samba - May 2022 - NT_STATUS_INVALID_DOMAIN_STATE “The domain was in the wrong state to perform the security operation.”

Hi,


We have a CentOS7 samba server that stopped working recently for some 
users, but only when connecting from MacOS clients (Windows seems fine).


Amongst the various logfies, this seems to be the common factor:


NT_STATUS_INVALID_DOMAIN_STATE ??? ?The domain was in the wrong state to 
perform the security operation.?


smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] 
status[NT_STATUS_INVALID_DOMAIN_STATE] || at 
../../source3/smbd/smb2_sesssetup.c:146


NTLM CRAP authentication for user [xxxx]\[xxxxxxx] returned 
NT_STATUS_INVALID_DOMAIN_STATE


Any pointers? Not an expert on samba!

You have to add more info.

Server os  (Centos7) and samba version.  (?????) 
Clients os (Windows XX) and samba version  (???? ) work. 
Macos clients (samba ??? ) does not work. 
and which program/how are you authenticating 

but looks like someone is authenticating over SMB1/NTLM1 

In samba servers and clients, set in smb.conf 
min protocol = SMB2

optional other things to look at are. 
# needed on the AD-DC that do the authorisation. 
ntlm auth = mschapv2-and-ntlmv2-only
# but also needed on clients that are authentication. 
ntlm_auth = "/path/to/ntlm_auth --allow-mschapv2 

I hope I descripted that right.. :-/ 

Greetz, 

Louis


> -----Oorspronkelijk bericht-----
> Van: samba Namens Philip Pavelin via samba
> Verzonden: vrijdag 6 mei 2022 13:16
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] NT_STATUS_INVALID_DOMAIN_STATE ?The domain
> was in the wrong state to perform the security operation.?
> 
> Hi,
> 
> 
> We have a CentOS7 samba server that stopped working recently for some
> users, but only when connecting from MacOS clients (Windows seems fine).
> 
> 
> Amongst the various logfies, this seems to be the common factor:
> 
> 
> NT_STATUS_INVALID_DOMAIN_STATE ??? ?The domain was in the wrong
> state to
> perform the security operation.?
> 
> 
> smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1]
> status[NT_STATUS_INVALID_DOMAIN_STATE] || at
> ../../source3/smbd/smb2_sesssetup.c:146
> 
> 
> NTLM CRAP authentication for user [xxxx]\[xxxxxxx] returned
> NT_STATUS_INVALID_DOMAIN_STATE
> 
> 
> Any pointers? Not an expert on samba!
> 
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba