samba - Dec 2010 - problem connecting DFS-share with winXP - successful with Vista & 7

Hi,

 i have problems connecting to DFS-Share from Client WindowsXP. Same 
 configuration works fine for Windows Vista and 7. On Windows 7 the 
 LMCompatibility Level is 3.

 the striking point I see in logfile is following

 2010/12/20 10:30:17,  1] smbd/service.c:make_connection_snum(1119)
   10.184.144.171 (10.184.144.171) signed connect to service applbin 
 initially as user useracc (uid=45110, gid=45110) (pid 20312)
 [2010/12/20 10:30:17,  3] smbd/sec_ctx.c:set_sec_ctx(324)
   setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
 [2010/12/20 10:30:17,  2] smbd/reply.c:reply_tcon_and_X(789)
   Serving applbin as a Dfs root
 [2010/12/20 10:30:17,  3] smbd/reply.c:reply_tcon_and_X(794)
   tconX service=APPLBIN
 [2010/12/20 10:30:17,  3] smbd/process.c:process_smb(1576)
   Transaction 3 of length 1404 (0 toread)
 [2010/12/20 10:30:17,  3] smbd/process.c:switch_message(1393)
   switch message SMBsesssetupX (pid 20312) conn 0x0
 [2010/12/20 10:30:17,  3] smbd/sec_ctx.c:set_sec_ctx(324)
   setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
 [2010/12/20 10:30:17,  3] smbd/sesssetup.c:reply_sesssetup_and_X(1412)
   wct=12 flg2=0xc807
 [2010/12/20 10:30:17,  3] 
 smbd/sesssetup.c:reply_sesssetup_and_X_spnego(1175)
   Doing spnego session setup
 [2010/12/20 10:30:17,  3] 
 smbd/sesssetup.c:reply_sesssetup_and_X_spnego(1210)
   NativeOS=[Windows 2002 Service Pack 3 2600] NativeLanMan=[Windows 
 2002 5.1] PrimaryDomain=[]
 [2010/12/20 10:30:17,  3] smbd/sesssetup.c:reply_spnego_negotiate(802)
   reply_spnego_negotiate: Got secblob of size 1172
 [2010/12/20 10:30:17,  3] libads/authdata.c:decode_pac_data(301)
   Found account name from PAC: CLIENTXP$ []
 [2010/12/20 10:30:17,  3] smbd/sesssetup.c:reply_spnego_kerberos(356)
   Ticket name is [CLIENTXP$@DOMAIN.LOCAL]
 [2010/12/20 10:30:17,  1] smbd/sesssetup.c:reply_spnego_kerberos(474)
   Username DOMAIN00\CLIENTXP$ is invalid on this system
 [2010/12/20 10:30:17,  3] smbd/error.c:error_packet_set(61)
   error packet at smbd/sesssetup.c(480) cmd=115 (SMBsesssetupX) 
 NT_STATUS_LOGON_FAILURE


 On Windows Vista the Same Section in logfile shows different 
 account-name:

   Doing spnego session setup
 [2010/12/20 09:12:29,  3] 
 smbd/sesssetup.c:reply_sesssetup_and_X_spnego(1210)
   NativeOS=[] NativeLanMan=[] PrimaryDomain=[]
 [2010/12/20 09:12:29,  3] smbd/sesssetup.c:reply_spnego_negotiate(802)
   reply_spnego_negotiate: Got secblob of size 6566
 [2010/12/20 09:12:29,  3] libads/authdata.c:decode_pac_data(301)
   Found account name from PAC: USERACC [Nachname, Vorname]
 [2010/12/20 09:12:29,  3] smbd/sesssetup.c:reply_spnego_kerberos(356)
   Ticket name is [USERACC at DOMAIN.LOCAL]


 The difference i see, is that on windows XP the system don't take the 
 username of connecting account, although it is grabbed in start of 
 session-log.

 [2010/12/20 10:30:17,  3] libads/authdata.c:decode_pac_data(301)
   Found account name from PAC: USERACC [Nachname, Vorname]
 [2010/12/20 10:30:17,  3] smbd/sesssetup.c:reply_spnego_kerberos(356)
   Ticket name is [EFROEM1 at DOMAIN.LOCAL]

 Has someone an idea, how i can fix this problem.
 This problem only occurs, if i connect via DFS Master. If i connect 
 directly to the Share, all is successful.



 [complete Logfile]: http://paste.ubuntu.com/545870/
 [config DFS-master]: http://paste.ubuntu.com/545874/
 [config client]: http://paste.ubuntu.com/545873/


 Regards,
 Steffen

Anyone?

I am seeing the same behavior - DFS shares visible in Vista and 7, but  
not XP - though I have not spotted the same detail at session setup.

No problem with XP until recently when we applied a domain wide group  
policy update and latest windows updates.  Can't go backwards on the  
policy.

samba-3.5.4
security = ads

Thanks.

djm



On Dec 20, 2010, at 4:19 AM, Steffen Fr?mer wrote:
>
> Hi,
>
> i have problems connecting to DFS-Share from Client WindowsXP. Same  
> configuration works fine for Windows Vista and 7. On Windows 7 the  
> LMCompatibility Level is 3.
>
> the striking point I see in logfile is following
>
> 2010/12/20 10:30:17,  1] smbd/service.c:make_connection_snum(1119)
>  10.184.144.171 (10.184.144.171) signed connect to service applbin  
> initially as user useracc (uid=45110, gid=45110) (pid 20312)
> [2010/12/20 10:30:17,  3] smbd/sec_ctx.c:set_sec_ctx(324)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
> [2010/12/20 10:30:17,  2] smbd/reply.c:reply_tcon_and_X(789)
>  Serving applbin as a Dfs root
> [2010/12/20 10:30:17,  3] smbd/reply.c:reply_tcon_and_X(794)
>  tconX service=APPLBIN
> [2010/12/20 10:30:17,  3] smbd/process.c:process_smb(1576)
>  Transaction 3 of length 1404 (0 toread)
> [2010/12/20 10:30:17,  3] smbd/process.c:switch_message(1393)
>  switch message SMBsesssetupX (pid 20312) conn 0x0
> [2010/12/20 10:30:17,  3] smbd/sec_ctx.c:set_sec_ctx(324)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
> [2010/12/20 10:30:17,  3] smbd/sesssetup.c:reply_sesssetup_and_X(1412)
>  wct=12 flg2=0xc807
> [2010/12/20 10:30:17,  3] smbd/ 
> sesssetup.c:reply_sesssetup_and_X_spnego(1175)
>  Doing spnego session setup
> [2010/12/20 10:30:17,  3] smbd/ 
> sesssetup.c:reply_sesssetup_and_X_spnego(1210)
>  NativeOS=[Windows 2002 Service Pack 3 2600] NativeLanMan=[Windows  
> 2002 5.1] PrimaryDomain=[]
> [2010/12/20 10:30:17,  3] smbd/sesssetup.c:reply_spnego_negotiate(802)
>  reply_spnego_negotiate: Got secblob of size 1172
> [2010/12/20 10:30:17,  3] libads/authdata.c:decode_pac_data(301)
>  Found account name from PAC: CLIENTXP$ []
> [2010/12/20 10:30:17,  3] smbd/sesssetup.c:reply_spnego_kerberos(356)
>  Ticket name is [CLIENTXP$@DOMAIN.LOCAL]
> [2010/12/20 10:30:17,  1] smbd/sesssetup.c:reply_spnego_kerberos(474)
>  Username DOMAIN00\CLIENTXP$ is invalid on this system
> [2010/12/20 10:30:17,  3] smbd/error.c:error_packet_set(61)
>  error packet at smbd/sesssetup.c(480) cmd=115 (SMBsesssetupX)  
> NT_STATUS_LOGON_FAILURE
>
>
> On Windows Vista the Same Section in logfile shows different account- 
> name:
>
>  Doing spnego session setup
> [2010/12/20 09:12:29,  3] smbd/ 
> sesssetup.c:reply_sesssetup_and_X_spnego(1210)
>  NativeOS=[] NativeLanMan=[] PrimaryDomain=[]
> [2010/12/20 09:12:29,  3] smbd/sesssetup.c:reply_spnego_negotiate(802)
>  reply_spnego_negotiate: Got secblob of size 6566
> [2010/12/20 09:12:29,  3] libads/authdata.c:decode_pac_data(301)
>  Found account name from PAC: USERACC [Nachname, Vorname]
> [2010/12/20 09:12:29,  3] smbd/sesssetup.c:reply_spnego_kerberos(356)
>  Ticket name is [USERACC at DOMAIN.LOCAL]
>
>
> The difference i see, is that on windows XP the system don't take  
> the username of connecting account, although it is grabbed in start  
> of session-log.
>
> [2010/12/20 10:30:17,  3] libads/authdata.c:decode_pac_data(301)
>  Found account name from PAC: USERACC [Nachname, Vorname]
> [2010/12/20 10:30:17,  3] smbd/sesssetup.c:reply_spnego_kerberos(356)
>  Ticket name is [EFROEM1 at DOMAIN.LOCAL]
>
> Has someone an idea, how i can fix this problem.
> This problem only occurs, if i connect via DFS Master. If i connect  
> directly to the Share, all is successful.
>
>
>
> [complete Logfile]: http://paste.ubuntu.com/545870/
> [config DFS-master]: http://paste.ubuntu.com/545874/
> [config client]: http://paste.ubuntu.com/545873/
>
>
> Regards,
> Steffen
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba

hej David,

can you connect shares directly with XP?

Am 04.01.2011 18:50, schrieb David Merhar:
> Anyone?
>
> I am seeing the same behavior - DFS shares visible in Vista and 7, but
> not XP - though I have not spotted the same detail at session setup.
>
> No problem with XP until recently when we applied a domain wide group
> policy update and latest windows updates. Can't go backwards on the
policy.
What policy update did you do?
>
> samba-3.5.4
> security = ads
our DFS security is domain and Samba Server has
security = ads

But there is noch differnce bitween ads and domain in relation with our 
problem. We also tried 'security' = ads for DFS master, but same issue.
>
> Thanks.
>
> djm
>
>
>

hej David,

can you connect shares directly with XP?

Am 04.01.2011 18:50, schrieb David Merhar:
> Anyone?
>
> I am seeing the same behavior - DFS shares visible in Vista and 7, but
> not XP - though I have not spotted the same detail at session setup.
>
> No problem with XP until recently when we applied a domain wide group
> policy update and latest windows updates. Can't go backwards on the
policy.
What policy update did you do?
>
> samba-3.5.4
> security = ads
our DFS security is domain and Samba Server has
security = ads

But there is noch differnce bitween ads and domain in relation with our 
problem. We also tried 'security' = ads for DFS master, but same issue.
>
> Thanks.
>
> djm
>
>
>

On Mon, Dec 20, 2010 at 11:19:52AM +0100, Steffen Fr?mer
wrote:
> 
> Hi,
> 
> i have problems connecting to DFS-Share from Client WindowsXP. Same
> configuration works fine for Windows Vista and 7. On Windows 7 the
> LMCompatibility Level is 3.
I missed this in my previous search of the archives.  Seems I have the
same problem.  Did you ever find a resolution to this?

-- 
Bruce

Hierophant: someone who remembers, when you are on the way down,
everything you did to them on the way up.