Hai, 

I dont know much of AIX, but you config dont look good to me. 
I suggest you try again but with the following settings, adapt where needed and check again.


/etc/hosts
127.0.0.1  localhost
IP of this server     nrfvclyde.ad.nrfdist.com nrfvclyde
# the ip of the server is the one that contains also the A+PTR record. 

# AD servers, should resolve through DNS, but this is allowed. 
10.10.10.50 nrfvad01.ad.nrfdist.com nrfvad01
10.10.10.51 nrfvad02.ad.nrfdist.com nrfvad02



/etc/resolv.conf
search ad.nrfdist.com
nameserver      10.10.10.50
nameserver      10.10.10.51
options rotate

/etc/krb5.conf
[logging]
    default=FILE:/var/log/krb5/libs.log
    kdc=FILE:/var/log/krb5/kdc.log
    admin_server=FILE:/var/log/krb5/admin.log

[libdefaults]
    default_realm = AD.NRFDIST.COM
    dns_lookup_realm = false
    dns_lookup_kdc = true
    ticket_lifetime = 24h
    forwardable = yes



# Format: WORKGROUPNAME\Administrator 
/etc/samba/user.map
!root = NRFDIST\Administrator  NRFDIST\administrator

/etc/samba/smb.conf
# i removed most of you shares, so readd these but have a look at this. 
# much better to read now. 
[global]

    private dir = /opt/freeware/private                
    cache directory = /opt/freeware/var/cache
    lock directory = /opt/freeware/var/locks
    private dir = /opt/freeware/var/private
    state directory = /opt/freeware/var/locks/state
    binddns dir = /opt/freeware/var/bind-dns

    log file = /opt/freeware/var/log.%m          	
    log level = smbd:1 passdb:1 auth:1 winbind:1 nmbd:1
    max log size = 10 # double , the other had : 50

    security = ADS
    workgroup = NRFDIST
    realm = AD.NRFDIST.COM
    netbios name = NRFVCLYDE

    server string = CLYDE Samba Server
    os level = 20
    preferred master = no	

    interfaces = ens3 lo
    #or  interfaces = ip/mask lo
    #optinal: bind interfaces only = yes

    username map = /etc/samba/user.map     
	
    ######################### CNL
    # Default ID mapping configuration for local BUILTIN accounts
    # and groups on a domain member. The default (*) domain:
    # - must not overlap with any domain ID mapping configuration!
    # - must use a read-write-enabled back end, such as tdb.
    idmap config * : backend = tdb
    idmap config  * : range = 1000-8999
	
    # - You must set a DOMAIN backend configuration ( Should match with workgroup) 
    idmap config NRFDIST : backend = rid
    idmap config NRFDIST : range = 10000-999999
    idmap config NRFDIST : unix_nss_info = no

    ########################  
    dedicated keytab file = /etc/krb5.keytab
    kerberos method = secrets and keytab
    winbind refresh tickets = Yes 

    # Only set these to yes, while testing, yes, slows down you server..
    # use: getent passwd username/group 
    winbind enum users = no
    winbind enum groups = no

    # separate domain and username with '+', like DOMAIN+username
    winbind separator = +
	
    # and this removes the "DOM+" part from your users.. 
    winbind use default domain = Yes

    # Disable printing
    load printers = no
	
    # give winbind users a real shell (only needed if they have telnet access)
    template homedir = /usr/users/%U
    template shell = /bin/bash

    # For ACL support on member servers with shares (Obligated for members)
    vfs objects = acl_xattr
    map acl inherit = Yes
    store dos attributes = Yes

