[Samba] Samba4 Users can not change their password using ctrl + alt + del

[Nguyen Trung Hieu]

Dear all

Sorry for late, my log /var/log/messages, /var/log/samba/log.samba show
nothing

I don't know how to debug, I 'm sorry!

I also test some cases other

1. Using RSAT on Win7, Administrator reset password (and also checked: User
must change password at next logon) user u01

On other PC

test case 01:

u01 log off (1st) and logon --> u01 still can using old password --> not OK
u01 log off again (2nd) --> u01 can not using old password, must be using
new reseted password

test case 02:

u01 run command gpupdate /force and log off (1st), u01 still can using old
password --> not OK

---------------------------------------------

in test case 01 + 02:

restart PC (1st), u01 must be using new reseted password --> OK

Could you please help me troubleshoot this problem?

Thanks so much!


2014-03-18 11:13 GMT+07:00 Günter Kukkukk <linux at kukkukk.com>:

> Am 18.03.2014 03:52, schrieb Andrew Bartlett:
> > On Sun, 2014-03-16 at 08:54 +0700, Nguyen Trung Hieu wrote:
> >> Dear Samba team
> >>
> >> In my lab: Windows XP/7/8 joined Samba4.1 AD DC OK!
> >>
> >> I don't change any password policy (all are default!)
> >>
> >> But when users logged on sucessfully, they *pressed ctrl + alt + del* in
> >> order to change their passwords (new password included over 8
> characters,
> >> complexity...), but they failed
> >>
> >> I also read this link:
> >>
> >> https://lists.samba.org/archive/samba/2010-September/158171.html
> >>
> >> Could you please help me?
> >
> > What errors are shown on the client and in the server logs?
> >
> > Andrew Bartlett
> >
> >
>
> when i test that here with a win7 ultimate box, i get on the samba side:
>
> kpasswdd: Password change rejected, password changes may not be permitted
> on this account, or the minimum password age may not have elapsed.
>
> in kpasswdd.c -> kpasswd_make_pwchange_reply()
> not all SAM_PWD_* enums are tested, so the switch/default case is taken.
>
> Sorry, have no time to dig deeper with this one.
>
> Cheers, Günter
>
> --
>
>