[Samba] After some time "denied due to share security descriptor"

[Alessandro Briosi]

Hi all,
I'm using samba 4.1.20 (from sernet) with 2 AD servers and 1 as file 
server.

It happens that after some time (days), some users report that they 
cannot access the shares on the file server any-more, and I find the 
following entries in the log file:

STATUS=daemon 'smbd' finished starting up and ready to serve 
connectionsuser DOMAIN\pc-name$ connection to sharename denied due to 
share security descriptor.
STATUS=daemon 'smbd' finished starting up and ready to serve 
connectionsuser DOMAIN\pc-name$ connection to sharename denied due to 
share security descriptor.

Killing the specific smbd process serving the client restores the access 
(obviously creating a new process).

PCs don't get rebooted often (basically they are always on).

It takes days to happen again then. Is this related to some kerberos 
security?

Is this known? Anybody experiencing it?

Thank you.
Alessandro