samba - Jul 2023 - Test-ComputerSecureChannel -Verbose False since windows 10/11 update 07/2023

Hello

having also issues with KB5028166on window 10 22H2 with samba 
4.15.13-Ubuntu used as old NT domain PDC

Le 12/07/2023 ? 15:19, Rowland Penny via samba a ?crit?:
>
>
> On 12/07/2023 14:03, Samuel Wolf via samba wrote:
>> Hello,
>>
>> since we install the most recent windows updates from 07/2023
>> Test-ComputerSecureChannel -Verbose
>> show False [4].
>>
>> Moved the machine to local workgroup, deleted machine account on the
>> ad controller
>> and rejoined it (which works), but Test-ComputerSecureChannel -Verbose
>> show again False.
>>
>> I'm not sure this is an issue on the samba or on the windows side.
>>
>> Affected samba versions so far:
>> 4.17.8+dfsg-2 (Debian 12) [1]
>> 4.18.x (mjt packages) [2]
>> 4.15.13+dfsg-0 (ubuntu) [3]
>>
>> Any ideas what we can do/test?
>>
>> Thank you.
>>
>> Samuel
>>
>> [1] https://lists.samba.org/archive/samba/2023-July/245749.html
>> [2] https://lists.samba.org/archive/samba/2023-July/245763.html
>> [3] https://lists.samba.org/archive/samba/2023-July/245761.html
>>
>> [4] 
>>
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/test-computersecurechannel?view=powershell-5.1
>>
>
>
> I am not convinced this is a Samba problem. It could be that Samba 
> isn't providing something that Windows now expects, or Samba is 
> providing something that Windows doesn't expect, but I think it is 
> more likely that it has something to do with the 130 CVE's that 
> Microsoft shipped yesterday:
>
> https://msrc.microsoft.com/update-guide/releaseNote/2023-Jul
>
> It wouldn't be the first time Microsoft broke something while fixing 
> something else.
>
> By all means open a bug report, Samba may need to change something to 
> get things working again, but it will probably require level 10 logs 
> and network traces to workout just what is going on.
>
> Rowland
>
>
-- 
Arnaud FLORENT
IRIS Technologies

Hello,

We also have the same problem.

Test-ComputerSecureChannel -Verbose  shows False

Our "Offer Remote Assistance" has stopped working and remote desktop
requires using the computer hostname now, before using the ip address or
hostname would work.

Our GPO populates some restricted groups and these are not applying,
however other computer and user policies are applying.  Also interesting is
when looking at the local "Remote Desktop Users" group, before the
patch it
shows our DOMAIN\group but after update it is only showing the SID.

Samba AD DC 4.16.2
Windows 10 22H2 July 2023 patch Tuesday

Dale

On 12/07/2023 15:07, Arnaud FLORENT via samba wrote:
> Hello
> 
> having also issues with KB5028166on window 10 22H2 with samba 
> 4.15.13-Ubuntu used as old NT domain PDC
> 
At least that points to it not being solely an AD problem, something in 
basic authentication ?

Rowland