[cifs-protocol] Fwd: machine join not working if PacRequestorEnforcement set to 2 (CVE-2021-42287)

David Mulder dmulder at samba.org
Fri Jan 14 18:35:56 UTC 2022

-------- Forwarded Message --------
Subject: machine join not working if PacRequestorEnforcement set to 2 
Date: Fri, 14 Jan 2022 11:35:21 -0700
From: David Mulder <dmulder at samba.org>
To: dochelp at microsoft.com
CC: Ivanova, Nadezhda <nivanova at samba.org>, Bose, Sumit 
<sbose at redhat.com>, Andrew Bartlett <abartlet at samba.org>

An adcli machine join now fails when PacRequestorEnforcement is set to 2 
(as explained in this support doc: 
Sumit has produced a network trace which can be found here: 

What appears to be happening is the Administrator account fails to set 
the machine account password after the account has been created. Can we 
confirm whether this is the correct behavior, and if so, what 
mitigations can we take?

*David Mulder*
Labs Software Engineer, Samba
1221 Valley Grove Way
Pleasant Grove, UT 84062
(P)+1 385.666.5660
dmulder at suse.com

More information about the cifs-protocol mailing list