[Samba] Recent MS patch for W11 causing workstation login issues w/ Samba DCs?

[Peter]

Thanks Roland. I have looked on the clients but have not found any obvious
clues. Event Viewer reports a bad user name or password under the Event
Viewer "Security" logs. No errors or warnings under Applications or System.
As I mentioned before, I've done all the normal tests for generic AD client
checks and tests I could think of.

I was mainly hoping to see if anyone else had a similar experience, as I
went through a similar situation a few years ago with KB5028166, however,
that affected all of our workstations instantly, rather than just a
handful, and I have not been able to identify any relevant differences
between the computers "broken" by KB5120998 and those running fine with
this update. They're all the same brand and model of computer, same specs,
same OS installation process, same AD OU and GPOs, and mostly the same
end-user software.

Unfortunately, the server OS distribution and version is not a variable on
which I have any wiggle room, but I may be able to get an exception for
using the upstream build/repo version of Samba if it can run or be compiled
against our "non-negotiable-set-in-concrete" versions of openssl, gnu tls,
etc until Ubuntu 24.04 gets approved/certified.  I may have to set up a
test DC and network to test this if the issue becomes more widespread.

In the meantime, I am testing and setting up tooling to enable more verbose
logging on affected workstations, as I expect this patch will eventually be
rolled up into other superseding patches.

Peter

On Tue, Sep 1, 2026 at 10:05 AM Rowland Penny via samba <
samba at lists.samba.org> wrote:

> On Tue, 1 Sep 2026 09:28:25 -0700
> Peter via samba <samba at lists.samba.org> wrote:
>
> > Hi! I have a bit of an odd issue and was wondering if anyone else had
> > experienced this so far. Advice for logging settings would also be
> > appreciated to try and figure out what is causing this issue.
> >
> > We have ~40 domain joined computers with Win11 24H2 (up to date on
> > Windows Updates), but a handful of them started having interactive
> > login issues after receiving KB5120998. Removing this patch resolves
> > the issue, and reinstalling it causes the issue again.
> >
> > All computers have line of sight to the DC's, no firewalls (hardware
> > or software) between the PCs and DCs. Pinging, DNS all works (and DNS
> > servers are the DCs, and I am able to query all the AD related SRV
> > records), clock is synced to DCs and verified w/ w32tm, nltest works,
> > etc when the issue is happening. Oddly enough, I am still able to
> > connect to an affected computer's C$ share when the issue is
> > happening, even though the same credentials used can't login at the
> > login screen nor via RDP. I don't see any errors in the samba logs
> > with anything matching the computer name, IP address or user names
> > involved. In some cases, I even see successful authentication entries
> > on the DCs for a user account on an affected computer, for a
> > corresponding rejected login at the computer login screen.
> >
> > All of our Samba DCs have the following logging settings:
> >
> >         logging = file
> >         log file = /var/log/samba/log.%m
> >         log level = 1 \
> >                 full_audit:1@/var/log/samba/audit.log \
> >                 auth:5@/var/log/samba/auth.log \
> >                 auth_audit:5@/var/log/samba/auth_audit.log \
> >                 kerberos:3@/var/log/samba/kerberos.log
> >         full_audit:prefix = IP=%I - PROTO=%R - USER=%D\%u -
> > MACHINE=%m - VOLUME=%S
> >         full_audit:success = connect opendir disconnect unlink mkdir
> > rmdir open rename
> >         full_audit:failure = none
> >
>
> I wonder if you should be looking on the affected clients ?
>
> > The DCs are running Ubuntu 22.04LTS, fully updated, with their
> > official Samba 4 package (4.15.13). These versions are set in
> > concrete and can't change,
>
> That might be a problem, as I understand it, KB5120998 was released a
> few days ago, so if Samba requires fixing (it may be a Windows
> problem and they fix it), then any possible fixes will go into the
> latest version of Samba and may be backported to 4.23.x and if lucky to
> 4.22.x. Because you are running 4.15.3 you will have to rely on Ubuntu
> backporting such a fix.
>
> > although a test environment w/ newer
> > Samba version could be done to see if the issue is reproducible under
> > those circumstances.
>
> I would try with Debian 13 and Samba from backports, that will get you
> latest version of Samba, 4.24.5 at present.
>
> Rowland
>
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>