Summary:
I originally posted that I wanted to reduce broadcast traffic on my
network so that
a rogue machine got as little information as possible about other
machines on my network.
To do this I undertook 3 steps.
1. Turned off file and printer sharing in the network config.
2. Using a firewall with packet filtering capability blocked all
traffic between clients.
3. Adding a rule that blocked all traffic too/from the broadcast address.
4. Through my dhcp server told all clients to use WINS, mode 2
(unicast) and put in the IP address of my samba PDC as the server.
5. On the PDC verified that wins support was set to yes.
6. Made sure that my local DNS server had an entry for the domain name,
and that it
pointed to the PDC.
#3 caused some problems. If a cached roaming profile existed on the system
logins proceeded normally. If the profile was not cached, a message,
"You can't log in because the SJSA domain is not available.
This struck me as curious: Why would the only problem be with logins.
All network mapping seemed to be fine.
Next change I did was to put an entry in the local machine lmhosts file
for the PDC, with the options #PRE #DOM:sjsa
and on networking -> TCP/IP->Advaced, fill the check box for 'use lmhosts'.
This works, but I still don't understand why blocking broadcasts prevented
non-cached domain logins to fail. This work-a-round suggests that
broadcasts are an essential part of discovering who your domain
controller is.
My best guess at this point is that my broadcast stomping is interfering
with the election process.
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
