Today I had another automatic restart of my secondary DC because samba-tool drs showrepl showed errors. The restart was completed at 12:35. This is what I found in log.samba at log level 3: [2016/01/04 12:33:47.201892, 3] ../source4/rpc_server/drsuapi/getncchanges.c:2007(dcesrv_drsuapi_DsGetNCChanges) UpdateRefs on getncchanges for b19509be-c3ee-4a58-9fc9-afd61759a23f [2016/01/04 12:33:47.202791, 2] ../source4/rpc_server/drsuapi/getncchanges.c:2114(dcesrv_drsuapi_DsGetNCChanges) DsGetNCChanges with uSNChanged >= 3651 flags 0x00000074 on <GUID=57840cd3-5b72-476b-9333-32d1c03d872c>;CN=Configuration,DC=ad,DC=microsult,DC=de gave 0 objects (done 0/0) 0 links (done 0/0 (as S-1-5-21-820921042-1573760902-1500171102-1000)) [2016/01/04 12:34:39.306100, 3] ../auth/credentials/credentials_krb5.c:532(cli_credentials_get_client_gss_creds) Credentials for VERDANDI$@AD.MICROSULT.DE will expire shortly (0 sec), must refresh credentials cache [2016/01/04 12:34:39.306295, 1] ../source4/auth/gensec/gensec_gssapi.c:644(gensec_gssapi_update) GSS client Update(krb5)(1) Update failed: Miscellaneous failure (see text): Matching credential (GC/samba.ad.microsult.de/ad.microsult.de at AD.MICROSULT.DE) not found [2016/01/04 12:34:39.306318, 0] ../auth/gensec/gensec.c:247(gensec_update) Did not manage to negotiate mandetory feature SIGN for dcerpc auth_level 6 [2016/01/04 12:34:39.306370, 0] ../source4/librpc/rpc/dcerpc_util.c:681(dcerpc_pipe_auth_recv) Failed to bind to uuid e3514235-4b06-11d1-ab04-00c04fc2dcd2 for e3514235-4b06-11d1-ab04-00c04fc2dcd2 at ncacn_ip_tcp:b19509be-c3ee-4a58-9fc9-afd61759a23f._msdcs.ad.microsult.de[1024,seal,krb5] NT_STATUS_ACCESS_DENIED [2016/01/04 12:34:39.377246, 3] ../auth/credentials/credentials_krb5.c:532(cli_credentials_get_client_gss_creds) Credentials for VERDANDI$@AD.MICROSULT.DE will expire shortly (0 sec), must refresh credentials cache [ snip ] [2016/01/04 12:34:39.508508, 3] ../auth/credentials/credentials_krb5.c:532(cli_credentials_get_client_gss_creds) Credentials for VERDANDI$@AD.MICROSULT.DE will expire shortly (0 sec), must refresh credentials cache [2016/01/04 12:34:39.508704, 1] ../source4/auth/gensec/gensec_gssapi.c:644(gensec_gssapi_update) GSS client Update(krb5)(1) Update failed: Miscellaneous failure (see text): Matching credential (GC/samba.ad.microsult.de/ad.microsult.de at AD.MICROSULT.DE) not found [2016/01/04 12:34:39.508726, 0] ../auth/gensec/gensec.c:247(gensec_update) Did not manage to negotiate mandetory feature SIGN for dcerpc auth_level 6 [2016/01/04 12:34:39.508773, 0] ../source4/librpc/rpc/dcerpc_util.c:681(dcerpc_pipe_auth_recv) Failed to bind to uuid e3514235-4b06-11d1-ab04-00c04fc2dcd2 for e3514235-4b06-11d1-ab04-00c04fc2dcd2 at ncacn_ip_tcp:b19509be-c3ee-4a58-9fc9-afd61759a23f._msdcs.ad.microsult.de[1024,seal,krb5] NT_STATUS_ACCESS_DENIED [2016/01/04 12:34:39.563897, 3] ../auth/credentials/credentials_krb5.c:532(cli_credentials_get_client_gss_creds) Credentials for VERDANDI$@AD.MICROSULT.DE will expire shortly (0 sec), must refresh credentials cache [2016/01/04 12:34:39.564093, 1] ../source4/auth/gensec/gensec_gssapi.c:644(gensec_gssapi_update) GSS client Update(krb5)(1) Update failed: Miscellaneous failure (see text): Matching credential (GC/samba.ad.microsult.de/ad.microsult.de at AD.MICROSULT.DE) not found [2016/01/04 12:34:39.564115, 0] ../auth/gensec/gensec.c:247(gensec_update) Did not manage to negotiate mandetory feature SIGN for dcerpc auth_level 6 [2016/01/04 12:34:39.564161, 0] ../source4/librpc/rpc/dcerpc_util.c:681(dcerpc_pipe_auth_recv) Failed to bind to uuid e3514235-4b06-11d1-ab04-00c04fc2dcd2 for e3514235-4b06-11d1-ab04-00c04fc2dcd2 at ncacn_ip_tcp:b19509be-c3ee-4a58-9fc9-afd61759a23f._msdcs.ad.microsult.de[1024,seal,krb5] NT_STATUS_ACCESS_DENIED [2016/01/04 12:34:47.459334, 3] ../source4/dsdb/dns/dns_update.c:340(dnsupdate_check_names) Calling DNS name update script [2016/01/04 12:34:47.462858, 3] ../source4/dsdb/dns/dns_update.c:355(dnsupdate_check_names) Calling SPN name update script [2016/01/04 12:34:47.773203, 3] ../source4/dsdb/dns/dns_update.c:325(dnsupdate_spnupdate_done) Completed SPN update check OK [2016/01/04 12:34:47.815691, 3] ../source4/dsdb/dns/dns_update.c:296(dnsupdate_nameupdate_done) Completed DNS update check OK [2016/01/04 12:35:01.607243, 3] ../source4/smbd/service_stream.c:66(stream_terminate_connection) Terminating connection - 'dcesrv: NT_STATUS_CONNECTION_DISCONNECTED' [2016/01/04 12:35:01.607326, 3] ../source4/smbd/process_single.c:114(single_terminate) single_terminate: reason[dcesrv: NT_STATUS_CONNECTION_DISCONNECTED] So to me it looks like it cannot refresh its TGT since it cannot find GC/samba.ad.microsult.de/ad.microsult.de at AD.MICROSULT.DE - for whatever this is. After restarting the DC everything works fine. Samba version is 4.1.17-Debian. samba.ad.microsult.de is the primary DC. Thanks for your help, - lars.