Questions[zentyal](server)

currently i have one domain controller with zentyal (Community Edition). And i have 2 node already connected to domain.

So i setup Windows Failover Cluster, but i always got failed validate with error message access denied. Earlier i already create use with administrator level domain controller and this user already join to administrator group on every each node.

but still i got error access denied on validate step when i setup windows failover cluster.

this is impact or limitation from zentyal or need more configuration on zentyal ?

I can't write on all my clients (Windows 7 and Windows 10) in all my samba shares, even if the users are accepted on domain, and the permissions was maintained. The shares are on a NAS, ISCSI connected. The line in my /etc/fstab is:

UUID=98baebe4-ede3-4bed-a9e8-ff129f3988f4 /mnt/fileserver ext4 _netdev,user_xattr,acl,defaults 0 0

Until I was on Zentyal 5 everything was OK. The error that the client gives is: "No authorization to execute the operation". Where's the Samba log for this? I can read the files with all users. I tried to write with the domain admin, and no success. I tried to write from ssh, using root, with success. So I believe is a restriction of Samba and not on Linux level (operating system).

Addition: I tried to set a share "guest allowed" from Zentyal interface, and then, I can write in a Windows 10 client...

Addition: I receive the following error:

[2020/04/09 22:17:44.253864, 3] ../source3/smbd/smb2_server.c:3139(smbd_smb2_request_error_ex) smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] status[NT_STATUS_ACCESS_DENIED] || at ../source3/smbd/smb2_create.c:293

I've created a new domain in Zentyal Development 6. To quote their documentation:

By default each LDAP user has a personal /home/ directory on the server. If the File Sharing module is active this directory will be accessible to the specific user (and only to the user) through SMB/CIFS. Furthermore, if a Windows client host is joined to the domain this directory will be automounted as drive H:.

-- Zentyal Documentation

This reads as though disabling this is as simple as disabling the File Share module. However, this is not possible without also disabling the Directory Services module.

Domain Controller and File Sharing in Same Module (image)

This is NOT desirable in my environment. I've searched high and low for a way to turn this off, but I have been unsuccessful. There does not appear to be a way to disable this functionality in the web console and if I modify the configuration in dsa.msc the configuration is re-set after a minute or two.

This does not appear to be connected with any group policies as the policy item for this setting is left Not Configured, which tells me this is something with Zentyal itself.

There are a few forum posts on the Zentyal forums which have users asking about the same thing, but these either have no answer or in the case of the last one, relies on setting a group policy to fight override Zentyal.

It's worth noting that in the documentation linked above, there is a "General Settings" tab in the File Sharing module. This is missing in my configuration.

Imho, Domain Services and File Share should be two separate and disparate components that you would install separately. Following this pattern, disabling the home drive configuration is good, but disabling or removing Samba entirely would be even more ideal. Domain Controllers hosting files seems like a terrible design flaw and security hole in my mind, which is likely why Windows Server best practice says that you should NEVER install Domain Service and File Share roles on the same server.

Edit: I found this Zentyal document and two settings within:

SAMBA (/etc/zentyal/samba.conf)

# Uncomment this if you want to skip setting the home directory of the
# users while saving changes
#unmanaged_home_directory = yes

USERS (/etc/zentyal/users.conf)

# whether to create user homes or not
mk_home = yes

I set both of these items to 'no', but this saw no effect. The file share was created and new users have a home drive set.

I have server running Zentyal. And I have a problem with joining my domain. The problem exists with only my laptop. I've tried some other PC's and they successfully join the domain.

All the machines that I used run windows 7.

I tried to ping the domain controller from my laptop and it was successful. I also tried the other way around and that was also successful.

When I search Google I found some "fixes" that should work but they did not work for me.

1. I changed my dns server aadress to my domain controller.
2. I set my default gateway to domain controller ip but sill nothing.

Here's the error message that I get when I try to join the domain:

The domain name "KK" might be a NetBIOS domain name. If this is the case, verify that the domain name is properly registered with WINS.

If you are certain that the name is not a NetBIOS domain name, then the following information can help you troubleshoot your DNS configuration.

The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain "KK":

The error was: "DNS name does not exist." (error code 0x0000232B RCODE_NAME_ERROR)

I'm using Zentyal in order to use it as Domain Controller.

All the clients are Windows7.

I, as domain admin, need to install, in several computers, one application that requires admin privileges.

How can I do it remotely and with one order for all computer clients?