Tranquil IT Forum

Hello,

we have a Samba4 server that manages our public domain.
Based on my experience, I would like to point out the following points, which might help others:

- Be careful with password policies.
Beyond the domain security policies, it's important to know that password policies are active by default in the Samba system.
These take precedence over the domain security policies!
The best approach is to disable them and manage everything from the Microsoft console.

Here are some useful commands to run as root on the Samba4 machine:

View password configuration:
`samba-tool domain passwordsettings show`

Disable history:
`samba-tool domain passwordsettings set --history-length=0`

Disable minimum password age:
`samba-tool domain passwordsettings set --min-pwd-age=0`

Disable maximum password age:
`samba-tool domain passwordsettings set --max-pwd-age=0`

- It is not possible to apply a GPO to the default "Domain computers" group.
Perhaps it's a version bug, perhaps it's been fixed.
If you are experiencing or have experienced the same problem, please let us know.