| + |
Workaround |
| + |
========== |
| + |
|
| + |
It would be prudent to pre-create disabled users in Active Directory matching on all privileged names not held in Active Directory, eg |
| + |
|
| + |
samba-tool user add root -H ldap://$SERVER -U$USERNAME%$PASSWORD --random-password |
| + |
samba-tool user add ubuntu -H ldap://$SERVER -U$USERNAME%$PASSWORD --random-password |
| + |
... |
| + |
(repeat for eg all system users under 1000 in /etc/passwd or special to any other AD-connected services, eg perhaps "admin" for a web-app) |
| + |
|
| + |
If running a Microsoft Windows Active Directory, setting ms-DS-MachineAccountQuota to 0, in the Active Directory domain would be advised, if possible. |