THANK YOU FOR YOUR REPLY THE RESULT : KVNO Principal ---- -------------------------------------------------------------------------- 1 HOST/samba4 at FSS.LAN (des-cbc-crc) 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc) 1 SAMBA4$@FSS.LAN (des-cbc-crc) 1 HOST/samba4 at FSS.LAN (des-cbc-md5) 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-md5) 1 SAMBA4$@FSS.LAN (des-cbc-md5) 1 HOST/samba4 at FSS.LAN (arcfour-hmac) 1 HOST/samba4.fss.lan at FSS.LAN (arcfour-hmac) 1 SAMBA4$@FSS.LAN (arcfour-hmac) 1 HOST/samba4 at FSS.LAN (aes128-cts-hmac-sha1-96) 1 HOST/samba4.fss.lan at FSS.LAN (aes128-cts-hmac-sha1-96) 1 SAMBA4$@FSS.LAN (aes128-cts-hmac-sha1-96) 1 HOST/samba4 at FSS.LAN (aes256-cts-hmac-sha1-96) 1 HOST/samba4.fss.lan at FSS.LAN (aes256-cts-hmac-sha1-96) 1 SAMBA4$@FSS.LAN (aes256-cts-hmac-sha1-96) 2 HOST/samba4 at FSS.LAN (des-cbc-crc) 2 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc) 2 SAMBA4$@FSS.LAN (des-cbc-crc) 2 HOST/samba4 at FSS.LAN (des-cbc-md5) 2 HOST/samba4.fss.lan at FSS.LAN (des-cbc-md5) 2 SAMBA4$@FSS.LAN (des-cbc-md5) 2 HOST/samba4 at FSS.LAN (arcfour-hmac) 2 HOST/samba4.fss.lan at FSS.LAN (arcfour-hmac) 2 SAMBA4$@FSS.LAN (arcfour-hmac) 2 HOST/samba4 at FSS.LAN (aes128-cts-hmac-sha1-96) 2 HOST/samba4.fss.lan at FSS.LAN (aes128-cts-hmac-sha1-96) 2 SAMBA4$@FSS.LAN (aes128-cts-hmac-sha1-96) 2 HOST/samba4 at FSS.LAN (aes256-cts-hmac-sha1-96) 2 HOST/samba4.fss.lan at FSS.LAN (aes256-cts-hmac-sha1-96) 2 SAMBA4$@FSS.LAN (aes256-cts-hmac-sha1-96) 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc) 1 SAMBA4$@FSS.LAN (des-cbc-crc) 1 HOST/samba4 at FSS.LAN (des-cbc-md5) 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-md5) 1 SAMBA4$@FSS.LAN (des-cbc-md5) 1 HOST/samba4 at FSS.LAN (arcfour-hmac) 1 HOST/samba4.fss.lan at FSS.LAN (arcfour-hmac) 1 SAMBA4$@FSS.LAN (arcfour-hmac) 1 HOST/samba4 at FSS.LAN (aes128-cts-hmac-sha1-96) 1 HOST/samba4.fss.lan at FSS.LAN (aes128-cts-hmac-sha1-96) 1 SAMBA4$@FSS.LAN (aes128-cts-hmac-sha1-96) 1 HOST/samba4 at FSS.LAN (aes256-cts-hmac-sha1-96) 1 HOST/samba4.fss.lan at FSS.LAN (aes256-cts-hmac-sha1-96) 1 SAMBA4$@FSS.LAN (aes256-cts-hmac-sha1-96) Le mar. 26 févr. 2019 à 16:22, Rowland Penny via samba < samba at lists.samba.org> a écrit :> On Tue, 26 Feb 2019 15:57:03 +0100 > David Jehin via samba <samba at lists.samba.org> wrote: > > > Hello everyone > > since now a certain time I pull my hair and do not understand the > > source of my problem. > > after a samba 3 pdc migration to samba 4.8.5 AD, when a windows client > > starts the gpo computer is not applied to the boot. > > in the windows logs there are 1058 GPO errors and server side samba > > here are the logs: > > > > GSS server Update (krb5) (1) Update failed: Miscellaneous failure > > (see text): Failed to find SAMBA4$@FSS.LAN (kvno 2) in keytab FILE: > > /var/lib/samba/private/secrets.keytab (arcfour -hmac-md5) > > [2019/02/20 11: 20: 33.013351, 1] > > ../auth/gensec/spnego.c:1218(gensec_spnego_server_negTokenInit_step) > > gensec_spnego_server_negTokenInit_step: gssapi_krb5: parsing > > NEG_TOKEN_INIT content failed (next [(null)]): NT_STATUS_LOGON_FAILURE > > [2019/02/20 11: 20: 33.041913, 1] > > ../source4/auth/gensec/gensec_gssapi.c:790(gensec_gssapi_update_internal) > > > > thank you again for your participation. > > What does this show: > > klist -e -k /var/lib/samba/private/secrets.keytab > > Rowland > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba >
On Tue, 26 Feb 2019 16:37:39 +0100 David Jehin <bedou210977 at gmail.com> wrote:> THANK YOU FOR YOUR REPLY > > THE RESULT : > KVNO Principal > ---- > -------------------------------------------------------------------------- > 1 HOST/samba4 at FSS.LAN (des-cbc-crc) > 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc) > 1 SAMBA4$@FSS.LAN (des-cbc-crc) > 1 HOST/samba4 at FSS.LAN (des-cbc-md5) > 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-md5) > 1 SAMBA4$@FSS.LAN (des-cbc-md5) > 1 HOST/samba4 at FSS.LAN (arcfour-hmac) > 1 HOST/samba4.fss.lan at FSS.LAN (arcfour-hmac) > 1 SAMBA4$@FSS.LAN (arcfour-hmac) > 1 HOST/samba4 at FSS.LAN (aes128-cts-hmac-sha1-96) > 1 HOST/samba4.fss.lan at FSS.LAN (aes128-cts-hmac-sha1-96) > 1 SAMBA4$@FSS.LAN (aes128-cts-hmac-sha1-96) > 1 HOST/samba4 at FSS.LAN (aes256-cts-hmac-sha1-96) > 1 HOST/samba4.fss.lan at FSS.LAN (aes256-cts-hmac-sha1-96) > 1 SAMBA4$@FSS.LAN (aes256-cts-hmac-sha1-96) > 2 HOST/samba4 at FSS.LAN (des-cbc-crc) > 2 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc) > 2 SAMBA4$@FSS.LAN (des-cbc-crc) > 2 HOST/samba4 at FSS.LAN (des-cbc-md5) > 2 HOST/samba4.fss.lan at FSS.LAN (des-cbc-md5) > 2 SAMBA4$@FSS.LAN (des-cbc-md5) > 2 HOST/samba4 at FSS.LAN (arcfour-hmac) > 2 HOST/samba4.fss.lan at FSS.LAN (arcfour-hmac) > 2 SAMBA4$@FSS.LAN (arcfour-hmac) > 2 HOST/samba4 at FSS.LAN (aes128-cts-hmac-sha1-96) > 2 HOST/samba4.fss.lan at FSS.LAN (aes128-cts-hmac-sha1-96) > 2 SAMBA4$@FSS.LAN (aes128-cts-hmac-sha1-96) > 2 HOST/samba4 at FSS.LAN (aes256-cts-hmac-sha1-96) > 2 HOST/samba4.fss.lan at FSS.LAN (aes256-cts-hmac-sha1-96) > 2 SAMBA4$@FSS.LAN (aes256-cts-hmac-sha1-96) > 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc) > 1 SAMBA4$@FSS.LAN (des-cbc-crc) > 1 HOST/samba4 at FSS.LAN (des-cbc-md5) > 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-md5) > 1 SAMBA4$@FSS.LAN (des-cbc-md5) > 1 HOST/samba4 at FSS.LAN (arcfour-hmac) > 1 HOST/samba4.fss.lan at FSS.LAN (arcfour-hmac) > 1 SAMBA4$@FSS.LAN (arcfour-hmac) > 1 HOST/samba4 at FSS.LAN (aes128-cts-hmac-sha1-96) > 1 HOST/samba4.fss.lan at FSS.LAN (aes128-cts-hmac-sha1-96) > 1 SAMBA4$@FSS.LAN (aes128-cts-hmac-sha1-96) > 1 HOST/samba4 at FSS.LAN (aes256-cts-hmac-sha1-96) > 1 HOST/samba4.fss.lan at FSS.LAN (aes256-cts-hmac-sha1-96) > 1 SAMBA4$@FSS.LAN (aes256-cts-hmac-sha1-96) > > > Le mar. 26 févr. 2019 à 16:22, Rowland Penny via samba < > samba at lists.samba.org> a écrit : > > > On Tue, 26 Feb 2019 15:57:03 +0100 > > David Jehin via samba <samba at lists.samba.org> wrote: > > > > > Hello everyone > > > since now a certain time I pull my hair and do not understand the > > > source of my problem. > > > after a samba 3 pdc migration to samba 4.8.5 AD, when a windows > > > client starts the gpo computer is not applied to the boot. > > > in the windows logs there are 1058 GPO errors and server side > > > samba here are the logs: > > > > > > GSS server Update (krb5) (1) Update failed: Miscellaneous > > > failure (see text): Failed to find SAMBA4$@FSS.LAN (kvno 2) in > > > keytab FILE: /var/lib/samba/private/secrets.keytab (arcfour > > > -hmac-md5) [2019/02/20 11: 20: 33.013351, 1] > > > ../auth/gensec/spnego.c:1218(gensec_spnego_server_negTokenInit_step) > > > gensec_spnego_server_negTokenInit_step: gssapi_krb5: parsing > > > NEG_TOKEN_INIT content failed (next [(null)]): > > > NT_STATUS_LOGON_FAILURE [2019/02/20 11: 20: 33.041913, 1] > > > ../source4/auth/gensec/gensec_gssapi.c:790(gensec_gssapi_update_internal) > > > > > > thank you again for your participation. > > > > What does this show: > > > > klist -e -k /var/lib/samba/private/secrets.keytab > > > > Rowland > > > > -- > > To unsubscribe from this list go to the following URL and read the > > instructions: https://lists.samba.org/mailman/options/samba > >Well that shows that the keytab exists and contains the required enctypes for SAMBA4$@FSS.LAN at KVNO 2, what it doesn't have is '(arcfour -hmac-md5)' which, to be honest, I don't recognise. What distro is this running on ? Self compiled Samba or distro packages ? Rowland
compiled samba version : 4.8.5 and my distribution is: debian stretch 9.6 I said that when I join the domain, restarting the machine takes the GPO, the other restart does not take the gpo computer. Thanks for your help Le mar. 26 févr. 2019 à 17:11, Rowland Penny via samba < samba at lists.samba.org> a écrit :> On Tue, 26 Feb 2019 16:37:39 +0100 > David Jehin <bedou210977 at gmail.com> wrote: > > > THANK YOU FOR YOUR REPLY > > > > THE RESULT : > > KVNO Principal > > ---- > > > -------------------------------------------------------------------------- > > 1 HOST/samba4 at FSS.LAN (des-cbc-crc) > > 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc) > > 1 SAMBA4$@FSS.LAN (des-cbc-crc) > > 1 HOST/samba4 at FSS.LAN (des-cbc-md5) > > 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-md5) > > 1 SAMBA4$@FSS.LAN (des-cbc-md5) > > 1 HOST/samba4 at FSS.LAN (arcfour-hmac) > > 1 HOST/samba4.fss.lan at FSS.LAN (arcfour-hmac) > > 1 SAMBA4$@FSS.LAN (arcfour-hmac) > > 1 HOST/samba4 at FSS.LAN (aes128-cts-hmac-sha1-96) > > 1 HOST/samba4.fss.lan at FSS.LAN (aes128-cts-hmac-sha1-96) > > 1 SAMBA4$@FSS.LAN (aes128-cts-hmac-sha1-96) > > 1 HOST/samba4 at FSS.LAN (aes256-cts-hmac-sha1-96) > > 1 HOST/samba4.fss.lan at FSS.LAN (aes256-cts-hmac-sha1-96) > > 1 SAMBA4$@FSS.LAN (aes256-cts-hmac-sha1-96) > > 2 HOST/samba4 at FSS.LAN (des-cbc-crc) > > 2 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc) > > 2 SAMBA4$@FSS.LAN (des-cbc-crc) > > 2 HOST/samba4 at FSS.LAN (des-cbc-md5) > > 2 HOST/samba4.fss.lan at FSS.LAN (des-cbc-md5) > > 2 SAMBA4$@FSS.LAN (des-cbc-md5) > > 2 HOST/samba4 