From f95fb5fe3941a0ef916ac85c6ccf4aecf17aaf39 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Thu, 19 Apr 2001 21:33:44 +0000 Subject: large sync up with 2.2 (This used to be commit 96523293da19df201703fed6130f1ff9ba25324b) --- docs/htmldocs/DOMAIN_MEMBER.html | 63 +++++++++++++++++++++++++++++++++++----- 1 file changed, 56 insertions(+), 7 deletions(-) (limited to 'docs/htmldocs/DOMAIN_MEMBER.html') diff --git a/docs/htmldocs/DOMAIN_MEMBER.html b/docs/htmldocs/DOMAIN_MEMBER.html index 6ae8e7a49d..051b72f8d0 100644 --- a/docs/htmldocs/DOMAIN_MEMBER.html +++ b/docs/htmldocs/DOMAIN_MEMBER.html @@ -1,7 +1,7 @@ security = domain in Samba 2.x

security = domain in Samba 2.x

Joining an NT Domain with Samba 2.2

smbpasswd(8) man page for more details.

There is existing development code to join a domain + without having to create the machine trust account on the PDC + beforehand. This code will hopefully be available soon + in release branches as well.

This command goes through the machine account password change protocol, then writes the new (random) machine account password for this Samba server into a file in the same directory @@ -104,11 +118,11 @@ CLASS="REPLACEABLE" ><NT DOMAIN NAME>. - .<Samba Server Name><Samba + Server Name>.mac

Samba and Windows 2000 Domains

Many people have asked regarding the state of Samba's ability to participate in +a Windows 2000 Domain. Samba 2.2 is able to act as a member server of a Windows +2000 domain operating in mixed or native mode.

There is much confusion between the circumstances that require a "mixed" mode +Win2k DC and a when this host can be switched to "native" mode. A "mixed" mode +Win2k domain controller is only needed if Windows NT BDCs must exist in the same +domain. By default, a Win2k DC in "native" mode will still support +NetBIOS and NTLMv1 for authentication of legacy clients such as Windows 9x and +NT 4.0. Samba has the same requirements as a Windows NT 4.0 member server.

The steps for adding a Samba 2.2 host to a Win2k domain are the same as those +for adding a Samba server to a Windows NT 4.0 domain. The only exception is that +the "Server Manager" from NT 4 has been replaced by the "Active Directory Users and +Computers" MMC (Microsoft Management Console) plugin.

Why is this better than security = server?

security = server, @@ -264,6 +303,16 @@ TARGET="_top" NT server in the same way as a Windows 95 or Windows 98 server would.

Please refer to the Winbind + paper for information on a system to automatically + assign UNIX uids and gids to Windows NT Domain users and groups. + This code is available in development branches only at the moment, + but will be moved to release branches soon.

The advantage to domain-level security is that the authentication in domain-level security is passed down the authenticated RPC channel in exactly the same way that an NT server would do it. This -- cgit