# Switching from an rfc2307 schema to a tdb schema

In windows environment, a group can be the owner of a file whereas in linux only a user can.

Samba will handle this by giving a unique id to groups (GUID) and to users (UID).

In fact, a group can own a folder under Linux thanks to its id. The winbind in RFC2307 mode doesn’t know how to handle this, you have to go back to tdb mode, the default configuration of Samba-AD.

This problem is not visible as long as domain admins has no historical id. If this is the case, it will not be able to interface the group id, the group and the folder it owns.

## Converting a rfc2307 idmap to tdb

- The first step is to clean the `idmap.ldb` database:

      for i in $(ldbsearch  -H /var/lib/samba/private/idmap.ldb  dn  | grep ^dn | awk '{ print $2 }' | grep -v CONFIG) ; do echo "ldbdel -H /var/lib/samba/private/idmap.ldb $i" ; done

  Hint

  This code will show you the command lines to be executed. It will not be executed!. You can remove the `echo` command to execute them directly or copy and paste the output into a `bash`. Once the command is run it may also be useful to empty the cache.

      net cache flush

- The samba service is restarted when the order is completed:

      # Debian
      systemctl restart samba-ad-dc
      # RedHat10 and derived distributions
      systemctl restart samba

- We reset the `SYSVOL` rights, then we reset the ACLs:

      setfacl -b /var/lib/samba/sysvol
      chown -R root:root /var/lib/samba/sysvol
      chmod 755 /var/lib/samba/sysvol
      samba-tool ntacl sysvolreset
      samba-tool ntacl sysvolcheck

If the commands do not return an error then everything is OK.

You can check the new mappings with Winbind or with ldbsearch commands.

    ldbsearch  -H /var/lib/samba/idmap.ldb

## Synchroning with remote servers

If you use rsync to synchronize with numeric id, you must also synchronize both the idmap databases and the file permissions (ugo, acl posix and extended attributes permissions).

If you synchronize the file `idmap.ldb` by rsync, you must remember to empty the caches and restart samba:

    net cache flush
    systemctl restart samba