Background

Author's Note : This document is a combination of David Bannon's Samba 2.2 PDC HOWTO and the Samba NT Domain FAQ. Both documents are superceeded by this one.

Version of Samba prior to release 2.2 had marginal capabilities to act as a Windows NT 4.0 Primary Domain Controller (PDC). The following functionality should work in 2.2.0:

• domain logons for Windows NT 4.0/2000 clients

• placing a Windows 9x client in user level security

• retrieving a list of users and groups from a Samba PDC to Windows 9x/NT/2000 clients

• roving user profiles

• Windows NT 4.0 style system policies

The following pieces of functionality are not included in the 2.2 release:

• Windows NT 4 domain trusts

• Sam replication with Windows NT 4.0 Domain Controllers (i.e. a Samba PDC and a Windows NT BDC or vice versa)

• Adding users via the User Manager for Domains

• Acting as a Windows 2000 Domain Controller (i.e. Kerberos and Active Directory)

Please note that Windows 9x clients are not true members of a domain for reasons outlined in this article. Therefore the protocol for support Windows 9x style domain logons is completely different from NT4 domain logons and has been officially supported for some time.

Beginning with Samba 2.2.0, we are proud to announce official support for Windows NT 4.0 style domain logons from Windows NT 4.0 and Windows 2000 (including SP1) clients. This article outlines the steps necessary for configuring Samba as a PDC. Note that it is necessary to have a working Samba server prior to implementing the PDC functionality. If you have not followed the steps outlined in UNIX_INSTALL.html, please make sure that your server is configured correctly before proceeding. Another good resource in the smb.conf(5) man page.

Implementing a Samba PDC can basically be divided into 2 broad steps.

1. Configuring the Samba Domain Controller

2. Creating machine trust accounts and joining clients to the domain

There are other minor details such as user profiles, system policies, etc... However, these are not necessarily specific to a Samba PDC as much as they are related to Windows NT networking concepts. They will be mentioned only briefly here.

Configuring the Samba Domain Controller

The first step in creating a working Samba PDC is to understand the parameters necessary in smb.conf. I will not attempt to re-explain the parameters here as they are more that adequately covered in the smb.conf man page. For convenience, the parameters have been linked with the actual smb.conf description.

Here is an example smb.conf for acting as a PDC:

[global]
    ; Basic server settings
    netbios name = POGO
    workgroup = NARNIA

    ; we should act as the domain and local master browser
    os level = 64
    preferred master = yes
    domain master = yes
    local master = yes
    
    ; security settings (must user security = user)
    security = user
    
    ; encrypted passwords are a requirement for a PDC
    encrypt passwords = yes
    
    ; support domain logons
    domain logons = yes
    
    ; where to store user profiles?
    logon path = \\%N\profiles\%u
    
    ; where is a user's home directory and where should it
    ; be mounted at?
    logon drive = H:
    logon home = \\homeserver\%u
    
    ; specify a generic logon script for all users
    ; this is a relative path to the [netlogon] share
    logon script = logon.cmd

; necessary share for domain controller
[netlogon]
    path = /usr/local/samba/lib/netlogon
    writeable = no
    write list = ntadmin
    
; share for storing user profiles
[profiles]
    path = /export/smb/ntprofile
    writeable = yes
    create mask = 0600
    directory mask = 0700

There are a couple of points to emphasize in the above configuration.

• encrypted passwords must be enabled. For more details on how to do this, refer to ENCRYPTION.html.

• The server must support domain logons and a [netlogon] share

• The server must be the domain master browser in order for Windows client to locate the server as a DC.

As Samba 2.2 does not offer a complete implementation of group mapping between Windows NT groups and UNIX groups (this is really quite complicated to explain in a short space), you should refer to the domain admin users and domain admin group smb.conf parameters for information of creating a Domain Admins style accounts.

Creating Machine Trust Accounts and Joining Clients to the Domain

First you must understand what a machine trust account is and what it is used for.

A machine trust account is a user account owned by a computer. The account password acts as the shared secret for secure communication with the Domain Controller. Hence the reason that a Windows 9x host is never a true member of a domain because it does not posses a machine trust account and thus has no shared secret with the DC.

On a Windows NT PDC, these machine trust account passwords are stored in the registry. A Samba PDC stores these accounts in he same location as user LanMan and NT password hashes (currently smbpasswd). However, machine trust accounts only possess the NT password hash.

There are two means of creating machine trust accounts.

• Manual creation before joining the client to the domain. In this case, the password is set to a known value -- the lower case of the machine's netbios name.

• Creation of the account at the time of joining the domain. In this case, the session key of the administrative account used to join the client to the domain acts as an encryption key for setting the password to a random value.

Because Samba requires machine accounts to possess a UNIX uid from which an Windows NT SID can be generated, all of these accounts will have an entry in /etc/passwd and smbpasswd. Future releases will alleviate the need to create /etc/passwd entries.

The /etc/passwd entry will list the machine name with a $ appended, won't have a passwd, will have a null shell and no home directory. For example a machine called 'doppy' would have an /etc/passwd entry like this :

doppy$:x:505:501:NTMachine:/dev/null:/bin/false

If you are manually creating the machine accounts, it is necessary to add the /etc/passwd (or NIS passwd map) entry prior to adding the smbpasswd entry. The following command will create a new machine account ready for use.

root# smbpasswd -a -m machine_name

where machine_name is the machine's netbios name.

If you manually create a machine account, immediately join the client to the domain. An open account like this can allow intruders to gain access to user account information in your domain.

The second way of creating machine trust accounts is to add them on the fly at the time the client is joined to the domain. You will need to include a value for the add user script parameter. Below is an example I use on a RedHat 6.2 Linux system.

add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u 

In Samba 2.2.0, only the root account can be used to create machine accounts on the fly like this. Therefore, it is required to create an entry in smbpasswd for root. The password SHOULD be set to s different password that the associated /etc/passwd entry for security reasons.

Common Problems and Errors

I cannot include a '$' in a machine name.

A 'machine name' in (typically) /etc/passwd of the machine name with a '$' appended. FreeBSD (and other BSD systems ?) won't create a user with a '$' in their name.

The problem is only in the program used to make the entry, once made, it works perfectly. So create a user without the '$' and use vipw to edit the entry, adding the '$'. Or create the whole entry with vipw if you like, make sure you use a unique uid !

I get told "You already have a connection to the Domain...." when creating a machine account.

This happens if you try to create a machine account from the machine itself and use a user name that does not work (for whatever reason) and then try another (possibly valid) user name. Exit out of the network applet to close the initial connection and try again.

Further, if the machine is a already a 'member of a workgroup' that is the same name as the domain you are joining (bad idea) you will get this message. Change the workgroup name to something else, it does not matter what, reboot, and try again.

I get told "Cannot join domain, the credentials supplied conflict with an existing set.."

This is the same basic problem as mentioned above, "You already have a connection..."

"The system can not log you on (C000019B)...."

I joined the domain successfully but after upgrading to a newer version of the Samba code I get the message, "The system can not log you on (C000019B), Please try a gain or consult your system administrator" when attempting to logon.

This occurs when the domain SID stored in private/WORKGROUP.SID is changed. For example, you remove the file and smbd automatically creates a new one. Or you are swapping back and forth between versions 2.0.7, TNG and the HEAD branch code (not recommended). The only way to correct the problem is to restore the original domain SID or remove the domain client from the domain and rejoin.

"The machine account for this computer either does not exist or is not accessible."

When I try to join the domain I get the message "The machine account for this computer either does not exist or is not accessible". Whats wrong ?

This problem is caused by the PDC not having a suitable machine account. If you are using the add user script = method to create accounts then this would indicate that it has not worked. Ensure the domain admin user system is working.

Alternatively if you are creating account entries manually then they have not been created correctly. Make sure that you have the entry correct for the machine account in smbpasswd file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, make sure that the account name is the machine netbios name with a '$' appended to it ( ie. computer_name$ ). There must be an entry in both /etc/passwd and the smbpasswd file. Some people have reported that inconsistent subnet masks between the Samba server and the NT client have caused this problem. Make sure that these are consistent for both client and server.

System Policies and Profiles

Much of the information necessary to implement System Policies and Roving User Profiles in a Samba domain is the same as that for implementing these same items in a Windows NT 4.0 domain. You should read the white paper Implementing Profiles and Policies in Windows NT 4.0 available from Microsoft.

Here are some additional details:

What about Windows NT Policy Editor ?

