SAMBA-TOOL(8) System Administration tools SAMBA-TOOL(8) (NAME) samba-tool - (Samba) (SYNOPSIS) samba-tool [-h] [-W myworkgroup] [-U user] [-d debuglevel] [-V] (DESCRIPTION) samba(7) . (OPTIONS) samba-tool . . -h|--help . -r|--realm=REALM (realm) . realm /etc/samba/smb.conf . --simple-bind-dn=DN DN (simple bind). --password . . kinit. . --password PASSWD PASSWD_FD (FD) . PASSWD_FILE ( ) . . ! ( ps ) (race condition) . -U|--user=[DOMAIN\]USERNAME[%PASSWORD] SMB . %PASSWORD . USER ( % ) LOGNAME ( ) . (Kerberos Credentials cache) . . . . -A . . kinit. . ( ps ) . -W|--workgroup=WORKGROUP SMB . smb.conf . NetBIOS SAM ( SAM ) . workgroup /etc/samba/smb.conf . -N|--no-pass . . . . --use-kerberos=desired|required|off Kerberos . IP DNS . (ccache) . ccache -U|--user (kinit) . --use-krb5-ccache . client use kerberos /etc/samba/smb.conf . --use-krb5-ccache=CCACHE . --use-kerberos=required . -A|--authentication-file=filename . : username = password = domain = ! -H URL, --URL=URL LDB URL . . 'tdb://' . tdb://PATH PATH TDB . mdb://PATH PATH LMDB . ldb://PATH PATH LDB LMDB TDB . . . ldap://HOSTNAME, ldaps://HOSTNAME LDB ldap . ldaps:// TLS . ldapi://SOCKET ldap . --color=always|never|auto (: auto) --ipaddress=IPADDRESS IP -s FILE, --configfile=FILE smb.conf. --color=always|never|auto samba-tool ANSI . 'auto' () samba-tool NO_COLOR . 'yes' 'force' 'always' 'no' 'none' 'never' 'tty' 'if-tty' 'auto' . samba-tool . . -V, --version . -d|--debuglevel=level level 0 10 . 1 . (log) . 0 . 1 - . 1 . 3 . log level /etc/samba/smb.conf . --debug-stdout STDOUT . STDERR . (COMMANDS) computer . computer add computername [options] . sAMAccountName . --computerou=COMPUTEROU DN ( domainDN) CN=Computers 'OU=OUname'. --description=DESCRIPTION . --ip-address=IP_ADDRESS_LIST IPv4 A IPv6 AAAA . --service-principal-name=SERVICE_PRINCIPAL_NAME_LIST (SPN) . --prepare-oldjoin (oldjoin). computer create computername [options] . samba-tool computer add . samba-tool computer add . computer delete computername [options] . sAMAccountName . computer edit computername AD . sAMAccountName . --editor=EDITOR 'vi' . computer list . computer move computername new_parent_dn [options] (OU) . sAMAccountName . DN domainDN . computer show computername [options] AD . sAMAccountName . --attributes=USER_ATTRS . computer keytrust (Key Credential Links) . msDS-KeyCredentialLink . computer keytrust add computername public-key-or-certificate[options] key-credential-link . RSA ( ) PEM DER . --encoding . --force . --link-target=DN DN (: DN ) --encoding=ENCODING pem der auto. auto . --force computer keytrust delete computername [options] key-credential-link. . --all ( ). --link-target DN . --fingerprint . SHA256 DER . computer keytrust view . --link-target --fingerprint --all . --dry-run . --link-target=DN ( DN) --fingerprint=HH:HH:.. --all -n, --dry-run computer keytrust view computername [options] . DN . --verbose . -h, --help -v, --verbose computer generate-csr computername subject_name private_key_filename output_filename [options]" (CSR) PEM . --private-key-encoding . 'auto' . --private-key-pass . contact (contacts). contact add [contactname] [options] . 'contactname' --given-name --initial --surname . 