Windows 7 cannot create “permanent” profile from samba server

Question

I have a samba server which has an odd problem; I was able to get the Win7 box to logon using the instructions from the official samba wiki; however, after setting up a BDC, I missed the step of using the rpc command to join the samba domain; after that, the Win7 machine cannot log on at all, even after a fresh install of Windows; the user account can log in, but windows claims to be unable to create the profile, and logs them in with a temporary profile

The output from the samba logs with logging set to 4, IIRC, is below (dates are old, as this was a test setup that was set aside in favor of paying work, but I'm now back to this).

Short of reinstalling everything, is there something that I'm missing in my ignorance of both samba and windows?

Thanks.

Jun 14 15:30:26 ldc1 smbd[1942]: [2010/06/14 15:30:26,  0] lib/util_sock.c:539(read_fd_with_timeout) 
Jun 14 15:30:26 ldc1 smbd[1942]: [2010/06/14 15:30:26,  0]     lib/util_sock.c:1491(get_peer_addr_internal) 
Jun 14 15:30:26 ldc1 smbd[1942]:   getpeername failed. Error was Transport endpoint is not connected 
Jun 14 15:30:26 ldc1 smbd[1942]:   read_fd_with_timeout: client 0.0.0.0 read error =     Connection reset by peer. 
Jun 14 15:30:27 ldc1 smbd[1956]: [2010/06/14 15:30:27,  0]     rpc_server/srv_netlog_nt.c:603(_netr_ServerAuthenticate3) 
Jun 14 15:30:27 ldc1 smbd[1956]:   _netr_ServerAuthenticate3: netlogon_creds_server_check     failed. Rejecting auth request from client BRET-PC machine account BRET-PC$ 
Jun 14 15:31:53 ldc1 dhcpd: DHCPINFORM from 192.168.1.190 via eth0
Jun 14 15:31:53 ldc1 dhcpd: DHCPACK to 192.168.1.190 (f4:ce:46:30:14:15) via eth0

even further outputs, now that I've gotten access to the machine:

[root@ldc1 ~]# smbd -V Version 3.4.8

Windows 7 registry changes, per official Samba instructions: HKLM\System\CCS\Services\LanmanWorkstation\Parameters DWORD DomainCompatibilityMode = 1 DWORD DNSNameResolutionRequired = 0

The actual user account seems to be fine:

[root@ldc1 ~]# smbclient //localhost/testuser -U testuser -c 'ls'
Enter testuser's password:
Domain=[EXAMPLE] OS=[Unix] Server=[Samba 3.4.8]
  .                                   D        0  Fri May 21 15:58:57 2010
  ..                                  D        0  Tue May 25 09:33:16 2010
  .bashrc                            AH      124  Fri May 21 15:58:57 2010
  .mozilla                           DH        0  Fri May 21 15:58:57 2010
  .bash_profile                      AH      176  Fri May 21 15:58:57 2010
  .bash_logout                       AH       33  Fri May 21 15:58:57 2010

but logging in to the win7 box give me "you are logged in with a temporary profile"

testparm -s output:

Load smb config files from /etc/samba/smb.conf
rlimit_max: rlimit_max (1024) below minimum Windows limit (16384)
Processing section "[homes]"
Processing section "[printers]"
Processing section "[print$]"
Processing section "[netlogon]"
WARNING: The "share modes" option is deprecated
Processing section "[foo]"
Loaded services file OK.
Server role: ROLE_DOMAIN_PDC
[global]
        workgroup = ELDEN
        server string = Samba Server Version %v
        passdb backend = ldapsam:ldap://localhost/
        passwd program = /usr/sbin/smbldap-passwd %u
        passwd chat = *New*password* %n\n *Retype*new*password* %n\n *all*authentication*tokens*updat
ed*
        log level = 2
        printcap name = cups
        add user script = /usr/sbin/smbldap-useradd -a -m "%u"
        delete user script = /usr/sbin/smbldap-userdel "%u"
        add group script = /usr/sbin/smbldap-groupadd -a "%u"
        delete group script = /usr/sbin/smbldap-groupdel "%g"
        add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
        delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
        set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
        add machine script = /usr/sbin/smbldap-useradd -w "%u"
        domain logons = Yes
        preferred master = Yes
        domain master = Yes
        ldap admin dn = cn=Manager,dc=elden,dc=no
        ldap delete dn = Yes
        ldap group suffix = ou=Groups
        ldap machine suffix = ou=Computers
        ldap passwd sync = yes
        ldap suffix = dc=elden,dc=no
        ldap user suffix = ou=Users
        cups options = raw

[homes]
        comment = Home Directories
        read only = No
        browseable = No
        browsable = No

[printers]
        comment = All Printers
        path = /var/spool/samba
        printable = Yes
        browseable = No
        browsable = No

[print$]
        comment = Printer Drivers
        path = /etc/samba/drivers
        write list = root

[netlogon]
        comment = Network Logon Service
        path = /var/lib/samba/netlogon
        guest ok = Yes
        share modes = No

some now-suspect log entries from today:

[2010/08/11 14:31:10,  2] libsmb/credentials.c:223(netlogon_creds_server_check)
  netlogon_creds_server_check: credentials check failed.
[2010/08/11 14:31:10,  0] rpc_server/srv_netlog_nt.c:603(_netr_ServerAuthenticate3)
  _netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client B
RET-PC machine account BRET-PC$
[2010/08/11 14:31:10,  2] passdb/pdb_ldap.c:571(init_sam_from_ldap)
  init_sam_from_ldap: Entry found for user: bret-pc$
[2010/08/11 14:31:10,  2] passdb/pdb_ldap.c:2434(init_group_from_ldap)
  init_group_from_ldap: Entry found for group: 515
[2010/08/11 14:31:11,  2] passdb/pdb_ldap.c:571(init_sam_from_ldap)
  init_sam_from_ldap: Entry found for user: bret-pc$
[2010/08/11 14:31:11,  2] passdb/pdb_ldap.c:2434(init_group_from_ldap)
  init_group_from_ldap: Entry found for group: 515
[2010/08/11 14:31:11,  2] auth/auth.c:310(check_ntlm_password)
  check_ntlm_password:  authentication for user [BRET-PC$] -> [BRET-PC$] -> [bret-pc$] succeeded
[2010/08/11 14:31:11,  2] passdb/pdb_ldap.c:571(init_sam_from_ldap)
  init_sam_from_ldap: Entry found for user: testuser
[2010/08/11 14:31:11,  2] auth/auth.c:310(check_ntlm_password)
  check_ntlm_password:  authentication for user [testuser] -> [testuser] -> [testuser] succeeded

Tutorial that was followed to create this: http://wiki.samba.org/index.php/Replicated_Failover_Domain_Controller_and_file_server_using_LDAP