at FSS.LAN (arcfour-hmac) > > 2 HOST/samba4.fss.lan at FSS.LAN (arcfour-hmac) > > 2 SAMBA4$@FSS.LAN (arcfour-hmac) > > 2 HOST/samba4 at FSS.LAN (aes128-cts-hmac-sha1-96) > > 2 HOST/samba4.fss.lan at FSS.LAN (aes128-cts-hmac-sha1-96) > > 2 SAMBA4$@FSS.LAN (aes128-cts-hmac-sha1-96) > > 2 HOST/samba4 at FSS.LAN (aes256-cts-hmac-sha1-96) > > 2 HOST/samba4.fss.lan at FSS.LAN (aes256-cts-hmac-sha1-96) > > 2 SAMBA4$@FSS.LAN (aes256-cts-hmac-sha1-96) > > 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-crc) > > 1 SAMBA4$@FSS.LAN (des-cbc-crc) > > 1 HOST/samba4 at FSS.LAN (des-cbc-md5) > > 1 HOST/samba4.fss.lan at FSS.LAN (des-cbc-md5) > > 1 SAMBA4$@FSS.LAN (des-cbc-md5) > > 1 HOST/samba4 at FSS.LAN (arcfour-hmac) > > 1 HOST/samba4.fss.lan at FSS.LAN (arcfour-hmac) > > 1 SAMBA4$@FSS.LAN (arcfour-hmac) > > 1 HOST/samba4 at FSS.LAN (aes128-cts-hmac-sha1-96) > > 1 HOST/samba4.fss.lan at FSS.LAN (aes128-cts-hmac-sha1-96) > > 1 SAMBA4$@FSS.LAN (aes128-cts-hmac-sha1-96) > > 1 HOST/samba4 at FSS.LAN (aes256-cts-hmac-sha1-96) > > 1 HOST/samba4.fss.lan at FSS.LAN (aes256-cts-hmac-sha1-96) > > 1 SAMBA4$@FSS.LAN (aes256-cts-hmac-sha1-96) > > > > > > Le mar. 26 févr. 2019 à 16:22, Rowland Penny via samba < > > samba at lists.samba.org> a écrit : > > > > > On Tue, 26 Feb 2019 15:57:03 +0100 > > > David Jehin via samba <samba at lists.samba.org> wrote: > > > > > > > Hello everyone > > > > since now a certain time I pull my hair and do not understand the > > > > source of my problem. > > > > after a samba 3 pdc migration to samba 4.8.5 AD, when a windows > > > > client starts the gpo computer is not applied to the boot. > > > > in the windows logs there are 1058 GPO errors and server side > > > > samba here are the logs: > > > > > > > > GSS server Update (krb5) (1) Update failed: Miscellaneous > > > > failure (see text): Failed to find SAMBA4$@FSS.LAN (kvno 2) in > > > > keytab FILE: /var/lib/samba/private/secrets.keytab (arcfour > > > > -hmac-md5) [2019/02/20 11: 20: 33.013351, 1] > > > > ../auth/gensec/spnego.c:1218(gensec_spnego_server_negTokenInit_step) > > > > gensec_spnego_server_negTokenInit_step: gssapi_krb5: parsing > > > > NEG_TOKEN_INIT content failed (next [(null)]): > > > > NT_STATUS_LOGON_FAILURE [2019/02/20 11: 20: 33.041913, 1] > > > > > ../source4/auth/gensec/gensec_gssapi.c:790(gensec_gssapi_update_internal) > > > > > > > > thank you again for your participation. > > > > > > What does this show: > > > > > > klist -e -k /var/lib/samba/private/secrets.keytab > > > > > > Rowland > > > > > > -- > > > To unsubscribe from this list go to the following URL and read the > > > instructions: https://lists.samba.org/mailman/options/samba > > > > > Well that shows that the keytab exists and contains the required > enctypes for SAMBA4$@FSS.LAN at KVNO 2, what it doesn't have is > '(arcfour -hmac-md5)' which, to be honest, I don't recognise. > > What distro is this running on ? > Self compiled Samba or distro packages ? > > Rowland > > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba >