similar to: recommended smb.conf configuration for AD with realm+sssd

Adam, you already tried my suggestions? What do you see here: > Failed to modify SPNs on CN=SEC-CON03,CN=Computers,DC=domain,DC=com: > acl: spn validation failed for ... ^^^^^^ So read the links below and post your results The event id you showed, for now can be ignored. Inrelevant (for now). And mostlikly wil disapear when you added/fixed the "correct" spn's On

Release Announcements ===================== This is the second release candidate of Samba 4.9. This is *not* intended for production environments and is designed for testing purposes only. Please report any defects via the Samba bug reporting system at https://bugzilla.samba.org/. Samba 4.9 will be the next version of the Samba suite. UPGRADING ========= NEW FEATURES/CHANGES

Release Announcements ===================== This is the second release candidate of Samba 4.9. This is *not* intended for production environments and is designed for testing purposes only. Please report any defects via the Samba bug reporting system at https://bugzilla.samba.org/. Samba 4.9 will be the next version of the Samba suite. UPGRADING ========= NEW FEATURES/CHANGES

Hi Mathias and all. Am Donnerstag, 24. März 2016, 13:26:12 CEST schrieb mathias dufresne: > Hi, > > I'm glad that helped you : ) > > About SPN, I found that link few days ago: > https://adsecurity.org/?page_id=183 > It tries to list the string values available usable for SPN. > > And it gives also that link: >

Hi everyone, after a classicupgrade from a samba3 domain to a samba4, I have a weird issue related to DCOM and named pipes. The switch to samba4 went fine and everything works perfectly except one old software that uses Windows named pipes and DCOM for client-server communication. When trying to access the DCOM server the software fails. The failure can be easily reproduced with a simple

I'm attempting to get an old NT4 client participating in a Samba4 domain. Users can logon to the machine locally and access network shares on other machines in the network. However, no one can access shares on the NT4 machine using the machine name. Attempting this results in an error "The account is not authorized to log in from this station." Using the IP address does work however.

"Good day. Briefly about the situation. Installed sernet-samba4 (Version 4.2.3-SerNet-RedHat-18.el7, CentOS Linux release 7.1.1503, 3.10.0-229.7.2.el7.x86_64), AD domain is set up and works fine, windows servers and workstations added to the domain, no problem. Also added to the domain 2 hypervisor Hyper-V 2012R2. Faced with the next issue, I can not configure the replication and migration

Release Announcements ===================== This is the third release candidate of Samba 4.9. This is *not* intended for production environments and is designed for testing purposes only. Please report any defects via the Samba bug reporting system at https://bugzilla.samba.org/. Samba 4.9 will be the next version of the Samba suite. UPGRADING ========= NEW FEATURES/CHANGES

Release Announcements ===================== This is the third release candidate of Samba 4.9. This is *not* intended for production environments and is designed for testing purposes only. Please report any defects via the Samba bug reporting system at https://bugzilla.samba.org/. Samba 4.9 will be the next version of the Samba suite. UPGRADING ========= NEW FEATURES/CHANGES

Hi all my samba version is 4.12.5 and when a sql server windows machine join the domain, It shows error in samba : Failed to modify SPNs on CN=SEC-CON03,CN=Computers,DC=domain,DC=com: acl: spn validation failed for spn[E3514235-4B06-11D1-AB04-00C04FC2DCD2-ADAM/SEC-CON03:389] uac[0x1000] account[SEC-CON03$] hostname[SEC-Con03.domain.com] nbname[DOMAIN] ntds[(null)] forest[domain.com]

Hi everyone, I have a samba DC, let's call it dc1.ad.example.com. I have two members of the domain - server1.ad.example.com and server2.ad.example.com.?? They are not running smbd and winbind. Instead, they are running SSSD with AD backend. I want to create an NFSv4 export on server1.ad.example.com and mount it on server2.ad.example.com (say, sec=krb5). I found some instructions online

Hi again, Am Montag, 14. März 2016, 00:44:47 CET schrieb Markus Dellermann: > Am Donnerstag, 10. März 2016, 10:41:34 CET schrieb mathias dufresne: > Hi, Mathias and all > thank you for your answer. > > > Hi all, > > > > SPN = servicePrincipalName > > > > A simple search returning all servicePrincipalName declared in your AD: > > ldbsearch -H $sam

I made some progress with the issue, but didn't solve it completely It's basically a kind of bug (i'm not sure if it's on kerberos side or samba, I think samba is the culprit here (?). Microsoft uses kind of weird SPN for Hyper-V. Weird as there are "spaces" in the string - which is kind of unique as far as SPN's go, usually SPN form a complete string. So I kind

Hello, I've setup over 6 months ago samba 4 AD on centos 7.3 (self compiled from source). Up until now I didn't encounter any undocumented errors. I have 3 DC's (all samba 4.5.3) which are working pretty nice with over 60 windows clients. The issue I've stumbled upon is when I added Windows server Hyper-V hosts to the domain. Tried with Hyper-V from 2012, 2012r2 and new 2016

Hello, I have now spent 30 hours trying to get this working, so it's time to get some professinoal help. :) In a nutshell, I would like to have a sambda AD PDC that authenticates both Windows and Debian. On Linux, I would like to use SSSD. I have followed the steps on the wiki: - https://wiki.samba.org/index.php/Samba_AD_DC_HOWTO -

Hi guys am looking for some guidance on how I can generate some keytab files from a samba 4 DC I been following a tutorial that states some bits on the windows side such as creating an spn C:\Users\Administrator>setspn -A host/test.sondrel.com at SONDREL.COM Test Registering ServicePrincipalNames for CN=Test,OU=Machines,DC=sondrel,DC=com host/envy.sondrel.com at SONDREL.COM Updated

Hi, I'm glad that helped you : ) About SPN, I found that link few days ago: https://adsecurity.org/?page_id=183 It tries to list the string values available usable for SPN. And it gives also that link: http://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spns-setspn-syntax-setspn-exe.aspx That one is a technet paper to explain SPNs. I tried to read it but

Hello Kevin, We have a  Samba/Windows20008R2 domain that's been running a few years now. Here are the details: * clients auth with SSSD (ldap, kerberos, ldap_schema=rfc2307bis) * idmap * samba on clients/server for joining domain We have scripts that automatically create users with UnixHomeDir, UID and GUID numbers within AD. I don't know about using WInbind...  I dropped that

Hai, Any windows event ID's related to this? These might be handy. I suggest you read : http://www.scomgod.com/?p=155 On the SQL server, to add the SPN, use: setspn ?A <SPN> <Account> Example: setspn -A MSSQLSvc/SCMVPSCOM01.test.COM:1433 TEST\SVCACCOUNT Does the SQL server has an A and PTR record in the DNS? Do verify that. And there is bit more explained .

I'm not an expert, especially when it comes to servicePrincipalName which I haven't understood until now but I think it is safe to give an object the right to modify itself. If securing is one of your main concern, you could try to remove the possibility to that account to modify itself, once the servicePrincipalName is created. Doing that SPN should NOT be removed (no right to remove it)