Samba 2:3.6.25-0ubuntu0.12.04.2 as PDC (samba3 NT4 domain) Windows machines lost trust after USN-2950-1 update

Question

we have problem on some of our Windows 7 Pro/ Windows 8 Pro/ Windows 2008 Server machines which are in Samba3 Domain after yesterday USN-2950-1 update to 3.6.25 on Ubuntu 12.04 LTS

When the user tries to log in to the computer it says "The trust relationship between this workstation and primary domain failed." and i can see

In samba log is this error: _netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client XXXX machine account XXXX$

and Windows System event log is Event ID:5719

"This computer was not able to set up a secure session with a domain controller in domain CONTOSO due to the following: There are currently no logon servers available to service the logon request. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator."

On some computers can users login after few reboots, but then they again can't. And the only workaround which works is to disconnect computer from network during login and then connect it after.

All computers are fully updated and have also MS16-047 (KB3149090 for Win7 64bit) (the badlock update) installed.

I tried and didn't work:

• rejoin computer to doimain without problem
• checked if they use NTLMv2 for login
• ntlm auth = no and lanman auth = no are applied in samba
• tried raw NTLMv2 auth = yes but didn't help according to https://www.samba.org/samba/security/CVE-2016-2111.html
• Checked for "RequireSignOrSeal"=dword:00000001 "RequireStrongKey"=dword:00000001 registry keys according to https://wiki.samba.org/index.php/Required_settings_for_NT4-style_domains but they are OK.

Does anybody same problem? Did you find solution? Any help appreciated. Thank you.

UPDATE: downgrade of samba to previous version worked as a workaround:

apt-get install samba=2:3.6.3-2ubuntu2 samba-common=2:3.6.3-2ubuntu2 libwbclient0=2:3.6.3-2ubuntu2 winbind=2:3.6.3-2ubuntu2 libpam-winbind=2:3.6.3-2ubuntu2 smbclient=2:3.6.3-2ubuntu2

apt-mark hold samba smbclient samba-common winbind libwclient0 libpam-winbind

Answer 1

I have the same problem:

https://serverfault.com/questions/771388/how-can-i-fix-samba-3-6-25-the-trust-relationship-between-this-workstation-and

A workaround is to reinstall the old packages (see the link).

Answer 2

Downgrade of samba to previous version worked as a workaround, not the real solution:

apt-get install samba=2:3.6.3-2ubuntu2 samba-common=2:3.6.3-2ubuntu2 libwbclient0=2:3.6.3-2ubuntu2 winbind=2:3.6.3-2ubuntu2 libpam-winbind=2:3.6.3-2ubuntu2 smbclient=2:3.6.3-2ubuntu2

apt-mark hold samba smbclient samba-common winbind libwclient0 libpam-winbind

Answer 3

possibly related and see my answer there: Samba Share user/password error after update

I will update this answer, if this is indeed the solution.