{"id":1880,"date":"2026-10-19T13:41:50","date_gmt":"2026-10-19T16:41:50","guid":{"rendered":"https:\/\/www.linuxpro.com.br\/?p=1880"},"modified":"2026-10-19T13:46:20","modified_gmt":"2026-10-19T16:46:20","slug":"ad-manager-active-directory-e-samba-4-pelo-navegador-desktop-e-cli","status":"publish","type":"post","link":"https:\/\/www.linuxpro.com.br\/en\/2026\/10\/ad-manager-active-directory-e-samba-4-pelo-navegador-desktop-e-cli\/","title":{"rendered":"AD Manager: Active Directory and Samba 4 from the browser, desktop, and CLI"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/10\/ad-manager-active-directory-samba-v1.webp\" alt=\"Mascote LinuxPro administrando o Active Directory no painel do AD Manager, ao lado de racks de servidores e do cachorro caramelo\" width=\"1486\" height=\"856\" \/><\/p>\n<p>Anyone who manages Active Directory on Linux knows the drill: ADUC and RSAT only run on Windows, the <code data-no-translation=\"\">samba-tool<\/code> output is hard to automate, and folder permissions become a mix of POSIX ACLs and Windows ACLs. The <strong>AD Manager<\/strong> project was born to put an end to that juggling act. It is an open source project, under the MIT license, that administers <strong>Windows Server<\/strong> or <strong>Samba 4<\/strong> directories \u2014 users, groups, OUs, computers, and password policy \u2014 through a web panel, a desktop app, and a CLI. On Samba servers, it also handles shares with Windows permissions, backups, and migration.<\/p>\n<p>In this post I show what it does, how the pieces fit together, and how to test it in one minute with Docker.<\/p>\n<h2>What is AD Manager<\/h2>\n<p>It is a single binary written in Go, with the panel built-in in Vue 3. The same executable works as a web panel, as a CLI, as an MCP server for AI agents, and as an agent on Samba file servers. There is also a native desktop app for Linux, Windows, and macOS (Apple Silicon, Intel, and a <code data-no-translation=\"\">.app<\/code> universal).<\/p>\n<p>The point that mattered most to me in the design: the panel <strong>does not require a service account<\/strong> in AD. It speaks LDAPS with the domain using the credentials of the logged-in administrator; by default, access is restricted to members of the <em>Domain Admins<\/em> group (you can configure another group), and every change goes to the audit log \u2014 who did it, from where, what, and when.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/10\/ad-manager-usuarios.webp\" alt=\"Lista de usu\u00e1rios no painel web do AD Manager\" \/><\/p>\n<h2>What it does<\/h2>\n<ul>\n<li><strong>Directory:<\/strong> users, groups, OUs, computers and password policy. Create, edit, move, enable and disable accounts, delete with typed confirmation, password generator and <strong>password change link<\/strong> so the user can choose the new one themselves.<\/li>\n<li><strong>File servers:<\/strong> folders and shares with <strong>Windows ACL (NTFS)<\/strong> per group and per user, permission history with restore, recycle bin, ABE (the user only sees what they can open) and file auditing.<\/li>\n<li><strong>Backup:<\/strong> of the Samba domain controller and of the file servers, with schedule, retention and restore, and also of the panel itself.<\/li>\n<li><strong>Folder synchronization:<\/strong> brings folders from another SMB server (Windows or Samba) with wizard, preview, quarantine and verification.<\/li>\n<li><strong>Browser-based installation:<\/strong> a wizard turns a clean Ubuntu into a domain controller, additional DC or file server.<\/li>\n<li><strong>Windows \u2192 Samba migration:<\/strong> inventory, comparison, import from another AD (users, groups, DNS and shares) and joining a Samba DC.<\/li>\n<li><strong>DNS, GPOs and SMB sessions<\/strong>, audit, HTTP and Samba logs, 14 themes (light, dark and flat view) and English and Portuguese interface.<\/li>\n<\/ul>\n<h2>How the pieces fit together<\/h2>\n<p>The panel talks to AD over LDAPS. On the Samba file servers (or on the DC itself) runs the <strong>agent<\/strong>: it receives requests over HTTPS, queues tasks with <a href=\"\/en\/2026\/09\/asynq-filas-de-tarefas-em-go-com-redis-e-asynqmon\/\">Asynq and Redis<\/a> and tweaks Samba locally. The desktop app uses the panel's API and talks directly to the agents.