Trying to attach to a network share on a Samba server from Windows Server 2019 as the SYSTEM account results in
The password is invalid for \\server\share then a prompt for a new one. Expected result is
The command completed successfully.
When I try to connect to the share, the log for the machine on the Samba server shows:
get_user_from_kerberos_info: Username DOMAIN\COMPUTER$ is invalid on this system
So the question is: why? How can I allow a member server to authenticate a computer account?
I have recently reconfigured a Samba server (v4.5.16) and joined it to a Samba-powered Active Directory domain at 2008 R2 functional level. I've set up a share using Windows ACLs, giving Read & Execute NTFS permissions to Authenticated Users and Domain Computers and Everyone Full Control on the share. Browsing and
net useing tests fine with a regular user account on a Windows 2019 box. All fine and dandy.
BUT! Since this share holds installation files for software deployment via Group Policy objects (GPOs,) it also needs to be accessible to machine accounts (e.g. COMPUTER$) But it's apparently not, despite also giving Everyone Read permissions. I'm testing with
psexec -i -s cmd.exe net use \\server\share /user:%computername%$
...and that's when I see the problem.
I also enabled Windows Installer logging which just says the source (
\\server\share\path\to\installer) is invalid.
Before this, everything was fine (software deployed successfully at startup) with older Windows machines (2003-2008) as the share had Guest access enabled, but Windows 10+ and 2016+ no longer allow this by default. (I did test allowing it too, but that only resulted in the same password prompt.)
FWIW, the Samba domain member hosting this share is set up to use the ad idmap back-end with the RFC2307 option. As a result, I tried adding a uidNumber to the computer account in the domain but that had no effect.
I'm at my wits' end here, having spent the better part of two days searching, testing, cursing, etc. so I now humbly seek the collective wisdom of ServerFault.
Thank you for your time and attention!