samba - Feb 2025 - Windows 11 24H2, Samba 4.21.3 AD DC and domain users cannot log in

And there has been some developement...

test-computersecurechannel
still reports True.
But now
test-computersecurechannel -repair
now fails with
"Test-ComputerSecureChannel: Cannot reset the secure channel password 
for the computer account in the domain. Operation failed with the 
following exception: The user name or password is incorrect."

test-computersecurechannel -repair -Credential DOMAIN\Administrator 
-Server dc.domain
also fails with same message.

But
test-computersecurechannel -repair -Credential DOMAIN\Administrator 
-Server ip_of_dc
succeeds...

-- 
Virgo P?rna
virgo.parna at mail.ee

On Tue, 4 Feb 2025 15:07:30 +0200
Virgo P?rna via samba <samba at lists.samba.org> wrote:
> And there has been some developement...
> 
> test-computersecurechannel
> still reports True.
> But now
> test-computersecurechannel -repair
> now fails with
> "Test-ComputerSecureChannel: Cannot reset the secure channel password 
> for the computer account in the domain. Operation failed with the 
> following exception: The user name or password is incorrect."
> 
> test-computersecurechannel -repair -Credential DOMAIN\Administrator 
> -Server dc.domain
> also fails with same message.
> 
> But
> test-computersecurechannel -repair -Credential DOMAIN\Administrator 
> -Server ip_of_dc
> succeeds...
> 
that may point a way to the problem, using a fqdn will probably use
kerberos and using the IP will probably use rpc. If that is the case,
then there is probably a kerberos problem and doing a search on that,
turned up this;

https://nuangel.net/2025/01/windows-11-24h2-insufficient-system-resources-trying-to-login/

Check that, it may be your problem.

Rowland