Join NT Domain : password problem, or so it seems
Damien Veillon
Damien.Veillon at alcatel.fr
Wed Feb 21 17:36:14 GMT 2001
Here is my config :
samba box (newly configured) :
hostname : host201
netbios name : host201
OS : Solaris 7 (+ kernel patch 106541-12)
samba version : 2.0.7
NT domain :
domain name : DOM5
PDC : PDC407
PDC OS : NT 4.0 service pack 5
WINS server : WINS406 which is also NT 4.0 / SP 5
I found an info on the TechNet web from microsoft (article ID:Q154501)
regarding the machine account passwords on PDC's. There is two options
in the registry which are "RefusePasswordChange" and
"DisablePasswordChange".
These are located in the registry key :
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
I will see with my NT guys to check what are the values for these
parameters on the PDC and try to join again. As I am away from my site
tomorrow, I will check that by friday...
I will let you know...
If anyone have any idea, anyway, I would be very pleased !!
Damien.
Roman, James (J.D.) a écrit :
> I've got to say I'm a little stumped by this one. It clearly is an
> authentication problem. Out of curiosity what version of Samba and NT are we
> dealing with?
>
> -----Original Message-----
> From: Damien Veillon [mailto:Damien.Veillon at alcatel.fr]
> Sent: Wednesday, February 21, 2001 7:14 AM
> To: Samba mailing list
> Subject: RE: Join NT Domain : password problem, or so it seems
>
>
>
> A little more infos...
>
> Here are the messages returned by smbpasswd -j with the debug level 4 :
>
> --
> host201 # smbpasswd -j DOM5 -r PDC407 -D 4
> resolve_lmhosts: Attempting lmhosts lookup for name PDC407<0x20>
> startlmhosts: Can't open lmhosts file /usr/local/samba/lib/lmhosts. Error
> was No such file or directory
> resolve_hosts: Attempting host lookup for name PDC407<0x20>
> Connecting to X.Y.233.6 at port 139
> cli_net_req_chal: LSA Request Challenge from PDC407 to HOST201:
> 8CB9F5B242A76A50
> cred_session_key
> cred_create
> cli_net_auth2: srv:\\PDC407 acct:HOST201$ sc:2 mc: HOST201 chal
> 7DA1DA1A70A6EF0D neg: 1ff
> cred_create
> cred_assert
> cred_create
> cli_net_srv_pwset: srv:\\PDC407 acct:HOST201$ sc: 2 mc: HOST201 clnt
> 1866D40E1ABADA75 3a93aeb4
> cli_net_srv_pwset: NT_STATUS_WRONG_PASSWORD
> modify_trust_password: unable to change password for machine HOST201 in
> domain DOM5 to Domain controller PDC407. Error was NT_STATUS_WRONG_PASSWORD.
> 2001/02/21 13:04:04 : change_trust_account_password: Failed to change
> password for domain DOM5.
> Unable to join domain DOM5.
> host201 #
> --
>
> Damien.
>
>
> ------ forwarded message ------
> From: Damien Veillon <Damien.Veillon at alcatel.fr>
> Sujet: RE: Join NT Domain : password problem, or so it seems
> To: Samba mailing list <samba at us5.samba.org>
>
>
> Hi James (and others !)
>
> All the machines are on the same subnet.
> HOST201 (samba box) is X.Y.232.28 with netmask 255.255.252.0
> PDC407 (NT PDC) is X.Y.233.6 with netmask 255.255.252.0
> WINS406 (NT WINS server) is X.Y.233.5 with netmask 255.255.252.0
>
> Here is the result of the "nmblookup -M - -T" command :
>
> --
> host201 # nmblookup -M - -T
> querying `a__MSBROWSE__a on X.Y.235.255
> X.Y.233.5 `a__MSBROWSE__a<01>
> X.Y.233.6 `a__MSBROWSE__a<01>
> X.Y.233.43 `a__MSBROWSE__a<01>
> X.Y.233.42 `a__MSBROWSE__a<01>
> querying `a__MSBROWSE__a on X.Y.235.255
> X.Y.233.5 `a__MSBROWSE__a<01>
> X.Y.233.43 `a__MSBROWSE__a<01>
> X.Y.233.6 `a__MSBROWSE__a<01>
> X.Y.233.42 `a__MSBROWSE__a<01>
> host201 #
> --
>
> ...sounds ok to me !
>
>
> On my first try, I didn't set "Encrypt Passwords = Yes". However, I
> already tried that yesterday (this was one of my tries actually). It
> didn't help. I think this parameter must be set before restarting the
> samba daemons, after a successful join. It rules the authentification
> between the client and the Domain controler (PDC or BDC) but is not
> used during the joining process... well, that's what I understood !
>
>
>
> Roman, James (J.D.) a écrit :
>> Are all the machines on the same subnet? Or more specifically, are you on
>> the same subnet as PDC407? Try "nmblookup -M - -T" and see if your PDC or
>> WINS server comes back.
