[Samba] After some time "denied due to share security descriptor"

[Rowland Penny]

On 15/09/15 08:34, Alessandro Briosi wrote:
> Hi all,
> I'm using samba 4.1.20 (from sernet) with 2 AD servers and 1 as file 
> server.

Yes, but on what OS ?

>
> It happens that after some time (days), some users report that they 
> cannot access the shares on the file server any-more, and I find the 
> following entries in the log file:
>
> STATUS=daemon 'smbd' finished starting up and ready to serve 
> connectionsuser DOMAIN\pc-name$ connection to sharename denied due to 
> share security descriptor.
> STATUS=daemon 'smbd' finished starting up and ready to serve 
> connectionsuser DOMAIN\pc-name$ connection to sharename denied due to 
> share security descriptor.

Very good, but is there anything else in the log ?
Is there anything in the event log on the client ?

>
> Killing the specific smbd process serving the client restores the 
> access (obviously creating a new process).
>
> PCs don't get rebooted often (basically they are always on).
>
> It takes days to happen again then. Is this related to some kerberos 
> security?

Don't know, you haven't posted your smb.conf & krb5.conf files

Rowland

>
> Is this known? Anybody experiencing it?
>
> Thank you.
> Alessandro
>