Server 2008R2 DCs and non-Windows clients

[Ric_]

I currently run 2 Server 2003 DCs and have a number of non-Windows clients - Debian Lenny (Samba version is 3.2.5), OS X (Tiger and Leopard) and Sun 7110 stroage boxes... plus a couple of web apps like GLPI that auth against AD.

 

Now the question that I can't find a definitive answer to is this... if I install a Server 2008R2 DC, I believe the cryptography algorithms will change which may stop things authenticating. There is a workaround noted at The Net Logon service on Windows Server 2008 and on Windows Server 2008 R2 domain controllers does not allow the use of older cryptography algorithms that are compatible with Windows NT 4.0 by default but I don't want to implement that if I don't have to... so will everything break when I create the 2008R2 DC?

[featured_spectre]

Short answer is yes.

 

We tried the above for our non windows clients (Edubuntu, OpenSUSE, MAC OSX Leopard) and it was crippled. We had to create a new server as a separate DC to keep those clients active.

[DMcCoy]

Up to date versions of Samba and OS X 10.5 should be fine. The only thing I have altered is not to require ldap signing for Smoothwall.

[Ric_]

Up to date versions of Samba and OS X 10.5 should be fine. The only thing I have altered is not to require ldap signing for Smoothwall.

 

What about OS X 10.4? Am I basically screwed when it comes to that?

 

What bad things might happen if I change the cryptography settings as suggested by the MS workaround?

[cookie_monster]

We had to enable that setting when we moved to 2008 DC's "I think" it was to allow XP WDS clients join the domain using NetJoinDomain. It's been set ever since with no issues.

 

It does of course lower the level of required encryption, this shouldn't be a massive issue on a single secure firewalled LAN.

Edited March 17, 2010 by cookie_monster

[DrCheese]

I have 2 2008 R2 DC's and have my Linux proxy successfully authorising users against them.

 

We do have a 2003 DC still, but to all intents and purposes, the Linux proxy doesn't know about it. We are naturally still in 2003 Mode tho.