[Samba] windows 10 locking profile files

[Maximilian Kirchner]

I am running samba 4.5.1 on Ubuntu 16.04. The samba server is running as an AD DC and stores the user profiles, the clients are all windows 10 professional.

One user reported being locked out of the profile pretty regularly. After investigating the case I saw that a lot of files in the profile are still locked even after logging out and shutting down the system. After restarting the samba server, the user can log in without problems until he logs out the next time.

Any ideas how to solve this without restarting the samba service every night? Down below the output of smbstatus after every client is shut down. This problem only affects one user (kueck).

root at srv:/usr/local/samba/logs# smbstatus

Samba version 4.5.1
PID Username Group Machine Protocol Version Encryption Signing
----------------------------------------------------------------------------------------------------------------------------------------
23798 SMB\kueck users 192.168.1.17 (ipv4:192.168.1.17:57846) SMB3_11 - AES-128-CMAC
23798 SMB\wie-01007$ SMB\domain computers 192.168.1.17 (ipv4:192.168.1.17:57846) SMB3_11 - AES-128-CMAC
23800 SMB\kueck users 192.168.1.17 (ipv4:192.168.1.17:57852) SMB3_11 - AES-128-CMAC

Service pid Machine Connected at Encryption Signing
---------------------------------------------------------------------------------------------
Profiles 23798 192.168.1.17 Tue Jan 31 21:21:31 2017 CET - AES-128-CMAC
netlogon 23800 192.168.1.17 Tue Jan 31 21:21:34 2017 CET - AES-128-CMAC
IPC$ 23798 192.168.1.17 Tue Jan 31 21:21:44 2017 CET - AES-128-CMAC
datenaustausch 23800 192.168.1.17 Tue Jan 31 21:21:34 2017 CET - AES-128-CMAC
oeffentlich 23800 192.168.1.17 Tue Jan 31 21:21:33 2017 CET - AES-128-CMAC
sysvol 23798 192.168.1.17 Tue Jan 31 21:21:34 2017 CET - AES-128-CMAC
IPC$ 23798 192.168.1.17 Tue Jan 31 21:21:44 2017 CET - AES-128-CMAC
Scanner 23800 192.168.1.17 Tue Jan 31 21:21:34 2017 CET - AES-128-CMAC
home 23800 192.168.1.17 Tue Jan 31 21:21:33 2017 CET - AES-128-CMAC

Locked files:
Pid Uid DenyMode Access R/W Oplock SharePath Name Time
--------------------------------------------------------------------------------------------------
23798 3000047 DENY_NONE 0x100081 RDONLY NONE /zext/Profiles . Tue Jan 31 21:21:44 2017
23800 3000047 DENY_NONE 0x80 RDONLY NONE /ssds/samba/Scanner/kueck . Tue Jan 31 21:21:34 2017
23798 3000047 DENY_NONE 0x12019f RDWR LEASE(RWH) /zext/Profiles kueck.V6/ntuser.ini Tue Jan 31 21:21:47 2017
23798 3000047 DENY_NONE 0x120089 RDONLY LEASE(RWH) /zext/Profiles kueck.V6/ntuser.ini Tue Jan 31 21:21:47 2017
23800 3000047 DENY_NONE 0x100081 RDONLY NONE /usr/local/samba/var/locks/sysvol/smb.wie/scripts . Tue Jan 31 21:21:33 2017
23800 3000047 DENY_NONE 0x80 RDONLY NONE /ssds/samba/datenaustausch . Tue Jan 31 21:21:34 2017
23800 3000047 DENY_NONE 0x80 RDONLY NONE /ssds/samba/home/kueck . Tue Jan 31 21:21:34 2017
23798 3000047 DENY_WRITE 0x12019f RDWR LEASE(RWH) /zext/Profiles kueck.V6/NTUSER.DAT Tue Jan 31 21:21:47 2017
23800 3000047 DENY_NONE 0x80 RDONLY NONE /ssds/samba/oeffentlich . Tue Jan 31 21:21:34 2017