SAMBA Domain Controller

Samba Domain on XP:

Start->run->MMC
->File->add/remove snap-in->Add
-->Add
--->Group Policy Object Editor->Add
---->(Group Policy Object must be 'Local Computer')->Finish
--->Close
-->OK
->Local Computer Policy
->Computer Configuration
->Windows Settings
->Security Settings
->Local Policies
->Security Options
->Disable "Domain Member: Digitally encrypt or sign secure channel data (always)"
Restart, and you should be able to log on with your Samba username and password.

Samba Domain on Windows7:

Start-> MMC
->File->add/remove snap-in->Add
-->Select Group Policy Object Editor->Add
---->(Group Policy Object must be 'Local Computer')->Finish
-->OK
->Local Computer Policy
->Computer Configuration
->Windows Settings
->Security Settings
->Local Policies
->Security Options
->Disable "Domain Member: Digitally encrypt or sign secure channel data (always)"

save this as samba_w7.reg, run it to load in the registry:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\lanmanserver\parameters]
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\lanmanworkstation\parameters]
"DNSNameResolutionRequired"=dword:00000000
"DomainCompatibilityMode"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\netlogon\parameters]
"DisablePasswordChange"=dword:00000001
"RequireSignOrSeal"=dword:00000001
"RequireStrongKey"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wscsvc]
"Start"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]
"SlowLinkDetectEnabled"=dword:00000000
"DeleteRoamingCache"=dword:00000001
"WaitForNetwork"=dword:00000000
"CompatibleRUPSecurity"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=dword:00000000
"LocalAccountTokenFilterPolicy"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\Setup]
"RestartSetup"=dword:00000000
"SetupType"=dword:00000000
"SystemSetupInProgress"=dword:00000000
"SetupPhase"=dword:00000000
"CmdLine"=""
"OOBEInProgress"=dword:00000000

Reboot after this

add user

smbpasswd -a <user>

add machine

smbpasswd -a -m <machine>

delete user

smbpasswd -x <user>

machine verwijderen en vervolgens opnieuw aanmelden

pdbedit -x CLIENT-PC$
userdel CLIENT-PC$

List all users, with settings:

pdbedit -Lv

on workstation, scan and repair corruptions:

sfc /scanall

div. commands (samba):

net rpc rights list -all
net -S server -U domadmin rpc rights grant 'DOMAIN\Domain Admins' SeMachineAccountPrivilege
net rpc rights grant 'DOMAIN\Domain Admins' SeMachineAccountPrivilege -S server -U domadmin
getfacl -t  /data/profiles/roland
net groupmap add ntgroup="Domain Admins" unixgroup=domadm rid=512 type=d
net rpc group add demo -L -Uroot%not24get
net rpc group addmem demo "DOM\Domain Users" 
net groupmap list

net groupmap add ntgroup="Domain Admins" unixgroup=ntadmin rid=512 type=d
net groupmap add ntgroup="Domain Users" unixgroup=users rid=513 type=d
net groupmap add ntgroup="Domain Guests" unixgroup=nobody rid=514 type=d
groupadd Orks
groupadd Elves
groupadd Gnomes
net groupmap add ntgroup="Orks"   unixgroup=Orks   type=d
net groupmap add ntgroup="Elves"  unixgroup=Elves  type=d
net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d

Default ID's

Well-Known Entity	RID	Type	Essential
Domain Administrator	500	User	No
Domain Guest	501	User	No
Domain KRBTGT	502	User	No
Domain Admins	512	Group	Yes
Domain Users	513	Group	Yes
Domain Guests	514	Group	Yes
Domain Computers	515	Group	No
Domain Controllers	516	Group	No
Domain Certificate Admins	517	Group	No
Domain Schema Admins	518	Group	No
Domain Enterprise Admins	519	Group	No
Domain Policy Admins	520	Group	No
Builtin Admins	544	Alias	No
Builtin users	545	Alias	No
Builtin Guests	546	Alias	No
Builtin Power Users	547	Alias	No
Builtin Account Operators	548	Alias	No
Builtin System Operators	549	Alias	No
Builtin Print Operators	550	Alias	No
Builtin Backup Operators	551	Alias	No
Builtin Replicator	552	Alias	No
Builtin RAS Servers	553	Alias	No

div. commands (workstation):

net localgroup administrators /add domain_name\entity