NT ADS Join from Samba 3.6.6+ to Windows Server 2008 ADS fails with ACCESS_DENIED?

Richard Sharpe realrichardsharpe at gmail.com
Mon Feb 11 11:49:41 MST 2013

Hi folks,

We are seeing a Samba 3.6.6+ installation when trying to join a Server
2008 ADS domain fail with ACCESS DENIED.

We use 'net ads join' and see the following during the join process:

SPNEGO login failed: Access denied
failed session setup with NT_STATUS_ACCESS_DENIED

The command seems to only be prepared to use NTLMSSP rather than KRB5.

Is there some policy setting in ADS that enforces KRB5 authentication?
Can they require that the older RPCs not be used?

Richard Sharpe

More information about the samba-technical mailing list