'contactname' . . ('.') . --ou=OU DN ( domainDN) 'OU=OUname'. . --description=DESCRIPTION . --surname=SURNAME . --given-name=GIVEN_NAME . --initials=INITIALS . --display-name=DISPLAY_NAME . --job-title=JOB_TITLE . --department=DEPARTMENT . --company=COMPANY . --mail-address=MAIL_ADDRESS . --internet-address=INTERNET_ADDRESS . --telephone-number=TELEPHONE_NUMBER . --mobile-number=MOBILE_NUMBER . --physical-delivery-office=PHYSICAL_DELIVERY_OFFICE . contact create [contactname] [options] . samba-tool contact add . samba-tool contact add . contact delete contactname [options] . (DN) . domainDN . contact edit contactname AD . . domainDN . --editor=EDITOR 'vi' . contact list [options] . --full-dn DN . contact move contactname new_parent_dn [options] . . domainDN . contact show contactname [options] AD . . domainDN . --attributes=CONTACT_ATTRS . contact rename contactname [options] . . CN . CN . ('.') . --force-new-cn CN --reset-cn . . CN . --surname=SURNAME . --given-name=GIVEN_NAME . --initials=INITIALS . --force-new-cn=NEW_CN CN (RDN) . --reset-cn CN . --display-name=DISPLAY_NAME . --mail-address=MAIL_ADDRESS . dbcheck AD . delegation (Delegations). delegation add-principal accountname principal [options] (principal) msDS-AllowedToActOnBehalfOfOtherIdentity . delegation del-principal accountname principal [options] msDS-AllowedToActOnBehalfOfOtherIdentity . delegation add-service accountname principal [options] msDS-AllowedToDelegateTo. delegation del-service accountname principal [options] msDS-AllowedToDelegateTo. delegation for-any-protocol accountname [(on|off)] [options] UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION ( S4U2Proxy) . delegation for-any-service accountname [(on|off)] [options] UF_TRUSTED_FOR_DELEGATION . delegation show accountname [options] . dns (DNS). dns add server zone name A|AAAA|PTR|CNAME|NS|MX|SRV|TXT data DNS. --allow-existing . ( DNS ) samba-tool . dns cleanup server name DNS DNS . . : samba-tool dns cleanup dc1 computer.samdom.test.site dns delete server zone name A|AAAA|PTR|CNAME|NS|MX|SRV|TXT data DNS. dns query server zone name A|AAAA|PTR|CNAME|NS|MX|SRV|TXT|ALL [options] data . dns roothints server [name] [options] (root hints). dns serverinfo server [options] . dns update server zone name A|AAAA|PTR|CNAME|NS|MX|SRV|TXT olddata newdata DNS. dns zonecreate server zone [options] ( DNS). dns zonedelete server zone [options] . dns zoneinfo server zone [options] . dns zonelist server [options] . dns zoneoptions server zone [options] (aging). DNS . . -n, --dry-run . --client-version=w2k|dotnet|longhorn . longhorn . --mark-old-records-static=YYYY-MM-DD (static). --mark-records-static-regex=REGEXP . --mark-records-dynamic-regex=REGEXP (dynamic). --aging=0|1 --aging=1 (aging) . --aging=0 . --norefreshinterval=HOURS . . --refreshinterval=HOURS (0: ) domain . domain backup . domain backup offline ( ) tar. domain backup online (DC) tar. domain backup rename . domain backup restore . domain auth policy . domain auth policy list . -H, --URL LDB URL . --json JSON . domain auth policy view . -H, --URL LDB URL . --name (). domain auth policy create . -H, --URL LDB URL . --name (). --description . --protect . --unprotect . --unprotect . --protect . --audit (audit) . --enforce . --enforce . --audit . --strong-ntlm-policy NTLM ( Disabled Optional Required). --user-tgt-lifetime-mins (TGT) ( ). --user-allow-ntlm-auth NTLM Interactive NETLOGON SamLogon allowed-to-authenticate-from . --user-allowed-to-authenticate-from . ACE . SDDL Device . : O:SYG:SYD:(XA;OICI;CR;;;WD;(Member_of {SID(AU)})) --user-allowed-to-authenticate-to=SDDL ( ) . SDDL . SDDL Device . SDDL: