samba - Dec 2024 - Authentication error., The requested encryption type is not supported by the Kerberos domain controller.

Hello,

After updating to Windows 24H2, I get an error message when connecting 
to remotedesktop: "Authentication error.
The requested encryption type is not supported by the Kerberos domain 
controller."

The domain controllers run with Samba 4.21.2-Ubuntu
What can be done in this situation?

Thanks,

Georg


smb.conf:

# Global parameters
[global]
 ??????? netbios name = AD1
 ??????? realm = AD.EXAMPLE.COM
 ??????? server role = active directory domain controller
 ??????? workgroup = AD
 ??????? dns forwarder = 192.168.3.2
 ??????? interfaces = 192.168.3.8

[sysvol]
 ??????? path = /var/lib/samba/sysvol
 ??????? read only = No

[netlogon]
 ??????? path = /var/lib/samba/sysvol/ad.example.com/scripts
 ??????? read only = No

On 13/12/24 7:34 pm, Georg Weickelt via samba wrote:
> Hello,
> 
> After updating to Windows 24H2, I get an error message when connecting 
> to remotedesktop: "Authentication error.
> The requested encryption type is not supported by the Kerberos domain 
> controller."
> 
> The domain controllers run with Samba 4.21.2-Ubuntu
> What can be done in this situation?
> 
> Thanks,
> 
> Georg
> 
> 
> smb.conf:
> 
> # Global parameters
> [global]
>  ??????? netbios name = AD1
>  ??????? realm = AD.EXAMPLE.COM
>  ??????? server role = active directory domain controller
>  ??????? workgroup = AD
>  ??????? dns forwarder = 192.168.3.2
>  ??????? interfaces = 192.168.3.8
> 
> [sysvol]
>  ??????? path = /var/lib/samba/sysvol
>  ??????? read only = No
> 
> [netlogon]
>  ??????? path = /var/lib/samba/sysvol/ad.example.com/scripts
>  ??????? read only = No
Any chance you can capture a Wireshark trace of the connection attempt? 
That might help us to determine what?s going on.

Cheers,
Jennifer (she/her)

On Fri, 13 Dec 2024 07:34:47 +0100
Georg Weickelt via samba <samba at lists.samba.org> wrote:
> Hello,
> 
> After updating to Windows 24H2, I get an error message when
> connecting to remotedesktop: "Authentication error.
> The requested encryption type is not supported by the Kerberos domain 
> controller."
24H2 no longer has RC4, it only has AES, so could the KDC still be
using only RC4 ?
 
> 
> The domain controllers run with Samba 4.21.2-Ubuntu
> What can be done in this situation?
> 
> Thanks,
> 
> Georg
> 
> 
> smb.conf:
> 
> # Global parameters
> [global]
>  ??????? netbios name = AD1
>  ??????? realm = AD.EXAMPLE.COM
>  ??????? server role = active directory domain controller
>  ??????? workgroup = AD
>  ??????? dns forwarder = 192.168.3.2
>  ??????? interfaces = 192.168.3.8
That caught my attention, the DCs ipaddress is 192.168.3.8 and it is
forwarding to 192.168.3.2, what is 192.168.3.2 ?

Rowland