Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a samba server which has an odd problem; I was able to get the Win7 box to logon using the instructions from the official samba wiki; however, after setting up a BDC, I missed the step of using the rpc command to join the samba domain; after that, the Win7 machine cannot log on at all, even after a fresh install of Windows; the user account can log in, but windows claims to be unable to create the profile, and logs them in with a temporary profile

The output from the samba logs with logging set to 4, IIRC, is below (dates are old, as this was a test setup that was set aside in favor of paying work, but I'm now back to this).

Short of reinstalling everything, is there something that I'm missing in my ignorance of both samba and windows?

Thanks.

Jun 14 15:30:26 ldc1 smbd[1942]: [2010/06/14 15:30:26,  0] lib/util_sock.c:539(read_fd_with_timeout) 
Jun 14 15:30:26 ldc1 smbd[1942]: [2010/06/14 15:30:26,  0]     lib/util_sock.c:1491(get_peer_addr_internal) 
Jun 14 15:30:26 ldc1 smbd[1942]:   getpeername failed. Error was Transport endpoint is not connected 
Jun 14 15:30:26 ldc1 smbd[1942]:   read_fd_with_timeout: client 0.0.0.0 read error =     Connection reset by peer. 
Jun 14 15:30:27 ldc1 smbd[1956]: [2010/06/14 15:30:27,  0]     rpc_server/srv_netlog_nt.c:603(_netr_ServerAuthenticate3) 
Jun 14 15:30:27 ldc1 smbd[1956]:   _netr_ServerAuthenticate3: netlogon_creds_server_check     failed. Rejecting auth request from client BRET-PC machine account BRET-PC$ 
Jun 14 15:31:53 ldc1 dhcpd: DHCPINFORM from 192.168.1.190 via eth0
Jun 14 15:31:53 ldc1 dhcpd: DHCPACK to 192.168.1.190 (f4:ce:46:30:14:15) via eth0

even further outputs, now that I've gotten access to the machine:

[root@ldc1 ~]# smbd -V Version 3.4.8

Windows 7 registry changes, per official Samba instructions: HKLM\System\CCS\Services\LanmanWorkstation\Parameters DWORD DomainCompatibilityMode = 1 DWORD DNSNameResolutionRequired = 0

The actual user account seems to be fine:

[root@ldc1 ~]# smbclient //localhost/testuser -U testuser -c 'ls'
Enter testuser's password:
Domain=[EXAMPLE] OS=[Unix] Server=[Samba 3.4.8]
  .                                   D        0  Fri May 21 15:58:57 2010
  ..                                  D        0  Tue May 25 09:33:16 2010
  .bashrc                            AH      124  Fri May 21 15:58:57 2010
  .mozilla                           DH        0  Fri May 21 15:58:57 2010
  .bash_profile                      AH      176  Fri May 21 15:58:57 2010
  .bash_logout                       AH       33  Fri May 21 15:58:57 2010

but logging in to the win7 box give me "you are logged in with a temporary profile"

testparm -s output:

Load smb config files from /etc/samba/smb.conf
rlimit_max: rlimit_max (1024) below minimum Windows limit (16384)
Processing section "[homes]"
Processing section "[printers]"
Processing section "[print$]"
Processing section "[netlogon]"
WARNING: The "share modes" option is deprecated
Processing section "[foo]"
Loaded services file OK.
Server role: ROLE_DOMAIN_PDC
[global]
        workgroup = ELDEN
        server string = Samba Server Version %v
        passdb backend = ldapsam:ldap://localhost/
        passwd program = /usr/sbin/smbldap-passwd %u
        passwd chat = *New*password* %n\n *Retype*new*password* %n\n *all*authentication*tokens*updat
ed*
        log level = 2
        printcap name = cups
        add user script = /usr/sbin/smbldap-useradd -a -m "%u"
        delete user script = /usr/sbin/smbldap-userdel "%u"
        add group script = /usr/sbin/smbldap-groupadd -a "%u"
        delete group script = /usr/sbin/smbldap-groupdel "%g"
        add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
        delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
        set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
        add machine script = /usr/sbin/smbldap-useradd -w "%u"
        domain logons = Yes
        preferred master = Yes
        domain master = Yes
        ldap admin dn = cn=Manager,dc=elden,dc=no
        ldap delete dn = Yes
        ldap group suffix = ou=Groups
        ldap machine suffix = ou=Computers
        ldap passwd sync = yes
        ldap suffix = dc=elden,dc=no
        ldap user suffix = ou=Users
        cups options = raw

