Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So i have an old NT domain, and a brand spanking new Windows 2008 R2 domain.

while I switch people off the old server to the new one we're having this issue.

we have a third server (running samba) which acts as a file server/remote storage for my users.

anything i can do to make the samba server allow people from either domain to login? I've already tried forming a trust between them but that didn't work. (couldn't create the trust)

share|improve this question

Your trust failed due to the combination of Windows 2008 R2 considering the WinNT security protocols insecure and the Forest Functional Level being anything higher than Server 2000 Compatible. Since this is a brand new 2008r2 domain, your functional levels are at Server 2008 R2. To the best of my knowledge, you can't downgrade those so your're stuck.

Samba can do this, but the answer isn't pretty, and it isn't secure. The trick is to let pam handle the Samba connections. The prime downside to this is that passwords are transmitted in the clear, which some Windows versions (anything newer than XP) won't allow without explicit configuration.

You'll have to configure winbind to talk to the NT domain, and then use LDAP to hunt the Active Directory domain. Then set both pam_winbind and pam_ldap to be sufficient for login. And finally configure Samba to use pam ('obey pam restrictions' directive). You'll also have to ensure that accounts in the NT domain are removed once they're migrated to the 2008r2 domain otherwise PAM may pick the wrong account to authenticate against. Once you're done, you can get Samba joined up properly to the 2008 domain, undo the pam directives, and passwords will be secure once more.

It's ugly, but it just might work.

share|improve this answer
thanks i'll keep looking but that looks like a starting point. and you're right it's not pretty. everything on our network here is behind a proxy so it MIGHT be ok for the changeover period. – Brian Jun 29 '10 at 19:47
well the new domain doesn't have anything on it. if i wiped the install and started a new domain with a lower functional level should it work? i was thinking about doing that and then upgrading the functional level once everyone moves over. – Brian Jun 29 '10 at 23:49
Oo! That helps! If you can install it as Server 2000 right off the bat it'll start as Server 2000. Make the trust at that point. When you add the Server 2008 DC's you'll have to drop the LanMan level to let the NT4 talk to it, but it should work. – sysadmin1138 Jun 30 '10 at 1:22
ok thanks! i think we're gonna go with that. – Brian Jul 2 '10 at 17:56
@sysadmin1138: a little bit off-topic, but I'd like a clarification on this; isn't the forest/domain functional level only related to having NT/2000/2003 domain controllers in the same domain? AFAIK, it doesn't apply to external trusts. The point about LM level still applies, of course. – Massimo Oct 1 '10 at 11:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.