[Samba] Samba AD DC: users cannot change expired passwords

[Rowland Penny]

On Mon, 25 Sep 2023 16:47:57 +0200
"Pluess, Tobias via samba" <samba at lists.samba.org> wrote:

> Hi Rowland,
> 
> yes I also got this message that was from Kees but signed by me. I
> did not send it. But I did send the very first message, though.

It confused me no end, can I suggest that if anyone replies to a samba
mailing list post, they just reply to the list, do not 'CC' anyone else
and do not reply to anyone else. That way, anyone who is subscribed to
the list will get the reply.

> I just checked the logs on the DC. There is nothing relevant in
> there. I cannot see any errors whatsoever.
> The strange thing is:
> 
> When the password is expired, the user can, on the Windows 10 login
> page, literally enter ANY password, and gets the message "your
> password is expired" and when the user tries to change his password,
> no matter if the correct or a random password is entered as the old
> password, the message "password expired" appears again and the login
> is stuck in this forever loop unless "cancel" is clicked, which, of
> course, cancels the login.

I think that the password may or may not be changing, but either way,
the other relevant attributes do not seem to be being reset. Note,
this all guess work.

> 
> So I checked every log file under /var/log/samba on my DCs (I have
> two off them, dc0 and dc1, which are rsync'ed).
> Let me know which config I shall change to increase the loglevel and
> I will do that and post the logs here.

Raising the loglevel on any Samba machine is fairly easy, you just add
the very aptly named parameter 'log level' to the global part of the
smb.conf , this should also point to a number, the higher the number,
the bigger the log. For instance, add 'log level = 3' will make Samba
log at level 3, you could try raising this number until something
possibly 'pops' out, The maximum level I would go to would be 10, but
beware, the logs at that level will be very large. You will also need
to restart your DC after adding the parameter or changing the log level.

Rowland