[Samba] 3-part SPN problem after update 4.13.8 to 4.13.14

[Andrew Bartlett]

On Wed, 2021-11-17 at 15:42 +0000, Rowland Penny via samba wrote:
> On Wed, 2021-11-17 at 16:28 +0100, Nikita Druba via samba wrote:
> > I need just to set this value to userAccountControl? Or this task
> > not
> > so 
> > easy?
> 
> Changing the userAccountControl attribute is fairly easy, but the
> question has to be asked, how did it get changed and did anything
> else
> get changed ?

I agree.

> > I will try to run tests today's night.
> 
> I wouldn't.

Yeah, there is no need, we know the issue, it is the data in sam.ldb
not some exotic compiler bug.

> Is this the only DC in the domain ? If not, I would demote it
> (forcibly
> if required), then join a new DC to replace it.

This (just in the other order) is the correct approach, just join a new
DC and demote this faulty one.

Andrew Bartlett

-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst IT - Expert Open Source
Solutions