Debian does not upgrade to major Samba versions within a stable release. For example, Debian 13 includes and will remain on version 4.22.x. However, the Backports repository provides newer versions — as of Nov 2025, version 4.23 is available.

Run the following to see what's available:

apt-cache policy samba

Example output:

samba:
  Installed: 2:4.22.4+dfsg-1~deb13u1
  Candidate: 2:4.22.4+dfsg-1~deb13u1
  Version table:
 *** 2:4.22.4+dfsg-1~deb13u1 500
        500 http://deb.debian.org/debian trixie/main amd64 Packages
        100 /var/lib/dpkg/status

You can also check the backport builds here:

https://buildd.debian.org/status/package.php?p=samba&suite=trixie-backports

To access newer versions, add the backports repo:

echo "deb http://deb.debian.org/debian trixie-backports main contrib non-free" >> /etc/apt/sources.list

Then update and re-check available versions:

apt-get update && apt-cache policy samba

Expected output:

samba:
  Installed: 2:4.22.4+dfsg-1~deb13u1
  Candidate: 2:4.22.4+dfsg-1~deb13u1
  Version table:
     2:4.23.3+dfsg-1~bpo13+1 100
        100 http://deb.debian.org/debian trixie-backports/main amd64 Packages
 *** 2:4.22.4+dfsg-1~deb13u1 500
        500 http://deb.debian.org/debian trixie/main amd64 Packages
        100 /var/lib/dpkg/status

Since `apt` prefers stable packages, explicitly specify the backports target:

(This will also update your samba “from trixie” to samba “from trixie-backports” If you have Samba already installed)

apt-get install -t trixie-backports samba

This ensures you install the newer version, e.g. 4.23.3.

Once installed, you can proceed with:

• Installing as a Domain Controller
• Installing as a Member Server

Running apt-get dist-upgrade on a Debian 13 (Trixie) system with trixie-backports enabled and Samba 4.23 installed will remove core Samba packages instead of upgrading them:

• samba
• samba-ad-dc
• samba-libs
• samba-common-bin
• samba-dsdb-modules
• winbind, libpam-winbind, libnss-winbind
• python3-samba, libsmbclient0, smbclient

Reason for this , between Samba 4.23 and 4.24, several packages were renamed, merged, or restructured in the backports repository.

dist-upgrade sees that the installed 4.23 packages conflict with the new 4.24 library versions, but does not automatically map old package names to their 4.24 equivalents. Rather than guess at renames, it resolves the conflict by removing the packages entirely.

For this reason, explicitly install the Samba packages from backports, which forces apt to resolve the full 4.24 dependency tree correctly:

For DCs:

apt-get update && apt-get install samba samba-common samba-common-bin samba-libs samba-ad-dc \
  samba-dsdb-modules smbclient winbind libpam-winbind libnss-winbind \
  python3-samba libsmbclient0 -t trixie-backports

For Member Servers (file server):

apt-get update && apt-get install samba samba-common samba-common-bin samba-libs \
  samba-dsdb-modules samba-vfs-modules smbclient winbind libpam-winbind \
  libnss-winbind python3-samba libsmbclient0 -t trixie-backports

This upgrades all packages cleanly with nothing removed.

After this, apt-get dist-upgrade is safe to run normally.

• Never upgrade both DCs simultaneously. Upgrade one, verify, then upgrade the second.
• After upgrading, verify the domain is healthy:

systemctl status samba-ad-dc
samba-tool drs showrepl
samba-tool visualize uptodateness -rS --utf8

Caponato's Samba notebook. Start here or go to the Main menu.