HP CIFS Server Administrator's Guide Version A.02.04.05 (5900-2302), April 2012

encrypt passwords = yes
security = user
[netlogon]
comment = The domain logon service
path = /var/opt/samba/netlogon
writeable = no
guest ok = no
• The smb.conf file is as shown if the HP CIFS Server acting as a BDC uses the LDAP backend
to store UNIX and Samba account databases:
[global]
workgroup = SAMBADOM #Samba Domain
security = user
domain logon = yes
domain master = no
encrypt passwords = yes
passdb backend = ldapsam:ldap://ldapserver:389
• When you configure the relative domain controller parameters, ensure that the
/var/opt/samba/netlogon subdirectory for the domain logon service exists.
HP CIFS does not implement a true SAM database and nor its replication. HP CIFS implementation
of BDCs is very much like a PDC with one important difference. A BDC is configured like a PDC
except the smb.conf parameter, domain master,mustbesettono.
NOTE: security: Set this parameter to user to ensure that Windows users, client machine
accounts, and passwords are stored and managed in the smbpasswd file or LDAP backend.
domain master: Set this parameter to no in order for the HP CIFS Server to act as a BDC.
domain logon: Set this parameter to yes to provide netlogon services.
Encrypt passwords: You set this parameter to yes, the passwords used to authenticate users
are encrypted. You must set this parameter to yes when you configure HP CIFS Server to act as
aBDC.
Promote a BDC to a PDC in a Samba Domain
If a PDC fails or needs to be taken out of services, simply set "domain master = yes"ona
BDC. It will then register the appropriate NetBIOS names and will assume the PDC role.
Domain Member Server
Configure the HP CIFS Server as a Member Server
When configuring HP CIFS Server to act as a domain member server, you need to configure the
relative domain parameters in the /etc/opt/samba/smb.conf file by using the SWAT tool or
an editor. The smb.conf file is shown as follows:
• The smb.conf file is as shown if the HP CIFS Server acting as a member server does not use
the LDAP backend:
[global]
workgroup = NTDOM
security = domain
58 Windows Style Domains