topic Re: RHEL5/Samba Client local rights in Operating System - Linux

RHEL5/Samba Client local rights

Rob Hausler — Tue, 07 Oct 2008 11:47:06 GMT

have migrated to RHEL5 from RHEL4 and while the logins are all working fine we cannot get the members of domadmin to have Domain Admins rights on the XP pro / Vista clients. .

We have done the
net groupmap add ntuser="Domain Admins" unixgroup=domadmin type=d
but this doesnt seem to work..

net groupmap shows
Domain Admins (S-1-5-21-3779496958-1255796685-868011268-1007) -> domadmin

any thoughts??

Re: RHEL5/Samba Client local rights

Ivan Ferreira — Tue, 07 Oct 2008 18:32:22 GMT

You RID for the Domain Admins is not correct, this RID must be 512 otherwise it wont work.

Use the following command:

# net groupmap add rid=512 ntgroup='Domain Admins' unixgroup='domadmin'

Also, you specify "ntuser" it should be "ntgroup".

I see in your profile "I have assigned points to 0 of 1 responses to my questions."

Please assign points to the answers you get. For mor information visit:

http://forums1.itrc.hp.com/service/forums/helptips.do?#28

Re: RHEL5/Samba Client local rights

Rob Hausler — Wed, 08 Oct 2008 10:11:37 GMT

Ok i removed the ntgroup "Domain Admins" and added it back forcing a rid=512..

Thought it worked at first untill i tried other users.. still not working..

I performed further testing on my own user account - removed from all admin/root samba administration lists even removed from ntadmin unix group

I logged into the test pc on site - and i STILL HAD ADMIN RIGHTS. (no im not set as a local administrator via Control Panel/Users)

I even removed my profile from the server and logged into a pc I have NEVER logged into and I still have Local Domain Admin Rights.

I have tested this on my own Centos4 server and the moment I remove myself from the ntadmins unix group, log out of the xp pro client and then log back in - i loose Domain Admin rights, I re-add myself back and log out/in and i get them back.. So I know this works (or at least how it should)