[Samba] Users from trusted domains get "Your Password expires today" in 3.4.3

[Deyan Stoykov]

Hello everyone!

We've got a Samba domain that trusts another Samba domain and a Windows 
  Server 2008 domain. We recently upgraded both Samba DCs from 3.0.x to 
3.4.3

After that, whenever a user logs on a workstation in the trusting domain 
with an account from one of the trusted domains, he gets this message:

Your Password expires today. Do you want to change it?

Of course, the password isn't expiring, and no such message appears when 
  users login on a workstation, joined into their domain.

Since both trusted domains, that otherwise have nothing in common, are 
affected, I'm currently looking into the trusting domain. Here's the 
global section of smb.conf on the DC:

[global]
         workgroup = UCCD
         server string =
         interfaces = 127.0.0.1, 172.16.0.9
         passdb backend = ldapsam:"ldap://ldap2.ru.acad.bg/"
         username map = /etc/samba/smbusers
         lanman auth = Yes
         log level = 2
         syslog = 0
         log file = /var/log/samba/%m.log
         max log size = 500
         load printers = No
         printcap name = /dev/null
         disable spoolss = Yes
         add machine script = /usr/sbin/smbldap-useradd -w "%u"
         logon script = etc\welcome.vbs
         logon path = \\orac\%U\Profile
         logon drive = M:
         domain logons = Yes
         domain master = Yes
         wins server = 172.16.0.6, 172.16.0.10
         ldap admin dn = *****
         ldap group suffix = ou=groups
         ldap machine suffix = ou=machines
         ldap passwd sync = yes
         ldap suffix = dc=ru,dc=acad,dc=bg
         ldap user suffix = ou=people
         utmp = Yes
         idmap uid = 10000-25000
         idmap gid = 10000-25000
         hosts allow = *****
         oplocks = No
         level2 oplocks = No

Ideas anyone?

Regards,

Deyan

-- 
Deyan Stoykov, dstoykov at ru.acad.bg
University of Rousse, BG-7017