Working with Read Only Domain Controllers(RODC).

[Hemanth Thummala]

Hi ,

We are currently using samba 3.6.12 stack and uses windows active directory
for authentication.

While working with RODCs, we have learned that we need to perform some
manual steps in order to communicate with Read Only DCs consistently.

Basically we found people start working with RODCs in two ways.

1) Join the domain using writable DC and wait for the sync to happen on
RODCs.
2) Perform manual steps which are required by join process.

Approach #1 : Join the domain using Writable DC.

1) Perform domain join now using writable domain controller(net ads join -S
<writableDC>)
2) Allow this computer account credentials to be cached on RODC. On
writable DC(specified in webUI), run this command:
net localgroup "Allowed RODC Password Replication Group" <Samba server
NetBios name>$ /add
4) On Writable DC, Force the replication of computer account credentials to
RODC
command: REPADMIN /RODCPWDREPL <RODC-HOSTNAME> <RWDC-HOSTNAME>
<FQDN of samba server>

At this point, RODC should have the computer account credentials. And
controller should be able to talk to RODC from now onwards.

Approach #2: Join the domain using RODC

1) On one of the Read-Write DCs perform the following operations:
a. Pre-create the computer object and set the custom password for the
same.
cmd: net computer \\<Samba server NetBios name> /add & net user
<Samba server NetBios name>$ <custom password>

b. Allow this computer account credentials to be cached on RODC
eg: net localgroup "Allowed RODC Password Replication Group" <Samba
server NetBios name>$ /add

c. Force the replication of computer account credentials to RODC
eg: REPADMIN /RODCPWDREPL <RODC> <RWDC> <FQDN of Samba server>

2) On CC, need to set the CC account password same as the one provided in
pre-creation time(1a).
cmd: net -f changesecretpw
This will prompt for the password.Provide the same password given at
step 1a.


We have validated these steps internally and works fine for us. I am not
sure if Samba has some official documentation related to RODC support.
Someone can point me if we have such documentation. If not, we would need
your comments for the same.

Most of these steps are taken from following blog:
https://jorgequestforknowledge.wordpress.com/2009/01/01/domain-join-through-an-rodc-instead-of-an-rwdc/

Thanks,
Hemanth.

[Volker Lendecke]

Post by Hemanth Thummala
Hi ,
We are currently using samba 3.6.12 stack and uses windows active directory
for authentication.
While working with RODCs, we have learned that we need to perform some
manual steps in order to communicate with Read Only DCs consistently.
Basically we found people start working with RODCs in two ways.

Thanks for that intro!

My question would be: Can't we make this transparent in net
join?

Volker

[Hemanth Thummala]

Volker,

I am not sure if I understood your question correctly.

I believe we do not read(atleast in 3.6.12 version) the DC
properties(read-only/writable) during net join. If we chose(with auto
discovery) RODC during net join, it is going to be failed with
STATUS_NOT_SUPPORTED error as we attempt create the computer(member server)
object on rodc which is not permitted.

If we contact writable DC, we found that adding the computer account to
"Allowed RODC password replication" group is mandatory. Without that
winbindd trust secret checks were failing.

Thanks,
Hemanth.

Post by Hemanth Thummala

Post by Hemanth Thummala
Hi ,
We are currently using samba 3.6.12 stack and uses windows active

directory

Post by Hemanth Thummala
for authentication.
While working with RODCs, we have learned that we need to perform some
manual steps in order to communicate with Read Only DCs consistently.
Basically we found people start working with RODCs in two ways.

Thanks for that intro!
My question would be: Can't we make this transparent in net
join?
Volker
--
SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: [phone], fax: [phone]
AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen

[Richard Sharpe]

On Wed, Jan 14, 2015 at 10:47 AM, Hemanth Thummala

Post by Hemanth Thummala
Volker,
I am not sure if I understood your question correctly.
I believe we do not read(atleast in 3.6.12 version) the DC
properties(read-only/writable) during net join. If we chose(with auto
discovery) RODC during net join, it is going to be failed with
STATUS_NOT_SUPPORTED error as we attempt create the computer(member server)
object on rodc which is not permitted.
If we contact writable DC, we found that adding the computer account to
"Allowed RODC password replication" group is mandatory. Without that
winbindd trust secret checks were failing.

Do you have some patches for this?

Post by Hemanth Thummala
Thanks,
Hemanth.

Post by Hemanth Thummala

Post by Hemanth Thummala
Hi ,
We are currently using samba 3.6.12 stack and uses windows active

directory

Post by Hemanth Thummala
for authentication.
While working with RODCs, we have learned that we need to perform some
manual steps in order to communicate with Read Only DCs consistently.
Basically we found people start working with RODCs in two ways.

Thanks for that intro!
My question would be: Can't we make this transparent in net
join?
Volker
--
SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: [phone], fax: [phone]
AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen

[Volker Lendecke]

Post by Hemanth Thummala
Volker,
I am not sure if I understood your question correctly.
I believe we do not read(atleast in 3.6.12 version) the DC
properties(read-only/writable) during net join. If we chose(with auto
discovery) RODC during net join, it is going to be failed with
STATUS_NOT_SUPPORTED error as we attempt create the computer(member server)
object on rodc which is not permitted.

How does Windows handle this? Windows should be able to
transparently contact a writable DC at join time. Samba
should be able to do the same. This would most likely
involve code changes, that's why we have this thread. But it
does not sound magic.

Post by Hemanth Thummala
If we contact writable DC, we found that adding the computer account to
"Allowed RODC password replication" group is mandatory. Without that
winbindd trust secret checks were failing.

Here as well: Can Samba find out itself whether this
condition is fulfilled and if not, give an appropriate error
message? Or make winbind in that error condition choose a
writable DC?

Volker