Migrating a Windows NT4 PDC to Linux

See also:

• Linux Overview
• Various Linux Distros (distributions)
• Documentation about Linux
• Building Routers with Linux
• Running off a Flash Drive
• Installing Debian 4 Linux on a RAID Array
• Linux and SAMBA
• Configuring Debian 3.1 (Sarge)

Various Samba Links

• 2010-Sep-12: Configuring a Samba server for a Windows domain, including how to configure for Administrator account login. [9368] [1]
• Sept'05 discussion of the future plans for Samba [4226] [1]
• Here's a list of useful articals on Samba. [4225] [1]
• how to demote a Windows PDC to BDC, also discussed here, and here [4224] [1]
• Problems with capitalization in the account names during migration [4223] [1]
• More on the migration process [4222] [1]
• Migrating an NT4 Domain to Samba-3 [4221] [1]
• A tutorial on the process of migrating from NT4 to Samba3 [4220] [1]
• The samba mail list archives [4219] [1]
• Issues with XP and roaming profiles [4218] [1]
• How To: Implement Samba as your PDC [4217] [1]
• How To: NT4 to Samba3 LDAP Migration [4216] [1]

Migrating a Windows NT4 PDC to Linux (Debian Etch) and Samba 3.0

Much of this procedure is based on Replace Your NT4 Domain Controller with Samba 3 (Part 2) By Carla Schroder, which is one of the few articles that almost worked. Of course samba.org is the main support site for all things relating to Samba, and the Official HOWTO has a whole chapter: Migration from NT4 PDC to Samba-3 PDC that documents this process too (but misses some essential steps, which might be obvious to an experienced Samba person but won't be done by the inexperienced as they are following a documented procedure).

Install Your Linux

Before starting the install you need to set your BIOS clock to GMT time as they don't seem to accommodate local time in the BIOS.

Install Debian, just the standard packages and the file server packages (which I think gets you Samba).

Once installed and rebooted you'll probably want to add "ssh" to your system by doing an "apt-get install ssh".

At this point you've spent about 20 minutes and should have a functioning server that you can now boot without a monitor, keyboard and mouse attached and control via SSH. It will be running a minimal Samba at this time, but we'll shut that down shortly.

Create a BDC Server Machine Account

1. stop the samba services by doing: /etc/init.d/samba stop
2. login to the NT4 server, start up the "Server Manager" (its in the Administrative Tools area of the Start menu) and then add the new machine as a BDC server. The detailed steps are:
   1. Menu: Computer / Add to Domain...
   2. Select: Windows NT Backup Domain Controller
   3. enter the computer name and then press "Add"
   4. then press "Close"
   5. Now you should see the new computer in the list and it should be identified as being "Windows NT Backup"
   6. close the server manager
3. If you have any old machine or user accounts for machines that no longer exist now would be a good time to remove then from the NT4 domain database.

Initially Configure Samba as a BDC

[global]
     workgroup = BUTLER
     netbios name = STAR6
     passdb backend = tdbsam
     domain master = No
     domain logons = Yes
     os level = 40
     add user script = /usr/sbin/useradd -m '%u'
     delete user script = /usr/sbin/userdel -r '%u'
     add group script = /usr/sbin/groupadd '%g'
     delete group script = /usr/sbin/groupdel '%g'
     add user to group script = /usr/sbin/usermod -G '%g' '%u'
     add machine script = /usr/sbin/useradd -s /bin/false -d /dev/null '%u'
#     username map = /etc/samba/smbusers
     logon path =
     logon home =
#     wins support = yes

[files]
        comment = SAMBA File Server
        path = /files
        read only = No

Next you need to set the root account password into Samba. Do this by running "smbpasswd" and entering the password.

Now check that the smb.conf file is reasonable, run the command "testparm" and make sure it reports: "Server role: ROLE_DOMAIN_BDC". If it does not, then there's something wrong with your smb.conf file.

Now find out what your Samba box's SID is currently set to, issue the command "net getlocalsid" and you'll get something like: S-1-5-21-2906888183-500865873-4023403494. Make a note of it somewhere.

Get Domain Information

Then complete the process of adding your Samba box into the existing NT Domain with a command like: net rpc join -S nova -U administrator note that you should replace nova with the name of your Windows Domain server machine (not the domain name).

Next get a copy of the account information by doing: net rpc vampire -S nova -w butler -U administrator note that you need to replace butler with your domain name. This command will print a lot of output, listing all the accounts and machines that are being transferred. It might also print some errors (especially on very old abandoned machines and accounts), you should probably check later to see if any of those errors are for things you actually need so save a copy of the output.

The "net vampire" is described as acquiring the full account database and other things needed for the Linux box to take over the full PDC role, but from the testing I did it appears that it does not acquire the SID for the domain. Because of this you will find that if you just follow the usual examples and enable the Samba server to take on the PDC role that not all things will work.

It appears you need to do one more step, first re-issue the net getlocalsid command and verify that the SID has not changed. Now issue the command net rpc getsid -S nova -U Administrator" and note that its output:

Storing SID S-1-5-21-1965320917-1955335400-7473742 for Domain BUTLER in secrets.tdb

So you need to issue one more command like: net setlocalsid S-1-5-21-1965320917-1955335400-7473742 and then the Linux Samba server will really have the same SID as the old PDC (which is how Microsoft documents a BDC as functioning)

Shutdown the NT PDC

Now you need to stop Samba as well: /etc/init.d/samba stop.

Then edit your smb.conf file so that:

  domain master = Yes
  wins support = Yes

Test Your Samba Server

1. login/logout of a windows workstation using a domain account
2. change the password on a domain account from within windows
3. remove a windows box from the domain and put it back in to the domain. On this one you will hit a small snag: it will probably refuse to add the machine when you use the domain Administrator account - you will need to use the Linux box's "root" for user name and the root password. You can get around this by adding an "smbusers" file that contains the single line root = Administrator and uncommenting the line username map in the smb.conf file. But then all the files and directories that Administrator creates from within windows will show as root ownership.
4. add some sub directories under /files and "chown" and "chgrp" them to a few different users, then verify that you can restrict access as to who can read and write those directories appropriately.
5. check that printer sharing works (I never played with this, so its not even in the smb.conf file)
6. do a net groupmap list to see some of the group mapping
7. do a pdbedit -Lv to see details on what the vampire fetched.

How to Return Things to How They Used to Be

  domain master = No
#  wins support = Yes

About the worst that happened to me while I was testing and figuring this out was that on occasion when I went to login I would get the warning that the domain server could not be found and so it was going to use a roaming profile. Some times I had to set this back to a local profile by hand. Once I set the lines:

     logon path =
     logon home =

Building a Replacement for a Windows NT4 Server with Linux (Old Version)

• Did a test install of Linux using the Knoppix 3.7 distribution. This was done to an empty 40GB IDE drive partitioned as an 8GB root partition, a 512MB swap partition and a 31.5GB data partition. The installation was done following the instructions of Hack#33 in Knoppix Hacks (see above for information) and went without any surprises.
• Once the system was installed I could only see one partition, turns out the 31GB data partition was not mounted by default. To add this to the system I just needed to edit the /etc/fstab table to mount it at boot time and then make a directory in the root directory to mount it on and set the permissions on that directory. The fstab file looks like:

• By default Knoppix had installed so that it used DHCP to configure the LAN, as I wanted the server to have a static IP address I had to manually configure the card, this I did using the Knoppix tool from the KNOPPIX menu, sub-menu: "Network/Internet", item: "Network Card Configuration", which then runs as root and prompts you for the necessary information
  
• Tested doing an image backup of the installed Linux, used Acronis version 8.0 and it did a full backup of the partitions (with a verify) to a shared drive across my 100baseT LAN in under 30 minutes. Still need to do a test of the restoration process to see if that also goes smoothly.
• At this point I started playing with Samba, first I wanted to just get file sharing happening, to do this I created a new /etc/samba/smb.conf file:

• as per the example 2.1 in The Official SAMBA-3 Howto and Reference Guide. Since Knoppix does not start the Samba server at boot time I needed to add the following link:

• and then rebooted (this was only partially described in the Samba howto section 35.5.2). I also needed to add an smb password for my Windows box account with:

• I also configured the inetd to start at boot time by adding the following link:

• to start apache manually:

• apache log files are in /var/log/apache, config files are in /etc/apache,
  
• to allow individual users to manage their own html files on the server you get the user to make a public_html directory in their home directory, then you add a symbolic link in the /var/www/users directory that points to the user's public_html directory. So if the user is called fred:

• then when someone asks for the URL: http://server/users/fred/test.html they will be served this document from fred's own public_html directory
  
• to start apache at boot time:

• to reboot right away:

• todo:
  
• test restore of acronis image
• look for a Linux version of the DNS2Go client from Deerfield.com
  
• sort out how to configure SAMBA as a PDC to replace the old NT4 server

1. there were actually two Xaccess files on my system, one in /etc/X11/xdm and the other in /etc/kde3/kdm, I made the same change to both
2. upon connecting the VNC client prompted me for a password, and it did not accept any password I tried, so I added the "-securitytypes=none" parameter to the end of the command in the inetd.conf (this artical suggests that there should be a "-" on the securitytypes parameter)