# Samba-AD documentation

[https://www.samba.org/]

## Main benefits

Samba-AD is a GPLv3 licensed opensource software that reproduces the behavior of Microsoft Active Directory (2022 schemas and 2016 functional level).

Samba-AD allows to provision and manage an Active Directory domain:

- LDAP directory;

- DNS name service;

- NTP time synchronization service;

- Transparent Kerberos based authentication;

- KDC token distribution service;

- Multi-AD replication;

- Security policies implemented with GPO;

Note

The purpose of this theoretical presentation is not to provide an exhaustive documentation on LDAP, Kerberos or DNS protocols, but rather to provide the necessary clues for understanding and analyzing the working and the behavior of an Active Directory server that is implemented using Samba.

## Table Of Contents Tree

Theoretical presentation of Samba-AD

- History of Samba Active Directory
- About the services that compose a Samba Active Directory server
- Evolution of Samba since version 4

Installing and configuring Samba-AD

- Dimensioning a Samba Active Directory server
  - Dimensioning the memory
  - Dimensioning the storage
  - Dimensioning CPUs
- Installing and configuring a Samba-AD server
  - Samba-AD on Redhat (and derivatives)
  - Samba-AD on Debian (and derivatives)
  - Further documentation

Securing Samba-AD

- Advanced features of Samba Active Directory
- Samba-AD and MS-AD
- Forest Functional Level 2016 and AD Schema 2022

Configuring AD clients

- Working with Samba-AD and Microsoft AD
  - Adding a Windows AD to your Samba Active Directory domain
  - Migrating a Samba domain to a Microsoft domain
- Configuring Samba-AD as a file server
  - Setting up a Samba File Server on RedHat10 and derived distributions
  - Setting up a Samba File Server on Debian
  - Handling common errors with the Samba file server
- Joining members to the Active Directory domain
  - Integrating Windows machines in the Samba-AD domain
  - Integrating Linux machines in the Samba-AD domain
  - Managing NTP on Windows clients
  - Applying group strategies to enhance security
  - Protecting Domain Windows PCs and Servers with SRP

Additional readings

- Migrating from Samba3-NT4 to Samba-AD
  - Preparing Samba-AD Active Directory
  - Migrating the Samba3-NT4 user base
  - Migrating from Samba3-NT4 to Samba-AD
- Synchronizing SYSVOLs between multiple domain controllers
  - Introducing the SysvolSync Utility
  - Packaging the SysvolSync Utility
- Rebuilding a crashed Domain Controller
  - If the AD is a primary DC (with the FSMO role)
  - If the AD is a secondary DC (without the FSMO role)
  - Validating the new installation
  - Useful links
- Using Python to administer Samba-AD
  - Importing the necessary Python libraries
  - Creating the Python classes that will help you
  - Acting on the Organizational Units
  - Acting on users
  - Acting on groups
  - Searching for objects in an Active Directory Samba Forest
  - Acting on attributes

Additional ressources

- Final configuration of the smb.conf
- Compiling Samba from source
- Common mistakes with Samba-AD, tips and tricks
- Transferring your Samba3-NT4 to a new host
- Installing and configuring Bind-DLZ for Samba-AD

Appendix

- Glossary
- Contact Tranquil IT for your Samba-AD project
- Useful links to our resources
- Security Advisories