https://samba.tranquil.it/doc/en/samba_config_server-server_prepare_debian.html

~~~

userdel -r user

update-locale LANG=en_US.UTF-8
localectl

/root/.ssh/authorized_keys
  [...]

apt install apt-transport-https locales-all gnupg net-tools mc nmap rsync screen tcpdump telnet

nano /etc/network/interfaces
  auto lo
  iface lo inet loopback
  auto ens18
  iface ens18 inet static
  address 192.168.10.247
  netmask 255.255.255.0
  gateway 192.168.10.254

(reboot)

nano /etc/resolv.conf
  nameserver 192.168.10.254

nano /etc/systemd/timesyncd.conf
  NTP=bfw-Router.lan
  FallbackNTP=192.168.10.254

(shutdown + remove install media + backup!)

apt install samba winbind libnss-winbind krb5-user smbclient ldb-tools python3-cryptography

rm /etc/samba/smb.conf
rm /etc/krb5.conf

nano /etc/hostname
  bfw-dc1.hl.local

nano /etc/hosts
  127.0.0.1 localhost
  192.168.10.247 bfw-dc1.hl.local bfw-dc1

nano /etc/resolv.conf
  search hl.local
  nameserver 127.0.0.1

nano /etc/krb5.conf
  [libdefaults]
    default_realm = HL.LOCAL
    dns_lookup_kdc = true
    dns_lookup_realm = false

systemctl stop samba winbind nmbd smbd

samba-tool domain provision --use-rfc2307 --realm=HL.LOCAL --domain=HL --server-role=dc --adminpass=Baumkuchen123! --option="dns forwarder = 192.168.10.254" --option="ad dc functional level = 2016" --site=BFW-HL

rm -f /var/lib/samba/private/krb5.conf
ln -s /etc/krb5.conf /var/lib/samba/private/krb5.conf

systemctl disable smbd nmbd winbind
systemctl mask smbd nmbd winbind
systemctl unmask samba-ad-dc
systemctl enable samba-ad-dc

(reboot)

samba-tool domain passwordsettings set --complexity=off --history-length=0 --min-pwd-length=3

samba-tool user setpassword Administrator

kinit Administrator
klist

samba-tool domain functionalprep --function-level=2016
samba-tool domain level raise --domain-level=2016 --forest-level=2016
samba-tool domain level show

apt install msitools cabextract

samba-tool gpo admxload -U Administrator
wget "https://download.microsoft.com/download/f35d3000-b6c9-4ca6-bedc-5e4ec15a6b7a/Administrative%20Templates%20(admx)%20for%20Windows%2011%20Sep%202025%20Update.msi" -O admx_2025.msi

wget "https://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/ca10b2d2-1f5e-4f2f-8e09-72839fc80c98/MicrosoftEdgePolicyTemplates.cab" -O admx_edge.cab

wget "https://github.com/microsoft/terminal/releases/download/v1.24.10621.0/GroupPolicyTemplates_1.24.10621.0.zip" -O admx_terminal.zip

msiextract ./admx_2025.msi
samba-tool gpo admxload -U Administrator --admx-dir=./admx_2025/

(shutdown + backup!)

apt install bind9

nano /etc/bind/named.conf.options
  options {
      directory "/var/cache/bind";
      forwarders {
          192.168.10.254;
      };
      allow-query { any; };
      dnssec-validation no;
      minimal-responses yes;
      auth-nxdomain no;

      #listen-on-v6 port 5353 { ::1; };
      listen-on port 5353 { 127.0.0.1; };
  };

nano /etc/default/named
  RESOLVCONF=no
  OPTIONS="-4 -u bind"

namo /etc/samba/smb.conf
  [...]
  dns forwarder = 127.0.0.1:5353
  [...]

(reboot)

samba-tool dns zonecreate bfw-dc1 10.168.192.in-addr.arpa -U Administrator
samba-tool dns zonecreate bfw-dc1 20.168.192.in-addr.arpa -U Administrator
samba-tool dns zonecreate bfw-dc1 30.168.192.in-addr.arpa -U Administrator
samba-tool dns add bfw-dc1.hl.local 10.168.192.in-addr.arpa 247 PTR bfw-dc1.hl.local -U Administrator
samba-tool dns query bfw-dc1 10.168.192.in-addr.arpa @ ALL -U Administrator

~~~

Windows 11 -> Optional features
  RSAT: Active Directory Domain Services and Lightweight Directory Services Tools
  RSAT: DNS Server Tools
  RSAT: Group Policy Management Tools

~~~

OpenWrt -> DNS -> Filter -> Domain whitelist
  hl.local

OpenWrt -> DNS -> Forwards -> DNS Forwards
  /hl.local/192.168.10.247

~~~

netstat -tapn | grep 5353

dig @localhost google.de
dig @localhost bfw-dc1.hl.local
dig -t SRV @localhost _ldap._tcp.hl.local


host -t A hl.local
host -t A bfw-dc1.hl.local
host -t SRV _kerberos._udp.hl.local
host -t SRV _ldap._tcp.hl.local

smbclient -L hl.local -N

samba-tool domain info bfw-dc1.hl.local