samba - Jul 2005 - winbind gives NT_STATUS_INSUFFICIENT_RESOURCES error after a few hours of running

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

We have a samba 3.0.14a server connected via NT4 to an ADS domain, and after a
few
hours of access, winbind stops autheticating, and gives errors like this:

[2005/07/29 09:32:33, 1] nsswitch/winbindd_group.c:fill_grent_mem(133)
~  could not lookup membership for group rid
S-1-5-21-1957994488-1409082233-725345543-512 in domain MERCYHOME (error:
NT_STATUS_INSUFFICIENT_RESOURCES)
[2005/07/29 09:32:33, 1] nsswitch/winbindd_group.c:fill_grent_mem(133)
~  could not lookup membership for group rid
S-1-5-21-1957994488-1409082233-725345543-513 in domain MERCYHOME (error:
NT_STATUS_INSUFFICIENT_RESOURCES)

Restarting smbd and winbindd doesn't help, I have to make it use another
domain
controller or reboot the domain controller.

What can I do to make this not happen?

- -tom
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFC6j432dxAfYNwANIRAn0iAJsFtDUpgMcdJoxzoM8BddJY3NXdxgCbBunw
5nkWIXrQT0ibBIMbj/cnXjY=ri7a
-----END PGP SIGNATURE-----

Hi,

On Fri, Jul 29, 2005 at 07:33:28AM -0700, Tom Dickson
wrote:
> We have a samba 3.0.14a server connected via NT4 to an ADS domain, and
after a few
> hours of access, winbind stops autheticating, and gives errors like this:
> 
> [2005/07/29 09:32:33, 1] nsswitch/winbindd_group.c:fill_grent_mem(133)
> ~  could not lookup membership for group rid
> S-1-5-21-1957994488-1409082233-725345543-512 in domain MERCYHOME (error:
> NT_STATUS_INSUFFICIENT_RESOURCES)
> [2005/07/29 09:32:33, 1] nsswitch/winbindd_group.c:fill_grent_mem(133)
> ~  could not lookup membership for group rid
> S-1-5-21-1957994488-1409082233-725345543-513 in domain MERCYHOME (error:
> NT_STATUS_INSUFFICIENT_RESOURCES)
> 
> Restarting smbd and winbindd doesn't help, I have to make it use
another domain
> controller or reboot the domain controller.
> 
> What can I do to make this not happen?
What exactly do you mean with "connected via NT4 to an ADS domain" ?
Is
this a more complex trusted domain setup? Is MERCYHOME running on NT4 or
on Windows 2000/2003 ?

This sounds like an effect I've seen somewhere else. Could you, when the
error shows up, call 

	net rpc file -S DC_OF_MERCYHOME -U administrator%password

and send us the output ?

Thanks,
Guenther
-- 
G?nther Deschner                    GPG-ID: 8EE11688
Novell / SUSE LINUX                       gd@suse.de
Samba Team                              gd@samba.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url :
http://lists.samba.org/archive/samba/attachments/20050729/3a7ad42f/attachment.bin

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tom Dickson wrote:
| We have a samba 3.0.14a server connected via NT4 to
| an ADS domain, and  after a few hours of access, winbind
| stops autheticating, and gives errors like this:
|
| ~  could not lookup membership for group rid
| S-1-5-21-1957994488-1409082233-725345543-512 in domain MERCYHOME (error:
| NT_STATUS_INSUFFICIENT_RESOURCES)

Is this Windows 2000-SP4.SR1 ?  Or Maybe Windows 2003 SP1 ?
I've seen the exact same error message with the former.
Try setting 'client schannel = no' as a temporary workaround.
But also try Guenther's debugging suggestion.





cheers, jerry
====================================================================Alleviating
the pain of Windows(tm)      ------- http://www.samba.org
GnuPG Key                ----- http://www.plainjoe.org/gpg_public.asc
"I never saved anything for the swim back."     Ethan Hawk in Gattaca
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFC6380IR7qMdg1EfYRAoo7AJ9Me6zVlRIQM8aZd3eDNxDylHbEBwCeNgHd
hQQ/4h1lnmvXcuUBl+UXLS4=OQIY
-----END PGP SIGNATURE-----