samba - Aug 2017 - Trust Relationship between this work station and primary domain failed

hi all

i still struggling for the last 2 month to figure out what happen with my
samba 4 AD server Installation

almost all my client mostly win 7 and 10 having same problem with trust
relationship

i have check the time on PC client all fine ..but the trust relationship
problem still happen

here is my samba server conf



































*# Global parameters[global]        workgroup = TERMINIX        realm
terminix.co.id <http://terminix.co.id>        netbios name = PDC
server role = active directory domain controller        #dns forwarder 10.9.8.10
dns forwarder = 172.16.99.1        vfs objects acl_xattr        map acl inherit
= Yes        store dos attributes Yes        log level = 1[netlogon]        path
/usr/local/samba/var/locks/sysvol/terminix.co.id/scripts
<http://terminix.co.id/scripts>        read only = No[sysvol]        path
/usr/local/samba/var/locks/sysvol        read only = No#[install]#    path
= /home/install#    comment = app repository#    read only = No#    Veto
files /*.exe/*.com/*.dll/*.bat/*.vbs/*.tmp/*.mp3/*.avi/*.mp4/*.wmv/*.wma/#[bos]#
path = /home/bos#    comment = app repository#    read only = No#
browseable = No#Veto files
/*.exe/*.com/*.dll/*.bat/*.vbs/*.tmp/*.mp3/*.avi/*.mp4/*.wmv/*.wma/*

can anybody give me some hint to debug / check  the cause of the problem

thx before

On Tue, 15 Aug 2017 16:50:36 +0700
zhia chandra via samba <samba at lists.samba.org> wrote:
> hi all
> 
> i still struggling for the last 2 month to figure out what happen
> with my samba 4 AD server Installation
> 
> almost all my client mostly win 7 and 10 having same problem with
> trust relationship
> 
> i have check the time on PC client all fine ..but the trust
> relationship problem still happen
> 
> here is my samba server conf
Well, you could start by removing the Unix domain member lines from
your AD DC smb.conf:

        vfs objects = acl_xattr
        map acl inherit = Yes
        store dos attributes = Yes

These should NEVER be there.

Also if these '<http://terminix.co.id>',
'<http://terminix.co.id/scripts>' are actually in smb.conf, remove
them.

Rowland

PS: your mail client is rubbish, it just put your smb.conf into a
managled block which I had to decipher ;-)

hi rowland

im sorry i used gmail web to send it
i ll try to remove it as your suggest

btw i just find some work arround .

i try to un join then rejoin, and the problem still the same i cannot login

and then i try to rejoin with different computer name (i change my computer
name before rejoin)

and i successfully access my profile

i still dont get the root cause of this problem .. maybe i have corrupt
computer data in my ldap database ..

maybe  you can give me some enlightment



On Aug 15, 2017 17:33, "Rowland Penny via samba" <samba at
lists.samba.org>
wrote:

On Tue, 15 Aug 2017 16:50:36 +0700
zhia chandra via samba <samba at lists.samba.org> wrote:
> hi all
>
> i still struggling for the last 2 month to figure out what happen
> with my samba 4 AD server Installation
>
> almost all my client mostly win 7 and 10 having same problem with
> trust relationship
>
> i have check the time on PC client all fine ..but the trust
> relationship problem still happen
>
> here is my samba server conf
Well, you could start by removing the Unix domain member lines from
your AD DC smb.conf:

        vfs objects = acl_xattr
        map acl inherit = Yes
        store dos attributes = Yes

These should NEVER be there.

Also if these '<http://terminix.co.id>',
'<http://terminix.co.id/scripts>' are actually in smb.conf, remove
them.

Rowland

PS: your mail client is rubbish, it just put your smb.conf into a
managled block which I had to decipher ;-)


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Hai, 

Was this pc a member of any NT4 Domain in the past? 


You can try the following. 
Login as a Local Administrator on the pc.  ( you may need to create one first. )
Open PowerShell as administrator ( you need powershell 3.0  for this ) 
Run: 
Reset-ComputerMachinePassword -Server AD_DC.DOMAIN.TLD -Credential
YOUR_AD_DOM\Adminstrator
Restart-Computer

No powershell V3.
netdom.exe resetpwd /s:AD_DC.DOMAIN.TLD /ud:YOUR_AD_DOM\Adminstrator  /pd:*
(netdom.exe on Windows 7, get it from the Remote Server Administration Tools.)

Did this help? If not, follow the steps from this link. 
https://support.microsoft.com/en-us/help/2771040

And last, run : net cache flush on the AD DC's before you do above. 


Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens zhia 
> chandra via samba
> Verzonden: dinsdag 15 augustus 2017 14:18
> Aan: samba
> Onderwerp: Re: [Samba] Trust Relationship between this work 
> station and primary domain failed
> 
> hi rowland
> 
> im sorry i used gmail web to send it
> i ll try to remove it as your suggest
> 
> btw i just find some work arround .
> 
> i try to un join then rejoin, and the problem still the same 
> i cannot login
> 
> and then i try to rejoin with different computer name (i 
> change my computer name before rejoin)
> 
> and i successfully access my profile
> 
> i still dont get the root cause of this problem .. maybe i 
> have corrupt computer data in my ldap database ..
> 
> maybe  you can give me some enlightment
> 
> 
> 
> On Aug 15, 2017 17:33, "Rowland Penny via samba" 
> <samba at lists.samba.org>
> wrote:
> 
> On Tue, 15 Aug 2017 16:50:36 +0700
> zhia chandra via samba <samba at lists.samba.org> wrote:
> 
> > hi all
> >
> > i still struggling for the last 2 month to figure out what 
> happen with 
> > my samba 4 AD server Installation
> >
> > almost all my client mostly win 7 and 10 having same problem with 
> > trust relationship
> >
> > i have check the time on PC client all fine ..but the trust 
> > relationship problem still happen
> >
> > here is my samba server conf
> 
> Well, you could start by removing the Unix domain member 
> lines from your AD DC smb.conf:
> 
>         vfs objects = acl_xattr
>         map acl inherit = Yes
>         store dos attributes = Yes
> 
> These should NEVER be there.
> 
> Also if these '<http://terminix.co.id>', 
> '<http://terminix.co.id/scripts>' are actually in smb.conf, 
> remove them.
> 
> Rowland
> 
> PS: your mail client is rubbish, it just put your smb.conf 
> into a managled block which I had to decipher ;-)
> 
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

hai belle

Was this pc a member of any NT4 Domain in the past? nope ..

but actually our samba4 server was upgrated from samba3 base on clearOS 5
..

and actually i still running samba3 in stand alone mode for netbios only,
 incase some PC cannot map / detect other pc in same  network / domain in
network place

about powershell let me try it tomorrow thx for the advice

about https://support.microsoft.com/en-us/help/2771040
its no work for me unless i change the comenuter name before rejoin the PC




On Aug 15, 2017 7:48 PM, "L.P.H. van Belle via samba" <samba at
lists.samba.org>
wrote:

Hai,

Was this pc a member of any NT4 Domain in the past?


You can try the following.
Login as a Local Administrator on the pc.  ( you may need to create one
first. )
Open PowerShell as administrator ( you need powershell 3.0  for this )
Run:
Reset-ComputerMachinePassword -Server AD_DC.DOMAIN.TLD -Credential
YOUR_AD_DOM\Adminstrator
Restart-Computer

No powershell V3.
netdom.exe resetpwd /s:AD_DC.DOMAIN.TLD /ud:YOUR_AD_DOM\Adminstrator  /pd:*
(netdom.exe on Windows 7, get it from the Remote Server Administration
Tools.)

Did this help? If not, follow the steps from this link.
https://support.microsoft.com/en-us/help/2771040

And last, run : net cache flush on the AD DC's before you do above.


Greetz,

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens zhia
> chandra via samba
> Verzonden: dinsdag 15 augustus 2017 14:18
> Aan: samba
> Onderwerp: Re: [Samba] Trust Relationship between this work
> station and primary domain failed
>
> hi rowland
>
> im sorry i used gmail web to send it
> i ll try to remove it as your suggest
>
> btw i just find some work arround .
>
> i try to un join then rejoin, and the problem still the same
> i cannot login
>
> and then i try to rejoin with different computer name (i
> change my computer name before rejoin)
>
> and i successfully access my profile
>
> i still dont get the root cause of this problem .. maybe i
> have corrupt computer data in my ldap database ..
>
> maybe  you can give me some enlightment
>
>
>
> On Aug 15, 2017 17:33, "Rowland Penny via samba"
> <samba at lists.samba.org>
> wrote:
>
> On Tue, 15 Aug 2017 16:50:36 +0700
> zhia chandra via samba <samba at lists.samba.org> wrote:
>
> > hi all
> >
> > i still struggling for the last 2 month to figure out what
> happen with
> > my samba 4 AD server Installation
> >
> > almost all my client mostly win 7 and 10 having same problem with
> > trust relationship
> >
> > i have check the time on PC client all fine ..but the trust
> > relationship problem still happen
> >
> > here is my samba server conf
>
> Well, you could start by removing the Unix domain member
> lines from your AD DC smb.conf:
>
>         vfs objects = acl_xattr
>         map acl inherit = Yes
>         store dos attributes = Yes
>
> These should NEVER be there.
>
> Also if these '<http://terminix.co.id>',
> '<http://terminix.co.id/scripts>' are actually in smb.conf,
> remove them.
>
> Rowland
>
> PS: your mail client is rubbish, it just put your smb.conf
> into a managled block which I had to decipher ;-)
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

On Tue, 15 Aug 2017 20:52:12 +0700
zhia chandra via samba <samba at lists.samba.org> wrote:
> hai belle
> 
> Was this pc a member of any NT4 Domain in the past? nope ..
> 
> but actually our samba4 server was upgrated from samba3 base on
> clearOS 5 ..
> 
> and actually i still running samba3 in stand alone mode for netbios
> only, incase some PC cannot map / detect other pc in same  network /
> domain in network place
> 
> about powershell let me try it tomorrow thx for the advice
> 
> about https://support.microsoft.com/en-us/help/2771040
> its no work for me unless i change the comenuter name before rejoin
> the PC
Is this 'samba3' machine (presumably a standalone server) using the
same workgroup name ?

Rowland