O:SYG:SYD:(XA;OICI;CR;;;WD;(Member_of {SID(AO)})) --service-tgt-lifetime-mins (TGT) ( ). --service-allow-ntlm-auth NTLM . --service-allowed-to-authenticate-from . ACE . SDDL Device . SDDL: O:SYG:SYD:(XA;OICI;CR;;;WD;(Member_of {SID(AU)})) --service-allowed-to-authenticate-to=SDDL ( Managed Service Account Group Managed Service Account) . SDDL . SDDL Device . SDDL: O:SYG:SYD:(XA;OICI;CR;;;WD;(Member_of {SID(AO)})) --computer-tgt-lifetime-mins (TGT) ( ). --computer-allowed-to-authenticate-to=SDDL ( ) . SDDL . SDDL Device . SDDL: O:SYG:SYD:(XA;OICI;CR;;;WD;(Member_of {SID(AO)})) domain auth policy modify . domain auth policy create . domain auth policy delete . -H, --URL LDB URL . --name (). --force . domain auth policy user-allowed-to-authenticate-from set user-allowed-to-authenticate-from . -H, --URL LDB URL . --name . --by-group=GROUP GROUP . --silo=SILO SILO . domain auth policy user-allowed-to-authenticate-to set user-allowed-to-authenticate-to . -H, --URL LDB URL . --name . --group=GROUP GROUP . --silo=SILO SILO ( ). domain auth policy service-allowed-to-authenticate-from set service-allowed-to-authenticate-from . -H, --URL LDB URL . --name . --group=GROUP ( Managed Service Account Group Managed Service Account) GROUP . --silo=SILO ( Managed Service Account Group Managed Service Account) SILO . domain auth policy service-allowed-to-authenticate-to set service-allowed-to-authenticate-to . -H, --URL LDB URL . --name . --group=GROUP ( Managed Service Account Group Managed Service Account) GROUP . --silo=SILO ( Managed Service Account Group Managed Service Account) SILO ( ). domain auth policy computer-allowed-to-authenticate-to set computer-allowed-to-authenticate-to . -H, --URL LDB URL . --name . --group=GROUP ( ) GROUP . --silo=SILO ( ) SILO ( ). domain auth silo (Authentication Silos). domain auth silo list . -H, --URL LDB URL . --json JSON . domain auth silo view . -H, --URL LDB URL . --name (). domain auth silo create . -H, --URL LDB URL . --name (). --description . --user-authentication-policy . --service-authentication-policy . --computer-authentication-policy . --protect . --unprotect . --unprotect . --protect . --audit . --enforce . --enforce . --audit . domain auth silo modify . -H, --URL LDB URL . --name (). --description . --user-authentication-policy . --service-authentication-policy . --computer-authentication-policy . --protect . --unprotect . --unprotect . --protect . --audit . --enforce . --enforce . --audit . domain auth silo delete . -H, --URL LDB URL . --name (). --force . domain auth silo member grant . -H, --URL LDB URL . --name (). --member (DN ). domain auth silo member list . -H, --URL LDB URL . --name (). --json JSON . domain auth silo member revoke . -H, --URL LDB URL . --name (). --member (DN ). domain claim claim-type list (claim types) . -H, --URL LDB URL . --json JSON . domain claim claim-type view . -H, --URL LDB URL . --name (). domain claim claim-type create . -H, --URL LDB URL . --attribute (). --class . : --class=user --class=computer --name . --description . --enable . --disable . --disable . --enable . --protect . --unprotect . --unprotect . --protect . domain claim claim-type modify . -H, --URL LDB URL . --name (). --class . : --class=user --class=computer --description . --enable . --disable . --disable . --enable . --protect . --unprotect . --unprotect . --protect . domain claim claim-type delete . -H, --URL LDB URL . --name (). --force . domain claim value-type list (claim value types) . -H, --URL LDB URL . --json JSON . domain claim value-type view . -H, --URL LDB URL . --name (). domain classicupgrade [options] classic_smb_conf ( NT4) Samba AD DC. domain dcpromo dnsdomain [DC|RODC] [options] NT4 PDC AD DC. domain demote (DC). domain exportkeytab keytab [options] keytab. domain functionalprep [options] (functional level). --functional-level ( 2016) . (forest) (domain) . . --forest-prep --domain-prep . . -H, --URL LDB URL . --functional-level [2008_R2|2012|2012_R2|2016] . 2016 . --forest-prep ( --domain-prep ). --domain-prep ( --forest-prep ). domain info ip_address [options] (DC) . domain join dnsdomain [DC|RODC|MEMBER|SUBDOMAIN] [options] . domain kds root-key (KDS). domain kds root-key create [options] KDS -H, --URL LDB URL . --use-start-time=["now"|iso8601 or LDIF time string] . "now" LDIF YYYYmmddHHMMSS.0Z ISO YYYY-mm-dd[*HH[:MM[:SS[.fff[fff]]]][+HH:MM[:SS[.ffffff]]]] '*' '[+HH:MM[:SS[.ffffff]]]' ( '+00:00' UTC). --json JSON. domain kds root-key delete --name={GUID} KDS . samba-tool domain kds root-key list . -H, --URL LDB URL . --name=NAME . GUID . -v, --verbose ( --show secrets ). --json JSON. domain kds root-key list [options] KDS. . -H, --URL LDB URL . --show-secrets msKds-RootKeyData msKds-SecretAgreementParam. -v, --verbose ( --show secrets ). --json JSON. domain kds root-key view [options] KDS. samba-tool domain kds root-key list --verbose . --latest --name . -H, --URL LDB URL . --latest . --name=NAME . GUID . -v, --verbose ( --show secrets ). LDB . --json JSON. domain leave [options] . samba-tool domain demote . --keep-account . domain level show|raise options [options] . domain passwordsettings set options [options] Samba AD DC. Windows DC group policy . -H URL, --URL=URL LDB URL -q, --quiet --complexity=COMPLEXITY (on | off | default). 'on' --store-plaintext=STORE_PLAINTEXT 'store passwords with reversible encryption' (on | off | default). 'off' --history-length=HISTORY_LENGTH ( | default). 24 . --min-pwd-length=MIN_PWD_LENGTH ( | default). 7 . --min-pwd-age=MIN_PWD_AGE ( | default). 1 . --max-pwd-age=MAX_PWD_AGE ( | default). 43 . --account-lockout-duration=ACCOUNT_LOCKOUT_DURATION ( | default). 30 . --account-lockout-threshold=ACCOUNT_LOCKOUT_THRESHOLD ( | default). 0 ( ). --reset-account-lockout-after=RESET_ACCOUNT_LOCKOUT_AFTER ( | default). 30 . domain passwordsettings show options [options] . -H URL, --URL=URL LDB URL domain passwordsettings pso (PSOs). domain passwordsettings pso apply pso-name user-or-group-name [options] PSO . domain passwordsettings pso create pso-name precedence [options] (PSO) . domain passwordsettings pso delete pso-name [options] (PSO). domain passwordsettings pso list [options] (PSOs). domain passwordsettings pso set pso-name [options] (PSO). domain passwordsettings pso show user-name [options] (PSO). domain passwordsettings pso show-user pso-name [options] . domain passwordsettings pso unapply pso-name user-or-group-name [options] PSO . domain provision NT4 PDC AD DC. domain schemaupgrade [options] (schema). -H, --URL LDB URL . --schema [2012|2012_R2|2016|2019] . 