Windows 8 joining Samba domains, and which ones it just fails to join (those with dots in their names)

TO SAY AS OF MAI 2015

There are two way to get Windows 8 into a NETBIOS/samba3 dot style domain.

  1. Join Windows 7 and upgrade to 8/8.1 – works perfectly.

2a. second method is basically tampering with DNS name resolution temporarily in the network interface settings. There’s a link down in the comments. I can confirm Havrlas method works fine. 🙂 thanks again

2b. for now just an idea, but what about just stopping the DNS-Client in Computer/Manage/Services … haven’t tried that yet, but I will on the next occasion, if it comes before migrating to S4AD.

EDITED JULY 16, 2013

former post name: Windows 8 failing to join certain Samba domains

Usually, Windows 8 can indeed easily be integrated into classic Samba environments, say improved NT4 domains. And, yes, Microsoft has indeed dropped native NT4 support and deliberately developed some sort of compatibility mode to support Samba, it seems.

To enable Samba 3 domain membership, three registry keys have to be changed by the user, whereof we already know two from Windows Seven. The first one, named DomainCompatibilityMode, is quite obvious by it’s name, though its name doesn’t exactly imply how that works. The second one, DNSNameResolutionRequired, is to a lesser degree obscure, but still, its name doesn’t tell us for what exactly DNS names do or do not need to be resolved (sure, DNS is needed to find AD DCs, but that can’t be the whole truth about this regkey). The third one is new since Windows 8, and it’s a rather rude one. It’s a change in the Workstation Service dependencies which results in SMB2 support being disabled as a whole. This requirement results from shortcomings in the SMB2 support in Samba 3.6. While SMB2 support in Samba is considered helpful for Windows 7, it is not compatible to Windows 8’s more advanced implementation. This is at least the case when connecting to a DC, resulting in two options, which are to turn off SMB2 either on the server side (“max protocol = nt1”) or on the client side via the described registry key change.

The whole set of registry changes is available here as a .reg file ready to import with regedit.exe (take care to save with Windows line endings when using too much Unix). Have a look at the respective areas in your registry after importing the file. I have added the original value of DependOnService next to the changed one to facilitate restoring later. It’s a multi value key. Don’t mess it up, as that would keep the Workstation Service from starting, resulting in a loss of access to all network shares.

This works for most Samba 3 domains, but unfortunately, it doesn’t for all. Should you be so unlucky to run a domain which (perhaps more than a decade ago) had been chosen to include a dot in its name, well, either some smart guy comes up with another bald workaround, or for now, as it looks like, you’re lost. Period.

How’s that possible, I wondered for while, then remembered the two distinct error messages resulting from failing attempts to join and tried again using two inexistent names, one with dots and one without. And that’s it – failing to join an inexistent domain containing a dot, I’m getting told the DC cannot be discovered using DNS, quite clearly, while the attempt to join an inexistent domain named without a dot tells me the DC weren’t found, plus the hint, that this name looks like a legacy domain name.

My conclusion is, Microsoft did some cleanup and has dropped some portions of code that were there to detect what kind of domain we are dealing with, and because this information is needed in a pretty early stage of the joining procedure, they instead derive it from the users input, assuming that names containing a dot are usually to be considered DNS resolvable and therefore a typical AD environment, whereas plain names are most likely NETBIOS names.

As this assumption is not always true, we must say, it looks like Windows 8 will not be able to join certain classic Samba domains whos names are not following the naming conventions underlying the assumptions codified inside Microsoft’s Windows 8 network stack, unless somebody finds a way to override looking for Active Directory domains if the Domain name does contain one or more dots.

EDIT: GOOGLED LINKS AS OF JULY 16

http://social.technet.microsoft.com/Forums/windows/en-US/b257449c-1168-4f7d-a6ff-661c28b2e400/joining-w8-to-a-samba-3xx-domain-containing-dots-in-its-name

http://samba.2283325.n4.nabble.com/Fix-the-Issue-Windows-8-cannot-join-if-a-example-com-domain-td4650137.html […ends up linking back here]

http://www.clearfoundation.com/component/option,com_kunena/Itemid,232/catid,39/func,view/id,51202/ […ends up linking back here]

Summary: no solution in sight yet.