To create or edit ntconfig.pol you must use the NT Server Policy Editor, poledit.exe which is included with NT Server but not NT Workstation. There is a Policy Editor on a NTws but it is not suitable for creating Domain Policies. Further, although the Windows 95 Policy Editor can be installed on an NT Workstation/Server, it will not work with NT policies because the registry key that are set by the policy templates. However, the files from the NT Server will run happily enough on an NTws. You need poledit.exe, common.adm and winnt.adm. It is convenient to put the two *.adm files in c:\winnt\inf which is where the binary will look for them unless told otherwise. Note also that that directory is 'hidden'.

The Windows NT policy editor is also included with the Service Pack 3 (and later) for Windows NT 4.0. Extract the files using servicepackname /x, ie thats Nt4sp6ai.exe /x for service pack 6a. The policy editor, poledit.exe and the associated template files (*.adm) should be extracted as well. It is also possible to downloaded the policy template files for Office97 and get a copy of the policy editor. Another possible location is with the Zero Administration Kit available for download from Microsoft.

Can Win95 do Policies ?

Install the group policy handler for Win9x to pick up group policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. Install group policies on a Win9x client by double-clicking grouppol.inf. Log off and on again a couple of times and see if Win98 picks up group policies. Unfortunately this needs to be done on every Win9x machine that uses group policies....

If group policies don't work one reports suggests getting the updated (read: working) grouppol.dll for Windows 9x. The group list is grabbed from /etc/group.

How do I get 'User Manager' and 'Server Manager'

Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for Domains', the 'Server Manager' ?

Microsoft distributes a version of these tools called nexus for installation on Windows 95 systems. The tools set includes

• Server Manager

• User Manager for Domains

• Event Viewer

Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE

The Windows NT 4.0 version of the 'User Manager for Domains' and 'Server Manager' are available from Microsoft via ftp from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE

What other help can I get ?

There are many sources of information available in the form of mailing lists, RFC's and documentation. The docs that come with the samba distribution contain very good explanations of general SMB topics such as browsing.

What are some diagnostics tools I can use to debug the domain logon process and where can I find them?

One of the best diagnostic tools for debugging problems is Samba itself. You can use the -d option for both smbd and nmbd to specifiy what 'debug level' at which to run. See the man pages on smbd, nmbd and smb.conf for more information on debugging options. The debug level can range from 1 (the default) to 10 (100 for debugging passwords).

Another helpful method of debugging is to compile samba using the gcc -g flag. This will include debug information in the binaries and allow you to attach gdb to the running smbd / nmbd process. In order to attach gdb to an smbd process for an NT workstation, first get the workstation to make the connection. Pressing ctrl-alt-delete and going down to the domain box is sufficient (at least, on the first time you join the domain) to generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation maintains an open connection, and therefore there will be an smbd process running (assuming that you haven't set a really short smbd idle timeout) So, in between pressing ctrl alt delete, and actually typing in your password, you can gdb attach and continue.

Some useful samba commands worth investigating:

• testparam | more

• smbclient -L //{netbios name of server}

An SMB enabled version of tcpdump is available from http://www.tcpdup.org/. Ethereal, another good packet sniffer for UNIX and Win32 hosts, can be downloaded from http://www.ethereal.com.

For tracing things on the Microsoft Windows NT, Network Monitor (aka. netmon) is available on the Microsoft Developer Network CD's, the Windows NT Server install CD and the SMS CD's. The version of netmon that ships with SMS allows for dumping packets between any two computers (ie. placing the network interface in promiscuous mode). The version on the NT Server install CD will only allow monitoring of network traffic directed to the local NT box and broadcasts on the local subnet. Be aware that Ethereal can read and write netmon formatted files.

How do I install 'Network Monitor' on an NT Workstation or a Windows 9x box?

Installing netmon on an NT workstation requires a couple of steps. The following are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server 4.0, on Microsoft Windows NT Workstation 4.0. The process should be similar for other version of Windows NT / Netmon. You will need both the Microsoft Windows NT Server 4.0 Install CD and the Workstation 4.0 Install CD.

Initially you will need to install 'Network Monitor Tools and Agent' on the NT Server. To do this

• Goto Start - Settings - Control Panel - Network - Services - Add

• Select the 'Network Monitor Tools and Agent' and click on 'OK'.