2019 . --ldf-file LDIF . --base-dir LDIF . domain tombstones expunge NC [NC [...]] [options] -H URL, --URL=URL LDB URL --current-time=YYYY-MM-DD tombstone YYYY-MM-DD --tombstone-lifetime=DAYS tombstone domain trust (trust) . domain trust create DOMAIN options [options] . domain trust modify DOMAIN options [options] . domain trust delete DOMAIN options [options] . domain trust list options [options] . domain trust namespaces [DOMAIN] options [options] . domain trust show DOMAIN options [options] . domain trust validate DOMAIN options [options] . drs (DRS). drs bind DRS . drs clone-dc-database dnsdomain --targetdir=DIR [options]" (DO NOT JOIN). --server=DC DC. --targetdir=TARGETDIR (). -q, --quiet . --include-secrets (secrets). --backend-store=BACKENDSTORE ( tdb ). --backend-store-size=SIZE lmdb ( 8 ). drs uptodateness [options] (uptodateness). -H URL, --URL=URL LDB URL -p PARTITION, --partition=PARTITION --json json --maximum --median --full drs kcc (KCC). drs options options NTDS Settings . drs replicate destination_DC source_DC NC [options] (naming context) DC. drs showrepl . [--json] JSON [--summary] . dsacl (DS ACLs) dsacl delete . dsacl get . dsacl set . forest (Forest). forest directory_service directory_service . forest directory_service dsheuristics VALUE dsheuristics directory_service . forest directory_service show directory_service . fsmo FSMO (Flexible Single Master Operations). fsmo seize [options] (seize). fsmo show . fsmo transfer [options] (transfer). gpo (GPO). gpo aclcheck [options] ACL LDAP DS GPO. -H URL, --URL=URL LDB URL gpo admxload [options] admx sysvol -H URL, --URL=URL LDB URL --admx-dir=ADMX_DIR admx gpo backup gpo[options] GPO. -H H LDB URL --tmpdir=TMPDIR --generalize XML --entities=ENT_FILE XML gpo create displayname [options] GPO . gpo cse list (CSE) . gpo cse register cse_file cse_name [options] (CSE) . CSE . CSE CSE . cse_file CSE . register . samba-gpupdate CSE . --machine CSE Machine --user CSE User gpo cse unregister GUID (CSE) . GUID ( CSE ) . GUID `samba-tool gpo cse list` . gpo del gpo [options] GPO. gpo dellink container_dn gpo [options] GPO (container). gpo fetch gpo [options] GPO. gpo getinheritance container_dn [options] . gpo getlink container_dn [options] GPO . gpo list username [options] GPO . gpo listall GPO. gpo listcontainers gpo [options] GPO. gpo load gpo [options] GPO. json (EOF) json --content . json_input: [ { "keyname": "Software\Policies\Mozilla\Firefox\Homepage", "valuename": "StartPage", "class": "USER", "type": "REG_SZ", "data": "homepage" }, { "keyname": "Software\Policies\Mozilla\Firefox\Homepage", "valuename": "URL", "class": "USER", "type": "REG_SZ", "data": "google.com" }, { "keyname": "Software\Microsoft\Internet Explorer\Toolbar", "valuename": "IEToolbar", "class": "USER", "type": "REG_BINARY", "data": [0] }, { "keyname": "Software\Policies\Microsoft\InputPersonalization", "valuename": "RestrictImplicitTextCollection", "class": "USER", "type": "REG_DWORD", "data": 1 } ] : MACHINE|USER|BOTH . --machine-ext-name --user-ext-name ldap gPCMachineExtensionNames gPCUserExtensionNames GPO . GUID . GUID . . {35378EAC-683F-11D2-A89A-00C04FBBCFA2} . -H H LDB URL --content=CONTENT JSON --machine-ext-name=MACHINE_EXTS gPCMachineExtensionNames --user-ext-name=USER_EXTS gPCUserExtensionNames --replace gpo manage security list gpo [options] sysvol. sysvol winbind . AD DC . : samba-tool gpo manage security list {31B2F340-016D-11D2-945F-00C04FB984F9} -H URL, --URL=URL LDB URL gpo manage security set gpo [options] sysvol. sysvol winbind . . AD DC . : samba-tool gpo manage security set {31B2F340-016D-11D2-945F-00C04FB984F9} MaxTicketAge 10 : MaxTicketAge (). MaxServiceAge . MaxRenewAge . MinimumPasswordAge . MaximumPasswordAge . MinimumPasswordLength . PasswordComplexity . 