Recently we decided to upgrade our domain server, which sport a OSX Tiger installation, with a new Mac Mini Server with Snow Leopard.
Following all the Apple instructions on how to migrate the old installation to the new one, we encountered a big problem when it comes to Samba settings. All the old domain settings were preserved, but our WindowsXP clients couldn’t authenticate against the new server. Specifically the user account was authenticated successfully but the machine one doesn’t. This lead to the situation where XP users can access Windows machine only if there is a local profile on that machine, but even in this case they were left out of the domain resources.
We tried the migration assistant and the manual migration (as described in the Apple documentation) but none of them worked as advertised. After a lot of google searching it looked like the real culprit was that on the Snow Leopard server the domain SID was different than the old Tiger Server.
After a lot of trying I’ve succeeded to resolve this issue, using a manual migration of the services (which by the way, ends in a much cleaner installation, imo).
The first two steps (that will not be discussed here) involve the process of restoring the DNS database and the OpenDirectory backup from the old server to the new one. Doing that, assure us to have all the users and machine accounts, as well as passwords and the dns structure of the domain. Note that when upgrading the server to Opendirectory Master you should provide the same username and password of the old server’s Directory Administrator.
Now we can move to the Samba part, first of all we need to copy the /etc/smb.conf config file from the Tiger Server, renaming in something convenient like smb.conf.tiger, then copy all the contents of var/samba and var/db/samba from the Tiger server. The contents of var/db/samba is particularly important because contains the secrets.db file.
Restore the files on the new server machine, put smb.conf.tiger in /etc and the other 2 directories in the appropriate paths. Now edit the /etc/smb.conf on the new server, adding your custom configurations from the old smb.conf file after the ;END section of the file. Now you can activate the SMB service, setting the same Workgroup name and options like the old one, and provide the directory administrator username and password as requested.
In this phase the new domain SID for the samba server is generated, and stored in key configurations files. The trick is to get the old domain SID, change the new one with the latter, and inject it into the secrets.tb file. So, move back to the old server, open terminal and type
sudo net rpc info
you should see some informations, like domain name, sequence numbers and most important of all the domain SID, in the form a Guid like: S-1-5-21-etc… Copy that guid, and move back to the new server.
Open workgroup manager, authenticate as directory administrator, then choose preferences from the pull down menu. Flag the “Show all records tab and inspector” option, than click ok. You should now see a new icon near the users, computers and groups, like a bullseye, select it and from the pull down menu select config. In the selection pane, you should see some services, one of them is CIFSServer, select it and edit the 2 XMLPlist files. Those files contains an xml key with the domain SID and name, while the domain name should be the same as the old server one (if you configured correctly in Server Admin), the SID value is different. Copy the SID from the old server, overwriting the new one, on BOTH the xml files, then close the Workgroup Manager.
While should be sufficient to restart the samba service, I’ve noticed that the SID isn’t updated, so you need to restart the server. Once done, open terminal and type
sudo net rpc getSID
and you’ll see the “old domain” sid injected into the secrets.td file on the new server. Restart the server once more, and your XP clients will be able to authenticate to the new server like it was the old one, permitting users to access all the shared resources.
Hope this helps some other people in my situations!!!!
).
