Доменконтроллер на SAMBA 5.6, пользователи в OpenLDAP.
Windows машины введенные в домен не видят пользователей в группах.
Например:
На windows машине группа SMBDOMAIN/Domain Admins входит в группу Administrators, пользователь SMBDOMAIN/admin в свою очередь входит в группу SMBDOMAIN/Domain Admins.
По идее он должен обладать админ привилегиями на винде, но вот только не работает такая схема.
Кто сталкивался с такой проблемой и как она решается не подскажите?
Конфиг SAMBA, делал на основе этой статьи
# Global parameters
[global]
workgroup = SMBDOMAIN
server string = Samba Server
netbios name = SAMBA
hosts allow = 192.168.0. 192.168.2. 127.
# passwd backend
encrypt passwords = yes
passdb backend = ldapsam:ldap://ldap.local.domain.com/
enable privileges = yes
pam password change = Yes
passwd program = /usr/bin/passwd %u
passwd chat = *New*UNIX*password* %nn *ReType*new*UNIX*password* %nn * passwd:*all*authentication*tokens*updated*successfully*
unix password sync = Yes
# Log options
log level = 10
log file = /var/log/samba/%m
max log size = 50
syslog = 0
# Name resolution
name resolve order = wins bcast host
# misc
timeserver = Yes
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
use sendfile = yes
veto files = /*.eml/*.nws/*.{*}/
veto oplock files = /*.doc/*.xls/*.mdb/
deadtime = 120
# Dos-Attribute
map hidden = No
map system = No
map archive = No
map read only = No
store dos attributes = Yes
# printers - configured to use CUPS and automatically load them
load printers = No
# scripts invoked by samba
add user script = /usr/local/sbin/smbldap-useradd -m %u
delete user script = /usr/local/sbin/smbldap-userdel %u
add group script = /usr/local/sbin/smbldap-groupadd -p %g
delete group script = /usr/local/sbin/smbldap-groupdel %g
add user to group script = /usr/local/sbin/smbldap-groupmod -m %u %g
delete user from group script = /usr/local/sbin/smbldap-groupmod -x %u %g
set primary group script = /usr/local/sbin/smbldap-usermod -g %g %u
add machine script = /usr/local/sbin/smbldap-useradd -w %m
# LDAP-iConfiguration
ldap delete dn = Yes
ldap ssl = off
ldap passwd sync = Yes
ldap suffix = dc=local,dc=domain,dc=com
ldap machine suffix = ou=Computers
ldap user suffix = ou=Users
ldap group suffix = ou=Groups
ldap idmap suffix = ou=Idmap
ldap admin dn = cn=Manager,dc=local,dc=domain,dc=com
idmap backend = ldap:ldap://ldap.local.domain.com
idmap uid = 10000-20000
idmap gid = 10000-20000
# logon options
logon path =
logon drive = Z:
# setting up as domain controller
username map = /usr/local/samba/usermap
preferred master = Yes
wins support = Yes
wins proxy = No
client ntlmv2 auth = yes
lanman auth = yes
ntlm auth = Yes
dns proxy = No
domain logons = Yes
domain master = Yes
local master = Yes
os level = 64
map acl inherit = Yes
unix charset = UTF8
inherit permissions = Yes
inherit acls = Yes
inherit owner = Yes
vfs objects = zfsacl
nfs4:mode = special
nfs4:acedup = merge
nfs4:chown = yes
