[Samba] Samba 4.17 AD Cannot connect to shares as administrator
Timo Altun
olol13.samba at the-1337.org
Mon May 18 03:59:24 MDT 2015
Hi Daniel,
thanks for the answer.
We do use one Win 7 Ultimate USB image to install new client pcs. Is that
unusual? Many pcs that were installed with this image could join. I
installed one of the affected pcs with a Win 7 Professional Image and could
join the domain, although I received the same error the first time I tried
to do it. A reboot later it worked.
I tried changing the host names and network cards of the affected
computers, but without success. Unfortunately a couple of those pcs are a
bit more difficult to reinstall and I'd of course still prefer to avoid it.
Greetings,
Timo
On 18 May 2015 at 08:42, Daniel Müller <mueller at tropenklinik.de> wrote:
> So you use images!?
> Are you shure you used different host names for each client.
> We found using install images will do this confusion some times because
> windows announced with the image name not with the new one.
>
>
>
>
> EDV Daniel Müller
>
> Leitung EDV
> Tropenklinik Paul-Lechler-Krankenhaus
> Paul-Lechler-Str. 24
> 72076 Tübingen
> Tel.: 07071/206-463, Fax: 07071/206-499
> eMail: mueller at tropenklinik.de
> Internet: www.tropenklinik.de
>
>
>
> -----Ursprüngliche Nachricht-----
> Von: samba-bounces at lists.samba.org [mailto:samba-bounces at lists.samba.org]
> Im
> Auftrag von Timo Altun
> Gesendet: Samstag, 16. Mai 2015 17:29
> An: samba at lists.samba.org
> Betreff: [Samba] Samba 4.17 AD Cannot connect to shares as administrator
>
> Hi,
>
> I encountered a strange problem...some of my windows machines cannot be
> joined to an Samba 4.17 AD domain (8 of ~90 clients). These are 7 Win7
> clients and one WinXP client.
> The message I receive in windows is: "Logon failure: unknown user name or
> bad password".
> All other Win7 and XP machines could be joined...the same OS image has been
> used to install both the machines that could be joined and those that
> couldn't.
>
> The AD DC is on Debian Jessie with Samba 4.17 from debian sources. Win 7
> clients are Win7 Ultimate SP1, XP is SP3.
>
> If I'm interpreting the logs correctly, it seems the clients are trying to
> join as anonymous, even though I enter the administrators account
> information. I tried using workgroup and realm name, and other domain admin
> accounts to join the computers, but get the same error over and over.
>
> Does somebody have a hint where to look? I'd of course like to avoid
> reinstalling these machines.
> I attached the smb.conf and the log file of a Win7 PC while I was trying to
> join.
>
> Greetings,
> Timo
>
> *smb.conf:*
> # Global parameters
> [global]
> workgroup = MAYWEG
> realm = MAYWEG.NET
> netbios name = SERVER27
> interfaces = lo, eth0
> bind interfaces only = Yes
> server role = active directory domain controller server services = s3fs,
> rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbind, ntp_signd, kcc,
> dnsupdate
> idmap_ldb:use rfc2307 = yes
>
> log file = /var/log/samba/log.%m
> log level = 3
> max log size = 1000
>
> [netlogon]
> path = /var/lib/samba/sysvol/mayweg.net/scripts
> read only = No
>
> [sysvol]
> path = /var/lib/samba/sysvol
> read only = No
>
>
> *Samba-log of a Win7 machine while trying to join:*
> [2015/05/16 17:04:22.607986, 3] ../source3/lib/access.c:338(allow_access)
> Allowed connection from 192.168.111.236 (192.168.111.236)
> [2015/05/16 17:04:22.608616, 3] ../source3/smbd/oplock.c:873(init_oplocks)
> init_oplocks: initializing messages.