>>
>> One other distant possibility, have you set Encrypt Passwords = Yes?
>>
>> -----Original Message-----
>> From: Damien Veillon [mailto:Damien.Veillon at alcatel.fr]
>> Sent: Tuesday, February 20, 2001 12:49 PM
>> To: samba at us5.samba.org
>> Subject: RE: Join NT Domain : password problem, or so it seems
>>
>>
>>
>> James, thanks for your answer... unfortunetely your suggestions don't
>> fix my problem !
>>
>> OK, I checked/tried the followings :
>> -> there is no DOM5.HOST201.mac file (actually, the private directory
>> only contains the MACHINE.SID file)
>> -> I removed the samba machine account, waited more than 15 minutes.
>> I then started from scrach (included rm private/MACHINE.SID file)
>> with all the netbios names in CAPS ("netbios name = HOST201",
>> "password server = DOM407" and so on) (by the way, yes, hostname
>> HOST201 is unique on the network !)
>> -> I then re-added the samba server (HOST201) to the domain as a
>> workstation in server manager and tried the "smbpasswd -j DOM5 -r
>> PDC407"
>> line again (I am root, so I have write access to the samba
>> installation directory)
>>
>> I have exactly the same problem :-(
>>
>>
>>
>> Roman, James (J.D.) a écrit :
>> Before you try again. Search to see if there is a (NTDOMAIN NAME).(SAMBA
>> SERVER NAME).mac file on your system. If so delete it. Go back to your
>> NT
>> PDC and remove the samba machines account from server manager. WAIT 15
>> MINUTES FOR THE NT SAM DATABASE TO UPDATE!!!!
>>
>> Now start from scratch. Change your smb.conf, so that netbios name =
>> HOST201
>> (All CAPS) (By the way HOST201 is unique on the network, isn't it?)
>> Re-add
>> the Samba server (HOST201) to the domain as a workstation in server
>> manager.
>> Now try the smbpasswd -j DOM5 -r PDC407 line again (Make sure you are
>> root,
>> and that you have write access to the samba installation directory,
>> probably
>> the same as where your smbpasswd file is located.)
>>
>> Let me know if this helps.
>>
>> -----Original Message-----
>> From: Damien Veillon [mailto:Damien.Veillon at alcatel.fr]
>> Sent: Tuesday, February 20, 2001 11:14 AM
>> To: samba at us5.samba.org
>> Subject: Join NT Domain : password problem, or so it seems
>>
>>
>>
>> Hi everybody,
>>
>> I have a problem with the join NT domain procedure.
>> I would like to use the "security = domain" authentification mode.
>> Therefore, I followed the instructions found in the DOMAIN_MEMBER.txt
>> file, by Jeremy Allison.
>>
>> Here is my config :
>>
>> samba box (newly configured) :
>> hostname : host201
>> netbios name : host201
>> OS : Solaris 7
>> samba version : 2.0.7
>> NT domain :
>> domain name : DOM5
>> PDC : PDC407
>> PDC OS : NT 4 service pack 5
>> WINS server : WINS406 which is also NT 4 / SP 5
>>
>>
>> Here is what I get :
>>
>> step 1 : On the PDC (PDC407), adding the netbios name of the samba box
>> (host201) whith the "server manager for domains" tool, as a "Windows NT
>> workstation or server".
>> => OK.
>>
>> step 2 : stopping the samba daemons on the samba box (host201)
>> => OK.
>>
>> step 3 : joining the domain with the command :
>>
>> smbpasswd -j DOM5 -r PDC407
>>
>> => not OK ; damn !
>>
>> I got the following messages :
>>
>> --
>> host201 # smbpasswd -j DOM5 -r PDC407
>> cli_net_srv_pwset: NT_STATUS_WRONG_PASSWORD
>> modify_trust_password: unable to change password for machine HOST201 in
>> domain DOM5 to Domain controller PDC407. Error was
> NT_STATUS_WRONG_PASSWORD.
>> 2001/02/20 16:29:18 : change_trust_account_password: Failed to change
>> password for domain DOM5.
>> Unable to join domain DOM5.
>> host201 #
>> --
>>
>> Here is an extract of my smb.conf file when in step 1 :
>>
>> --
>> [global]
>> workgroup = DOM5
>> netbios name = host201
>> security = server
>> password server = PDC407
>> wins server = WINS406
>> --
>>
>> I checked the samba mailing list archive from january 2000 to february
>> 2001 but found nothing regarding this problem.
>>
>> I believe that the step 1 phase would create a trust account for the
>> samba box, with a well-known initial trust account password. This
>> allows smbpasswd to join the domain. Maybe there is something wrong in
>> that area ? Unfortunately, I don't know the NT mecanisms well enough to
>> figure out.
>>
>> If anyone has any idea... please help !
>> Thanks,
>> Damien.
>
>
>
>
>
More information about the samba
mailing list