1

I am setting up Samba as sole AD controller for a new domain following the official instructions. Everything appears to go fine with the domain provisioning, and I can get a kerberos ticket with kinit just fine; after that, however, things fail:

$ kinit administrator@EXAMPLE.COM
Password for administrator@EXAMPLE.COM: [OK]

$ klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator@EXAMPLE.COM

Valid starting       Expires              Service principal
05/17/2016 23:36:39  05/18/2016 09:36:39  krbtgt/EXAMPLE.COM@EXAMPLE.COM
    renew until 05/18/2016 23:36:36

$ smbclient -L localhost -U%
session setup failed: NT_STATUS_INVALID_SID

When attempting to join a windows desktop to the domain, I get a similar error:

The following error occurred attempting to join the domain "example.com":

The Security ID structure is invalid.

I see nothing enlightening in the logs and google has failed me too. My suspicion is that I'm missing a dependency not covered by the package system -- e.g. the package description notes that winbind is required for it to operate as an AD DC even though it's not a package dependency. Perhaps something else is too.

This is samba v4.3.9 running on Ubuntu 16.04.

Andrew
  • 1,134
  • 3
  • 10
  • 16
  • Have you solved that? Same problem here with Samba 4.2.10 running on Debian 8.5.0. – Antônio Medeiros Jun 20 '16 at 15:36
  • For suitably small values of "solved". I nuked the server and started from scratch. It worked the second time around but I have no idea why (and I ran into a different problem anyway). – Andrew Jun 23 '16 at 00:06

1 Answers1

2

I used to have a similar problem (Ubuntu 16.04 Samba server and Windows 10 workstation). When tried to join the Win computer to the domain appeared a window with the following message:

"The following error occurred attempting to join the domain "example.com":

The Security ID structure is invalid."

Solved rebooting the Ubuntu server, then join the Win 10 box with out problem. So... Install samba, restart the server then join the win client to the domain.

dienteperro
  • 41
  • 6