Migration-MS-AD-to-SAMBA4

Capital Local Area Bank

Project Migration from Microsoft Windows 2003 Ad to Linux Samba 4 

Installation Of Samba 4 on linux Machine

1. Download tar package from samba site, we have downloaded samba 4.1.9

2. for the Installation full fill the basic requirement  of required library files.

3. Cd /download/samba4.1; ./configure --enable-debug –enable-selftest ; make && make install

4. Before creating a domain of before joining the domain make the environment ready .

hostname : entry in /etc/sysconfig/network 

define host : entry in /etc/hosts

network IP : setup : ip address and nameserver is important

disable selinux : entry in /etc/sysconfig/selinux : requires restart of the machine : init 6

disable iptables : /etc/init.d/iptables stop; chkconfig iptables off

5. Here comes the turning point, decide whether to make a testing enviroment with independent full funtionality or need to join in already running PDC

To make independent environment :

Provision the New domain with the below command 
# samba-tool domain provision –use-rfc2307 –interactive –use-ntvfs

To Join in already running PDC as an ADC:

Remove the smb.conf or just rename the file 

# mv -vf /usr/local/samba/etc/smb.conf mv -vf /usr/local/samba/etc/smb.conf.org

# samba-tool domain join domainname.rootdn DC -Uadministrator --realm=domainname.rootdn –use-ntvfs

# domainname.rootdn : capitalbank.co.in

# realm : preferred to be as same as domain name but we can modify it if required.
The above will join the two computers with there computer name and give the output Joined domain DOMAINNAME (SID S-1-5-21-53190096-2129939875-608521123) as a DC

The new domain is joined with SID.
To check hit the below command

# ldbsearch -H /usr/local/samba/private/sam.ldb '(invocationid=*)' --cross-ncs objectguid

This will provide the two SID one of the joined one and one of the already existing one now check whether both of them is resolvable or not by running below command.

# host -t CNAME SID._msdcs.domain.rootdn
# host -t CNAME  S-1-5-21-53190096-2129939875-608521123._msdcs.capitalbank.co.in

Copy the krb5.conf from samba to /etc/
# cp -vf /usr/local/samba/private/krb5.conf /etc/

Now start the samba, to do so hit the already implemented init script as below.
# /etc/init.d/samba start

Now check the samba process to confirm that its running properly
# ps -elf | grep samba | grep -v grep 
The above process count should be 14 
# ps -elf | grep samba | grep -v grep | wc -l

check whether administrator is able to login or not with the cli This check to authenticate via kerbrose 
# kinit administrator@DOMAIN.ROOTDN
# kinit administrator@CAPITAL.COM

Check things got Replicated or not by the below command
# samba-tool drs showrepl

Now Test the DNS its working properly or not
# host -t SRV _ldap._tcp.capitalbank.co.in.

# host -t SRV _kerberos._udp.capitalbank.co.in.

# host -t A pdc.capitalbank.co.in.

Now Check GPO’s got replicated or not by hitting below command :
# samba-tool gpo listall 
This will show’s the all policies

Now First Check roles by hitting below command
# samba-tool fsmo show

To transfer the role hit the below command
# samba-tool fsmo transfer –role=all

Now confirm the transferred role by below command
# samba-tool fsmo show

Note : If we seize the role the server will take over as a PDC forcefully to do so hit below
# samba-tool fsmo seize –roll=all ( suggested not to do if again want to use windows as a PDC)

Now Copy the sysvol from already running PDC to new AD just to take over apart from seize the role by this process PDC is reversible.

Now we can edit the policies on samba to do so do the below :
Login as an administrator on windows PC with the domain.

Now Install the RSAT update according to the machine 64 bit or 32 bit, packages were avaiable on share directory just have to re enable them and restart the samba
After installation of the update go to controle panel --> program and features --> turn windows feature on & off --> 
You will get the Screen having section Remote Server Administration Tool now enable the all the packages which required and want to use.
Now Press Windows --> all programs --> administrative tool and here you have all the required things to manage like DNS, GPO, USERS, GROUP and all the feature as vailable on MS AD

1. Now One more requirement was there to Implement DHCP Server with below Requirement
Users must get Dynamic IP
Dynamic Ip to be provided only when MAC address is allowed
Different Mac Group with different gateways.
The above will done by below configuration in dhcpd.conf
# vim /etc/dhcp/dhcpd.conf
subnet 10.0.0.0 netmask 255.255.255.0 {

option routers 10.0.0.69; # default router for all option subnet-mask 255.255.255.0; option domain-name “capital.com”; option domain-name-servers 10.0.0.26; # IP of doimain name server option ntp-servers 10.0.028; #Already Running NTP server range 10.0.0.50 10.0.0.254; # IP range to be used }

deny unknown-clients;
group	{

host cap1 { hardware ethernet 00:18:F3:1D:53:E9; } # Windows 7 Machine Test host cap2 { hardware ethernet 00:18:F3:1F:53:W9; } # Description ANY option routers 10.0.0.61; # Specific gateways for the above MAC address }

group 	{

host capd1 { hardware ethernet F8:0F:41:A6:62:A0; } # joined Machine 1 test host capd2 { hardware ethernet F8:0F:4E:A6:6G:A0; } # joined Machine 2 test }

:wq # to save and exit
Note : Be careful before doing any change on the above file as this is very imortant file befor editing always take a backup then edit save and restart the server and check if no issues then remove the backup , if having any issue you have done something wrong revert back with backup file and check to understand what you have done wrong is still having Issue let us know will take the remote session and help you out.
Note : Data will Migrate once all The Users Login to the new server it will automatically create the folders of the respective users then will Migrate the data to the respective user directory.