Starting from version 4.0, Samba is able to run as an Active Directory (AD) domain controller (DC). If you are installing Samba in a production environment, it is recommended to run two or more DCs for failover reasons.
This documentation describes how to set up Samba as the first DC to build a new AD forest. Additionally, use this documentation if you are migrating a Samba NT4 domain to Samba AD. To join Samba as an additional DC to an existing AD forest, see Joining a Samba DC to an Existing Active Directory.
Samba as an AD DC only supports:
- the integrated LDAP server as AD back end. For details, see the frequently asked question (FAQ) Does Samba AD DCs Support OpenLDAP or Other LDAP Servers as Back End?
- the Mit and Kerberos Key Distribution Center (KDC).
- Samba uses the MIT KDC provided by your operating system if you run Samba 4.7 or later and has been built using the
--with-system-mitkrb5option. In other cases Samba uses the Heimdal KDC included in Samba. For further details about Samba using the MIT KDC, see Running a Samba AD DC with MIT Kerberos KDC.
