Joining a Samba DC to an Existing Active Directory

Samba4 joining a domain as a DC

As of Samba4 alpha11, Samba4 now has the ability to join an existing Active Directory domain as an additional domain controller. The process of joining a Samba4 server to an existing domain is a bit different to provisioning a new domain. This process is the equivalent of the 'dcpromo' command on Windows servers.

This HOWTO will assume you configured and installed Samba in the default location of /usr/local/samba. It assumes you are joining Samba to an existing domain called 'samba.example.com'.

Getting ready for joining Samba as a DC to an exiting domain

You need to build Samba4 as usual, but don't do the provision step. You should remove any existing smb.conf in /usr/local/samba/etc/smb.conf

You should have your Windows domain setup correctly as your default realm in /etc/krb5.conf, and you should have these options setup in /etc/krb5.conf:

[libdefaults]
 dns_lookup_realm = true
 dns_lookup_kdc = true
 default_realm = SAMBA.EXAMPLE.COM

You should then test to make sure that DNS and kerberos are setup correctly to point at your existing Windows DC. Test that it is all working by trying a kinit as a domain administration:

kinit administrator
Password: XXXXXXXX

Once all that is setup you can move on to the main domain join step

Joining the Windows domain as a DC

Run the following command as root:

bin/net vampire samba.example.com -Uadministrator --realm=samba.example.com

It should show a set of debug messages about replicating the domain contents, like this:

Partition[CN=Configuration,DC=sample,DC=example,DC=com] objects[1596] linked_values[1]

then it will show a message like this:

mark ROOTDSE with isSynchronized=TRUE
Vampired domain VSOFS8 (S-1-5-21-2848215498-2472035911-1947525656)

at this point you have joined your Samba4 server to the Windows domain.