Active Directory & Samba File Server

Core Concepts

Before diving into commands, understand what each technology does and why it exists.

What is Active Directory (AD)?

Active Directory is Microsoft's directory service that runs on Windows Server. It acts as a central authority that stores all user accounts, passwords, and groups in one place, authenticates users when they log in (via Kerberos), controls what resources each user can access, and manages computers joined to the domain. The Windows Server running AD is called a Domain Controller (DC). Every machine in the domain trusts the DC for authentication.

What is Samba?

Samba is an open-source implementation of the SMB (Server Message Block) protocol — the same protocol Windows uses for file sharing. Samba allows Linux machines to share folders that Windows and Linux clients can access like network drives, join an Active Directory domain as a recognised member, and authenticate users against AD so domain users can access Linux shares.

What is Winbind?

Winbind is a component of Samba that acts as a bridge between Linux and Windows AD. It translates Windows user/group identities (SIDs) into Linux user IDs (UIDs/GIDs), allows Linux to resolve AD usernames and groups (like getent passwd), and handles authentication requests against the DC. Without Winbind, Linux would not know what to do with Windows domain users trying to access its file shares.

What is Kerberos?

Kerberos is the authentication protocol used by AD. When a user logs in, the DC issues a ticket. Other machines in the domain accept this ticket as proof of identity — no password is sent over the network.

ID Mapping (idmap) — Why it matters

Windows identifies users by SIDs (Security Identifiers) like S-1-5-21-...-1001. Linux uses numeric UIDs/GIDs. Winbind must map between these. The smb.conf idmap config controls this:

SMB Share Permissions — Syntax Explained

In smb.conf, permissions are written in octal notation. Octal digits: 4 = Read, 2 = Write, 1 = Execute. So 6 = rw, 7 = rwx.

Part 1 — Windows Client & DC Setup

This section covers connecting a Windows computer to the domain and setting up AD groups. Your DC should already be installed with Active Directory Domain Services (AD DS). If you haven't set up your Active Directory yet, see the setup guide here.

Connecting a Windows Computer to the Domain

Do this on any Windows client machine you want to join to SDWIN.LOCAL.

Step 1 — Set DNS to point to the DC

Control Panel → Network and Sharing Center → Change adapter settings → Right-click NIC → Properties → IPv4 → Properties, then set:

IP Address:       192.168.122.x   # unique IP for this machine
Subnet Mask:      255.255.255.0
Default Gateway:  192.168.122.1
Preferred DNS:    192.168.122.100  # your DC
Alternate DNS:    8.8.8.8          # fallback

Step 2 — Join the Domain

Right-click This PC → Properties → Rename this PC (advanced) → Change → select Member of Domain → type SDWIN.LOCAL → enter Administrator credentials when prompted → restart.

Creating AD Groups and Users

On the Domain Controller, open Server Manager → Tools → Active Directory Users and Computers.

Step 1 — Create Groups

1. Right-click the container → New → Group
2. Group name: Finance | Group scope: Global | Group type: Security
3. Repeat for HR and IT

Step 2 — Create Users

4. Right-click the container → New → User
5. Fill in First name, Last name, User logon name (e.g. finance1)
6. Set a password; uncheck User must change password at next logon for lab use

Step 3 — Add Users to Groups

7. Double-click the Finance group → Members tab → Add
8. Type the username (e.g. finance1) → Check Names → OK

Verify from CMD on any domain machine:

net user finance1 /domain

Configure DNS Forwarder on DC

So your DC (and all domain machines using it as DNS) can resolve internet addresses:

1. Open DNS Manager on Windows Server
2. Right-click your server name → Properties → Forwarders tab
3. Add 8.8.8.8 and 1.1.1.1 → OK

Part 2 — Ubuntu Server: Network & Hostname

Configure Static IP with Netplan

Edit the netplan configuration file (check the filename with ls /etc/netplan/):

sudo nano /etc/netplan/01-netcfg.yaml

network:
  version: 2
  ethernets:
    enp1s0:           # use your actual NIC name (ip a)
      dhcp4: no
      addresses:
        - 192.168.122.181/24
      gateway4: 192.168.122.1
      nameservers:
        addresses:
          - 192.168.122.100  # DC as primary DNS
          - 8.8.8.8          # fallback
        search:
          - SDWIN.LOCAL

sudo netplan apply
ping 192.168.122.100    # verify DC is reachable
nslookup SDWIN.LOCAL    # verify DNS resolves the domain