1 0 . -H URL, --URL=URL LDB URL sysvol. sysvol winbind . AD DC . : samba-tool gpo manage security list {31B2F340-016D-11D2-945F-00C04FB984F9} -H URL, --URL=URL LDB URL gpo manage smb_conf list smb.conf sysvol winbind . : samba-tool gpo manage smb_conf list {31B2F340-016D-11D2-945F-00C04FB984F9} -H URL, --URL=URL LDB URL gpo manage smb_conf set gpo [value] [options] smb.conf sysvol winbind. smb.conf . : samba-tool gpo manage smb_conf set {31B2F340-016D-11D2-945F-00C04FB984F9} 'apply gpo policies' yes -H URL, --URL=URL LDB URL gpo setinheritance container_dn block|inherit [options] . gpo setlink container_dn gpo [options] GPO . gpo removegpo [options] GPO. GPO. json (EOF) json --content . Example json_input: [ { "keyname": "Software\Policies\Mozilla\Firefox\Homepage", "valuename": "StartPage", "class": "USER", }, { "keyname": "Software\Policies\Mozilla\Firefox\Homepage", "valuename": "URL", "class": "USER", }, { "keyname": "Software\Microsoft\Internet Explorer\Toolbar", "valuename": "IEToolbar", "class": "USER" }, { "keyname": "Software\Policies\Microsoft\InputPersonalization", "valuename": "RestrictImplicitTextCollection", "class": "USER" } ] : MACHINE|USER|BOTH -H H LDB URL --content=CONTENT JSON --machine-ext-name=MACHINE_EXTS gPCMachineExtensionNames --user-ext-name=USER_EXTS gPCUserExtensionNames --color=always|never|auto (: auto) gpo restore displayname backup location [options] GPO . -H H LDB URL --tmpdir=TMPDIR --entities=ENTITIES XML DOCTYPE --restore-metadata GPT.INI gpo show gpo [options] GPO. gpo manage symlink list VGP sysvol gpo manage symlink add VGP sysvol gpo manage symlink remove VGP sysvol gpo manage files list VGP sysvol gpo manage files add VGP sysvol gpo manage files remove VGP sysvol gpo manage openssh list OpenSSH VGP sysvol gpo manage openssh set OpenSSH VGP sysvol gpo manage sudoers add Sudoers sysvol. gpo manage sudoers list Sudoers sysvol. gpo manage sudoers remove Sudoers sysvol. gpo manage scripts startup list VGP sysvol gpo manage scripts startup add VGP sysvol gpo manage scripts startup remove VGP sysvol gpo manage motd list MOTD VGP sysvol. gpo manage motd set MOTD VGP sysvol gpo manage issue list Issue VGP sysvol. gpo manage issue set Issue VGP sysvol gpo manage access add VGP sysvol gpo manage access list VGP sysvol gpo manage access remove VGP sysvol group . group add groupname [options] AD. group create groupname [options] AD. samba-tool group add . samba-tool group add . group addmembers groupname members [options] AD. group addunixattrs groupname gidnumber [options] RFC2307 . sAMaccountName . (RFC2307) . 'idmap_ldb:use rfc2307 = Yes' smb.conf UID/GID . . -H --URL= . : samba-tool group addunixattrs Group1 10000 RFC2307 . '10000' . -H URL, --URL=URL LDB URL group delete groupname [options] AD. group edit groupname AD . --editor=EDITOR 'vi' . group list . group listmembers groupname [options] AD . sAMAccountName . sAMAccountName CN . --full-dn (DN) sAMAccountName. --hide-expired . --hide-disabled . group move groupname new_parent_dn [options] . sAMAccountName . DN domainDN . group removemembers groupname members [options] AD . group show groupname [options] . group stats [options] . group rename groupname [options] . . CN . CN sAMAccountName . --force-new-cn CN --reset-cn . . sAMAccountName . --force-new-cn=NEW_CN CN (RDN) sAMAccountName. --reset-cn