All, I've got a Samba 3 PDC serving numerous XP clients, and I'm getting an error I wouldn't have expected. When trying to rename an XP machine joined to the domain (via "netdom renamecomputer"), the command fails unless the specified domain user has UID 0.
The command in question: netdom renamecomputer %COMPUTERNAME% /newname:%NEWNAME% /userD:DOMAIN\USER /passwordd:PASSWORD /force fails with "error 5: Access is denied" for UID >0 accounts, and succeeds for an account with UID 0. Some background: I have the following group mappings: net groupmap list Domain Administrators (S-1-5-21-1079125125-2089603153-60846589-512) -> Domain Admins Domain Users (S-1-5-21-1079125125-2089603153-60846589-513) -> Domain Users Domain Guests (S-1-5-21-1079125125-2089603153-60846589-514) -> Domain Guests Domain Admins has a few members; among them, account testadmin has UID 0, and account printsetup has UID 12632. Domain Admins has the following rights: net rpc rights list "Domain Admins" SeMachineAccountPrivilege SePrintOperatorPrivilege SeAddUsersPrivilege SeRemoteShutdownPrivilege SeDiskOperatorPrivilege "Domain Admins" members have no individual rights assigned; rights are assigned to the group only. So, it comes down to this: printsetup and testadmin have the same rights, the same group memberships, the same everything except UID. I've looked through the available rights list in the Samba docs and didn't see a specific "rename computer" right, and I would have expected membership in "Domain Admins" to be sufficient. However, I've found that UID >0 accounts can't rename domain computers; UID 0 accounts can. Is this a known issue? I haven't seen anything in the docs, but I'll be digging in again shortly. High-level debugs available upon request. Thanks, Ryan
------------------------------------------------- This email transmission and any documents, files or previous email messages attached to it may contain information that is confidential or legally privileged. If you are not the intended recipient, you are hereby notified that any disclosure, copying, printing, distributing or use of this transmission is strictly prohibited. If you have received this transmission in error, please immediately notify the sender by telephone or return email and delete the original transmission and its attachments without reading or saving in any manner. The Evangelical Lutheran Good Samaritan Society. ---------------------------------------------------------
-- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
