[Samba] Printserver after latest MS updates

[Achim Gottinger]

Am 25.10.2021 um 11:14 schrieb L.P.H. van Belle via samba:
>> Hello Christian and Louis,
>>
>> I assume both of you use domain accounts for testing. 
> Yes, that is correct. 
>
>> Does  printing and connecting new printers also work with local non 
>> domain accounts? 
> I dont have any "none domain" accounts here. 
>
>> Here this (local account printing) works 
>> with Windows 11 but not with Windows 10 LTSC ( I assume 
>> windows server 2019 will be affected as well). I did not 
>> release the Oktober Update on our WSUS servers here, but last 
>> Friday an work colleague called because he could no longer 
>> print to the office from his home office pc (Windows 10 Pro, 
>> local account). Afterwards I started testing and posted 
>> results here a few days ago for comparison.
> I do have 2 windows 11 pc's currenlty these also work as far i know.
> I'll let that user print some for me. 
> All windows 10 versions i have running are 2004 or up. 
>
Thank you for the reply.
For sake of completeness I tried it with Windows Server 2019 Version 1809 Update 2021-10 installed.
Again no issues with domain accounts but with an local administrator if i try to connect an printer an credential window pops up and after entering domain credentials again an dialog pops up saying
the account is not allowed to install/access this printer.
So only Windows 11 seems to work with local accounts. The collegue first having the problem here uses  Windows 10 21H2.

This is the log (level 2) with when I connect to a printer (debian stretch samba 4.10) from server 2019 logged in with an domain account. Seems to be all kerberos here.

Okt 25 11:39:57 ad-test smbd[57830]: [2021/10/25 11:39:57.715406,  4] ../../auth/auth_log.c:751(log_successful_authz_event_human_readable)
Okt 25 11:39:57 ad-test smbd[57830]:   Successful AuthZ: [spoolss,ncacn_np] user [TEST]\[Administrator] [S-1-5-21-XXX-500] at [Mo, 25 Okt 2021 11:39:57.715385 UTC] Remote host [ipv4:192....:50475]
local host [ipv4:192....:445]
Okt 25 11:39:57 ad-test smbd[57830]: [2021/10/25 11:39:57.814763,  4] ../../auth/auth_log.c:751(log_successful_authz_event_human_readable)
Okt 25 11:39:57 ad-test smbd[57830]:   Successful AuthZ: [spoolss,ncacn_np] user [TEST]\[Administrator] [S-1-5-21-XXX-500] at [Mo, 25 Okt 2021 11:39:57.814742 UTC] Remote host [ipv4:192....:50475]
local host [ipv4:192....:445]
Okt 25 11:39:57 ad-test smbd[57830]: [2021/10/25 11:39:57.914702,  4] ../../auth/auth_log.c:751(log_successful_authz_event_human_readable)
Okt 25 11:39:57 ad-test smbd[57830]:   Successful AuthZ: [spoolss,ncacn_np] user [TEST]\[Administrator] [S-1-5-21-XXX-500] at [Mo, 25 Okt 2021 11:39:57.914680 UTC] Remote host [ipv4:192....:50475]
local host [ipv4:192....:445]
Okt 25 11:39:58 ad-test smbd[57830]: [2021/10/25 11:39:58.020295,  4] ../../auth/auth_log.c:751(log_successful_authz_event_human_readable)
Okt 25 11:39:58 ad-test smbd[57830]:   Successful AuthZ: [spoolss,ncacn_np] user [TEST]\[Administrator] [S-1-5-21-XXX-500] at [Mo, 25 Okt 2021 11:39:58.020273 UTC] Remote host [ipv4:192....:50475]
local host [ipv4:192....:445]

Same test environment local account not working printer connect attempt:

Okt 25 11:43:16 ad-test smbd[57852]: [2021/10/25 11:43:16.553308,  2] ../../auth/auth_log.c:647(log_authentication_event_human_readable)
Okt 25 11:43:16 ad-test smbd[57852]:   Auth: [SMB2,NTLMSSP] user [S2019-TEST]\[Administrator] at [Mo, 25 Okt 2021 11:43:16.553281 UTC] with [NTLMv2] status [NT_STATUS_WRONG_PASSWORD] workstation
[S2019-TEST] remote host [ipv4:192....:59221] mapped to [S2019-TEST]\[Administrator]. local host [ipv4:192....:445]
Okt 25 11:43:16 ad-test smbd[57853]: [2021/10/25 11:43:16.648050,  2] ../../auth/auth_log.c:647(log_authentication_event_human_readable)
Okt 25 11:43:16 ad-test smbd[57853]:   Auth: [SMB2,NTLMSSP] user [S2019-TEST]\[Administrator] at [Mo, 25 Okt 2021 11:43:16.648022 UTC] with [NTLMv2] status [NT_STATUS_WRONG_PASSWORD] workstation
[S2019-TEST] remote host [ipv4:192....:59222] mapped to [S2019-TEST]\[Administrator]. local host [ipv4:192....:445]
Okt 25 11:43:16 ad-test smbd[57854]: [2021/10/25 11:43:16.683346,  2] ../../auth/auth_log.c:647(log_authentication_event_human_readable)
Okt 25 11:43:16 ad-test smbd[57854]:   Auth: [SMB2,NTLMSSP] user [S2019-TEST]\[Administrator] at [Mo, 25 Okt 2021 11:43:16.683315 UTC] with [NTLMv2] status [NT_STATUS_WRONG_PASSWORD] workstation
[S2019-TEST] remote host [ipv4:192....:59223] mapped to [S2019-TEST]\[Administrator]. local host [ipv4:192....:445]