similar to: SPNs for a samba server

Hai,   I've checked out the log you send and i re-read the complete thread.   Based on thats done and what i did see in you logs now, looks like a  * (wildcard)  entry is giving the problem. But i am not sure of that, the wildcard bugs should be fixed, when i look in bugzilla.  (#10435 #12952 )   I've forwarded the mail to Rowland also before we go throw things at you again. ;-)

21.01.2025 13:55, Rowland Penny via samba wrote: > On Tue, 21 Jan 2025 12:51:26 +0300 > Michael Tokarev via samba <samba at lists.samba.org> wrote: > >> Hi! >> >> I'm not sure I understand how SPNs are registered in the AD domain. >> I know when a regular samba server is joined to an AD domain, a few >> SPNs are registered - namely,

On Tue, 21 Jan 2025 12:51:26 +0300 Michael Tokarev via samba <samba at lists.samba.org> wrote: > Hi! > > I'm not sure I understand how SPNs are registered in the AD domain. > I know when a regular samba server is joined to an AD domain, a few > SPNs are registered - namely, CIFS/$netbios_name and each for > CIFS/$netbios_aliases (where netbios name and netbios aliases

On Wed, 22 Jan 2025 09:32:19 +0300 Michael Tokarev via samba <samba at lists.samba.org> wrote: > 21.01.2025 13:55, Rowland Penny via samba wrote: > > On Tue, 21 Jan 2025 12:51:26 +0300 > > Michael Tokarev via samba <samba at lists.samba.org> wrote: > > > >> Hi! > >> > >> I'm not sure I understand how SPNs are registered in the AD

My samba4 (latest git, @ 5f826415) logs seem to be littered with this error: [2013/05/02 13:10:39, 0] ../source4/rpc_server/drsuapi/writespn.c:237(dcesrv_drsuapi_DsWriteAccountSpn) Failed to modify SPNs on CN=AIO6,CN=Computers,DC=corp,DC=example,DC=com: error in module acl: insufficient access rights (50) Any thoughts on debugging this / fixing this issue? It's only this one machine

Please I getting some erros about SPNs and main process ended respawing, bellow the erros that ia m getting at messages log 5 or more machines are getting "Failed to modify SPNs on CN=PC-2902194,OU=XXXXX ,DC=ABC,DC=com,DC=br: error in module acl: Constraint violation (19)" another problem is more serious ... I really need help because the main process of Samba4 is respawing... ad

On 12/17/2014 01:35 AM, Luke Bigum wrote: > Hello, > > We're using Samba 4.1.11 as domain controllers and over the past two weeks I've run into several issues with unrelated Windows software, the problems of which all point to Kerberos authentication and SPNs as being somehow involved. If there are many more issues it might start to get politically difficult *not* to blame the

On Tue, 2016-02-02 at 23:38 +0100, Markus Dellermann wrote: > sometimes I see following in the logs: > /source4/rpc_server/drsuapi/writespn.c:234(dcesrv_drsuapi_DsWriteAcco > untSpn) > Failed to modify SPNs on > CN=PCNAME,CN=Computers,DC=DOMAIN,DC=NAME,DC=NAME,DC=de: error in > module acl: > Constraint violation during LDB_MODIFY (19) I am seeing a very similar message -

On Tue, 7 Aug 2018 13:00:57 +0200 Henry Jensen via samba <samba at lists.samba.org> wrote: > Hi Rowland, > > > On Tue, 7 Aug 2018 09:46:24 +0100 > Rowland Penny via samba <samba at lists.samba.org> wrote: > > > > Failed to modify SPNs on CN=db1,CN=Computers,DC=mydom,DC=lan: acl: > > > spn validation failed for spn[TERMSRV/DB1.MYDOM] uac[0x1000]

Hi Rowland I have no windows DC but only 2 samba AD DCs. This error has been happening for years. I don't know what's the error means and what shoud I do in samba AD DC or Windows domain members. ? 2020/7/22 15:14, Rowland penny via samba ??: > On 22/07/2020 03:33, Adam Xu via samba wrote: >> Hi all >> >> my samba version is 4.12.5 and when a sql server windows

I think "after a sql server windows machine join the domain" should be better. Sorry, but I am not a native English speaker. ? 2020/7/22 15:48, Rowland penny via samba ??: > On 22/07/2020 08:37, Adam Xu via samba wrote: >> Hi Rowland >> >> I have no windows DC but only 2 samba AD DCs. > > Then what is this: 'when a sql server windows machine join the

Hai, Any windows event ID's related to this? These might be handy. I suggest you read : http://www.scomgod.com/?p=155 On the SQL server, to add the SPN, use: setspn ?A <SPN> <Account> Example: setspn -A MSSQLSvc/SCMVPSCOM01.test.COM:1433 TEST\SVCACCOUNT Does the SQL server has an A and PTR record in the DNS? Do verify that. And there is bit more explained .

On Tue, 7 Aug 2018 14:55:24 +0200 Henry Jensen via samba <samba at lists.samba.org> wrote: > On Tue, 7 Aug 2018 12:51:33 +0100 > Rowland Penny via samba <samba at lists.samba.org> wrote: > > > > > > Failed to modify SPNs on CN=db1,CN=Computers,DC=mydom,DC=lan: > > > > > acl: spn validation failed for spn[TERMSRV/DB1.MYDOM] > > > >

On Tue, 2023-01-31 at 10:13 +0300, Michael Tokarev via samba wrote: > 31.01.2023 08:55, Matt Savin via samba ?????: > > In group policies use DNS aliases, then you'll need to change only > > DNS > > entries for these aliases to point to a new host(s). > > I'd say don't use simple dns aliases (cnames) in a DC, but use SPNs > instead > (see samba-tool

On Tue, 7 Aug 2018 17:13:02 +0200 Henry Jensen via samba <samba at lists.samba.org> wrote: > On Tue, 7 Aug 2018 14:59:56 +0100 > Rowland Penny via samba <samba at lists.samba.org> wrote: > > > On Tue, 7 Aug 2018 14:55:24 +0200 > > Henry Jensen via samba <samba at lists.samba.org> wrote: > > > > > On Tue, 7 Aug 2018 12:51:33 +0100 > >

Hello, I've got some log entries like these on our DCs: Failed to modify SPNs on CN=db1,CN=Computers,DC=mydom,DC=lan: acl: spn validation failed for spn[TERMSRV/DB1.MYDOM] uac[0x1000] account[db1$] hostname[(null)] nbname[mydom] ntds[(null)] forest[mydom.lan] domain[mydom.lan] At first I thought it was about missing SPN entries, but adding these did not resolve the problem: # samba-tool

Hi, I'm glad that helped you : ) About SPN, I found that link few days ago: https://adsecurity.org/?page_id=183 It tries to list the string values available usable for SPN. And it gives also that link: http://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spns-setspn-syntax-setspn-exe.aspx That one is a technet paper to explain SPNs. I tried to read it but

Am Donnerstag, 10. März 2016, 10:41:34 CET schrieb mathias dufresne: Hi, Mathias and all thank you for your answer. > Hi all, > > SPN = servicePrincipalName > > A simple search returning all servicePrincipalName declared in your AD: > ldbsearch -H $sam serviceprincipalname=* serviceprincipalname > For me: ldbsearch -H /var/lib/samba/private/sam.ldb serviceprincipalname=*

Hi, sometimes I see following in the logs: /source4/rpc_server/drsuapi/writespn.c:234(dcesrv_drsuapi_DsWriteAccountSpn) Failed to modify SPNs on CN=PCNAME,CN=Computers,DC=DOMAIN,DC=NAME,DC=NAME,DC=de: error in module acl: Constraint violation during LDB_MODIFY (19) In the net i found this "explanation": "LDAP_CONSTRAINT_VIOLATION Indicates that the attribute value specified in

Hi, I have 2 domain controllers with samba4, and i realized i have some missing spns for the second domain controller: > samba-tool spn list dc1$ dc1$ User CN=dc1,OU=Domain Controllers,DC=test,DC=pt has the following servicePrincipalName: ?? ? HOST/dc1.test.pt ?? ? HOST/dc1.test.pt/test[1] ?? ? ldap/dc1.test.pt/test[1] ?? ? GC/dc1.test.pt/test.pt[2] ?? ?