Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that may help.
What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
First and foremost, portability. It means that notebook users can move between the Abmas office and client offices (so long as they, too, use DHCP) without having to manually reconfigure their machines. It also means that when they work from their home environments either using DHCP assigned addressing or when using dial-up networking, settings such as default routes and DNS server addresses that apply only to the Abmas office environment do not interfere with remote operations. This is an extremely important feature of DHCP.
Are there any DHCP server configuration parameters in the /etc/dhcpd.conf that should be noted in particular?
Yes. The configuration you created automatically provides each client with the IP address of your WINS server. It also configures the client to preferentially register NetBIOS names with the WINS server, and then instructs the client to first query the WINS server when a NetBIOS machine name needs to be resolved to an IP Address. This configuration results in far lower UDP broadcast traffic than would be the case if WINS was not used.
Is it possible to create a Windows Domain account that is specifically called Administrator?
You can surely create a Windows Domain account called Administrator. It is also possible to map that account so that it has the effective UNIX UID of 0. This way it isn't necessary to use the username map facility to map this account to the UNIX account called root.
Why is it necessary to give the Windows Domain Administrator a UNIX UID of 0?
The Windows Domain Administrator account is the most privileged account that exists on the Windows platform. This user can change any setting, add, delete, or modify user accounts, and completely reconfigure the system. The equivalent to this account in the UNIX environment is the root account. If you want to permit the Windows Domain Administrator to manage accounts as well as permissions, privileges, and security settings within the Domain and on the Samba server, equivalent rights must be assigned. This is achieved with the root UID equal to 0.
One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him root access. How can we do this?
Users who are members of the Domain Admins group can add machines to the Domain. This group is mapped to the UNIX group account called root (or the equivalent wheel on some UNIX systems) that has a GID of 0. This must be the primary GID of the account of the user who is a member of the Windows Domain Admins account.
Why must I map Windows Domain Groups to UNIX groups?
Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are Domain Guests, Domain Users, and Domain Admins.
I deleted my root account and now I cannot add it back! What can I do?
This is a nasty problem. Fortunately, there is a solution.
Back up your existing configuration files in case you need to restore them.
Rename the group_mapping.tdb file.
Use the smbpasswd to add the root account.
Restore the group_mapping.tdb file.
When I run net groupmap list, it reports a group called Administrators as well as Domain Admins. What is the difference between them?
The group called Administrators is representative of the same account that would be present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This may change at some later date. These accounts are provided only so that security objects are correctly shown.
What is the effect of changing the name of a Samba server or of changing the Domain name?
If you elect to change the name of the Samba server, on restarting smbd, Windows security identifiers are changed. In the case of a standalone server or a Domain Member server, the machine SID is changed. This may break Domain membership. In the case of a change of the Domain name (Workgroup name), the Domain SID is changed. This affects all Domain memberships.
If it becomes necessary to change either the server name or the Domain name, be sure to back up the respective SID before the change is made. You can back up the SID using the net getlocalsid (Samba-3) or the smbpasswd (Samba-2.2.x). To change the SID, you use the same tool. Be sure to check the man page for this command for detailed instructions regarding the steps involved.
How can I manage user accounts from my Windows XP Professional workstation?
Samba-3 implements a Windows NT4-style security domain architecture. This type of Domain cannot be managed using tools present on a Windows XP Professional installation. You may download from the Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use it. This package extracts the tools: User Manager for Domains, Server Manager, and Event Viewer. You may use the User Manager for Domains to manage your Samba-3 Domain user and group accounts. Of course, you do need to be logged on as the Administrator for the Samba-3 Domain. It may help to log on as the root account.