Samba 4.7.8 - Windows user can't change passwords

Andrew Bartlett abartlet at
Tue Sep 25 02:08:05 UTC 2018

On Mon, 2018-09-24 at 23:40 +0000, Bryant Zimmerman via samba-technical 
> We have a 4.7.8 Samba server running AD 
> We can add computers, Users, and GPO's without issues. 
> For some reason Windows Users can not change their passwords. 
> Our old Samba 4.4 did not have this issue. One of my guys posted earlier on this and was suggested to look at the Kerberos formats. 
> This does not make sense as the users can log in with their passwords, They just are not being allowed to change their passwords. 
> I see in the samba change log  shows a number of changes in 4.7.x where password changing was updated. Is there some kind of new flags or configurations that have to be set?  - I have also setup a brand new 4.7.8 install fresh and it has the issues as well. So this seems to not be related to upgrading our older 4.4.x to 4.7.x 
> Any ideas are appreciated. 

Are you still using the Heimdal KDC (default) in both versions?

Can you try a git bisect between the last working and now not-working

This wasn't intentionally broken, so there isn't any configuration I
can suggest, but do check thinks like bad password lockout and the like
that is now enforced. 

Andrew Bartlett

Andrew Bartlett
Authentication Developer, Samba Team
Samba Development and Support, Catalyst IT

More information about the samba-technical mailing list