getpwuid(13891) failed Failed to finalize nt token

[capricorn cap]

Hi!

We have plane to upgrade but it will take some time and we have to fix this Samba quickly.
Here is the smb.conf
[global]
workgroup = NUTI.ME
server string = %h server
dns proxy = no
log level = 3
log file = /var/log/samba/log.%m
max log size = 1000
logging = syslog
panic action = /usr/share/samba/panic-action %d
encrypt passwords = true
passdb backend = tdbsam
obey pam restrictions = no
unix password sync = no
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
pam password change = yes
socket options = TCP_NODELAY IPTOS_LOWDELAY
guest account = nobody
load printers = no
disable spoolss = yes
printing = bsd
printcap name = /dev/null
unix extensions = yes
wide links = no
create mask = 0777
directory mask = 0777
use sendfile = yes
aio read size = 16384
aio write size = 16384
local master = no
time server = no
wins support = no
wins server = 192.168.1.30
netbios name = SAMBASERVER1
netbios aliases = SMBSERVER1
interfaces = 192.168.1.10
security = ADS
realm = TP.NUTI.LOCAL
auth methods = winbind
winbind use default domain = Yes
idmap config * : backend        = tdb
idmap config * : range          = 1000000-1999999
idmap config NUTI.ME : backend     = rid
idmap config NUTI.ME : range       = 10000 - 49999
invalid users = root
#======================= Share Definitions =======================
#======================= Home Directories =======================
[homes]
comment = Home directories
browseable = no
writable = yes
create mask = 0600
force create mode = 0600
directory mask = 0700
force directory mode = 0700
valid users = %S
hide special files = yes
follow symlinks = yes
vfs objects =

________________________________
From: samba-technical <samba-technical-bounces at lists.samba.org> on behalf of Rowland Penny via samba-technical <samba-technical at lists.samba.org>
Sent: Wednesday, March 23, 2022 9:51 PM
To: samba-technical at lists.samba.org <samba-technical at lists.samba.org>
Cc: Rowland Penny <rpenny at samba.org>
Subject: Re: getpwuid(13891) failed Failed to finalize nt token

On Wed, 2022-03-23 at 21:41 +0000, capricorn cap via samba-technical
wrote:
> Hi!
> I have joined  4.5.16-Debian to AD.
> sudo net ads testjoin
> Join is OK
> getent passwd works
> getent group works
>
> But When I try to browse from windows computer then I get popup to
> enter username and password.
> Below is the log message.
>
> Kerberos ticket principal name is [xyz at TP.NUTI.LOCAL]
> SID S-1-5-21-774976744-1476728229-930774774-3891 -> getpwuid(13891)
> failed
> Failed to map kerberos pac to server info (NT_STATUS_UNSUCCESSFUL)
>
> Can anyone help me that what can be the solution to fix this issue.
>
> Thanks

Is there some reason why you are still using Debian Stretch ?

Please post your smb.conf

Rowland