Need help on this. My account is locked out. Need way to reset. --Mark -----Original Message----- Date: Fri, 13 Apr 2018 14:49:44 -0400 Organization: Ohio Highway Patrol Retirement System To: samba at lists.samba.org Subject: Re: [Samba] How to change Domain password as normal user? On Thu, 5 Apr 2018 16:59:15 +0100 Rowland Penny <rpenny at samba.org> wrote:> > On Thu, 05 Apr 2018 11:31:18 -0400 > Mark Foley via samba <samba at lists.samba.org> wrote: > > > OK, I'm having issues with the problem. To summarize, I'm trying to > > have a normal user change his password from a domain member. I've > > tried: passwd, kpasswd and 'samba-tool user password -U $USER > > --ipaddress=<IPofAD/DC>'. All mechanisms do change the domain > > password and I can log into Windows and Linux domain members, and > > website requiring domain authentication. > > > > HOWEVER, after 1 to 3 days the account become locked out. About 2 > > days ago I did the samba-tool method and reported in this thread that > > it worked. Today I tried to log into my Windows workstation and was > > locked out. The Samba log message was: > > > > [2018/04/05 05:11:38.549997, 2] authentication for user [HPRS/myuser] > > FAILED with error NT_STATUS_ACCOUNT_LOCKED_OUT > > > > ntlm_auth gives: > > > > Unable to Authenticate: NT_STATUS_ACCOUNT_LOCKED_OUT: Account locked > > out (0xc0000234) > > > > This all despite the rcpclient saying the expiration is in July. > > > > The problem here is that you are mixing up an expired password and an > account that is locked out. > An account can get logged out for various reasons, but the main one is > something trying to auth with an old or wrong password. Do you have > anything that tries to authenticate to AD with the username and > password, if so, check it is using the right password, mobile phones > are a favourite place to start. > > RowlandI think there might be a bug. A week ago I used 'samba-tool user setpassword me' as the domain administrator from the AD server to reset my normal user domain password. That worked for the past week with no lockout issues. So, yesterday I decided to again try samba-tool user password -U $USER --ipaddress=mail from the domain member workstation as the normal user, $USER. Again, that worked. However, once again today (the next day) I am locked out. Furthermore, if I try to use samba-tool as the Domain Admin to set the password to the same value as the locked out one, I still could not get in. I had to change the password to something different. This behavior is consistent. If, as the normal user, I change the domain password using samba-tool from the domain member computer, I get locked out within about a day. If I do the same as the domain admin, no lockout happens. I know with certainty this is NOT related to cell phones or other programs trying to repeatedly authenticate. For one thing, I have no cell phone or remote mail client accessing this domain. Also, I send an email notice for EVERY failed domain login attempt. There are no such failures in the samba log. I think there is a bug afoot. I would be happy to try any tests anyone might suggest. --Mark Samba 4.4.16 6 hours Later ... After resetting to a different password using samba-tool as domain administrator from the AD server 6 hours ago, and being able to successfully log in, I find myself locked out AGAIN! I need a way to reset the lockout indicator. This is a big problem. --Mark -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Still having daily problems. Yesterday, again, I reset the user password from the AD/DC as the domain administrator: samba-tool user setpassword mark Today, I was unable to log in. The only message in the log.samba file is: [2018/04/16 14:02:12.199145, 2] ../source4/auth/ntlm/auth.c:430(auth_check_password_recv) auth_check_password_recv: sam_ignoredomain authentication for user [HPRS\mark] FAILED with error NT_STATUS_ACCOUNT_LOCKED_OUT There are no preceeding messages with invalid passwords, etc. If I reset the password as domain administrator I get locked out sometime a day later. This is consistently repeatable. How do I fix this? This is an urgent problem. If this list is not the right place for this question, please advise. --Mark -----Original Message----- Date: Sat, 14 Apr 2018 19:29:01 -0400 Organization: Ohio Highway Patrol Retirement System To: samba at lists.samba.org Subject: Re: [Samba] How to change Domain password as normal user? Need help on this. My account is locked out. Need way to reset. --Mark -----Original Message----- Date: Fri, 13 Apr 2018 14:49:44 -0400 Organization: Ohio Highway Patrol Retirement System To: samba at lists.samba.org Subject: Re: [Samba] How