Peck Yong Lee

Adventure through Samba & Active Directory

2026-10-15T00:00:00Z

AI tools were not used in the production of this post.

Background

I inherited a (mostly) greenfield IT environment when I joined a growing SME firm as an IT consultant. This firm had recently moved all their data to a Synology network-attached storage (NAS) device, and decided to forgo backing up individual workstations in favor of backing up the NAS instead. So, the firms storage and backup strategy were sorted, however there were still many issues. Most pressing of which was network security, which I'll cover in another post.

Problem

The second most pressing matter was endpoint security and management. Here were some of the biggest pain points:

All workstations had a single local user account. These accounts, being the only user account on said workstations, necessarily had to be administrator accounts, something that employees exploited to install non-approved software.
Printers and network shares were manually configured on each workstation, which meant IT had to manually configure these remotely over RDP every time a mapped network share or printer was somehow unmapped.
Provisioning new users was a pain. Here's the process:
1. Create the new users NAS account
2. Create the new users private "home" network share on NAS
3. Assign the new users NAS account the required permissions to network shares.
4. Use RDP to remote into the specific workstation that the new starter was assigned to use, map the relevant network shares. This is where the new NAS account credentials will have to be entered.
5. Ensure printers were mapped and working.
6. Clean up the workstation local user directory to clear files of previous user.
  (i.e. clear C:\Users\<user>\Downloads etc.)
7. Backup Outlook mailbox to a .pst file and move this file to the previous users private "home" network share.
8. Sign out of previous users Outlook account and sign into new Outlook users account.

Needless to say, it was a tedious and fragile process.

Solution

I decided that it was worth the effort to set up an Active Directory domain, especially considering that the firm was growing. This would allow for centralised authentication and Windows host management.

The first rather obvious solution I considered was Windows Server. However, funding for Windows Server licenses could not be obtained, so I decided to try using Samba on Debian Linux as the Active Directory domain controller instead. I heard good things about Samba from a few other IT professionals, and was comfortable with using Linux and troubleshooting issues myself, so it was a natural choice.

I spun up a Debian VM on the firms Proxmox VE environment, installed Samba via apt and then followed the instructions provided in the Samba documentation. It was surprisingly easier than I expected, and before I knew it, the domain controller was up and running. After joining all Windows hosts as well as the NAS to the domain, I immediately got to work creating all user accounts and Group Policies through Remote Server Administration Tools

Benefits

Here were the benefits of implementing Active Directory:

Network shares, including private "home" network shares for each user, are now automatically mounted upon user logon via GPO. No need to use RDP to remote into each workstation and manually mount network shares.
Printers were automatically configured via GPO, which was previously configured by remoting into each workstation via RDP. Setting up printing was quite a hassle, and I might write a dedicated post in the future about this experience.
Centralised management of network connection profiles via GPO. This helped a lot when it came to setting up WPA-Enterprise authentication. I'll elaborate more in my future post about network security.
Each user has to remember only one set of credentials to access their workstation and other internal services. I also configured Keycloak for OIDC/SAML SSO, which I might write a dedicated post on later on.
Each user has their own C:\Users folder, which is automatically generated just in time on first logon. This saves IT from having to remotely login via RDP into each workstation to delete files of previous users.
All Windows hosts are registered with Samba's internal DNS server, which dynamically updates when the IP address of hosts change.

Provisioning a new user was now a one step process: create the new user in Active Directory Users and Computers and assign them to the appropriate groups. After that, It Just Works^TM as described above.

What I would improve in future

I would setup a secondary domain controller on a seperate physical host for redundancy. Unfortunately, this was not possible due to resource constraints, and the firm's leadership was advised of the possibility of extended downtime if the single domain controller failed. However, this risk was deemed acceptable, as recovery was expected to be relatively quick.

Chapter 1 - Artificial Intelligence, A Modern Approach

2026-09-27T00:00:00Z

AI has been on the news lately, and it seems like everyones got an opinion. I think it's important that I learn more about this technology on a deeper level so I can form my own opinions. It'll also allow me to stimulate the intellectual parts of my brain. I did learn a little about AI at university, but it wasn't my main focus at the time. Anyways, I'm going back to the basics, starting by reading a book that was on my university reading list: Artificial Intelligence: a modern approach by Peter Norvig and Stuart Russell.

I just finished reading the first chapter, which gives a very broad overview of AI.

It talks about the history of AI, and the various fields that have contributed to it.

It also talks about the many risks of AI, such as its potential societal and macroeconomic impacts.

The biggest thing I took away from this chapter was that AI evolved from using “traditional” methods that required humans to hard code logic and knowledge, to machine learning methods that learned from examples and experiences instead.

I’m going to skip the chapters that talk about hard coded logic and knowledge methods, as I want to focus more on machine learning and deep learning instead.

Intro - Road to CCNA

2026-09-01T00:00:00Z

I still remember when I was the designated Minecraft server sysadmin in my high school friend group. Barely knowing enough to get started, I installed VirtualBox, spun up a CentOS virtual machine, and somehow managed to configure port forwarding on my router. Even though I didn’t know enough to appreciate it at the time, my ISP was nice enough to provision a publicly routable IPv4 address to my home router (as opposed to putting my router behind carrier grade NAT). And just like that, my friends were able to connect to my server. One by one, they started to pop up in the blocky world of Minecraft. At this point, most people would declare their association with computer networking over. But for me, my obsession with computer networking had only just begun. I was fascinated and confused by the many little details that enable computer networks to work.

Anyways, fast forward a few years, and after many hours of reading Wikipedia articles, watching YouTube videos, talking to experienced sysadmins and engineers, and studying computer science at university, I now have a more complete understanding of computer networks.

But I feel like my knowledge ought to be formalized and expanded. In particular, my understanding of some protocols such as STP and BGP is very limited. I want to improve that. I also want to improve my ability to use Cisco specific tools. So, I've decided to study for the Cisco Certified Network Associate certification. I'll document my learning journey on here, so stay tuned.