[Samba] How to change Domain password as normal user?

Mark Foley mfoley at ohprs.org
Fri Apr 13 13:45:14 UTC 2018


On Thu, 5 Apr 2018 16:59:15 +0100 Rowland Penny <rpenny at samba.org> wrote:
>
> On Thu, 05 Apr 2018 11:31:18 -0400
> Mark Foley via samba <samba at lists.samba.org> wrote:
>
> > OK, I'm having issues with the problem.  To summarize, I'm trying to
> > have a normal user change his password from a domain member.  I've
> > tried: passwd, kpasswd and 'samba-tool user password -U $USER
> > --ipaddress=<IPofAD/DC>'.  All mechanisms do change the domain
> > password and I can log into Windows and Linux domain members, and
> > website requiring domain authentication. 
> > 
> > HOWEVER, after 1 to 3 days the account become locked out.  About 2
> > days ago I did the samba-tool method and reported in this thread that
> > it worked.  Today I tried to log into my Windows workstation and was
> > locked out.  The Samba log message was:
> > 
> > [2018/04/05 05:11:38.549997, 2] authentication for user [HPRS/myuser]
> > FAILED with error NT_STATUS_ACCOUNT_LOCKED_OUT
> > 
> > ntlm_auth gives:
> > 
> > Unable to Authenticate: NT_STATUS_ACCOUNT_LOCKED_OUT: Account locked
> > out (0xc0000234)
> > 
> > This all despite the rcpclient saying the expiration is in July.
> > 
>
> The problem here is that you are mixing up an expired password and an
> account that is locked out.
> An account can get logged out for various reasons, but the main one is
> something trying to auth with an old or wrong password. Do you have
> anything that tries to authenticate to AD with the username and
> password, if so, check it is using the right password, mobile phones
> are a favourite place to start.
>
> Rowland

I think there might be a bug.

A week ago I used 'samba-tool user setpassword me' as the domain administrator from the AD
server to reset my normal user domain password.  That worked for the past week with no lockout
issues.  So, yesterday I decided to again try

samba-tool user password -U $USER --ipaddress=mail

from the domain member workstation as the normal user, $USER. Again, that worked. However, once
again today (the next day) I am locked out.

Furthermore, if I try to use samba-tool as the Domain Admin to set the password to the same
value as the locked out one, I still could not get in. I had to change the password to
something different.

This behavior is consistent. If, as the normal user, I change the domain password using
samba-tool from the domain member computer, I get locked out within about a day. If I do the
same as the domain admin, no lockout happens.

I know with certainty this is NOT related to cell phones or other programs trying to repeatedly
authenticate. For one thing, I have no cell phone or remote mail client accessing this domain.
Also, I send an email notice for EVERY failed domain login attempt. There are no such failures
in the samba log.

I think there is a bug afoot. I would be happy to try any tests anyone might suggest.

--Mark

Samba 4.4.16



More information about the samba mailing list