samba - Sep 2005 - Random "access denied" failures

I'm at my wits end.  I'm running FreeBSD 5.4-STABLE and Samba 3.0.20 on
my fileserver.  It authenticates from Active Directory which is most likely
running on Windows 2000 Server.  I do NOT have domain admin
 priviledges--only admin privs of my OU.

My problems began when I upgraded from 3.0.14a to 3.0.20:

It started with one user suddenly getting denied access to his home
directory on the fileserver on only one machine.  He could get access from
any other machine in the building.  Then there was another with what
appeared to be the same problem but on a different computer.  Now I've had
this problem show up for five or six different users, each one on just one
computer (a couple of them on the same computer) but everything was fine
on the other computers.

For all but one user (so far), simply renewing my Kerberos ticket on the
command line with kinit like I did when I initially joined the domain solved the
problem.  (!!)

On one occasion, renamaing the user's logon name and then renaming it
 back solved the problem.

Things I've tried to do to resolve this problem:
+ Rejoin the client computer to the domain
+ Change the client's logon name
+ Rejoin the fileserver to the domain
+ Remove the fileserver's machine account and recreate it in the domain
+ Verified settings in the configuration file
+ Verified permissions and passwords are correct
+ Verified filename case matches on the domain, on the fileserver, and at
   the client
+ Recompiling Samba
+ Recompiling Samba and all it's dependencies
+ ...

I haven't yet tried to delete the user accounts and recreate them, as it
would
be somewhat burdensome to get the district office to relink the Exchange
accounts with the new user SIDs.

I just don't know what to do!  I tried going back to 3.0.14a, but when
I did that
 I started getting log messages that Samba couldn't authenticate with the
KDC.
On top of that, when I tried to rejoin the domain, the 'net' program
kept dumping
core.

Any help would be appreciated.  If it weren't for these random instances
popping up (and not going away), everything would be working fine.  Things
worked great under 3.0.14a.

Kevin

On Wed, Sep 28, 2005 at 02:20:25PM -0400, ML Samba
wrote:
> I'm at my wits end.  I'm running FreeBSD 5.4-STABLE and Samba
3.0.20 on
> my fileserver.  It authenticates from Active Directory which is most likely
> running on Windows 2000 Server.  I do NOT have domain admin
>  priviledges--only admin privs of my OU.
> 
> My problems began when I upgraded from 3.0.14a to 3.0.20:
> 
> It started with one user suddenly getting denied access to his home
> directory on the fileserver on only one machine.  He could get access from
> any other machine in the building.  Then there was another with what
> appeared to be the same problem but on a different computer.  Now I've
had
> this problem show up for five or six different users, each one on just one
> computer (a couple of them on the same computer) but everything was fine
> on the other computers.
Get logs from the smbd serving that user on that computer. Debug level 10
logs. Look into them (or post them on the list).

It doesn't sound like random failures to me, it sounds like a consistent
problem that should be reasonably easy to debug.

Going downrev was the wrong solution to debugging a problem like this.

Jeremy.