> [2015/05/16 17:04:22.609217, 3]
> ../source3/smbd/process.c:1802(process_smb)
> Transaction 0 of length 159 (0 toread)
> [2015/05/16 17:04:22.609385, 3]
> ../source3/smbd/process.c:1405(switch_message)
> switch message SMBnegprot (pid 4587) conn 0x0
> [2015/05/16 17:04:22.611816, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [PC NETWORK PROGRAM 1.0]
> [2015/05/16 17:04:22.612015, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [LANMAN1.0]
> [2015/05/16 17:04:22.612176, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [Windows for Workgroups 3.1a]
> [2015/05/16 17:04:22.612272, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [LM1.2X002]
> [2015/05/16 17:04:22.612397, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [LANMAN2.1]
> [2015/05/16 17:04:22.612520, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [NT LM 0.12]
> [2015/05/16 17:04:22.612643, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [SMB 2.002]
> [2015/05/16 17:04:22.612989, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [SMB 2.???]
> [2015/05/16 17:04:22.613738, 3]
> ../source3/smbd/smb2_negprot.c:243(smbd_smb2_request_process_negprot)
> Selected protocol SMB2_FF
> [2015/05/16 17:04:22.622803, 2]
> ../lib/util/modules.c:191(do_smb_load_module)
> Module 'samba4' loaded
> [2015/05/16 17:04:22.626230, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'gssapi_spnego' registered
> [2015/05/16 17:04:22.626428, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'gssapi_krb5' registered
> [2015/05/16 17:04:22.626515, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'gssapi_krb5_sasl' registered
> [2015/05/16 17:04:22.626591, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'schannel' registered
> [2015/05/16 17:04:22.626657, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'spnego' registered
> [2015/05/16 17:04:22.626752, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'ntlmssp' registered
> [2015/05/16 17:04:22.626841, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'krb5' registered
> [2015/05/16 17:04:22.626911, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'fake_gssapi_krb5' registered
> [2015/05/16 17:04:22.632051, 3]
> ../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
> ldb_wrap open of secrets.ldb
> [2015/05/16 17:04:22.638717, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'sam' registered
> [2015/05/16 17:04:22.638915, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'sam_ignoredomain' registered
> [2015/05/16 17:04:22.639031, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'anonymous' registered
> [2015/05/16 17:04:22.639194, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'winbind' registered
> [2015/05/16 17:04:22.639277, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'winbind_wbclient' registered
> [2015/05/16 17:04:22.639379, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'name_to_ntstatus' registered
> [2015/05/16 17:04:22.639460, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'unix' registered
> [2015/05/16 17:04:22.662528, 3]
> ../source3/smbd/negprot.c:672(reply_negprot)
> Selected protocol SMB 2.???
> [2015/05/16 17:04:22.663344, 3]
> ../source3/smbd/smb2_negprot.c:243(smbd_smb2_request_process_negprot)
> Selected protocol SMB2_10
> [2015/05/16 17:04:22.664437, 3]
> ../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
> ldb_wrap open of secrets.ldb
> [2015/05/16 17:04:22.690034, 3]
> ../source3/smbd/server_exit.c:221(exit_server_common)
> Server exit (NT_STATUS_CONNECTION_RESET)
> [2015/05/16 17:04:22.999939, 3] ../source3/lib/access.c:338(allow_access)
> Allowed connection from 192.168.111.236 (192.168.111.236)
> [2015/05/16 17:04:23.000705, 3] ../source3/smbd/oplock.c:873(init_oplocks)
> init_oplocks: initializing messages.
