Tips Samba : Migrating From Windows Server To Samba 4 Part 1

Ahmad Imanudin May 22, 2013 6 min read

Untuk melakukan Migrasi dari Windows Server ke Samba 4, sebenarnya hal yang dilakukan sama persis dengan yang dijelaskan pada artikel sebelumnya : https://www.imanudin.com/2013/05/21/tips-samba-membuat-bdcjoin-a-domain-as-a-dc-pada-samba-4/ dengan sedikit modifikasi dan tambahan konfigurasi. Untuk memudahkan pemahaman, berikut persiapan yang dilakukan :

INFORMASI SISTEM

Windows Server

Domain      : imanudin.com
Hostname    : windowsdc
IP Address  : 192.168.56.26

Linux Server

Domain     : imanudin.com
Hostname   : samba4
IP Address : 192.168.56.11
DNS 1      : 192.168.56.26 (Mengarah ke IP Windows Server)
DNS 2      : 192.168.56.11 (Mengarah ke IP dirinya sendiri)

INSTALASI DAN KONFIGURASI SAMBA 4

Sistem Operasi yang saya gunakan adalah CentOS dengan panduan instalasi merujuk pada artikel berikut :

Also Read: Tips Menambahkan External Warning pada Proxmox Mail Gateway

Ingat, jangan lakukan provisioning pada panduan part 4. Jika terlanjur melakukan provisioning, hapus file smb.conf pada folder instalasi Samba 4

Buang file smb.conf pada folder /usr/local/samba/etc/ dan edit file krb5.conf
[code lang=’bash’]
rm /usr/local/samba/etc/smb.conf
vi /etc/krb5.conf
[/code]
Isi seperti pada contoh berikut :
[code lang=’bash’]
[libdefaults]
dns_lookup_realm = true
dns_lookup_kdc = true
default_realm = IMANUDIN.COM
[/code]
Testing koneksi DNS dan Kerberos
[code lang=’bash’]
kinit administrator
klist
[/code]
Jalankan perintah berikut sebagai root
[code lang=’bash’]
/usr/local/samba/bin/samba-tool domain join imanudin.com DC -Uadministrator –realm=imanudin.com –dns-backend=BIND9_DLZ
[/code]
Berikut adalah proses join domain yang dilakukan :

[root@samba4 ~]# /usr/local/samba/bin/samba-tool domain join imanudin.com DC -Uadministrator –realm=imanudin.com –dns-backend=BIND9_DLZ
Finding a writeable DC for domain ‘imanudin.com’
Found DC windowsdc.imanudin.com
Password for [WORKGROUP\administrator]:
workgroup is IMANUDIN
realm is imanudin.com
checking sAMAccountName
Deleted CN=SAMBA4,OU=Domain Controllers,DC=imanudin,DC=com
Deleted CN=NTDS Settings,CN=SAMBA4,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=imanudin,DC=com
Deleted CN=SAMBA4,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=imanudin,DC=com
Adding CN=SAMBA4,OU=Domain Controllers,DC=imanudin,DC=com
Adding CN=SAMBA4,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=imanudin,DC=com
Adding CN=NTDS Settings,CN=SAMBA4,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=imanudin,DC=com
Adding SPNs to CN=SAMBA4,OU=Domain Controllers,DC=imanudin,DC=com
Setting account password for SAMBA4$
Enabling account
Calling bare provision
No IPv6 address will be assigned
Provision OK for domain DN DC=imanudin,DC=com
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=imanudin,DC=com] objects[402] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=imanudin,DC=com] objects[804] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=imanudin,DC=com] objects[1206] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=imanudin,DC=com] objects[1266] linked_values[0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=imanudin,DC=com] objects[402] linked_values[0]
Partition[CN=Configuration,DC=imanudin,DC=com] objects[804] linked_values[0]
Partition[CN=Configuration,DC=imanudin,DC=com] objects[1206] linked_values[0]
Partition[CN=Configuration,DC=imanudin,DC=com] objects[1520] linked_values[0]
Replicating critical objects from the base DN of the domain
Partition[DC=imanudin,DC=com] objects[93] linked_values[0]
Partition[DC=imanudin,DC=com] objects[299] linked_values[0]
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=imanudin,DC=com
Partition[DC=DomainDnsZones,DC=imanudin,DC=com] objects[26] linked_values[0]
Replicating DC=ForestDnsZones,DC=imanudin,DC=com
Partition[DC=ForestDnsZones,DC=imanudin,DC=com] objects[18] linked_values[0]
Partition[DC=ForestDnsZones,DC=imanudin,DC=com] objects[36] linked_values[0]
Committing SAM database
descriptor_sd_propagation_recursive: DC=DomainDnsZones,DC=imanudin,DC=com not found under DC=imanudin,DC=com
descriptor_sd_propagation_recursive: DC=ForestDnsZones,DC=imanudin,DC=com not found under DC=imanudin,DC=com
Sending DsReplicateUpdateRefs for all the replicated partitions
Setting isSynchronized and dsServiceName
Setting up secrets database
Joined domain IMANUDIN (SID S-1-5-21-1957489133-1293898768-425495568) as a DC

Tambahkan A record server Samba4 pada DNS Server. Hal ini dilakukan agar domain imanudin.com mengenali ip Samba4
[code lang=’bash’]
/usr/local/samba/bin/samba-tool dns add 192.168.56.26 imanudin.com samba4 A 192.168.56.11 -Uadministrator
[/code]
Keterangan : IP Address 192.168.56.26 merupakan IP Address Windows Server, samba4 merupakan nama hostname pada server Linux yang saya buat dan 192.168.56.11 merupakan ip address yang digunakan pada server Linux.

Tambahkan juga objectGUID pada DNS
[code lang=’bash’]
/usr/local/samba/bin/ldbsearch -H /usr/local/samba/private/sam.ldb ‘(invocationid=*)’ –cross-ncs objectguid
[/code]
Berikut output yang dihasilkan :

Also Read: Menambahkan Modul Set Flag Moderated melalui CLI pada Mailman

# record 1
dn: CN=NTDS Settings,CN=SAMBA4,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=imanudin,DC=com
objectGUID: 54cab258-2d26-4273-90c1-f88397bcb5ea

# record 2
dn: CN=NTDS Settings,CN=WINDOWSDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=imanudin,DC=com
objectGUID: 7e84d99e-5d0e-4ade-91a1-30f9f5970988

# returned 2 records
# 2 entries
# 0 referrals

Perhatikan tulisan yang diberi tanda tebal, object GUID yang dimiliki oleh Linux server Samba4 adalah 54cab258-2d26-4273-90c1-f88397bcb5ea, record tersebut harus dibuat dan dimasukkan pada DNS server agar Linux server Samba 4 dapat digunakan sebagaimana mestinya
[code lang=’bash’]
/usr/local/samba/bin/samba-tool dns add 192.168.56.26 _msdcs.imanudin.com 54cab258-2d26-4273-90c1-f88397bcb5ea CNAME samba4.imanudin.com -Uadministrator
[/code]
samba4.imanudin.com merupakan nama hostname Linux Samba4

Testing hasil penambahan DNS
[code lang=’bash’]
host -t A samba4.imanudin.com
host -t CNAME 54cab258-2d26-4273-90c1-f88397bcb5ea._msdcs.imanudin.com.
[/code]

STARTING SAMBA

Untuk melakukan starting samba, dapat merujuk pada link berikut pada bagian starting Samba : https://www.imanudin.com/2013/05/13/membangun-linux-active-directory-dengan-samba4-pada-redhatcentos-part-4-compile-install-provisioning-samba-4/

Pada saat Samba4 baru saja dijalankan, kemungkinan pada log samba akan muncul warning seperti berikut :

Also Read: Cara Membuat WhatsApp Gateway Sendiri dengan go-whatsapp-web-multidevice

UpdateRefs failed with WERR_DS_DRA_BAD_NC/NT code 0xc00020f8 for 5344d0a6-78a1-4758be69-66d933f1123._msdcs.imanudin.com CN=RID Manager$,CN=System,DC=imanudin,DC=com

Jalankan perintah berikut untuk solving problem diatas
[code lang=’bash’]
/usr/local/samba/bin/samba-tool drs kcc -Uadministrator windowsdc.imanudin.com
[/code]
windowsdc.imanudin.com merupakan nama hostname dari Windows Server

Check replikasi antara Windows Server DC dengan Samba 4 DC
[code lang=’bash’]
/usr/local/samba/bin/samba-tool drs showrepl
[/code]

Dari keterangan diatas tidak ada failure mengenai replikasi antara Windows Server dengan Samba4. Artikel berikutnya pembahasan mengenai Tips memindahkan GPO pada Samba4.

Silakan dicoba dan semoga bermanfaat 😀

Ahmad Imanudin

Ahmad Imanudin, Tinggal di Bekasi. Bekerja sebagai salah satu staff di PT. Excellent Infotama Kreasindo. Dapat dihubungi pada alamat surel ahmad [at] imanudin.com

17 thoughts on “Tips Samba : Migrating From Windows Server To Samba 4 Part 1”

Pingback: Tips Samba : Migrating From Windows Server To Samba 4 Part 2
rahid says:

September 10, 2013 at 4:34 pm

Mas imanudin :
jika ada minta password ini “Password for [WORKGROUP\administrator]:” diisi dengan password ynag mana?

Reply
rahmad says:

February 24, 2015 at 2:10 pm

Mas Iman

klo AD saya yg lama samba4. ketika saya migrasikan apakah data di pdc akan hilang?

