samba - Sep 2016 - NT_STATUS_ACCESS_DENIED: Access denied (0xc0000022)

I have a Samba4 AD/DC running on Slackware64 14.1, Samba version 4.2.12. This
computer has been
serving a Domain of several Windows 7 and one Linux domain members for about 2
years without problem.

On a few occasions lately I've run the following command on the AD/DC:

$ ntlm_auth --username="user" --password='password'
NT_STATUS_ACCESS_DENIED: Access denied (0xc0000022)

and have gotten the access denied message shown.  In other words, domain users
suddenly can't
authenticate.  Stopping and restarting samba does not fix the problem.  The
samba log has:

[2016/09/02 11:19:36.490991,  2]
../libcli/auth/credentials.c:403(netlogon_creds_server_check_internal)
credentials check failed
  
I have to reboot the computer to fix this.

It looks like my last update to Samba to 4.2.12 was done on July 2, 2016. 
It's probable that I
started noticing this problem about then.  It is very intermittant.  Probably
less than 8
times since then. 

Can anyone tell me why this is happening and how I can fix it without having to
reboot?

This is important as this is a production machine and users are unable to log
into the domain
when this happens. 

THX -- Mark

On Fri, Sep 02, 2016 at 11:46:14AM -0400, Mark Foley via samba
wrote:
> I have a Samba4 AD/DC running on Slackware64 14.1, Samba version 4.2.12.
This computer has been
> serving a Domain of several Windows 7 and one Linux domain members for
about 2 years without problem.
> 
> On a few occasions lately I've run the following command on the AD/DC:
> 
> $ ntlm_auth --username="user" --password='password'
> NT_STATUS_ACCESS_DENIED: Access denied (0xc0000022)
> 
> and have gotten the access denied message shown.  In other words, domain
users suddenly can't
> authenticate.  Stopping and restarting samba does not fix the problem.  The
samba log has:
> 
> [2016/09/02 11:19:36.490991,  2]
../libcli/auth/credentials.c:403(netlogon_creds_server_check_internal)
credentials check failed
>   
> I have to reboot the computer to fix this.
> 
> It looks like my last update to Samba to 4.2.12 was done on July 2, 2016. 
It's probable that I
> started noticing this problem about then.  It is very intermittant. 
Probably less than 8
> times since then. 
> 
> Can anyone tell me why this is happening and how I can fix it without
having to reboot?
> 
> This is important as this is a production machine and users are unable to
log into the domain
> when this happens. 
Can you get logs showing what is going on when the machine is in
this state ? There's not enough information here to make a good
diagnosis.

[global]
    ntlm auth = Yes ??

2016-09-02 20:47 GMT+03:00 Jeremy Allison via samba <samba at
lists.samba.org>:
> On Fri, Sep 02, 2016 at 11:46:14AM -0400, Mark Foley via samba wrote:
> > I have a Samba4 AD/DC running on Slackware64 14.1, Samba version
4.2.12.
> This computer has been
> > serving a Domain of several Windows 7 and one Linux domain members for
> about 2 years without problem.
> >
> > On a few occasions lately I've run the following command on the
AD/DC:
> >
> > $ ntlm_auth --username="user" --password='password'
> > NT_STATUS_ACCESS_DENIED: Access denied (0xc0000022)
> >
> > and have gotten the access denied message shown.  In other words,
domain
> users suddenly can't
> > authenticate.  Stopping and restarting samba does not fix the problem.
> The samba log has:
> >
> > [2016/09/02 11:19:36.490991,  2] ../libcli/auth/credentials.c:
> 403(netlogon_creds_server_check_internal) credentials check failed
> >
> > I have to reboot the computer to fix this.
> >
> > It looks like my last update to Samba to 4.2.12 was done on July 2,
> 2016.  It's probable that I
> > started noticing this problem about then.  It is very intermittant.
> Probably less than 8
> > times since then.
> >
> > Can anyone tell me why this is happening and how I can fix it without
> having to reboot?
> >
> > This is important as this is a production machine and users are unable
> to log into the domain
> > when this happens.
>
> Can you get logs showing what is going on when the machine is in
> this state ? There's not enough information here to make a good
> diagnosis.
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>