> [2015/05/16 17:04:23.001398, 3]
> ../source3/smbd/process.c:1802(process_smb)
> Transaction 0 of length 108 (0 toread)
> [2015/05/16 17:04:23.001849, 3]
> ../source3/smbd/smb2_negprot.c:243(smbd_smb2_request_process_negprot)
> Selected protocol SMB2_10
> [2015/05/16 17:04:23.013135, 2]
> ../lib/util/modules.c:191(do_smb_load_module)
> Module 'samba4' loaded
> [2015/05/16 17:04:23.016389, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'gssapi_spnego' registered
> [2015/05/16 17:04:23.016571, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'gssapi_krb5' registered
> [2015/05/16 17:04:23.016671, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'gssapi_krb5_sasl' registered
> [2015/05/16 17:04:23.016750, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'schannel' registered
> [2015/05/16 17:04:23.016882, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'spnego' registered
> [2015/05/16 17:04:23.016985, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'ntlmssp' registered
> [2015/05/16 17:04:23.017066, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'krb5' registered
> [2015/05/16 17:04:23.017156, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'fake_gssapi_krb5' registered
> [2015/05/16 17:04:23.022258, 3]
> ../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
> ldb_wrap open of secrets.ldb
> [2015/05/16 17:04:23.028125, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'sam' registered
> [2015/05/16 17:04:23.028321, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'sam_ignoredomain' registered
> [2015/05/16 17:04:23.028421, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'anonymous' registered
> [2015/05/16 17:04:23.028499, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'winbind' registered
> [2015/05/16 17:04:23.028593, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'winbind_wbclient' registered
> [2015/05/16 17:04:23.028677, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'name_to_ntstatus' registered
> [2015/05/16 17:04:23.028774, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'unix' registered
> [2015/05/16 17:04:23.054566, 3]
> ../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
> ldb_wrap open of secrets.ldb
> [2015/05/16 17:04:23.082930, 3]
> ../auth/ntlmssp/ntlmssp_util.c:34(debug_ntlmssp_flags)
> Got NTLMSSP neg_flags=0xe2088297
> [2015/05/16 17:04:23.084961, 3]
> ../auth/ntlmssp/ntlmssp_server.c:358(ntlmssp_server_preauth)
> Got user=[] domain=[] workstation=[PC65] len1=1 len2=0
> [2015/05/16 17:04:23.085136, 3]
> ../source4/auth/ntlm/auth.c:270(auth_check_password_send)
> auth_check_password_send: Checking password for unmapped user
> []\[]@[PC65]
> auth_check_password_send: mapped user is: [MAYWEG]\[]@[PC65]
> [2015/05/16 17:04:23.085396, 3]
> ../auth/ntlmssp/ntlmssp_sign.c:547(ntlmssp_sign_init)
> NTLMSSP Sign/Seal - Initialising with flags:
> [2015/05/16 17:04:23.085480, 3]
> ../auth/ntlmssp/ntlmssp_util.c:34(debug_ntlmssp_flags)
> Got NTLMSSP neg_flags=0xe2088215
> [2015/05/16 17:04:23.089748, 3] ../source3/lib/access.c:338(allow_access)
> Allowed connection from 192.168.111.236 (192.168.111.236)
> [2015/05/16 17:04:23.090331, 3]
> ../source3/smbd/service.c:612(make_connection_snum)
> Connect path is '/tmp' for service [IPC$]
> [2015/05/16 17:04:23.090587, 3]
> ../source3/smbd/vfs.c:113(vfs_init_default)
> Initialising default vfs hooks
> [2015/05/16 17:04:23.090745, 3] ../source3/smbd/vfs.c:139(vfs_init_custom)
> Initialising custom vfs hooks from [/[Default VFS]/]
> [2015/05/16 17:04:23.090851, 3] ../source3/smbd/vfs.c:139(vfs_init_custom)
> Initialising custom vfs hooks from [acl_xattr]
> [2015/05/16 17:04:23.095703, 2]
> ../lib/util/modules.c:191(do_smb_load_module)
> Module 'acl_xattr' loaded
> [2015/05/16 17:04:23.095910, 3] ../source3/smbd/vfs.c:139(vfs_init_custom)
> Initialising custom vfs hooks from [dfs_samba4]
> [2015/05/16 17:04:23.100971, 2]
> ../lib/util/modules.c:191(do_smb_load_module)
> Module 'dfs_samba4' loaded
> [2015/05/16 17:04:23.101172, 2]
> ../source3/modules/vfs_acl_xattr.c:193(connect_acl_xattr)
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode = true'
> and 'force unknown acl user = true' for service IPC$
> [2015/05/16 17:04:23.109088, 3]
> ../source3/smbd/service.c:856(make_connection_snum)
> 192.168.111.236 (ipv4:192.168.111.236:1174) connect to service IPC$
> initially as user NT AUTHORITY\ANONYMOUS LOGON (uid=65534, gid=3000008)
> (pid
> 4588)
> [2015/05/16 17:04:31.383878, 3] ../source3/smbd/service.c:1130(close_cnum)
> 192.168.111.236 (ipv4:192.168.111.236:1174) closed connection to service
> IPC$
> [2015/05/16 17:04:31.387550, 3]
> ../source3/smbd/server_exit.c:221(exit_server_common)
> Server exit (NT_STATUS_CONNECTION_RESET)
> [2015/05/16 17:04:31.704078, 3] ../source3/lib/access.c:338(allow_access)
> Allowed connection from 192.168.111.236 (192.168.111.236)
> [2015/05/16 17:04:31.704942, 3] ../source3/smbd/oplock.c:873(init_oplocks)
> init_oplocks: initializing messages.
> [2015/05/16 17:04:31.705594, 3]
> ../source3/smbd/process.c:1802(process_smb)
> Transaction 0 of length 159 (0 toread)
> [2015/05/16 17:04:31.705775, 3]
> ../source3/smbd/process.c:1405(switch_message)
> switch message SMBnegprot (pid 4589) conn 0x0
> [2015/05/16 17:04:31.708376, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [PC NETWORK PROGRAM 1.0]
> [2015/05/16 17:04:31.708616, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [LANMAN1.0]
> [2015/05/16 17:04:31.708763, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [Windows for Workgroups 3.1a]
> [2015/05/16 17:04:31.708887, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [LM1.2X002]
> [2015/05/16 17:04:31.709044, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [LANMAN2.1]
> [2015/05/16 17:04:31.709181, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [NT LM 0.12]
> [2015/05/16 17:04:31.709309, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [SMB 2.002]
> [2015/05/16 17:04:31.709438, 3]
> ../source3/smbd/negprot.c:564(reply_negprot)
> Requested protocol [SMB 2.???]
> [2015/05/16 17:04:31.710062, 3]
> ../source3/smbd/smb2_negprot.c:243(smbd_smb2_request_process_negprot)
> Selected protocol SMB2_FF
> [2015/05/16 17:04:31.719910, 2]
> ../lib/util/modules.c:191(do_smb_load_module)
> Module 'samba4' loaded
> [2015/05/16 17:04:31.723681, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'gssapi_spnego' registered
> [2015/05/16 17:04:31.723880, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'gssapi_krb5' registered
> [2015/05/16 17:04:31.723978, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'gssapi_krb5_sasl' registered
> [2015/05/16 17:04:31.724079, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'schannel' registered
> [2015/05/16 17:04:31.724173, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'spnego' registered
> [2015/05/16 17:04:31.724263, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'ntlmssp' registered
> [2015/05/16 17:04:31.724360, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'krb5' registered
> [2015/05/16 17:04:31.724449, 3]
> ../auth/gensec/gensec_start.c:870(gensec_register)
> GENSEC backend 'fake_gssapi_krb5' registered
> [2015/05/16 17:04:31.730008, 3]
> ../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
> ldb_wrap open of secrets.ldb
> [2015/05/16 17:04:31.736065, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'sam' registered
> [2015/05/16 17:04:31.736216, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'sam_ignoredomain' registered
> [2015/05/16 17:04:31.736307, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'anonymous' registered
> [2015/05/16 17:04:31.736427, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'winbind' registered
> [2015/05/16 17:04:31.736491, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'winbind_wbclient' registered
> [2015/05/16 17:04:31.736576, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'name_to_ntstatus' registered
> [2015/05/16 17:04:31.736668, 3]
> ../source4/auth/ntlm/auth.c:673(auth_register)
> AUTH backend 'unix' registered
> [2015/05/16 17:04:31.757056, 3]
> ../source3/smbd/negprot.c:672(reply_negprot)
> Selected protocol SMB 2.???
> [2015/05/16 17:04:31.757823, 3]
> ../source3/smbd/smb2_negprot.c:243(smbd_smb2_request_process_negprot)
> Selected protocol SMB2_10
> [2015/05/16 17:04:31.759042, 3]
> ../lib/ldb-samba/ldb_wrap.c:320(ldb_wrap_connect)
> ldb_wrap open of secrets.ldb
> [2015/05/16 17:04:31.786446, 3]
> ../source3/smbd/server_exit.c:221(exit_server_common)
> Server exit (NT_STATUS_CONNECTION_RESET)
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
>
More information about the samba
mailing list