Hai, i noticed that when a domain is joined as DC, the rights on /var/lib/samba/private/dns.keytab its set to root:root 600 and not root:bind 640 ( tested on debian wheezy ) im speaking of the sernet packages, I noticed this as of samba 4.1.8, still exists in 4.1.17 and 4.2.1 i dont know it this belongs here, but i already reported this 2x at support@sernet.de.
sorry duplicate of : bug report : 10881 *** This bug has been marked as a duplicate of bug 10881 ***