[Samba] Going insane (can't logon from Windows)

[Mont Rothstein]

I have Fedora Directory Server (1.0.4) running on a Red Hat Linux (RHEL 4)
with Samba (3.0.10-1.4E.12.2).

I have a Windows XP box that I have successfully joined to the domain.

When I go to login with a domain user I get the following error:

"Windows cannot connect to the domain, either because the domain controller
is down or otherwise unavailable, or because your computer account was not
found."

In the Windows system event log there is the following entry:

"Event Type:    Error
Event Source:    NETLOGON
Event Category:    None
Event ID:    3210
Date:        6/12/2007
Time:        10:08:02 AM
User:        N/A
Computer:    WINXP-CLEAN
Description:
This computer could not authenticate with \\RHEL-CLEAN2, a Windows domain
controller for domain MYDOMAIN, and therefore this computer might deny logon
requests. This inability to authenticate might be caused by another computer
on the same network using the same name or the password for this computer
account is not recognized. If this message appears again, contact your
system administrator.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp
.
Data:
0000: c0000022"


The only thing in smb.log is:

[2007/06/12 11:41:09, 0] lib/util_sock.c:get_peer_addr(1000)
  getpeername failed. Error was Transport endpoint is not connected

The only thing in the machine's samba log is:

[2007/06/12 11:41:09, 0] lib/util_sock.c:get_peer_addr(1000)
  getpeername failed. Error was Transport endpoint is not connected
[2007/06/12 11:41:09, 0] lib/util_sock.c:write_socket_data(430)
  write_socket_data: write failure. Error = Connection reset by peer
[2007/06/12 11:41:09, 0] lib/util_sock.c:write_socket(455)
  write_socket: Error writing 4 bytes to socket 24: ERRNO = Connection reset
by peer
[2007/06/12 11:41:09, 0] lib/util_sock.c:send_smb(647)
  Error writing 4 bytes to client. -1. (Connection reset by peer)


There is nothing in the Fedora log near to when the workstation boots or the
user tries to login.

I can connect to a share on the server from the Windows computer, when
logged in as a local user, using "net view" or entering the path directly
(\\rhel-clean2\sharename\).

I can ping the server from the workstation and vis-a-versa.

I've explicitly added the workstation to the forward and reverse DNS zone
files.

The time of the server and workstation is less than 5 min apart.

I have explicitly added the linux server as a WINS server on the Windows box
(just in case).

All of the Windows diagnostic test I have performed point to the machine's
password being out of sync or various things about group policies for
encryption and such.  I tried turning off all of the related group policies
with no effect.


I am pulling my hair out trying to figure this out.  Any and all help is
appreciated.

smb.conf is below.

Thanks,
-Mont


[global]

# workgroup = NT-Domain-Name or Workgroup-Name
   workgroup = mydomain

# ldap settings
    passdb backend = ldapsam:ldap://mydomain.com:53911
    ldap admin dn = cn=Directory Manager
    ldap suffix = dc=mydomain,dc=com
    ldap user suffix = ou=People
    ldap machine suffix = ou=Computers
    ldap group suffix = ou=Groups

# PDC Settings
    domain logons = yes
    domain master = yes
    local master = yes
    preferred master = yes

# Windows integration settings
    wins support = yes
    logon home = \\%L\%u\profiles
    logon path = \\%L\profiles\%u
    logon drive = H:
    add machine script = /usr/sbin/adduser -n -g machinetrust -c Machine -d
/dev/null -s /bin/false %u

# Log Settings
    log file = /var/log/%m.log
    log file = /var/log/samba/%m.log
    max log size = 50

# Misc Global Settings
    server string = FDS Server
    socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
    os level = 33
    time server = true
    hide files = /desktop.ini/
    dns proxy = no

# Security Settings
   security = user
    obey pam restrictions = yes
    encrypt passwords = yes
   password server = None
    restrict anonymous = 2

#============================ Share Definitions
==============================
   idmap uid = 16777216-33554431
   idmap gid = 16777216-33554431
   template shell = /bin/false
   winbind use default domain = no

[netlogon]
    path = /var/lib/samba/netlogon
    read only = yes
    browsable = no

[profiles]
    path = /var/lib/samba/profiles
    read only = no
    create mask = 0600
    directory mask = 0700
    browseable = no

[homes]
    comment = Home Directories
    browseable = no
    writeable = yes

[repository]
    path = /repository
    guest ok = yes
    writeable = yes
    browseable = yes
    create mask = 0600
    directory mask = 0700
    # Restrict access to only users in the following group(s)
    #valid users = "@shortdomainname\group name"