samba - May 2007 - Samba NT MD4 password check problem

Hi all!

Im having a problem on my network when users try to logon.
After trying to logon the follow error is generated on the log.user file.


smb_password_ok: NT MD4 password check failed


to correct this problem what I done was change the login password in
smbpasswd for that user to the same password used on the station. (smbpasswd
user )

But how to make any passwd change on the clients to automatic change the
password on smbpasswd  (Or some way that the netlogon share continues to
work even if the user change the machine logon) ?


cheers [ ]'s

We upgraded ours samba servers to 3.0.25
All of them run on Solaris 10 machines.
They are PDC or printservers of differents Domains.
We are using smbpasswd files (not LDAP or tdbsam).

Two servers (the oldest ones configurationwise)
are exhibiting the following problem.

Windows user are greated with:
 "Your password expires today. Do you want to change it now?"

/export/samba/bin/pdbedit -L -v inetadm
Unix username:        inetadm
NT username:
Account Flags:        [UX         ]
User SID:             S-1-5-21-....................-20246
Primary Group SID:    S-1-5-21-....................-513
Full Name:            Informationsn?t kurskonto
Home Directory:       \\port\inetadm
HomeDir Drive:        H:
Logon Script:         LOGON.BAT
Profile Path:         \\port\inetadm\NT\profile
Domain:               ISYEDU
Account desc:
Workstations:
Munged dial:
Logon time:           0
Logoff time:          Sun, 04 Dec 0468 16:30:07 MET
Kickoff time:         Sun, 04 Dec 0468 16:30:07 MET
Password last set:    Tue, 15 May 2007 10:14:46 MEST
Password can change:  Tue, 15 May 2007 10:14:46 MEST
Password must change: Sun, 04 Dec 0468 16:30:07 MET
Last bad password   : 0
Bad password count  : 0
Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF


A working server gives


/export/samba/bin/pdbedit -L -v inetadm
Unix username:        inetadm
NT username:
Account Flags:        [UX         ]
User SID:             S-1-5-21-...............................-20246
Primary Group SID:    S-1-5-21-...............................-513
Full Name:            Informationsn?t kurskonto
Home Directory:       \\port\inetadm
HomeDir Drive:        H:
Logon Script:         LOGON.BAT
Profile Path:         \\port\inetadm\NT\profile
Domain:               ISYEDU
Account desc:
Workstations:
Munged dial:
Logon time:           0
Logoff time:          Tue, 19 Jan 2038 04:14:07 MET
Kickoff time:         Tue, 19 Jan 2038 04:14:07 MET
Password last set:    Wed, 05 Nov 2003 13:43:24 MET
Password can change:  Wed, 05 Nov 2003 13:43:24 MET
Password must change: Tue, 19 Jan 2038 04:14:07 MET
Last bad password   : 0
Bad password count  : 0
Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

The Servers are identicals (situed at differents sites)
with the same smb.conf and smbpasswd file
but with differents tdb files

I don't know what to check next and where the "Password must
change" value
is stored

I will for the time being regress to a patched 3.0.24.



-- 
Jean-Jacques   Moulis                              Tel:  (013) 281684
ISY                                                Fax:  (013) 139282
Link?ping University                            E-mail: jj@isy.liu.se
581 83 Link?ping