HOME

Return to SambAD

RedHat10/sambaAD.

01- Network	02- SambaAD	03- PdnsRecursor	04- Settings	05- Maintenance
06- SecondaryAD	07- Samba-tool	08- Selinux	09- GnomeShell	10- Troubleshoots

5. Maintenance

5.1 Update.

https://samba.tranquil.it/doc/en/samba_config_server/redhat8/server_upgrade_samba_redhat.html
Download last version.
Example Redhat 10
wget -O /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-10 https://samba.tranquil.it/RPM-GPG-KEY-TISSAMBA-10
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-10
Make a backup before update.

samba -V  
systemctl stop samba  
  
samba-tool dbcheck  
If you have errors.  
samba-tool dbcheck --cross-ncs --fix --yes  
  
samba-tool ntacl sysvolcheck  
If you have errors.  
samba-tool ntacl sysvolreset  
  
samba-tool dbcheck  
samba-tool ntacl sysvolcheck  

rsync -avAX /var/lib/samba /root/backup_samba_20261004/

dnf update

Re-check Samba-AD

systemctl start samba  
samba -V  
systemctl stop samba  
  
samba-tool dbcheck  
If you have errors.  
samba-tool dbcheck --cross-ncs --fix --yes  
  
samba-tool ntacl sysvolcheck  
If you have errors.  
samba-tool ntacl sysvolreset  
  
samba-tool dbcheck  
samba-tool ntacl sysvolcheck  
systemctl start samba  

5.2 Backup and restore with tar.

Samba server is down.
My home folder is teacher.

Backup.
cd /var/lib
tar --acls -cvzf /home/teacher/my-samba-backup.tar samba
Restore.
cd /var/lib
mv samba samba_ori
tar --acls -xvzf /home/teacher/my-samba-backup.tar

The tar --acls command keeps the ACLS if the restore is on the server
but does not keep the ACLS if the restore is on another server.
ldbedit -H /var/lib/samba/private/idmap.ldb- CN=CONFIG The tar --acls command keeps the ACLS for another server if the server is stopped .
You must start the server from a Live CD Almalinux.
Then mount the server partitions and use the tar --acls command for backups.

5.7 list of groups.

Example.
Samba ad server: 192.168.40.47
Domain: dw.learn.lan

net rpc group -S 192.168.40.47 -U administrator

Password for [DW.LEARN\administrator]:
Read-only Domain Controllers
Enterprise Read-only Domain Controllers
Group Policy Creator Owners
Domain Controllers
Domain Guests
Domain Users
Schema Admins
Enterprise Admins
Domain Computers
Protected Users
DnsUpdateProxy
Domain Admins
Cert Publishers
RAS and IAS Servers
Allowed RODC Password Replication Group
Denied RODC Password Replication Group
DnsAdmins
Administrators
Users
Guests
Account Operators
Server Operators
Print Operators
Backup Operators
Replicator
Pre-Windows 2000 Compatible Access
Remote Desktop Users
Network Configuration Operators
Incoming Forest Trust Builders
Performance Monitor Users
Performance Log Users
Windows Authorization Access Group
Terminal Server License Servers
Distributed COM Users
IIS_IUSRS
Cryptographic Operators
Event Log Readers
Certificate Service DCOM Access

id "DW.LEARN\Users"

uid=3000026(DW.LEARN\users) gid=3000026(DW.LEARN\users) groups=3000026(DW.LEARN\users)

5.8 Groups that aren't visible.

getent group "NT Authority\system"

NT Authority\system:x:3000002:

getent group "NT Authority\authenticated users"

NT Authority\authenticated users:x:3000015:  

5.9 Be careful not to confuse the BUILTIN with the Domain.

getent group "BUILTIN\administrators"

BUILTIN\administrators:x:3000000:

getent group "DW.LEARN\administrators"

DW.LEARN\administrators:x:3000081: