similar to: Failed to finalize nt token

Hi Stefan, > I am googling around for an issue and can't figure it out so far. > > Status: > > 2 Debian 9.3 ADCs with samba-4.6.12 each. > > 1 Gentoo Samba Domain Member server "main", > Samba version 4.5.15 (we downgraded because of another issue a month ago > or so). > > *one* AD user is able to log into his Windows10 PC, but doesn't get a >

samba-4.6.8 on both DC and DM. 3 users were created as suggested: DC # samba-tool user create kamleitnerl Le26xxx --nis-domain=arbeitsgruppe --unix-home=/home/kamleitnerl --uid-number=10070 --login-shell=/bin/false --gid-number=100 this user can login to a Windows PC, but not access/connect shares. log for the PC's IP: [2017/09/25 15:45:10.522051, 1]

Am 2017-09-25 um 17:18 schrieb Stefan G. Weichinger via samba: > as mentioned in the other reply > > DC: 100 > DM: 10513 > > - and using "id" as Louis did: > > DC # id kamleitnerl > uid=10072(ARBEITSGRUPPE\kamleitnerl) gid=100(users) > Gruppen=100(users),3000001(BUILTIN\users) > > DM # id kamleitnerl > uid=10072(kamleitnerl) gid=10513(domain

Arg.. wbinfo --gid-info=100 DC: Confirmed, DOMAIN\Domain Users Member: Fail. failed to call wbcGetgrgid: WBC_ERR_DOMAIN_NOT_FOUND Could not get info for gid 100 But both server show the same with : wbinfo -n "NTDOM\domain users" So imho, report bug if Rowland can confirm this with a samba from source. Greetz, Louis > -----Oorspronkelijk bericht----- > Van: samba

Am 2017-09-25 um 16:29 schrieb Rowland Penny via samba: >> DC # samba-tool user create kamleitnerl Le26xxx >> --nis-domain=arbeitsgruppe --unix-home=/home/kamleitnerl >> --uid-number=10070 --login-shell=/bin/false --gid-number=100 >> > > Where did you get the GID '100' from ? > Is this the gidNumber for Domain Users ? I think so: # wbinfo --gid-info=100

On Mon, 25 Sep 2017 17:01:09 +0200 "Stefan G. Weichinger via samba" <samba at lists.samba.org> wrote: > Am 2017-09-25 um 16:49 schrieb Rowland Penny via samba: > > On Mon, 25 Sep 2017 16:35:52 +0200 > > "L.P.H. van Belle via samba" <samba at lists.samba.org> wrote: > > > >> 100 is debian default for users > >> And as far i

Hai, That bond0 interface, you might want to change that the interface name to bond1 Depending on the bonding settings, you might have hit a reserved name. I lots my docu on that but i know i configured a bond1 because bond0 didn work right. And then check these. wbinfo -pPt ( or wbinfo -p && wbinfo -P && wbinfo -t ) wbinfo --sids-to-unix-ids S-1-22-2-10513 wbinfo -D

Hai Stefan, Can you try the following. Reboot the server, then reboot the pc, then login with the not working user. When/If that works, then login and login with the other users try then. And, i bet you checked it, but must ask, time in sync? Greetz, Louis > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens > Stefan G. Weichinger

Am 22.02.19 um 15:16 schrieb Rowland Penny via samba: > On Fri, 22 Feb 2019 15:03:37 +0100 > "L.P.H. van Belle via samba" <samba at lists.samba.org> wrote: > >> Hai, >> >> That bond0 interface, you might want to change that the interface >> name to bond1 Depending on the bonding settings, you might have hit a >> reserved name. I lots my docu

On Fri, 30 Dec 2016 14:26:01 +0100 "Stefan G. Weichinger via samba" <samba at lists.samba.org> wrote: > Am 2016-12-30 um 14:07 schrieb Rowland Penny via samba: > > Is this the smb.conf you got when you ran the classicupgrade ? > > I don't think it is, can I suggest you remove any and all lines you > > have added and restart samba > > that was the

I am trying to set up winbind on a ADS domain member server. The join works OK, but winbind simply fails to start. see config and logs below, I am scratching my head. Why does it "contact" a domain called "MAIN" ? that is the hostname of that server, not the domain name! would be nice to get a quick reply, I am at the customer and this should work asap .... Thanks!

