I had a test environment with a few hundreds of users using Windows 7 under a samba 3 domain. They had the registry tweaks required to join a samba 3 domain. I followed the classicupgrade migration to samba 4 and everything seemed to be ok. In my scenario I have a DNS server different from the samba server, and the DNS server forwards all queries to my samba domain to the samba server. The samba server is also acting as a NTP server, and the option ntp-servers on DHCP is specified. Some users see a pop-up requesting to log off and log in again - with a "windows need your credentials" message. Moreover, they seem to not have any kerberos ticket - running a klist shows no active tickets; and they do not have the time synchronized and sometimes they see a message regarding the time mismatch. We tried to set up a NTP time using GPOs without luck. Looking at the samba logs doesn't give a clue - just some errors which may be normal. Any hint to look at or any configuration/misconfiguration? Thanks!