[Samba] Windows profile not syncing on logout

[Rowland Penny]

On Tue, 27 May 2025 12:32:51 +0200
Simon Hakenes via samba <samba at lists.samba.org> wrote:

> Hi all,
> 
> I'm running into a puzzling issue with users' Windows profile not 
> syncing correctly. Here’s our setup:
> 
>   *
> 
>     Samba version 4.19.9-Debian-4.19.9+dfsg-1~mjt+deb12
> 
>   *
> 
>     One AD DC (Samba internal DNS)

Bad idea, you should always run at least two DCs for failover purposes.

> 
>   *
> 
>     Profile data located on a separate file server (member of the
> domain)
> 
>   *
> 
>     Clients are all Windows 11
> 
>   *
> 
>     We also run Linux clients, they all work fine
> 
>   *
> 
>     The share |\\usersfs\profiles\...|resolves correctly and is used
> by all users successfully
> 
> All other users work fine. For the affected user:
> 
>   *
> 
>     She can login. I can see that in the logs and everything looks
> fine.
> 
>   *
> 
>     She works normally during the day (reads/writes files, Thunderbird
>     works, etc.).
> 
>   *
> 
>     On logout, *nothing is written back*to the file server. All
>     timestamps on the file server are old.
> 
>   *
> 
>     Windows event log shows no errors or warnings.
> 
>   *
> 
>     Logging out and back in still loads the old state.
> 
> We've verified:
> 
>   *
> 
>     Permissions on the profile directory on the file server
> 
>   *
> 
>     No event viewer messages during logout
> 
>   *
> 
>     Her authentication in the logs look fine
> 
>   *
> 
>     A new test user works fine, profile is created and synced normally
> 
> We also see this related issue:
> 
>   *
> 
>     Two other users report that files they delete from their profile
>     reappear after logout/login
> 
>   *
> 
>     Their profile directories on the file server *do*get new
> timestamps at logout
> 
> I am trying to figure out how to further diagnose the root cause. I
> am admittedly a bit inexperienced with samba/Windows. What places do
> I need to check to find the cause of that issue?
> 
> Thanks a lot!
> Simon
> 
> Here is our smb.conf from the dc:
> ------------------------------------------------------------------
> # Global parameters
> [global]
> 
>          netbios name = DC1
>          realm = HOME.DOMAIN.DE
>          server role = active directory domain controller
>          server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, 
> drepl, winbindd, ntp_signd, kcc, dnsupdate

Interesting, above you say that you are using the Samba internal dns,
but you have a 'server services' line (which isn't standard if using
the Samba internal dns server) without 'dns' anywhere in it. There is
also no 'dns forwarder' line.
 
>          workgroup = HOME
>          idmap_ldb:use rfc2307 = yes
>          log level = 1 auth_audit:5
>          ntp signd socket directory = /var/lib/samba/ntp_signd

There is no need to set that, it is the default.

> 
> [sysvol]
>          path = /var/lib/samba/sysvol
>          read only = No
> 
> [netlogon]
>          path = /var/lib/samba/sysvol/home.domain.de/scripts
>          read only = No
> ------------------------------------------------------------------
> 
> 
> And the smb.conf from the fileserver:
> 
> ------------------------------------------------------------------
> [global]
>          log file = /var/log/samba/%m.log
>          log level = 5
>          max log size = 50
>          realm = HOME.DOMAIN.DE
>          security = ADS
>          server role = member server
>          winbind cache time = 10
>          winbind enum groups = Yes
>          winbind enum users = Yes
>          winbind expand groups = 1
>          winbind nss info = rfc2307
>          winbind offline logon = Yes
>          winbind refresh tickets = Yes
>          winbind use default domain = Yes
>          workgroup = HOME
>          idmap config * : backend = tdb
>          idmap config * : range = 1000-1999
>          idmap config home : backend = ad
>          idmap config home : schema_mode = rfc2307
>          idmap config home : range = 10000-999999
>          idmap config home : unix_nss_info = yes
>          idmap config home : unix_primary_group = yes
>          map acl inherit = Yes
>          vfs objects = acl_xattr shadow_copy2
>          min domain uid = 0
>          kerberos method = secrets and keytab
> 
> ##### Shares #####
> 
> [users]
>          path = /tank/homes/
>          read only no

Unless that is a typo, it should be 'read only = no'

>          writable = yes

But thankfully it is corrected by its synonym.

> 
> [profiles]
>          browseable = No
>          comment = User profiles
>          csc policy = disable
>          path = /tank/profiles/
> 
>          read only = No
> 
> ------------------------------------------------------------------
> 

Rowland