[Samba] upgrade broke XP workstation logins, variably

[David Mathog]

Help please, a file server was upgraded from:

  Mandriva 2007.1,  Samba 3.0.24-2.7mdv2007.1

to

  Mandriva 2008.1, Samba 3.0.28a-2.1mdv2008.1

and it broke something badly.

After the upgrade logins from all XP workstations broke - some of the
time. For an existing account (one with a profile already in the home
directory) sometimes it will login normally.  Well, almost normally, it
never seems to leave a new copy of the profile on the XP workstation. 
Other times, and this is most attempts, it will put up a "Windows did
not load your roaming profile..." dialog, then after that a "Windows
could not find your local profile...".  Eventually it will sort of login
using a temporary profile (sorry, I have not been able to catch the
exact message yet).

For a normal login, a normal looking workstation log file will appear 
in /var/log/samba/name.log on the server, and will contain both the
"connect to service <username> initially as user <username> (uic=2005,
gid=192) (pid 7156)" message,
and at logout, the "closed connection to service" messages for all of
the mounts (netlogin, <username>, and pdb).

If a new user (valid username, password, home directory, but no existing
profile in that home directory) tries to login it will never succeed. 
The first error message on the XP side is:  "The system could not log
you on.  Make sure that your user name and domain are correct, then type
your password again."  They were.  I can log into that account on linux
with no problems.

I already tried turning off the firewall on the server and it made no
difference.  

SMB folder mounting works 100% reliably.  It is only the domain logins
that are (very) iffy.

tcpdump of failed logins shows a very large number of packets being sent
from the workstation like this:

  xpmachine.caltech.edu.1026 > smbserver.netbios-ssn

with absolutely nothing going back.

log.nmbd has these lines (as if it is working correctly)

  Samba server SAFSERVER is now a domain master browser for workgroup
SAF on subnet 131.215.12.42

  Samba server SAFSERVER is now a local master browser for workgroup SAF
on subnet 13.215.12.42

These are unchanged from the previous version.

The smb.conf was not modified.  It still uses the smbpasswd mechanism.

Anybody have a suggestion what to try next?

Thanks,

David Mathog
mathog at caltech.edu
Manager, Sequence Analysis Facility, Biology Division, Caltech