samba - Dec 2016 - winbind joining NT4-style domain - two strange issues

On Sat, Dec 17, 2016 at 09:51:57PM +0000, Rowland Penny via samba
wrote:
> > | netbios name = DALET-STG
> > | workgroup = SYNTH
> > | wins support = no
> > | wins server = herkules.synth.intern
> > | client ipc signing = auto
> > | server role = member server
> > | security = domain
> > | password server = herkules.synth.intern
> > | idmap config *:backend = tdb
> > | idmap config *:range = 1000-9999
> > | idmap config SYNTH:backend = rid
> > | idmap config SYNTH:range = 10000-19999
> > | winbind separator = +
> > | winbind enum groups = yes
> > | winbind enum users = yes
> > | winbind use default domain = no
> From version 4.5.0, the default 'ntlm auth' option in smb.conf was
> change from "yes" to "no". Try adding 'ntlm auth =
yes' to your
> smb.conf
Thans, I added that - unfortunately it did not change anything.

In fact the problem was exactly the same with Samba 4.2.10 (shipping
with Debian jessie). I only upgraded to 4.5.2 before posting to this
list in order to avoid any "upgrade to the recent version" replies.

Bye,
Stefan

On Sat, Dec 17, 2016 at 5:07 PM, Stefan Froehlich via samba
<samba at lists.samba.org> wrote:
> In fact the problem was exactly the same with Samba 4.2.10 (shipping
> with Debian jessie). I only upgraded to 4.5.2 before posting to this
> list in order to avoid any "upgrade to the recent version"
replies.
Try setting:
client ipc signing = No

On Sat, Dec 17, 2016 at 05:19:19PM -0500, Sonic wrote:
> On Sat, Dec 17, 2016 at 5:07 PM, Stefan Froehlich via samba
> <samba at lists.samba.org> wrote:
> > In fact the problem was exactly the same with Samba 4.2.10 (shipping
> > with Debian jessie). I only upgraded to 4.5.2 before posting to this
> > list in order to avoid any "upgrade to the recent version"
replies.
 
> Try setting:
> client ipc signing = No
Unfortunately this makes no difference in behaviour either.

(As far as I understand the man page, "auto" is the most liberal
setting here, and in my case "auto" and "no" should be
identical).

@Sonic: sorry for the PM, I pressed the wrong button

Bye,
Stefan