William Ross
2014-Nov-10 14:48 UTC
[Samba] User's DPAPI/backupkey protected data lost when changing domain password
After a user changes their password (CTRL-ALT-DEL) in our Samba 4 domain
(4.1.12) they lose access to any stored passwords on their Windows PC.
I've set the log level in smb.conf to 4 and enabled the GPO to record DPAPI
log entries in Windows to get the below log data.
My reading of the two is that the Windows PC believes it is failing to reset
the access to its DPAPI store (where the saved passwords are kept) - hence
the repitition in the samba log and the Windows event log as the client
tries over-and-over again. I don't see any specific error in the samba log
though.
Any advice on getting this backupkey/DPAPI functionality to work very much
appreciated.
In the below the domain controller is
soda.mbsw.prv.mercedes-benzsouthwest.co.uk and the client is ex-wrk-11, the
user whose password is being changed is wtr30.
Audit failure log entries in Windows Event Viewer (from Windows 7 Pro PC),
there are nine entries total but the other seven appear to be duplicates of
the two below:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 10/11/2014 13:56:43
Event ID: 4692
Task Category: DPAPI Activity
Level: Information
Keywords: Audit Failure
User: N/A
Computer: ex-lap-11.mbsw.prv.mercedes-benzsouthwest.co.uk
Description:
Backup of data protection master key was attempted.
Subject:
Security ID: MBSW\wtr30
Account Name: wtr30
Account Domain: MBSW
Logon ID: 0x28b53
Key Information:
Key Identifier: 1668a88c-71a7-4a52-a842-dcb709965555
Recovery Server: \\soda.mbsw.prv.mercedes-benzsouthwest.co.uk
Recovery Key ID:
Status Information:
Status Code: 0x57
Event Xml:
<Event
xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing"
Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4692</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13314</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2014-11-10T13:56:43.416299900Z" />
<EventRecordID>1607</EventRecordID>
<Correlation />
<Execution ProcessID="580" ThreadID="2792" />
<Channel>Security</Channel>
<Computer>ex-lap-11.mbsw.prv.mercedes-benzsouthwest.co.uk</Computer>
<Security />
</System>
<EventData>
<Data
Name="SubjectUserSid">S-1-5-21-447411674-2312009110-1666944656-1158</Data>
<Data Name="SubjectUserName">wtr30</Data>
<Data Name="SubjectDomainName">MBSW</Data>
<Data Name="SubjectLogonId">0x28b53</Data>
<Data
Name="MasterKeyId">1668a88c-71a7-4a52-a842-dcb709965555</Data>
<Data
Name="RecoveryServer">\\soda.mbsw.prv.mercedes-benzsouthwest.co.uk</Data>
<Data Name="RecoveryKeyId">
</Data>
<Data Name="FailureReason">0x57</Data>
</EventData>
</Event>
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 10/11/2014 13:56:43
Event ID: 4692
Task Category: DPAPI Activity
Level: Information
Keywords: Audit Failure
User: N/A
Computer: ex-lap-11.mbsw.prv.mercedes-benzsouthwest.co.uk
Description:
Backup of data protection master key was attempted.
