\/strong>\u00a0Don\u2019t close the file yet, move to the bottom of the file and add the following lines in order for other clients to be able to query and\u00a0sync the time with this NTP server<\/a>, issuing signed NTP requests, in case the primary DC goes offline:<\/p>\n
                restrict source notrap nomodify noquery mssntp\r\nntpsigndsocket \/var\/lib\/samba\/ntp_signd\/\r\n<\/pre>\n
                4.<\/strong>\u00a0Finally, save and close the configuration file and restart NTP daemon in order to apply the changes. Wait for a few seconds or minutes for the time to synchronize and issue\u00a0ntpq<\/strong>\u00a0command in order to print the current summary state of the\u00a0adc1<\/strong>\u00a0peer in sync.<\/p>\n
                # systemctl restart ntp\r\n# ntpq -p\r\n<\/pre>\n
                \n
                \"Synchronize<\/a><\/p>\n
                Synchronize NTP Time with Samba4 AD<\/p>\n<\/div>\n
                Step 2: SysVol Replication with First DC via Rsync<\/h3>\n
                By default,\u00a0Samba4 AD DC<\/strong>\u00a0doesn\u2019t perform\u00a0SysVol<\/strong>\u00a0replication via\u00a0DFS-R<\/strong>\u00a0(Distributed File System Replication<\/strong>) or the\u00a0FRS<\/strong>\u00a0(File Replication Service<\/strong>).<\/p>\n
                This means that\u00a0Group Policy<\/strong>\u00a0objects are available only if the first domain controller is online. If the first DC becomes unavailable, the Group Policy settings and logon scripts will not apply further on Windows machines enrolled into the domain.<\/p>\n
                To overcome this obstacle and achieve a rudimentary form of SysVol replication we will schedule a\u00a0Linux rsync command<\/a>\u00a0combined with a SSH encrypted tunnel with\u00a0key-based SSH authentication<\/a>\u00a0in order to securely transfer\u00a0GPO<\/strong>\u00a0objects from the first domain controller to the second domain controller.<\/p>\n
                This method ensures\u00a0GPO<\/strong>\u00a0objects consistency across domain controllers, but has one huge drawback. It works only in one direction because\u00a0rsync<\/strong>\u00a0will transfer all changes from the source DC to the destination DC when synchronizing GPO directories.<\/p>\n
                Objects which no longer exist on the source will be deleted from the destination as well. In order to limit and avoid any conflicts, all GPO edits should be made only on the first DC.<\/p>\n
                5.<\/strong>\u00a0To start the process of\u00a0SysVol<\/strong>\u00a0replication, first\u00a0generate a SSH key on the first Samba AD DC<\/a>\u00a0and transfer the key to the second DC by issuing the below commands.<\/p>\n
                Do not use a\u00a0passphrase<\/strong>\u00a0for this key in order for the scheduled transfer to run without user interference.<\/p>\n
                # ssh-keygen -t RSA  \r\n# ssh-copy-id root@adc2  \r\n# ssh adc2 \r\n# exit \r\n<\/pre>\n
                \n
                \"Generate<\/a><\/p>\n
                Generate SSH Key on Samba4 DC<\/p>\n<\/div>\n
                6.<\/strong>\u00a0After you\u2019ve assured that the root user from the first\u00a0DC<\/strong>\u00a0can automatically login on the second\u00a0DC<\/strong>, run the following\u00a0Rsync<\/strong>\u00a0command with\u00a0--dry-run<\/code>\u00a0parameter in order simulate SysVol replication. Replace\u00a0adc2<\/strong>accordingly.<\/p>\n
                # rsync --dry-run -XAavz --chmod=775 --delete-after  --progress --stats  \/var\/lib\/samba\/sysvol\/ root@adc2:\/var\/lib\/samba\/sysvol\/\r\n<\/pre>\n
                7.<\/strong>\u00a0If the simulation process works as expected, run the rsync command again without the\u00a0--dry-run<\/code>\u00a0option in order to actually replicate GPO objects across your domain controllers.<\/p>\n
                # rsync -XAavz --chmod=775 --delete-after  --progress --stats  \/var\/lib\/samba\/sysvol\/ root@adc2:\/var\/lib\/samba\/sysvol\/\r\n<\/pre>\n
                \n
                \"Samba4<\/a><\/p>\n
                Samba4 AD DC SysVol Replication<\/p>\n<\/div>\n
                8.<\/strong>\u00a0After SysVol replication process has finished, login to the destination domain controller and list the contents of one of the GPO objects directory by running the below command.<\/p>\n
                The same GPO objects from the first DC should be replicated here too.<\/p>\n
                # ls -alh \/var\/lib\/samba\/sysvol\/your_domain\/Policiers\/\r\n<\/pre>\n
                \n
                \"Verify<\/a><\/p>\n
                Verify Samba4 DC SysVol Replication<\/p>\n<\/div>\n
