search for: keyversionnumber

...the AD/DC as the Domain Administrator and do 'samba-tool user setpassword'. > > > > Suggestions on how I can get the expiration back to the 'Maximum password age' value? > > This sounds very strange. Are you sure the password changed on the DC? > Did the msDS-KeyVersionNumber change, did the pwdLastSet change? Yes, I know it changed on the DC because I was able to use the new password to log into another Windows workstation, and I use the domain credential to log into an internal web application. All these worked with the new PW. Later, I checked the Linux workstatio...

...is normal ? eg : INFO : dn: CN=pierre,CN=Users,DC=educonsult,DC=intra INFO : objectGUID: 9838c793-67f3-4e68-b362-f939e517313e INFO : objectSid: S-1-5-21-1504766521-268068577-265870750-1104 INFO : sAMAccountName: pierre INFO : userAccountControl: 512 INFO : pwdLastSet: 131664785101680280 INFO : msDS-KeyVersionNumber: 4 INFO : virtualCryptSHA512: {CRYPT}$6$3WZAFpbFo5J6n2rS$tmDWcZEkgO5e89c5yBnyEYWamNi40CI INFO : 32FermFcq3VweLGmR2qfsdjxbs0RiYJ6jrvWzlpIMDJMI1fSg8923t0 INFO : Thank's ! 2018-03-23 0:31 GMT+01:00 Andrew Bartlett <abartlet at samba.org>: > On Thu, 2018-03-22 at 23:48 +0100, Lapin Blan...

...dministrator and do 'samba-tool user setpassword'. > > > > > > Suggestions on how I can get the expiration back to the 'Maximum password age' value? > > > > This sounds very strange. Are you sure the password changed on the DC? > > Did the msDS-KeyVersionNumber change, did the pwdLastSet change? > > Yes, I know it changed on the DC because I was able to use the new password to log into another > Windows workstation, and I use the domain credential to log into an internal web application. > All these worked with the new PW. Later, I checked t...

...ch ldb_wrap open of secrets.ldb ldb: ldb_trace_request: SEARCH dn: cn=Primary Domains scope: sub expr: (&(flatname=THECREEDS)(objectclass=primaryDomain)) attr: secret attr: priorSecret attr: samAccountName attr: flatname attr: realm attr: secureChannelType attr: unicodePwd attr: msDS-KeyVersionNumber attr: saltPrincipal attr: privateKeytab attr: krb5Keytab attr: servicePrincipalName attr: ldapBindDn control: <NONE> ldb: ldb_trace_request: (tdb)->search ldb: ldb_trace_response: ENTRY dn: flatname=THECREEDS,cn=Primary Domains flatname: THECREEDS msDS-KeyVersionNumber: 1 privateKey...

On Tue, 27 Mar 2018 13:38:56 -0400 Mark Foley wrote: > > On Mon, 26 Mar 2018 08:08:53 +0200 Michael Wandel <m.wandel at t-online.de> wrote: > > > > Am 26.03.2018 um 06:31 schrieb Mark Foley via samba: > > > As a normal user, I want to change my Domain Password. I've tried: > > > > > > $ samba-tool user setpassword myuserId

...password'. > > > > > > > > Suggestions on how I can get the expiration back to the > > > > 'Maximum password age' value? > > > > > > This sounds very strange. Are you sure the password changed on > > > the DC? Did the msDS-KeyVersionNumber change, did the pwdLastSet > > > change? > > > > Yes, I know it changed on the DC because I was able to use the new > > password to log into another Windows workstation, and I use the > > domain credential to log into an internal web application. All > > these...

...=pierre,CN=Users,DC=educonsult,DC=intra > INFO : objectGUID: 9838c793-67f3-4e68-b362-f939e517313e > INFO : objectSid: S-1-5-21-1504766521-268068577-265870750-1104 > INFO : sAMAccountName: pierre > INFO : userAccountControl: 512 > INFO : pwdLastSet: 131664785101680280 > INFO : msDS-KeyVersionNumber: 4 > INFO : virtualCryptSHA512: > {CRYPT}$6$3WZAFpbFo5J6n2rS$tmDWcZEkgO5e89c5yBnyEYWamNi40CI > INFO : 32FermFcq3VweLGmR2qfsdjxbs0RiYJ6jrvWzlpIMDJMI1fSg8923t0 > INFO : > Thank's ! Yes, it is standard for LDIF to have such a line wrap. (I hope that is a testing password). Thank...

...rch_v: DC=klin,DC=kifato-mk,DC=com NULL -> 1 ldb: ldb_trace_request: SEARCH dn: CN=??????????? ?????????,OU=IT,OU=Departments,DC=klin,DC=kifato-mk,DC=com scope: base expr: (objectClass=*) attr: objectClass attr: sAMAccountName attr: userPrincipalName attr: servicePrincipalName attr: msDS-KeyVersionNumber attr: msDS-SecondaryKrbTgtNumber attr: msDS-SupportedEncryptionTypes attr: supplementalCredentials attr: msDS-AllowedToDelegateTo attr: dBCSPwd attr: unicodePwd attr: userAccountControl attr: objectSid attr: pwdLastSet attr: accountExpires attr: logonHours attr: userWorkstations attr:...