[homes]
        comment = Home Directories
        read only = No
        browseable = No
        browsable = No

[printers]
        comment = All Printers
        path = /var/spool/samba
        printable = Yes
        browseable = No
        browsable = No

[print$]
        comment = Printer Drivers
        path = /etc/samba/drivers
        write list = root

[netlogon]
        comment = Network Logon Service
        path = /var/lib/samba/netlogon
        guest ok = Yes
        share modes = No

some now-suspect log entries from today:

[2010/08/11 14:31:10,  2] libsmb/credentials.c:223(netlogon_creds_server_check)
  netlogon_creds_server_check: credentials check failed.
[2010/08/11 14:31:10,  0] rpc_server/srv_netlog_nt.c:603(_netr_ServerAuthenticate3)
  _netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client B
RET-PC machine account BRET-PC$
[2010/08/11 14:31:10,  2] passdb/pdb_ldap.c:571(init_sam_from_ldap)
  init_sam_from_ldap: Entry found for user: bret-pc$
[2010/08/11 14:31:10,  2] passdb/pdb_ldap.c:2434(init_group_from_ldap)
  init_group_from_ldap: Entry found for group: 515
[2010/08/11 14:31:11,  2] passdb/pdb_ldap.c:571(init_sam_from_ldap)
  init_sam_from_ldap: Entry found for user: bret-pc$
[2010/08/11 14:31:11,  2] passdb/pdb_ldap.c:2434(init_group_from_ldap)
  init_group_from_ldap: Entry found for group: 515
[2010/08/11 14:31:11,  2] auth/auth.c:310(check_ntlm_password)
  check_ntlm_password:  authentication for user [BRET-PC$] -> [BRET-PC$] -> [bret-pc$] succeeded
[2010/08/11 14:31:11,  2] passdb/pdb_ldap.c:571(init_sam_from_ldap)
  init_sam_from_ldap: Entry found for user: testuser
[2010/08/11 14:31:11,  2] auth/auth.c:310(check_ntlm_password)
  check_ntlm_password:  authentication for user [testuser] -> [testuser] -> [testuser] succeeded

Tutorial that was followed to create this: http://wiki.samba.org/index.php/Replicated_Failover_Domain_Controller_and_file_server_using_LDAP

share|improve this question
1  
@thrashbluegrass: without knowing your smb.conf content (output of testparm -s is good enough) and your Samba version, it will be difficult to give any advice. Also, which wiki did you follow (link to page?) !?? {Does your smb.conf define a [profiles] share?} –  Kurt Pfeifle Aug 9 '10 at 16:49
    
@papitas: edited to add information i got now that I have access to the machine again. Hopefully someone can help me, although I get the feeling that this is deep within the depths of windows and thus outside of my skillset –  user50426 Aug 11 '10 at 15:45
    
@thrashbluegrass: Your [global] section misses a logon script = %U.bat entry. %U.bat needs to be located where [netlogon]'s path goes. %U.bat needs DOS line ending conventions (not Unix!). Also missing in [global]: logon {home,path,drive} = .... Your [netlogon] share should be set to browseable = yes and writeable = yes (in smb.conf). Why do you use share modes = no?? Should be yes. The [profiles] section is missing altogether... –  Kurt Pfeifle Aug 11 '10 at 23:45

1 Answer 1

Under [global] you need to set:

logon path = 

With an empty string after the = sign.
This tells it to not use roaming profiles and a permanent local one will be used instead.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.