                9.<\/strong>\u00a0To automate the process of\u00a0Group Policy<\/strong>\u00a0replication (sysvol directory transport over network), schedule a root job to run the rsync command used earlier every 5 minutes by issuing the below command.<\/p>\n
                # crontab -e \r\n<\/pre>\n
                Add rsync command to run every 5 minutes and direct the output of the command, including the errors, to the log file\u00a0\/var\/log\/sysvol-replication.log<\/strong>\u00a0.In case something doesn\u2019t work as expected you should consult this file in order to troubleshoot the problem.<\/p>\n
                *\/5 * * * * rsync -XAavz --chmod=775 --delete-after  --progress --stats  \/var\/lib\/samba\/sysvol\/ root@adc2:\/var\/lib\/samba\/sysvol\/ > \/var\/log\/sysvol-replication.log 2>&1\r\n<\/pre>\n
                10.<\/strong>\u00a0Assuming that in future there will be some related issues with\u00a0SysVol ACL<\/strong>\u00a0permissions, you can run the following commands in order to detect and repair these errors.<\/p>\n
                # samba-tool ntacl sysvolcheck\r\n# samba-tool ntacl sysvolreset\r\n<\/pre>\n
                \n
                \"Fix<\/a><\/p>\n
                Fix SysVol ACL Permissions<\/p>\n<\/div>\n
                11.<\/strong>\u00a0In case the first\u00a0Samba4 AD DC<\/strong>\u00a0with\u00a0FSMO<\/strong>\u00a0role as \u201cPDC Emulator<\/strong>\u201d becomes unavailable, you can force the\u00a0Group Policy Management Console<\/strong>\u00a0installed on a\u00a0Microsoft Windows<\/strong>\u00a0system to connect only to the second domain controller by choosing Change Domain Controller option and manually selecting the target machine as illustrated below.<\/p>\n
                \n
                \"Change<\/a><\/p>\n
                Change Samba4 Domain Controller<\/p>\n<\/div>\n
                \n
                \"Select<\/a><\/p>\n
                Select Samba4 Domain Controller<\/p>\n<\/div>\n
                While connected to the second\u00a0DC<\/strong>\u00a0from\u00a0Group Policy Management Console<\/strong>, you should avoid making any modification to your domain\u00a0Group Policy<\/strong>. When the first\u00a0DC\u00a0<\/strong>will become available again,\u00a0rsync command<\/strong>\u00a0will destroy all changes made on this second domain controller.<\/p>\n
                Create a Shared Directory on Samba AD DC and Map to Windows\/Linux Clients \u2013 Part 7<\/h1>\n
                This tutorial will guide you on how to create a shared directory on\u00a0Samba AD DC<\/strong>\u00a0system, map this Shared Volume to Windows clients integrated into the domain via GPO and manage share permissions from Windows domain controller perspective.<\/p>\n
                It will also cover how to access and mount the file share from a Linux machine enrolled into domain using a Samba4 domain account.<\/p>\n
                Requirements:<\/h4>\n
                  \n
                1. Create an Active Directory Infrastructure with Samba4 on Ubuntu<\/a><\/li>\n<\/ol>\n
                  Step 1: Create Samba File Share<\/h3>\n
                  1.<\/strong>\u00a0The process of creating a share on\u00a0Samba AD DC<\/strong>\u00a0is a very simple task. First create a directory you want to share via SMB protocol and add the below permissions on the filesystem in order to allow a\u00a0Windows AD DC<\/strong>admin acount to modify the share permissions accordingly to what permissions Windows clients should see.<\/p>\n
                  Assuming that the new file share on the\u00a0AD DC<\/strong>\u00a0would be the\u00a0\/nas<\/code>\u00a0directory, run the below commands to assign the correct permissions.<\/p>\n
                  # mkdir \/nas\r\n# chmod -R 775 \/nas\r\n# chown -R root:\"domain users\" \/nas\r\n# ls -alh | grep nas\r\n<\/pre>\n
                  \n
                  \"Create<\/a><\/p>\n
                  Create Samba Shared Directory<\/p>\n<\/div>\n
                  2.<\/strong>\u00a0After you\u2019ve created the directory that will be exported as a share from\u00a0Samba4 AD DC<\/strong>, you need to add the following statements to samba configuration file in order to make the share available via SMB protocol.<\/p>\n
                  # nano \/etc\/samba\/smb.conf\r\n<\/pre>\n
                  Go to the bottom of the file and add the following lines:<\/p>\n
                  [nas]\r\n\tpath = \/nas\r\n\tread only = no\r\n<\/pre>\n
                  \n
                  \"Configure<\/a><\/p>\n
                  Configure Samba Shared Directory<\/p>\n<\/div>\n
