Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup an Ubuntu Server with Samba 4 as Active Directory Domain Controller and I'm getting an error when I try to connect from a Windows machine.

Here's Samba's log of the error (I've replaced the name of my domain for privacy):

[2014/07/04 15:09:48.437798,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ from ipv4: for krbtgt/
[2014/07/04 15:09:48.442161,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client sent patypes: 128
[2014/07/04 15:09:48.442329,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PK-INIT(ietf) pa-data --
[2014/07/04 15:09:48.442438,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for PK-INIT(win2k) pa-data --
[2014/07/04 15:09:48.442539,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Looking for ENC-TS pa-data --
[2014/07/04 15:09:48.442658,  3] ../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ
[2014/07/04 15:09:48.535053,  3] ../source4/smbd/service_stream.c:66(stream_terminate_connection)
  Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2014/07/04 15:09:48.535219,  3] ../source4/smbd/process_single.c:114(single_terminate)
  single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED]

However, if I try to login locally, there's no problem:

# smbclient //localhost/netlogon -U Administrator
Enter Administrator's password: 
Domain=[MYDOMAIN] OS=[Unix] Server=[Samba 4.1.6-Ubuntu]
smb: \> ls
  .                                   D        0  Mon May 26 12:54:45 2014
  ..                                  D        0  Mon May 26 12:56:28 2014

                36484 blocks of size 8388608. 27650 blocks available
smb: \> 

# kinit
Password for administrator@MYDOMAIN.COM: 
Warning: Your password will expire in 5 days on jue 10 jul 2014 14:47:07 ART
# klist 
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator@MYDOMAIN.COM

Valid starting     Expires            Service principal
04/07/14 16:38:31  05/07/14 02:38:31  krbtgt/MYDOMAIN.COM@MYDOMAIN.COM
        renew until 05/07/14 16:38:24

What can be the problem? What does the error "Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ" mean?

Here's some additional information that could be important.

Information about the Server:

  • OS: Ubuntu Server 14.04
  • Samba version: 4.1.6-Ubuntu
  • Kerberos version: Kerberos 5 release 1.12

Contents of smb.conf

# Global parameters
        workgroup = MYDOMAIN
        realm = MYDOMAIN.COM
        netbios name = COLLIE
        server role = active directory domain controller
        dns forwarder =
        idmap_ldb:use rfc2307 = yes
        log level = 3

        path = /var/lib/samba/sysvol/
        read only = No

        path = /var/lib/samba/sysvol
        read only = No

# Sharing general
path = /var/lib/samba/usershares/files
read only = no

path = /var/lib/samba/usershares/todos
read only = no

path = /var/lib/samba/usershares/dbox
read only = no

Information about the Windows client

During this installation stage I'm working with a Virtual Machine running Windows 7 Professional, which is hosted by a Kubuntu box which connects through a VPN to the office where the Samba server is.

I know this is a little messed up but it's just for this stage, the Samba server will only serve local Windows machines. However, I don't think that this is what's causing the problem, since the Window box seems to be reaching the Samba server just fine.

share|improve this question
up vote 1 down vote accepted

According to the MS-KILE documentation

When clients perform a password-based initial authentication, they MUST supply the PA-ENC-TIMESTAMP pre-authentication type when they construct the initial AS request.

You're Windows client apparently is not doing this.

I am not pertaining to know the Windows side very well, but perhaps there are 'compatibility mode' options for authentication which should not be enabled for Samba 4 to work.

share|improve this answer
Thanks for the link. I had to drop this because we found another limitation on our network that made us look for a different approach, so I couldn't get another Windows client to test. – El Barto Jul 16 '14 at 17:42
I finally could set up a new Windows VM and could connect to the Domain just fine. Evidently there was something weird about my other VM, so I marked this as resolved. Thanks! – El Barto Jul 21 '14 at 15:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.