samba - Apr 2015 - New Samba4 AD - "Logon failure: user account restriction"

On 04/09/2015 11:31 AM, Rowland Penny wrote:
> On 09/04/15 16:19, John E.P. Hynes wrote:
>> Thanks Rowland, I'll check that out.
>>
>> The funny thing is though, this workstation is in a "test"
environment
>> because I'm testing a profile migration/domain join tool.
>>
>> Now, the *first* workstation I tested, I joined to the domain "by
hand".
>>   That one works for logons as expected.
>>
>> On 04/09/2015 11:07 AM, Rowland Penny wrote:
>>> On 09/04/15 15:52, John E.P. Hynes wrote:
>>> Hi List,
>>>
>>> I just set up a new Samba4 AD controller, created users, etc.  When
I
>>> join a test workstation from our old, currently active domain to
the
>>> new AD server (separate network) the join succeeds, and the user
can
>>> log in the first time to be prompted with the "change your
password"
>>> prompt.  Immediately after changing the password, the logon fails
with
>>> "Logon failure: user account restriction" and possible
reasons.
>>>
>>> I looked at the policy, by default it seems to be set to hours 24/7
>>> and computers to log in from "any".  Which is fine.
>>>
>>> Does anyone have a pointer for me?
>>>
>>> Thanks,
>>>
>>> -John
>>>
>>> You refer to checking a 'policy', would this be a windows
GPO ? If so,
>>> then I think that you need to know that you cannot set password
policies
>>> on a Samba 4 AD DC via a gpo, you need to use samba-tool, see
>>> 'samba-tool domain passwordsettings --help'
>>>
>>> Rowland
> 
> If your new users work, but the original users don't, it would seem
that
> there must be a difference between them, what I do not know. It should
> be easy to find out, make sure that ldb-tools is installed and try
> searching for a user that works, then one that doesn't and compare them
> i.e.
> 
> ldbsearch -H /var/lib/samba/private/sam.ldb
> '(&(objectclass=user)(samaccountname=rowland))'
> 
> This displays my AD record when run on my Debian wheezy AD DC
> 
> Rowland
> 
There are no old accounts, either user or computer.  The newly created
accounts can be logged into from "box1" but not "box2".

Comparing the machine accounts, they are identical.  Also, just for
giggles, I unjoined/rejoined the "not log-in-able" box manually, and
it
*still* didn't work.  Same error.

Nothing in the samba logs at all.  One box works fine, now two others
don't.  Using the accounts with smbclient on the server also works fine.

I'm really at a loss here.  All clients are windows 7, Samba version is
the latest that comes with Ubuntu 14.04.

It looks like it must be on the windows side, since Samba allows logins
from one of the clients, just not the rest.  What debug options should I
try on Samba to watch the credential verification process just to be
sure though?

Thanks,

-John

On 09/04/15 18:03, John E.P. Hynes wrote:
>
> On 04/09/2015 11:31 AM, Rowland Penny wrote:
>> On 09/04/15 16:19, John E.P. Hynes wrote:
>>> Thanks Rowland, I'll check that out.
>>>
>>> The funny thing is though, this workstation is in a
"test" environment
>>> because I'm testing a profile migration/domain join tool.
>>>
>>> Now, the *first* workstation I tested, I joined to the domain
"by hand".
>>>    That one works for logons as expected.
>>>
>>> On 04/09/2015 11:07 AM, Rowland Penny wrote:
>>>> On 09/04/15 15:52, John E.P. Hynes wrote:
>>>> Hi List,
>>>>
>>>> I just set up a new Samba4 AD controller, created users, etc. 
When I
>>>> join a test workstation from our old, currently active domain
to the
>>>> new AD server (separate network) the join succeeds, and the
user can
>>>> log in the first time to be prompted with the "change your
password"
>>>> prompt.  Immediately after changing the password, the logon
fails with
>>>> "Logon failure: user account restriction" and
possible reasons.
>>>>
>>>> I looked at the policy, by default it seems to be set to hours
24/7
>>>> and computers to log in from "any".  Which is fine.
>>>>
>>>> Does anyone have a pointer for me?
>>>>
>>>> Thanks,
>>>>
>>>> -John
>>>>
>>>> You refer to checking a 'policy', would this be a
windows GPO ? If so,
>>>> then I think that you need to know that you cannot set password
policies
>>>> on a Samba 4 AD DC via a gpo, you need to use samba-tool, see
>>>> 'samba-tool domain passwordsettings --help'
>>>>
>>>> Rowland
>> If your new users work, but the original users don't, it would seem
that
>> there must be a difference between them, what I do not know. It should
>> be easy to find out, make sure that ldb-tools is installed and try
>> searching for a user that works, then one that doesn't and compare
them
>> i.e.
>>
>> ldbsearch -H /var/lib/samba/private/sam.ldb
>> '(&(objectclass=user)(samaccountname=rowland))'
>>
>> This displays my AD record when run on my Debian wheezy AD DC
>>
>> Rowland
>>
> There are no old accounts, either user or computer.  The newly created
> accounts can be logged into from "box1" but not "box2".
>
> Comparing the machine accounts, they are identical.  Also, just for
> giggles, I unjoined/rejoined the "not log-in-able" box manually,
and it
> *still* didn't work.  Same error.
>
> Nothing in the samba logs at all.  One box works fine, now two others
> don't.  Using the accounts with smbclient on the server also works
fine.
>
> I'm really at a loss here.  All clients are windows 7, Samba version is
> the latest that comes with Ubuntu 14.04.
>
> It looks like it must be on the windows side, since Samba allows logins
> from one of the clients, just not the rest.  What debug options should I
> try on Samba to watch the credential verification process just to be
> sure though?
>
> Thanks,
>
> -John
Add 'log level = passdb:5 auth:5 winbind:5' to smb.conf and then restart
samba, this should give you plenty of output to look at, you can change 
the numbers to get more or less output i.e. anything between 0 to 10. 
See 'man smb.conf' for more info.

