OK, I'm having issues with the problem. To summarize, I'm trying to
have a normal user change
his password from a domain member. I've tried: passwd, kpasswd and
'samba-tool user password
-U $USER --ipaddress=<IPofAD/DC>'. All mechanisms do change the
domain password and I can log
into Windows and Linux domain members, and website requiring domain
authentication.
HOWEVER, after 1 to 3 days the account become locked out. About 2 days ago I
did the
samba-tool method and reported in this thread that it worked. Today I tried to
log into my
Windows workstation and was locked out. The Samba log message was:
[2018/04/05 05:11:38.549997, 2] authentication for user [HPRS/myuser] FAILED
with error
NT_STATUS_ACCOUNT_LOCKED_OUT
ntlm_auth gives:
Unable to Authenticate: NT_STATUS_ACCOUNT_LOCKED_OUT: Account locked out
(0xc0000234)
This all despite the rcpclient saying the expiration is in July.
As the domain administrator I ran 'samba-tool user setpassword myuser'
and reset the password
and was able to log in. I'm going to not mess with this for a couple of days
and see what
happens.
The rpcclient output shows no indication that the user is locked out. The logon
time is shown
at 10:03AM today, but I was unable to log then.
Is there a better tool than rpcclient that will give lockout status?
Does anyone have any idea why this is happening?
rpcclient $> queryuser 0x457
User Name : myuser
Logon Time : Thu, 05 Apr 2018 10:03:45 EDT
Logoff Time : Wed, 31 Dec 1969 19:00:00 EST
Kickoff Time : Wed, 31 Dec 1969 19:00:00 EST
Password last set Time : Thu, 05 Apr 2018 10:25:39 EDT
Password can change Time : Thu, 05 Apr 2018 10:25:39 EDT
Password must change Time: Wed, 04 Jul 2018 10:26:42 EDT
unknown_2[0..31]...
user_rid : 0x457
group_rid: 0x201
acb_info : 0x00000010
fields_present: 0x08ffffff
logon_divs: 168
bad_password_count: 0x00000000
logon_count: 0x00000000
padding1[0..7]...
logon_hrs[0..21]...
--Mark
On Thu, 05 Apr 2018 11:31:18 -0400 Mark Foley via samba <samba at lists.samba.org> wrote:> OK, I'm having issues with the problem. To summarize, I'm trying to > have a normal user change his password from a domain member. I've > tried: passwd, kpasswd and 'samba-tool user password -U $USER > --ipaddress=<IPofAD/DC>'. All mechanisms do change the domain > password and I can log into Windows and Linux domain members, and > website requiring domain authentication. > > HOWEVER, after 1 to 3 days the account become locked out. About 2 > days ago I did the samba-tool method and reported in this thread that > it worked. Today I tried to log into my Windows workstation and was > locked out. The Samba log message was: > > [2018/04/05 05:11:38.549997, 2] authentication for user [HPRS/myuser] > FAILED with error NT_STATUS_ACCOUNT_LOCKED_OUT > > ntlm_auth gives: > > Unable to Authenticate: NT_STATUS_ACCOUNT_LOCKED_OUT: Account locked > out (0xc0000234) > > This all despite the rcpclient saying the expiration is in July. >The problem here is that you are mixing up an expired password and an account that is locked out. An account can get logged out for various reasons, but the main one is something trying to auth with an old or wrong password. Do you have anything that tries to authenticate to AD with the username and password, if so, check it is using the right password, mobile phones are a favourite place to start. Rowland
On Thu, 5 Apr 2018 16:59:15 +0100 Rowland Penny <rpenny at samba.org> wrote:> > On Thu, 05 Apr 2018 11:31:18 -0400 > Mark Foley via samba <samba at lists.samba.org> wrote: > > > OK, I'm having issues with the problem. To summarize, I'm trying to > > have a normal user change his password from a domain member. I've > > tried: passwd, kpasswd and 'samba-tool user password -U $USER > > --ipaddress=<IPofAD/DC>'. All mechanisms do change the domain > > password and I can log into Windows and Linux domain members, and > > website requiring domain authentication. > > > > HOWEVER, after 1 to 3 days the account become locked out. About 2 > > days ago I did the samba-tool method and reported in this thread that > > it worked. Today I tried to log into my Windows workstation and was > > locked out. The Samba log message was: > > > > [2018/04/05 05:11:38.549997, 2] authentication for user [HPRS/myuser] > > FAILED with error NT_STATUS_ACCOUNT_LOCKED_OUT > > > > ntlm_auth gives: > > > > Unable to Authenticate: NT_STATUS_ACCOUNT_LOCKED_OUT: Account locked > > out (0xc0000234) > > > > This all despite the rcpclient saying the expiration is in July. > > > > The problem here is that you are mixing up an expired password and an > account that is locked out. > An account can get logged out for various reasons, but the main one is > something trying to auth with an old or wrong password. Do you have > anything that tries to authenticate to AD with the username and > password, if so, check it is using the right password, mobile phones > are a favourite place to start. > > RowlandI think there might be a bug. A week ago I used 'samba-tool user setpassword me' as the domain administrator from the AD server to reset my normal user domain password. That worked for the past week with no lockout issues. So, yesterday I decided to again try samba-tool user password -U $USER --ipaddress=mail from the domain member workstation as the normal user, $USER. Again, that worked. However, once again today (the next day) I am locked out. Furthermore, if I try to use samba-tool as the Domain Admin to set the password to the same value as the locked out one, I still could not get in. I had to change the password to something different. This behavior is consistent. If, as the normal user, I change the domain password using samba-tool from the domain member computer, I get locked out within about a day. If I do the same as the domain admin, no lockout happens. I know with certainty this is NOT related to cell phones or other programs trying to repeatedly authenticate. For one thing, I have no cell phone or remote mail client accessing this domain. Also, I send an email notice for EVERY failed domain login attempt. There are no such failures in the samba log. I think there is a bug afoot. I would be happy to try any tests anyone might suggest. --Mark Samba 4.4.16