samba - Apr 2002 - can't get an XP machine to join my samba3 PDC's domain

I think i've got the new add machine script working
since the user is created okay

here is the relevant part of my conf file - 
	workgroup = LAUELAB
	netbios name = BITC
	server string = BITC/CAMIS Samba Server
	passdb backend = ldapsam
	passwd program = /usr/sbin/smbldap-passwd.pl %u
	username map = /etc/samba/smbusers
	unix password sync = Yes
	log level = 10
	syslog = 0
	log file = /var/log/samba/log.smbd.%m
	max log size = 50000
	time server = Yes
	total print jobs = 10
	add user script = /usr/sbin/smbldap-useradd.pl -a -m %u
	delete user script = /usr/sbin/smbldap-userdel.pl %u
	add group script = /usr/sbin/smbldap-groupadd.pl %g
	delete group script = /usr/sbin/smbldap-userdel.pl %g
	add machine script = /usr/sbin/smbldap-useradd.pl -w %u
	logon script = logon.cmd
	logon path = \\bitc\profiles\%u
	logon drive = H:
	logon home = \\bitc\%U
	domain logons = Yes
	os level = 64
	preferred master = True
	domain master = True
	dns proxy = No
	wins server = 132.177.44.30
	ldap suffix = dc=bitc,dc=unh,dc=edu
	ldap machine suffix = dc=bitc,dc=unh,dc=edu
	ldap user suffix = dc=bitc,dc=unh,dc=edu
	ldap admin dn = cn=ldapadmin,dc=bitc,dc=unh,dc=edu
	ldap ssl = no
	printer admin = root, bwlang
	hosts allow = 132.177.44.0/255.255.252.0
	printing = lprng

has anybody actually done this with samba3?
I have a level 10 log but its 10k lines so i won't post it here unless
somebody wants it

the message on the client is 
"There is not user session key for the specified logon session"

thanks!

brad

On Tue, Apr 30, 2002 at 07:29:52PM -0400, Bradley W. Langhorst
wrote:
> I think i've got the new add machine script working
> since the user is created okay
> has anybody actually done this with samba3?
> I have a level 10 log but its 10k lines so i won't post it here unless
> somebody wants it
> 
> the message on the client is 
> "There is not user session key for the specified logon session"
> 
You must set 'use spnego = no' (smb.conf) to stop Win2k (and WinXP) from
thinking
that we are a AD domain controller, and attempting to set kerberos keys
on us.  Our 'we don't know what that is' reply gets mangled rather
badly
before it gets to the user...

Andrew Bartlett