[Samba] Error joining Win2K domain: ads_connect: DSA is unavailable

[Andrew Bartlett]

On Thu, Oct 31, 2002 at 05:14:19AM -0500, Matt Sapp wrote:
> I'm running 3.0alpha (both current CVS pull and alpha20 from dist) and trying to have my samba server join our already in place Win2K ADS domain.  I am able to 'kinit user at DOMAIN' and auth successfully, but upon attempting 'net ads join', I get the following:
> 
> # net ads join -Uadministrator
> administrator password:
> [2002/10/31 05:11:19, 1] libsmb/clikrb5.c:krb5_mk_req2(63)
>   krb5_get_credentials failed for mnu-server$@MNU.EDU (No credentials found with supported encryption types)
> [2002/10/31 05:11:19, 1] utils/net_ads.c:ads_startup(148)
>   ads_connect: DSA is unavailable

You have not got the latest MIT kerberos (you need a snapshot, the 
releases don't seem to support it) and your Administrator password
has not been changed since you upgraded to ADS.  As such the only
password is the MD4 based password from pre-ads, which MIT can't 
use.

Andrew Bartlett