Rowland

On 04/09/2015 01:21 PM, Rowland Penny wrote:
> On 09/04/15 18:03, John E.P. Hynes wrote:
>>
>> On 04/09/2015 11:31 AM, Rowland Penny wrote:
>>> On 09/04/15 16:19, John E.P. Hynes wrote:
>>>> Thanks Rowland, I'll check that out.
>>>>
>>>> The funny thing is though, this workstation is in a
"test" environment
>>>> because I'm testing a profile migration/domain join tool.
>>>>
>>>> Now, the *first* workstation I tested, I joined to the domain
"by
>>>> hand".
>>>>    That one works for logons as expected.
>>>>
>>>> On 04/09/2015 11:07 AM, Rowland Penny wrote:
>>>>> On 09/04/15 15:52, John E.P. Hynes wrote:
>>>>> Hi List,
>>>>>
>>>>> I just set up a new Samba4 AD controller, created users,
etc.  When I
>>>>> join a test workstation from our old, currently active
domain to the
>>>>> new AD server (separate network) the join succeeds, and the
user can
>>>>> log in the first time to be prompted with the "change
your password"
>>>>> prompt.  Immediately after changing the password, the logon
fails with
>>>>> "Logon failure: user account restriction" and
possible reasons.
>>>>>
>>>>> I looked at the policy, by default it seems to be set to
hours 24/7
>>>>> and computers to log in from "any".  Which is
fine.
>>>>>
>>>>> Does anyone have a pointer for me?
>>>>>
>>>>> Thanks,
>>>>>
>>>>> -John
>>>>>
>>>>> You refer to checking a 'policy', would this be a
windows GPO ? If so,
>>>>> then I think that you need to know that you cannot set
password
>>>>> policies
>>>>> on a Samba 4 AD DC via a gpo, you need to use samba-tool,
see
>>>>> 'samba-tool domain passwordsettings --help'
>>>>>
>>>>> Rowland
>>> If your new users work, but the original users don't, it would
seem that
>>> there must be a difference between them, what I do not know. It
should
>>> be easy to find out, make sure that ldb-tools is installed and try
>>> searching for a user that works, then one that doesn't and
compare them
>>> i.e.
>>>
>>> ldbsearch -H /var/lib/samba/private/sam.ldb
>>> '(&(objectclass=user)(samaccountname=rowland))'
>>>
>>> This displays my AD record when run on my Debian wheezy AD DC
>>>
>>> Rowland
>>>
>> There are no old accounts, either user or computer.  The newly created
>> accounts can be logged into from "box1" but not
"box2".
>>
>> Comparing the machine accounts, they are identical.  Also, just for
>> giggles, I unjoined/rejoined the "not log-in-able" box
manually, and it
>> *still* didn't work.  Same error.
>>
>> Nothing in the samba logs at all.  One box works fine, now two others
>> don't.  Using the accounts with smbclient on the server also works
fine.
>>
>> I'm really at a loss here.  All clients are windows 7, Samba
version is
>> the latest that comes with Ubuntu 14.04.
>>
>> It looks like it must be on the windows side, since Samba allows logins
>> from one of the clients, just not the rest.  What debug options should
I
>> try on Samba to watch the credential verification process just to be
>> sure though?
>>
>> Thanks,
>>
>> -John
> 
> Add 'log level = passdb:5 auth:5 winbind:5' to smb.conf and then
restart
> samba, this should give you plenty of output to look at, you can change
> the numbers to get more or less output i.e. anything between 0 to 10.
> See 'man smb.conf' for more info.
> 
> Rowland
> 
OK, so after looking at a bunch of debug logs...

The machine account is locked, UseAccountControl flags are 0x4144 for
the machines that don't allow logon, and 0x1000 for those that do.

It doesn't seem you can manipulate these through Windows (errors out
that the server rejected the change) so I guess the next two questions are:

1) How do I edit these with samba-tool?
2) How the heck did they end up "wrong" like this right out of the
box?

Any ideas appreciated.

-John