[Samba] NT_STATUS_ACCESS_DENIED: Access denied (0xc0000022)

[Mark Foley via samba]

I have a Samba4 AD/DC running on Slackware64 14.1, Samba version 4.2.12. This computer has been
serving a Domain of several Windows 7 and one Linux domain members for about 2 years without problem.

On a few occasions lately I've run the following command on the AD/DC:

$ ntlm_auth --username="user" --password='password'
NT_STATUS_ACCESS_DENIED: Access denied (0xc0000022)

and have gotten the access denied message shown. In other words, domain users suddenly can't
authenticate. Stopping and restarting samba does not fix the problem. The samba log has:

[2016/09/02 11:19:36.490991, 2] ../libcli/auth/credentials.c:403(netlogon_creds_server_check_internal) credentials check failed

I have to reboot the computer to fix this.

It looks like my last update to Samba to 4.2.12 was done on July 2, 2016. It's probable that I
started noticing this problem about then. It is very intermittant. Probably less than 8
times since then.

Can anyone tell me why this is happening and how I can fix it without having to reboot?

This is important as this is a production machine and users are unable to log into the domain
when this happens.

THX -- Mark

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Jeremy Allison via samba]

On Fri, Sep 02, 2016 at 11:46:14AM -0400, Mark Foley via samba wrote:
> I have a Samba4 AD/DC running on Slackware64 14.1, Samba version 4.2.12. This computer has been
> serving a Domain of several Windows 7 and one Linux domain members for about 2 years without problem.
>
> On a few occasions lately I've run the following command on the AD/DC:
>
> $ ntlm_auth --username="user" --password='password'
> NT_STATUS_ACCESS_DENIED: Access denied (0xc0000022)
>
> and have gotten the access denied message shown. In other words, domain users suddenly can't
> authenticate. Stopping and restarting samba does not fix the problem. The samba log has:
>
> [2016/09/02 11:19:36.490991, 2] ../libcli/auth/credentials.c:403(netlogon_creds_server_check_internal) credentials check failed
>
> I have to reboot the computer to fix this.
>
> It looks like my last update to Samba to 4.2.12 was done on July 2, 2016. It's probable that I
> started noticing this problem about then. It is very intermittant. Probably less than 8
> times since then.
>
> Can anyone tell me why this is happening and how I can fix it without having to reboot?
>
> This is important as this is a production machine and users are unable to log into the domain
> when this happens.

Can you get logs showing what is going on when the machine is in
this state ? There's not enough information here to make a good
diagnosis.

[barış tombul via samba]

[global]
ntlm auth = Yes ??