Reply
jalaludin says:

May 5, 2015 at 11:23 am

kang,kalu sudah migrasi apakah kita harus membuat DNS sendiri di linux nya?

terimakasih

Reply
Ahmad Imanudin says:

May 5, 2015 at 2:30 pm

@Rahmad : Tidak hilang mas.
@Jalaludin : Jika DNS dari Windows Server tidak terambil, harus buat DNS juga di Linux-nya. Bisa dicek pada part2 😀

Reply
Nopriyan says:

June 29, 2016 at 9:06 pm

Mas klo boleh tanya saya saat migarasi gagal keluar pesan seperti berikut :
…..
Partition[CN=Configuration,DC=transtv,DC=co,DC=id] objects[5538] linked_values[0]
Partition[CN=Configuration,DC=transtv,DC=co,DC=id] objects[5693] linked_values[0]
Partition[CN=Configuration,DC=transtv,DC=co,DC=id] objects[5835] linked_values[0]
Failed to apply records: Failed to find GUID for (null): Invalid DN syntax
Failed to commit objects: WERR_GENERAL_FAILURE
Join failed – cleaning up
checking sAMAccountName
Deleted CN=AD1,OU=Domain Controllers,DC=transtv,DC=co,DC=id
Deleted CN=dns-AD1,CN=Users,DC=transtv,DC=co,DC=id
Deleted CN=NTDS Settings,CN=AD1,CN=Servers,CN=SMSSite,CN=Sites,CN=Configuration,DC=transtv,DC=co,DC=id
Deleted CN=AD1,CN=Servers,CN=SMSSite,CN=Sites,CN=Configuration,DC=transtv,DC=co,DC=id
ERROR(): uncaught exception – Failed to process chunk: NT_STATUS_UNSUCCESSFUL
…..

ini kenapa ya?? ada solusi gk mas?
migrasi dari win ser 2k3

Reply
- Ahmad Imanudin says:
  
  June 30, 2016 at 9:15 am
  
  Hi mas Nopriyan,
  
  Hal tersebut biasanya karena data yang ada sudah terlalu banyak (user, ou, group dll).
  Tapi pastikan saja jam antara W2k3 dan Samba4 sama (bisa pake NTP). Kemudian coba kembali
  
  Reply
  - Nopriyan says:
    
    July 1, 2016 at 4:36 am
    
    tetap gagal mas, sudah dipastikan untuk time nya sama,,dikarenakan memakai ntp yang sama.
    
    untuk user memang banyak hampir 500.
    
    apa memang ada batasan user untuk migrasi??
    
    Reply
    - Ahmad Imanudin says:
      
      July 3, 2016 at 3:45 pm
      
      Hi mas,
      
      Untuk batasan Migrasi seharusnya tidak ada
      
      Reply
ruben says:

January 12, 2017 at 10:52 pm

mas imam kalau mau migrasi datasharing yg tdk joint domain ke linux bagaimana? boleh dibantu kasih informasinya.

Reply
- Ahmad Imanudin says:
  
  January 15, 2017 at 7:32 am
  
  Hi mas Ruben,
  
  Secara umum, jika tidak join domain cukup buat saja si Samba sebagai file share kemudian pindahkan data2nya.
  
  Reply
Bobby says:

June 20, 2018 at 11:21 am

Mas Iman,
Klo error seperti ini :

/usr/local/samba/bin/samba-tool domain join pif.co.id DC -Uadministrator –realm=pif.co.id –dns-backend=BIND9_DLZ
Finding a writeable DC for domain ‘pif.co.id’
Found DC tgr05-dc.pif.co.id
Password for [WORKGROUP\administrator]:
workgroup is PIF
realm is pif.co.id
checking sAMAccountName
Deleted CN=CAD-IT101,CN=Computers,DC=pif,DC=co,DC=id
Adding CN=CAD-IT101,OU=Domain Controllers,DC=pif,DC=co,DC=id
Adding CN=CAD-IT101,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=pif,DC=co,DC=id
Adding CN=NTDS Settings,CN=CAD-IT101,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=pif,DC=co,DC=id
Adding SPNs to CN=CAD-IT101,OU=Domain Controllers,DC=pif,DC=co,DC=id
Setting account password for CAD-IT101$
Enabling account
Calling bare provision
More than one IPv4 address found. Using 192.168.20.160
No IPv6 address will be assigned
Provision OK for domain DN DC=pif,DC=co,DC=id
Starting replication
Join failed – cleaning up
checking sAMAccountName
Deleted CN=CAD-IT101,OU=Domain Controllers,DC=pif,DC=co,DC=id
Deleted CN=NTDS Settings,CN=CAD-IT101,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=pif,DC=co,DC=id
Deleted CN=CAD-IT101,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=pif,DC=co,DC=id
ERROR(runtime): uncaught exception – (-1073741643, ‘NT_STATUS_IO_TIMEOUT’)
File “/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/__init__.py”, line 175, in _run
return self.run(*args, **kwargs)
File “/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/domain.py”, line 552, in run
machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
File “/usr/local/samba/lib64/python2.7/site-packages/samba/join.py”, line 1104, in join_DC
ctx.do_join()
File “/usr/local/samba/lib64/python2.7/site-packages/samba/join.py”, line 1009, in do_join
ctx.join_replicate()
File “/usr/local/samba/lib64/python2.7/site-packages/samba/join.py”, line 731, in join_replicate
replica_flags=ctx.replica_flags)
File “/usr/local/samba/lib64/python2.7/site-packages/samba/drs_utils.py”, line 248, in replicate
(level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, req_level, req)