to change Domain password as normal user? On Thu, 5 Apr 2018 16:59:15 +0100 Rowland Penny <rpenny at samba.org> wrote:> > On Thu, 05 Apr 2018 11:31:18 -0400 > Mark Foley via samba <samba at lists.samba.org> wrote: > > > OK, I'm having issues with the problem. To summarize, I'm trying to > > have a normal user change his password from a domain member. I've > > tried: passwd, kpasswd and 'samba-tool user password -U $USER > > --ipaddress=<IPofAD/DC>'. All mechanisms do change the domain > > password and I can log into Windows and Linux domain members, and > > website requiring domain authentication. > > > > HOWEVER, after 1 to 3 days the account become locked out. About 2 > > days ago I did the samba-tool method and reported in this thread that > > it worked. Today I tried to log into my Windows workstation and was > > locked out. The Samba log message was: > > > > [2018/04/05 05:11:38.549997, 2] authentication for user [HPRS/myuser] > > FAILED with error NT_STATUS_ACCOUNT_LOCKED_OUT > > > > ntlm_auth gives: > > > > Unable to Authenticate: NT_STATUS_ACCOUNT_LOCKED_OUT: Account locked > > out (0xc0000234) > > > > This all despite the rcpclient saying the expiration is in July. > > > > The problem here is that you are mixing up an expired password and an > account that is locked out. > An account can get logged out for various reasons, but the main one is > something trying to auth with an old or wrong password. Do you have > anything that tries to authenticate to AD with the username and > password, if so, check it is using the right password, mobile phones > are a favourite place to start. > > RowlandI think there might be a bug. A week ago I used 'samba-tool user setpassword me' as the domain administrator from the AD server to reset my normal user domain password. That worked for the past week with no lockout issues. So, yesterday I decided to again try samba-tool user password -U $USER --ipaddress=mail from the domain member workstation as the normal user, $USER. Again, that worked. However, once again today (the next day) I am locked out. Furthermore, if I try to use samba-tool as the Domain Admin to set the password to the same value as the locked out one, I still could not get in. I had to change the password to something different. This behavior is consistent. If, as the normal user, I change the domain password using samba-tool from the domain member computer, I get locked out within about a day. If I do the same as the domain admin, no lockout happens. I know with certainty this is NOT related to cell phones or other programs trying to repeatedly authenticate. For one thing, I have no cell phone or remote mail client accessing this domain. Also, I send an email notice for EVERY failed domain login attempt. There are no such failures in the samba log. I think there is a bug afoot. I would be happy to try any tests anyone might suggest. --Mark Samba 4.4.16 6 hours Later ... After resetting to a different password using samba-tool as domain administrator from the AD server 6 hours ago, and being able to successfully log in, I find myself locked out AGAIN! I need a way to reset the lockout indicator. This is a big problem. --Mark -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
On Mon, 16 Apr 2018 14:12:02 -0400 Mark Foley via samba <samba at lists.samba.org> wrote:> Still having daily problems. Yesterday, again, I reset the user > password from the AD/DC as the domain administrator: samba-tool user > setpassword mark > > Today, I was unable to log in. The only message in the log.samba file > is: > > [2018/04/16 14:02:12.199145, > 2] ../source4/auth/ntlm/auth.c:430(auth_check_password_recv) > auth_check_password_recv: sam_ignoredomain authentication for user > [HPRS\mark] FAILED with error NT_STATUS_ACCOUNT_LOCKED_OUT > > There are no preceeding messages with invalid passwords, etc. If I > reset the password as domain administrator I get locked out sometime > a day later. This is consistently repeatable. > > How do I fix this? This is an urgent problem. > > If this list is not the right place for this question, please advise. >The problem is that the locking out probably has nothing to do with the password change, other than the password has been changed. See here for what to check for: https://www.lepide.com/blog/what-are-the-common-root-causes-of-account-lockouts-and-do-i-resolve-them/ The other problem is, you really need Samba 4.7.0 onwards to get the authentication attempts in the logs, so it looks like you need to upgrade, but do not upgrade to 4.8.0 There is probably something trying to auth with a stale password, but with your Samba version it will be hard to discover what. Rowland