Hi folks, Please, see hardware specs and smb.conf below the message. I have got problems with smbd hanging at irregular intervals. When smbd hangs, it consumes most of the cpu cycles, and the server becomes quite unresponsive. The server can work for 2 weeks with no problems, and the problem can also occur a few times during the same day. I cannot deduce anything that triggers the problems. No network problems, the DCs work as expected. The only solution to solve the problem is to restart smbd. The problems started after installing Samba 4.22.2 from Bookworm backports, and continuing under Samba 4.23.3 from Trixie backports, though not as frequent as under Debian 12. There are about 4 - 6 simultaneous users connected to Samba shares on the server. It's mainly used for storing workstation profiles, CAD drawings, and Adobe InDesign projects. Many files may be open at a time, and the file sizes are mostly below 100 MB. Files can stay open for a whole workday, 8 - 9 hours. All clients are Windows 11 workstations. Don't get excited by the fact that the domain ends with .LOCAL. It's a very old domain that started as an NT4 domain more than 20 years ago. It was converted? to a AD domain 10 years ago, and has been working without major problems since then. There are NO zero config devices in the network, so the .local in the domain name should be OK. The server is very lightly loaded. I have never seen the server exhausting available memory, not even coming close to available memory. The drives are all NVMe gen 4, and network connection 2x10 Gbit/s over LDAP. In the journal, the following log entries are repeatedly recurring when problems occur: Nov 26 12:54:07 srvfast rpcd_classic[46927]: [2025/11/26 12:54:07.068293,? 0, effective(0, 0), real(0, 0)] source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg) Nov 26 12:54:07 srvfast rpcd_classic[46927]: ?svcctl_init_winreg: Could not open SYSTEM\CurrentControlSet\Services - NT_STATUS_CONNECTION_DISCONNECTED Nov 26 12:54:07 srvfast rpcd_classic[46927]: [2025/11/26 12:54:07.069179,? 0, effective(0, 0), real(0, 0)] librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server) Nov 26 12:54:07 srvfast rpcd_classic[46927]: ?dcesrv_init_ep_server: Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL Nov 26 12:54:07 srvfast rpcd_classic[46927]: [2025/11/26 12:54:07.069915,? 0, effective(0, 0), real(0, 0)] source3/rpc_server/rpc_worker.c:954(register_ep_server) Nov 26 12:54:07 srvfast rpcd_classic[46927]: ?register_ep_server: dcesrv_init_ep_server(svcctl) failed: NT_STATUS_UNSUCCESSFUL Nov 26 12:54:07 srvfast rpcd_classic[46927]: [2025/11/26 12:54:07.070645,? 0, effective(0, 0), real(0, 0)] source3/rpc_server/rpc_worker.c:1227(rpc_worker_main) Nov 26 12:54:07 srvfast rpcd_classic[46927]:? ?rpc_worker_main: register_ep_server failed: NT_STATUS_UNSUCCESSFUL Nov 26 12:54:11 srvfast rpcd_classic[46926]: [2025/11/26 12:54:11.829782,? 0, effective(0, 0), real(0, 0)] source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg) Nov 26 12:54:11 srvfast rpcd_classic[46926]: ?svcctl_init_winreg: Could not open SYSTEM\CurrentControlSet\Services - NT_STATUS_CONNECTION_DISCONNECTED Nov 26 12:54:11 srvfast rpcd_classic[46926]: [2025/11/26 12:54:11.830773,? 0, effective(0, 0), real(0, 0)] librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server) Nov 26 12:54:11 srvfast rpcd_classic[46926]: ?dcesrv_init_ep_server: Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL Nov 26 12:54:11 srvfast rpcd_classic[46926]: [2025/11/26 12:54:11.831672,? 0, effective(0, 0), real(0, 0)] source3/rpc_server/rpc_worker.c:954(register_ep_server) Nov 26 12:54:11 srvfast rpcd_classic[46926]: ?register_ep_server: dcesrv_init_ep_server(svcctl) failed: NT_STATUS_UNSUCCESSFUL Nov 26 12:54:11 srvfast rpcd_classic[46926]: [2025/11/26 12:54:11.832437,? 0, effective(0, 0), real(0, 0)] source3/rpc_server/rpc_worker.c:1227(rpc_worker_main) Nov 26 12:54:11 srvfast rpcd_classic[46926]:? ?rpc_worker_main: register_ep_server failed: NT_STATUS_UNSUCCESSFUL Nov 26 12:54:28 srvfast rpcd_classic[46957]: [2025/11/26 12:54:28.921915,? 0, effective(0, 0), real(0, 0)] source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg) Nov 26 12:54:28 srvfast rpcd_classic[46957]: ?svcctl_init_winreg: Could not open SYSTEM\CurrentControlSet\Services - NT_STATUS_CONNECTION_DISCONNECTED Nov 26 12:54:28 srvfast rpcd_classic[46959]: [2025/11/26 12:54:28.922598,? 