This is a several year old blog post the briefly explains group policy under the hood

So I am looking into using service accounts to allow services to access network resources. My own use case is going to be Jellyfin but if this works I might try to use this for other services.

I have not set anything up as of yet but I am going to create a domain controller and then join Linux servers to it. On the Linux servers I am going to run podman under the service account. I am still working on how to store the password but my plan is to login to the service account via Pam and then to use pam mount to mount a network resource.

I'll create another post once I set this up.

So I am going to try to document how I joined a Windows 2022 server to a Samba domain. This is highly experimental and should not be attempted in anything production or important.

To do this you will need Samba 4.19 or newer. I used Fedora server in this case. The first step it to either create or use a existing domain. I recommend that you setup a time server when you setup Samba DCs as active directory (kerberos) is time dependent. Also make sure that your network and domain are working properly as you do not want to try this if there are existing issues.

To start, add ad dc functional level = 2012_R2 to smb.conf. if you are setting up a domain from scratch you can add the option --option="ad dc functional level = 2012_R2". Keep in mind you will need to do this for each DC in the domain.

After you have added that option the next step is to restart Samba. If you are using a new enough version there should not be any errors. The next step is to upgrade the forest, schema and functional levels. You can do this with these commands:

First check the current functional level:

sudo samba-tool domain level show

If everything is working correctly the Lowest function level of a DC should be 2012_R2. If it isn't you need to either upgrade the functional level with the above steps or you need to demote old domain controllers.

Once the lowest functional level is 2012_R2 you can upgrade the domain.

samba-tool domain schemaupgrade --schema=2012_R2
samba-tool domain functionalprep --function-level=2012_R2
samba-tool domain level raise --domain-level=2012_R2 --forest-level=2012_R2

I would also run a check on the database just in case. You may need to run it multible times.

samba-tool dbcheck --fix --yes --cross-ncs

Next, verify that everything shows 2012_R2 sudo samba-tool domain level show

I would also like to point out that Samba supports a 2016 functional level and a 2019 schema level but both of those are even more experimental.

The next step is to join a Windows Server as a DC. You can to join it just like you would join any other DC. Set the DNS and then use the server manager or Powershell to join the domain as a DC.

The next steps are important so do not skip them. On the Windows server you will need first force enable the sysvol. Run this command as Administrator:

 "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name "SysvolReady" -Value "1"

Next, you will need to setup NTP sync. Run this:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters" -Name "Type" -Value  "NTP"
net stop w32time
net start w32time

Once that it done you need to setup replication via robocopy. Follow the Samba Wiki: https://wiki.samba.org/index.php/Robocopy_based_SysVol_replication_workaround

After doing this setup I would reboot the DC. After that everything should work.

Sources:

https://www.samba.org/samba/history/samba-4.19.0.html

https://samba.tranquil.it/doc/en/samba_advanced_methods/samba_add_windows_active_directory.html

https://wiki.samba.org/index.php/Robocopy_based_SysVol_replication_workaround

!sambasoftware@lemmy.sdf.org

This is a community to discuss and to get support for Samba and related projects

I have created a new Samba community on lemmy.sdf.org

You can find it here:

!sambasoftware@lemmy.sdf.org

I think Samba is a great piece of software but it lacks good community support and engagement. I'm hopping to change that.

I have created a new Samba community on lemmy.sdf.org

You can find it here:

!sambasoftware@lemmy.sdf.org

My goal is to create a support network that is outside of the mailing list.