Refer to the
pdbedit
man page for a full synopsis of all operations
that are available with this tool.
An example of a simple change in the user account information is the change of the full name
information shown here:
root# pdbedit -r --fullname="Victor Aluicious Laan" vlaan
...
Primary Group SID: S-1-5-21-726309263-4128913605-1168186429-513
Full Name: Victor Aluicious Laan
Home Directory: \\frodo\vlaan
...
Let us assume for a moment that a user's password has expired and the user is unable to
change the password at this time. It may be necessary to give the user additional grace time
so that it is possible to continue to work with the account and the original password. This
demonstrates how the password expiration settings may be updated
root# pdbedit -Lv vlaan
...
Password last set: Sun, 09 Sep 2001 22:21:40 GMT
Password can change: Thu, 03 Jan 2002 15:08:35 GMT
Password must change: Thu, 03 Jan 2002 15:08:35 GMT
Last bad password : Thu, 03 Jan 2002 15:08:35 GMT
Bad password count : 2
...
The user has recorded 2 bad logon attempts and the next will lock the account, but the
password is also expired. Here is how this account can be reset:
root# pdbedit -z vlaan
...
Password last set: Sun, 09 Sep 2001 22:21:40 GMT
Password can change: Thu, 03 Jan 2002 15:08:35 GMT
Password must change: Thu, 03 Jan 2002 15:08:35 GMT
Last bad password : 0
Bad password count : 0
...
The Password must change: parameter can be reset like this:
root# pdbedit --pwd-must-change-time=1200000000 vlaan
...
Password last set: Sun, 09 Sep 2001 22:21:40 GMT
Password can change: Thu, 03 Jan 2002 15:08:35 GMT
Password must change: Thu, 10 Jan 2008 14:20:00 GMT
...
Another way to use this tools is to set the date like this:
root# pdbedit --pwd-must-change-time="2010-01-01" \
--time-format="%Y-%m-%d" vlaan
...
Password last set: Sun, 09 Sep 2001 22:21:40 GMT
Password can change: Thu, 03 Jan 2002 15:08:35 GMT
Password must change: Fri, 01 Jan 2010 00:00:00 GMT
...
Refer to the strptime man page for specific time format information.
Please refer to the pdbedit man page for further information relating to SambaSAMAccount
management.
The Samba SAM account flags are properly called the ACB (account control block) within
the Samba source code. In some parts of the Samba source code they are referred to as the
account encode_bits, and also as the account control flags.
The manual adjustment of user, machine (workstation or server) or an inter-domain trust
account account flgas should not be necessary under normal conditions of use of Samba. On the other hand,
where this information becomes corrupted for some reason, the ability to correct the damaged data is certainly
useful. The tool of choice by which such correction can be affected is the
pdbedit
utility.
There have been a few requests for information regarding the account flags from developers
who are creating their own Samba management tools. An example of a need for information regarding
the proper management of the account flags is evident when developing scripts that will be used
to manage an LDAP directory.
The account flag field can contain up to 16 characters. Presently, only 11 are in use.
These are listed in
Samba SAM Account Control Block Flags.
The order in which the flags are specified to the
pdbedit
command is not important.
In fact, they can be set without problem in any order in the SambaAcctFlags record in the LDAP directory.
Table10.2.Samba SAM Account Control Block Flags
| Flag |
Description |
| D |
Account is disabled. |
| H |
A home directory is required. |
| I |
An inter-domain trust account. |
| L |
Account has been auto-locked. |
| M |
An MNS (Microsoft network service) logon account. |
| N |
Password not required. |
| S |
A server trust account. |
| T |
Temporary duplicate account entry. |
| U |
A normal user account. |
| W |
A workstation trust account. |
| X |
Password does not expire. |
An example of use of the
pdbedit
utility to set the account control flags
is shown here:
root# pdbedit -r -c "[DLX]" jra
Unix username: jht
NT username: jht
Account Flags: [DHULX ]
User SID: S-1-5-21-729263-4123605-1186429-3000
Primary Group SID: S-1-5-21-729263-4123605-1186429-513
Full Name: John H Terpstra,Utah Office
Home Directory: \\aurora\jht
HomeDir Drive: H:
Logon Script: scripts\logon.bat
Profile Path: \\aurora\profiles\jht
Domain: MIDEARTH
Account desc: BluntObject
Workstations:
Logon time: 0
Logoff time: Mon, 18 Jan 2038 20:14:07 GMT
Kickoff time: 0
Password last set: Sun, 03 Jul 2005 23:19:18 GMT
Password can change: Sun, 03 Jul 2005 23:19:18 GMT
Password must change: Mon, 18 Jan 2038 20:14:07 GMT
Last bad password : 0
Bad password count : 0
Logon hours : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
The flags can be reset to the default settings by executing:
root# pdbedit -r -c "[]" jra
Unix username: jht
NT username: jht
Account Flags: [U ]
User SID: S-1-5-21-729263-4123605-1186429-3000
Primary Group SID: S-1-5-21-729263-4123605-1186429-513
Full Name: John H Terpstra,Utah Office
Home Directory: \\aurora\jht
HomeDir Drive: H:
Logon Script: scripts\logon.bat
Profile Path: \\aurora\profiles\jht
Domain: MIDEARTH
Account desc: BluntObject
Workstations:
Logon time: 0
Logoff time: Mon, 18 Jan 2038 20:14:07 GMT
Kickoff time: 0
Password last set: Sun, 03 Jul 2005 23:19:18 GMT
Password can change: Sun, 03 Jul 2005 23:19:18 GMT
Password must change: Mon, 18 Jan 2038 20:14:07 GMT
Last bad password : 0
Bad password count : 0
Logon hours : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
Domain Account Policy Managment
To view the domain account access policies that may be configured execute:
root# pdbedit -P ?
No account policy by that name
Account policy names are :
min password length
password history
user must logon to change password
maximum password age
minimum password age
lockout duration
reset count minutes
bad lockout attempt
disconnect time
refuse machine password change
Commands will be executed to establish controls for our domain as follows:
-
min password length = 8 characters.
-
password history = last 4 passwords.
-
maximum password age = 90 days.
-
minimum password age = 7 days.
-
bad lockout attempt = 8 bad logon attempts.
-
lockout duration = forever, account must be manually reenabled.
The following command execution will achieve these settings:
root# pdbedit -P "min password length" -C 8
account policy value for min password length was 5
account policy value for min password length is now 8
root# pdbedit -P "password history" -C 4
account policy value for password history was 0
account policy value for password history is now 4
root# pdbedit -P "maximum password age" -C 90
account policy value for maximum password age was 4294967295
account policy value for maximum password age is now 90
root# pdbedit -P "minimum password age" -C 7
account policy value for minimum password age was 0
account policy value for minimum password age is now 7
root# pdbedit -P "bad lockout attempt" -C 8
account policy value for bad lockout attempt was 0
account policy value for bad lockout attempt is now 8
root# pdbedit -P "lockout duration" -C -1
account policy value for lockout duration was 30
account policy value for lockout duration is now 4294967295
