samba - Dec 2024 - Authentication error., The requested encryption type is not supported by the Kerberos domain controller.

On Fri, 13 Dec 2024 07:34:47 +0100
Georg Weickelt via samba <samba at lists.samba.org> wrote:
> Hello,
> 
> After updating to Windows 24H2, I get an error message when
> connecting to remotedesktop: "Authentication error.
> The requested encryption type is not supported by the Kerberos domain 
> controller."
24H2 no longer has RC4, it only has AES, so could the KDC still be
using only RC4 ?
 
> 
> The domain controllers run with Samba 4.21.2-Ubuntu
> What can be done in this situation?
> 
> Thanks,
> 
> Georg
> 
> 
> smb.conf:
> 
> # Global parameters
> [global]
>  ??????? netbios name = AD1
>  ??????? realm = AD.EXAMPLE.COM
>  ??????? server role = active directory domain controller
>  ??????? workgroup = AD
>  ??????? dns forwarder = 192.168.3.2
>  ??????? interfaces = 192.168.3.8
That caught my attention, the DCs ipaddress is 192.168.3.8 and it is
forwarding to 192.168.3.2, what is 192.168.3.2 ?

Rowland

I believe RC4 is the default Samba side.  I had to create a policy on the
workstation to enable cipher RC4 to correct the issue.  The latest update
to Windows 11 doesn't accept RC4 anymore. Another option I tried was
backing out of the updates which also worked.

My laptop SSD died however and I lost my diagnostic tools.

Perhaps you could try changing the cipher Samba side for these new Windows
updates to see if it fixes the issue as well and report back?





On Sat, Dec 14, 2024, 2:52?AM Rowland Penny via samba <samba at
lists.samba.org>
wrote:
> On Fri, 13 Dec 2024 07:34:47 +0100
> Georg Weickelt via samba <samba at lists.samba.org> wrote:
>
> > Hello,
> >
> > After updating to Windows 24H2, I get an error message when
> > connecting to remotedesktop: "Authentication error.
> > The requested encryption type is not supported by the Kerberos domain
> > controller."
>
> 24H2 no longer has RC4, it only has AES, so could the KDC still be
> using only RC4 ?
>
> >
> > The domain controllers run with Samba 4.21.2-Ubuntu
> > What can be done in this situation?
> >
> > Thanks,
> >
> > Georg
> >
> >
> > smb.conf:
> >
> > # Global parameters
> > [global]
> >          netbios name = AD1
> >          realm = AD.EXAMPLE.COM
> >          server role = active directory domain controller
> >          workgroup = AD
> >          dns forwarder = 192.168.3.2
> >          interfaces = 192.168.3.8
>
> That caught my attention, the DCs ipaddress is 192.168.3.8 and it is
> forwarding to 192.168.3.2, what is 192.168.3.2 ?
>
> Rowland
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

Hello,
Am 14.12.2024 um 10:52 schrieb Rowland Penny via samba:
> On Fri, 13 Dec 2024 07:34:47 +0100
> Georg Weickelt via samba<samba at lists.samba.org> wrote:
>
>> Hello,
>>
>> After updating to Windows 24H2, I get an error message when
>> connecting to remotedesktop: "Authentication error.
>> The requested encryption type is not supported by the Kerberos domain
>> controller."
> 24H2 no longer has RC4, it only has AES, so could the KDC still be
> using only RC4 ?
How can I find this out?
>> The domain controllers run with Samba 4.21.2-Ubuntu
>> What can be done in this situation?
>>
>> Thanks,
>>
>> Georg
>>
>>
>> smb.conf:
>>
>> # Global parameters
>> [global]
>>   ??????? netbios name = AD1
>>   ??????? realm = AD.EXAMPLE.COM
>>   ??????? server role = active directory domain controller
>>   ??????? workgroup = AD
>>   ??????? dns forwarder = 192.168.3.2
>>   ??????? interfaces = 192.168.3.8
> That caught my attention, the DCs ipaddress is 192.168.3.8 and it is
> forwarding to 192.168.3.2, what is 192.168.3.2 ?
This is our Router.
>
> Rowland
>
>