    # other optional settings
    create mask = 0774   
    directory mask = 0775

#####################################

[homes]
    read only = No
    browseable = No

[mgmtdata]
    path = /pcdata/mgmtdata
    comment = shared directory for MgmtInqScr data
    writable = yes
    # If you apply all above settings, these "valid user" need to be changed.
    force create mode = 0666
    # I suggest, use groups here.
    valid users = \
       NRFDIST+bobb, \
       NRFDIST+wendyj, \
       NRFDIST+peterr, \
       NRFDIST+debbiej, \
       NRFDIST+stephm, \
       NRFDIST+sueb, \
       NRFDIST+andrewr, \
       NRFDIST+billn, \
       NRFDIST+gordons, \
       NRFDIST+gregc2, \
       NRFDIST+brendab2, \
       NRFDIST+erikaw, \
       NRFDIST+operator, \
       NRFDIST+melindab, \
       NRFDIST+donnat

[adtest]
    # Test like this and read man smb.conf
    # read also https://wiki.samba.org/index.php/Samba_File_Serving 
    path = /home/billn/tmp
    browseable = yes
    comment = test this share
    writable = yes
    force directory mode = 4775 # or 4770
    force group = +your-group-here


This should give a better result.

Thank you.

I changed the workgroup to match the domain & winbindd is now running.

 workgroup = AD.NRFDIST.COM <http://AD.NRFDIST.COM>

File /etc/hosts already had the AD servers;
 # cat /etc/hosts | grep vad
10.10.10.50 NRFVAD01  NRFVAD01.ad.nrfdist.com nrfvad01.ad.nrfdist.com
10.10.10.51 NRFVAD02  NRFVAD02.ad.nrfdist.com nrfvad02.ad.nrfdist.com

I changed the DNS server to use the AD servers. The 192.168.4.19 is the
old AD/DNS server.

 # cat  /etc/resolv.conf
nameserver      10.10.10.50
nameserver      10.10.10.51
# nameserver 192.168.4.19
# domain  ad.nrfdist.com
options rotate
search ad.nrfdist.com

Could not find machine account in secrets database: Failed to fetch
machine account password for AD.NRFDIST.COM from both secrets.ldb (Could
not find entry to match filter:
'(&(flatname=AD.NRFDIST.COM)(objectclass=primaryDomain))' base:
'cn=Primary Domains': No such object: dsdb_search at
../../source4/dsdb/common/util.c:4712) and from
/opt/freeware/var/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
[2019/09/20 09:01:51.894931,  1]
../../source3/winbindd/winbindd_cm.c:1306(cm_prepare_connection)
  Failed to prepare SMB connection to NRFVAD01.ad.nrfdist.com:
NT_STATUS_NETWORK_NAME_DELETED

 # nslookup
> set type=SRV
> NRFVAD01.ad.nrfdist.com
Server:         10.10.10.50
Address:        10.10.10.50#53

*** Can't find NRFVAD01.ad.nrfdist.com: No answer

 set type=SRV
>  NRFVAD01
Server:         10.10.10.50
Address:        10.10.10.50#53

*** Can't find NRFVAD01: No answer


Can you tell which directory/files has an issue? From the smbd log;
  messaging_dgm_cleanup(20054066) returned Permission denied
[2019/09/20 09:00:27.452589, 10, pid=12582966, effective(0, 0), real(0,
0)] ../../source3/lib/messages_dgm.c:1600(messaging_dgm_wipe_fn)

Also, the samba-tool is not compiled for my distribution. Is this a
compiled module or a perl script? Where can I locate a copy for AIX?



 # wbinfo --ping-dc
checking the NETLOGON for domain[AD.NRFDIST.COM] dc connection to "" failed
failed to call wbcPingDc: WBC_ERR_DOMAIN_NOT_FOUND

Thank you



‹
Regards,
Chris

Christopher Lee
President / CEO, ITS, Inc.
888.264.7852 <tel:888.264.7852> | T: 207.929.2612 <tel:T:%20207.929.2613>
| M: 207.266.9060 <tel:T:%20207.929.2613>
Chris.Lee@itsne.com | itsne.com <http://itsne.com/>
 <http://www.facebook.com/itsne>  <http://twitter.com/ITS_innovate>
<http://www.linkedin.com/company/its-inc-?trk=company_logo>
<http://plus.google.com/106571444730456248578/posts>
  IBM Premier Business Partner & Systems Integration Specialists
  
Please treat this and all communications from ITS, Inc. as confidential.
If you receive this in error please do not disseminate and destroy it
immediately.






On 9/20/19, 6:39 AM, "samba-bugs@samba.org" <samba-bugs@samba.org> wrote:

>https://bugzilla.samba.org/show_bug.cgi?id=14135
>
>--- Comment #1 from Louis <belle@samba.org> ---
>Hai, 
>
>I dont know much of AIX, but you config dont look good to me.
>I suggest you try again but with the following settings, adapt where
>needed and
>check again.
>
>
>/etc/hosts
>127.0.0.1  localhost
>IP of this server     nrfvclyde.ad.nrfdist.com nrfvclyde
># the ip of the server is the one that contains also the A+PTR record.
>
># AD servers, should resolve through DNS, but this is allowed.
>10.10.10.50 nrfvad01.ad.nrfdist.com nrfvad01
>10.10.10.51 nrfvad02.ad.nrfdist.com nrfvad02
>
>
>
>/etc/resolv.conf
>search ad.nrfdist.com
>nameserver      10.10.10.50
>nameserver      10.10.10.51
>options rotate
>
>/etc/krb5.conf
>[logging]
>    default=FILE:/var/log/krb5/libs.log
>    kdc=FILE:/var/log/krb5/kdc.log
>    admin_server=FILE:/var/log/krb5/admin.log
>
>[libdefaults]
>    default_realm = AD.NRFDIST.COM
>    dns_lookup_realm = false
>    dns_lookup_kdc = true
>    ticket_lifetime = 24h
>    forwardable = yes
>
>
>
># Format: WORKGROUPNAME\Administrator
>/etc/samba/user.map
>!root = NRFDIST\Administrator  NRFDIST\administrator
>
>/etc/samba/smb.conf
># i removed most of you shares, so readd these but have a look at this.
># much better to read now.
>[global]
>
>    private dir = /opt/freeware/private
>    cache directory = /opt/freeware/var/cache
>    lock directory = /opt/freeware/var/locks
>    private dir = /opt/freeware/var/private
>    state directory = /opt/freeware/var/locks/state
>    binddns dir = /opt/freeware/var/bind-dns
>
>    log file = /opt/freeware/var/log.%m
>    log level = smbd:1 passdb:1 auth:1 winbind:1 nmbd:1
>    max log size = 10 # double , the other had : 50
>
>    security = ADS
>    workgroup = NRFDIST
>    realm = AD.NRFDIST.COM
>    netbios name = NRFVCLYDE
>
>    server string = CLYDE Samba Server
>    os level = 20
>    preferred master = no
>
>    interfaces = ens3 lo
>    #or  interfaces = ip/mask lo
>    #optinal: bind interfaces only = yes
>
>    username map = /etc/samba/user.map
>
>    ######################### CNL
>    # Default ID mapping configuration for local BUILTIN accounts
>    # and groups on a domain member. The default (*) domain:
>    # - must not overlap with any domain ID mapping configuration!
>    # - must use a read-write-enabled back end, such as tdb.
>    idmap config * : backend = tdb
>    idmap config  * : range = 1000-8999
>
>    # - You must set a DOMAIN backend configuration ( Should match with
>workgroup) 
>    idmap config NRFDIST : backend = rid
>    idmap config NRFDIST : range = 10000-999999
>    idmap config NRFDIST : unix_nss_info = no
>
>    ########################
>    dedicated keytab file = /etc/krb5.keytab
>    kerberos method = secrets and keytab
>    winbind refresh tickets = Yes
>
>    # Only set these to yes, while testing, yes, slows down you server..
>    # use: getent passwd username/group
>    winbind enum users = no
>    winbind enum groups = no
>
>    # separate domain and username with '+', like DOMAIN+username
>    winbind separator = +
>
>    # and this removes the "DOM+" part from your users..
>    winbind use default domain = Yes
>
>    # Disable printing
>    load printers = no
>
>    # give winbind users a real shell (only needed if they have telnet
>access)
>    template homedir = /usr/users/%U
>    template shell = /bin/bash
>
>    # For ACL support on member servers with shares (Obligated for
>members)
>    vfs objects = acl_xattr
>    map acl inherit = Yes
>    store dos attributes = Yes
>
>    # other optional settings
>    create mask = 0774
>    directory mask = 0775
>
>#####################################
>
>[homes]
>    read only = No
>    browseable = No
>
>[mgmtdata]
>    path = /pcdata/mgmtdata
>    comment = shared directory for MgmtInqScr data
>    writable = yes
>    # If you apply all above settings, these "valid user" need to be
>changed.
>    force create mode = 0666
>    # I suggest, use groups here.
>    valid users = \
>       NRFDIST+bobb, \
>       NRFDIST+wendyj, \
>       NRFDIST+peterr, \
>       NRFDIST+debbiej, \
>       NRFDIST+stephm, \
>       NRFDIST+sueb, \
>       NRFDIST+andrewr, \
>       NRFDIST+billn, \
>       NRFDIST+gordons, \
>       NRFDIST+gregc2, \
>       NRFDIST+brendab2, \
>       NRFDIST+erikaw, \
>       NRFDIST+operator, \
>       NRFDIST+melindab, \
>       NRFDIST+donnat
>
>[adtest]
>    # Test like this and read man smb.conf
>    # read also https://wiki.samba.org/index.php/Samba_File_Serving
>    path = /home/billn/tmp
>    browseable = yes
>    comment = test this share
>    writable = yes
>    force directory mode = 4775 # or 4770
>    force group = +your-group-here
>
>
>This should give a better result.
>
>-- 
>You are receiving this mail because:
>You reported the bug.

this is more of a config support case, please do not use bugzilla for this but move it to the samba mailing list instead.

Team,

While there maybe a configuration issue with the smb.conf, it would be extremely helpful to have a better diagnostic msg. I cannot determine my error based on the message. 

interpret_interface: using netmask value 24 from config file on interface en0
added interface en0 ip=10.10.40.35 bcast=10.10.40.255 netmask=255.255.255.0
interpret_interface: Adding interface 127.0.0.1/8
added interface 127.0.0.1/8 ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
Netbios name list:-
my_netbios_names[0]="NRFVCLYDE"
interpret_interface: using netmask value 24 from config file on interface en0
added interface en0 ip=10.10.40.35 bcast=10.10.40.255 netmask=255.255.255.0
interpret_interface: Adding interface 127.0.0.1/8
added interface 127.0.0.1/8 ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
exit_daemon: daemon failed to start: Failed to create session, error code 1

The NETBIOS name & the workgroup names are both found. So, it is a puzzle why the winbindd session failed. Perhaps, provide the command so I could see the values.  Also, testparm does not report any issues. 

thank you
Chris

Team,

While there maybe a configuration issue with the smb.conf, it would be extremely helpful to have a better diagnostic msg. I cannot determine my error based on the message. 

interpret_interface: using netmask value 24 from config file on interface en0
added interface en0 ip=10.10.40.35 bcast=10.10.40.255 netmask=255.255.255.0
interpret_interface: Adding interface 127.0.0.1/8
added interface 127.0.0.1/8 ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
Netbios name list:-
my_netbios_names[0]="NRFVCLYDE"
interpret_interface: using netmask value 24 from config file on interface en0
added interface en0 ip=10.10.40.35 bcast=10.10.40.255 netmask=255.255.255.0
interpret_interface: Adding interface 127.0.0.1/8
added interface 127.0.0.1/8 ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
exit_daemon: daemon failed to start: Failed to create session, error code 1

The NETBIOS name & the workgroup names are both found. So, it is a puzzle why the winbindd session failed. Perhaps, provide the command so I could see the values.  Also, testparm does not report any issues. 

thank you
Chris