samba - Feb 2019 - gpo not applied a boot computer

compiled samba version : 4.8.5  and my distribution is: debian stretch 9.6
I said that when I join the domain, restarting the machine takes the GPO,
the other restart does not take the gpo computer.
Thanks for your help

Le mar. 26 févr. 2019 à 17:11, Rowland Penny via samba <
samba at lists.samba.org> a écrit :
> On Tue, 26 Feb 2019 16:37:39 +0100
> David Jehin <bedou210977 at gmail.com> wrote:
>
> > THANK YOU FOR YOUR REPLY
> >
> > THE RESULT :
> > KVNO Principal
> > ----
> >
> --------------------------------------------------------------------------
> >    1 HOST/samba4 at FSS.LAN (des-cbc-crc)
> >    1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc)
> >    1 SAMBA4$@FSS.LAN (des-cbc-crc)
> >    1 HOST/samba4 at FSS.LAN (des-cbc-md5)
> >    1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-md5)
> >    1 SAMBA4$@FSS.LAN (des-cbc-md5)
> >    1 HOST/samba4 at FSS.LAN (arcfour-hmac)
> >    1 HOST/samba4.fss.lan at FSS.LAN (arcfour-hmac)
> >    1 SAMBA4$@FSS.LAN (arcfour-hmac)
> >    1 HOST/samba4 at FSS.LAN (aes128-cts-hmac-sha1-96)
> >    1 HOST/samba4.fss.lan at FSS.LAN (aes128-cts-hmac-sha1-96)
> >    1 SAMBA4$@FSS.LAN (aes128-cts-hmac-sha1-96)
> >    1 HOST/samba4 at FSS.LAN (aes256-cts-hmac-sha1-96)
> >    1 HOST/samba4.fss.lan at FSS.LAN (aes256-cts-hmac-sha1-96)
> >    1 SAMBA4$@FSS.LAN (aes256-cts-hmac-sha1-96)
> >    2 HOST/samba4 at FSS.LAN (des-cbc-crc)
> >    2 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc)
> >    2 SAMBA4$@FSS.LAN (des-cbc-crc)
> >    2 HOST/samba4 at FSS.LAN (des-cbc-md5)
> >    2 HOST/samba4.fss.lan at FSS.LAN (des-cbc-md5)
> >    2 SAMBA4$@FSS.LAN (des-cbc-md5)
> >    2 HOST/samba4 at FSS.LAN (arcfour-hmac)
> >    2 HOST/samba4.fss.lan at FSS.LAN (arcfour-hmac)
> >    2 SAMBA4$@FSS.LAN (arcfour-hmac)
> >    2 HOST/samba4 at FSS.LAN (aes128-cts-hmac-sha1-96)
> >    2 HOST/samba4.fss.lan at FSS.LAN (aes128-cts-hmac-sha1-96)
> >    2 SAMBA4$@FSS.LAN (aes128-cts-hmac-sha1-96)
> >    2 HOST/samba4 at FSS.LAN (aes256-cts-hmac-sha1-96)
> >    2 HOST/samba4.fss.lan at FSS.LAN (aes256-cts-hmac-sha1-96)
> >    2 SAMBA4$@FSS.LAN (aes256-cts-hmac-sha1-96)
> >    1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc)
> >    1 SAMBA4$@FSS.LAN (des-cbc-crc)
> >    1 HOST/samba4 at FSS.LAN (des-cbc-md5)
> >    1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-md5)
> >    1 SAMBA4$@FSS.LAN (des-cbc-md5)
> >    1 HOST/samba4 at FSS.LAN (arcfour-hmac)
> >    1 HOST/samba4.fss.lan at FSS.LAN (arcfour-hmac)
> >    1 SAMBA4$@FSS.LAN (arcfour-hmac)
> >    1 HOST/samba4 at FSS.LAN (aes128-cts-hmac-sha1-96)
> >    1 HOST/samba4.fss.lan at FSS.LAN (aes128-cts-hmac-sha1-96)
> >    1 SAMBA4$@FSS.LAN (aes128-cts-hmac-sha1-96)
> >    1 HOST/samba4 at FSS.LAN (aes256-cts-hmac-sha1-96)
> >    1 HOST/samba4.fss.lan at FSS.LAN (aes256-cts-hmac-sha1-96)
> >    1 SAMBA4$@FSS.LAN (aes256-cts-hmac-sha1-96)
> >
> >
> > Le mar. 26 févr. 2019 à 16:22, Rowland Penny via samba <
> > samba at lists.samba.org> a écrit :
> >
> > > On Tue, 26 Feb 2019 15:57:03 +0100
> > > David Jehin via samba <samba at lists.samba.org> wrote:
> > >
> > > > Hello everyone
> > > > since now a certain time I pull my hair and do not
understand the
> > > > source of my problem.
> > > > after a samba 3 pdc migration to samba 4.8.5 AD, when a
windows
> > > > client starts the gpo computer is not applied to the boot.
> > > > in the windows logs there are 1058 GPO errors and server
side
> > > > samba here are the logs:
> > > >
> > > >   GSS server Update (krb5) (1) Update failed: Miscellaneous
> > > > failure (see text): Failed to find SAMBA4$@FSS.LAN (kvno 2)
in
> > > > keytab FILE: /var/lib/samba/private/secrets.keytab (arcfour
> > > > -hmac-md5) [2019/02/20 11: 20: 33.013351, 1]
> > > >
../auth/gensec/spnego.c:1218(gensec_spnego_server_negTokenInit_step)
> > > >    gensec_spnego_server_negTokenInit_step: gssapi_krb5:
parsing
> > > > NEG_TOKEN_INIT content failed (next [(null)]):
> > > > NT_STATUS_LOGON_FAILURE [2019/02/20 11: 20: 33.041913, 1]
> > > >
> ../source4/auth/gensec/gensec_gssapi.c:790(gensec_gssapi_update_internal)
> > > >
> > > > thank you again for your participation.
> > >
> > > What does this show:
> > >
> > > klist -e -k /var/lib/samba/private/secrets.keytab
> > >
> > > Rowland
> > >
> > > --
> > > To unsubscribe from this list go to the following URL and read
the
> > > instructions:  https://lists.samba.org/mailman/options/samba
> > >
>
> Well that shows that the keytab exists and contains the required
> enctypes for SAMBA4$@FSS.LAN at KVNO 2, what it doesn't have is
> '(arcfour -hmac-md5)' which, to be honest, I don't recognise.
>
> What distro is this running on ?
> Self compiled Samba or distro packages ?
>
> Rowland
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