• Click 'OK' on the Network Control Panel.

• Insert the Windows NT Server 4.0 install CD when prompted.

At this point the Netmon files should exist in %SYSTEMROOT%\System32\netmon\*.*. Two subdirectories exist as well, parsers\ which contains the necessary DLL's for parsing the netmon packet dump, and captures\.

In order to install the Netmon tools on an NT Workstation, you will first need to install the 'Network Monitor Agent' from the Workstation install CD.

• Goto Start - Settings - Control Panel - Network - Services - Add

• Select the 'Network Monitor Agent' and click on 'OK'.

• Click 'OK' on the Network Control Panel.

• Insert the Windows NT Workstation 4.0 install CD when prompted.

Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set permissions as you deem appropriate for your site. You will need administrative rights on the NT box to run netmon.

To install Netmon on a Windows 9x box install the network monitor agent from the Windows 9x CD (\admin\nettools\netmon). There is a readme file located with the netmon driver files on the CD if you need information on how to do this. Copy the files from a working Netmon installation.

DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba

This appendix was originally authored by John H Terpstra of the Samba Team and is included here for posterity.

NOTE : The term "Domain Controller" and those related to it refer to one specific method of authentication that can underly an SMB domain. Domain Controllers prior to Windows NT Server 3.1 were sold by various companies and based on private extensions to the LAN Manager 2.1 protocol. Windows NT introduced Microsoft-specific ways of distributing the user authentication database. See DOMAIN.txt for examples of how Samba can participate in or create SMB domains based on shared authentication database schemes other than the Windows NT SAM.

Windows NT Server can be installed as either a plain file and print server (WORKGROUP workstation or server) or as a server that participates in Domain Control (DOMAIN member, Primary Domain controller or Backup Domain controller).

The same is true for OS/2 Warp Server, Digital Pathworks and other similar products, all of which can participate in Domain Control along with Windows NT. However only those servers which have licensed Windows NT code in them can be a primary Domain Controller (eg Windows NT Server, Advanced Server for Unix.)

To many people these terms can be confusing, so let's try to clear the air.

Every Windows NT system (workstation or server) has a registry database. The registry contains entries that describe the initialization information for all services (the equivalent of Unix Daemons) that run within the Windows NT environment. The registry also contains entries that tell application software where to find dynamically loadable libraries that they depend upon. In fact, the registry contains entries that describes everything that anything may need to know to interact with the rest of the system.

The registry files can be located on any Windows NT machine by opening a command prompt and typing:

C:\WINNT\> dir %SystemRoot%\System32\config

The environment variable %SystemRoot% value can be obtained by typing:

C:\WINNT>echo %SystemRoot%

The active parts of the registry that you may want to be familiar with are the files called: default, system, software, sam and security.

In a domain environment, Microsoft Windows NT domain controllers participate in replication of the SAM and SECURITY files so that all controllers within the domain have an exactly identical copy of each.

The Microsoft Windows NT system is structured within a security model that says that all applications and services must authenticate themselves before they can obtain permission from the security manager to do what they set out to do.

The Windows NT User database also resides within the registry. This part of the registry contains the user's security identifier, home directory, group memberships, desktop profile, and so on.

Every Windows NT system (workstation as well as server) will have its own registry. Windows NT Servers that participate in Domain Security control have a database that they share in common - thus they do NOT own an independent full registry database of their own, as do Workstations and plain Servers.

The User database is called the SAM (Security Access Manager) database and is used for all user authentication as well as for authentication of inter- process authentication (ie: to ensure that the service action a user has requested is permitted within the limits of that user's privileges).

The Samba team have produced a utility that can dump the Windows NT SAM into smbpasswd format: see ENCRYPTION.txt for information on smbpasswd and /pub/samba/pwdump on your nearest Samba mirror for the utility. This facility is useful but cannot be easily used to implement SAM replication to Samba systems.

Windows for Workgroups, Windows 95, and Windows NT Workstations and Servers can participate in a Domain security system that is controlled by Windows NT servers that have been correctly configured. At most every domain will have ONE Primary Domain Controller (PDC). It is desirable that each domain will have at least one Backup Domain Controller (BDC).

The PDC and BDCs then participate in replication of the SAM database so that each Domain Controlling participant will have an up to date SAM component within its registry.