                  3.<\/strong>\u00a0The last thing you need to do is to restart\u00a0Samba AD DC<\/strong>\u00a0daemon in order to apply the changes by issuing the below command:<\/p>\n
                  # systemctl restart samba-ad-dc.service\r\n<\/pre>\n
                  Step 2: Manage Samba Share Permissions<\/h3>\n
                  4.<\/strong>\u00a0Since we\u2019re accessing this shared volume from Windows, using domain accounts (users and groups) that are created on\u00a0Samba AD DC<\/strong>\u00a0(the share is not meant to be accessed by Linux system users).<\/p>\n
                  The process of managing permissions can be done directly from\u00a0Windows Explorer<\/strong>, in the same way permissions are managed for any folder in Windows Explorer.<\/p>\n
                  First, log on to Windows machine with a\u00a0Samba4 AD<\/strong>\u00a0account with administrative privileges on the domain. In order to access the share from Windows and set the permissions, type the IP address or host name or FQDN of the Samba AD DC machine in Windows Explorer path field, preceded by two back slashes, and the share should be visible.<\/p>\n
                  \\adc1\r\nOr\r\n\\192.168.1.254\r\nOr\r\n\\adc1.tecmint.lan\r\n<\/pre>\n
                  \n
                  \"Access<\/a><\/p>\n
                  Access Samba Share Directory from Windows<\/p>\n<\/div>\n
                  5.<\/strong>\u00a0To modify permissions just right click on the share and choose\u00a0Properties<\/strong>. Navigate to\u00a0Security<\/strong>\u00a0tab and proceed with altering domain users and group permissions accordingly. Use\u00a0Advanced<\/strong>\u00a0button in order to fine tune permissions.<\/p>\n
                  \n
                  \"Configure<\/a><\/p>\n
                  Configure Samba Share Directory Permissions<\/p>\n<\/div>\n
                  Use the below screenshot as an excerpt on how to tune permissions for specific\u00a0Samba AD DC<\/strong>\u00a0authenticated accounts.<\/p>\n
                  \n
                  \"Manage<\/a><\/p>\n
                  Manage Samba Share Directory User Permissions<\/p>\n<\/div>\n
                  6.<\/strong>\u00a0Other method you can use to manage the share permissions is from\u00a0Computer Management -> Connect<\/strong>\u00a0to another computer.<\/p>\n
                  Navigate to\u00a0Shares<\/strong>, right click on the share you want to modify permissions, choose\u00a0Properties<\/strong>\u00a0and move to\u00a0Security<\/strong>\u00a0tab. From here you can alter permissions in any way you want just as presented in the previous method using file share permissions.<\/p>\n
                  \n
                  \"Connect<\/a><\/p>\n
                  Connect to Samba Share Directory Machine<\/p>\n<\/div>\n
                  \n
                  \"Manage<\/a><\/p>\n
                  Manage Samba Share Directory Properties<\/p>\n<\/div>\n
                  \n
                  \"Assign<\/a><\/p>\n
                  Assign Samba Share Directory Permissions to Users<\/p>\n<\/div>\n
                  Step 3: Map the Samba File Share via GPO<\/h3>\n
                  7.<\/strong>\u00a0To automatically mount the exported samba file share via domain\u00a0Group Policy<\/strong>, first on a machine with\u00a0RSAT tools installed<\/a>, open\u00a0AD UC<\/strong>\u00a0utility, right click on your domain name and, then, choose\u00a0New -> Shared Folder<\/strong>.<\/p>\n
                  \n
                  \"Map<\/a><\/p>\n
                  Map Samba Share Folder<\/p>\n<\/div>\n
                  8.<\/strong>\u00a0Add a name for the shared volume and enter the network path where your share is located as illustrated on the below image. Hit\u00a0OK<\/strong>\u00a0when you\u2019ve finished and the share should now be visible on the right plane.<\/p>\n
                  \n
                  \"Set<\/a><\/p>\n
                  Set Samba Shared Folder Name Location<\/p>\n<\/div>\n
                  9.<\/strong>\u00a0Next, open\u00a0Group Policy Management<\/strong>\u00a0console, expand to your domain\u00a0Default Domain Policy<\/strong>\u00a0script and open the file for editing.<\/p>\n
                  On the\u00a0GPM Editor<\/strong>\u00a0navigate to\u00a0User Configuration -> Preferences -> Windows Settings<\/strong>\u00a0and right click on\u00a0Drive Maps<\/strong>\u00a0and choose\u00a0New -> Mapped Drive<\/strong>.<\/p>\n
                  \n
                  \"Map<\/a><\/p>\n
                  Map Samba Share Folder in Windows<\/p>\n<\/div>\n