Subject:
Security ID: MBSW\wtr30
Account Name: wtr30
Account Domain: MBSW
Logon ID: 0x3f212
Key Information:
Key Identifier: 1668a88c-71a7-4a52-a842-dcb709965555
Recovery Server:
Recovery Key ID:
Status Information:
Status Code: 0x7a
Event Xml:
<Event
xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing"
Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4692</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13314</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2014-11-10T13:56:43.494300000Z" />
<EventRecordID>1608</EventRecordID>
<Correlation />
<Execution ProcessID="580" ThreadID="632" />
<Channel>Security</Channel>
<Computer>ex-lap-11.mbsw.prv.mercedes-benzsouthwest.co.uk</Computer>
<Security />
</System>
<EventData>
<Data
Name="SubjectUserSid">S-1-5-21-447411674-2312009110-1666944656-1158</Data>
<Data Name="SubjectUserName">wtr30</Data>
<Data Name="SubjectDomainName">MBSW</Data>
<Data Name="SubjectLogonId">0x3f212</Data>
<Data
Name="MasterKeyId">1668a88c-71a7-4a52-a842-dcb709965555</Data>
<Data Name="RecoveryServer">
</Data>
<Data Name="RecoveryKeyId">
</Data>
<Data Name="FailureReason">0x7a</Data>
</EventData>
</Event>
Corresponding entries in /usr/local/samba/var/log.samba:
[2014/11/10 13:56:43.735766, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: AS-REQ wtr30 at MBSW from ipv4:53.253.137.105:62425 for
kadmin/changepw at MBSW
[2014/11/10 13:56:43.739991, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Client sent patypes: 128
[2014/11/10 13:56:43.740055, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for PKINIT pa-data -- wtr30 at MBSW
[2014/11/10 13:56:43.740103, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for ENC-TS pa-data -- wtr30 at MBSW
[2014/11/10 13:56:43.740166, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: No preauth found, returning PREAUTH-REQUIRED -- wtr30 at MBSW
[2014/11/10 13:56:43.740736, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:43.740838, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:43.741188, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: AS-REQ wtr30 at MBSW from ipv4:53.253.137.105:62426 for
kadmin/changepw at MBSW
[2014/11/10 13:56:43.744834, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Client sent patypes: encrypted-timestamp, 128
[2014/11/10 13:56:43.744899, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for PKINIT pa-data -- wtr30 at MBSW
[2014/11/10 13:56:43.744947, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for ENC-TS pa-data -- wtr30 at MBSW
[2014/11/10 13:56:43.745043, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: ENC-TS Pre-authentication succeeded -- wtr30 at MBSW using
arcfour-hmac-md5
[2014/11/10 13:56:43.745114, 4]
../source4/auth/sam.c:170(authsam_account_ok)
authsam_account_ok: Checking SMB password for user wtr30 at MBSW
[2014/11/10 13:56:43.747137, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: AS-REQ authtime: 2014-11-10T13:56:43 starttime: unset endtime:
2014-11-10T23:56:43 renew till: 2014-11-17T13:56:43
[2014/11/10 13:56:43.747249, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96,
aes128-cts-hmac-sha1-96, arcfour-hmac-md5, 24, -135, des-cbc-md5, using
arcfour-hmac-md5/arcfour-hmac-md5
[2014/11/10 13:56:43.747308, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Requested flags: renewable-ok, renewable, forwardable
[2014/11/10 13:56:43.748107, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:43.748178, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:43.751877, 3]
../auth/kerberos/kerberos_pac.c:386(kerberos_decode_pac)
Found account name from PAC: wtr30 [William Ross]
[2014/11/10 13:56:43.758686, 3]
../source4/kdc/kpasswdd.c:206(kpasswdd_change_password)
Changing password of MBSW\wtr30
(S-1-5-21-447411674-2312009110-1666944656-1158)
[2014/11/10 13:56:43.858238, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:43.858337, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:43.869756, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: AS-REQ wtr30 at MBSW.PRV.MERCEDES-BENZSOUTHWEST.CO.UK from
ipv4:53.253.137.105:62428 for
krbtgt/MBSW.PRV.MERCEDES-BENZSOUTHWEST.CO.UK at MBSW.PRV.MERCEDES-BENZSOUTHWEST
.CO.UK
[2014/11/10 13:56:43.871740, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Client sent patypes: encrypted-timestamp, 128
[2014/11/10 13:56:43.871804, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for PKINIT pa-data --
wtr30 at MBSW.PRV.MERCEDES-BENZSOUTHWEST.CO.UK
[2014/11/10 13:56:43.871853, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for ENC-TS pa-data --
wtr30 at MBSW.PRV.MERCEDES-BENZSOUTHWEST.CO.UK
[2014/11/10 13:56:43.871931, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: ENC-TS Pre-authentication succeeded --
wtr30 at MBSW.PRV.MERCEDES-BENZSOUTHWEST.CO.UK using arcfour-hmac-md5
