recurent kerberos error message in Windows XP

[Andrew Bartlett]

On Sun, 2008-07-20 at 20:09 +0400, Matthieu PATOU wrote:
> Dear all,
> 
> 
> I am running Samba4 with a couple of Windows XP computers.
> 
> I started to watch at the windows event log and I see quite often this message
> 
> The kerberos subsystem encountered a PAC verification failure.  This indicates that the PAC from the client mycomputer$ 
> in realm TESTAD.TST had a PAC which failed to verify or was modified.  Contact your system administrator.
> 
> I did some search on internet and find this
> http://support.microsoft.com/?scid=kb%3Ben-us%3B883268&x=2&y=8
> Everything is ok except for the KDC service but I think it's quite logic due to the fact that XP should not act as a 
> kerberos Key Distribution Center (to my mind).
> 
> I am wondering if it's related to samba4 or not at all.

This isn't anything I have seen - it could certainly be a Samba4 error.
We do however have fairly strict 'expected value' tests over this area
of the codebase.   It seems odd that you can log in, but the workstation
trust account has the error. 

Can you reproduce it on a fresh install of WinXP?  You mention 'a couple
of WinXP computers' - do others not show this problem?

Andrew Bartlett

-- 
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/samba-technical/attachments/20080721/04c8090b/attachment.bin