CN sAMAccountName. --mail-address=MAIL_ADDRESS --samaccountname=SAMACCOUNTNAME (sAMAccountName/logon name) ldapcmp URL1 URL2 domain|configuration|schema|dnsdomain|dnsforest [options] LDAP. ntacl NT ACL. ntacl changedomsid original-domain-SID new-domain-SID file [options] SID ACL. acl_xattr SID / rsync . --use-ntvfs ACL TDB xattr. POSIX NT ACL . --service=SERVICE smb.conf . --use-s3fs . --use-s3fs ACL s3fs VFS. smb.conf --service=SERVICE . --xattr-backend=[native|tdb] xattr ( tdb). --eadb-file=EADB_FILE tdb . --recursive ACL . --follow-symlinks --recursive . --verbose ACL . ntacl getdosinfo file [options] DOS xattr. ntacl get file [options] ACL . ntacl set acl file [options] ACL . ntacl sysvolcheck ACL sysvol ( ACL GPO). ntacl sysvolreset ACL sysvol ( ACL GPO). ou (OUs). ou add ou_dn [options] . DN domainDN . --description=DESCRIPTION OU. ou create ou_dn [options] . samba-tool ou add . samba-tool ou add . ou delete ou_dn [options] . DN domainDN . --force-subtree-delete . ou list [options] . --full-dn DN DN . ou listobjects ou_dn [options] . DN domainDN . --full-dn DN DN . -r|--recursive . ou move old_ou_dn new_parent_dn [options] . DN domainDN . ou rename old_ou_dn new_ou_dn [options] . DN domainDN . processes . samba-tool smb.conf -s/--configfile . --name=NAME . --pid=PID PID. rodc (RODC). rodc preload SID|DN|accountname [options] RODC. schema (schema). schema attribute modify attribute [options] . schema attribute show attribute [options] . schema attribute show_oc attribute [options] (objectclasses) . schema objectclass show objectclass [options] . service-account (Service Accounts). service-account list . -H, --URL LDB URL . --json JSON . service-account view . -H, --URL LDB URL . --name (). service-account create . -H, --URL LDB URL . --name (). --dns-host-name DNS (). --group-msa-membership SDDL Group MSA. --managed-password-interval . service-account modify . -H, --URL LDB URL . --name (). --dns-host-name DNS . --group-msa-membership SDDL Group MSA. service-account delete . -H, --URL LDB URL . --name . service-account group-msa-membership Group MSA . service-account group-msa-membership show Group MSA . -H, --URL LDB URL . --name (). --json JSON . service-account group-msa-membership add (principal) Group MSA . -H, --URL LDB URL . --name (). --principal DN SID . service-account group-msa-membership remove Group MSA . -H, --URL LDB URL . --name (). --principal DN SID . shell . shell [options] ldb . -H, --URL LDB URL . sites (Sites). sites list [options] . --json JSON sites view site [options] . sites create site [options] . sites remove site [options] . sites subnet list site [options] . --json JSON sites subnet view subnet [options] . sites subnet create subnet site-of-subnet [options] . sites subnet remove subnet [options] . sites subnet set-site subnet site-of-subnet [options] . spn (SPN). spn add name user [options] SPN . spn delete name [user] [options] SPN . spn list user [options] SPN . testparm () . time . user . user add username [password] . user addunixattrs username uid-number [options] RFC2307 . . sAMaccountName . uid . (RFC2307) . '--gid-number' 'gidNumber' . '--gid-number' gidNumber 'Domain Users' Domain Users gidNumber . '--unix-home' /home/DOMAIN/username . '--login-shell' '/bin/sh' . '--gecos' gecos 'CN' . 