Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having an issue with SAMBA AD authentication. What i believe is happening, is that winbind is not able to see all of the users in my AD.

I can successfully query groups and domains with wbinfo -u and wbinfo -g, but when a user tries to authenticate, samba doesn't see them, and grepping for then in the output of wbinfo -u returns no results.

I have ~160k objects in AD, wbinfo -u | wc -l returns ~28k entries.

my smb.conf:

#======================= Global Settings =====================================


# Domain Authntication Settings
        workgroup = <my domain>
        server string = <Sever String>
        security = ads
        passdb backend = tdbsam
        realm = <>
        client use spnego = yes
        ldap ssl = no
# logging
        log level = 5
        max log size = 50
        # logs split per machine
        log file = /var/log/samba/%m.log
        # max 50KB per log file, then rotate
;       max log size = 50

# User settings
        username map =  /etc/samba/smbusers
        idmap uid = 10000-20000000
        idmap gid = 10000-20000000
        idmap backend = ad
;       template primary group = <ad group>
        template shell = /sbin/nologin

# Winbind Settings
        winbind separator = +
        winbind enum users = Yes
        winbind enum groups  = Yes
        winbind netsted groups = Yes
        winbind nested groups = Yes
        winbind use default domain = Yes

#Other Globals
        unix charset = LOCALE
        server string = <my server name>
        load printers = no
        printing =  cups
        cups options = raw

;       printcap name = /etc/printcap
        #obtain list of printers automatically on SystemV
;       printcap name = lpstat
;       printing = cups

#============================ Share Definitions ==============================

comment = <share comment>
path = /srv/smb/share
guest ok = yes
valid users = "DOMAIN+testUser"
read only = yes

Any help, or pointers in the right direction - greatly appreciated!

Let me know if you need any log or other config files.

share|improve this question
up vote 1 down vote accepted

This ended up being a bug in the version of SAMBA in the ubuntu repository. I ended up grabbing the latest stable from samba's site and that cleared everything up.

share|improve this answer

I have dealt with a similar problem and my fix was to add the Samba machine into the "Builtin\Pre-Windows 2000 Compatible Access" group. You also did not specify what version of Windows Server 2003. This worked on SBS 2003 SP2.

share|improve this answer
It's a variety there are about 100 DC's throughout the infrastructure most of them are either 2k3 SP2 or 2k3 R2 SP2 – Zypher Feb 5 '10 at 16:32
Did you add the machine to the group, any luck? – xeon Feb 5 '10 at 20:04
I did add it to the group, haven't been able to test because it went into production (put basic unix users in place temporarily). I'm going to get a test rig up to duplicate the environment, if that works I'll give ya the answer. – Zypher Feb 6 '10 at 18:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.