How to Add, List, Delete and Change Samba Users (smbpasswd, pdbedit and Failed to add entry for user)

Updated: 9 October 2026 · Applies to: Samba 4.22.11 (Debian 13), 4.23.6 (Ubuntu 26.04), 4.19.5 (Ubuntu 24.04) and 4.23.5 (AlmaLinux 10.2 and Rocky Linux 9.8), standalone servers with the default tdbsam user database

Samba keeps its own passwords, separate from Linux login passwords, and every Samba user must first exist as a Linux user. As root:

sudo useradd -M -s /usr/sbin/nologin zach   # Linux account without home or login shell, if it does not exist yet
sudo smbpasswd -a zach                      # add the user to Samba and set the Samba password
sudo pdbedit -L                             # list Samba users

If smbpasswd -a answers Failed to add entry for user zach, the Linux account is usually missing: create it and run the command again.

Fix "Failed to add entry for user"

Run the command with debug level 3 to see the reason. Here the Linux user did not exist (output shortened):

$ sudo smbpasswd -D 3 -a ghost
...
Could not find user ghost and no add script defined
Failed to add entry for user ghost.

Check these in order:

1. The Linux user exists: id ghost or getent passwd ghost. If not, create it with useradd (as above) and run smbpasswd -a again; it then prints Added user ghost. Users from LDAP or SSSD must show up in getent passwd too. The "add script" in the debug line refers to the add user script option in smb.conf, which can create the Linux account for you; creating it yourself is simpler.
2. You are root: as a normal user, smbpasswd -a does not add anyone; it only prints the usage text.
3. The user database is writable: if the Linux user exists and it still fails, the line just before the error in the -D 3 output names the problem with the passdb backend (testparm -sv | grep "passdb backend" shows which one you use; the default is tdbsam).
4. Not an AD domain controller: smbpasswd and pdbedit manage the local user database of a standalone or member server. On a Samba Active Directory DC, use samba-tool user add and samba-tool user setpassword, according to the Samba manual.

List Samba users

smbpasswd has no list option. Use pdbedit:

$ sudo pdbedit -L
zach:1000:
anna:1001:

Each line is the user name and Linux UID. sudo pdbedit -L -v shows details for every user (or add a name for one), including the account flags (shortened):

$ sudo pdbedit -L -v zach
Unix username:        zach
Account Flags:        [U          ]

U is a normal account; a disabled one shows [DU ]. On Debian and Ubuntu, pdbedit comes with the samba package (with only samba-common-bin installed, you have smbpasswd but not pdbedit). On AlmaLinux and Rocky Linux both are in samba-common-tools.

Change a Samba user password

• As root (no old password needed): sudo smbpasswd zach, then type the new password twice. If the two do not match you get Mismatch - password unchanged.
• As the user: smbpasswd asks for the old password first. This goes through the local smbd, so the Samba service must be running; otherwise you get Unable to connect to SMB server on machine 127.0.0.1. Error was : NT_STATUS_CONNECTION_REFUSED.
• In a script, -s reads the password twice from standard input: printf '%s\n%s\n' "$PASS" "$PASS" | sudo smbpasswd -s -a zach (works for new and existing users).

Changing the Samba password does not change the Linux login password: in our test, root's smbpasswd zach left /etc/shadow untouched. If users need the same password for both, set both.

Disable, enable or delete a Samba user

$ sudo smbpasswd -d zach
Disabled user zach.
$ sudo smbpasswd -e zach
Enabled user zach.
$ sudo smbpasswd -x anna
Deleted user anna.

-x removes only the Samba entry; the Linux account stays (remove it with sudo userdel anna if no longer needed). Deleting a user that is not in Samba gives Failed to find entry for user anna.

Give the user access to a share

In /etc/samba/smb.conf, add valid users = zach @staff to the share section, check the file with testparm, and reload: sudo systemctl reload smbd on Debian and Ubuntu, sudo systemctl reload smb on AlmaLinux, Rocky Linux and RHEL.

On AlmaLinux and Rocky Linux, shared folders also need the SELinux label samba_share_t (the semanage command is in policycoreutils-python-utils):

sudo semanage fcontext -a -t samba_share_t "/srv/share(/.*)?"
sudo restorecon -R /srv/share

Do not open Samba (ports 139 and 445) to the internet: see Samba ports and how to open them safely. For a full setup, see install and configure a Samba file share; if the service will not start, see Samba service will not start.

Official documentation: smbpasswd(8) and pdbedit(8).