samba - Oct 2017 - NT_STATUS_INTERNAL_ERROR from RPC server on samba 4.5.8 AD DC

On Mon, 16 Oct 2017 19:06:20 +0100
Richard Connon via samba <samba at lists.samba.org> wrote:
> Hi,
> 
> I provided the dump of all the conf files to Rowland by email but in 
> case anyone else is curious they are also here:
> 
> http://www.irconan.co.uk/dc.tar http://www.irconan.co.uk/member.tar
> 
I didn't get it, so I downloaded it ;-)

Is the member server using DHCP ?

Is '10.0.2.15' the ipaddress of the DC ?

You haven't got 'security = ADS' in your smb.conf.

You have 'unix password sync = yes' in smb.conf,
Do you have Unix users that are also in AD ?

And finally the biggy, are you using sssd ?

Rowland

On 16/10/2017 19:30, Rowland Penny wrote:
> On Mon, 16 Oct 2017 19:06:20 +0100
> Richard Connon via samba <samba at lists.samba.org> wrote:
>
>> Hi,
>>
>> I provided the dump of all the conf files to Rowland by email but in
>> case anyone else is curious they are also here:
>>
>> http://www.irconan.co.uk/dc.tar http://www.irconan.co.uk/member.tar
>>
> I didn't get it, so I downloaded it ;-)
>
> Is the member server using DHCP ?
Yes. Both test hosts are using DHCP with static leases for IP addresses 
but not for DNS domains or nameservers.
> Is '10.0.2.15' the ipaddress of the DC ?
Yes
> You haven't got 'security = ADS' in your smb.conf.
Assuming you mean on the member, good point, but it doesn't change this 
behaviour. My understanding was this only affected smbd anyway, which 
I'm not running on the member.
> You have 'unix password sync = yes' in smb.conf,
> Do you have Unix users that are also in AD ?
No, this is just a default smb.conf from debian. I assume this wouldn't 
actually have any affect on a member server where there is no local 
passdb anyway and again, removing it has no affect.
> And finally the biggy, are you using sssd ?
No, these test hosts are very basic debian installs I've done to attempt 
to isolate this problem, although my "production" installs use
SSSD.
> Rowland

On Tue, 17 Oct 2017 09:29:00 +0100
Richard Connon via samba <samba at lists.samba.org> wrote:
> On 16/10/2017 19:30, Rowland Penny wrote:
> >
> > Is the member server using DHCP ?
> Yes. Both test hosts are using DHCP with static leases for IP
> addresses but not for DNS domains or nameservers.
I wouldn't do this, I would give the DC a fixed ipaddress.
> > Is '10.0.2.15' the ipaddress of the DC ?
> Yes
> > You haven't got 'security = ADS' in your smb.conf.
> Assuming you mean on the member, good point, but it doesn't change
> this behaviour. My understanding was this only affected smbd anyway,
> which I'm not running on the member.
You need it
> > You have 'unix password sync = yes' in smb.conf,
> > Do you have Unix users that are also in AD ?
> No, this is just a default smb.conf from debian. I assume this
> wouldn't actually have any affect on a member server where there is
> no local passdb anyway and again, removing it has no affect.
It wouldn't help.
> > And finally the biggy, are you using sssd ?
> No, these test hosts are very basic debian installs I've done to
> attempt to isolate this problem, although my "production"
installs
> use SSSD.
Then it is never going to work, you have not set up winbind at all.

Can I suggest you go and read this:

https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member

I suggest you follow it and use the 'rid' backend.

Rowland