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/10\/ad-manager-arquitetura.webp\" alt=\"Diagrama da arquitetura do AD Manager: painel, CLI, MCP, desktop, agentes, Redis e controladores Samba\" \/><\/p>\n<table>\n<thead>\n<tr>\n<th>Component<\/th>\n<th>Function<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code data-no-translation=\"\">ad-manager server<\/code><\/td>\n<td>HTTPS web panel and REST API (Swagger in <code data-no-translation=\"\">\/swagger<\/code>, after enabling it in Settings)<\/td>\n<\/tr>\n<tr>\n<td><code data-no-translation=\"\">ad-manager agent<\/code><\/td>\n<td>Runs on each file server or DC: folders, shares, ACLs, backups and synchronization<\/td>\n<\/tr>\n<tr>\n<td><code data-no-translation=\"\">ad-manager<\/code> (CLI)<\/td>\n<td>Directory administration from the terminal, in addition to backup, sync, migration, and import commands<\/td>\n<\/tr>\n<tr>\n<td><code data-no-translation=\"\">ad-manager mcp<\/code><\/td>\n<td>MCP server for AI agents to query and administer the directory<\/td>\n<\/tr>\n<tr>\n<td><code data-no-translation=\"\">ad-manager-desktop<\/code><\/td>\n<td>Native app (Fyne) for Linux, Windows, and macOS<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The stack is the same one I showed in the series <a href=\"\/en\/2026\/09\/vue-go-echo-v5-parte-5-embed-binario-unico-e-docker\/\">Vue.js + Go with Echo v5<\/a>: Echo on the backend and the SPA embedded in the binary with <code data-no-translation=\"\">go:embed<\/code>.<\/p>\n<h2>Test it in one minute with Docker<\/h2>\n<p>The demo image brings up a complete Samba domain 4, with the panel and the agent, in a single container:<\/p>\n<pre data-no-translation=\"\"><code class=\"language-bash\" data-no-translation=\"\">docker run -d --name ad-manager --hostname dc1 --cap-add SYS_ADMIN -p 8443:8443 jniltinho\/ad-manager\ndocker logs ad-manager<\/code><\/pre>\n<p>The first start takes about a minute, because it provisions the domain. The log shows the URL, the user, and the password generated for the <code data-no-translation=\"\">Administrator<\/code>. Open <code data-no-translation=\"\">https:\/\/localhost:8443<\/code>, accept the untrusted certificate warning (or import the demo CA) and log in. The <code data-no-translation=\"\">--cap-add SYS_ADMIN<\/code> is what allows Samba to write Windows permissions to extended attributes <code data-no-translation=\"\">security.*<\/code>.<\/p>\n<p>If Docker is new to you, it's worth reading <a href=\"\/en\/2026\/09\/a-historia-do-docker\/\">the history of Docker<\/a> before.<\/p>\n<h2>Installing on an Ubuntu server 26.04<\/h2>\n<p>For a real server, download the <code data-no-translation=\"\">.deb<\/code> da <a href=\"https:\/\/github.com\/jniltinho\/ad-manager\/releases\/latest\">releases page<\/a>, install, start the services and read the configuration token:<\/p>\n<pre data-no-translation=\"\"><code class=\"language-bash\" data-no-translation=\"\">sudo apt install --no-install-recommends .\/ad-manager_X.Y.Z_amd64.deb\nsudo systemctl enable --now ad-manager ad-manager-agent\nsudo cat \/opt\/ad-manager\/data\/setup-token<\/code><\/pre>\n<p>Then open <code data-no-translation=\"\">https:\/\/IP-DO-SERVIDOR:8443<\/code> and enter the token. The setup wizard prepares the machine as a new domain controller, an additional DC, or a file server \u2014 or simply connects the panel to an existing Active Directory. Nothing on the server changes before the review screen.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/10\/ad-manager-setup-assistente.webp\" alt=\"Assistente de instala\u00e7\u00e3o do AD Manager no navegador, etapa de detalhes do novo dom\u00ednio\" \/><\/p>\n<h2>Sharing with real Windows permissions<\/h2>\n<p>This is the feature I missed most in Samba. When creating or editing a share, you choose who has full control, write access, or read-only access, by group or by user. The agent writes the Windows ACL using Samba's own code (the module <code data-no-translation=\"\">acl_xattr<\/code>): it lives in the attribute <code data-no-translation=\"\">security.NTACL<\/code> from the folder, and Samba derives an approximate POSIX representation from it. For this reason, avoid changing these permissions directly with <code data-no-translation=\"\">setfacl<\/code> or <code data-no-translation=\"\">chmod<\/code>. Each change saves the previous permission, and it can be restored with one click, including in subfolders and files that inherit.