[Samba] cannot join windows 7 samba4-ad-dc fresh install, get NT_STATUS_INTERNAL_ERROR

[Vladimir Frelikh]

Hello,
I've a problem joining windows 7 samba4 ad
I'm doing a completely clean install on debian 9.1
When trying to join AD Win 7 gives me "internal error"
I also get error on "Verifying the File Server" step of the

https://wiki.samba.org/index.php/Setting_up_Samba_as_an_
Active_Directory_Domain_Controller

here's the output:

smbclient -L localhost -U%
session setup failed: NT_STATUS_INTERNAL_ERROR

smbclient //localhost/netlogon -UAdministrator -c `ls`
Enter Administrator's password:
session setup failed: NT_STATUS_INTERNAL_ERROR
------
If you need more info (config, trace, debug, tcpdump etc) I will post it
Please help

provision script, configs and log are below:

samba-tool domain provision --server-role=dc --use-rfc2307
--dns-backend=SAMBA_INTERNAL --realm=RONA.LOC --domain=RONA
--adminpass=<mypassword>
------
cat /etc/debian_version
9.1
------
cat /etc/samba/smb.conf
# Global parameters
[global]
        netbios name = SAMBADC
        realm = RONA.LOC
        workgroup = RONA
        dns forwarder = 192.168.19.1
        server role = active directory domain controller
        idmap_ldb:use rfc2307 = yes
        log level = 5

[netlogon]
        path = /var/lib/samba/sysvol/rona.loc/scripts
        read only = No

[sysvol]
        path = /var/lib/samba/sysvol
        read only = No
------
cat /etc/krb5.conf
[libdefaults]
        default_realm = RONA.LOC
        dns_lookup_realm = false
        dns_lookup_kdc = true
------
cat /etc/resolv.conf
domain rona.loc
nameserver 192.168.19.2
------
cat /etc/hosts
127.0.0.1       localhost
::1             localhost ip6-localhost ip6-loopback
ff02::1         ip6-allnodes
ff02::2         ip6-allrouters
192.168.19.2    sambadc.rona.loc sambadc
------
kinit administrator at RONA.LOC
Password for administrator at RONA.LOC:
Warning: Your password will expire in 41 days on Tue Sep 19 20:53:26 2017
------
klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator at RONA.LOC

Valid starting     Expires            Service principal
08/08/17 23:23:40  08/09/17 09:23:40  krbtgt/RONA.LOC at RONA.LOC
        renew until 08/09/17 23:23:37
------
log file of the joining windows 7 session:
log.out
(38 КБ)
<https://mail.google.com/mail/u/0/?ui=2&ik=7f6f030913&view=att&th=15dc2ba7d7a63129&attid=0.1&disp=safe&realattid=f_j63tfts50&zw>


--
Best regards, Vladimir