Samba Active Directory
Working reference: Consolidated from prior BarnesBears configuration sessions. Verify live state before changing domain services.
Domain
| Item | Value |
|---|---|
| DNS domain | barnesbears.xyz |
| Base DN | DC=barnesbears,DC=xyz |
| Primary controller | ad-1 — 192.168.10.28 |
| Second controller | ad-2 — 192.168.10.29 |
| Second controller OS | Debian 13 (last observed) |
| Second controller Samba | 4.22.10 (last observed) |
Both DCs were previously verified in DNS SRV records and Samba AD replication checks.
DNS
Clients should use AD-aware DNS resolvers, normally both domain controllers. AdGuard (192.168.10.82) provides DNS filtering; a previous conditional forwarding loop was removed. DHCP is administered through UniFi.
See DNS and Directory Services.
Replication
Samba database replication and SYSVOL synchronization are separate concerns. Check replication with:
samba-tool drs showrepl
samba-tool fsmo show
Do not run database repair options without a tested backup and recovery plan.
SYSVOL
A scheduled synchronization from ad-1 to ad-2 was established using sysvol-sync.service and sysvol-sync.timer. Confirm current timer, direction, ACLs and policy versions.
systemctl list-timers --all | grep -i sysvol
systemctl cat sysvol-sync.service
journalctl -u sysvol-sync.service -n 50 --no-pager
A successful timer run does not alone establish that files and permissions are correct.
Time
Chrony was configured with ad-1 preferred and ad-2 as backup for managed hosts. Verify active synchronization with chronyc sources -v.
Domain-connected applications
Linux machines use realmd/SSSD where applicable. Nextcloud uses LDAPS with a dedicated service account and Nextcloud Users group filtering. Keycloak realm BarnesBears provides application SSO for selected services.
A prior Mobility Print problem was resolved after SSSD cache/service troubleshooting; separate unprivileged LXC UID/GID mapping limitations were also observed.
Recovery cautions
Back up domain controllers using supported Samba-aware procedures. Do not restore old VM snapshots into a healthy multi-controller domain without a deliberate recovery plan. Confirm DNS, replication, Kerberos, time and SYSVOL after maintenance.