                  10.<\/strong>\u00a0On the new window search and add the network location for the share by pressing the right button with three dots, check\u00a0Reconnect<\/strong>\u00a0checkbox, add a label for this share, choose the letter for this drive and hit\u00a0OK<\/strong>\u00a0button to save and apply configuration.<\/p>\n
                  \n
                  \"Configure<\/a><\/p>\n
                  Configure Network Location for Samba Share Directory<\/p>\n<\/div>\n
                  11.<\/strong>\u00a0Finally, in order to force and apply\u00a0GPO<\/strong>\u00a0changes on your local machine without a system restart, open a\u00a0Command Prompt<\/strong>\u00a0and run the following command.<\/p>\n
                  gpupdate \/force\r\n<\/pre>\n
                  \n
                  \"Apply<\/a><\/p>\n
                  Apply GPO Changes<\/p>\n<\/div>\n
                  12.<\/strong>\u00a0After the policy has been successfully applied on your machine, open\u00a0Windows Explorer<\/strong>\u00a0and the shared network volume should be visible and accessible, depending on what permissions you\u2019ve granted for the share on previous steps.<\/p>\n
                  The share will be visible for other clients on your network after they reboot or re-login onto their systems if the group policy will not forced from command line.<\/p>\n
                  \n
                  \"Samba<\/a><\/p>\n
                  Samba Shared Network Volume on Windows<\/p>\n<\/div>\n
                  Step 4: Access the Samba Shared Volume from Linux Clients<\/h3>\n
                  13.<\/strong>\u00a0Linux users from machines that are enrolled into\u00a0Samba AD DC<\/strong>\u00a0can also access or mount the share locally by authenticating into the system with a Samba account.<\/p>\n
                  First, they need to assure that the following samba clients and utilities are installed on their systems by issuing the below command.<\/p>\n
                  $ sudo apt-get install smbclient cifs-utils\r\n<\/pre>\n
                  14.<\/strong>\u00a0In order to list the exported shares your domain provides for a specific domain controller machine use the below command:<\/p>\n
                  $ smbclient \u2013L your_domain_controller \u2013U%\r\nor\r\n$ smbclient \u2013L \\adc1 \u2013U%\r\n<\/pre>\n
                  \n
                  \"List<\/a><\/p>\n
                  List Samba Share Directory in Linux<\/p>\n<\/div>\n
                  15.<\/strong>\u00a0To interactively connect to a samba share from command line with a domain account use the following command:<\/p>\n
                  $ sudo smbclient \/\/adc\/share_name -U domain_user\r\n<\/pre>\n
                  On command line you can list the content of the share, download or upload files to the share or perform other tasks. Use ? to list all available smbclient commands.<\/p>\n
                  \n
                  \"Connect<\/a><\/p>\n
                  Connect Samba Share Directory in Linux<\/p>\n<\/div>\n
                  16.<\/strong>\u00a0To mount a samba share on a Linux machine use the below command.<\/p>\n
                  $ sudo mount \/\/adc\/share_name \/mnt -o username=domain_user\r\n<\/pre>\n
                  \n
                  \"Mount<\/a><\/p>\n
                  Mount Samba Share Directory in Linux<\/p>\n<\/div>\n
                  Replace the\u00a0host<\/strong>,\u00a0share name<\/strong>,\u00a0mount point<\/strong>\u00a0and\u00a0domain user<\/strong>\u00a0accordingly. Use mount command piped with\u00a0grep<\/strong>to filter only by cifs expression.<\/p>\n
                  As some final conclusions, shares configured on a\u00a0Samba4 AD DC<\/strong>\u00a0will work only with Windows access control lists (ACL<\/strong>), not\u00a0POSIX ACLs<\/strong>.<\/p>\n
                  Configure Samba as a Domain member with file shares in order to achieve other capabilities for a network share. Also, on an Additional Domain Controller\u00a0configure Windbindd daemon<\/a>\u00a0\u2013\u00a0Step Two<\/strong>\u00a0\u2013 before you start exporting network shares.<\/p>\n
                  Integrate Ubuntu 16.04 to AD as a Domain Member with Samba and Winbind \u2013 Part 8<\/h1>\n
                  This tutorial describes how to join an Ubuntu machine into a\u00a0Samba4 Active Directory<\/strong>\u00a0domain in order to authenticate\u00a0AD<\/strong>\u00a0accounts with local\u00a0ACL<\/strong>\u00a0for files and directories or to create and map volume shares for domain controller users (act a as file server).<\/p>\n
                  Requirements:<\/h4>\n
                    \n
                  1. Create an Active Directory Infrastructure with Samba4 on Ubuntu<\/a><\/li>\n<\/ol>\n
