There's a "fix" in Microsoft's July updates that prevents Samba servers running in member mode using the idmap backend = ad. It looks like the default (confirmed with "testparm -s /etc/samba/smb.conf | egrep -i 'security|idmap'") is idmap config <domain> : backend = rid, or at least, I haven't changed it to that, so I believe that upgrading the DC's will go without issue.

Has anyone using AD with Unraid joined as a member server had any issues with AD account permissions since the July update? Any speedbumps or things I should be doing to prep?

I do have 2 DC's running across my 2 Unraid servers as VMs and a third running on bare metal with a NUC for backup purposes when the VMs aren't running, though I can't think of a great way to test the Windows patches to see if everything's working other than just going for it.

Any advice gratefully accepted. Thanks!

On 8/10/2025 at 10:24 AM, Alyred said:

There's a "fix" in Microsoft's July updates that prevents Samba servers running in member mode using the idmap backend = ad. It looks like the default (confirmed with "testparm -s /etc/samba/smb.conf | egrep -i 'security|idmap'") is idmap config <domain> : backend = rid, or at least, I haven't changed it to that, so I believe that upgrading the DC's will go without issue.

Has anyone using AD with Unraid joined as a member server had any issues with AD account permissions since the July update? Any speedbumps or things I should be doing to prep?

I do have 2 DC's running across my 2 Unraid servers as VMs and a third running on bare metal with a NUC for backup purposes when the VMs aren't running, though I can't think of a great way to test the Windows patches to see if everything's working other than just going for it.

Any advice gratefully accepted. Thanks snow rider 3d!

1. If your Samba member server is still using idmap_ad, after the DCs get updated, you may lose SMB authentication or even lose the ability to map AD-supplied identities to Unix accounts properly.

2. Switching from idmap_ad → idmap_rid or another backend will change how UIDs/GIDs are assigned. This can break file permissions, ACLs, or cause mismatches if you already have files owned by users via the old mapping.

3. Some users report that after switching, all users and groups essentially get new IDs, and previous ownerships are “lost” (effectively) unless remapped

Thanks. As I stated, I do have backend=rid in my samba settings, so I knew that part was set correctly. I wasn't sure if there were any additional things to watch out for.

I upgraded one of my servers and set it as the primary to test, and all seems to have gone well. Haven't quite pulled the trigger on my other primary though... probably should be able to do that without issue.

And switching from backend=ad to backend=rid would absolutely reset mappings for users, as it changes the whole schema for mapping users to linux IDs.