...ldb_trace_next_request: (tdb)->search ldb: Added timed event "ltdb_callback": 0x238f910 ldb: Added timed event "ltdb_timeout": 0x2948fe0 ldb: Running timer event 0x238f910 "ltdb_callback" ldb: ldb_trace_response: ENTRY dn: flatname=DOMAIN,cn=Primary Domains msDS-KeyVersionNumber: 1 objectClass: top objectClass: primaryDomain objectClass: kerberosSecret objectSid: S-1-5-21-1406441594-952197255-810364793 privateKeytab: secrets.keytab realm: DOMAIN.LOCAL saltPrincipal: host/linsrv.domain.local at DOMAIN.LOCAL samAccountName: LINSRV$ secret: q~;iioq&Tf$JL6[]94jYps4+P<$$...

...ges/samba/join.py", line 1170, in join_DC ctx.do_join() File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1073, in do_join ctx.join_add_objects() File "/usr/lib/python2.7/dist-packages/samba/join.py", line 605, in join_add_objects attrs=["msDS-KeyVersionNumber"]) If it matters, i use samba 4.3.11-Ubuntu. Any idea what could break the join process and how i could fix it?

Everytime I try to login using windows credentials to my db instance I get the error: ORA-12638: Credential retrieval failed. Looking at my alert log I find: ns main err code: 12638 which means the database is not able to connect the domain controller. The database connector makes use of NTLM protocol to authenticate. Is it supported by samba4 (4.1.16)? I'm unable to find any

Hello, and thank you for the answer. I'm quite new to Samba, and when you speak about Samba storing a crypt() password hash and about the virtualCryptSHA256 attribute I get the general meaning, but not the way to get to those informations. Would you have any pointer on where I could learn more about that ? I found discussions about some patches from Stefan Metzmacher in the mailing lists, is

...b_trace_next_request: (tdb)->search ldb: Added timed event "ltdb_callback": 0x81c1cd60 ldb: Added timed event "ltdb_timeout": 0x81c1ce20 ldb: Running timer event 0x81c1cd60 "ltdb_callback" ldb: ldb_trace_response: ENTRY dn: flatname=DONNET,cn=Primary Domains msDS-KeyVersionNumber: 1 objectClass: top objectClass: primaryDomain objectClass: kerberosSecret objectSid: S-1-5-21-2560341170-2029613188-788714530 privateKeytab: secrets.keytab realm: donnet.lan saltPrincipal: host/bsd.donnet.lan at DONNET.LAN samAccountName: BSD$ secret: =zie4p?hma-teLVIcSDZIX!KrQG<nnL<?qd- sec...

...ainDC=com memberOf: <GUID=50cae1b4-168a-43e6-9fc7-43fa7cd7e8a3>;<SID=S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-3271483883-1111>;CN=noc,CN=Users,DC=modianoad,DC=testdomainDC=com lastLogonTimestamp: 131528901605870470 primaryGroupID: 513 lastLogon: 131529690266506010 logonCount: 389 msDS-KeyVersionNumber: 95 msDS-User-Account-Control-Computed: 0 msDS-UserPasswordExpiryTimeComputed: 131654185610000000 _________________________________________________________________________ Every hint is welcome! ;-) Giuseppe

...samba/ldb_wrap.c:71(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: DC=domain,DC=ad scope: sub expr: (&(objectClass=user)(*samAccountName=DATABASE_SERVER*)) attr: objectClass attr: sAMAccountName attr: userPrincipalName attr: servicePrincipalName attr: msDS-KeyVersionNumber attr: msDS-SecondaryKrbTgtNumber attr: msDS-SupportedEncryptionTypes attr: supplementalCredentials attr: msDS-AllowedToDelegateTo attr: dBCSPwd attr: unicodePwd attr: userAccountControl attr: objectSid attr: pwdLastSet attr: accountExpires control: 1.3.6....

Try verifying kvno from the client that gives the error message. That kvno = 2 for dc$ must've come from somewhere. You can also double check e.g. via ADUC ldap attributes of the dc$: lastpwdset and kvno. If  kvno is definately 1 that means that client connecting has some error, if it's 2, than it means that dc has outdated keytab. And if it's the former, than I really am not sure

...> ldb: ldb_trace_request: SEARCH > dn: DC=domain,DC=ad > scope: sub > expr: (&(objectClass=user)(*samAccountName=DATABASE_SERVER*)) > attr: objectClass > attr: sAMAccountName > attr: userPrincipalName > attr: servicePrincipalName > attr: msDS-KeyVersionNumber > attr: msDS-SecondaryKrbTgtNumber > attr: msDS-SupportedEncryptionTypes > attr: supplementalCredentials > attr: msDS-AllowedToDelegateTo > attr: dBCSPwd > attr: unicodePwd > attr: userAccountControl > attr: objectSid > attr: pwdLastSet >...

...samba[30387]: /usr/local/samba/sbin/samba_dnsupdate: ldb: ldb_trace_response: ENTRY <27>Nov 16 20:21:05 camus samba[30387]: /usr/local/samba/sbin/samba_dnsupdate: dn: flatname=KNADA,cn=Primary Domains <27>Nov 16 20:21:05 camus samba[30387]: /usr/local/samba/sbin/samba_dnsupdate: msDS-KeyVersionNumber: 2 <27>Nov 16 20:21:05 camus samba[30387]: /usr/local/samba/sbin/samba_dnsupdate: objectClass: top <27>Nov 16 20:21:05 camus samba[30387]: /usr/local/samba/sbin/samba_dnsupdate: objectClass: primaryDomain <27>Nov 16 20:21:05 camus samba[30387]: /usr/local/samba/sbin/samba_dnsup...