Maintaining Unix Attributes in AD using ADUC: Difference between revisions
m (changed the wording a little bit) |
|||
Line 52: | Line 52: | ||
= Setting attributes on a computer account = |
= Setting attributes on a computer account = |
||
You need to set uidNumber to access shares with the Windows machine network account. |
You need to set the uidNumber attribute to access samba shares on a domain with the Windows machine network account. |
||
* Open ADUC. |
* Open ADUC. |
Revision as of 00:57, 22 November 2017
Introduction
In the following we describe how to set/edit the RFC2307 attributes used by idmap_ad. This requires to have NIS extensions installed in your AD and RFC2307 enabled in each DCs smb.conf. Install the Remote Server Administration Tools (RSAT), if not already installed and enable the advanced view ("View" / "Advanced features"). Modifications on user and group objects will be done by the Domain Administrator, if you haven't set any delegations.
ADUC, running on Windows 10 and Windows Server 2016, no longer displays the "Unix Attributes" tab in user or group properties. For details, see Missing Unix Attributes tab in ADUC on Windows 10 and Windows Server 2016. |
Setting attributes on an user account
- Open ADUC.
- Right-click to a user account and choose properties.
- Navigate to the "UNIX Attributes" tab.
- Note: If you don't see this tab, you haven't installed the RSAT function "Server for NIS Tools".
- The other fields are not enabled until the "NIS Domain" is chosen. Fill the values as required.
- Hint: You can only choose a primary group that has had Unix attributes defined!
- Click "OK" to save your changes.
Setting attributes on a group
- Open ADUC.
- Right-click to a group and choose properties.
- Navigate to the "UNIX Attributes" tab.
- Note: If the tab isn't visible, you haven't installed the RSAT function "Server for NIS Tools".
- The other fields are not enabled until the "NIS Domain" is chosen, fill the values as required.
- Hint: It's not required to add users to the group in this tab! Winbind retrieves the account membership from the Windows groups (see "Member Of"-tab).
- Click "OK" to save your changes.
Setting attributes on a computer account
You need to set the uidNumber attribute to access samba shares on a domain with the Windows machine network account.
- Open ADUC.
- Right-click to a computer account and choose properties.
- Navigate to the "Attribute Editor" tab.
- Note: If you don't see this tab, you haven't installed the RSAT function "Server for NIS Tools".
- Scroll down to the "uidNumber" attribute, select it, click edit, enter a value, click "OK"
- Note: Ensure that you enter a unique value.
- Click "OK" to save your changes.
Defining the next UID/GID to use
Every time a UID/GID is assigned using Active Directory Users and Computers (ADUC), the next UID/GID is stored inside the Active Directory. By default, ADUC starts assigning UIDs and GIDs at 10000
If you setup a new Samba AD and want to use a different start value, you will need to add the counting attributes before using ADUC for the first time:
# ldbedit -H /usr/local/samba/private/sam.ldb -b \ CN=samdom,CN=ypservers,CN=ypServ30,CN=RpcServices,CN=System,DC=samdom,DC=example,DC=com
msSFU30MaxUidNumber: 10000 msSFU30MaxGidNumber: 10000
With the same command you can change the values. E. g. if you require to start UIDs at 20000 and GIDs at 50000, adapt the values to your requirements:
msSFU30MaxUidNumber: 20000 msSFU30MaxGidNumber: 50000