Ric_ Posted March 17, 2010 Posted March 17, 2010 I currently run 2 Server 2003 DCs and have a number of non-Windows clients - Debian Lenny (Samba version is 3.2.5), OS X (Tiger and Leopard) and Sun 7110 stroage boxes... plus a couple of web apps like GLPI that auth against AD. Now the question that I can't find a definitive answer to is this... if I install a Server 2008R2 DC, I believe the cryptography algorithms will change which may stop things authenticating. There is a workaround noted at The Net Logon service on Windows Server 2008 and on Windows Server 2008 R2 domain controllers does not allow the use of older cryptography algorithms that are compatible with Windows NT 4.0 by default but I don't want to implement that if I don't have to... so will everything break when I create the 2008R2 DC?
featured_spectre Posted March 17, 2010 Posted March 17, 2010 Short answer is yes. We tried the above for our non windows clients (Edubuntu, OpenSUSE, MAC OSX Leopard) and it was crippled. We had to create a new server as a separate DC to keep those clients active.
DMcCoy Posted March 17, 2010 Posted March 17, 2010 Up to date versions of Samba and OS X 10.5 should be fine. The only thing I have altered is not to require ldap signing for Smoothwall.
Ric_ Posted March 17, 2010 Author Posted March 17, 2010 Up to date versions of Samba and OS X 10.5 should be fine. The only thing I have altered is not to require ldap signing for Smoothwall. What about OS X 10.4? Am I basically screwed when it comes to that? What bad things might happen if I change the cryptography settings as suggested by the MS workaround?
cookie_monster Posted March 17, 2010 Posted March 17, 2010 (edited) We had to enable that setting when we moved to 2008 DC's "I think" it was to allow XP WDS clients join the domain using NetJoinDomain. It's been set ever since with no issues. It does of course lower the level of required encryption, this shouldn't be a massive issue on a single secure firewalled LAN. Edited March 17, 2010 by cookie_monster
DrCheese Posted March 17, 2010 Posted March 17, 2010 I have 2 2008 R2 DC's and have my Linux proxy successfully authorising users against them. We do have a 2003 DC still, but to all intents and purposes, the Linux proxy doesn't know about it. We are naturally still in 2003 Mode tho.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now