samba - Feb 2018 - smbclient //server/netlogon -k -c 'ls' fails with "NT_STATUS_LOGON_FAILURE"

Dear all,

After recently upgrading my server from Debian Jessie to Debian Stretch, 
Windows 7 clients fail to join (or even authenticate) with the samba ad server.

I have redone the basic checks on the samba server:
smbclient //localhost/netlogon -U Administrator -c 'ls'  -- works
kinit administrator at INTERNAL.DOMAIN.COM -- works
klist -- works
smbclient //server/netlogon -k -c 'ls' -- fails

Detailed output:
smbclient //lotus.intra.dam-application.ro/netlogon -k -c 'ls' -d9

Any advices for troubleshooting this issue?

Thank you for your help!

   Arcadie Cracan

Dear all,

Sorry for the previous incomplete message. I am still having trouble with my 
samba installation. I have made the check suggested  on wiki.samba.org and 
got the following results:

 # smbclient -L localhost -U% 
smbclient //localhost/netlogon -UAdministrator -c 'ls' 

 # host -t SRV _ldap._tcp.intra.dam-application.ro 

 # host -t SRV _kerberos._udp.intra.dam-application.ro 

 # host -t A lotus.intra.dam-application.ro 

 # kinit administrator 

 # klist 

Finally, this last check fails:

 # smbclient //lotus.intra.dam-application.ro/netlogon -k -c 'ls'       

A detailed output follows:

 # smbclient //lotus.intra.dam-application.ro/netlogon -k -c 'ls' -d9

Sorry for the large message. I suspect this problem to be the reason why I
can't
join any Windows 7 clients to my Samba AD server. I kindly ask you to lend me a 
hand in troubleshooting this issue.

Thank you for your help!

Best regards,
   Arcadie Cracan

În ziua de luni, 5 februarie 2018, la 18:24:42 EET, Arcadie Cracan a
scris:
> Dear all,
> 
> After recently upgrading my server from Debian Jessie to Debian Stretch,
> Windows 7 clients fail to join (or even authenticate) with the samba ad
> server.
> 
> I have redone the basic checks on the samba server:
> smbclient //localhost/netlogon -U Administrator -c 'ls'  -- works
> kinit administrator at INTERNAL.DOMAIN.COM -- works
> klist -- works
> smbclient //server/netlogon -k -c 'ls' -- fails
> 
> Detailed output:
> smbclient //lotus.intra.dam-application.ro/netlogon -k -c 'ls' -d9
> 
> Any advices for troubleshooting this issue?
> 
> Thank you for your help!
> 
>    Arcadie Cracan

On Mon, 26 Feb 2018 10:19:58 +0200
Arcadie Cracan via samba <samba at lists.samba.org> wrote:
> Dear all,
> 
> Sorry for the previous incomplete message. I am still having trouble
> with my samba installation. I have made the check suggested  on
> wiki.samba.org and got the following results:
> 
>  # smbclient -L localhost -U% 
> smbclient //localhost/netlogon -UAdministrator -c 'ls' 
> 
>  # host -t SRV _ldap._tcp.intra.dam-application.ro 
> 
>  # host -t SRV _kerberos._udp.intra.dam-application.ro 
> 
>  # host -t A lotus.intra.dam-application.ro 
> 
>  # kinit administrator 
> 
>  # klist 
> 
> Finally, this last check fails:
> 
>  # smbclient //lotus.intra.dam-application.ro/netlogon -k -c
> 'ls'       
> 
> A detailed output follows:
> 
>  # smbclient //lotus.intra.dam-application.ro/netlogon -k -c 'ls'
> -d9          
> 
> Sorry for the large message. 
Don't be, it got stripped from the post ;-)

All the tests should work, I suspect a configuration problem somewhere.
Can you post the following files from the DC:

/etc/hostname
/etc/hosts
/etc/resolv.conf
/etc/krb5.conf
/etc/samba/smb.conf

As you are now using stretch, you could consider using Louis Van
Belle's repo, see here:

http://apt.van-belle.nl/

This will get you a much more recent version of Samba.

Rowland