'idmap_ldb:use rfc2307 = Yes' smb.conf UID/GID . . -H --URL= . : samba-tool user addunixattrs User1 10001 RFC2307 Domain Users gidNumber . '10001' . : samba-tool user addunixattrs User2 10002 --gid-number=10001 --unix-home=/home/User2 RFC2307 . '10002' . gidNumber '10001' . '/home/user2' . : samba-tool user addunixattrs User3 10003 --gid-number=10001 --login-shell=/bin/false --gecos='User3 test' RFC2307 . '10003' . gidNumber '10001' . '/bin/false' . gecos 'User3 test' . -H URL, --URL=URL LDB URL --gid-number=GROUP_ID GID /RFC2307 --unix-home=DIR /RFC2307 --login-shell=SHELL /RFC2307 --gecos=GECOS GECOS /RFC2307 --uid=USER_ID (UID) /RFC2307 user create username [password] . samba-tool user add . samba-tool user add . user delete username [options] . user disable username . --remove-supplemental-groups . user edit username AD . --editor=EDITOR 'vi' . user enable username . user list . sAMAccountName . --full-dn (DN) sAMAccountName. -b BASE_DN|--base-dn=BASE_DN DN . DN . --hide-expired . --hide-disabled . --locked-only . user setprimarygroup username primarygroupname . user getgroups username . user show username [options] AD . --attributes=USER_ATTRS . user move username new_parent_dn [options] . sAMAccountName . DN domainDN . user password [options] ( ). user rename username [options] . . CN . CN . ('.') . --force-new-cn CN --reset-cn . . sAMAccountName . --surname=SURNAME --given-name=GIVEN_NAME --initials=INITIALS --force-new-cn=NEW_CN CN (RDN) . --reset-cn CN . --display-name=DISPLAY_NAME --mail-address=MAIL_ADDRESS --samaccountname=SAMACCOUNTNAME (sAMAccountName/ ) --upn=UPN (UPN) user sensitive accountname [show|on|off] [options] UF_NOT_DELEGATED . -H URL, --URL=URL LDB URL user setexpiry username [options] . user setpassword username [options] . user unlock username [options] . user getpassword username [options] . user get-kerberos-ticket username [options] (TGT) . user syncpasswords --cache-ldb-initialize [options] . ( PDC). user auth policy assign username [options] . --policy . user auth policy remove username . user auth policy view username . user auth silo assign username [options] . --silo . user auth silo remove username . user auth silo view username . user keytrust (Key Credential Links) . msDS-KeyCredentialLink . user keytrust add username public-key-or-certificate[options] key-credential-link . RSA ( ) PEM DER . --encoding . --force . --link-target=DN DN (: DN ) --encoding=ENCODING pem der auto. auto . --force user keytrust delete username [options] key-credential-link. . --all ( ). --link-target DN . --fingerprint . SHA256 DER . user keytrust view . --link-target --fingerprint --all . --dry-run . --link-target=DN ( DN) --fingerprint=HH:HH:.. --all -n, --dry-run user keytrust view username [options] . DN . --verbose . -h, --help -v, --verbose user generate-csr username subject_name private_key_filename output_filename [options]" (CSR) PEM . --private-key-encoding . 'auto' . --private-key-pass . vampire [options] domain AD . samba-tool vampire samba-tool domain join . visualize [options] subcommand . . () . MODES OF OPERATION samba-tool visualize ntdsconn NTDS. samba-tool visualize reps repsTo repsFrom. samba-tool visualize uptodateness . GRAPHICAL MODES --distance DC . --dot dot Graphviz ( ntdsconn reps). dot xdot DC . . --xdot dot Graphviz [--dot] /usr/bin/xdot. -r samba-tool [-r] DC . samba-tool visualize uptodateness samba-tool visualize reps repsFrom/To . help . (VERSION) 4.24.6 . (AUTHOR) (Andrew Tridgell) . (Samba Team) . Samba 4.24.6 08/16/2026 SAMBA-TOOL(8)