We are using Samba Active Directory 2:4.7.6 on Ubuntu 14.04.5 LT
We have only one domain controller, and it is not remote (it is inside the controlled, non-WAN-accessed subnet).
However, as is the default since Windows AD 2008, all authoritative users ("enterprise admins", "domain admins", "Cert Publishers", etc) belong to the group "Denied RODC Password Replication".
I have two questions:
Since this is NOT a remote domain controller (it is the master) and it is NOT available via WAN (it is in an isolated subnet) - can we remove these users safely from the "Denied RODC Password Replication"
(This may need to be a separate post). When attempting to log onto an Ubuntu 18 member of the domain, it fails with the error ...
lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "MyDomainAdminAccount"
This is because of the line in the
auth sufficient pam_succeed_if.so user ingroup nopasswdlogin
I corrected the issue by changing this file to ...
#auth sufficient pam_succeed_if.so user ingroup nopasswdlogin auth sufficient pam_succeed_if.so user ingroup [domain users] auth sufficient pam_succeed_if.so user ingroup [domain admins]
...but I don't know if these two issues are related.
Can anyone shed light on this?