I setup Samba version 4.1.17-Ubuntu as domain controller and active directory, and everything seemed to go smoothly, but when I try to use the administrator account on one windows 10 PC domain member to create new user in the AD using Windows active directory users and computers management tool, I get this error:

An error occured, contact your system administrator

(I get the same problem when trying to copy the user as well).

But when I use samba-tool to create a user, it works pefectly.

Here is my smb.conf file:

        workgroup = EXAMPLE
        realm = EXAMPLE.LOCAL
        netbios name = LINUXSERVER
        server role = active directory domain controller
        dns forwarder =
        idmap_ldb:use rfc2307 = yes

        path = /var/lib/samba/sysvol/example.local/scripts
        read only = No

        path = /var/lib/samba/sysvol
        read only = No [Users]
        directory_mode: parameter = 0700
        read only = no
        path = /Users
        csc policy = documents

        directory_mode: parameter = 0700
        read only = no
        path = /Users
        csc policy = documents

Another related problem: I am going to mention this problem too, because it may help finding the causes of the previous problem. When I try to change the password of any user using the same windows tools, I get an error about that my computer and my user has to have delegate permissions.

And there might be something else doesn't work, but at least till now that is just what I found.

So what I want is to get that windows tool to get working correctly somehow.

What I tried:

  • I tried to delete the profile of administrator account.
  • I tried to create a new test account with administrator permissions using samba-tool and tried to create users from that account with no success.
  • I tried to give the administrator user delegate permissions by right clicking on the domain name and then delegate controller but also with no success for both errors.
  • I tried with and without the last block [Users], (I actually don't understand what does it do exactly).
  • Leaving and rejoining the domain.

And all of those were with no success, I appreciate any help from you.


Upgrade to Samba 4.3.

The problem is related to a buggy and/or incomplete implementation of the "Backup Key" sub-protocol that older Samba versions have. You'll probably notice that Credential Manager was also unusable for the same reason.

Alternatively, use an older OS to manage the directory – e.g. Server 2003 can create user accounts without any problems, since it doesn't use the "Backup Key" protocol for anything yet. (I am not sure about Server 2008.)

Unfortunately, 4.3 is not yet packaged for Ubuntu – still pending in Debian's "unstable" too – however, it's actually easy to build Samba from source code.

As for the [Users] block, it simply defines a shared folder.

In smb.conf, every section except [global] corresponds to a share definition – "netlogon" and "sysvol" are special AD shares, and "Users" is probably a custom one.

  • I am building it right now, thank you for your advice, I will tell you what will happen when I finish installing it. – Mohammed Noureldin Feb 23 '16 at 23:33
  • That did it!! it worked like a charm! Than you a lot! (sorry I still doesn't have enough reputation to rate it up). Thanks again. – Mohammed Noureldin Feb 24 '16 at 0:10
  • Sorry but could you tell me where can I find that Users folder? should I add it manually or should it appear somewhere? – Mohammed Noureldin Feb 24 '16 at 0:31
  • I tried adding that Users folder, but I have no permissions to access it, do you have any idea about that folder? as it seems not to be custom folder – Mohammed Noureldin Feb 24 '16 at 0:37
  • @MohammedNoureldin: I'm not sure. It is definitely custom configuration, maybe someone tried to set up personal file storage for users, but forgot to actually mkdir it; or maybe it's something Ubuntu-specific. (You would access it via \\linuxserver\Users on Windows.) Either way, that folder is not required for an AD DC – only the two shares "netlogon" and "sysvol" are required (mainly because the Group Policy settings are stored on them). – user1686 Feb 24 '16 at 0:42

A workaround with Samba 4.1.17 with Windows 10 clients is to change a registry key:

Add a 32bit DWORD named ProtectionPolicy with value 1 at:


No restart or logout/login required. With us this resolved an issue with very slow typing in the remote desktop connection window's computer name field, too, and the resetting of passwords in ADUC.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.