Adventure through Samba & Active Directory

• 15 October 2026
• Computers,
• Enterprise IT

AI tools were not used in the production of this post.

Background

I inherited a (mostly) greenfield IT environment when I joined a growing SME firm as an IT consultant. This firm had recently moved all their data to a Synology network-attached storage (NAS) device, and decided to forgo backing up individual workstations in favor of backing up the NAS instead. So, the firms storage and backup strategy were sorted, however there were still many issues. Most pressing of which was network security, which I'll cover in another post.

Problem

The second most pressing matter was endpoint security and management. Here were some of the biggest pain points:

• All workstations had a single local user account. These accounts, being the only user account on said workstations, necessarily had to be administrator accounts, something that employees exploited to install non-approved software.
• Printers and network shares were manually configured on each workstation, which meant IT had to manually configure these remotely over RDP every time a mapped network share or printer was somehow unmapped.
• Provisioning new users was a pain. Here's the process:
  1. Create the new users NAS account
  2. Create the new users private "home" network share on NAS
  3. Assign the new users NAS account the required permissions to network shares.
  4. Use RDP to remote into the specific workstation that the new starter was assigned to use, map the relevant network shares. This is where the new NAS account credentials will have to be entered.
  5. Ensure printers were mapped and working.
  6. Clean up the workstation local user directory to clear files of previous user.
     (i.e. clear C:\Users\<user>\Downloads etc.)
  7. Backup Outlook mailbox to a .pst file and move this file to the previous users private "home" network share.
  8. Sign out of previous users Outlook account and sign into new Outlook users account.

Needless to say, it was a tedious and fragile process.

Solution

I decided that it was worth the effort to set up an Active Directory domain, especially considering that the firm was growing. This would allow for centralised authentication and Windows host management.

The first rather obvious solution I considered was Windows Server. However, funding for Windows Server licenses could not be obtained, so I decided to try using Samba on Debian Linux as the Active Directory domain controller instead. I heard good things about Samba from a few other IT professionals, and was comfortable with using Linux and troubleshooting issues myself, so it was a natural choice.

I spun up a Debian VM on the firms Proxmox VE environment, installed Samba via apt and then followed the instructions provided in the Samba documentation. It was surprisingly easier than I expected, and before I knew it, the domain controller was up and running. After joining all Windows hosts as well as the NAS to the domain, I immediately got to work creating all user accounts and Group Policies through Remote Server Administration Tools

Benefits

Here were the benefits of implementing Active Directory:

• Network shares, including private "home" network shares for each user, are now automatically mounted upon user logon via GPO. No need to use RDP to remote into each workstation and manually mount network shares.
• Printers were automatically configured via GPO, which was previously configured by remoting into each workstation via RDP. Setting up printing was quite a hassle, and I might write a dedicated post in the future about this experience.
• Centralised management of network connection profiles via GPO. This helped a lot when it came to setting up WPA-Enterprise authentication. I'll elaborate more in my future post about network security.
• Each user has to remember only one set of credentials to access their workstation and other internal services. I also configured Keycloak for OIDC/SAML SSO, which I might write a dedicated post on later on.
• Each user has their own C:\Users folder, which is automatically generated just in time on first logon. This saves IT from having to remotely login via RDP into each workstation to delete files of previous users.
• All Windows hosts are registered with Samba's internal DNS server, which dynamically updates when the IP address of hosts change.

Provisioning a new user was now a one step process: create the new user in Active Directory Users and Computers and assign them to the appropriate groups. After that, It Just Works^TM as described above.

What I would improve in future

I would setup a secondary domain controller on a seperate physical host for redundancy. Unfortunately, this was not possible due to resource constraints, and the firm's leadership was advised of the possibility of extended downtime if the single domain controller failed. However, this risk was deemed acceptable, as recovery was expected to be relatively quick.

• ← Previous
  Chapter 1 - Artificial Intelligence, A Modern Approach