[Samba] Cannot change password or create users from Windows

[Matt Jones]

Hope someone can help me here, i'm tearing my hair out.

I got Samba-3.0.0 set up on suse enterprise server 7.  It set up as a 
PDC and works great, everything except changing passwords from a windows 
machine.  When I try to change my password it tells me I do not have 
permission to change my password.  If I go in to User Manager for 
Domains and try to change it I get 'Access is Denied'.  Also if I try to 
add a new user in User Manager it gives me the same 'Access is Denied' 
message, but it does create the unix user and set the password correctly 
which suggests that the add user script and passwd chat are set ok. 
These errors occur when I am logged on as root and as a regular user.

There was a previous message in the mailing list archive, which seems to 
be the same error:

 >Andreas Roth wrote:
 >| i tried to change my password with windows. But i got an error, that 
 >| i don't have the permission to change my password.
 >|
 >| Any sugestions?
 >| A. Roth
 > Be sure that you have it setup to run passwd/smbpasswd as root to
 > change the password.
 > see the HOWTO at
 > http://us1.samba.org/samba/devel/docs/html/Samba-HOWTO-Collection.html
 >
 > If there is anything that is missing or not clear, let us know.
 >
 > (At least I think that's what JHT would say! :))
 >
I have looked thru the docs and also the Using Samba book and I can't 
find any way to do what was suggested.  So if anyone has any suggestions 
or can point out where I should be looking in the howtos then I would be 
very grateful.

smb.conf:

[global]
         netbios name            = KANGA
         workgroup               = BEDWASDEPOT
         server string           = Bedwas Depot PDC %v
         security                = user
         domain logons           = yes
         domain master           = yes
         preferred master        = yes
         local master            = yes
         os level                = 65
         load printers           = yes
         printing                = cups
         printer admin           = @ntadmin, at users
         logon path              = \\%L\%U\profile
         logon home              = \\%L\%U\.profile
         logon script            = login.bat
         logon drive             = H:
         passdb backend          = tdbsam:/opt/samba-3.0.0/passdb.tdb
         encrypt passwords       = yes
         unix password sync      = yes
         passwd program          = /usr/bin/passwd %u
         passwd chat             = *New password* %n\n *new password* 
%n\n *changed*
         add user script         = /usr/sbin/useradd -m %u
         add machine script      = /usr/sbin/useradd -d /dev/null -g 102 
-s /bin/false %u
         add group script        = /opt/samba-3.0.0/bin/smbgrpadd.sh %g
[netlogon]
         comment                 = Netlogon Service
         path                    = /export/netlogon
         admin users             = @ntadmin
         read only               = yes
         write list              = @ntadmin

Thanks
Matt
---------

Matt Jones
Senior Administrator
Peter's Food Service Ltd