On Mon, 25 Sep 2017 16:54:24 +0200 "Stefan G. Weichinger via samba" <samba at lists.samba.org> wrote: > Am 2017-09-25 um 16:48 schrieb L.P.H. van Belle via samba: > > Arg.. > > > > wbinfo --gid-info=100 > > DC: Confirmed, DOMAIN\Domain Users > > > > Member: Fail. > > failed to call wbcGetgrgid: WBC_ERR_DOMAIN_NOT_FOUND > >

On Fri, 30 Dec 2016 15:52:33 +0100 "Stefan G. Weichinger via samba" <samba at lists.samba.org> wrote: > Am 2016-12-30 um 14:44 schrieb Rowland Penny via samba: > > On Fri, 30 Dec 2016 14:26:01 +0100 > > "Stefan G. Weichinger via samba" <samba at lists.samba.org> wrote: > > > >> Am 2016-12-30 um 14:07 schrieb Rowland Penny via samba:

Am 2017-01-01 um 16:04 schrieb Rowland Penny via samba: > So it looks like you only have 77 users, but cannot have any local Unix > users because your Unix users start at 1000. How do feel about changing > the uidNumbers ? feels scary and I'd like to avoid that :-) > if so, the easiest way will be to open the AD database > with ldbedit: > > ldbedit -e nano -H

Am 2016-12-30 um 17:01 schrieb Rowland Penny via samba: > If everything is setup as above you should be able to join the gentoo > domain member to the domain and then start the nmbd, smbd and winbind > deamons. sad to say: leave and join works without a problem, but then -> winbindd.service - Samba Winbind daemon Loaded: loaded (/usr/lib64/systemd/system/winbindd.service;

# Global parameters [global] interfaces = bond0 log file = /var/log/samba/%m.log log level = 5 auth:5 winbind:8 printcap name = /dev/null realm = SOMEDOM.AT security = ADS username map = /etc/samba/user.map winbind refresh tickets = Yes winbind use default domain = Yes workgroup = ARBEITSGRUPPE idmap config arbeitsgruppe:unix_nss_info = yes idmap config arbeitsgruppe:range =

On Sat, 31 Dec 2016 01:14:46 +0100 "Stefan G. Weichinger via samba" <samba at lists.samba.org> wrote: > Am 30.12.2016 um 19:10 schrieb Rowland Penny via samba: > > >> -d10 please :-) > >> > >> Volker > >> > > > > I would have worked up to that ;-) > > > > But the OP has since posted that he just changed the

Am 2016-12-30 um 14:49 schrieb L.P.H. van Belle via samba: > I think we are mixing 2 things now. > > You corrected DC, thats good. > > > > And the debian server member is the member? No: debian = DC gentoo = former NT4-PDC, upcoming member server / fileserver > > Did you add in /etc/ldap/ldap.conf > > TLS_REQCERT allow on the member? Did that right now. >

Am 22.02.19 um 15:32 schrieb Rowland Penny via samba: >> ARBEITSGRUPPE\Domain Users >> S-1-5-21-2777655458-4002997014-749295002-513 (Domain Group: 2) >> > > Looks correct, try these: > > wbinfo -n Domain\ Users > > wbinfo --group-info=Domain\ Users > > wbinfo --gid-info=10513 > > Rowland root at main:/etc/samba# wbinfo -n Domain\ Users

On Sun, 1 Jan 2017 13:45:11 +0100 "Stefan G. Weichinger via samba" <samba at lists.samba.org> wrote: > Am 2017-01-01 um 13:29 schrieb Rowland Penny via samba: > > > Try checking in AD, as you have classicupgraded, your users should > > have uidNumber attributes. Find the lowest and the highest, do the > > same for groups and if you change to the