3

I am setting up a Primary Domain Controller on a small office network. I am following this guide

https://help.ubuntu.com/12.04/serverguide/samba-dc.html

I got it working on one machine a few weeks ago but now there is a new server. And the thing is i did not understand fully what i was doing the first time so I would appreciate if someone could clarify a few places in this guide. 

sudo net groupmap add ntgroup="Domain Admins" unixgroup=sysadmin rid=512 type=d

Then a note says 

Change sysadmin to whichever group you prefer.

I prefer? I dont know what I prefer here. What you recommend? And what implications will this have? will this mean that all unix user in this group would have domain admin status? If meaning anything..

Then this comes

net rpc rights grant -U sysadmin "EXAMPLE\Domain Admins" ....

Here sysadmin is the username, not group correct? And example is the name of my workgroup set earlier. Sysadmin is the name of the user I would use to register machines and add new users to the unix/samba, right?

Braiam
  • 69,112
Jepzen
  • 917

1 Answers1

1

The sysadmin is a hypothetical group, the *sys*tem *admin*istrators. It says "you prefer" so you could use any existing UNIX group that you want to provide access to the Domain. This becomes evident later when it says:

... user used to join the domain needs to be a member of the sysadmin group, as well as a member of the system admin group. The admin group allows sudo use.

So, the recommendation here is: use what you prefer, need, or feel like.

And what implications will this have? will this mean that all unix user in this group would have domain admin status?

The users in this group will have Domain Administrator status, since: sysadmin (the group) = Domain Admins (the group)

Here sysadmin is the username, not group correct? And example is the name of my workgroup set earlier. Sysadmin is the name of the user I would use to register machines and add new users to the unix/samba, right?

Yes. Yes. And again yes.

I reckon that the example can be a little confusing, but at very least is correct in all the steps. Is wrote like that since normally in the *NIX systems a user is member of a group with the same name:

permissions User   Group
-rw-r--r--  braiam braiam
Braiam
  • 69,112