[Samba] Recent MS patch for W11 causing workstation login issues w/ Samba DCs?

[Peter]

Hi! I have a bit of an odd issue and was wondering if anyone else had
experienced this so far. Advice for logging settings would also be
appreciated to try and figure out what is causing this issue.

We have ~40 domain joined computers with Win11 24H2 (up to date on Windows
Updates), but a handful of them started having interactive login issues
after receiving KB5120998. Removing this patch resolves the issue, and
reinstalling it causes the issue again.

All computers have line of sight to the DC's, no firewalls (hardware or
software) between the PCs and DCs. Pinging, DNS all works (and DNS servers
are the DCs, and I am able to query all the AD related SRV records), clock
is synced to DCs and verified w/ w32tm, nltest works, etc when the issue is
happening. Oddly enough, I am still able to connect to an affected
computer's C$ share when the issue is happening, even though the same
credentials used can't login at the login screen nor via RDP. I don't see
any errors in the samba logs with anything matching the computer name, IP
address or user names involved. In some cases, I even see successful
authentication entries on the DCs for a user account on an affected
computer, for a corresponding rejected login at the computer login screen.

All of our Samba DCs have the following logging settings:

        logging = file
        log file = /var/log/samba/log.%m
        log level = 1 \
                full_audit:1@/var/log/samba/audit.log \
                auth:5@/var/log/samba/auth.log \
                auth_audit:5@/var/log/samba/auth_audit.log \
                kerberos:3@/var/log/samba/kerberos.log
        full_audit:prefix = IP=%I - PROTO=%R - USER=%D\%u - MACHINE=%m -
VOLUME=%S
        full_audit:success = connect opendir disconnect unlink mkdir rmdir
open rename
        full_audit:failure = none

The DCs are running Ubuntu 22.04LTS, fully updated, with their official
Samba 4 package (4.15.13). These versions are set in concrete and can't
change, although a test environment w/ newer Samba version could be done to
see if the issue is reproducible under those circumstances.

Peter