ada kendala dimana ya mas ?
Thanks..

Reply
- Ahmad Imanudin says:
  
  June 21, 2018 at 10:00 pm
  
  Hi mas,
  Saya sudah lama belum coba lagi. Tapi jika dilihat dari pesannya, coba masukkan masing-masing nama server di /etc/hosts agar bisa lookup via hosts
  
  Reply
  - Bobby says:
    
    June 22, 2018 at 8:50 am
    
    Contoh masukin nama” servernya gimana mas ?
    saya coba seperti ini masukin nama” nya di /etc/hosts, dan saya coba lagi masih error yang sama mas ..
    ldap._tcp.pif.co.id has SRV record 0 100 389 test-machine.pif.co.id
    ldap._tcp.pif.co.id has SRV record 0 100 389 tgr05-dc.pif.co.id
    ldap._tcp.pif.co.id has SRV record 0 100 389 mlg-dc10.pif.co.id
    ldap._tcp.pif.co.id has SRV record 0 100 389 pwk3-dc.pif.co.id
    ldap._tcp.pif.co.id has SRV record 0 100 389 bgr3-dc.pif.co.id
    ldap._tcp.pif.co.id has SRV record 0 100 389 crb04-dc.pif.co.id
    ldap._tcp.pif.co.id has SRV record 0 100 389 bdg-dc04.pif.co.id
    ldap._tcp.pif.co.id has SRV record 0 100 389 sby-dc01.pif.co.id
    ldap._tcp.pif.co.id has SRV record 0 100 389 dns-server.pif.co.id
    ldap._tcp.pif.co.id has SRV record 0 100 389 bks05-dc.pif.co.id
    ldap._tcp.pif.co.id has SRV record 0 100 389 dps04-dc.pif.co.id
    
    Thanks,
    
    Reply
    - Ahmad Imanudin says:
      
      July 25, 2018 at 10:14 pm
      
      Hi mas,
      
      Bisa dibuka via vi ataupun nano file /etc/hosts nya. Contoh isinya seperti ini
      
      127.0.0.1 localhost 192.168.1.11 ad.imanudin.com ad 192.168.1.12 bdc.imanudin.com bdc
      
      Reply
alvian says:

September 23, 2019 at 4:41 pm

hai mass
maaf tanya waktu sya mau join ke AD pakai samba-tools join muncul error seperti ini, mungkin bsa dibantu mas maksudnya apa ya
trmks
workgroup is VISIONET
realm is visionet.co.id
checking sAMAccountName
Adding CN=VN-LDAP-02-UPH,OU=Domain Controllers,DC=visionet,DC=co,DC=id
Adding CN=VN-LDAP-02-UPH,CN=Servers,CN=UPH,CN=Sites,CN=Configuration,DC=visionet,DC=co,DC=id
Join failed – cleaning up
checking sAMAccountName
Deleted CN=VN-LDAP-02-UPH,OU=Domain Controllers,DC=visionet,DC=co,DC=id
ERROR(ldb): uncaught exception – LDAP error 68 LDAP_ENTRY_ALREADY_EXISTS –
File “/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py”, line 175, in _run
return self.run(*args, **kwargs)
File “/usr/lib/python2.7/dist-packages/samba/netcmd/domain.py”, line 621, in run
machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
File “/usr/lib/python2.7/dist-packages/samba/join.py”, line 1170, in join_DC
ctx.do_join()
File “/usr/lib/python2.7/dist-packages/samba/join.py”, line 1073, in do_join
ctx.join_add_objects()
File “/usr/lib/python2.7/dist-packages/samba/join.py”, line 555, in join_add_objects
ctx.samdb.add(rec)

Reply
- Ahmad Imanudin says:
  
  September 24, 2019 at 8:17 am
  
  Hi mas,
  Jika dilihat dari pesannya sih already exists. Tapi ngga jelas apanya yang exist :D. Sudah lama ngga coba Samba4 lagi. Jadi pada lupa 🙂
  
  Reply