Introduction

Running one domain controller (DC) is sufficient for a working Active Directory (AD) forest. However, for failover and load balancing reasons, you should add further DCs to your AD forest. Joining an additional Samba DC to an existing AD differs from provisioning the first DC in a forest. If you set up a new AD forest, see Set up a Samba Active Directory Domain Controller.

An NT4 domain uses only one Primary Domain Controller (PDC) and optionally additional Backup Domain Controllers (BDC). In an AD forest, there is no difference between DCs, beside the FSMO roles. Use only the term "domain controller" or "DC" when you talk about AD to avoid any possibility of confusion.

Preconditions

Use a static IP address.

Verify that the host name in /etc/resolv.conf resolves to the network IP and not to 127.0.0.1 (localhost).

127.0.0.1     localhost.localdomain      localhost     DC2.samdom.example.com     DC2
10.99.0.2     DC2.samdom.example.com     DC2

If you run a Samba on this host before, it is recommended to:

remove the existing smb.conf file. To list the path to the file:

# smbd -b | grep "CONFIGFILE"
   CONFIGFILE: /usr/local/samba/etc/samba/smb.conf

remove all Samba database files, such as *.tdb and *.ldb files. To list the folders containing Samba databases:

## smbd -b | egrep "LOCKDIR|STATEDIR|CACHEDIR|PRIVATE_DIR"
  LOCKDIR: /usr/local/samba/var/lock/
  STATEDIR: /usr/local/samba/var/locks/
  CACHEDIR: /usr/local/samba/var/cache/
  PRIVATE_DIR: /usr/local/samba/private/

Starting with a clean environment helps you to prevent confusion and and no files from your previous Samba installation are mixed with your new domain controller (DC) installation.

When joining a Windows Active Directory (AD), run the following tests on a Windows computer in the domain:

Verify that the forest functional level meets the Samba requirements:

> dsquery * "CN=Partitions,CN=Configuration,DC=samdom,DC=example,DC=com" -scope base -attr msDS-Behavior-Version
  msDS-Behavior-Version
  4

Minimum suported level: 2003 native (level 2)

Maximum suported level: 2008 R2 (level 4)

Downgrade the forest functional level to 2008 R2, if you are joining an AD with a higher level.

Verify that the directory schema meets the Samba requirements:

> dsquery * "CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com" -Scope Base -attr objectVersion
  objectVersion
  69

Samba <= 4.4: Maximum supported forest schema: 47 (Server 2008 R2)

Samba >= 4.5: Maximum supported forest schema: 69 (Server 2012 R2)

Installation

To install Samba:

Build Samba From Source

Distribution-specific Package Installation

Not all distributions currently provide packages with Active Directory (AD) domain controller (DC) support. For example, some distributions, such as Red Hat Enterprise Linux and Fedora, are based on MIT Kerberos, which is currently not supported by Samba. In this situation, compile Samba yourself or use packages with AD DC support.

SerNet Samba+ or Enterprise packages

Paths

If you built Samba yourself using the default directories, add the directories at the beginning of your $PATH variable:

export PATH=/usr/local/samba/bin/:/usr/local/samba/sbin/:$PATH

For information how to set the path variable permanently, see your distribution's documentation.

Preparing the Host for Joining the Domain

Local DNS server

By default, the first Domain Controller (DC) in a forest runs a DNS server for Active Directory (AD)-based zones. For failover reasons it is recommended to run multiple DCs acting as a DNS server in a network. If you consider providing a DNS service on the new DC:

For the BIND9_DLZ back end, see BIND9_DLZ DNS Back End. Finish this task before you start the Samba DC service.
For the internal DNS no further actions are required.

DNS Resolving

AD uses DNS in the background, such as locating other DCs and services. Thus configure your host to use a DNS server that is able to resolve the AD DNS zones.

Set the DNS server IP and AD DNS domain in your /etc/resolv.conf. For example:

nameserver 10.99.0.1
search samdom.example.com

Some utilities, such as NetworkManager can overwrite manual changes in that file. Consult your distribution's documentation for information about how to configure name resolution permanently.

