Samba - password synchronization-possible rights escalation

[ddaas]

Hello,
On the network where I am admin there is another guy who installs win clients, makes update etc.
It needs the samba root password (not the Linux root pass) to install new win clients etc.
My problem is that I have password synchronization between samba and Linux.
The guy who administers the win clients could log in from windows with his samba root password and change (from windows) my root password from the server.

Any idea how can I solve this problem? I don't want him to have possibility to change my root pass or other rights escalation to occur.

Can I restrict password synchronization only for root account?

Please need help.

ddaas

[GoldenEye]

Just create a new (no root) linux user and turn it into a samba server domain administrator, and then give the password to the guyl

[ddaas]

But the first when a windows client is added to the domain, it should log in as root. So it needs root to add a new machine to samba domain.

Am I right?

ddaas

[adam7979]

like GoldenEye said, you can have more domain administrator by adding entries into smb.conf

[ddaas]

I did it so:

admin user = not_root_user
invalid users = root

Thanks

[adam7979]

hmm..... try

domain admin group = not_root_user