[2014/11/10 13:56:43.871982, 4]
../source4/auth/sam.c:170(authsam_account_ok)
authsam_account_ok: Checking SMB password for user
wtr30 at MBSW.PRV.MERCEDES-BENZSOUTHWEST.CO.UK
[2014/11/10 13:56:43.874114, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: AS-REQ authtime: 2014-11-10T13:56:43 starttime: unset endtime:
2014-11-10T23:56:43 renew till: 2014-11-17T13:56:43
[2014/11/10 13:56:43.874218, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96,
aes128-cts-hmac-sha1-96, arcfour-hmac-md5, 24, -135, des-cbc-md5, using
arcfour-hmac-md5/arcfour-hmac-md5
[2014/11/10 13:56:43.874277, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Requested flags: renewable-ok, canonicalize, renewable,
forwardable
[2014/11/10 13:56:43.874957, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:43.875040, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:43.881593, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: TGS-REQ wtr30 at MBSW.PRV.MERCEDES-BENZSOUTHWEST.CO.UK from
ipv4:53.253.137.105:62429 for wtr30 at MBSW.PRV.MERCEDES-BENZSOUTHWEST.CO.UK
[enc-tkt-in-skey, canonicalize, renewable, forwardable]
[2014/11/10 13:56:43.883859, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Principal may not act as server --
wtr30 at MBSW.PRV.MERCEDES-BENZSOUTHWEST.CO.UK
[2014/11/10 13:56:43.883954, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Failed building TGS-REP to ipv4:53.253.137.105:62429
[2014/11/10 13:56:43.884544, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:43.884611, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:43.898985, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: AS-REQ wtr30 at MBSW from ipv4:53.253.137.105:62430 for
krbtgt/MBSW at MBSW
[2014/11/10 13:56:43.901569, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Client sent patypes: 128
[2014/11/10 13:56:43.901634, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for PKINIT pa-data -- wtr30 at MBSW
[2014/11/10 13:56:43.901683, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for ENC-TS pa-data -- wtr30 at MBSW
[2014/11/10 13:56:43.901740, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: No preauth found, returning PREAUTH-REQUIRED -- wtr30 at MBSW
[2014/11/10 13:56:43.902084, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:43.902178, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:43.902682, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: AS-REQ wtr30 at MBSW from ipv4:53.253.137.105:62431 for
krbtgt/MBSW at MBSW
[2014/11/10 13:56:43.905275, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Client sent patypes: encrypted-timestamp, 128
[2014/11/10 13:56:43.905340, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for PKINIT pa-data -- wtr30 at MBSW
[2014/11/10 13:56:43.905388, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Looking for ENC-TS pa-data -- wtr30 at MBSW
[2014/11/10 13:56:43.905606, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: ENC-TS Pre-authentication succeeded -- wtr30 at MBSW using
arcfour-hmac-md5
[2014/11/10 13:56:43.905663, 4]
../source4/auth/sam.c:170(authsam_account_ok)
authsam_account_ok: Checking SMB password for user wtr30 at MBSW
[2014/11/10 13:56:43.907687, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: AS-REQ authtime: 2014-11-10T13:56:43 starttime: unset endtime:
2014-11-10T23:56:43 renew till: 2014-11-17T13:56:43
[2014/11/10 13:56:43.907790, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96,
aes128-cts-hmac-sha1-96, arcfour-hmac-md5, 24, -135, des-cbc-md5, using
arcfour-hmac-md5/arcfour-hmac-md5
[2014/11/10 13:56:43.907847, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: Requested flags: renewable-ok, canonicalize, renewable,
forwardable
[2014/11/10 13:56:43.908370, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:43.908434, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:43.909184, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: TGS-REQ wtr30 at MBSW.PRV.MERCEDES-BENZSOUTHWEST.CO.UK from
ipv4:53.253.137.105:62432 for
host/ex-lap-11.mbsw.prv.mercedes-benzsouthwest.co.uk at MBSW.PRV.MERCEDES-BENZS
OUTHWEST.CO.UK [canonicalize, renewable, forwardable]
[2014/11/10 13:56:43.912187, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: TGS-REQ authtime: 2014-11-10T13:56:43 starttime:
2014-11-10T13:56:43 endtime: 2014-11-10T23:56:43 renew till:
2014-11-17T13:56:43
[2014/11/10 13:56:43.912745, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:43.912812, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:44.028220, 3]
../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
ldb_wrap open of secrets.ldb
[2014/11/10 13:56:44.034589, 3]
../source4/rpc_server/dcerpc_server.c:963(dcesrv_request)
Warning: 60 extra bytes in incoming RPC request
[2014/11/10 13:56:44.034653, 4]
../source4/rpc_server/backupkey/dcesrv_backupkey.c:1263(dcesrv_bkrp_BackupKe
y)
[2014/11/10 13:56:44.034690, 4]
../source4/rpc_server/backupkey/dcesrv_backupkey.c:1299(dcesrv_bkrp_BackupKe
y)
Client unknown requested certificate for client wrapped secret
[2014/11/10 13:56:44.036202, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'dcesrv: NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:44.036309, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[dcesrv: NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:44.068981, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: TGS-REQ wtr30 at MBSW.PRV.MERCEDES-BENZSOUTHWEST.CO.UK from
ipv4:53.253.137.105:62434 for
cifs/soda.mbsw.prv.mercedes-benzsouthwest.co.uk at MBSW.PRV.MERCEDES-BENZSOUTHW
EST.CO.UK [canonicalize, renewable, forwardable]
[2014/11/10 13:56:44.072197, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: TGS-REQ authtime: 2014-11-10T13:56:43 starttime:
2014-11-10T13:56:44 endtime: 2014-11-10T23:56:43 renew till:
2014-11-17T13:56:43
[2014/11/10 13:56:44.072883, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:44.072980, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:44.073786, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: TGS-REQ wtr30 at MBSW.PRV.MERCEDES-BENZSOUTHWEST.CO.UK from
ipv4:53.253.137.105:62435 for
krbtgt/MBSW.PRV.MERCEDES-BENZSOUTHWEST.CO.UK at MBSW.PRV.MERCEDES-BENZSOUTHWEST
.CO.UK [renewable-ok, canonicalize, renewable, forwarded, forwardable]
[2014/11/10 13:56:44.075901, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: TGS-REQ authtime: 2014-11-10T13:56:43 starttime:
2014-11-10T13:56:44 endtime: 2014-11-10T23:56:43 renew till:
2014-11-17T13:56:43
[2014/11/10 13:56:44.076429, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:44.076665, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:44.081808, 3]
../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
ldb_wrap open of secrets.ldb
[2014/11/10 13:56:44.092557, 3]
../source4/rpc_server/dcerpc_server.c:963(dcesrv_request)
Warning: 60 extra bytes in incoming RPC request
[2014/11/10 13:56:44.092625, 4]
../source4/rpc_server/backupkey/dcesrv_backupkey.c:1263(dcesrv_bkrp_BackupKe
y)
[2014/11/10 13:56:44.097480, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'wbsrv: wbsrv_call_loop:
tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:44.097559, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[wbsrv: wbsrv_call_loop:
tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:44.102593, 4]
../source4/lib/socket/interface.c:121(add_interface)
added interface lo ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
[2014/11/10 13:56:44.103742, 4]
../source4/lib/socket/interface.c:121(add_interface)
added interface eth0 ip=53.253.137.16 bcast=53.253.137.255
netmask=255.255.255.0
[2014/11/10 13:56:44.113156, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: TGS-REQ wtr30 at MBSW.PRV.MERCEDES-BENZSOUTHWEST.CO.UK from
ipv4:53.253.137.105:62436 for
ProtectedStorage/soda.mbsw.prv.mercedes-benzsouthwest.co.uk at MBSW.PRV.MERCEDE
S-BENZSOUTHWEST.CO.UK [canonicalize, renewable, forwardable]
[2014/11/10 13:56:44.116345, 3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
Kerberos: TGS-REQ authtime: 2014-11-10T13:56:43 starttime:
2014-11-10T13:56:44 endtime: 2014-11-10T23:56:43 renew till:
2014-11-17T13:56:43
[2014/11/10 13:56:44.117107, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:44.117176, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() -
NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:44.117750, 3]
../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
ldb_wrap open of secrets.ldb
[2014/11/10 13:56:44.124196, 3]
../source4/rpc_server/dcerpc_server.c:963(dcesrv_request)
Warning: 16 extra bytes in incoming RPC request
[2014/11/10 13:56:44.124260, 4]
../source4/rpc_server/backupkey/dcesrv_backupkey.c:1263(dcesrv_bkrp_BackupKe
y)
[2014/11/10 13:56:44.124296, 4]
../source4/rpc_server/backupkey/dcesrv_backupkey.c:1299(dcesrv_bkrp_BackupKe
y)
Client unknown requested certificate for client wrapped secret
[2014/11/10 13:56:44.125894, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'dcesrv: NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:44.126015, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[dcesrv: NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:44.126328, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'dcesrv: NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:44.126424, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[dcesrv: NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:44.171604, 3]
../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
ldb_wrap open of secrets.ldb
[2014/11/10 13:56:44.177638, 3]
../source4/rpc_server/dcerpc_server.c:963(dcesrv_request)
Warning: 60 extra bytes in incoming RPC request
[2014/11/10 13:56:44.177700, 4]
../source4/rpc_server/backupkey/dcesrv_backupkey.c:1263(dcesrv_bkrp_BackupKe
y)
[2014/11/10 13:56:44.178375, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'dcesrv: NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:44.178601, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[dcesrv: NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:44.183743, 4]
../source4/lib/socket/interface.c:121(add_interface)
added interface lo ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
[2014/11/10 13:56:44.183817, 4]
../source4/lib/socket/interface.c:121(add_interface)
added interface eth0 ip=53.253.137.16 bcast=53.253.137.255
netmask=255.255.255.0
[2014/11/10 13:56:44.206407, 3]
../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
ldb_wrap open of secrets.ldb
[2014/11/10 13:56:44.212393, 3]
../source4/rpc_server/dcerpc_server.c:963(dcesrv_request)
Warning: 60 extra bytes in incoming RPC request
[2014/11/10 13:56:44.212519, 4]
../source4/rpc_server/backupkey/dcesrv_backupkey.c:1263(dcesrv_bkrp_BackupKe
y)
[2014/11/10 13:56:44.213259, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'dcesrv: NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:44.213365, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[dcesrv: NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:44.284671, 3]
../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
ldb_wrap open of secrets.ldb
[2014/11/10 13:56:44.290683, 3]
../source4/rpc_server/dcerpc_server.c:963(dcesrv_request)
Warning: 60 extra bytes in incoming RPC request
[2014/11/10 13:56:44.290744, 4]
../source4/rpc_server/backupkey/dcesrv_backupkey.c:1263(dcesrv_bkrp_BackupKe
y)
[2014/11/10 13:56:44.291554, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'dcesrv: NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:44.291658, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[dcesrv: NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:44.399861, 3]
../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
ldb_wrap open of secrets.ldb
[2014/11/10 13:56:44.405971, 3]
../source4/rpc_server/dcerpc_server.c:963(dcesrv_request)
Warning: 60 extra bytes in incoming RPC request
[2014/11/10 13:56:44.406033, 4]
../source4/rpc_server/backupkey/dcesrv_backupkey.c:1263(dcesrv_bkrp_BackupKe
y)
[2014/11/10 13:56:44.406068, 4]
../source4/rpc_server/backupkey/dcesrv_backupkey.c:1299(dcesrv_bkrp_BackupKe
y)
Client unknown requested certificate for client wrapped secret
[2014/11/10 13:56:44.407646, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'dcesrv: NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:44.407750, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[dcesrv: NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:44.449983, 3]
../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
ldb_wrap open of secrets.ldb
[2014/11/10 13:56:44.456089, 3]
../source4/rpc_server/dcerpc_server.c:963(dcesrv_request)
Warning: 60 extra bytes in incoming RPC request
[2014/11/10 13:56:44.456151, 4]
../source4/rpc_server/backupkey/dcesrv_backupkey.c:1263(dcesrv_bkrp_BackupKe
y)
[2014/11/10 13:56:44.456814, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'dcesrv: NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:44.456919, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[dcesrv: NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:44.462414, 4]
../source4/lib/socket/interface.c:121(add_interface)
added interface lo ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
[2014/11/10 13:56:44.462505, 4]
../source4/lib/socket/interface.c:121(add_interface)
added interface eth0 ip=53.253.137.16 bcast=53.253.137.255
netmask=255.255.255.0
[2014/11/10 13:56:44.565691, 3]
../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
ldb_wrap open of secrets.ldb
[2014/11/10 13:56:44.572159, 3]
../source4/rpc_server/dcerpc_server.c:963(dcesrv_request)
Warning: 60 extra bytes in incoming RPC request
[2014/11/10 13:56:44.572221, 4]
../source4/rpc_server/backupkey/dcesrv_backupkey.c:1263(dcesrv_bkrp_BackupKe
y)
[2014/11/10 13:56:44.573195, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'dcesrv: NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:44.573300, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[dcesrv: NT_STATUS_CONNECTION_DISCONNECTED]
[2014/11/10 13:56:45.333280, 3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
Terminating connection - 'wbsrv: wbsrv_call_loop:
tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2014/11/10 13:56:45.333339, 3]
../source4/smbd/process_single.c:114(single_terminate)
single_terminate: reason[wbsrv: wbsrv_call_loop:
tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED]
Maybe Matching Threads
Wisdom of the Ancients
