samba - Dec 2009 - Users from trusted domains get "Your Password expires today" in 3.4.3

Hello everyone!

We've got a Samba domain that trusts another Samba domain and a Windows 
  Server 2008 domain. We recently upgraded both Samba DCs from 3.0.x to 
3.4.3

After that, whenever a user logs on a workstation in the trusting domain 
with an account from one of the trusted domains, he gets this message:

Your Password expires today. Do you want to change it?

Of course, the password isn't expiring, and no such message appears when 
  users login on a workstation, joined into their domain.

Since both trusted domains, that otherwise have nothing in common, are 
affected, I'm currently looking into the trusting domain. Here's the 
global section of smb.conf on the DC:

[global]
         workgroup = UCCD
         server string          interfaces = 127.0.0.1, 172.16.0.9
         passdb backend = ldapsam:"ldap://ldap2.ru.acad.bg/"
         username map = /etc/samba/smbusers
         lanman auth = Yes
         log level = 2
         syslog = 0
         log file = /var/log/samba/%m.log
         max log size = 500
         load printers = No
         printcap name = /dev/null
         disable spoolss = Yes
         add machine script = /usr/sbin/smbldap-useradd -w "%u"
         logon script = etc\welcome.vbs
         logon path = \\orac\%U\Profile
         logon drive = M:
         domain logons = Yes
         domain master = Yes
         wins server = 172.16.0.6, 172.16.0.10
         ldap admin dn = *****
         ldap group suffix = ou=groups
         ldap machine suffix = ou=machines
         ldap passwd sync = yes
         ldap suffix = dc=ru,dc=acad,dc=bg
         ldap user suffix = ou=people
         utmp = Yes
         idmap uid = 10000-25000
         idmap gid = 10000-25000
         hosts allow = *****
         oplocks = No
         level2 oplocks = No

Ideas anyone?

Regards,

Deyan

-- 
Deyan Stoykov, dstoykov at ru.acad.bg
University of Rousse, BG-7017

2009/12/30 Deyan Stoykov <dstoykov at ru.acad.bg>:
> Ideas anyone?
ldap acl? (hint: shadowlastchange)

Hi Deyan,

We have noticed this issue also.  I have opened a bug report regarding
this at:

https://bugzilla.samba.org/show_bug.cgi?id=7066

Regards,

Patrick

-- 
Dr Patrick Rynhart
Linux Systems Administrator / Team Leader
IT Support Group
School of Engineering and Advanced Technology
AgHort A Room 3.61
Turitea Campus
Massey University
NEW ZEALAND
Phone +64 6 356 9099 extn 2444