You might ask yourself why adding Win NT or 2000 machines should be any different from adding Win 9x machines. However, there are significant differences in the SMB implementations between versions of Microsoft’s own operating systems. Even the password algorithms used by the two operating systems are different. Win 9x machines don’t actually participate in a Win NT domain the way NT does. The domain controller in this case is used purely for authentication.

If you want to use Win 2000 machines in a Samba domain, you’ll need to upgrade to Samba 2.0.7 (Zoot ships with 2.0.6, so you’ll have to download the updated RPMs). There are a few subtle changes in 2000, most of which have been addressed in this release. There are a few outstanding bugs though, but no show-stoppers. Note that Win 2000 is currently only supported in the backwards compatibility (with NT PDC) mode, and not in its native domain controller mode.

Adding a Samba server to a Win NT domain

To get a Samba server to join a Win NT domain, you must first create a machine account for the server in the PDC’s SAM (Security Accounting Manager) database. You can do this using the "Server Manager for Domains" utility on the PDC. The machine account is created using the netbios name of the Samba server, which is usually, but not necessarily, its host name.

Once you’ve created the machine account, you need to configure the smb.conf file. Apart from the standard configuration, you need to make the following changes:

workgroup = NTDOM (Assume that the domain name is NTDOM)

security = domain

password server = NTDOMPDC NTDOMBDC1 NTDOMBDC2

where NTDOMPDC is the name of the domain controller, NTDOMBDC[1,2] are the names of the backup domain controllers, and SAMBA is the netbios name of the samba server.

Now, before restarting the smbd daemons, give the command

# smbpasswd -j NTDOM -r NTDOMPDC

This command will create a file called SAMBA.NTDOM.mac in your /etc/ directory, containing the machine account password for the Samba server.

Assuming all goes well, you should get a message saying

smbpasswd : Joined domain NTDOM