samba - Mar 2016 - Duplicate nobody pid entries from smbstatus

Hi
   We've recently had a few windows 10 machines active on the network and
are experiencing a strange issue in the output of smbstatus.
By the end of the day a windows 10 machine may be listed dozens of times in the
PID listing, with the expected user once but then dozens of nobody:nobody
entries also associated with the same machine / PID.
eg: a trimmed view..

Samba version 4.2.3
PID     Username      Group         Machine            Protocol Version
------------------------------------------------------------------------------
35585     nobody        nobody        192.168.0.41 (ipv4:192.168.0.41:51340)
SMB3_00
35585     user1         user1         192.168.0.41 (ipv4:192.168.0.41:51340)
SMB3_00
35585     nobody        nobody        192.168.0.41 (ipv4:192.168.0.41:51340)
SMB3_00
35585     nobody        nobody        192.168.0.41 (ipv4:192.168.0.41:51340)
SMB3_00

I've tried limiting the protocol tho SMB2_10, but the issue still occurs.
Has anyone else seen something similar? or be able to point me in the right
direction?

Samba 4.2.3-11.el7_2
Centos 7

Regards
  Richard

Hi All
  No bites?  I've run out of places to look for help.
Getting hundreds of these dud entries daily now, real pain when I'm
trying to look for a specific entry..
Server is just simple file sharing into a workgroup.
Here is the config, I didn't want to spam the list if there was a simple
answer someone might have know

Thanks
  Richard

[global]
    server string = Samba Server Version %v
    workgroup = EMIT
    netbios name = SERVER

    interfaces = lo em1.10 192.168.0.0/255.255.224.0 em1.20
10.1.1.0/255.255.255.0
    passdb backend = tdbsam

    read raw = yes
    write raw = yes
    socket options = SO_KEEPALIVE TCP_NODELAY IPTOS_LOWDELAY
SO_SNDBUF=65536 SO_RCVBUF=65536
    keepalive = 600

    follow symlinks = yes
    unix extensions = no
    wide links = yes

    load printers = no
    printing = bsd
    printcap cache time = 0
    printcap name = /dev/null
    disable spoolss = yes

    acl allow execute always = true
    security = user

    log file = /var/log/samba/log.%m
    max log size = 5000
    log level = 2

    vfs objects = recycle
    recycle:keeptree = yes
    recycle:maxsize = 50000000
    recycle:exclude_dir = "......"

    full_audit:priority = notice
    full_audit:facility = local6
    full_audit:failure = none
    full_audit:success = open close unlink rename rmdir mknod mkdir
    full_audit:prefix = %u|%I/%S

    domain master = yes
    local master = yes
    os level = 65
    preferred master = yes

    wins support = yes
    dns proxy = yes

[homes]
    comment = Home Directories
    browseable = no
    writable = yes
    follow symlinks = yes
    wide links = yes
    vfs objects = shadow_copy2
    shadow:snapdir = /backups/snapshots/home
    shadow:basedir = /home
    shadow:format = snap. at GMT-%Y.%m.%d-%H.%M.%S
    shadow:sort = desc

[shared]
    vfs objects = full_audit shadow_copy2
    writeable = yes
    path = /home/shared
    force directory mode = 02770
    force create mode = 02770
    comment = Emit shared directory
    follow symlinks = yes
    create mode = 0774
    directory mode = 02775
    shadow:snapdir = /backups/snapshots/shared
    shadow:basedir = /home/shared
    shadow:format = snap. at GMT-%Y.%m.%d-%H.%M.%S
    shadow:sort = desc

[admin]
    comment = Emit Administration
    path = /home/admin
    valid users = ........
    read only = No
    create mask = 02770
    force create mode = 02770
    directory mask = 02770
    force directory mode = 02770
    follow symlinks = yes
    wide links = yes
    vfs objects = full_audit shadow_copy2
    shadow:snapdir = /backups/snapshots/admin
    shadow:basedir = /home/admin
    shadow:format = snap. at GMT-%Y.%m.%d-%H.%M.%S
    shadow:sort = desc

[projects]
    comment = EMIT Projects
    path = /home/projects
    read only = No
    create mask = 0770
    force create mode = 00770
    directory mask = 02770
    force directory mode = 02770
    follow symlinks = yes
    wide links = yes
    vfs objects = shadow_copy2
    shadow:snapdir = /backups/snapshots/projects
    shadow:basedir = /home/projects
    shadow:format = snap. at GMT-%Y.%m.%d-%H.%M.%S
    shadow:sort = desc
> Hi
>    We've recently had a few windows 10 machines active on the network
and are experiencing a strange issue in the output of smbstatus.
> By the end of the day a windows 10 machine may be listed dozens of times in
the PID listing, with the expected user once but then dozens of nobody:nobody
entries also associated with the same machine / PID.
> eg: a trimmed view..
>
> Samba version 4.2.3
> PID     Username      Group         Machine            Protocol Version
>
------------------------------------------------------------------------------
> 35585     nobody        nobody        192.168.0.41
(ipv4:192.168.0.41:51340) SMB3_00
> 35585     user1         user1         192.168.0.41
(ipv4:192.168.0.41:51340) SMB3_00
> 35585     nobody        nobody        192.168.0.41
(ipv4:192.168.0.41:51340) SMB3_00
> 35585     nobody        nobody        192.168.0.41
(ipv4:192.168.0.41:51340) SMB3_00
>
> I've tried limiting the protocol tho SMB2_10, but the issue still
occurs.
> Has anyone else seen something similar? or be able to point me in the right
direction?
>
> Samba 4.2.3-11.el7_2
> Centos 7
>
> Regards
>   Richard
>
>
>