samba - Sep 2020 - Trying to add workstation to smb domain and get access denied

Rebooted my system for a windows update.  When it came back up,
It said the trust between my workstation and DC was broken.
(Running Windows 7x64 SP1).  Very odd, haven't seen that for a while.

I thought it would be easy: unjoin/rejoin.  But upon trying to rejoin,
I get:


  The join operation was not successful.  This could be because an existing
  computer account having name 'ANY' was previous created using a
  different set of credential.  Use a different computer name, or
  contact your administrator to remove any stale conflicting account
  The error was Access is denied.

I also tried it from the smb DC using 'net dom join...', but get the
same
error: access is denied.

Have never seen this.  I've tried changing the name to a computer name
never existing on my network, but got the same message with no matter
what computer name I put in.

Help?
Linda

On 09/09/2020 03:20, L A Walsh via samba wrote:
> Rebooted my system for a windows update.  When it came back up,
> It said the trust between my workstation and DC was broken.
> (Running Windows 7x64 SP1).  Very odd, haven't seen that for a while.
>
> I thought it would be easy: unjoin/rejoin.  But upon trying to rejoin,
> I get:
>
>
>    The join operation was not successful.  This could be because an
existing
>    computer account having name 'ANY' was previous created using a
>    different set of credential.  Use a different computer name, or
>    contact your administrator to remove any stale conflicting account
>    The error was Access is denied.
>
> I also tried it from the smb DC using 'net dom join...', but get
the same
> error: access is denied.
>
> Have never seen this.  I've tried changing the name to a computer name
> never existing on my network, but got the same message with no matter
> what computer name I put in.
>
> Help?
> Linda
One thing you didn't say is what the DC is, as this is the samba mailing 
list and you mention 'smb DC', I think we can safely assume it is a 
Samba DC, but what version of Samba is it ?

Can you also tell us what OS you are using and supply a copy of the DC's 
smb.conf

Rowland

Im wondering why the message is : 
> This could be because an existing computer account having name
'ANY'
Your called Linda not Any ;- 

Its a case like this : 
https://chentiangemalc.wordpress.com/2012/07/27/case-of-the-domain-join-failure/#:~:text=This%20could%20be%20because%20an,remove%20any%20stale%20conflicting%20account.

I suspect you didnt sysprep your pc's and/or having multiple pc's with
the same hostname.

You can try/verify this if its not a "local" problem in the pc. 
1. Log onto the computer as a user as a local admin or a user with
administrative priviledges
2. Open My Computer or Windows Explorer and Navigate to the following directory
C:\Windows\System32
3. Locate then right-click the config folder select ?> Properties ( the
config properties page is displayed)
4. Select the Security tab
5. Click the continue button if it is present, otherwise locate the
Administrators group or the user with Admin privileges ..
6. Select the Administrative group or User Account with Admin rights.
7. Under Permissions for Administrators click the Full control check box
8. Click Apply ? if a windows security prompt appears, click Yes
9. If several Error Applying Security Access is denied windows appear click
continue on all window pop-ups
10. Click OK on the Permissions for Config page ? the page will close
11. Click OK on the config Properties page ? the page will close
(source
https://nerdynerdnerdz.com/4192/solved-windows-domain-join-operation-was-not-successful-access-denied/
)

The othere one is, remove (all same name) pc's  from the AD-domain. 
Rename/sysprep them and rejoin. 

After thats done, and its still nog working, then maybe its time to look at
samba also.


Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens L A 
> Walsh via samba
> Verzonden: woensdag 9 september 2020 4:20
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] Trying to add workstation to smb domain 
> and get access denied
> 
> Rebooted my system for a windows update.  When it came back up,
> It said the trust between my workstation and DC was broken.
> (Running Windows 7x64 SP1).  Very odd, haven't seen that for a while.
> 
> I thought it would be easy: unjoin/rejoin.  But upon trying to rejoin,
> I get:
> 
> 
>   The join operation was not successful.  This could be 
> because an existing
>   computer account having name 'ANY' was previous created using a
>   different set of credential.  Use a different computer name, or
>   contact your administrator to remove any stale conflicting account
>   The error was Access is denied.
> 
> I also tried it from the smb DC using 'net dom join...', but 
> get the same
> error: access is denied.
> 
> Have never seen this.  I've tried changing the name to a computer name
> never existing on my network, but got the same message with no matter
> what computer name I put in.
> 
> Help?
> Linda
> 
> 
> 
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

This could be a slightly different solution to the same issue:
https://nerdynerdnerdz.com/4192/solved-windows-domain-join-operation-was-not-successful-access-denied/

It avoids a regedit.