To verify the DNS settings, try resolving the host name of one of your existing Domain Controllers. For example:

# host -t A DC1.samdom.example.com
DC1.samdom.example.com has address 10.99.0.1

Kerberos

Set the following settings in your Kerberos client configuration file /etc/krb5.conf:

[libdefaults]
    dns_lookup_realm = false
    dns_lookup_kdc = true
    default_realm = SAMDOM.EXAMPLE.COM

To verify the settings use the kinit command to request a Kerberos ticket for the domain administrator:

# kinit administrator
Password for administrator@SAMDOM.EXAMPLE.COM:

To list Kerberos tickets:

# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator@SAMDOM.EXAMPLE.COM

Valid starting       Expires              Service principal
24.09.2015 19:56:55  25.09.2015 05:56:55  krbtgt/SAMDOM.EXAMPLE.COM@SAMDOM.EXAMPLE.COM
	renew until 25.09.2015 19:56:53

Joining the Active Directory as a Domain Controller

To join the domain samdom.example.com as a domain controller (DC) that additionally acts as a DNS server using the Samba internal DNS:

# samba-tool domain join samdom.example.com DC -U"SAMDOM\administrator" --dns-backend=SAMBA_INTERNAL
Finding a writeable DC for domain 'samdom.example.com'
Found DC dc1.samdom.example.com
Password for [SAMDOM\administrator]:
workgroup is SAMDOM
realm is samdom.example.com
Adding CN=DC2,OU=Domain Controllers,DC=samdom,DC=example,DC=com
Adding CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samdom,DC=example,DC=com
Adding CN=NTDS Settings,CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samdom,DC=example,DC=com
Adding SPNs to CN=DC2,OU=Domain Controllers,DC=samdom,DC=example,DC=com
Setting account password for DC2$
Enabling account
Calling bare provision
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
A Kerberos configuration suitable for Samba 4 has been generated at /usr/local/samba/private/krb5.conf
Provision OK for domain DN DC=samdom,DC=example,DC=com
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com] objects[402/1550] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com] objects[804/1550] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com] objects[1206/1550] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com] objects[1550/1550] linked_values[0/0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=samdom,DC=example,DC=com] objects[402/1618] linked_values[0/0]
Partition[CN=Configuration,DC=samdom,DC=example,DC=com] objects[804/1618] linked_values[0/0]
Partition[CN=Configuration,DC=samdom,DC=example,DC=com] objects[1206/1618] linked_values[0/0]
Partition[CN=Configuration,DC=samdom,DC=example,DC=com] objects[1608/1618] linked_values[0/0]
Partition[CN=Configuration,DC=samdom,DC=example,DC=com] objects[1618/1618] linked_values[42/0]
Replicating critical objects from the base DN of the domain
Partition[DC=samdom,DC=example,DC=com] objects[100/100] linked_values[23/0]
Partition[DC=samdom,DC=example,DC=com] objects[386/286] linked_values[23/0]
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=samdom,DC=example,DC=com
Partition[DC=DomainDnsZones,DC=samdom,DC=example,DC=com] objects[44/44] linked_values[0/0]
Replicating DC=ForestDnsZones,DC=samdom,DC=example,DC=com
Partition[DC=ForestDnsZones,DC=samdom,DC=example,DC=com] objects[19/19] linked_values[0/0]
Committing SAM database
Sending DsReplicaUpdateRefs for all the replicated partitions
Setting isSynchronized and dsServiceName
Setting up secrets database
Joined domain SAMDOM (SID S-1-5-21-469703510-2364959079-1506205053) as a DC

See the samba-tool domain join --help command's output for further information.

Other frequently used parameters for the samba-tool domain join command:

--site=SITE: Directly join the host as DC to a specific Active Directory Sites.

--option="interfaces=lo eth0" --option="bind interfaces only=yes": If your server has multiple network interfaces, use these options to bind Samba to the specified interfaces. This enables samba-tool to register the correct LAN IP address in the directory during the join.

Verify the DNS Entries

See Verifying and Creating a DC DNS Record.

Do not skip this step. If the DNS entries are missing, the directory replication fails.

BIND9_DLZ DNS Back End

If you selected the BIND9_DLZ DNS back end during the domain join, set up the BIND configuration. For details, see BIND9_DLZ DNS Back End.

Built-in Groups GID Mappings

Samba currently does not support Sysvol replication. If you plan to use a Sysvol Replication workaround, you have to ensure that all domain controllers (DC) use the same GID mappings for built-in groups:

Create a hot-backup of the /usr/local/samba/private/idmap.ldb file a existing DC:

# tdbbackup -s .bak /usr/local/samba/private/idmap.ldb

This creates a backup file /usr/local/samba/private/idmap.ldb.bak.

Move the backup file to the /usr/local/samba/private/ folder on the new joined DC and remove the .bak suffix to replace the existing file.

