samba - Apr 2015 - New Samba4 AD - "Logon failure: user account restriction"

On 04/09/2015 01:21 PM, Rowland Penny wrote:
> On 09/04/15 18:03, John E.P. Hynes wrote:
>>
>> On 04/09/2015 11:31 AM, Rowland Penny wrote:
>>> On 09/04/15 16:19, John E.P. Hynes wrote:
>>>> Thanks Rowland, I'll check that out.
>>>>
>>>> The funny thing is though, this workstation is in a
"test" environment
>>>> because I'm testing a profile migration/domain join tool.
>>>>
>>>> Now, the *first* workstation I tested, I joined to the domain
"by
>>>> hand".
>>>>    That one works for logons as expected.
>>>>
>>>> On 04/09/2015 11:07 AM, Rowland Penny wrote:
>>>>> On 09/04/15 15:52, John E.P. Hynes wrote:
>>>>> Hi List,
>>>>>
>>>>> I just set up a new Samba4 AD controller, created users,
etc.  When I
>>>>> join a test workstation from our old, currently active
domain to the
>>>>> new AD server (separate network) the join succeeds, and the
user can
>>>>> log in the first time to be prompted with the "change
your password"
>>>>> prompt.  Immediately after changing the password, the logon
fails with
>>>>> "Logon failure: user account restriction" and
possible reasons.
>>>>>
>>>>> I looked at the policy, by default it seems to be set to
hours 24/7
>>>>> and computers to log in from "any".  Which is
fine.
>>>>>
>>>>> Does anyone have a pointer for me?
>>>>>
>>>>> Thanks,
>>>>>
>>>>> -John
>>>>>
>>>>> You refer to checking a 'policy', would this be a
windows GPO ? If so,
>>>>> then I think that you need to know that you cannot set
password
>>>>> policies
>>>>> on a Samba 4 AD DC via a gpo, you need to use samba-tool,
see
>>>>> 'samba-tool domain passwordsettings --help'
>>>>>
>>>>> Rowland
>>> If your new users work, but the original users don't, it would
seem that
>>> there must be a difference between them, what I do not know. It
should
>>> be easy to find out, make sure that ldb-tools is installed and try
>>> searching for a user that works, then one that doesn't and
compare them
>>> i.e.
>>>
>>> ldbsearch -H /var/lib/samba/private/sam.ldb
>>> '(&(objectclass=user)(samaccountname=rowland))'
>>>
>>> This displays my AD record when run on my Debian wheezy AD DC
>>>
>>> Rowland
>>>
>> There are no old accounts, either user or computer.  The newly created
>> accounts can be logged into from "box1" but not
"box2".
>>
>> Comparing the machine accounts, they are identical.  Also, just for
>> giggles, I unjoined/rejoined the "not log-in-able" box
manually, and it
>> *still* didn't work.  Same error.
>>
>> Nothing in the samba logs at all.  One box works fine, now two others
>> don't.  Using the accounts with smbclient on the server also works
fine.
>>
>> I'm really at a loss here.  All clients are windows 7, Samba
version is
>> the latest that comes with Ubuntu 14.04.
>>
>> It looks like it must be on the windows side, since Samba allows logins
>> from one of the clients, just not the rest.  What debug options should
I
>> try on Samba to watch the credential verification process just to be
>> sure though?
>>
>> Thanks,
>>
>> -John
> 
> Add 'log level = passdb:5 auth:5 winbind:5' to smb.conf and then
restart
> samba, this should give you plenty of output to look at, you can change
> the numbers to get more or less output i.e. anything between 0 to 10.
> See 'man smb.conf' for more info.
> 
> Rowland
> 
OK, so after looking at a bunch of debug logs...

The machine account is locked, UseAccountControl flags are 0x4144 for
the machines that don't allow logon, and 0x1000 for those that do.

It doesn't seem you can manipulate these through Windows (errors out
that the server rejected the change) so I guess the next two questions are:

1) How do I edit these with samba-tool?
2) How the heck did they end up "wrong" like this right out of the
box?

Any ideas appreciated.

