samba - Dec 2015 - Fix for Windows 8.1 RSAT error when creating users

I created a new Samba4 AD DC, and attempted to add users and groups from 
a Windows 8.1 computer using the Remote Server Administration Tools. 
While I was able to create groups just fine, attempting to create a user 
failed with the message "An Error Occurred. Contact your System 
Administrator."

A quick Google shows that others on this list have had this and similar 
problems, but I was unable to find a satisfactory solution here. I 
thought you might be interested in what worked for me.

According to Microsoft, there is a known issue with a Windows Update 
which may appear as KB3000850 or KB2992611. Others have suggested 
removing this update, which may or may not be practical. However if you 
look at http://support.microsoft.com/en-us/kb/3000850 in the "Known 
issues in this update" gives a registry hack fix.

In regedit, under the key " 
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb",
create a DWORD entry with name "ProtectionPolicy" and value
"1".

After a reboot, this fixed the problem for me.

--Dan Menes

On Thu, 2015-12-10 at 15:59 -0500, Daniel Menes wrote:
> I created a new Samba4 AD DC, and attempted to add users and groups
> from 
> a Windows 8.1 computer using the Remote Server Administration Tools. 
> While I was able to create groups just fine, attempting to create a
> user 
> failed with the message "An Error Occurred. Contact your System 
> Administrator."
> 
> A quick Google shows that others on this list have had this and
> similar 
> problems, but I was unable to find a satisfactory solution here. I 
> thought you might be interested in what worked for me.
Samba 4.2 should fix this for you.  If that doens't, then remove the
pointer to the preferred backupkey (so we regenerate one correctly with
a 2048 bit key), per the ldbdel suggestion here:

https://lists.samba.org/archive/samba/2014-November/187205.html
> According to Microsoft, there is a known issue with a Windows Update 
> which may appear as KB3000850 or KB2992611. Others have suggested 
> removing this update, which may or may not be practical. However if
> you 
> look at http://support.microsoft.com/en-us/kb/3000850 in the "Known 
> issues in this update" gives a registry hack fix.
> 
> In regedit, under the key " 
> HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Protect\Providers\
> df9d8cd0-1501-11d1-8c7a-00c04fc297eb", 
> create a DWORD entry with name "ProtectionPolicy" and value
"1".
> 
> After a reboot, this fixed the problem for me.
> 
> --Dan Menes
-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba