At this time, Samba 4.15 only supports Server 2008 functional level, so you most likely won't be able to add Samba DCs to your existing domain. You also won't be able to add a new domain to the forest.

Other than that, there might be some compatibility problems depending on the Samba version – I would very strongly recommend 4.12 or later. Here's the overall status around Samba 4.15:

• Samba does support joining an existing domain as a DC and replicating data, but even if you start fresh with a Samba-only domain you'll want a recent version with all the replication-related fixes.

• Samba does not implement AD Web Services, which means PowerShell AD cmdlets will not work. However, RSAT does work as it only needs traditional MS-RPC and LDAP. (PowerShell's [adsi] interface is also LDAP-based, so it works too.)

  • (I seem to remember that promoting Server2012+ as a DC appears to require AD Web Services for some reason, so that won't work either... so if you want to migrate from Samba to Windows Server, you might need to use Server2008 as an intermediary.)

• File ACLs will work fine, as do registry ACLs, printer ACLs, GPO ACLs, etc. All of them are enforced by file servers themselves, not by the DCs (the DC just has to report your group memberships correctly).

• AD Certificate Services will work, but it's not a DC feature and not included as part of Samba – you will still need Windows Server to actually host the certification authority.

  • Also note that older Samba DC versions (up to 4.12) had a bug which prevented computers from being automatically granted "Domain Computer" SID, which affected all types of ACLs. Most importantly it meant AD Certificate Services auto-enrolment wouldn't work, because many standard certificate template ACLs require "Domain Computer". (This bug was fixed in 4.13+ so ADCS now works correctly, as do all other ACL types.)

• Group Policies will work. However, the GPO data won't automatically sync across multiple DCs (because Samba lacks DFS-R support), so you'll need to manually robocopy your Sysvol after every change. (But note the "Domain Computer" ACL bug.)

• Azure AD Connect probably won't work.

• I'm not sure whether Kerberos constrained delegation is implemented fully, which may be relevant to Hyper-V clusters.

• Standalone Hyper-V works. Replication works. Live migration almost works – there's a small bug (all the way to 4.16) that prevents Samba DCs from correctly issuing Kerberos tickets if the SPN contains spaces.

  (Fortunately, Hyper-V live migration is the only service that thought it would be a good idea to put spaces in its SPNs. There is a manual workaround, though, and there is a patch on Bugzilla as well, but it hasn't been applied yet.)

• No idea whether Hyper-V clustering works or not – it might be affected by the "spaces in SPN" bug, as well as lack of constrained delegation.

Active directory knows the concept of multiple DCs replicating in a multi-master fashion. That means that you can add additional DCs to your existing domain. See the full instructions on the Samba Wiki.

In this setup, all DCs for the domain will be active simultaneously, and clients will use all of them. If one DC fails, the clients will simply continue to use the other DC(s). If a DC should be taken out of the domain, the process is called demotion of the DC. There are also notes for that on the Samba Wiki.

Note that the replication that is currently impemented with Samba only treats the directory data, not file share data. While there are file replication mechanisms in Windows, these are not fully implemented in Samba yet. If you want to do serious file sharing, you may want to do that not on the DCs but on additional Samba servers that are members of the domain. You would then make the file server highly available by establishing a backup of the data to a different server that is configured to take over the file server role if the productive file server fails. (Alternatively, a clustered/distributed file system could be used to store the file server data and samba could be clustered with CTDB, but that might be an overkill for your purposes.)