[Samba] Windows 7 + Samba 3.5.6 = abject misery... [SOLVED]

[Steve Holdoway]

On Thu, 2013-05-23 at 08:28 +1000, Andrew Bartlett wrote:
> On Wed, 2013-05-22 at 10:53 +1200, Steve Holdoway wrote:
> > On Tue, 2013-05-21 at 13:54 +1000, Andrew Bartlett wrote:
> > > On Mon, 2013-05-20 at 09:53 +1200, Steve Holdoway wrote:
> > > > Can anyone help with this? I set it all up a few months ago, the samba
> > > > side being standard upgrades via debian - configured as a PDC, and the
> > > > windows 7 clients being clean installs, with the standard
> > > > lanmanworkstation regedits done.
> > > > 
> > > > They've been working fine since then, but have now started failing,
> > > > instead raising the error message
> > > > 
> > > >  'The trust relationship between this work station and the primary
> > > > domain has failed'
> > > > 
> > > > on the client.
> > > > 
> > > > Any suggestions??
> > > 
> > > One different avenue you might persue is upgrading to Samba 4.0 as an AD
> > > DC.  This will bring Windows 7 back to a server it is much happier with
> > > than the current situation.
> > > 
> > > Or at the very least, consider upgrading the domain as-is to Samba 4.0,
> > > running it as a classic DC.
> > > 
> > > Andrew Bartlett
> > > 
> > 
> > This is a local charity that I support in my spare (non-existant!) time.
> > I'm offsite at the moment, but received this message...
> > 
> > "When Cath tried to logon today she got this message:
> > 
> > There are currently no logon servers available to service the logon
> > request
> > 
> > I have done a small experiment, I can logon as Dawn or Bill on Bill's
> > computer and switch between them but I can't logon as Cath  (get the
> > lack of trust message). On Cath's computer I can't logon as anyone.  On
> > Bill's computer I logged in as Bill then went to Dawn's computer and
> > tried to logon as Dawn and got the no logon servers message."
> > 
> > How on earth has a simple domain been working ok for years, and now end
> > up in this mess?
> > 
> > Is there a simple way to just reset the server-side information so
> > everyone starts with a clean sheet?
> 
> Could it be that the server really is offline or not responding to logon
> requests, and the logins which 'work' are from the local cache?
> 
> Andrew Bartlett
> 
It's possible. Windows never ceases to amaze me in the ways that it
flouts all logic!

Anyway, after another mammoth session today, I finally got these
workstations to talk to the server. 

In the meantime, my failed attempts have upgraded from squeeze default
3.5.6 to sernet's 3.6.15, enabled local admin accounts, left and
rejoined the domain, renamed workstations, destroyed and recreated user
accounts... you get the picture???

In the end,

	server signing = auto -> off

is what fixed the problem. Why half of the PC's were running OK, and the
rest not, I have no idea - could well have been local caching?, but then
how did I join them in the first place! At least I now have a list of
instructions that make the PCs useable again.

Many thanks to all who contributed, especially to Dewayne Geraghty,
who's offline help was immensely useful, went way beyond. Beers are owed
if you're passing.

Cheers,

Steve
-- 
Steve Holdoway BSc(Hons) MNZCS <steve at greengecko.co.nz>
http://www.greengecko.co.nz
MSN: steve at greengecko.co.nz
Skype: sholdowa