Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Trying to set up a linux server to authenticate users on the corporate active directory we're facing a problem. We're using SAMBA, winbind, krb5 and PAM.

The problem arises when trying to list users from the system. winbind tries to look them up in all the trusted domains from the company branches. As they cannot be accessed from the linux server we get a timeout.

How can we tell samba or winbind to only look for users in the parent domain and avoid the rest?

We want users from but not from


SAMBA version is 3.0.33 on RH4.

share|improve this question
up vote 2 down vote accepted

It sounds like this functionality regressed from Samba prior to 3.0.26. A patch was proposed and it was re-added to Samba 3.3.

If you're prepared to patch Samba's source code yourself, there is an "only domains" patch, which is the inverse of "ignore domains".

share|improve this answer

You could add this option to smb.conf :

allow trusted domains = no
share|improve this answer
This does not work to list users, it only means that users from trusted domains does not authenticate. – chmeee Jul 3 '09 at 10:59

I actually have this setup on my Ubuntu workstation in the office so I don't have to use Windows but still authenticate off the domains AD. We have several domains that are trusted so I limited it down to our main AD domain used for workstation logins. I believe I have found all the relevant entries so if you have trouble let me know and I'll hunt for other stragglers that may be scattered in the config.

    idmap uid = 2000-50000000
    idmap gid = 2000-50000000
    idmap backend = rid:DOMAIN=2000-50000000
    template shell = /bin/bash
    template homedir = /home/%D/%U
    winbind use default domain = yes
    allow trusted domains = No
    password server = FQDN-of-AD-Server
    use kerberos keytab = true

Of other note, I had to be sure that Samba and Winbind were nearly last to be started in order to be able to authenticate after the system was rebooted.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.