[Samba] Test-ComputerSecureChannel -Verbose False since windows 10/11 update 07/2023

[Rowland Penny]

On 12/07/2023 14:03, Samuel Wolf via samba wrote:
> Hello,
> 
> since we install the most recent windows updates from 07/2023
> Test-ComputerSecureChannel -Verbose
> show False [4].
> 
> Moved the machine to local workgroup, deleted machine account on the
> ad controller
> and rejoined it (which works), but Test-ComputerSecureChannel -Verbose
> show again False.
> 
> I'm not sure this is an issue on the samba or on the windows side.
> 
> Affected samba versions so far:
> 4.17.8+dfsg-2 (Debian 12) [1]
> 4.18.x (mjt packages) [2]
> 4.15.13+dfsg-0 (ubuntu) [3]
> 
> Any ideas what we can do/test?
> 
> Thank you.
> 
> Samuel
> 
> [1] https://lists.samba.org/archive/samba/2023-July/245749.html
> [2] https://lists.samba.org/archive/samba/2023-July/245763.html
> [3] https://lists.samba.org/archive/samba/2023-July/245761.html
> 
> [4] https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/test-computersecurechannel?view=powershell-5.1
> 


I am not convinced this is a Samba problem. It could be that Samba isn't 
providing something that Windows now expects, or Samba is providing 
something that Windows doesn't expect, but I think it is more likely 
that it has something to do with the 130 CVE's that Microsoft shipped 
yesterday:

https://msrc.microsoft.com/update-guide/releaseNote/2023-Jul

It wouldn't be the first time Microsoft broke something while fixing 
something else.

By all means open a bug report, Samba may need to change something to 
get things working again, but it will probably require level 10 logs and 
network traces to workout just what is going on.

Rowland