similar to: Failed to establish your Kerberos Ticket cache due time differences with the domain controller

On 7/21/2018 3:50 PM, Rowland Penny via samba wrote: > On Sat, 21 Jul 2018 14:13:45 +0100 > Roy Eastwood via samba <samba at lists.samba.org> wrote: > >> On Sat, 21 Jul 2018 12:16:42 +0100 >>> Rowland Penny via samba<samba at lists.samba.org> wrote: >>> On Sat, 21 Jul 2018 11:24:47 +0100 >>> Roy Eastwood via samba <samba at

On Sat, 21 Jul 2018 17:01:55 +0200 john doe via samba <samba at lists.samba.org> wrote: > On 7/21/2018 3:50 PM, Rowland Penny via samba wrote: > > On Sat, 21 Jul 2018 14:13:45 +0100 > > Roy Eastwood via samba <samba at lists.samba.org> wrote: > > > >> On Sat, 21 Jul 2018 12:16:42 +0100 > >>> Rowland Penny via samba<samba at

On Sat, 21 Jul 2018 14:13:45 +0100 Roy Eastwood via samba <samba at lists.samba.org> wrote: > On Sat, 21 Jul 2018 12:16:42 +0100 > > Rowland Penny via samba<samba at lists.samba.org> wrote: > > On Sat, 21 Jul 2018 11:24:47 +0100 > > Roy Eastwood via samba <samba at lists.samba.org> wrote: > > > > > "Failed to establish your Kerberos

Thanks for that. > > > Remove the following lines, they shouldn't be in a DC > > > From here: > > >> wins support = no > > >> local master = yes > > >> domain master = yes > > >> preferred master = yes > > > To here. > > > > > > If you have chrony (or ntp) running, then you don't need another

Thanks Louis. Results below. > Hai, > > I've reading this thread more closely. > > I suggest you try the followoing. > > Check the servers hardware clock in the bios first. > Set these within 5 min, if they are not about the same. > There no RTC in the pi; the other DC is running in a VM with RTC set to UTC. I have disabled the guest from getting the time

I did re-read the whole thread again. Im running out of options.. When i look at : https://wiki.samba.org/index.php/PAM_Offline_Authentication You can do these last checks. Run the : Testing offline authentication as show on the wiki. Debian normaly does not have /etc/security/pam_winbind.conf, check if its there if so backup it remove it. Check if these packages are installed.

> > Strange, you say the time is okay, but the error says it isn't. > > Try this, open a terminal on both DC's, run 'date' and 'samba-tool > time' on both. The results should be virtually the same. > > e.g. > root at dc4:~# samba-tool time > Sat Jul 21 16:47:43 2018 BST > root at dc4:~# date > Sat 21 Jul 16:47:46 BST 2018 > >

On Sat, 21 Jul 2018 16:40:58 +0100 Roy Eastwood via samba <samba at lists.samba.org> wrote: > Thanks for that. > > > > > Remove the following lines, they shouldn't be in a DC > > > > From here: > > > >> wins support = no > > > >> local master = yes > > > >> domain master = yes > > > >>

On Sat, 21 Jul 2018 18:59:08 +0100 Rowland Penny via samba <samba at lists.samba.org> wrote: > On Sat, 21 Jul 2018 18:30:48 +0100 > Roy Eastwood via samba <samba at lists.samba.org> wrote: > > > Thanks Rowland. > > > > > -----Original Message----- > > > From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of > > > Rowland

On Sat, 21 Jul 2018 17:09:12 +0100 Roy Eastwood via samba <samba at lists.samba.org> wrote: > > > > Strange, you say the time is okay, but the error says it isn't. > > > > Try this, open a terminal on both DC's, run 'date' and 'samba-tool > > time' on both. The results should be virtually the same. > > > > e.g. > >

I have this warning message when I try to logon using a domain user to the DC itself: "Failed to establish your Kerberos Ticket cache due time differences with the domain controller. Please verify the system time." I have set up PAM using this file: /usr/share/pam-configs/winbind: Name: Winbind NT/Active Directory authentication Default: yes Priority: 192 Auth-Type: Primary Auth:

Hai, I've reading this thread more closely. I suggest you try the followoing. Check the servers hardware clock in the bios first. Set these within 5 min, if they are not about the same. Run : dpkg-reconfigure tzdata Check/set the correct timezones on both servers, and both servers should show you the same date/time and (optional) zone. Run : ntpq -p Check the offset on both servers.

In another thread on this list (https://lists.samba.org/archive/samba/2019-August/225607.html), Rowland suggested that the following command doesn't work ie it still requests the password: samba-tool domain backup online --targetdir=<output-dir> --server=<DC-server> -k yes However, I tried it out on one of my DCs and found it created the backup but failed at the end as this

On 25 September 2019 17:25, Rowland penny wrote: > On 25/09/2019 16:25, Roy Eastwood via samba wrote: > > I have set up a share on a domain member server and am attempting to set the ACLs from a domain-joined Windows 7 computer as > per the > > WiKi at https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs > > > > I want to use one of the BUILTIN

I have set up a share on a domain member server and am attempting to set the ACLs from a domain-joined Windows 7 computer as per the WiKi at https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs I want to use one of the BUILTIN groups, Backup Operators to be able to have Full Control on files in the share (as it will be used for backups). However, when trying to assign the

Hi, I have a Debian Stretch machine with Louis' samba 4.7.1 package installed. I have configured it as a member server and joined it to my test domain. I tried the idmap rid back end and all worked ok, but am now trying the idmap ad back end. I have users' home folders saved to a users share on the member server, configured to allow auto-creation of home folders when the windows user

Thanks Rowland. > -----Original Message----- > From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of Rowland > Penny via samba > Sent: 21 July 2018 18:04 > To: samba at lists.samba.org > Subject: Re: [Samba] Failed to establish your Kerberos Ticket cache due time > differences with the domain controller > > On Sat, 21 Jul 2018 17:36:14 +0100 > Roy

Have joined a new DC to an existing AD and am trying to transfer the fsmo roles to the new DC with a view to retiring the old DC. The forestdns role transfer failed with the error: ERROR(<class 'AttributeError'>): uncaught exception - module 'samba' has no attribute 'drs_utils' all the other roles transferred successfully. The console output is below: root at

> -----Original Message----- > From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of L.P.H. van > Belle via samba > Sent: 24 July 2018 09:41 > To: samba at lists.samba.org > Subject: Re: [Samba] Failed to establish your Kerberos Ticket cache due time > differences with the domain controller > > I did re-read the whole thread again. > > Im running out

Hi, I have a samba 4.7.0 DC installed on a Debian Stretch machine.   I provisioned the domain with rfc2307 enabled and have set the Unix attributes using Windows 7 RSAT/ADUC.   I think I followed the WiKi pages correctly to enable the pam_winbind module in PAM, and have allocated a gID to Domain Users.   After falling foul of the https://bugzilla.samba.org/show_bug.cgi?id=13054 bug, entering net