-John

On 09/04/15 19:18, John E.P. Hynes wrote:
> On 04/09/2015 01:21 PM, Rowland Penny wrote:
>> On 09/04/15 18:03, John E.P. Hynes wrote:
>>> On 04/09/2015 11:31 AM, Rowland Penny wrote:
>>>> On 09/04/15 16:19, John E.P. Hynes wrote:
>>>>> Thanks Rowland, I'll check that out.
>>>>>
>>>>> The funny thing is though, this workstation is in a
"test" environment
>>>>> because I'm testing a profile migration/domain join
tool.
>>>>>
>>>>> Now, the *first* workstation I tested, I joined to the
domain "by
>>>>> hand".
>>>>>     That one works for logons as expected.
>>>>>
>>>>> On 04/09/2015 11:07 AM, Rowland Penny wrote:
>>>>>> On 09/04/15 15:52, John E.P. Hynes wrote:
>>>>>> Hi List,
>>>>>>
>>>>>> I just set up a new Samba4 AD controller, created
users, etc.  When I
>>>>>> join a test workstation from our old, currently active
domain to the
>>>>>> new AD server (separate network) the join succeeds, and
the user can
>>>>>> log in the first time to be prompted with the
"change your password"
>>>>>> prompt.  Immediately after changing the password, the
logon fails with
>>>>>> "Logon failure: user account restriction" and
possible reasons.
>>>>>>
>>>>>> I looked at the policy, by default it seems to be set
to hours 24/7
>>>>>> and computers to log in from "any".  Which is
fine.
>>>>>>
>>>>>> Does anyone have a pointer for me?
>>>>>>
>>>>>> Thanks,
>>>>>>
>>>>>> -John
>>>>>>
>>>>>> You refer to checking a 'policy', would this be
a windows GPO ? If so,
>>>>>> then I think that you need to know that you cannot set
password
>>>>>> policies
>>>>>> on a Samba 4 AD DC via a gpo, you need to use
samba-tool, see
>>>>>> 'samba-tool domain passwordsettings --help'
>>>>>>
>>>>>> Rowland
>>>> If your new users work, but the original users don't, it
would seem that
>>>> there must be a difference between them, what I do not know. It
should
>>>> be easy to find out, make sure that ldb-tools is installed and
try
>>>> searching for a user that works, then one that doesn't and
compare them
>>>> i.e.
>>>>
>>>> ldbsearch -H /var/lib/samba/private/sam.ldb
>>>> '(&(objectclass=user)(samaccountname=rowland))'
>>>>
>>>> This displays my AD record when run on my Debian wheezy AD DC
>>>>
>>>> Rowland
>>>>
>>> There are no old accounts, either user or computer.  The newly
created
>>> accounts can be logged into from "box1" but not
"box2".
>>>
>>> Comparing the machine accounts, they are identical.  Also, just for
>>> giggles, I unjoined/rejoined the "not log-in-able" box
manually, and it
>>> *still* didn't work.  Same error.
>>>
>>> Nothing in the samba logs at all.  One box works fine, now two
others
>>> don't.  Using the accounts with smbclient on the server also
works fine.
>>>
>>> I'm really at a loss here.  All clients are windows 7, Samba
version is
>>> the latest that comes with Ubuntu 14.04.
>>>
>>> It looks like it must be on the windows side, since Samba allows
logins
>>> from one of the clients, just not the rest.  What debug options
should I
>>> try on Samba to watch the credential verification process just to
be
>>> sure though?
>>>
>>> Thanks,
>>>
>>> -John
>> Add 'log level = passdb:5 auth:5 winbind:5' to smb.conf and
then restart
>> samba, this should give you plenty of output to look at, you can change
>> the numbers to get more or less output i.e. anything between 0 to 10.
>> See 'man smb.conf' for more info.
>>
>> Rowland
>>
> OK, so after looking at a bunch of debug logs...
>
> The machine account is locked, UseAccountControl flags are 0x4144 for
> the machines that don't allow logon, and 0x1000 for those that do.
>
> It doesn't seem you can manipulate these through Windows (errors out
> that the server rejected the change) so I guess the next two questions are:
>
> 1) How do I edit these with samba-tool?
> 2) How the heck did they end up "wrong" like this right out of
the box?
>
> Any ideas appreciated.
>
> -John
OK, my computer accounts all have this:

userAccountControl: 69632

Which is made up from:

65536 DONT_EXPIRE_PASSWORD
04096 WORKSTATION_TRUST_ACCOUNT

So you could try using ldbmodify on the samba DC to change this.

Create an ldif file, /tmp/computer

dn: CN=computername,CN=Computers,CN=Users,DC=example,DC=com
changetype: modify
replace: UserAccountControl
UserAccountControl: 69632

Don't forget to alter the top line to your settings.

Now use this ldif and ldbmodify to change the attribute:

ldbmodify -H /var/lib/samba/private/sam.ldb /tmp/computer

Again if sam.ldb isn't in /var/lib/samba/private , then change the path, 
also note that this needs to be done as root.

Rowland

Ok,

I just set the flags to 0x11000 and the problem workstations can now be logged
in to.

Thanks Rowland!

