[Samba] Users unable to reset passwords

[Mark Foley]

On Mon, 22 Apr 2024 08:56:41 -0400
> Mark Foley via samba <samba at lists.samba.org> wrote:
>
> New related issue.
> 
> I upgraded the Domain Controller from 4.8.2 to 4.18.9 about 90 days
> ago, and set the 'Maximum password age' to 90 days. Today, two of the
> users' passwords were expired when they tried to log in this morning.
> They got the messaage that their password was expired and to change
> it, but when doing so they keep getting "your password has expired." 
> 
> I've reset 3 people's passwords so far today. This worked without
> problem on 4.8.2. Yes, they did get the Windows notice that their
> password was expiring in x days, but they didn't act on that.
> 
> Any idea how to fix this? 

It's been another 90 days and passwords are expiring. I'm back to investigating
this issue.

1. Most people are not getting the "your password expires in X days" message on
their Windows 11 workstations. I've looked in 'samba-tool user show <user>' and 
'samba-tool domain passwordsettings show' and don't see where this setting is
defined.

2. More importantly, when their password expires, they get the normal Windows
"Your Password has expired" dialogue with "Password", "New password", "Confirm
password". When users fill in this info and click the arrow beside "Confirm
password", it simply repaints the form and never lets them in. The same happens
to me so I know it's not just user error. 

In ADUC > Users, no boxes are checked under "Account options" and "Account
expires" is set to 'never'. 

This is our 2nd 90-day cycle since upgrading from Samba 4.8.2 to Samba 4.18.9,
and from Windows 10 to Windows 11 on the workstations. Users have never
since been able to set their passwords once expired. I have to do so for each
user with 'samba-tool user setpassword <user>'. This used to work fine on
4.8.2. We need to get this fixed.

Suggestions?

Thanks --Mark