similar to: winbindd authentication fails with NT_STATUS_RPC_SEC_PKG_ERROR intermittently

First 'winbind enum' lines, they can and do slow things down in large domains and aren't required at all, getent etc will work without them. there are some old programs that will not work without them, but when was the last time you ran 'finger' for instance ? I made this change and it makes some difference but doesn't fix the issue entirely. Earlier the auth calls used to

>>> What are the DC's ? DC is a read-write windows active directory domain controller on Windows server 2016. >>> Why are you using NTLMv2 ? what is it required for ? The smb client here is a windows server 2016 machine part of a domain and the smb server is on Ubuntu 22.04. The communication between the client and the server uses NTLMv2 while the communication between the

On further investigation, the error that shows up in packet capture is that the DC is returning [Fault: nca_s_fault_sec_pkg_error] for the NetrLogonSamLogonEx call. There are no error logs (or any logs) regarding the netlogon call failure in the netlogon logs even after enabling debug logs in the DC. One more interesting thing is restarting the netlogon.exe service on the DC also fixes the issue

>>> Why are you using a non default port for SMB ? The defaults are 139 and 445. I not aware of the complete details but we have a dependency for the smb server to support multiple domains, so we spin up a container with samba for each of the domains and a front server routes it to the appropriate container. That is the reason for having non-default ports and binding interfaces.

A couple of things possible, from 4.8.0 winbind must be running and your smb.conf is, to be blunt, rubbish. You need to set the workgroup, you need to have idmap config lines for the workgroup, the 'winbind enum' lines only slow things down and 'map untrusted to domain' has been removed. Winbind is running and the workgroup was set as well. I omitted some lines from the smb.conf

> I have never heard of this problem before, but Stefan Metzmacher has > opened an MR: https://gitlab.com/samba-team/samba/-/merge_requests/3162 > And there is a bug report here: > https://bugzilla.samba.org/show_bug.cgi?id=15413 > Could this be your problem ? Thanks, that is the exact problem we are facing. Will it be backported to 4.15? On Tue, Jul 4, 2023 at 6:32?PM Bharath

On Mon, 24 Sep 2018 17:33:47 +0200 Marco Gaiarin via samba <samba at lists.samba.org> wrote: > Mandi! L.P.H. van Belle via samba > In chel di` si favelave... > > > I hope this helps you understanding your problem a bit more. > > See also: > > https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts > > No,

Hello: Platform: CentOS 6.7 x86-64 $ rpm -qa | grep samba samba-common-3.6.23-30.el6_7.x86_64 samba4-libs-4.2.10-6.el6_7.x86_64 ie-samba-utils-3.6.13-7.x86_64 samba-winbind-3.6.23-30.el6_7.x86_64 samba-client-3.6.23-30.el6_7.x86_64 samba-winbind-clients-3.6.23-30.el6_7.i686 samba-winbind-clients-3.6.23-30.el6_7.x86_64 Problems began after requiring SMB signing (I forgot the specifics but it was

On Mon, Jul 03, 2023 at 01:10:26AM +0530, Bharath Bheemarasetti via samba wrote: >On further investigation, the error that shows up in packet capture is that >the DC is returning [Fault: nca_s_fault_sec_pkg_error] for the >NetrLogonSamLogonEx call. There are no error logs (or any logs) regarding >the netlogon call failure in the netlogon logs even after enabling debug >logs in the

I've read the documentation that domain trusts should be fully supported with both Kerberos and NTLM authentication. I've created a new 2016 domain on a Windows box and created a Samba domain on a Linux box with a BIND9_DLZ backend. Both servers can resolve both DNS domains forwards and backwards and I am able to connect a Windows 10 client to the Samba domain without any issues. The

On Mon Jul 31 11:17:57 2023 Mark Foley via samba <samba at lists.samba.org> wrote: > On Jul 31 03:00:37 2023 Rowland Penny via samba <samba at lists.samba.org> wrote: > > > On 30/07/2023 22:24, Mark Foley via samba wrote: > > > That gave me: > > > > > > # host -t A 0d2a3ba9-4ade-45de-85c7-321ba69caee0._msdcs.hprs.local > > > host:

Hi Team, Issue :- I am not able to access samba share on windows client machine with domain name but able to access with IP Further Details:- We had 2 old samba 3.6.6 setup on hp-ux 11iv3, configured as Active Directory member server, We upgraded both hp-ux samba to 4.9.0 version. For a week both setup works fine, In which we were able to access share of both hp-ux machines by domain name from

Hi Rowland >Hi Marcio, we would need more info, where are you migrating the home folders from ? and where to ? I copied Windows Server 2008 folders and permissions with ROBOCOPY to my Samba 4 server. >I know you mentioned a Win 2008 server, are the home folders stored on that ? The personal folders were stored on it (Windows), but now they are on my new Samba 4 file server. >Another

I've just upgraded my DM from samba 4.5 to 4.8, using luois repos (also, debian jessie -> stretch). I'm experimenting some troubles on some shares, seems that both guest access and 'machine account' access does not work. The share is rather simple: [wpkg] browseable = No comment = WPKG Automated Software Deploying System force create mode = 0664 force directory mode =

On Tue, 28 May 2019 11:04:01 +0200 Denis Cardon <dcardon at tranquil.it> wrote: > Hi Mark, > > > Because of other issues using ADUC, I tried to remove a domain member using: > > > >> samba-tool group removemembers "Domain Computers" MARKA\$ > > Removed members from group Domain Computers > > > > As shown, it say it "Removed

On Wed, May 25, 2016 at 2:38 PM, pisymbol . <pisymbol at gmail.com> wrote: > Hello: > > Platform: CentOS 6.7 x86-64 > > $ rpm -qa | grep samba > samba-common-3.6.23-30.el6_7.x86_64 > samba4-libs-4.2.10-6.el6_7.x86_64 > ie-samba-utils-3.6.13-7.x86_64 > samba-winbind-3.6.23-30.el6_7.x86_64 > samba-client-3.6.23-30.el6_7.x86_64 >

On Jul 24 13:30:11 2023 Rowland Penny via samba <samba at lists.samba.org> wrote: > On 24/07/2023 17:46, Mark Foley via samba wrote: > > I removed the new computer from the domain and deleted the smb.conf file. I then > > did: > > > > samba-tool domain join hprs.local DC --option='idmap_ldb:use rfc2307 = yes' -U Administrator [deleted] > It sounds

This spnego stuff makes me think about "client ldap sasl wrapping = sign" to be added in some cases. There are threads related to that posted recently. Disabling spnego is, if I'm not mistaken, disabling Kerberos. Disabling Kerberos should not be what you really want with AD : ) 2016-05-26 13:23 GMT+02:00 pisymbol . <pisymbol at gmail.com>: > On Wed, May 25, 2016 at 2:38

Hai Christian, > Can someone reproduce this? No, tried, but sorry, works fine for me on my 4.11.6 server. And what is you try it like this. samba-tool dns add dc1.zone1.domain.de 0.168.192.in-addr.arpa 157 PTR zone1.domain.de -U Administrator samba-tool dns add dc1.zone1.domain.de 1.168.192.in-addr.arpa 157 PTR zone2.domain.de -U Administrator I tested on my production where i have 6

Hello all. I'm encountering an issue where smbclient seemingly ignores the kerberos ccache as configured in krb5.conf when using "krb5-user" as the kerberos package and will instead always default to using "FILE:/tmp/krb5cc_uid". I tested each valid default ccache name type but smbclient completely ignores whatever is set as the "default_ccache_name" in the conf