Samba 4.7.8 - Windows user can't change passwords

[Andrew Bartlett]

On Mon, 2018-09-24 at 23:40 +0000, Bryant Zimmerman via samba-technical 
wrote:
> We have a 4.7.8 Samba server running AD 
> We can add computers, Users, and GPO's without issues. 
> 
> For some reason Windows Users can not change their passwords. 
> 
> Our old Samba 4.4 did not have this issue. One of my guys posted earlier on this and was suggested to look at the Kerberos formats. 
> This does not make sense as the users can log in with their passwords, They just are not being allowed to change their passwords. 
> I see in the samba change log  shows a number of changes in 4.7.x where password changing was updated. Is there some kind of new flags or configurations that have to be set?  - I have also setup a brand new 4.7.8 install fresh and it has the issues as well. So this seems to not be related to upgrading our older 4.4.x to 4.7.x 
> 
> Any ideas are appreciated. 

Are you still using the Heimdal KDC (default) in both versions?

Can you try a git bisect between the last working and now not-working
versions?

This wasn't intentionally broken, so there isn't any configuration I
can suggest, but do check thinks like bad password lockout and the like
that is now enforced. 

Andrew Bartlett

-- 
Andrew Bartlett
https://samba.org/~abartlet/
Authentication Developer, Samba Team         https://samba.org
Samba Development and Support, Catalyst IT   
https://catalyst.net.nz/services/samba