Is there an easy way to override the Samba "template shell = /bin/bash" setting on a per-user basis?

This is for Linux systems joined to an Active Directory domain. Some users want /bin/bash. Others including myself want /bin/zsh. Is there some AD attribute I can set?

Anything I've found via googling seems hackish at best (writing a script to replace /bin/sh -- maintenance hassle).

A similar serverfault question Override LDAP shell seems OpenLDAP-oriented (but if someone knows how to get it working with AD, please say so).

3 Answers 3


If you're using winbind, you can do the following:

  1. Install IDMU as Christoph suggested. If you have 2003 R2 or later, the necessary RFC 2307 schema is already installed, so you can skip this step.

  2. Add the following to smb.conf, per the Samba wiki:

    winbind nss info = rfc2307

    Again, this is only going to work if you're using winbind. Restart it once you've made the change.

  3. Set users' loginShell attribute in Active Directory. winbind will honor that setting on its next refresh.

  • I can verify that this works on RHEL 6.5. When loginShell is not set it just uses the template one which is what we wanted. Thanks!
    – GeneBean
    Commented May 30, 2014 at 13:41

If you have a large number of Linux systems using AD, this may not be efficient, but for a small number of systems, the simplest way of doing this is to run the following on the Linux machine:

getent passwd ADUSER >> /etc/passwd

Then edit the corresponding line in /etc/passwd to reflect the preferred shell (or better yet, use sed to change the shell entry on the fly before appending to /etc/passwd). IDMU, as others have suggested, is probably the most elegant solution for multiple hosts, but the above example gets the job done if you're just looking to do this on a few systems.

  • Looking for this answer for a week now. Thanks @rvf.
    – Sam R.
    Commented Oct 29, 2015 at 23:46

If you install Identity Management for Unix (IDMU) on your AD server, the LDAP schema is extended for storing Unix attributes and you can set the login shell in the "Unix Attributes" tab of the (user) object properties.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .