samba - Oct 2006 - Samba3.023c host can't join 2003AD on Freebsd6.1 AMD64

Hi
??I installed Samba 3.0.23c on the freebsd 6.1 via ports, I have configure
krb5.conf and nsswitch.conf, when I execute ?kinit username@domain.com? system
response ?kinit: NOTICE: ticket renewable lifetime is 10 hours?
??But when I execute ?net ads join ?U administrator@DOMAIN.COM? system response 
??
??? ?[2006/10/20 09:21:41, 0] utils/net_ads.c:ads_startup(281)
   ? ads_connect: Response too big for UDP, retry with TCP?
   why I got this message? My host can?t join AD 2003.
   Who can help me ?
Best Regards,

Alan Zhou

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed. If
you have received this email in error please notify the system manager. This
message contains confidential information and is intended only for the
individual named. If you are not the named addressee you should not disseminate,
distribute or copy this e-mail.

On Fri, Oct 20, 2006 at 03:56:06PM +0800, Zhou,Alan
wrote:
> Hi
> ??????I installed Samba 3.0.23c on the freebsd 6.1 via ports, I have
configure krb5.conf and nsswitch.conf, when I execute ???kinit
username@domain.com??? system response ???kinit: NOTICE: ticket renewable
lifetime is 10 hours???
> ??????But when I execute ???net ads join ???U administrator@DOMAIN.COM???
system response
> ??????
> ??? ???[2006/10/20 09:21:41, 0] utils/net_ads.c:ads_startup(281)
>    ? ads_connect: Response too big for UDP, retry with TCP???
The kdc reply is too big to fit in one UDP packet. This happans if
the authorization data in that reply is too big. This may be the case,
if administrator belongs to a large number of groups (>32).

If that is the case, you could try to join with another userid, one
that belongs to a smaller number of groups.


- Mark