[Samba] Windows 10 clients unable to work on domain after update of windows (on client) and samba on dc

[Fabio Fantoni]

Hi, 2 days ago I updated the 2 samba domain controllers debian on latest 
version of debian stable (that should include support for windows client 
with july update), I also updated windows 10 clients with latest windows 
update of latest months

after that with all patched for latest updates support the domain don't 
works on the windows 10 clients, I already tried for hours many things, 
rejoin domain, remove latest windows update (but one fails to uninstall, 
also in safe mode), restore backup of dc controller, update to samba 
4.18.5 from mjt repository, etc... but nothing worked

from /var/log/samba/log.samba there are these errors:

> [2023/08/16 10:03:33.914303,  0] 
> ../../source4/samba/server.c:621(binary_smbd_main)
>   samba version 4.18.5-Debian started.
>   Copyright Andrew Tridgell and the Samba Team 1992-2023
> [2023/08/16 10:03:33.915622,  0] 
> ../../lib/util/become_daemon.c:150(daemon_status)
>   daemon_status: daemon 'samba' : Starting process...
> [2023/08/16 10:03:34.150858,  0] 
> ../../source4/samba/server.c:896(binary_smbd_main)
>   binary_smbd_main: samba: using 'prefork' process model
> [2023/08/16 10:03:35.935988,  1] 
> ../../auth/kerberos/gssapi_helper.c:391(gssapi_check_packet)
>   GSS VerifyMic failed:  A token had an invalid MIC: unknown mech-code 
> 2529638943 for mech 1 2 840 113554 1 2 2
> [2023/08/16 10:03:35.936046,  0] 
> ../../source4/auth/gensec/gensec_gssapi.c:1351(gensec_gssapi_check_packet)
> gssapi_check_packet(hdr_signing=0,sig_size=28,data=104,pdu=104) 
> failed: NT_STATUS_ACCESS_DENIED
> [2023/08/16 10:03:35.937151,  0] 
> ../../lib/util/util_runcmd.c:355(samba_runcmd_io_handler)
>   /usr/sbin/samba_dnsupdate: ; TSIG error with server: tsig indicates 
> error
> [2023/08/16 10:03:35.937286,  0] 
> ../../lib/util/util_runcmd.c:355(samba_runcmd_io_handler)
>   /usr/sbin/samba_dnsupdate: update failed: NOTAUTH(BADSIG)
> [2023/08/16 10:03:35.992678,  1] 
> ../../auth/kerberos/gssapi_helper.c:391(gssapi_check_packet)
>   GSS VerifyMic failed:  A token had an invalid MIC: unknown mech-code 
> 2529638943 for mech 1 2 840 113554 1 2 2
> [2023/08/16 10:03:35.992738,  0] 
> ../../source4/auth/gensec/gensec_gssapi.c:1351(gensec_gssapi_check_packet)
> gssapi_check_packet(hdr_signing=0,sig_size=28,data=111,pdu=111) 
> failed: NT_STATUS_ACCESS_DENIED
> [2023/08/16 10:03:35.993470,  0] 
> ../../lib/util/util_runcmd.c:355(samba_runcmd_io_handler)
>   /usr/sbin/samba_dnsupdate: ; TSIG error with server: tsig indicates 
> error
> [2023/08/16 10:03:35.993568,  0] 
> ../../lib/util/util_runcmd.c:355(samba_runcmd_io_handler)
>   /usr/sbin/samba_dnsupdate: update failed: NOTAUTH(BADSIG)
> [2023/08/16 10:03:36.053098,  1] 
> ../../auth/kerberos/gssapi_helper.c:391(gssapi_check_packet)
>   GSS VerifyMic failed:  A token had an invalid MIC: unknown mech-code 
> 2529638943 for mech 1 2 840 113554 1 2 2
> [2023/08/16 10:03:36.053134,  0] 
> ../../source4/auth/gensec/gensec_gssapi.c:1351(gensec_gssapi_check_packet)
> gssapi_check_packet(hdr_signing=0,sig_size=28,data=113,pdu=113) 
> failed: NT_STATUS_ACCESS_DENIED
> [2023/08/16 10:03:36.053762,  0] 
> ../../lib/util/util_runcmd.c:355(samba_runcmd_io_handler)
>   /usr/sbin/samba_dnsupdate: ; TSIG error with server: tsig indicates 
> error
> [2023/08/16 10:03:36.053824,  0] 
> ../../lib/util/util_runcmd.c:355(samba_runcmd_io_handler)
>   /usr/sbin/samba_dnsupdate: update failed: NOTAUTH(BADSIG)
> [2023/08/16 10:03:36.139994,  0] 
> ../../source4/dsdb/dns/dns_update.c:85(dnsupdate_nameupdate_done)
>   dnsupdate_nameupdate_done: Failed DNS update with exit code 3
I didn't found a solution from a search, can someone please tell me how 
to solves please?

if you need more informations tell me and I'll post them


-- 
Questa email è stata esaminata alla ricerca di virus dal software antivirus Avast.
www.avast.com