Cannot view AD Users/Groups in ACL menu

[icsy7867]

I am doing some upgrade/maintenance on one of our IXSystem boxes. After the upgrade I was having trouble re-binding to the domain. However after some fiddling I seemed to have it working. Currently running FreeNAS-11.3-U5.

The machine has been bound to the domain now. The Computer object is happily in AD, and the Directory Services shows Active Directory: Healthy. Not sure what else to try. I have bound, unbound, deleted the AD object, rebound to the same effect. I even tried LDAP, which had the same result. Showed "Successful", but no users/groups propagated. Hoping for some guidance.

Code:

wbinfo -g

Code:

wbinfo -u

Both of these commands show valid users and groups from AD. And per googling and searching on the forums I see people usually ask for these too:

Code:

cat /etc/nsswitch.conf
group: files winbind
hosts: files dns
networks: files
passwd: files winbind
shells: files
services: files
protocols: files
rpc: files
sudoers: files

and:

Code:

testparm -s

Load smb config files from /usr/local/etc/smb4.conf
Loaded services file OK.
Server role: ROLE_DOMAIN_MEMBER

# Global parameters
[global]
    aio max threads = 2
    allow trusted domains = No
    bind interfaces only = Yes
    disable spoolss = Yes
    dns proxy = No
    domain master = No
    enable web service discovery = Yes
    kerberos method = secrets and keytab
    kernel change notify = No
    load printers = No
    local master = No
    logging = file
    max log size = 51200
    nsupdate command = /usr/local/bin/samba-nsupdate -g
    preferred master = No
    realm = domain.company.com
    restrict anonymous = 2
    security = ADS
    server min protocol = SMB2_02
    server role = member server
    server string = FreeNAS Server
    template shell = /bin/sh
    unix extensions = No
    winbind cache time = 7200
    winbind enum groups = Yes
    winbind enum users = Yes
    winbind max domain connections = 10
    winbind nss info = rfc2307
    winbind status fifo = Yes
    workgroup = DOMAIN
    idmap config *: range = 90000001-100000000
    idmap config domain: schema_mode = rfc2307
    idmap config domain: range = 10000-90000000
    idmap config domain: backend = ad
    idmap config * : backend = tdb
    allocation roundup size = 0
    directory name cache size = 0
    dos filemode = Yes
    include = /usr/local/etc/smb4_share.conf


[Data]
    aio write size = 0
    ea support = No
    mangled names = illegal
    path = /mnt/tank/Data
    read only = No
    vfs objects = streams_xattr zfs_space zfsacl
    nfs4:acedup = merge
    nfs4:chown = true

 

[anodos]

Do you see the ad users and groups in `getent user` and `getent group` output?
You have selected the `AD` idmap backend for your domain, which relies on MS-SFU-style LDAP schema extensions in active directory. Are you using such attributes in AD?

 

[icsy7867]

Do you see the ad users and groups in `getent user` and `getent group` output?
You have selected the `AD` idmap backend for your domain, which relies on MS-SFU-style LDAP schema extensions in active directory. Are you using such attributes in AD?

This was actually it, I went back to RID and everything seems OK now. Not sure what changed upgrading to 11.3, but something enough to have to reset these. Thanks for the prompt reply!