[Samba] Recent MS patch for W11 causing workstation login issues w/ Samba DCs?

[Rowland Penny]

On Tue, 1 Sep 2026 09:28:25 -0700
Peter via samba <samba at lists.samba.org> wrote:

> Hi! I have a bit of an odd issue and was wondering if anyone else had
> experienced this so far. Advice for logging settings would also be
> appreciated to try and figure out what is causing this issue.
> 
> We have ~40 domain joined computers with Win11 24H2 (up to date on
> Windows Updates), but a handful of them started having interactive
> login issues after receiving KB5120998. Removing this patch resolves
> the issue, and reinstalling it causes the issue again.
> 
> All computers have line of sight to the DC's, no firewalls (hardware
> or software) between the PCs and DCs. Pinging, DNS all works (and DNS
> servers are the DCs, and I am able to query all the AD related SRV
> records), clock is synced to DCs and verified w/ w32tm, nltest works,
> etc when the issue is happening. Oddly enough, I am still able to
> connect to an affected computer's C$ share when the issue is
> happening, even though the same credentials used can't login at the
> login screen nor via RDP. I don't see any errors in the samba logs
> with anything matching the computer name, IP address or user names
> involved. In some cases, I even see successful authentication entries
> on the DCs for a user account on an affected computer, for a
> corresponding rejected login at the computer login screen.
> 
> All of our Samba DCs have the following logging settings:
> 
>         logging = file
>         log file = /var/log/samba/log.%m
>         log level = 1 \
>                 full_audit:1@/var/log/samba/audit.log \
>                 auth:5@/var/log/samba/auth.log \
>                 auth_audit:5@/var/log/samba/auth_audit.log \
>                 kerberos:3@/var/log/samba/kerberos.log
>         full_audit:prefix = IP=%I - PROTO=%R - USER=%D\%u -
> MACHINE=%m - VOLUME=%S
>         full_audit:success = connect opendir disconnect unlink mkdir
> rmdir open rename
>         full_audit:failure = none
> 

I wonder if you should be looking on the affected clients ?

> The DCs are running Ubuntu 22.04LTS, fully updated, with their
> official Samba 4 package (4.15.13). These versions are set in
> concrete and can't change, 

That might be a problem, as I understand it, KB5120998 was released a
few days ago, so if Samba requires fixing (it may be a Windows
problem and they fix it), then any possible fixes will go into the
latest version of Samba and may be backported to 4.23.x and if lucky to
4.22.x. Because you are running 4.15.3 you will have to rely on Ubuntu
backporting such a fix.
 
> although a test environment w/ newer
> Samba version could be done to see if the issue is reproducible under
> those circumstances.

I would try with Debian 13 and Samba from backports, that will get you
latest version of Samba, 4.24.5 at present.

Rowland