samba - Jan 2025 - Windows 11 24H2, Samba 4.21.3 AD DC and domain users cannot log in

On 22.01.2025 16:16, Rowland Penny via samba wrote:
> On Wed, 22 Jan 2025 15:46:44 +0200
> Virgo P?rna via samba <samba at lists.samba.org> wrote:
> 
>> After enabling auth_audit logging at samba, there are lot of messages
>> with status NT_STATUS_TIME_DIFFERENCE_AT_DC
>> But clock is synced and same in workstation and in server...
>>
> 
>  From the looks of it, your workstation thinks differently, could it be
> a timezone problem ?
> 
	Windows is set to UTC +02:00.. And date command in DC shows EET (East 
European Time). Both appear to have same time.

And also, w32tm /monitor run at Windows 11 computer reports:
NTP: +0.0000000s offset from dc.hostname




-- 
Virgo P?rna
virgo.parna at mail.ee

It is quite possible, that NT_STATUS_TIME_DIFFERENCE_AT_DC is some kind 
of red herring. I found thread from July, where it was suggested, that 
"Samba seems to return it as an error code as a backstop".
	I did add log level = 10 with custom IP based filename to get 
additional logs. But it seems, that with
log level = 1 auth_audit:5@/var/log/samba/auth_audit.log
in main config... auth audit log goes still there.

	One additional strange thing I did notice in that log, was, that Samba 
seems to be using strange 0 datetime in logs... In data structures were 
values like
creation_time   : N jaan  23 08:26:52 2025 EET
expiration_time : N jaan  23 01:55:33 1975 MSK
(Default locale is et_EE locale... jaan - jan, N - Thu.)

I would assume, that this 50 years in past date is some kind of null 
values.

	Although, I do not think that there is actual time syncing issue. 
Because I have backup script, that connects to read-only share at that 
computer from linux with special backup user and it uses krb5 
authentication to mount it. I would assume, that with wrong time that 
would also not work.

	

-- 
Virgo P?rna
virgo.parna at mail.ee