Craig White wrote:
On Sat, 2006-02-18 at 11:11 -0600, Philip Washington wrote:
We have had a Samba LDAP-PDC-BDC system setup for close to 3 months with
about 60 computers in the domain. Earlier we had a power outage and
about 30 computers no longer were able to log into the domain or
authenticate. Some were NT Workstations and some were W2k. But not all
NT or W2K workstations were affected.
If we went to network neighborhood we would see the error message
" "The trust relationship between this workstation and the primary domain
failed"
When someone tries to login to these computers then they get the error
"The system cannot log you on to this domain because the system's
computer account in it's primary domain is missing or the password on
that account is incorrect".
We were able to fix the problem on the computers by taking the computers
out of the domain and re-entering them into the domain. Went into
System->Network Identification-> put the machine in a workgroup ->
reboot -> Go back in and put the machine back into the domain. No
manual deletion on the PDC was done. This was all done on the client.
I reviewed LDAP backups and thus far have not found any descrepancies
with the systems profiles before or after the power outage. The records
indicate that there has not been any change in the LDAP information in
the last 2 months for the machines which have the problem. Of course
once the systems have been relogged into the domain the SambaNTPassword
changes.
I am currently both baffled and concerned as to how or why this would
happen. If anybody could shed more light on what could have happened I
would appreciate it.
I would also like to know if there is a way to re-add or add a client on
the Samba-LDAP-PDC instead of going to each individual client.
----
probably would be a good idea to figure out how to troubleshoot your
setup as one could only conjecture about what your problem is as you
describe it.
I do know that there is some faulty logic in your assumptions above
since the workstations will automatically change their password with the
passdb approximately once each month and I am quite certain that this is
documented in the samba documentation.
Yep, this does throw a bad domino into the logic. ( I wonder if MS will
give me my money back for all of those MCSE classes). Once I fixed that
domino and started looking at the BDC again, I realized that it's samba
configuration files look identical to the ones on the PDC with the
exception that ldap is pointing to the ldap on the BDC. So it
currently looks like the BDC is misconfigured (Basically I'm seeing a
configuration that deviates quite a bit from what I see in Samba-3 by
Example).
I shutdown the BDC for now and put the PDC on a UPS (Yeah it should have
been on one in the first place, but money is tight and we're operating
under, if it ain't broke don't pay money to fix it). This should hold
us over until the BDC is configured correctly.
Thanks for the enlightenment.
So in view of your faulty assumption, my guess would be that your
PDC/BDC setup in LDAP probably isn't working properly as there should be
evidence in some log somewhere when the workstations change their
password and that the password changes propagate from LDAP server to
LDAP server and assuming that you are using something like 'slurpd' to
replicate changes in LDAP, there should be evidence of some failures
(aka rejects) unless you are allowing changes directly to the 'slave'
LDAP server in which case, you have a lot to fix.
Craig
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
