Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know this is the wrong way round... but

Is it possible to use AD in front of Samba for our PC clients, so that the user accounts are in Samba/Open LDAP.

Managing our fleet of Windows PC's is becoming more and more difficult with just Samba v3 - until Samba v4 comes along, it would be great if we could leverage Active Directory, but have the accounts stored in Samba/Open LDAP.

Windows PC's are a minority in our organisation & Samaba/Open LDAP are used for just about every service (Zimbra/RADIUS/Intranet/SAN/Printing/...) so it will have to remain the definitive account source. Anyway, it probably can't be done, but I thought I would ask for ideas anyway.

share|improve this question
up vote 4 down vote accepted

I haven't got any experience actually doing this, but it sure seems technically feasible to set up an Active Directory forest to join the computers into while preserving the ability to logon with the existing Samba domain accounts. They key is creating an NT 4 style trust relationship between the Samba domain and the Active Directory domain (either two-way, or with the AD domain trusting the Samba domain in a one-way trust) to allow the existing Samba domain user accounts to logon to these computers.

It should be a transparent process for the users. You'll be able to add computers to the AD domain at your leisure.

The main issues I can think of that might crop up during the creation of the trust would be good NetBIOS name resolution. I'd run a WINS server, either on the Samba DCs or on the Windows DCs, and have both the client and server computers register themselves. That ought to save a lot of heartburn fighting name resolution issues.

share|improve this answer
Sounds good - will give it a try! – Jon Rhoades Mar 23 '10 at 10:13

Can you share any notes from your trial?

--------- Update1

@whatever-downvoted-my-answer, be it bot or human,

May I ask why my questions were downvoted? Uncommented / unexplained, i.e. unreasonable, downvotes disservice and discredit the community of

share|improve this answer
Hmm, in 2 min upon posting I have got "-1". What does it mean, I wonder? – Gennady Vanin Геннадий Ванин Aug 8 '10 at 14:59
-1: More appropriate as a comment. – GregD Aug 8 '10 at 14:59
@vgv8: The FAQ is your friend: – GregD Aug 8 '10 at 15:00
No comment was available. I think it is connected with the period of inactivity of the thread. Though please continue, I am hoping to hit the negative maximum – Gennady Vanin Геннадий Ванин Aug 8 '10 at 15:25
It's very simple: this doesn't look like an answer. If you don't have enough reputation to comment, create awesome questions and answers to gain reputation to allow you to add comments. – Oskar Duveborn Aug 15 '10 at 14:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.