Re: Attribut msDS-KeyCredentialLink is missing

Hello,
I'm continuing my investigations.
I have an error when trying to re-import the AD_DS_Attributes__Windows_Serv=
er_2016.ldf file because some attributes are always in.
So I extract all of them:

grep "lDAPDisplayName:" /usr/share/samba/setup/ad-schema/AD_DS_Attributes__=
Windows_Server_2016.ldf | awk '{print $2}' > /tmp/attributes_list.txt

Then I check if all attributes exist on my schema:

while read attr; do
    result=3D$(sudo ldbsearch -H /var/lib/samba/private/sam.ldb \
      -b "CN=3DSchema,CN=3DConfiguration,DC=3Ddomain,DC=3Dlocal" \
      "(lDAPDisplayName=3D$attr)" lDAPDisplayName 2>/dev/null | grep "lDAPD=
isplayName:")
    if [ -z "$result" ]; then
        echo "MISSING: $attr"
    fi
done < /tmp/attributes_list.txt

All of this are missing:

MISSING: msds-tokenGroupNames
MISSING: msds-tokenGroupNamesGlobalAndUniversal
MISSING: msds-tokenGroupNamesNoGCAcceptable
MISSING: msDS-DeviceMDMStatus
MISSING: msDS-ExternalDirectoryObjectId
MISSING: msDS-IsCompliant
MISSING: msDS-KeyId
MISSING: msDS-KeyMaterial
MISSING: msDS-KeyUsage
MISSING: msDS-KeyPrincipal
MISSING: msDS-KeyPrincipalBL
MISSING: msDS-DeviceDN
MISSING: msDS-ComputerSID
MISSING: msDS-CustomKeyInformation
MISSING: msDS-KeyApproximateLastLogonTimeStamp
MISSING: msDS-DeviceTrustType
MISSING: msDS-ShadowPrincipalSid
MISSING: msDS-ExpirePasswordsOnSmartCardOnlyAccounts
MISSING: msDS-UserAllowedNTLMNetworkAuthentication
MISSING: msDS-ServiceAllowedNTLMNetworkAuthentication
MISSING: msDS-StrongNTLMPolicy
MISSING: msDS-SourceAnchor
MISSING: msDS-ObjectSoa

Then extract all information for each attribute from AD_DS_Attributes__Wind=
ows_Server_2016.ldf to a new file, then import my new file...

samba-tool domain schemaupgrade --ldf-file=3D/home/user/AD_DS_Attributes__W=
indows_Server_2016_missing.ldf -v

import successful...
But WHfB still not working, after a new enrollment, my user cotinu to have =
no key:
#sudo samba-tool user keytrust view user
user has 0 key credential links

Where are the log for this?

In my smb.conf I have:
log level =3D 1 auth_json_audit:3@/var/log/samba/samba_audit.log dsdb_passw=
ord_json_audit:3@/var/log/samba/samba_password.log



Bruno MOREL
Administrateur syst=E8mes et r=E9seaux

-----Message d'origine-----
De=A0: samba <[email protected]> De la part de Rowland Penny vi=
a samba
Envoy=E9=A0: vendredi 12 juin 2026 13:17
=C0=A0: [email protected]
Cc=A0: Rowland Penny <[email protected]>
Objet=A0: Re: [Samba] Attribut msDS-KeyCredentialLink is missing

On Fri, 12 Jun 2026 06:10:13 +0000
Bruno MOREL <[email protected]> wrote:

> Hello,
> Well, I have trying to upgrade manually the schema with the file =

> AD_DS_Attributes_Windows_Server_2016.ldf and I have an error. I think =

> it is for that the upgrade doesn't pass... :
> =

> # samba-tool domain schemaupgrade
> --ldf-file=3D/usr/share/samba/setup/ad-schema/AD_DS_Attributes__Windows_
> Server_2016.ldf
> -v Applying
> /usr/share/samba/setup/ad-schema/AD_DS_Attributes__Windows_Server_2016
> .ldf
> updates..
>                                    . Exception: 'utf-8' codec can't =

> decode byte 0x92 in position 854: invalid start byte Error =

> encountered, aborting schema upgrade ERROR: Failed to upgrade schema
> =

> =


OK, I am now officially at a loss, I installed Debian 13 in a VM, added the=
 Tranquil IT Samba 4.24 repo and installed Samba and provisioned it as a ne=
w AD domain, checking the functional level returned '2008 R2'

So I attempted to upgrade the schema and got 'No changes applied to schema'
Not surprising, because when I checked the schema version, it was '88', so =
I checked for 'msDS-KeyCredentialLink' in AD and it was there.

So I attempted to raise the functional level, the first command:

sudo samba-tool domain functionalprep --function-level=3D2016

Gave me lots of 'Skip Forest Update' lines, so I moved onto the next
command:

sudo samba-tool domain level raise --domain-level=3D2016
--forest-level=3D2016

Which returned:

Domain function level changed!
Forest function level changed!
All changes applied successfully!

Added 'ad dc functional level =3D 2016' to the DCs smb.conf file and restar=
ted Samba.

sudo samba-tool domain level show
Now shows:
Domain and forest function level for domain 'DC=3Dad,DC=3Dhome,DC=3Darpa'

Forest function level: (Windows) 2016
Domain function level: (Windows) 2016
Lowest function level of a DC: (Windows) 2016

Or to put it another way, it works for me.

Rowland


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

-- =

To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba