Samba: How to check if Domain Menbership is intact?

[Alzhy]

Server used to be a domain member via security=domain. After tests, the Samba service was changed to security=user. (Nothing was dne on the Domain head to remove the machine account). Then the service was once more resumed with security=domain. A join now fails (net rpc join ...). "net rpc testjoiin" says join is ok.

1. How do I check from UNIX if my Samba service at this point is still a true domain member.

2. Will a rejoin neccessitate a refresh of the machine account and a join needed once more?

Thanks!

[eric roseme]

Hi Nelson,

You already have a computer object on the domain. That object has a matching SID to the one stored in your secrets.tdb. So you cannot re-join the domain unless you delete the existing computer object and add it back.

You can do a "net rpc testjoin" and/or "net rpc info" and those should indicate if your current config is okay. If your users cannot auth-n, then you need to delete the old object and re-join.

I doubt that simply changing "security = user" would mod your secrets.tdb, but if it did, then you need to re-join.

Eric Roseme
Hewlett-Packard

[Geoff Wild]

Samba and Windows work in mysterious ways - more then likely you will need to have a NT admin remove the machine account from Server Manager, then rejoin the domain manually from the command line on HP-UX.

Rgds...Geoff

[Steven E. Protter]

Shalom Nelson aka Harley man,

1. Check the primary domain controller. Depending on which OS, the Samba machine should be listed in the machine database, at least for Windows Server 2003.

2. I don't think so, but if behavior remains strange, #2 is a viable option for fixing the problem.

SEP

[Thomas Bianco]

heres the NT side:

"membership" is nothing more then having an account on the domain and trusting it for authentication. the account has a password like any other that is changed every 30 days by the DC. the exception is that the computer is allowed to log into the domain to update it's password using the last password as well.

so: if the server has been disconnected more then 60 days, then it's very likley the DC has changed the password of the computer account, and the secrets file is out of date anyways.

talk to your NT admin, have him remove the computer account from the domain, and create a new one.