[Samba] Failed to establish your Kerberos Ticket cache due time differences with the domain controller

[Roy Eastwood]

Thanks Rowland.

> -----Original Message-----
> From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of Rowland
> Penny via samba
> Sent: 21 July 2018 18:04
> To: samba at lists.samba.org
> Subject: Re: [Samba] Failed to establish your Kerberos Ticket cache due time
> differences with the domain controller
> 
> On Sat, 21 Jul 2018 17:36:14 +0100
> Roy Eastwood via samba <samba at lists.samba.org> wrote:
> 
> > >
> > > Try restarting Samba on 'debian-vb'.
> > > If this doesn't help, try 'samba-tool dbcheck' and compare the two
> > > DC's with 'samba-tool ldapcmp'
> > >
> > > Rowland
> > >
> >
> > OK, have tried that but no change.   I used Louis'  script:
> > samba-check-db-repl.sh which includes samba-tool ldapcmp and
> > samba-tool drs showrepl it passes both tests.
> >
> > Roy
> >
> >
> 
> Did you run 'samba-tool dbcheck' ? Louis's script doesn't do this.
> 
> Was this machine provisioned quite a few versions ago ? and then updated
> in place ?
> 'samba-tool time' was changed at sometime (cannot just when) and a
> python module was replaced, but 'make install' did not remove the old
> python script. Check if you have:
> 
> '/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/time.py'
> 
> If you have, delete it.
> 
> Rowland
> 
Sorry, yes I ,meant to say, I ran samba-tool dbcheck and initially it threw up some errors about deleted items (I had recently demoted a DC after the pi-dc was joined) but these were repaired with the --fix option.   I tried the samba-tool time commands afterwards with the same result.    I also had to clean up all the DNS records as the demote command doesn't tidy things up properly.

Whist this is a new domain provision with v 4.8.3, the machine has had versions going back to 4.7.4 compiled and installed (albeit with different domains).  I used make uninstall on the last version of samba before installing 4.8.3 if that makes any difference.   I checked for that time.py file and it's not in that folder (or anywhere else according to find).

Roy