samba - Jun 2005 - win2k usrmgr.exe returns "remote procedure call failed"

WHAT I HAVE:
I've inherited a production debian system.  uname reveals kernel
2.4.18-bf2.4.  I am now running samba 3.0.14a with a completely "stock
from source" install (as part of my troubleshooting activities).  The
machine acts as a PDC for win2k clients.  It uses smbpasswd for the
password back end. There are approx 20 users.  It also serves dhcp, ntp,
mysql and apache.

WHAT I WANT:
I want to have a person at the client's site able to log on as root and
use the srvtools in win2k to manage the groups and users.  In other
words, they need to be able to use usrmgr.exe to manage the users and
groups of the domain from one of the win2k workstations.

WHAT THE ERROR MESSAGE SAYS:
if I double click on on a user, a standard windows error dialogue comes up
"User Manager for Domains"
"The following error occurred accessing the properties of the user
XX:"
"The remote procedure call failed:"
"The user properties cannot be edited or viewed at this time."
                      [OK]

if I double click on a group (well-known or mapped unix group) the same
error dialogue comes up
"User Manager for Domains"
"The following error occurred accessing the properties of the group
YY:"
"The remote procedure call failed:"
"The group properties cannot be edited or viewed at this time."
                      [OK]

If I then immediately double click again on one of the items (user or
group) the dialogue is a little different:
"User Manager for Domains"
"The following error occurred accessing the properties of the
[user|group] ZZ:"
"The handle is invalid."
"The user properties cannot be edited or viewed at this time."
                      [OK]


WHAT I HAVE DONE SO FAR:
Since it is a production machine, I have built a replica to experiment
with. It has the same debian kernel and "stock from source" install of
samba 3.0.14a.  I copied the smb.conf file, /etc/passwd, /etc/shadow,
and private/smbpasswd files and the directory and permissions structure
of the production server.  The objective was to make as close a copy as
I could of the conditions, users and groups on the production server
(excluding mysql, dhcp, and apache).

I have not been able to replicate the problem. That is, usrmgr.exe works
as expected when the "replica" is acting as PDC. 

On the production server I have set the logging up to 10 and used
usrmgr.exe.  None of the log files had any activity at all.  When I did
this with the replica server, there were the expected entries in the logs.

Other than this problem with rpc, the production server seems to operate
correctly.  For example, I can add machines to the domain.  The
user/group management tools work in the debian linux environment (except
net rpc commands).

I've unmapped and remapped the groups, compared the passwd, shadow and
smbpasswd files (just in case).  I have been thru all the
troubleshooting checklists in the HOW-TO collection, and searched that
document extensively.  Hours with Google have proved fruitless.

So the issue seems to be, what part of the linux install is missing from
my production machine that supports the rpc needs of usrmgr.exe?

What should I post here that would help with troubleshooting?

Any other suggestions, tips, pointers, etc. are most welcome, as I have
run out of knowledge and ideas.

TIA!
d.

Matt Schwartz wrote:
>It might be simply that a tdb has become corrupt.  Try deleting the .tdb
>files from your samba locks directory and rebuilding group mapping.
>  
>
Thanks for the tip, but this had no effect.  I went so far as to remove
all .tdb files in the /usr/local/samba tree.
>-----Original Message-----
>From: samba-bounces+mschwartz=dcscorp.net@lists.samba.org
>Sent: Sunday, June 12, 2005 2:35 AM
>To: samba@lists.samba.org
>Subject: [Samba] win2k usrmgr.exe returns "remote procedure call
failed"
>
-- 
Derek Shaw
BIS Business Information Systems Inc.
Victoria, BC.
voice: 250-885-2021   fax: 250-386-4060
GnuPG Public Key ID: 0x5553C338

Matt Schwartz wrote:
>It might be simply that a tdb has become corrupt.  Try deleting the .tdb
>files from your samba locks directory and rebuilding group mapping.
>  
>
Further experience to add here after re-creating all the .tdb files.

I have a win2k workstation temporarily sharing a directory.  I have
dis-joined and rejoined this machine to the samba (NT) domain.  I did
this after I unmapped and re-mapped the NT groups for the domain  Then I
needed to fix the access permissions on the shared directory.

In the sharing permissions for this folder I cannot add the mapped
groups to the list of authorized users/groups.  I can add individual
users from the samba domain, and the "well-known" NT groups.  I
suspect
this is a different symptom of the same problem causing the "rpc
failed"
message when trying to use the windows usrmgr.exe tool.

Any ideas which logs I should be monitoring to see the difference
between my "replica" server and this production server for this issue?

On a different tangent -- is there a way to re-create or re-print the
list of files that were installed by samba (the list that shows up on
the screen when one types "make install")?  I'd like to compare
the
lists between the two machines.

TIA for any other tips or ideas.
>-----Original Message-----
>From: samba-bounces+mschwartz=dcscorp.net@lists.samba.org
>[mailto:samba-bounces+mschwartz=dcscorp.net@lists.samba.org] On Behalf
>Of Derek Shaw
>Sent: Sunday, June 12, 2005 2:35 AM
>To: samba@lists.samba.org
>Subject: [Samba] win2k usrmgr.exe returns "remote procedure call
failed"
>  
>
-- 
Derek Shaw
BIS Business Information Systems Inc.
Victoria, BC.
voice: 250-885-2021   fax: 250-386-4060
GnuPG Public Key ID: 0x5553C338