Set Hostname

sudo hostnamectl set-hostname SD-Ubuntu.SDWIN.LOCAL

Update /etc/hosts so the FQDN is listed first:

sudo nano /etc/hosts

127.0.0.1   localhost
127.0.1.1   SD-Ubuntu.SDWIN.LOCAL SD-Ubuntu
192.168.122.181   SD-Ubuntu.SDWIN.LOCAL SD-Ubuntu
::1         ip6-localhost ip6-loopback
fe00::0     ip6-localnet
ff00::0     ip6-mcastprefix
ff02::1     ip6-allnodes
ff02::2     ip6-allrouters

hostname    # should return: SD-Ubuntu.SDWIN.LOCAL
hostname -f # should return: SD-Ubuntu.SDWIN.LOCAL

Configure Kerberos

sudo nano /etc/krb5.conf

[libdefaults]
    default_realm = SDWIN.LOCAL
    dns_lookup_realm = false
    dns_lookup_kdc = true

Part 3 — Ubuntu Server: Samba File Server

Install Packages

sudo apt update
sudo apt install samba winbind libpam-winbind libnss-winbind -y

Configure /etc/samba/smb.conf

First back up the original:

sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.bak

Edit the [global] section only — do not delete the rest of the file:

sudo nano /etc/samba/smb.conf

[global]
    workgroup = SDWIN                       # NetBIOS name (no .LOCAL)
    realm = SDWIN.LOCAL                     # Full Kerberos realm (uppercase)
    security = ADS                          # Use Active Directory for auth
    winbind use default domain = yes         # Allow 'username' not 'SDWIN\username'
    winbind offline logon = no               # Don't cache credentials offline
    log file = /var/log/samba/log.%m
    logging = file
    max log size = 1000
    panic action = /usr/share/samba/panic-action %d
    template shell = /bin/bash               # Shell for AD users on Linux
    template homedir = /home/%U              # Home dir template for AD users
    idmap config * : backend = tdb          # Simple consistent mapping (not autorid)
    idmap config * : range = 0-999999       # ID pool for non-SDWIN objects
    idmap config SDWIN : backend = rid      # Derive UID from Windows RID
    idmap config SDWIN : range = 1000000-1999999  # Must not overlap * range

Verify the config:

testparm

Join Ubuntu to the AD Domain

sudo net ads join -U Administrator

Enter the Administrator password. Successful output ends with:

Joined 'SD-UBUNTU' to dns domain 'SDWIN.LOCAL'

Verify the join:

sudo net ads testjoin

Configure NSSwitch

Tell Linux to use winbind when looking up users and groups:

sudo nano /etc/nsswitch.conf

# Before:
passwd: files systemd
group:  files systemd

# After:
passwd: files systemd winbind
group:  files systemd winbind

Start and Enable Services

sudo systemctl restart smbd nmbd winbind
sudo systemctl enable  smbd nmbd winbind

Verify AD users are now visible:

wbinfo -u                          # list all AD users
wbinfo -g                          # list all AD groups
wbinfo -i finance1                 # look up a specific user
getent passwd 'SDWIN\\finance1'    # resolve user via NSS

Create Shared Folders

sudo mkdir -p /srv/shares/finance
sudo mkdir -p /srv/shares/hr
sudo mkdir -p /srv/shares/it

Add share definitions to smb.conf after the [global] section:

[Finance]
    path = /srv/shares/finance
    browseable = yes
    read only = no
    valid users = @"SDWIN\\Finance"   # @ = group; only Finance members
    create mask = 0660               # new files: owner rw, group rw, others none
    directory mask = 0770            # new dirs: owner rwx, group rwx, others none

[HR]
    path = /srv/shares/hr
    browseable = yes
    read only = no
    valid users = @"SDWIN\\HR"
    create mask = 0660
    directory mask = 0770

[IT]
    path = /srv/shares/it
    browseable = yes
    read only = no
    valid users = @"SDWIN\\IT"
    create mask = 0660
    directory mask = 0770

Set Folder Ownership and Permissions

# First find the correct GID for each AD group:
wbinfo --sid-to-gid $(wbinfo --name-to-sid 'SDWIN\Finance')
wbinfo --sid-to-gid $(wbinfo --name-to-sid 'SDWIN\HR')
wbinfo --sid-to-gid $(wbinfo --name-to-sid 'SDWIN\IT')

# Use the GID numbers returned above (example: 1001110, 1001111, 1001112)
sudo chown root:1001110 /srv/shares/finance
sudo chown root:1001111 /srv/shares/hr
sudo chown root:1001112 /srv/shares/it

sudo chmod 2770 /srv/shares/finance
sudo chmod 2770 /srv/shares/hr
sudo chmod 2770 /srv/shares/it

ls -la /srv/shares/    # verify ownership

sudo systemctl restart smbd nmbd winbind
testparm

Part 4 — Kali Linux: Join Domain

Kali uses Samba/Winbind only (not realmd/sssd) for AD integration. This is appropriate for penetration testing environments.

Install Packages

sudo apt update
sudo apt install samba winbind libpam-winbind libnss-winbind krb5-user -y

When prompted for Kerberos realm, enter: SDWIN.LOCAL

Configure smb.conf on Kali

sudo nano /etc/samba/smb.conf

[global]
    workgroup = SDWIN
    realm = SDWIN.LOCAL
    security = ADS
    winbind use default domain = yes
    winbind offline logon = no
    template shell = /bin/bash
    template homedir = /home/%U
    idmap config * : backend = tdb
    idmap config * : range = 0-999999
    idmap config SDWIN : backend = rid
    idmap config SDWIN : range = 1000000-1999999

testparm  # should show ROLE_DOMAIN_MEMBER

Configure Kerberos on Kali

sudo nano /etc/krb5.conf

[libdefaults]
    default_realm = SDWIN.LOCAL
    dns_lookup_realm = false
    dns_lookup_kdc = true

Set DNS and Hostname on Kali

sudo nano /etc/resolv.conf

nameserver 192.168.122.100
search SDWIN.LOCAL

sudo hostnamectl set-hostname kali.SDWIN.LOCAL
sudo nano /etc/hosts
# Add: 192.168.122.x  kali.SDWIN.LOCAL  kali

Join Kali to the Domain

sudo net ads join -U Administrator
sudo net ads testjoin

Configure NSSwitch:

sudo nano /etc/nsswitch.conf

passwd: files systemd winbind
group:  files systemd winbind

sudo systemctl restart winbind
wbinfo -u   # verify AD users visible
wbinfo -g   # verify AD groups visible

Access Samba Shares from Kali (Without Joining Domain)

If you only want to test shares without joining, use smbclient directly:

# List all shares on the file server
smbclient -L //192.168.122.181 -U 'SDWIN\\finance1'

# Connect to Finance share
smbclient //192.168.122.181/Finance -U 'SDWIN\\finance1'

# Test a denied user — should return NT_STATUS_ACCESS_DENIED
smbclient //192.168.122.181/Finance -U 'SDWIN\\hruser1'

Commands inside the smbclient prompt:

ls              # list files
put file.txt    # upload file
get file.txt    # download file
mkdir testdir   # create directory
exit            # quit

Query AD users from Kali using rpcclient (no domain join needed):

rpcclient -U 'SDWIN\\Administrator' 192.168.122.100

# Inside rpcclient prompt:
enumdomusers    # list all AD users
enumdomgroups   # list all AD groups

Part 5 — Testing File Share Access

From Windows Client

Open File Explorer and navigate to:

\\192.168.122.181\Finance

Log in with a Finance group member (e.g. SDWIN\finance1). Access should be granted. Try with a user not in Finance — access should be denied.

From Ubuntu (smbclient)

smbclient //192.168.122.181/Finance -U 'SDWIN\\finance1'

Verify AD Resolution on Ubuntu File Server

wbinfo -u                                  # list all AD users
wbinfo -g                                  # list all AD groups
wbinfo --user-groups finance1              # groups finance1 belongs to
wbinfo -i finance1                         # resolve user details
getent group  'SDWIN\\Finance'             # check Finance group members
getent passwd 'SDWIN\\finance1'            # resolve user to Linux UID

Part 6 — Complete Teardown & Cleanup

Use this section to undo everything and start fresh. Follow in order.

Step 1 — Remove Ubuntu from the AD Domain

sudo net ads leave -U Administrator

Step 2 — Remove Samba Shares and Data

sudo rm -rf /srv/shares/finance
sudo rm -rf /srv/shares/hr
sudo rm -rf /srv/shares/it

Step 3 — Restore Original smb.conf

sudo cp /etc/samba/smb.conf.bak /etc/samba/smb.conf

# Or wipe it entirely and reinstall samba for a clean default:
sudo apt purge samba winbind libpam-winbind libnss-winbind -y
sudo apt autoremove -y
sudo rm -rf /etc/samba /var/lib/samba /var/cache/samba

Step 4 — Clear Samba Cache

sudo net cache flush

# Safe cache cleanup — NEVER delete secrets.ldb:
sudo rm -f /var/lib/samba/winbindd_idmap.tdb
sudo rm -f /var/lib/samba/winbindd_cache.tdb

Step 5 — Revert NSSwitch

Edit /etc/nsswitch.conf and remove winbind:

passwd: files systemd
group:  files systemd

Step 6 — Revert Hostname (optional)

sudo hostnamectl set-hostname ubuntu-server
sudo nano /etc/hosts   # remove the SDWIN.LOCAL lines

Step 7 — Stop and Disable Services

sudo systemctl stop    smbd nmbd winbind
sudo systemctl disable smbd nmbd winbind

Reinstall Fresh (to redo from scratch)

sudo apt update
sudo apt install samba winbind libpam-winbind libnss-winbind -y
# Now follow Part 3 again from the beginning

Troubleshooting Reference