                    Step 1: Initial Configurations to Join Ubuntu to Samba4 AD<\/h3>\n
                    1.<\/strong>\u00a0Before starting to join an\u00a0Ubuntu<\/strong>\u00a0host into an\u00a0Active Directory DC<\/strong>\u00a0you need to assure that some services are configured properly on local machine.<\/p>\n
                    An important aspect of your machine represents the\u00a0hostname<\/strong>. Setup a proper machine name before joining the domain with the help of\u00a0hostnamectl<\/strong>\u00a0command or by manually editing\u00a0\/etc\/hostname<\/strong>\u00a0file.<\/p>\n
                    # hostnamectl set-hostname your_machine_short_name\r\n# cat \/etc\/hostname\r\n# hostnamectl\r\n<\/pre>\n
                    \n
                    \"Set<\/a><\/p>\n
                    Set System Hostname<\/p>\n<\/div>\n
                    2.<\/strong>\u00a0On the next step, open and manually edit your machine network settings with the proper IP configurations. The most important settings here are the DNS IP addresses which points back to your domain controller.<\/p>\n
                    Edit\u00a0\/etc\/network\/interfaces<\/strong>\u00a0file and add\u00a0dns-nameservers<\/strong>\u00a0statement with your proper AD IP addresses and domain name as illustrated on the below screenshot.<\/p>\n
                    Also, make sure that the same DNS IP addresses and the domain name are added to\u00a0\/etc\/resolv.conf<\/strong>\u00a0file.<\/p>\n
                    \n
                    \"Configure<\/a><\/p>\n
                    Configure Network Settings for AD<\/p>\n<\/div>\n
                    On the above screenshot,\u00a0192.168.1.254<\/strong>\u00a0and\u00a0192.168.1.253<\/strong>\u00a0are the IP addresses of the\u00a0Samba4 AD DC<\/strong>\u00a0and\u00a0Tecmint.lan<\/strong>\u00a0represents the name of the AD domain which will be queried by all machines integrated into realm.<\/p>\n
                    3.<\/strong>\u00a0Restart the network services or reboot the machine in order to apply the new network configurations. Issue a\u00a0ping<\/strong>\u00a0command against your domain name in order to test if DNS resolution is working as expected.<\/p>\n
                    The\u00a0AD DC<\/strong>\u00a0should replay with its FQDN. In case you have configured a DHCP server in your network to automatically assign IP settings for your LAN hosts, make sure you add AD DC IP addresses to the DHCP server DNS configurations.<\/p>\n
                    # systemctl restart networking.service\r\n# ping -c2 your_domain_name\r\n<\/pre>\n
                    4.<\/strong>\u00a0The last important configuration required is represented by time synchronization. Install\u00a0ntpdate<\/strong>\u00a0package, query and sync time with the\u00a0AD DC<\/strong>\u00a0by issuing the below commands.<\/p>\n
                    $ sudo apt-get install ntpdate\r\n$ sudo ntpdate -q your_domain_name\r\n$ sudo ntpdate your_domain_name\r\n<\/pre>\n
                    \n
                    \"Time<\/a><\/p>\n
                    Time Synchronization with AD<\/p>\n<\/div>\n
                    5.<\/strong>\u00a0On the next step install the software required by Ubuntu machine to be fully integrated into the domain by running the below command.<\/p>\n
                    $ sudo apt-get install samba krb5-config krb5-user winbind libpam-winbind libnss-winbind\r\n<\/pre>\n
                    \n
                    \"Install<\/a><\/p>\n
                    Install Samba4 in Ubuntu Client<\/p>\n<\/div>\n
                    While the Kerberos packages are installing you should be asked to enter the name of your default realm. Use the name of your domain with uppercases and press\u00a0Enter<\/strong>\u00a0key to continue the installation.<\/p>\n
                    \n
                    \"Add<\/a><\/p>\n
                    Add AD Domain Name<\/p>\n<\/div>\n
                    6.<\/strong>\u00a0After all packages finish installing, test\u00a0Kerberos<\/strong>\u00a0authentication against an AD administrative account and list the ticket by issuing the below commands.<\/p>\n
                    # kinit ad_admin_user\r\n# klist\r\n<\/pre>\n
                    \n
                    \"Check<\/a><\/p>\n
                    Check Kerberos Authentication with AD<\/p>\n<\/div>\n
                    Step 2: Join Ubuntu to Samba4 AD DC<\/h3>\n
                    7.<\/strong>\u00a0The first step in integrating the Ubuntu machine into the\u00a0Samba4 Active Directory<\/strong>\u00a0domain is to edit\u00a0Samba configuration file.<\/p>\n
