[Samba] Domain Upgrade

[Raimund Waimann]

Hi everyone,

I got an old NT4 Domain Controller, which has to be upgraded to an AD DC.
So I first migrated the WindowsNT PDC to a samba3 domain and did a 
classicupgrade with samba-tool.

So far it seemed to work fine. I now have 2 samba4 AD DC running and the 
old Windows NT4 pdc and bdc.
Users in my network can authentcate against the new dcs.

But if a user, which authentcated against the ad is trying to connect to 
a windows NT4 (there are 2 more old servers running) share I keep 
getting an Error, that  it isnt possible to authenticate from this 
Computer (exact message in german: "Mit diesem Konto kann man sich nicht 
von diesem Computer aus anmelden").

Connections to all other shares on linux or windows 2003/2008 servers 
are possible, without any issues.

Can anybody help me with this problem?

Thx 4 your help
Ray

my smb.conf global section:

~# cat /usr/local/samba/etc/smb.conf
# Global parameters
[global]
         workgroup = MYCOMPANY
         realm = mycompany.de
         netbios name = DC1
         server role = active directory domain controller
         idmap_ldb:use rfc2307 = yes
         log file = /var/log/samba/log.%m
         printing bsd
         printcap name = /dev/null
         allow nt4 crypto = yes

Samba log shows:

[2014/03/27 03:29:34.991086,  0] 
../source4/dsdb/kcc/kcc_periodic.c:664(kccsrv_samba_kcc)
   Calling samba_kcc script
[2014/03/27 03:34:35.105251,  0] 
../source4/dsdb/kcc/kcc_periodic.c:664(kccsrv_samba_kcc)
   Calling samba_kcc script
[2014/03/27 03:38:35.033117,  0] 
../auth/ntlmssp/ntlmssp_sign.c:236(ntlmssp_check_packet)
   NTLMSSP NTLM2 packet check failed due to invalid signature!
[2014/03/27 03:39:35.424572,  0] 
../source4/dsdb/kcc/kcc_periodic.c:664(kccsrv_samba_kcc)
   Calling samba_kcc script
[2014/03/27 03:44:35.538867,  0] 
../source4/dsdb/kcc/kcc_periodic.c:664(kccsrv_samba_kcc)
   Calling samba_kcc script
[2014/03/27 03:49:35.860879,  0] 
../source4/dsdb/kcc/kcc_periodic.c:664(kccsrv_samba_kcc)
   Calling samba_kcc script
[2014/03/27 03:52:21.201893,  0] 
../auth/ntlmssp/ntlmssp_sign.c:236(ntlmssp_check_packet)
   NTLMSSP NTLM2 packet check failed due to invalid signature!
[2014/03/27 03:54:35.974844,  0] 
../source4/dsdb/kcc/kcc_periodic.c:664(kccsrv_samba_kcc)
   Calling samba_kcc script
[2014/03/27 03:59:36.311689,  0] 
../source4/dsdb/kcc/kcc_periodic.c:664(kccsrv_samba_kcc)
   Calling samba_kcc script