Samba net rpc rights grant SeDiskOperatorPrivilege Fails

Ubuntu Server 18.04

Installed/Configured Samba

Joined Domain successfully

Can browse the server and see the “printer share” – from Windows PC >net view \servername lists the printer share

Kerberos functionality confirmed with kinit, klist

Server name is listed in Active Directory Users & Computers.

:/$ net rpc rights grant "DOMAIN\Domain Admins" SeDiskOperatorPrivilege -U
"DOMAIN\administrator"
Enter DOMAIN\administrator's password:
Bad SMB2 signature for message
[0000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[0000] D8 29 57 39 05 18 72 BE 62 9E 74 58 90 88 FF 57 .)W9..r. b.tX...W
Could not connect to server 127.0.0.1
Connection failed: NT_STATUS_ACCESS_DENIED

smb.conf :

[global]
dns forwarder = my.DNS.ip.address
dns proxy = No
log file = /var/log/samba/log.%m
logging = syslog@1 /var/log/samba/log.%m
map to guest = Bad User
max log size = 1000
panic action = /usr/share/samba/panic-action %d
realm = DOMAIN.COM
security = ADS
server role = member server
server string = %h server (Samba, Ubuntu)
template shell = /bin/bash
usershare allow guests = Yes
winbind enum groups = Yes
winbind enum users = Yes
winbind nss info = rfc2307
winbind use default domain = Yes
workgroup = DOMAIN
idmap config DOMAIN : range = 50000-1000000
idmap config DOMAIN : backend = ad
idmap config * : range = 3000-7999
idmap config * : backend = tbd
map acl inherit = Yes
store dos attributes = Yes
vfs objects = acl_xattr
[printers]
browseable = No
comment = All Printers
create mask = 0700
path = /var/spool/samba
printable = Yes
[print$]
comment = Printer Drivers
path = /var/lib/samba/printers

1 Answer

A bit embarrassing, as I've been working this problem for a whole day. Finally relented and posted here and then found the solution:

Need to create a user mapping file: e.g. /etc/samba/user.map

!root = SAMDOM\Administrator SAMDOM\administrator

Add this to the [global] section of smb.conf

username map = /etc/samba/user.map

Restart smbd and it works.