[Samba] Windows XP SP3 cannot join to the Samba AD domain on Debian 11 4.17.10

[Michael Tokarev]

12.09.2023 22:36, Andrew Bartlett via samba:
> Thanks.  Can you please write up a wiki page with these details?

Andrew, are you sure we wan this info easily findable on the wiki? :)
I mean, it is terrible, it really is.. I wonder if Microsoft allows
to join WinXP machines to the current AD domain.  The thing is that
whole thing should not be used in 2023+, period.  Yes, I understand
there might be various interesting use cases, but that often can be
done on a stand-alone WinXP machine, not joined to a domain, - so the
whole domain isn't crippled.

It's interesting that Win2003 does not require all the same low-security
settings.

BTW, Paolo, I'm curious, - which licensing concerns/issues do you have?
Microsoft does not sell these versions of windows anymore.  But granted,
I've no idea what actual terms applies to already sold products now, way
past end-of-life.

Myself, I can't say I'm a "software pirate", but I do use many versions
of windows on my own home machine - to test how windows behaves in various
versions of QEMU and sometimes test them with samba too, - to ensure we
ship good samba or qemu able to run windows. I don't have licenses for
them, and I've no idea if such usage is legal or not (more likely not)..

> This does disable all AES use, it is unfortunate that you had to set
> the supported enctypes = 4, there may be a better way to do this.
[...]