[Samba] Dynamic dns updates fail for (most) xp, vista and win7 clients

[Felix Mason]

Hi 

Banging my head against a wall with this. Dynamic dns updates for windows clients are failing.

Log exceprt:

Apr 13 00:20:50 server named[30147]: samba_dlz: disallowing update of signer=newboywin7\$\@example.lan name=newboywin7.example.lan type=AAAA error=insufficient access rights
Apr 13 00:20:50 server named[30147]: client 192.168.12.205#61162: updating zone 'example.lan/NONE': update failed: rejected by secure update (REFUSED)
Apr 13 00:20:50 server named[30147]: samba_dlz: cancelling transaction on zone example.lan
Apr 13 00:20:50 server named[30147]: samba_dlz: starting transaction on zone example.lan
Apr 13 00:20:50 server named[30147]: client 192.168.12.205#62052: update 'example.lan/IN' denied
Apr 13 00:20:50 server named[30147]: samba_dlz: cancelling transaction on zone example.lan
Apr 13 00:20:50 server named[30147]: samba_dlz: starting transaction on zone example.lan
Apr 13 00:20:50 server named[30147]: samba_dlz: disallowing update of signer=newboywin7\$\@example.lan name=newboywin7.example.lan type=AAAA error=insufficient access rights
Apr 13 00:20:50 server named[30147]: client 192.168.12.205#64861: updating zone 'example.lan/NONE': update failed: rejected by secure update (REFUSED)

First two clients I got this problem with were winxp and win7. I did the following:
sudo samba_upgradedns --dns-backend=BIND9_DLZ 
They started working. Since then I have the same problem and this doesn't resolve the issue.

Someone previously suggested this 
ldbdel -H /opt/samba4/private/sam.ldb "DC=wxp1,DC=Kernevil.lan,CN=MicrosoftDNS,DC=Kernevil,DC=lan"

It doesn't work I don't find any entries for the affected workstations + they were not added to the domain with beta versions of samba.

I'm running Zentyal which is a version of ubuntu 12.4, samba package 4.0.4-zentyal1.

Have posted a question to there formum (with no success here) http://forum.zentyal.org/index.php/topic,14152.0.html <http://forum.zentyal.org/index.php/topic,14152.0.html> 

Any help appreciated - this is infuriating.

cheers

sean