undo samba

Step 0 — Capture current state (do not skip)

You'll need the idmap ranges and the SID mapping later to keep file ownership consistent under IdM.

mkdir -p /root/winbind-teardown-$(date +%F)
cd /root/winbind-teardown-$(date +%F)

testparm -s > smb.conf.effective 2>/dev/null
cp -a /etc/samba/smb.conf              smb.conf.orig
cp -a /etc/nsswitch.conf               nsswitch.conf.orig
cp -a /etc/krb5.conf                   krb5.conf.orig 2>/dev/null
cp -a /etc/krb5.keytab                 krb5.keytab.orig 2>/dev/null
cp -a /var/lib/samba/private/secrets.tdb secrets.tdb.orig 2>/dev/null
authselect current > authselect.current 2>&1
realm list > realm.list 2>&1

# The important one — the idmap config that decided every UID on this box
testparm -s 2>/dev/null | grep -i idmap > idmap.ranges

# Snapshot who owns what on the shares, before anything changes
getent passwd | grep -v '^[a-z_]*:x:[0-9]\{1,3\}:' > passwd.pre-teardown
ls -lan /path/to/share > share-ownership.pre 2>/dev/null   # adjust path

Keep idmap.ranges somewhere safe — matching it in IdM is what stops every file on the CIFS shares becoming nobody.

---

Step 1 — Leave the AD domain (while winbind still works)

This must happen first, while the machine account and keytab are still functional, so the computer object is removed cleanly from AD.

# Confirm the trust is still alive
wbinfo -t
net ads testjoin

# Leave — removes the computer object from AD
net ads leave -U <domain-admin-account>

If it was joined via realmd instead of net ads join (check realm list output from Step 0):

realm leave example.com -U <domain-admin-account>

If net ads leave fails (DC unreachable, keytab already broken), continue anyway — but have your AD team delete the computer object manually, or the later IdM enrolment and any re-join will collide with a stale object.

---

Step 2 — Stop the services

systemctl stop winbind smb nmb
systemctl status winbind smb nmb --no-pager

---

Step 3 — Disable them

systemctl disable winbind smb nmb

Only mask them if you're certain Samba is never coming back on this host. Since you have CIFS shares, don't mask smb — you'll likely re-enable it later with SSSD as the ID backend.

---

Step 4 — Flush winbind's caches and secrets

net cache flush

systemctl stop winbind 2>/dev/null

# Machine account secret + idmap/cache databases
rm -f /var/lib/samba/private/secrets.tdb
rm -f /var/lib/samba/winbindd_cache.tdb
rm -f /var/lib/samba/private/passdb.tdb
rm -f /var/cache/samba/winbindd_cache.tdb 2>/dev/null

# Kerberos keytab from the AD join (IdM will create its own)
rm -f /etc/krb5.keytab

The idmap autorid/rid allocation lives in these tdb files. Once deleted, the old SID→UID mappings are gone for good — which is exactly why Step 0's idmap.ranges capture matters.

---

Step 5 — Neutralise the winbind bits in smb.conf

Don't delete the file (your share definitions live there). Just take AD/winbind out of [global]:

cp -a /etc/samba/smb.conf /etc/samba/smb.conf.pre-idm

Then edit /etc/samba/smb.conf and remove or comment these from [global]:

    security = ADS
    realm = EXAMPLE.COM
    workgroup = EXAMPLE
    kerberos method = secrets and keytab
    winbind separator = +
    winbind use default domain = ...
    winbind enum users = ...
    winbind enum groups = ...
    winbind refresh tickets = ...
    winbind use krb5 enterprise principals = ...
    idmap config * : backend = ...
    idmap config * : range = ...
    idmap config * : rangesize = ...
    template shell = ...
    template homedir = ...

Verify it still parses:

testparm -s

---

Step 6 — Revert NSS and PAM (careful here)

Check what authselect is currently doing:

authselect current

Take winbind out of /etc/nsswitch.conf — it should go back to:

passwd:  files systemd
group:   files systemd
shadow:  files

Rather than hand-editing PAM, let authselect rebuild it. Going to a clean local-only state first (IdM enrolment will switch it to sssd for you in the next phase):

authselect select minimal --force
authselect current      # confirm no winbind profile / pam_winbind
grep -r pam_winbind /etc/pam.d/    # should return nothing

Test in your open console session now: su - <localuser> and id root. If local auth is broken, fix it before you drop the SSH session.

---

Step 7 — Remove the packages (optional)

Only if the host will no longer serve Samba shares:

dnf remove samba-winbind samba-winbind-clients samba-winbind-modules

Since you do have CIFS shares to preserve, I'd leave samba and samba-common installed and just remove the winbind-specific packages above — smbd can then be brought back later with SSSD/IdM providing identity.

---

Step 8 — Verify winbind is fully gone

systemctl is-enabled winbind smb nmb
wbinfo -u                      # should fail — no winbind
id <old-domain-user>           # should now fail to resolve
getent passwd | wc -l          # only local users remain
grep -r winbind /etc/nsswitch.conf /etc/pam.d/   # should be empty
klist -k /etc/krb5.keytab      # should report file not found

All of those failing is the success condition — the host is now identity-isolated and ready for ipa-client-install.

One thing to decide before we do the IdM half: are those CIFS shares going to keep serving AD users (which means IdM with an AD trust, and the idmap ranges have to line up with what you captured in Step 0), or are the consumers moving to IdM-native accounts? That answer changes the ipa-client-install flags and the sssd.conf significantly, so tell me which and I'll write that half accordingly.