                    Backup the default configuration file of Samba, provided by the package manager, in order to start with a clean configuration by running the following commands.<\/p>\n
                    # mv \/etc\/samba\/smb.conf \/etc\/samba\/smb.conf.initial\r\n# nano \/etc\/samba\/smb.conf\u00a0\r\n<\/pre>\n
                    On the new Samba configuration file add the below lines:<\/p>\n
                    [global]<\/strong>\r\n        workgroup = TECMINT\r\n        realm = TECMINT.LAN\r\n        netbios name = ubuntu\r\n        security = ADS\r\n        dns forwarder = 192.168.1.1\r\n\r\nidmap config * : backend = tdb        \r\nidmap config *:range = 50000-1000000\r\n\t\r\n   template homedir = \/home\/%D\/%U\r\n   template shell = \/bin\/bash\r\n   winbind use default domain = true\r\n   winbind offline logon = false\r\n   winbind nss info = rfc2307\r\n   winbind enum users = yes\r\n   winbind enum groups = yes\r\n\r\n  vfs objects = acl_xattr\r\n  map acl inherit = Yes\r\n  store dos attributes = Yes\r\n<\/pre>\n
                    \n
                    \"Configure<\/a><\/p>\n
                    Configure Samba for AD<\/p>\n<\/div>\n
                    Replace\u00a0workgroup<\/strong>,\u00a0realm<\/strong>,\u00a0netbios name<\/strong>\u00a0and\u00a0dns forwarder<\/strong>\u00a0variables with your own custom settings.<\/p>\n
                    The\u00a0winbind use default domain<\/strong>\u00a0parameter causes\u00a0winbind<\/strong>\u00a0service to treat any unqualified AD usernames as users of the AD. You should omit this parameter if you have local system accounts names which overlap AD accounts.<\/p>\n
                    8.<\/strong>\u00a0Now you should restart all samba daemons and stop and remove unnecessary services and enable samba services system-wide by issuing the below commands.<\/p>\n
                    $ sudo systemctl restart smbd nmbd winbind\r\n$ sudo systemctl stop samba-ad-dc\r\n$ sudo systemctl enable smbd nmbd winbind\r\n<\/pre>\n
                    9.<\/strong>\u00a0Join Ubuntu machine to\u00a0Samba4 AD DC<\/strong>\u00a0by issuing the following command. Use the name of an AD DC account with administrator privileges in order for the binding to realm to work as expected.<\/p>\n
                    $ sudo net ads join -U ad_admin_user\r\n<\/pre>\n
                    \n
                    \"Join<\/a><\/p>\n
                    Join Ubuntu to Samba4 AD DC<\/p>\n<\/div>\n
                    10.<\/strong>\u00a0From a\u00a0Windows machine with RSAT tools installed<\/a>\u00a0you can open\u00a0AD UC<\/strong>\u00a0and navigate to\u00a0Computers<\/strong>container. Here, your Ubuntu joined machine should be listed.<\/p>\n
                    \n
                    \"Confirm<\/a><\/p>\n
                    Confirm Ubuntu Client in Windows AD DC<\/p>\n<\/div>\n
                    Step 3: Configure AD Accounts Authentication<\/h3>\n
                    11.<\/strong>\u00a0In order to perform authentication for AD accounts on the local machine, you need to modify some services and files on the local machine.<\/p>\n
                    First, open and edit\u00a0The Name Service Switch<\/strong>\u00a0(NSS<\/strong>) configuration file.<\/p>\n
                    $ sudo nano\u00a0\/etc\/nsswitch.conf\r\n<\/pre>\n
                    Next append winbind value for passwd and group lines as illustrated on the below excerpt.<\/p>\n
                    passwd:         compat winbind\r\ngroup:          compat winbind\r\n<\/pre>\n
                    \n
                    \"Configure<\/a><\/p>\n
                    Configure AD Accounts Authentication<\/p>\n<\/div>\n
                    12.<\/strong>\u00a0In order to test if the Ubuntu machine was successfully integrated to realm run\u00a0wbinfo<\/strong>\u00a0command to list domain accounts and groups.<\/p>\n
                    $ wbinfo -u\r\n$ wbinfo -g\r\n<\/pre>\n
                    \n
                    \"List<\/a><\/p>\n
                    List AD Domain Accounts and Groups<\/p>\n<\/div>\n
                    13.<\/strong>\u00a0Also, check Winbind nsswitch module by issuing the\u00a0getent<\/strong>\u00a0command and pipe the results through a filter such as\u00a0grep<\/strong>\u00a0to narrow the output only for specific domain users or groups.<\/p>\n
                    $ sudo getent passwd| grep your_domain_user\r\n$ sudo getent group|grep 'domain admins'\r\n<\/pre>\n
                    \n
                    \"Check<\/a><\/p>\n
                    Check AD Domain Users and Groups<\/p>\n<\/div>\n
                    14.<\/strong>\u00a0In order to authenticate on Ubuntu machine with domain accounts you need to run\u00a0pam-auth-update<\/strong>command with root privileges and add all the entries required for winbind service and to automatically create home directories for each domain account at the first login.<\/p>\n
                    Check all entries by pressing\u00a0[space]<\/code>\u00a0key and hit\u00a0ok<\/strong>\u00a0to apply configuration.<\/p>\n
                    $ sudo pam-auth-update\r\n<\/pre>\n
                    \n
                    \"Authenticate<\/a><\/p>\n
                    Authenticate Ubuntu with Domain Accounts<\/p>\n<\/div>\n
                    15.<\/strong>\u00a0On Debian systems you need to manually edit\u00a0\/etc\/pam.d\/common-account<\/strong>\u00a0file and the following line in order to automatically create homes for authenticated domain users.<\/p>\n
                    session    required    pam_mkhomedir.so    skel=\/etc\/skel\/    umask=0022\r\n<\/pre>\n
                    \n
                    \"Authenticate<\/a><\/p>\n
                    Authenticate Debian with Domain Accounts<\/p>\n<\/div>\n
                    16.<\/strong>\u00a0In order for\u00a0Active Directory<\/strong>\u00a0users to be able to change password from command line in Linux open\u00a0\/etc\/pam.d\/common-password<\/strong>\u00a0file and remove the\u00a0use_authtok<\/strong>\u00a0statement from password line to finally look as on the below excerpt.<\/p>\n
                    password       [success=1 default=ignore]      pam_winbind.so try_first_pass\r\n<\/pre>\n
                    \n
                    \"Users<\/a><\/p>\n
                    Users Allowed to Change Password<\/p>\n<\/div>\n
                    17.<\/strong>\u00a0To authenticate on Ubuntu host with a Samba4 AD account use the domain username parameter after su \u2013 command. Run id command to get extra info about the AD account.<\/p>\n
                    $ su - your_ad_user\r\n<\/pre>\n
                    \n
                    \"Find<\/a><\/p>\n
                    Find AD User Information<\/p>\n<\/div>\n
                    Use\u00a0pwd command<\/a>\u00a0to see your domain user current directory and passwd command if you want to change password.<\/p>\n
                    18.<\/strong>\u00a0To use a domain account with root privileges on your Ubuntu machine, you need to add the AD username to the sudo system group by issuing the below command:<\/p>\n
                    $ sudo usermod -aG sudo your_domain_user\r\n<\/pre>\n
                    Login to Ubuntu with the domain account and update your system by running\u00a0apt-get update<\/strong>\u00a0command to check if the domain user has root privileges.<\/p>\n
                    \n
                    \"Add<\/a><\/p>\n
                    Add Sudo User Root Group<\/p>\n<\/div>\n
                    19.<\/strong>\u00a0To add root privileges for a domain group, open end edit\u00a0\/etc\/sudoers<\/strong>\u00a0file using\u00a0visudo<\/strong>\u00a0command and add the following line as illustrated on the below screenshot.<\/p>\n
                    %YOUR_DOMAIN\\your_domain\\  group       \t\t ALL=(ALL:ALL) ALL\r\n<\/pre>\n
                    \n
                    \"Add<\/a><\/p>\n
                    Add Root Privileges to Domain Group<\/p>\n<\/div>\n
                    Use backslashes to escape spaces contained into your domain group name or to escape the first backslash. In the above example the domain group for\u00a0TECMINT<\/strong>\u00a0realm is named \u201cdomain admins<\/strong>\u201d.<\/p>\n
                    The preceding percent sign\u00a0(%)<\/code>\u00a0symbol indicates that we are referring to a group, not a username.<\/p>\n
                    20.<\/strong>\u00a0In case you are running the graphical version of Ubuntu and you want to login on the system with a domain user, you need to modify LightDM display manager by editing\u00a0\/usr\/share\/lightdm\/lightdm.conf.d\/50-ubuntu.conf<\/strong>\u00a0file, add the following lines and reboot the machine to reflect changes.<\/p>\n
                    greeter-show-manual-login=true\r\ngreeter-hide-users=true\r\n<\/pre>\n
                    It should now be able to perform logins on Ubuntu Desktop with a domain account using either\u00a0your_domain_username<\/strong>\u00a0or\u00a0your_domain_username@your_domain.tld<\/strong>\u00a0or\u00a0your_domain\\your_domain_username<\/strong>format.<\/p>\n
                    Join CentOS 7 Desktop to Samba4 AD as a Domain Member \u2013 Part 9<\/h1>\n
                    This guide will describe how you can integrate\u00a0CentOS 7 Desktop<\/strong>\u00a0to\u00a0Samba4 Active Directory Domain Controller<\/strong>\u00a0with\u00a0Authconfig-gtk<\/strong>\u00a0in order to authenticate users across your network infrastructure from a single centralized account database held by\u00a0Samba.<\/p>\n
                    Requirements<\/h4>\n
                      \n
                    1. Create an Active Directory Infrastructure with Samba4 on Ubuntu<\/a><\/li>\n
                    2. CentOS 7.3 Installation Guide<\/a><\/li>\n<\/ol>\n
                      Step 1: Configure CentOS Network for Samba4 AD DC<\/h3>\n
                      1.<\/strong>\u00a0Before starting to join\u00a0CentOS 7 Desktop<\/strong>\u00a0to a\u00a0Samba4<\/strong>\u00a0domain you need to assure that the network is properly setup to query domain via DNS service.<\/p>\n
                      Open\u00a0Network Settings<\/strong>\u00a0and\u00a0turn off<\/strong>\u00a0the Wired network interface if enabled. Hit on the lower\u00a0Settings<\/strong>\u00a0button as illustrated in the below screenshots and manually edit your network settings, especially the\u00a0DNS\u00a0IPs that points to your\u00a0Samba4 AD DC.<\/p>\n
                      When you finish, Apply\u00a0the configurations and turn on your Network Wired Card.<\/p>\n
                      \n
                      \"Network<\/a><\/p>\n
                      Network Settings<\/p>\n<\/div>\n
                      \n
                      \"Configure<\/a><\/p>\n
                      Configure Network<\/p>\n<\/div>\n
                      2.<\/strong>\u00a0Next, open your network interface configuration file and add a line at the end of file with the name of your domain. This line assures that the domain counterpart is automatically appended by DNS resolution (FQDN) when you use only a short name for a domain DNS record.<\/p>\n
                      $ sudo vi \/etc\/sysconfig\/network-scripts\/ifcfg-eno16777736\r\n<\/pre>\n
                      Add the following line:<\/p>\n
                      SEARCH=\"your_domain_name\"\r\n<\/pre>\n
                      \n
                      \"Network<\/a><\/p>\n
                      Network Interface Configuration<\/p>\n<\/div>\n
                      3.<\/strong>\u00a0Finally, restart the network services to reflect changes, verify if the resolver configuration file is correctly configured and issue a series of\u00a0ping<\/strong>\u00a0commands against your DCs short names and against your domain name in order to verify if DNS resolution is working.<\/p>\n
                      $ sudo systemctl restart network\r\n$ cat \/etc\/resolv.conf\r\n$ ping -c1 adc1\r\n$ ping -c1 adc2\r\n$ ping tecmint.lan\r\n<\/pre>\n
                      \n
                      \"Verify<\/a><\/p>\n
                      Verify Network Configuration<\/p>\n<\/div>\n
                      4.<\/strong>\u00a0Also, configure your machine\u00a0hostname and reboot the machine to properly apply the settings by issuing the following commands:<\/p>\n
                      $ sudo hostnamectl set-hostname your_hostname\r\n$ sudo init 6\r\n<\/pre>\n
                      Verify if hostname was correctly applied with the below commands:<\/p>\n
                      $ cat \/etc\/hostname\r\n$ hostname\r\n<\/pre>\n
                      5.<\/strong>\u00a0The last setting will ensure that your system time is in sync with\u00a0Samba4 AD DC<\/strong>\u00a0by issuing the below commands:<\/p>\n
                      $ sudo yum install ntpdate\r\n$ sudo ntpdate -ud domain.tld\r\n<\/pre>\n
                      Step 2: Install Required Software to Join Samba4 AD DC<\/h3>\n
                      6.<\/strong>\u00a0In order to integrate CentOS 7 to an Active Directory domain install the following packages from command line:<\/p>\n
                      $ sudo yum install samba samba samba-winbind krb5-workstation\r\n<\/pre>\n
                      7.<\/strong>\u00a0Finally, install the graphical interface software used for domain integration provided by CentOS repos:\u00a0Authconfig-gtk<\/strong>.<\/p>\n
                      $ sudo yum install authconfig-gtk\r\n<\/pre>\n
                      Step 3: Join CentOS 7 Desktop to Samba4 AD DC<\/h3>\n
                      8.<\/strong>\u00a0The process of joining CentOS to a domain controller is very straightforward. From command line open\u00a0Authconfig-gtk<\/strong>\u00a0program with root privileges and make the following changes as described below:<\/p>\n
                      $ sudo authconfig-gtk\r\n<\/pre>\n
                      On\u00a0Identity & Authentication<\/strong>\u00a0tab.<\/p>\n