On Thu, Oct 29, 2015 at 09:43:41AM +0100, Davor Vusir wrote:
Hi all!
We have got many delegations in our AD. To add a certain administrator group
to the local Administrators group you can use GPO for Windowsservers. As
Samba does not understand GPO I have initially used the "username map"
feature to add a domain account to become root. After the appropriate group
is added via Computer Management MMC by the delegated administrator, the
line "username map" is commented and Samba is restarted. After this
procedure the delegated administrators have got proper access to the server.
Not using this feature of course renders access denied error when attempting
to add an AD-group to the local Administrators group.
If Winbind is disabled you get the well known SID in members list in the
properties dialog for the local Administrators group instead of the human
readable names (AD\Domain Admins...).
Maybe SSSD's version of libwbclient might help here. It is available on
Fedora/RHEL in the sssd-libwbclient package. It might be necessary to use
the alternatives tool to switch from the Samba version of the library to
SSSD's version.
Please note the SSSD's libwbclient does not implement the comple API of
libwbclient so it might not fix all yours needs.
HTH
bye,
Sumit