Reset the Sysvol folder's file system access control lists (ACL) on the new DC:

# samba-tool ntacl sysvolreset

Start Samba

To start the Samba domain controller (DC), run:

# samba

Samba does not include start scripts. For examples, see Samba Init-Script.

Directory Replication

A few minutes after the domain controller (DC) started, the connections with all other DCs are automatically established and the replication begins.

To verify the directory replication, run on a Samba DC:

# samba-tool drs showrepl
Default-First-Site-Name\DC2
DSA Options: 0x00000001
DSA object GUID: c14a774f-9732-4ec2-b9fa-2156c95c4e48
DSA invocationId: 7bdb135c-6868-4dd9-9460-33dea4b6b87b

==== INBOUND NEIGHBORS ====

CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com
	Default-First-Site-Name\DC1 via RPC
		DSA object GUID: 4a6bd92a-6612-4b15-aa8c-9ec371e8994f
		Last attempt @ Thu Sep 24 20:08:46 2015 CEST was successful
		0 consecutive failure(s).
		Last success @ Thu Sep 24 20:08:46 2015 CEST

DC=DomainDnsZones,DC=samdom,DC=example,DC=com
	Default-First-Site-Name\DC1 via RPC
		DSA object GUID: 4a6bd92a-6612-4b15-aa8c-9ec371e8994f
		Last attempt @ Thu Sep 24 20:08:45 2015 CEST was successful
		0 consecutive failure(s).
		Last success @ Thu Sep 24 20:08:45 2015 CEST

CN=Configuration,DC=samdom,DC=example,DC=com
	Default-First-Site-Name\DC1 via RPC
		DSA object GUID: 4a6bd92a-6612-4b15-aa8c-9ec371e8994f
		Last attempt @ Thu Sep 24 20:08:46 2015 CEST was successful
		0 consecutive failure(s).
		Last success @ Thu Sep 24 20:08:46 2015 CEST

DC=ForestDnsZones,DC=samdom,DC=example,DC=com
	Default-First-Site-Name\DC1 via RPC
		DSA object GUID: 4a6bd92a-6612-4b15-aa8c-9ec371e8994f
		Last attempt @ Thu Sep 24 20:08:45 2015 CEST was successful
		0 consecutive failure(s).
		Last success @ Thu Sep 24 20:08:45 2015 CEST

DC=samdom,DC=example,DC=com
	Default-First-Site-Name\DC1 via RPC
		DSA object GUID: 4a6bd92a-6612-4b15-aa8c-9ec371e8994f
		Last attempt @ Thu Sep 24 20:08:45 2015 CEST was successful
		0 consecutive failure(s).
		Last success @ Thu Sep 24 20:08:45 2015 CEST

==== OUTBOUND NEIGHBORS ====

CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com
	Default-First-Site-Name\DC1 via RPC
		DSA object GUID: 4a6bd92a-6612-4b15-aa8c-9ec371e8994f
		Last attempt @ NTTIME(0) was successful
		0 consecutive failure(s).
		Last success @ NTTIME(0)

DC=DomainDnsZones,DC=samdom,DC=example,DC=com
	Default-First-Site-Name\DC1 via RPC
		DSA object GUID: 4a6bd92a-6612-4b15-aa8c-9ec371e8994f
		Last attempt @ NTTIME(0) was successful
		0 consecutive failure(s).
		Last success @ NTTIME(0)

CN=Configuration,DC=samdom,DC=example,DC=com
	Default-First-Site-Name\DC1 via RPC
		DSA object GUID: 4a6bd92a-6612-4b15-aa8c-9ec371e8994f
		Last attempt @ NTTIME(0) was successful
		0 consecutive failure(s).
		Last success @ NTTIME(0)

DC=ForestDnsZones,DC=samdom,DC=example,DC=com
	Default-First-Site-Name\DC1 via RPC
		DSA object GUID: 4a6bd92a-6612-4b15-aa8c-9ec371e8994f
		Last attempt @ NTTIME(0) was successful
		0 consecutive failure(s).
		Last success @ NTTIME(0)

DC=samdom,DC=example,DC=com
	Default-First-Site-Name\DC1 via RPC
		DSA object GUID: 4a6bd92a-6612-4b15-aa8c-9ec371e8994f
		Last attempt @ NTTIME(0) was successful
		0 consecutive failure(s).
		Last success @ NTTIME(0)

==== KCC CONNECTION OBJECTS ====

Connection --
	Connection name: fb03f58b-1654-4a02-8e11-f0ea120b60cc
	Enabled        : TRUE
	Server DNS name : DC1.samdom.example.com
	Server DN name  : CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samdom,DC=example,DC=com
		TransportType: RPC
		options: 0x00000001
Warning: No NC replicated for Connection!

