Directory Services Issue - Can't have a hyphen in the IDMAP Domain Name field

TrueNAS General
,
1

So, first-time TrueNAS SCALE user here (Version 25.10.4).

I’ve been trying to get the Directory Services Configuration to sync with a new AD instance (Test environment) after the initial configuration steps with no luck. Configured for Active Directory, was able to get it to successfully make a new user in the correct OU, and got it to populate the initial list of users and groups, and autoconfigure itself just fine. However, any changes to AD users (such as adding or deleting someone) made after this step won’t propagate even after syncing the cache.

I figured maybe I needed to tweak the UID/GID range under the IDMAP Domain category, but I noticed I can’t actually save my config changes when I try to update values. It took me a bit, but as I found out, the NETBIOS name I used for this test DC contains invalid characters according to the TrueNAS SCALE UI; the NETBIOS name is MLN-TEST-DC1, and hyphens aren’t allowed.

So… is there anything I can do here? I can’t customize values because the NETBIOS name is invalid, and right now the only way to actually unlock the save button is to check “Use TrueNAS Server IDMAP Defaults,” which does me no good for troubleshooting.

Thanks in advance for your time!

2

Okay, so, I find it unlikely you named your domain MLN-TEST-DC1. That looks more like the name of a domain controller, which is very different. To verify what should be there, open Active Directory Domains and Trusts, and open your domain’s properties window like so:

image
image856×460 17.2 KB

The “pre-Windows 2000” name should be the IDMAP domain name, and it should have been automatic when joining. It should not be the name of a specific domain controller. As a side note, your domain controller should not be the same as the domain itself to avoid confusion, but it’s not technically illegal.

Your TrueNAS should be configured to consult the domain’s DNS server (if you’re using defaults, that would normally be a domain controller). The important part is that it’s not your router or ISP.

Normally you should not need to “tweak” anything in the Advanced settings unless you have a legacy setup that’s been going for 8 years plus like mine.

I would check your logs in /var/log/samba4, those will contain the logs of the underlying system that does all the active directory stuff and may hopefully lead to hints at what might be going wrong.