[Samba] Printserver after latest MS updates

[Rowland Penny]

On Mon, 2021-10-25 at 10:40 +0200, cn--- via samba wrote:
> I have set "auth_audit"
> 
> log level = 1 auth_audit:3@/var/log/samba/print.log
> 
> And I have tons of these:
> 
> 
> [2021/10/25 10:38:44.484840,  3] 
> ../../auth/auth_log.c:653(log_authentication_event_human_readable)
>    Auth: [DCE/RPC,(null)] user [DOMAIN-02]\[user] at [Mon, 25 Oct
> 2021 
> 10:38:44.484815 CEST] with [NTLMv2] status [NT_STATUS_OK]
> workstation 
> [BR-HOST] remote host [ipv4:X.X.X.X:59409] became [DOMAIN-02]\[user] 
> [S-1-5-21-xxx-xxx-xxx-xxx]. local host [ipv4:X.X.X.X:445]
> 
> 

Try changing the 3 in 'auth_audit' to 2, what you are receiving in the
logs is just Samba telling you that authentication was successful. 

Rowland