samba - Jan 2015 - Windows Remote Assistance fails

I attempted to set up unsolicited remote assistance via group policy, but
connections to the client machines fail.

A network trace show the 'expert' machine doing a TGS-REQ to the DC
which
responds with a KRB5KDC_ERR_POLICY. This seems to be the origin of the
problem.

I noticed in the request, the username of the 'novice' is given as the
Server Name but is otherwise pretty unremarkable.

Has anyone successfully gotten this working on a Samba4 AD domain?

On Mon, 2015-01-05 at 16:18 -0500, Ryan Bair wrote:
> I attempted to set up unsolicited remote assistance via group policy, but
> connections to the client machines fail.
> 
> A network trace show the 'expert' machine doing a TGS-REQ to the DC
which
> responds with a KRB5KDC_ERR_POLICY. This seems to be the origin of the
> problem.
> 
> I noticed in the request, the username of the 'novice' is given as
the
> Server Name but is otherwise pretty unremarkable.
> 
> Has anyone successfully gotten this working on a Samba4 AD domain?
Try giving the user an SPN.  That should make it work.   

I need to work out what the right clue is in AD to enable an account as
a server, without an SPN, as otherwise we would allow offline attacks on
the user (rather than machine, which should be more complex) passwords. 

Andrew Bartlett

-- 
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

Hi Andrew,

Thanks for the reply. That does indeed make it work.

On Tue, Jan 6, 2015 at 9:12 PM, Andrew Bartlett <abartlet at samba.org>
wrote:
> On Mon, 2015-01-05 at 16:18 -0500, Ryan Bair wrote:
> > I attempted to set up unsolicited remote assistance via group policy,
but
> > connections to the client machines fail.
> >
> > A network trace show the 'expert' machine doing a TGS-REQ to
the DC which
> > responds with a KRB5KDC_ERR_POLICY. This seems to be the origin of the
> > problem.
> >
> > I noticed in the request, the username of the 'novice' is
given as the
> > Server Name but is otherwise pretty unremarkable.
> >
> > Has anyone successfully gotten this working on a Samba4 AD domain?
>
> Try giving the user an SPN.  That should make it work.
>
> I need to work out what the right clue is in AD to enable an account as
> a server, without an SPN, as otherwise we would allow offline attacks on
> the user (rather than machine, which should be more complex) passwords.
>
> Andrew Bartlett
>
> --
> Andrew Bartlett
> http://samba.org/~abartlet/
> Authentication Developer, Samba Team  http://samba.org
> Samba Developer, Catalyst IT
> http://catalyst.net.nz/services/samba
>
>
>
>
>