samba - Jul 2004 - unable to join domain hosted by 3.0 PDC

I've been trying to set up a samba 3.0 PDC, and am unable to get my
machines to join the domain. I've followed the HOWTO pretty closely, but
when I try to get a win2k machine to join the domain, I get a message
saying that the authentication failed. The log on the samba server shows
the following errors (at loglevel 2):

[2004/07/18 21:05:04, 2]
rpc_server/srv_samr_nt.c:access_check_samr_object(93)
  _samr_open_domain: ACCESS DENIED  (requested: 0x00000211)
[2004/07/18 21:05:04, 2]
rpc_server/srv_samr_nt.c:access_check_samr_function(115)
  _samr_create_user: ACCESS DENIED (granted: 0x00000201;  required:
0x00000010)

My question is -- how do I determine _why_ access is denied. I've tried
turning up the loglevel, but it doesn't seem to be very enlightening.

In particular, the second entry seems to indicate that I need some sort
of permission bit set that is not. How do I interpret what these hex
numbers represent?

Any help is greatly appreciated!
-- 
Jeff Layton <jtlayton@poochiereds.net>

On Wed, Jul 21, 2004 at 01:54:52PM +0200, Nikola Vanevski
wrote:
> Hi!
> 
> I experienced the same problem a couple of days ago. It is a 
> misconfiguration in global parameters, but I don't exactly know where.
I
> copied the smb.conf [Globals] options from a working server and it fixed 
> the problem. Because I was in a great hurry, I did not check where did I 
> go wrong. Here are the parameters that worked on _my_ server : 
> (smbpasswd backend)
> 
> [global]
>    workgroup = MBPR2
>    server string = Samba Server
>    interfaces = 127.0.0.1, eth0
>    bind interfaces only = Yes
>    map to guest = Bad User
>    username map = /etc/samba/smbusers
>    add machine script = /usr/sbin/useradd  -c Machine -d 
> /var/lib/nobody -s /bin/false %m$
>    logon path >    logon home >    domain logons = Yes
>    os level = 65
>    preferred master = Yes
>    domain master = Yes
>    ldap suffix = dc=example,dc=com
>    ldap ssl = no
>    printer admin = @ntadmin, root, administrator
> 
> Hope this helps. If you find what's going on (like the difference 
> between your settings and these), Id like to know.
> 
> Greetings
> 
> Nino
Thanks for the info. I eventually found another way to solve it. I had:

  invalid users = root

so I commented that out, and was then able to use the root account to
join the domain. I'd like to be able to figure out how to do it using a
non-root account, though. Apparently it should be possible to do so if
the account is a member of the Domain Admins, but that didn't seem to
work for me.

It would be nice to know what privileges are required to add machines to
the domain, so you could delegate out that privilege without having to
use the root account. Any samba experts care to comment?

-- Jeff