Manage Samba4 Active Directory Infrastructure from Windows10 via RSAT – Part 3

In this part of the Samba4 AD DC infrastructure series we will talk on how join a Windows 10 machine into a Samba4 realm and how to administer the domain from a Windows 10 workstation.

Once a Windows 10 system has been joined to Samba4 AD DC we can create, remove or disable domain users and groups, we can create new Organizational Units, we can create, edit and manage domain policy or we can manage Samba4 domain DNS service.

All of the above functions and other complex tasks concerning domain administration can be achieved via any modern Windows platform with the help of RSAT – Microsoft Remote Server Administration Tools.

Requirements

  1. Create an AD Infrastructure with Samba4 on Ubuntu 16.04 – Part 1
  2. Manage Samba4 AD Infrastructure from Linux Command Line – Part 2
  3. Manage Samba4 AD Domain Controller DNS and Group Policy from Windows – Part 4

Step 1: Configure Domain Time Synchronization

1. Before starting to administer Samba4 ADDC from Windows 10 with the help of RSAT tools, we need to know and take care of a crucial piece of service required for an Active Directory and this service refers to accurate time synchronization.

Time synchronization can be offered by NTP daemon in most of the Linux distributions. The default maximum time period discrepancy an AD can support is about 5 minutes.

If the divergence time period is greater than 5 minutes you should start experience various errors, most important concerning AD users, joined machines or share access.

To install Network Time Protocol daemon and NTP client utility in Ubuntu, execute the below command.

$ sudo apt-get install ntp ntpdate
Install NTP on Ubuntu
Install NTP on Ubuntu

2. Next, open and edit NTP configuration file and replace the default NTP pool server list with a new list of NTP servers which are geographically located near your current physical equipment location.

The list of NTP servers can be obtained by visiting official NTP Pool Project webpage http://www.pool.ntp.org/en/.

$ sudo nano /etc/ntp.conf

Comment the default server list by adding a # in front of each pool line and add the below pool lines with your proper NTP servers as illustrated on the below screenshot.

pool 0.ro.pool.ntp.org iburst
pool 1.ro.pool.ntp.org iburst
pool 2.ro.pool.ntp.org iburst

# Use Ubuntu's ntp server as a fallback.
pool 3.ro.pool.ntp.org
Configure NTP Server in Ubuntu
Configure NTP Server in Ubuntu

3. Now, don’t close the file yet. Move to the top at the file and add the below line after the driftfile statement. This setup allows the clients to query the server using AD signed NTP requests.

ntpsigndsocket /var/lib/samba/ntp_signd/
Sync AD with NTP
Sync AD with NTP

4. Finally, move to the bottom of the file and add the below line, as illustrated on the below screenshot, which will allow network clients only to query the time on the server.

restrict default kod nomodify notrap nopeer mssntp
Query Clients to NTP Server
Query Clients to NTP Server

5. When finished, save and close the NTP configuration file and grant NTP service with the proper permissions in order to read the ntp_signed directory.

This is the system path where Samba NTP socket is located. Afterwards, restart NTP daemon to apply changes and verify if NTP has open sockets in your system network table using netstat command combined with grep filter.

$ sudo chown root:ntp /var/lib/samba/ntp_signd/
$ sudo chmod 750 /var/lib/samba/ntp_signd/
$ sudo systemctl restart ntp
$ sudo netstat –tulpn | grep ntp
Grant Permission to NTP
Grant Permission to NTP

Use the ntpq command line utility to monitor NTP daemon along with the -p flag in order to print a summary of peers state.

$ ntpq -p
Monitor NTP Server Pool
Monitor NTP Server Pool

Step 2: Troubleshoot NTP Time Issues

6. Sometimes the NTP daemon gets stuck in calculations while trying to synchronize time with an upstream ntp server peer, resulting the following error messages when manually trying to force time synchronization by running ntpdate utility on a client side:

# ntpdate -qu adc1
ntpdate[4472]: no server suitable for synchronization found
NTP Time Synchronization Error
NTP Time Synchronization Error

when using ntpdate command with -d flag.