It can take several minutes until all connections are established. If the connections on existing Samba DCs to the Windows DC are not established within 15 minutes, start the replication manually. For details, see samba-tool drs replicate.

If you see the warning No NC replicated for Connection!, see FAQ: What does Warning: No NC replicated for Connection! Means.

Starting the BIND daemon

Before you start the BIND daemon, verify that the DNS directory partitions have been replicated:

# samba-tool drs showrepl
...
==== INBOUND NEIGHBORS ====
...
DC=DomainDnsZones,DC=samdom,DC=example,DC=com
	Default-First-Site-Name\DC1 via RPC
		DSA object GUID: 4a6bd92a-6612-4b15-aa8c-9ec371e8994f
		Last attempt @ Thu Sep 24 20:08:45 2015 CEST was successful
		0 consecutive failure(s).
		Last success @ Thu Sep 24 20:08:45 2015 CEST
...
DC=ForestDnsZones,DC=samdom,DC=example,DC=com
	Default-First-Site-Name\DC1 via RPC
		DSA object GUID: 4a6bd92a-6612-4b15-aa8c-9ec371e8994f
		Last attempt @ Thu Sep 24 20:08:45 2015 CEST was successful
		0 consecutive failure(s).
		Last success @ Thu Sep 24 20:08:45 2015 CEST

If the replication is working, start the BIND daemon. See your distribution's documentation for information how to start a service.

Testing the Local DNS

Skip this step if you selected --dns-backend=NONE during the join.

Query the local DNS server to resolve the domain name samdom.example.com:

# host -t A samdom.example.com localhost
Using domain server:
Name: localhost
Address: 127.0.0.1#53
Aliases:

samdom.example.com has address 10.99.0.1
samdom.example.com has address 10.99.0.2

The local DNS must answer with the IP addresses of all domain controllers (DC).

In case you receive no or a different result, review this documentation and check:

the system log files,
the Samba log files,
the BIND log files, if the BIND9_DLZ is used.

DNS Configuration on Domain Controllers

The DNS configuration on domain controllers (DC) is important, because if it is unable to locate other DCs the replication will fail. The following is a best practice for DNS configuration on domain controllers (DC):

Set the local IP of a DC as secondary or tertiary nameserver entry in its /etc/resolv.conf file and use a different Active Directory (AD) DNS server IP from the forest as primary name server. For example:

On the new joined DC, use the 10.99.0.1 IP of the existing DC as primary and the local 10.99.0.2 IP as secondary nameserver entry:

nameserver 10.99.0.1
nameserver 10.99.0.2       # IP of the new joined DC as secondary entry
search samdom.example.com

If you are running more than two DCs, you can configure the IPs in crosswise direction.

Sysvol Replication

Samba currently does not support Sysvol replication. For unsupported workarounds, see Sysvol Replication.

Testing the Directory Replication

To test that the directory replication works correctly, add for example a user on an existing DC and verify that it shows up automatically on the newly joined DC.

Optionally use the ldapcmp utility to compare two directories. For details, see samba-tool ldapcmp.

Troubleshooting

For troubleshooting, see Samba AD DC Troubleshooting.

Anonymous

Search

Joining a Samba DC to an Existing Active Directory

Namespaces

More

Page actions

Contents

Introduction

Preconditions

Installation

Paths

Preparing the Host for Joining the Domain

Local DNS server

DNS Resolving

Kerberos

Joining the Active Directory as a Domain Controller

Verify the DNS Entries

BIND9_DLZ DNS Back End

Built-in Groups GID Mappings

Start Samba

Directory Replication

Starting the BIND daemon

Testing the Local DNS

DNS Configuration on Domain Controllers

Sysvol Replication

Testing the Directory Replication

Troubleshooting

Navigation

Navigation

Wiki tools

Wiki tools

Anonymous

Search

Joining a Samba DC to an Existing Active Directory

Introduction

Preconditions

Installation

Paths

Preparing the Host for Joining the Domain

Local DNS server

DNS Resolving

Kerberos

Joining the Active Directory as a Domain Controller

Verify the DNS Entries

BIND9_DLZ DNS Back End

Built-in Groups GID Mappings

Start Samba

Directory Replication

Starting the BIND daemon

Testing the Local DNS

DNS Configuration on Domain Controllers

Sysvol Replication

Testing the Directory Replication

Troubleshooting

Navigation

Wiki tools

Page tools