Hi everyone,

This is not a bug per se nor a security issue, just a cosmetic one.

The dsaSignature attribute on the root of each partition should be updated when the domain is backup'ed, cf. [1]. This does trigger security audit alerts on some tools, like PingCastle for example.

So samba-tool domain backup should update that value in order to make auditors happy.

Moreover people can also backup the AD using lvm snapshot or other tools, and perhaps there could be a command line helper to just update the value without doing the backup itself (domain backup still have rough edges).

Cheers,

Denis


[1] https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/ntds-replication-event-2089-backup-latency-interval