Hello Jeroen,
I just had the same problem you described. The cause of it was, that the LDAP configuration on my new os (Ubuntu 8.04) included an option to ignore the root user from LDAP: nss_initgroups_ignoreusers backup,bin,daemon,dhcp,games,gnats,irc,klog,libuuid,list,lp,mail,man,mysql,news,openldap,proxy,sshd,statd,sync,sys,syslog,uucp,www-data in /etc/ldap.conf. I can't remember if it was the stock config file or if I added it following some howto. However the root user on the server side was not a member of the 'Domain Admins' group because the data came from /etc/passwd. I removed root from the ignore list and it worked. Just check on your PDC, if the root user is really a member of the 'Domain Admins' group with 'id root' - if not - there's your problem. Kind regards, -sd 2008/7/18 Jeroen Vriesman <[EMAIL PROTECTED]>: > Hi list, > > after upgrading our ldap server, the Domain Admins group doesn't work > anymore. > > Members of the domain admins group don't have any special rights on the > workstations (for example, they cannot even change the date of a machine in > the > domain anymore). > > When I lookup the group members I get: > > [EMAIL > PROTECTED]<javascript:open_compose_win('to=root%40hermes&thismailbox=INBOX.Sent');>:/etc/samba# > net rpc group members 'Domain Admins' > Password: > HIVOS.NL\root > HIVOS.NL\foctaaf > HIVOS.NL\lhilarides > HIVOS.NL\administrator > HIVOS.NL\executor > HIVOS.NL\fbodijn > HIVOS.NL\psomer > HIVOS.NL\jvriesman > > And the rights of the group: > [EMAIL > PROTECTED]<javascript:open_compose_win('to=root%40hermes&thismailbox=INBOX.Sent');>:/etc/samba# > net rpc rights list 'Domain Admins' > Password: > SeMachineAccountPrivilege > SeRemoteShutdownPrivilege > SePrintOperatorPrivilege > SeAddUsersPrivilege > SeDiskOperatorPrivilege > > That seems ok, but when I lookup the rights of a member of the Domain Admins > group: > > [EMAIL > PROTECTED]<javascript:open_compose_win('to=root%40hermes&thismailbox=INBOX.Sent');>:/etc/samba# > net rpc rights list 'HIVOS.NL\jvriesman' > Password: > SeAddUsersPrivilege > > [EMAIL > PROTECTED]<javascript:open_compose_win('to=root%40hermes&thismailbox=INBOX.Sent');>:/etc/samba# > net rpc rights list 'HIVOS.NL\psomer' > Password: > <nothing here> > > Any idea why members of the Domain Admin group do not get the rights of the > group? > > cheers, > Jeroen. > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/listinfo/samba > -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba