samba - Nov 2003 - user can no longer connect to shares

Hi,

I'm using the setup defined for my RH9 box to participate in a Win2000 
domain. I have server = domain, etc. This has been working fine for 
several months.

As of this morning, one user can no longer access samba shares. His 
account settings haven't changed. I am able to access shares from his 
workstation using my account.

I checked the log for his workstation. He has a number of errors, 
although the same errors are also in my workstation log, so I'm not 
convinced they are the problem. I've scanned through howto's and 
searched through the mailing lists, to no avail.

Samba 2.2.7a, RH9, Win2000 PDC

Here is the log contents, followed by the pertinent details of my smb.conf:

[2003/11/04 12:19:45, 0] rpc_client/cli_netlogon.c:cli_net_auth2(157)
   cli_net_auth2: Error NT_STATUS_ACCESS_DENIED
[2003/11/04 12:19:45, 0] rpc_client/cli_login.c:cli_nt_setup_creds(72)
   cli_nt_setup_creds: auth2 challenge failed
[2003/11/04 12:19:45, 0] 
smbd/password.c:connect_to_domain_password_server(1367)
   connect_to_domain_password_server: unable to setup the PDC 
credentials to machine SERVER.
Error was : NT_STATUS_OK.
[2003/11/04 12:19:45, 0] smbd/password.c:domain_client_validate(1599)
   domain_client_validate: Domain password server not available.

My smb.conf:
===========[global]
         smb passwd file = /etc/samba/smbpasswd
         socket options = TCP_NODELAY SO_SNDBUF=8192 SO_RCVBUF=8192
         obey pam restrictions = yes
         encrypt passwords = yes
         dns proxy = no
         password server = OURPDCNAME
         unix password sync = yes
         workgroup = OURWORKGROUP
         os level = 20
         security = domain
         preferred master = no

Thanks in advance,
Gerry

On Tue, Nov 04, 2003 at 12:25:52PM -0500, Gerry Kirk
wrote:
> Hi,
> 
> I'm using the setup defined for my RH9 box to participate in a Win2000 
> domain. I have server = domain, etc. This has been working fine for 
> several months.
> 
> As of this morning, one user can no longer access samba shares. His 
> account settings haven't changed. I am able to access shares from his 
> workstation using my account.
> 
> I checked the log for his workstation. He has a number of errors, 
> although the same errors are also in my workstation log, so I'm not 
> convinced they are the problem. I've scanned through howto's and 
> searched through the mailing lists, to no avail.
> 
> Samba 2.2.7a, RH9, Win2000 PDC
Did you check the eventlog on the win2k server?  You might see something
helpful there.

The message in the error log is:

The session setup from the computer OURSAMBASERVER failed to
authenticate. The name of the account referenced in the security
database is OURSAMBASERVER$.  The following error occurred: 
Access is denied. 

This appears sporadically in the database a few times each month.

Gerry Kirk
Project Manager
www.faithonline.com 
www.dioceseonline.com

> -----Original Message-----
> From: Mike Fedyk [mailto:mfedyk@matchmail.com] 
> Sent: November 4, 2003 12:52 PM
> To: Gerry Kirk
> Cc: samba@lists.samba.org
> Subject: Re: [Samba] user can no longer connect to shares
> 
> 
> On Tue, Nov 04, 2003 at 12:25:52PM -0500, Gerry Kirk wrote:
> > Hi,
> > 
> > I'm using the setup defined for my RH9 box to participate 
> in a Win2000
> > domain. I have server = domain, etc. This has been working fine for 
> > several months.
> > 
> > As of this morning, one user can no longer access samba shares. His
> > account settings haven't changed. I am able to access 
> shares from his 
> > workstation using my account.
> > 
> > I checked the log for his workstation. He has a number of errors,
> > although the same errors are also in my workstation log, so I'm
not
> > convinced they are the problem. I've scanned through howto's
and
> > searched through the mailing lists, to no avail.
> > 
> > Samba 2.2.7a, RH9, Win2000 PDC
> 
> Did you check the eventlog on the win2k server?  You might 
> see something helpful there.
>

Mike Fedyk wrote:
> 
> Did you check the eventlog on the win2k server?  You might see something
> helpful there.
This is the message:

The session setup from the computer OURSAMBASERVER failed to
authenticate. The name of the account referenced in the security
database is OURSAMBASERVER$.  The following error occurred:
Access is denied.

This appears in the windows server log a few times a month.

Gerry