# ntpdate -d adc1.tecmint.lan
Server dropped: Leap not in sync
NTP Server Dropped Leap Not in Sync
NTP Server Dropped Leap Not in Sync

7. To circumvent this issue, use the following trick to solve the problem: On the server, stop the NTP service and use the ntpdate client utility to manually force time synchronization with an external peer using the -b flag as shown below:

# systemctl stop ntp.service
# ntpdate -b 2.ro.pool.ntp.org  [your_ntp_peer]
# systemctl start ntp.service
# systemctl status ntp.service
Force NTP Time Synchronization
Force NTP Time Synchronization

8. After the time has been accurately synchronized, start the NTP daemon on the server and verify from the client side if the service is ready to serve time for local clients by issuing the following command:

# ntpdate -du adc1.tecmint.lan    [your_adc_server]
Verify NTP Time Synchronization
Verify NTP Time Synchronization

By now, NTP server should work as expected.

Step 3: Join Windows 10 into Realm

9. As we saw in our previous tutorial, Samba4 Active Directory can be managed from command line using samba-tool utility interface which can be accessed directly from server’s VTY console or remotely connected through SSH.

Other, more intuitively and flexible alternative, would be to manage our Samba4 AD Domain Controller via Microsoft Remote Server Administration Tools (RSAT) from a Windows workstation integrated into the domain. These tools are available in almost all modern Windows systems.

The process of joining Windows 10 or older versions of Microsoft OS into Samba4 AD DC is very simple. First, make sure that your Windows 10 workstation has the correct Samba4 DNS IP address configured in order to query the proper realm resolver.

Open Control panel -> Network and Internet -> Network and Sharing Center -> Ethernet card -> Properties -> IPv4 -> Properties -> Use the following DNS server addresses and manually place Samba4 AD IP Address to the network interface as illustrated in the below screenshots.

join Windows to Samba4 AD
join Windows to Samba4 AD
Add DNS and Samba4 AD IP Address
Add DNS and Samba4 AD IP Address

Here, 192.168.1.254 is the IP Address of Samba4 AD Domain Controller responsible for DNS resolution. Replace the IP Address accordingly.

10. Next, apply the network settings by hitting on OK button, open a Command Prompt and issue a ping against the generic domain name and Samba4 host FQDN in order to test if the realm is reachable through DNS resolution.

ping tecmint.lan
ping adc1.tecmint.lan
Check Network Connectivity Between Windows and Samba4 AD
Check Network Connectivity Between Windows and Samba4 AD

11. If the resolver correctly responds to Windows client DNS queries, then, you need to assure that the time is accurately synchronized with the realm.

Open Control Panel -> Clock, Language and Region -> Set Time and Date -> Internet Time tab -> Change Settings and write your domain name on Synchronize with and Internet time server field.

Hit on Update Now button to force time synchronization with the realm and hit OK to close the window.

Synchronize Time with Internet Server
Synchronize Time with Internet Server

12. Finally, join the domain by opening System Properties -> Change -> Member of Domain, write your domain name, hit OK, enter your domain administrative account credentials and hit OK again.

A new pop-up window should open informing you’re a member of the domain. Hit OK to close the pop-up window and reboot the machine in order to apply domain changes.

The below screenshot will illustrate these steps.

Join Windows Domain to Samba4 AD
Join Windows Domain to Samba4 AD
Enter Domain Administration Login
Enter Domain Administration Login
Domain Joined to Samba4 AD Confirmation
Domain Joined to Samba4 AD Confirmation
Restart Windows Server for Changes
Restart Windows Server for Changes

13. After restart, hit on Other user and logon to Windows with a Samba4 domain account with administrative privileges and you should be ready to move to the next step.

Login to Windows Using Samba4 AD Account
Login to Windows Using Samba4 AD Account

Step 4: Administer Samba4 AD DC with RSAT

14. Microsoft Remote Server Administration Tools (RSAT), which will be further used to administer Samba4 Active Directory, can be downloaded from the following links, depending on your Windows version:

  1. Windows 10: https://www.microsoft.com/en-us/download/details.aspx?id=45520
  2. Windows 8.1: http://www.microsoft.com/en-us/download/details.aspx?id=39296
  3. Windows 8: http://www.microsoft.com/en-us/download/details.aspx?id=28972
  4. Windows 7: http://www.microsoft.com/en-us/download/details.aspx?id=7887

Once the update standalone installer package for Windows 10 has been downloaded on your system, run the installer, wait for the installation to finish and restart the machine to apply all updates.

After reboot, open Control Panel -> Programs (Uninstall a Program) -> Turn Windows features on or off and check all Remote Server Administration Tools.

Click OK to start the installation and after the installation process finishes, restart the system.

Administer Samba4 AD from Windows
Administer Samba4 AD from Windows

15. To access RSAT tools go to Control Panel -> System and Security -> Administrative Tools.

The tools can also be found in the Administrative tools menu from start menu. Alternatively, you can open Windows MMC and add Snap-ins using the File -> Add/Remove Snap-in menu.

Access Remote Server Administration Tools
Access Remote Server Administration Tools

The most used tools, such as AD UC, DNS and Group Policy Management can be launched directly from Desktop by creating shortcuts using Send to feature from menu.

16. You can verify RSAT functionality by opening AD UC and list domain Computers (newly joined windows machine should appear in the list), create a new Organizational Unit or a new user or group.

Verify if the users or groups had been properly created by issuing wbinfo command from Samba4 server side.

Active Directory Users and Computers
Active Directory Users and Computers
Create Organizational Units and New Users
Create Organizational Units and New Users
Confirm Samba4 AD Users
Confirm Samba4 AD Users

That’s it! On the next part of this topic we will cover other important aspects of a Samba4 Active Directory which can be administered via RSAT, such as, how to manage DNS server, add DNS records and create a reverse DNS lookup zone, how to manage and apply domain policy and how to create an interactive logon banner for your domain users.

Hey TecMint readers,

Exciting news! Every month, our top blog commenters will have the chance to win fantastic rewards, like free Linux eBooks such as RHCE, RHCSA, LFCS, Learn Linux, and Awk, each worth $20!

Learn more about the contest and stand a chance to win by sharing your thoughts below!

Matei Cezar
I'am a computer addicted guy, a fan of open source and linux based system software, have about 4 years experience with Linux distributions desktop, servers and bash scripting.

Each tutorial at TecMint is created by a team of experienced Linux system administrators so that it meets our high-quality standards.

Join the TecMint Weekly Newsletter (More Than 156,129 Linux Enthusiasts Have Subscribed)
Was this article helpful? Please add a comment or buy me a coffee to show your appreciation.

17 Comments

Leave a Reply
  1. Hello,

    I’m stuck on Step 10. When I run ping, I get these errors:

    C:\Users\Juston Griggs> ping relic.goneoweb.lan
    Ping request could not find host relic.goneoweb.lan. Please check the name and try again.

    C:\Users\Juston Griggs>ping goneoweb.lan
    Ping request could not find host goneoweb.lan. Please check the name and try again.

    but I can successfully ping just “relic”

    C:\Users\Juston Griggs>ping relic

    Pinging relic [10.16.24.16] with 32 bytes of data:
    Reply from 10.16.24.16: bytes=32 time<1ms TTL=64
    Reply from 10.16.24.16: bytes=32 time<1ms TTL=64
    Reply from 10.16.24.16: bytes=32 time<1ms TTL=64
    Reply from 10.16.24.16: bytes=32 time<1ms TTL=64
    

    Ping statistics for 10.16.24.16:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

    So I’m stuck on what might have gone wrong. Any suggestions?

    Thanks!

    Reply
  2. Hello,

    I tried to make the samba traffic encrypted by putting this smb encrypt = required at the GLOBAL section. Everything is fine except when I tried to launch rsat, request can’t be done with the error.

    Reply
  3. Hello,

    Me and my friend have exactly the same problem. When we try to join the domain we have that error “The join operation was not successful. This could be because an existing computer account having name “XXX” was previously created using a different set of credentials.

    Use a different computer name or contact your administrator to remove any stale conflicting account. The error was: Access is denied” Can u help us with that? Tried to reinstall like 5 times and always the same error.