0, effective(0, 0), real(0, 0)] source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg) Nov 26 12:54:28 srvfast rpcd_classic[46957]: [2025/11/26 12:54:28.922959,? 0, effective(0, 0), real(0, 0)] librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server) Nov 26 12:54:28 srvfast rpcd_classic[46959]: ?svcctl_init_winreg: Could not open SYSTEM\CurrentControlSet\Services - NT_STATUS_CONNECTION_DISCONNECTED Nov 26 12:54:28 srvfast rpcd_classic[46958]: [2025/11/26 12:54:28.923139,? 0, effective(0, 0), real(0, 0)] source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg) Nov 26 12:54:28 srvfast rpcd_classic[46957]: ?dcesrv_init_ep_server: Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL Nov 26 12:54:28 srvfast rpcd_classic[46958]: ?svcctl_init_winreg: Could not open SYSTEM\CurrentControlSet\Services - NT_STATUS_CONNECTION_DISCONNECTED Nov 26 12:54:28 srvfast rpcd_classic[46956]: [2025/11/26 12:54:28.923859,? 0, effective(0, 0), real(0, 0)] source3/rpc_server/svcctl/srv_svcctl_reg.c:586(svcctl_init_winreg) Nov 26 12:54:28 srvfast rpcd_classic[46957]: [2025/11/26 12:54:28.924098,? 0, effective(0, 0), real(0, 0)] source3/rpc_server/rpc_worker.c:954(register_ep_server) Nov 26 12:54:28 srvfast rpcd_classic[46956]: ?svcctl_init_winreg: Could not open SYSTEM\CurrentControlSet\Services - NT_STATUS_CONNECTION_DISCONNECTED Nov 26 12:54:28 srvfast rpcd_classic[46959]: [2025/11/26 12:54:28.924138,? 0, effective(0, 0), real(0, 0)] librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server) Nov 26 12:54:28 srvfast rpcd_classic[46957]: ?register_ep_server: dcesrv_init_ep_server(svcctl) failed: NT_STATUS_UNSUCCESSFUL Nov 26 12:54:28 srvfast rpcd_classic[46958]: [2025/11/26 12:54:28.924295,? 0, effective(0, 0), real(0, 0)] librpc/rpc/dcesrv_core.c:2812(dcesrv_init_ep_server) Nov 26 12:54:28 srvfast rpcd_classic[46959]: ?dcesrv_init_ep_server: Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL Nov 26 12:54:28 srvfast rpcd_classic[46958]: ?dcesrv_init_ep_server: Failed to init endpoint server 'svcctl': NT_STATUS_UNSUCCESSFUL Nov 26 12:54:28 srvfast rpcd_classic[46957]: [2025/11/26 12:54:28.924945,? 0, effective(0, 0), real(0, 0)] source3/rpc_server/rpc_worker.c:1227(rpc_worker_main) If somebody has got a clue what's going on, I would be grateful to get help how to address the problems. Best regards, Peter *Hardware* HPE ProLiant DL-325 Gen10 Plus v2 CPU: AMD EPYC 74F3 24-Core (48 threads) RAM: 32 GB Network connection: 2x10 Gbit/s over LDAP Drives: NVMe gen. 4 * OS * Debian 13.2, with Samba 4.23.3-Debian-4.23.3+dfsg-1~bpo13+1 * AD DCs * 2x AD DC running Debian 13.2 with Samba 4.23.3-Debian-4.23.3+dfsg-1~bpo13+1 * smb.conf * [global] # Prior to version 4.23.0+dfsg-4, debian samba package carried usershare.patch # patch which changed default value for "usershare max share" parameter ? ? ? ? usershare max shares = 100 ? ? ? ? client signing = required ? ? ? ? debug uid = Yes ? ? ? ? dedicated keytab file = /etc/krb5.keytab ? ? ? ? disable netbios = Yes ? ? ? ? disable spoolss = Yes ? ? ? ? kerberos method = secrets and keytab ? ? ? ? log level = 1 ? ? ? ? panic action = /usr/share/samba/panic-action %d ? ? ? ? printcap name = /dev/null ? ? ? ? realm = RULLE.LOCAL ? ? ? ? restrict anonymous = 2 ? ? ? ? security = ADS ? ? ? ? server role = member server ? ? ? ? smb ports = 445 ? ? ? ? template homedir = /home/%U ? ? ? ? template shell = /sbin/nologin ? ? ? ? winbind use default domain = yes ? ? ? ? timestamp logs = Yes ? ? ? ? username map = /etc/samba/user.map ? ? ? ? min domain uid = 0 ? ? ? ? winbind enum groups = Yes ? ? ? ? winbind enum users = Yes ? ? ? ? winbind refresh tickets = Yes ? ? ? ? workgroup = RULLE ? ? ? ? idmap config rulle : range = 10000-99999 ? ? ? ? idmap config rulle : backend = rid ? ? ? ? idmap config * : range = 3000-9999 ? ? ? ? idmap config * : backend = tdb ? ? ? ? map acl inherit = Yes ? ? ? ? vfs objects = acl_xattr ? ? ? ? hide unreadable = yes ? ? ? ? veto files = /.bash_logout/.bash_profile/.bash_history/.bashrc/ [Homes$] ? ? ? ? readonly = no ? ? ? ? path = /data/samba/homes ? ? ? ? csc policy = disable [Profiles$] ? ? ? ? readonly = no ? ? ? ? path = /data/samba/profiles ? ? ? ? csc policy = disable [Users$] ? ? ? ? readonly = no ? ? ? ? path = /data/samba/users ? ? ? ? csc policy = disable [Share1] ? ? ? ? readonly = no ? ? ? ? path = /data/samba/share1 [Share2] ? ? ? ? readonly = no ? ? ? ? path = /data/samba/share2 .... [ShareN] ? ? ? ? readonly = no ? ? ? ? path = /data/samba/sharen