Join Windows server 2016 or newer to Samba Active Directory

So I am going to try to document how I joined a Windows 2022 server to a Samba domain. This is highly experimental and should not be attempted in anything production or important.

To do this you will need Samba 4.19 or newer. I used Fedora server in this case. The first step it to either create or use a existing domain. I recommend that you setup a time server when you setup Samba DCs as active directory (kerberos) is time dependent. Also make sure that your network and domain are working properly as you do not want to try this if there are existing issues.

To start, add ad dc functional level = 2012_R2 to smb.conf. if you are setting up a domain from scratch you can add the option --option="ad dc functional level = 2012_R2". Keep in mind you will need to do this for each DC in the domain.

After you have added that option the next step is to restart Samba. If you are using a new enough version there should not be any errors. The next step is to upgrade the forest, schema and functional levels. You can do this with these commands:

First check the current functional level:

sudo samba-tool domain level show

If everything is working correctly the Lowest function level of a DC should be 2012_R2. If it isn't you need to either upgrade the functional level with the above steps or you need to demote old domain controllers.

Once the lowest functional level is 2012_R2 you can upgrade the domain.

samba-tool domain schemaupgrade --schema=2012_R2
samba-tool domain functionalprep --function-level=2012_R2
samba-tool domain level raise --domain-level=2012_R2 --forest-level=2012_R2

I would also run a check on the database just in case. You may need to run it multible times.

samba-tool dbcheck --fix --yes --cross-ncs

Next, verify that everything shows 2012_R2 sudo samba-tool domain level show

I would also like to point out that Samba supports a 2016 functional level and a 2019 schema level but both of those are even more experimental.

The next step is to join a Windows Server as a DC. You can to join it just like you would join any other DC. Set the DNS and then use the server manager or Powershell to join the domain as a DC.

The next steps are important so do not skip them. On the Windows server you will need first force enable the sysvol. Run this command as Administrator:

 "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name "SysvolReady" -Value "1"

Next, you will need to setup NTP sync. Run this:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters" -Name "Type" -Value  "NTP"
net stop w32time
net start w32time

Once that it done you need to setup replication via robocopy. Follow the Samba Wiki: https://wiki.samba.org/index.php/Robocopy_based_SysVol_replication_workaround

After doing this setup I would reboot the DC. After that everything should work.

Sources:

https://www.samba.org/samba/history/samba-4.19.0.html

https://samba.tranquil.it/doc/en/samba_advanced_methods/samba_add_windows_active_directory.html

https://wiki.samba.org/index.php/Robocopy_based_SysVol_replication_workaround