samba - Feb 2025 - Windows 11 24H2, Samba 4.21.3 AD DC and domain users cannot log in

El 13/2/25 a les 22:53, Kacper Wirski via samba ha
escrit:
> It's definately not that, i'm running local pki and CA is
distributed to
> all station, new win 11 24h2 has the root CA is the proper store (one of 
> the things I double checked), and samba ad dc servers use certificates 
> issued by this CA.
> 
> Do You have windows 11 24h2 in samba ad with no issues? Which samba 
> version You're running?
We had the same issues you reported (no access to sysvol, GPOs not 
applied) and installing the ca certificate on a test client seemed to 
solve it, however I'm not sure it was just a fluke or it really solved 
the problem (somebody else is dealing with it).

Bye
-- 
Luca Olivetti
Tel. +34 935883004 Ext. 3010
https://wetron.es
https://wecobots.com

I have been busy with other things lately and have not been able to 
investigate issue more. But there were some issues before it got really 
bad.
	But strange thing is, that clean install of 22H2 had same issue after 
successfully joining domain. And issue remained after upgrading to 23H2. 
And 22H2 did not even have latest security updates available.
	For me strangest part is, that after using "Nltest /DBFlag:2080FFFF"
to
set netlogon service to provide debug logs (after that restarting 
service), that debug complains about being unable to log into ldap server.
	Also, when trying to log in with invalid password (for domain account), 
I get "The username or password is incorrect. Try again". But if I 
provide correct password, I get "Welcome" and then "The username
or
password is incorrect. Try again".


-- 
Virgo P?rna
virgo.parna at mail.ee