 

23 thoughts on “Windows 8 joining Samba domains, and which ones it just fails to join (those with dots in their names)”

  1. Ok,

    So this means we can keep the “max protocol = SMB2” setting in smb.conf if wen use the supplied .reg file.

    Will test this tonight as I have a new laptop with “windows 8 pro” which I could not join to the domain so far, already wasted some hours on this but I didn’t know the implications of the “smb2” protocol. The interesting thing is that the other machines at home where I choose to make an in-place update from “windows 7 pro” to “windows 8 pro” did not have to join the domain again. It seems that once joined these 3 registry keys are not needed anymore cause on the upgraded machines these keys are missing but domain login still works even with “max protocol = smb2” enabled.

  2. Marc, one more advice: Have a look at the respective registry keys after importing, to see what they really contain. regedit.exe shows in clear text what’s represented as hex numbers in the .reg file. That’s why.

  3. Hi,

    It’s me again. The reg file did the trick, applied the reg file with the 3rd option which was missing with “max protocol = smb2” set in the smb.conf and finally I could join the domain.

    Thanks for your help.

  4. Hi there
    Thanks for the warning with the dot. But just that I understand it correctly as I am gonna setup a Samba3 domain soon and it is not always possible to avoid windows 8.
    If I for instance choose the domain name samba.org it won’t work in combination with Windows 8, is that correct? I would have to go against the standard and just call it samba?

  5. Buen dia
    Quisiera saber si en verdad se puede unir un Windows 8 Pro a un servidor de dominio “Zentyal” que tiene puntos .
    agradezco sus comentarios..

  6. Hi. I applied the three registry changes and set max protocol smb2 in samba global section. The samba version I use is the 3.6.3. I have a pc running windows 8.1 pro and still unable to connect to the domain samba.org. What can I do?

    1. I’ve never tried joining 8.1 to s3. But anyway, if your domain name is “samba.org”, as far as I know you will have no chance to join any Windows 8 or 8.1 machine to it. If you have a chance to setup a new domain with a new domain controller, just use a good old NETBIOS domain name without a dot, and you should be fine. Good luck!

        1. Hello,

          Thanks to Havrla and information in this article, I succeeded in joining Windows Server 2012 R2 to a samba 3 domain.
          I just followed the following process.

          On Samba:
          ———————–
          – Upgrade to at least Samba 3.6.6
          – Take care of those parameters in smb.conf:
          ldapsam:trusted = no
          max protocol = SMB2 # i add to disable this after joining windows 2012 because it breaks relation trust for part of my others servers
          – Reload Samba and Winbindd

          On Windows 2012:
          ———————–
          – Modify registry as explained in the article:
          Windows Registry Editor Version 5.00
          [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters]
          “DomainCompatibilityMode”=dword:00000001
          “DNSNameResolutionRequired”=dword:00000000
          – Set fixed IP address for IPv4and gateway, but do not configure DNS !!
          – Disable IPv6 (just uncheck it in interface properties)
          – In the advanced properties of the network interface, in DNS Tab set your NT domain example.org set “example” as suffix, and “org” as general suffix for this connection
          – Then join your domain EXAMPLE.ORG normally
          – Reboot and set DNS servers or configure DHCP as usual

          Hope this will help you.

          Mat

          1. Hi Mat,

            thanks for confirming the procedure laid out by Havrla. I’m really glad there is a solution to this. I will update my original post soon.

            Andreas

  7. Havrla, wich Samba version do you have? I have 3.5.6. I tried your workaround with Win8 e Win8.1 but it doesn’t work. I’ll try with a Samba 3.6.6. as suggested by Mat

    1. Hi George, thanks for asking. Did you see this one: https://www.multifake.net/paste/7f/

      Best would be to copy&paste into notepad.exe – you need DOS-like CRLF formatted code – save as or rename as favoritefilename.reg

      Tell me if you need something else. If this doesn’t work for you, I’m at least curious to know why.

Leave a Reply

Your email address will not be published. Required fields are marked *