I don't what his option 2 is. Perhaps your method?

On 09/09/2020 08:41, L.P.H. van Belle via samba wrote:
> 
> Im wondering why the message is :
>> This could be because an existing computer account having name
'ANY'
> 
> Your called Linda not Any ;-
> 
> Its a case like this :
>
https://chentiangemalc.wordpress.com/2012/07/27/case-of-the-domain-join-failure/#:~:text=This%20could%20be%20because%20an,remove%20any%20stale%20conflicting%20account.
> 
> I suspect you didnt sysprep your pc's and/or having multiple pc's
with the same hostname.
> 
> You can try/verify this if its not a "local" problem in the pc.
> 1. Log onto the computer as a user as a local admin or a user with
administrative priviledges
> 2. Open My Computer or Windows Explorer and Navigate to the following
directory C:\Windows\System32
> 3. Locate then right-click the config folder select ?> Properties ( the
config properties page is displayed)
> 4. Select the Security tab
> 5. Click the continue button if it is present, otherwise locate the
Administrators group or the user with Admin privileges ..
> 6. Select the Administrative group or User Account with Admin rights.
> 7. Under Permissions for Administrators click the Full control check box
> 8. Click Apply ? if a windows security prompt appears, click Yes
> 9. If several Error Applying Security Access is denied windows appear click
continue on all window pop-ups
> 10. Click OK on the Permissions for Config page ? the page will close
> 11. Click OK on the config Properties page ? the page will close
> (source
https://nerdynerdnerdz.com/4192/solved-windows-domain-join-operation-was-not-successful-access-denied/
)
> 
> The othere one is, remove (all same name) pc's  from the AD-domain.
> Rename/sysprep them and rejoin.
> 
> After thats done, and its still nog working, then maybe its time to look at
samba also.
> 
> 
> Greetz,
> 
> Louis
> 
> 
>> -----Oorspronkelijk bericht-----
>> Van: samba [mailto:samba-bounces at lists.samba.org] Namens L A
>> Walsh via samba
>> Verzonden: woensdag 9 september 2020 4:20
>> Aan: samba at lists.samba.org
>> Onderwerp: [Samba] Trying to add workstation to smb domain
>> and get access denied
>>
>> Rebooted my system for a windows update.  When it came back up,
>> It said the trust between my workstation and DC was broken.
>> (Running Windows 7x64 SP1).  Very odd, haven't seen that for a
while.
>>
>> I thought it would be easy: unjoin/rejoin.  But upon trying to rejoin,
>> I get:
>>
>>
>>    The join operation was not successful.  This could be
>> because an existing
>>    computer account having name 'ANY' was previous created
using a
>>    different set of credential.  Use a different computer name, or
>>    contact your administrator to remove any stale conflicting account
>>    The error was Access is denied.
>>
>> I also tried it from the smb DC using 'net dom join...', but
>> get the same
>> error: access is denied.
>>
>> Have never seen this.  I've tried changing the name to a computer
name
>> never existing on my network, but got the same message with no matter
>> what computer name I put in.
>>
>> Help?
>> Linda
>>
>>
>>
>>
>>
>> -- 
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba
>>
>>
> 
>

On 2020/09/09 00:41, L.P.H. van Belle via samba wrote:
> [check C:\Windows\system32 ownership and ACL security settings
>  and verify Full access by Administrators group, from.. 
>
https://nerdynerdnerdz.com/4192/solved-windows-domain-join-operation-was-not-successful-access-denied/
> ) ]
This was working correctly not too many days ago, but was very mangled
after the install of KB4508772 (attempt to fix a long-standing bug in my
Windows Event log not starting (since pre-Win8 days), giving the
error message:

  "Error 4201: The instance name passed was not recognized as valid
  by a WMI data provider."

that was accompanied by WMI failing with the message:

  "Server execution failed"

in response to most requests.  MS was never able to resolve the problem
(it persisted through SFC checks and in-place 'upgrade's using original
product disk to reset binaries + system state).  Their final answer, to
close out the original questions (a few others reported the problem
as well) years after it was first reported, was to upgrade to Win10,
where they assumed it was fixed or would not be duplicable (even though
they had no idea what caused the original problem).

Anyway, it was immediately after installing that patch (which
required a manual reboot, as well as a auto-reboot after applying
more changes) that my  system became unjoined from the domain
and had problems being re-added.

So thanks much for the advice to recheck OS-folder permissions.  It
wouldn't have occurred to me that a patch like that would have wiped
existing permissions forcing them to be re-applied.

Thanks very much for all the suggestions & input!