On 11/24/2012 03:35 PM, Michael Trausch wrote:
This is a freshly provisioned Samba 4.0.0-rc5 installation.
I provisioned the domain and created shares in the configuration file
to match an existing Samba 3.5.x installation that we're moving away
from (or at least, that's the plan...) for various reasons.
I then moved all the contents of the shares over from the old server
to the new server via rsync, including home directories and user
profiles.
I then changed the permissions on the profiles and home directories to
match the POSIX IDs which were created by Samba 4 when I created the
users using the Active Directory Users and Computers management tool
from a workstation that I bound to the domain.
I then created a Group Policy, which applied itself successfully to
the workstation.
So far, so good.
However, I can only login as DOMAIN\Administrator or DOMAIN\{$USER}
where $USER is a user account that has membership in the Domain Admins
group. I am completely unable to login as any user that is not in
Domain Admins. When I attempt to do so, the workstation returns the
error message "The Group Policy Client service failed the logon.
Access is denied."
There is nothing in the Windows Event Log indicating an access denied
message, and there is nothing in the Windows Event Log indicating any
other problems at the time that the error message is displayed or
within the time that the login process is pending.
There are no messages in the Samba 4 log, either, with the debug level
set to 9.
The best that I can come up with is that this is a permissions problem
of _some_ sort, but I cannot determine what it is. The system running
Samba has no MAC security systems in the way (e.g., no SELinux or
anything like that, just simple UNIX DAC). The permissions on SYSVOL
and NETLOGON are completely unmodified by me.
Can someone give me an idea of where to start looking? I tried to
figure out perhaps what the ID numbers in the ACLs are for the SYSVOL
share, but wbinfo doesn't seem to know anything about ID numbers
3000000-3000003, which are the IDs on the share itself. The lowest ID
number that I have which appears in user or group lists as returned by
wbinfo is 3000004.
Try to do kinit [email protected] try also to disable the GPO.
Try to trace and see if there is any kind of denied message (in
netlogon, smb, smb2 messages).
--
Matthieu Patou
Samba Team
http://samba.org
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
