[Samba] net ads info: failed to get server's current time

[Rowland Penny]

On 22/10/15 21:51, Guy-Laurent Subri wrote:
> On Wed, Oct 21, 2015 at 07:06:33PM +0100, Rowland Penny wrote:
>> On 21/10/15 18:35, Guy-Laurent Subri wrote:
>>> Hi all,
>>> We're having issues with Samba at work. I've searched a bit and the 
>>> only
>>> thing that have caught my eye is this: when I run the 'net ads info'
>>> command on our DC --we have a Debian on which samba4 is installed and
>>> configured as a AD DC-- I have the message "Failed to get server's
>>> current time!", and "Server time: Thu, 01 Jan 1970 01:00:00 CET".
>>
>> It works for me on a Debian 4.1.17 DC, so you may have something
>> mis-configured, have you altered the smb.conf in any way ?
>
> I don't think the modifications I did to smb.conf are relevant enough to
> cause problem, but here's our smb.conf, just in case:
>
> # Global parameters
> [global]
>    workgroup = TRS-CH
>    realm = TRS-CH.COM
>    netbios name = PDC
>    server role = active directory domain controller
>    server services = +s3fs, +rpc, +nbt, +wrepl, +ldap, +cldap, +kdc, 
> +drepl,
>                        +winbind, +ntp_signd, +kcc, +dnsupdate
> [netlogon]
>   path = /var/lib/samba/sysvol/trs-ch.com/scripts
>   read only = No
>
> [sysvol]
>   path = /var/lib/samba/sysvol
>   read only = No
>
>> do you have ntp installed and configured correctly ?
> Yes, I have it installed and everything works fine.
>
> I also already tested the DNS by running the commands described here:
> https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller 
>
> Everything is reachable.
>
> I tested kerberos by doing:
> 'kinit administrator at TRS-CH.COM'
> It showed up when I did 'klist'.
>
> Do you need more information ?
>
> Thanks !
> Cheers,
> Guy-Laurent Subri

Are you running with Bind9 ?

I think you need to remove all the '+' signs you have added to the 
'server services' line, you normally only use the '+' sign to add a 
service to the line, I think you may still be using the un-shown 'dns' 
option.
I would also recommend that you use the new separate 'winbindd' instead 
of the 'winbind' that you are using. I think that before long the old 
'winbind' built into the samba daemon is going to disappear, so you 
might as well get used to it now.

Rowland