I wonder how they got messed up in the first place though...
> On Apr 9, 2015, at 2:42 PM, Rowland Penny <rowlandpenny at
googlemail.com> wrote:
> 
>> On 09/04/15 19:18, John E.P. Hynes wrote:
>>> On 04/09/2015 01:21 PM, Rowland Penny wrote:
>>>> On 09/04/15 18:03, John E.P. Hynes wrote:
>>>>> On 04/09/2015 11:31 AM, Rowland Penny wrote:
>>>>>> On 09/04/15 16:19, John E.P. Hynes wrote:
>>>>>> Thanks Rowland, I'll check that out.
>>>>>> 
>>>>>> The funny thing is though, this workstation is in a
"test" environment
>>>>>> because I'm testing a profile migration/domain join
tool.
>>>>>> 
>>>>>> Now, the *first* workstation I tested, I joined to the
domain "by
>>>>>> hand".
>>>>>>    That one works for logons as expected.
>>>>>> 
>>>>>>> On 04/09/2015 11:07 AM, Rowland Penny wrote:
>>>>>>> On 09/04/15 15:52, John E.P. Hynes wrote:
>>>>>>> Hi List,
>>>>>>> 
>>>>>>> I just set up a new Samba4 AD controller, created
users, etc.  When I
>>>>>>> join a test workstation from our old, currently
active domain to the
>>>>>>> new AD server (separate network) the join succeeds,
and the user can
>>>>>>> log in the first time to be prompted with the
"change your password"
>>>>>>> prompt.  Immediately after changing the password,
the logon fails with
>>>>>>> "Logon failure: user account restriction"
and possible reasons.
>>>>>>> 
>>>>>>> I looked at the policy, by default it seems to be
set to hours 24/7
>>>>>>> and computers to log in from "any". 
Which is fine.
>>>>>>> 
>>>>>>> Does anyone have a pointer for me?
>>>>>>> 
>>>>>>> Thanks,
>>>>>>> 
>>>>>>> -John
>>>>>>> 
>>>>>>> You refer to checking a 'policy', would
this be a windows GPO ? If so,
>>>>>>> then I think that you need to know that you cannot
set password
>>>>>>> policies
>>>>>>> on a Samba 4 AD DC via a gpo, you need to use
samba-tool, see
>>>>>>> 'samba-tool domain passwordsettings --help'
>>>>>>> 
>>>>>>> Rowland
>>>>> If your new users work, but the original users don't,
it would seem that
>>>>> there must be a difference between them, what I do not
know. It should
>>>>> be easy to find out, make sure that ldb-tools is installed
and try
>>>>> searching for a user that works, then one that doesn't
and compare them
>>>>> i.e.
>>>>> 
>>>>> ldbsearch -H /var/lib/samba/private/sam.ldb
>>>>> '(&(objectclass=user)(samaccountname=rowland))'
>>>>> 
>>>>> This displays my AD record when run on my Debian wheezy AD
DC
>>>>> 
>>>>> Rowland
>>>> There are no old accounts, either user or computer.  The newly
created
>>>> accounts can be logged into from "box1" but not
"box2".
>>>> 
>>>> Comparing the machine accounts, they are identical.  Also, just
for
>>>> giggles, I unjoined/rejoined the "not log-in-able"
box manually, and it
>>>> *still* didn't work.  Same error.
>>>> 
>>>> Nothing in the samba logs at all.  One box works fine, now two
others
>>>> don't.  Using the accounts with smbclient on the server
also works fine.
>>>> 
>>>> I'm really at a loss here.  All clients are windows 7,
Samba version is
>>>> the latest that comes with Ubuntu 14.04.
>>>> 
>>>> It looks like it must be on the windows side, since Samba
allows logins
>>>> from one of the clients, just not the rest.  What debug options
should I
>>>> try on Samba to watch the credential verification process just
to be
>>>> sure though?
>>>> 
>>>> Thanks,
>>>> 
>>>> -John
>>> Add 'log level = passdb:5 auth:5 winbind:5' to smb.conf and
then restart
>>> samba, this should give you plenty of output to look at, you can
change
>>> the numbers to get more or less output i.e. anything between 0 to
10.
>>> See 'man smb.conf' for more info.
>>> 
>>> Rowland
>> OK, so after looking at a bunch of debug logs...
>> 
>> The machine account is locked, UseAccountControl flags are 0x4144 for
>> the machines that don't allow logon, and 0x1000 for those that do.
>> 
>> It doesn't seem you can manipulate these through Windows (errors
out
>> that the server rejected the change) so I guess the next two questions
are:
>> 
>> 1) How do I edit these with samba-tool?
>> 2) How the heck did they end up "wrong" like this right out
of the box?
>> 
>> Any ideas appreciated.
>> 
>> -John
> 
> OK, my computer accounts all have this:
> 
> userAccountControl: 69632
> 
> Which is made up from:
> 
> 65536 DONT_EXPIRE_PASSWORD
> 04096 WORKSTATION_TRUST_ACCOUNT
> 
> So you could try using ldbmodify on the samba DC to change this.
> 
> Create an ldif file, /tmp/computer
> 
> dn: CN=computername,CN=Computers,CN=Users,DC=example,DC=com
> changetype: modify
> replace: UserAccountControl
> UserAccountControl: 69632
> 
> Don't forget to alter the top line to your settings.
> 
> Now use this ldif and ldbmodify to change the attribute:
> 
> ldbmodify -H /var/lib/samba/private/sam.ldb /tmp/computer
> 
> Again if sam.ldb isn't in /var/lib/samba/private , then change the
path, also note that this needs to be done as root.
> 
> Rowland
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba