samba - Apr 2004 - Problem joining 3.0.2a to W2k AD

When attempting to join my Samba box to my AD domain, I get the following:

# ./net rpc join -I 192.168.0.20 -U administrator
Password:
[2004/04/21 16:18:30, 0] rpc_client/cli_netlogon.c:cli_nt_setup_creds(249)
  cli_nt_setup_creds: request challenge failed
[2004/04/21 16:18:30, 0] utils/net_rpc_join.c:net_rpc_join_newstyle(326)
  Error domain join verification (reused connection):
NT_STATUS_INVALID_COMPUTER_NAME

Unable to join domain OTSHDQTR.
# 

The machine account is created in AD when I run net join. I have been
deleting it between attempts to join the domain,

I am running Samba 3.0.2a on Debian GNU/Linux 3.0r2. My domain is a Windows
2000 mixed-mode domain with no WINS server. Samba was compiled from source
with the following options:

--with-prefix=/opt/samba --with-winbind

My smb.conf file is as follows:

[global]
  workgroup = OTSHDQTR
  netbios name = DEBSERV1
  security = domain
  password server = 192.168.0.20
  client ntlmv2 auth = yes
  log file = /opt/samba/var/log/log.%m
  log level = 3
  winbind use default domain = yes

Searching Google and the archives turned up a single hit: a nearly identical
problem (posted April 14th) that nobody responded to.

Any suggestions?

Adam

[Forwarding to list so it's in the archives]

----------  Forwarded Message  ----------

Subject: RE: [Samba] Problem joining 3.0.2a to W2k AD
Date: Wednesday 21 April 2004 05:05 pm
From: "Harmon, Leigh" <lharmo02@harris.com>
To: "'Adam Aube'" <aaube01@baker.edu>

I believe that you are referring to my post earlier.  Our issue ended up
 being a security policy on the Windows domain controller.  It took us
 many hours of looking at debug logs and sniffing the network traffic. It
 seemed like the Samba server was trying to connect anonymously, but
 there was a registry variable set to "restrict anonymous"

The following registry was the issue.
HKEY_LOCAL_MACHINE/System/CurrentControlSet/Control/LSA/RestrictAnonymous
 = 2 (it must be set to 1 or 0)

Once we changed it, we were able to join.

Hope this helps,

Leigh