[Samba] Authentication error., The requested encryption type is not supported by the Kerberos domain controller.

[Georg Weickelt]

Hello,

Am 15.12.2024 um 06:01 schrieb Gregory Carter via samba:
> I believe RC4 is the default Samba side.  I had to create a policy on the
> workstation to enable cipher RC4 to correct the issue.  The latest update
> to Windows 11 doesn't accept RC4 anymore. Another option I tried was
> backing out of the updates which also worked.
>
> My laptop SSD died however and I lost my diagnostic tools.
>
> Perhaps you could try changing the cipher Samba side for these new Windows
> updates to see if it fixes the issue as well and report back?
>
My first attempt is to set

  kerberos encryption types = strong

in smb.conf. However, this did not bring any improvement.

Georg

>
>
>
> On Sat, Dec 14, 2024, 2:52 AM Rowland Penny via samba<samba at lists.samba.org>
> wrote:
>
>> On Fri, 13 Dec 2024 07:34:47 +0100
>> Georg Weickelt via samba<samba at lists.samba.org> wrote:
>>
>>> Hello,
>>>
>>> After updating to Windows 24H2, I get an error message when
>>> connecting to remotedesktop: "Authentication error.
>>> The requested encryption type is not supported by the Kerberos domain
>>> controller."
>> 24H2 no longer has RC4, it only has AES, so could the KDC still be
>> using only RC4 ?
>>
>>> The domain controllers run with Samba 4.21.2-Ubuntu
>>> What can be done in this situation?
>>>
>>> Thanks,
>>>
>>> Georg
>>>
>>>
>>> smb.conf:
>>>
>>> # Global parameters
>>> [global]
>>>           netbios name = AD1
>>>           realm = AD.EXAMPLE.COM
>>>           server role = active directory domain controller
>>>           workgroup = AD
>>>           dns forwarder = 192.168.3.2
>>>           interfaces = 192.168.3.8
>> That caught my attention, the DCs ipaddress is 192.168.3.8 and it is
>> forwarding to 192.168.3.2, what is 192.168.3.2 ?
>>
>> Rowland
>>
>>
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions:https://lists.samba.org/mailman/options/samba
>>