Q:

Override template shell on linux system in Active Directory domain?

Is there an easy way to override the Samba "template shell = /bin/bash" setting on a per-user basis?
This is for Linux systems joined to an Active Directory domain.  Some users want /bin/bash.  Others including myself want /bin/zsh.  Is there some AD attribute I can set?
Anything I've found via googling seems hackish at best (writing a script to replace /bin/sh -- maintenance hassle).
A similar serverfault question Override LDAP shell seems OpenLDAP-oriented (but if someone knows how to get it working with AD, please say so).

A:

If you're using winbind, you can do the following:

Install IDMU as Christoph suggested. If you have 2003 R2 or later, the necessary RFC 2307 schema is already installed, so you can skip this step.
Add the following to smb.conf, per the Samba wiki:

winbind nss info = rfc2307

Again, this is only going to work if you're using winbind. Restart it once you've made the change.
Set users' loginShell attribute in Active Directory. winbind will honor that setting on its next refresh.

A:

If you have a large number of Linux systems using AD, this may not be efficient, but for a small number of systems, the simplest way of doing this is to run the following on the Linux machine:
getent passwd ADUSER >> /etc/passwd

Then edit the corresponding line in /etc/passwd to reflect the preferred shell (or better yet, use sed to change the shell entry on the fly before appending to /etc/passwd).  IDMU, as others have suggested, is probably the most elegant solution for multiple hosts, but the above  example gets the job done if you're just looking to do this on a few systems.