    Cheers

    Reply
  4. How to make client windows can access home folder automatically when they are login using another computer.

    Thank you (^_^)

    Reply
  5. Somehow dns queries do not resolve on client. nslookup returns result but when pinging or browsing, no website is resolving.

    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation. All rights reserved.

    C:\>nslookup gmail.com
    50.56.168.192.in-addr.arpa
            primary name server = nobody.invalid
            responsible mail addr = nobody.invalid
            serial  = 1
            refresh = 3600 (1 hour)
            retry   = 1200 (20 mins)
            expire  = 604800 (7 days)
            default TTL = 10800 (3 hours)
    explanation.invalid     text =
    
            "Blocking is mandated by standards, see references on https://www.iana.o
    rg/assignments/locally-served-dns-zones/locally-served-dns-zones.xhtml"
    (root)  ??? unknown type 41 ???
    Server:  UnKnown
    Address:  192.168.56.50
    
    Non-authoritative answer:
    Name:    gmail.com
    Addresses:  2404:6800:4003:c02::53
              74.125.130.17
              74.125.130.18
              74.125.130.19
              74.125.130.83
    
    
    C:\>ping gmail.com
    

    Ping request could not find host gmail.com. Please check the name and try again.

    Reply
  6. Hi, it’s a very good tutorial you have done such a great job.

    I have an issue to join my samba ad dc on active directory, I can log into my windows computer join to the domain with my administrator user and password but i have nothing in my active directory “username and password not correct” error. Can everyone help me ?

    Reply
  7. Just a heads-up, but for Windows 10 October Update RSAT is no longer a separate download, but part of the “Manage optional features” in Windows Settings.

    Reply
  8. Thank you for your outstanding tutorial.

    I have windows 10 pro build 1709. After I installed RSAT package and reboot, I opened Control Panel -> Programs (Uninstall a Program) -> Turn Windows features on or off. But Remote Server Administration Tools was not listed. What does this mean?

    Thank you.

    Reply
  9. Hi there, I have the same problem with Windows 10. RSAT can read the domain users, policies, etc can make some changes to it but I can not create new users, groups, etc. When I try to issue New > User for example, it does nothing and does not print any errors…

    Reply
  10. I Have a problem with active directory domain controller in CentOS 7 with samba.

    I do the provisioning to domain and all step appear without error. I can join one Windows 10 user as Administrator. I installed RSAT for windows 10 and can load the domain configuration but can not manage the domain. If I want to add a new user or administrative unit, do not do it. It is as if the user does not have privileges to perform the task. Any idea for the issue?

    Reply
  11. Hi Cezar,

    Thank you for the reply. I have tried up many times and found that the windows machine is communicating with ldap server using ping and ssh from putty but when i try to join the windows enterprise/professional edition then i am getting error indicating that the server is not able to communicate.

    Any idea how to resolve.

    Reply
  12. Hi,

    It is working fine for single subnet but when i am trying to work on multiple subnets then the windows systems are not able to contact the pdc server.

    My testing network is 192.168.1.0/24 and working environment is 192.168.2.0/24 and 192.168.4.0/24.

    I am able to connect to the machine in the 192.168.1.0/24 network but i am unable to connect from 192.168.2.0 & 192.168.4.0.

    How to resolve this. Can any one help me.

    Reply
    • It has no importance in what network your servers are located as long as they are reachable. Make sure the routers have no block policies enabled and all domain traffic is allowed to pass through them. Check domain ports to pass routers. Can you at least ping the domain from other networks? DNS resolution works also?

      Reply
  13. Hello,

    I have a problem when try to join to domain and show a message “The network resource or device specified is no longer available”.

    Reply

Got Something to Say? Join the Discussion...

Thank you for taking the time to share your thoughts with us. We appreciate your decision to leave a comment and value your contribution to the discussion. It's important to note that we moderate all comments in accordance with our comment policy to ensure a respectful and constructive conversation.

Rest assured that your email address will remain private and will not be published or shared with anyone. We prioritize the privacy and security of our users.