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/10\/ad-manager-compartilhamento-permissoes.webp\" alt=\"Edi\u00e7\u00e3o de compartilhamento no AD Manager com as permiss\u00f5es do Windows da pasta\" \/><\/p>\n<p>The share is stored in the Samba registry (the same one the <code data-no-translation=\"\">net conf<\/code> edits), and not in the <code data-no-translation=\"\">smb.conf<\/code>. This way each change is a transaction and does not require restarting the service.<\/p>\n<h2>Backup, synchronization, and migration<\/h2>\n<p>On the Backup screen you schedule copies of the DC and file servers, with retention and restore, and back up the panel itself. In Synchronization, a five-step wizard brings folders from another SMB server: source and connection test, what to copy, where to, when, and a preview before copying any file. What would be deleted goes to a quarantine, not to the trash.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/10\/ad-manager-assistente-sincronizacao.webp\" alt=\"Assistente de sincroniza\u00e7\u00e3o de pastas do AD Manager testando a conex\u00e3o com o servidor de origem\" \/><\/p>\n<p>For those who still have a Windows DC, the project provides a migration roadmap with pre-verification, before-and-after inventory, and import from another AD. If your environment also uses LDAP for remote access, it pairs with <a href=\"\/en\/2026\/09\/apache-guacamole-acesso-remoto-com-docker-ldap-e-sso\/\">Apache Guacamole with LDAP<\/a>.<\/p>\n<h2>Desktop app and AI<\/h2>\n<p>The desktop app brings together the main administration tasks \u2014 users, groups, OUs, computers, shares, password policy, backup, synchronization, and logs \u2014 and uses the same 14 themes as the web panel. It uses the panel's API and talks directly to the agents for the shares.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/10\/ad-manager-app-desktop.webp\" alt=\"App desktop do AD Manager mostrando a lista de usu\u00e1rios do dom\u00ednio\" \/><\/p>\n<p>And with the built-in MCP server, an AI agent queries and administers the directory using the same rules and the same auditing as the panel. It's the same idea I used in <a href=\"\/en\/2026\/09\/mcp-wp-go-wordpress-por-mcp-sem-ssh\/\">mcp-wp-go for WordPress<\/a>: giving the agent well-scoped tools, instead of a shell.<\/p>\n<h2>Open source<\/h2>\n<p>The project is on GitHub at <a href=\"https:\/\/github.com\/jniltinho\/ad-manager\">github.com\/jniltinho\/ad-manager<\/a>, under the MIT license. Each release brings <code data-no-translation=\"\">.deb<\/code>, the server binaries for Linux and Windows and the desktop app for Linux, Windows, and macOS. The documentation, in English, covers installation, panel, CLI, MCP, agent, backup, synchronization, and migration.<\/p>\n<p>If AD Manager saves you time, leave a star on the repository and open an issue with what's missing in your environment. Contributions are welcome.<\/p>","protected":false},"excerpt":{"rendered":"<p>AD Manager is an open-source project that manages Active Directory on Windows Server or Samba 4 via web panel, desktop app, CLI and MCP, with Windows-permission shares, backup, synchronization and migration.<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21,2,111,84],"tags":[552,156,31,553,311,554,87,468],"class_list":["post-1880","post","type-post","status-publish","format-standard","hentry","category-infra","category-linux","category-opensource","category-samba4","tag-active-directory","tag-docker","tag-golang","tag-ldap","tag-mcp","tag-open-source","tag-samba4","tag-vue"],"_links":{"self":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts\/1880","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/comments?post=1880"}],"version-history":[{"count":2,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts\/1880\/revisions"}],"predecessor-version":[{"id":1889,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/posts\/1880\/revisions\/1889"}],"wp:attachment":[{"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/media?parent=1880"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/categories?post=1880"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/en\/wp-json\/wp\/v2\/tags?post=1880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}