Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Members of Domain Admin using CentOS Directory Server as backend do not have Admin rights in Windows Server 2008. I have joined the domain, see that the users are populated, and can login using LDAP accounts. But, member from Domain Admins do not have Admin rights.

My smb.conf

[global]

workgroup = DOMAIN
netbios name = COMPUTERNAME
name resolver order = wins lmhosts hosts bcast
time server = yes
interfaces = lo eth0 192.168.2.0/24 
hosts allow = 127. 192.168.0.
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
enable privileges = yes
security = user
passdb backend = ldapsam
ldap admin dn = uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot
ldap delete dn = yes
ldap suffix = dc=DOMAIN, dc=local
ldap user suffix= ou=groups, ou=auto.home
ldap machine suffix= ou=Computers, ou=auto.home
ldap group suffix = ou=groups, ou=auto.home
ldap idmap suffix = ou=idmap, ou=auto.home
idmap backend = ldap:ldap://127.0.0.1/
idmap alloc backend = ldap:ldap://127.0.0.1/
ldap ssl = start tls
encrypt passwords = true
#add machine script = /usr/sbin/useradd -c Computers -s /bin/false %m$
ldap password sync = yes
idmap config DOMAIN:range = 800-500000
idmap config DOMAIN:ldap_url = ldap://127.0.0.1/
idmap config DOMAIN:ldap_user_dn = uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot
idmap config DOMAIN:ldap_base_dn = ou=idmap,ou=auto.home, dc=DOMAIN,dc=local
idmap config DOMAIN:default = yes
idmap config DOMAIN:readonly = no
idmap config DOMAIN:backend = ldap
idmap alloc config:range = 800-500000
idmap alloc config:ldap_url = ldap://127.0.0.1/
idmap alloc config:ldap_user_dn = uid=admin, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot
idmap alloc config:ldap_base_dn = ou=idmap,ou=auto.home, dc=DOMAIN,dc=local
logon path = \\%L\profiles\%U
logon home = \\%L\%U\profiles
    #logon drive = H:
ldapsam:editposix = yes
ldapsam:trusted = yes
idmap uid = 800-500000
idmap gid = 800-500000

This is the output from net groupmap list:

#net groupmap list
   Domain Admins (S-1-5-21-2832048597-2870066976-2120398464-512) -> Domain Admins
   Domain Users (S-1-5-21-2832048597-2870066976-2120398464-513) -> Domain Users
   Domain Guests (S-1-5-21-2832048597-2870066976-2120398464-514) -> Domain Guests
   Domain Computers (S-1-5-21-2832048597-2870066976-2120398464-515) -> Domain Computers
   Domain Guests (S-1-5-21-2832048597-2870066976-2120398464-514) -> nobody
   Administrators (S-1-5-21-2832048597-2870066976-2120398464-1007) -> admins
   Administrators (S-1-5-32-544) -> Administrators
   Account Operators (S-1-5-32-548) -> Account Operators
   Print Operators (S-1-5-32-550) -> Print Operators
   Backup Operators (S-1-5-32-551) -> Backup Operators
   Replicators (S-1-5-32-552) -> Replicators

pdbedit shows the user Administrator with the right SID (ending in 500).

I have granted rights to the Domain Admins group using documentation from Samba: http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/rights.html.

What else should I do?

Edit: Groups in Windows.

C:\Users\username>whoami
DomainName\username

C:\Users\username>whoami /groups

GROUP INFORMATION
-----------------

Group Name                             Type             SID          Attributes

====================================== ================ ============ ===========
=======================================
Everyone                               Well-known group S-1-1-0      Mandatory g
roup, Enabled by default, Enabled group
BUILTIN\Users                          Alias            S-1-5-32-545 Mandatory g
roup, Enabled by default, Enabled group
BUILTIN\Remote Desktop Users           Alias            S-1-5-32-555 Mandatory g
roup, Enabled by default, Enabled group
NT AUTHORITY\REMOTE INTERACTIVE LOGON  Well-known group S-1-5-14     Mandatory g
roup, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE               Well-known group S-1-5-4      Mandatory g
roup, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11     Mandatory g
roup, Enabled by default, Enabled group
NT AUTHORITY\This Organization         Well-known group S-1-5-15     Mandatory g
roup, Enabled by default, Enabled group
LOCAL                                  Well-known group S-1-2-0      Mandatory g
roup, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication       Well-known group S-1-5-64-10  Mandatory g
roup, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label            S-1-16-8192  Mandatory g
roup, Enabled by default, Enabled group

Edit2: Groups from Linux

[username@computername samba]$ id -Gn
Domain Users Domain Admins Administrators 

Edit3: genent group 512

[username@computername sambas]# getent group 512
Domain Admins:*:512:username,Administrator,username2
share|improve this question
    
When logged onto the Windows 2008 server, what groups do the users appear in? – Andy Smith Nov 15 '11 at 16:04
    
Okay. It doesn't look like your user is in any DomainName groups at all, or am I missing something?! – Andy Smith Nov 15 '11 at 16:16
    
I edited my question to show groups from Linux. The username in question, is a member of Domain Admins. If I go to Computer Management-> Groups->Administrators, I can manually add this user as Administrator and all groups are shown if I click on Find Now. – rchhe Nov 15 '11 at 16:27
    
Yeah, I can see - the weird thing is that is does look like the user is added to any domain groups from the Windows 2008 server's point of view - which is presumably where the problem lies! – Andy Smith Nov 15 '11 at 16:30
    
What does getent group 512 show? – Andrew Nov 16 '11 at 5:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.