On Tue, 26 Feb 2019 17:42:23 +0100
David Jehin <bedou210977 at gmail.com> wrote:
> compiled samba version : 4.8.5  and my distribution is: debian
> stretch 9.6 
How did you compile Samba ?
Did you just compile it with './configure' or did you create your
own .debs ?
I ask this because of '/var/lib/samba/private/secrets.keytab'
Normally if you just compiled Samba it goes into /usr/local/samba
unless you set a prefix, so I would have expected something
like /usr/local/samba/private/secrets.keytab.

Are you also aware that you can find Debian Samba packages here:

http://apt.van-belle.nl/

Is Apparmor running and blocking access to the keytab ?

Have you tried running some of the basic tests on both DC's ?

samba-tool dbcheck

https://wiki.samba.org/index.php/Samba-tool_ldapcmp

Rowland

>I said that when I join the domain, restarting the
> machine takes the GPO, the other restart does not take the gpo
> computer. Thanks for your help
> 
Not entirely sure what the above means, is it that a GPO is applied to
one computer but not another, or only one GPO is applied but another
isn't.

Rowland

Sorry for the translation.
actually my first installation is a samba put into production, to
avoid errors, I cloned on a new VM not to break my current system.
on this one I redid an installation with DEB packages
"https://dev.tranquil.it" I then made a restoration.
I presice that the supply is a samba3 pdc migration to samba4 dc
"samba-tool domain samba3upgrade".

I only have one DC at the moment.
I checked the database with "dbcheck", no problems.

if the machine is newly joined on the domain the gpo computer works
the first time, but not the other startups.