When we get the following: netr_LogonSamLogonEx: struct netr_LogonSamLogonEx out: struct netr_LogonSamLogonEx validation : * validation : union netr_Validation(case 6) sam6 : NULL authoritative : * authoritative : 0x00 (0) flags : * flags : 0x00000000 (0) 0: NETLOGON_SAMLOGON_FLAG_PASS_TO_FOREST_ROOT 0: NETLOGON_SAMLOGON_FLAG_PASS_CROSS_FOREST_HOP 0: NETLOGON_SAMLOGON_FLAG_RODC_TO_OTHER_DOMAIN 0: NETLOGON_SAMLOGON_FLAG_RODC_NTLM_REQUEST result : NT_STATUS_ACCESS_DENIED It means we need to try another server! A typical case is broken sysvol replication where the dc still has SysvolReady=0 in HKLM\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters If that happens we need to blacklist that server and retry with another one or return NO_LOGON_SERVERS with authoritative=1 in the end.
Such a DC is in "PAUSE" mode. See MS-ADTS 6.3.3.2 Domain Controller Response to an LDAP Ping: ... Let t be set as follows: - When the Netlogon service is in a paused state, if v does not have the NETLOGON_NT_VERSION_PDC bit set or the server is not a PDC, let t be 1. - If the value of rootDSE attribute isSynchronized (see section 3.1.1.3) is false, let t be 1. - When the Netlogon RPC server is not initialized, if v does not have the NETLOGON_NT_VERSION_LOCAL bit set, let t be 1. - If the FRS service is in a paused state, let t be 1. - Otherwise, let t be 0. ... OperationCode: Set to LOGON_SAM_PAUSE_RESPONSE_EX if t is equal to 1. Set to LOGON_SAM_USER_UNKNOWN_EX if u is not NULL, but x is NULL. Set to LOGON_SAM_LOGON_RESPONSE_EX in other cases. Currently we're completely ignoring the OperationCode... and also try to use paused DCs.
This bug was referenced in samba master: ca859e55d28f421196bc2660cfa84595ec5b57c6
Created attachment 18312 [details] Patch for v4-20-test
Created attachment 18313 [details] Patch for v4-19-test
Comment on attachment 18312 [details] Patch for v4-20-test LGTM, RB+
Comment on attachment 18313 [details] Patch for v4-19-test LGTM, RB+
Jule, please add to v4-20 and v4-19. Thanks!
This bug was referenced in samba v4-19-test: fab04efa32564a47191c775d1b51362bf0c5658a
This bug was referenced in samba v4-20-test: 4257e3b8fef705216a630320e0743a0ab6ed43bb
There's more to do to fix the bug...
This bug was referenced in samba v4-19-stable (Release samba-4.19.7): fab04efa32564a47191c775d1b51362bf0c5658a
This bug was referenced in samba v4-20-stable (Release samba-4.20.2): 4257e3b8fef705216a630320e0743a0ab6ed43bb
To clarify: the patches present in this bugreport are far from the complete fix.
This bug was referenced in samba master: 613ac83fb7666f5b132187d5587053e0d7dcd46d 7fed75c495ead8f476c805b91cc6624ebf933427 08c8760ad9706b62755e35acaa121647344a4c9e 63051a2dcbe3a4a07f029e0c18aa90bd3f56b0a4 a397801598eef4b0381a64a37af1845e9e85a50f d3000d7df09de724694aa0682b9750b8c7767514 5217bd1a2334825fed32f40c57f72464d126aac0 c1ee6fe9a489a8923d607e14d26768935a398849
Created attachment 18680 [details] Patch for 4.22 cherry-picked from master
Created attachment 18681 [details] Patch for 4.21 backported from master
Comment on attachment 18680 [details] Patch for 4.22 cherry-picked from master LGTM, RB+
Comment on attachment 18681 [details] Patch for 4.21 backported from master LGTM, RB+
Jule, please add to to v4-22 and v4-21. Thanks!
Pushed to autobuild-v4-{22,21}-test.
This bug was referenced in samba v4-21-test: 56b975c4ff461d79a0ca12cf61a3628315655aab 23eeafe43e90a62f586a521506ed3d3013852a4e 2994369b3bdf5b1fe35a6222a380bf0b6def4588 a9250ab504ea30dbf64bad54e5f7f4f7393de832 e56376504a82080b09ed50c320fddddc0769850d a0bf6a94267364c59c57a8c442ee0cf7860c3b73 ad604bb46f203caca18e4bd19d02e33f11621ea3 4750b7b59057bdd97fa34203a6344a2a8b3707b6
This bug was referenced in samba v4-22-test: f7b28aa9cb4ffceff9ac5ffd650a172476d233a2 48ce6782a974ef6f983579ecf1dadebd741f71b2 213af0ed20bdd97157c8a08e6959d76c5f9d27aa a77d376ab5ac36ee0786d6d01b448665c9ad156c 10c00de2616b4fcb056a1c1f1300a08226a46d8c 02080bdbf6929c3e06092a49b7bf31e65b90d972 a7eaa61f728f73a4eaa458a1bd5c5129ac8eb31f 4a05b06b12a5640655e83914b92065c627762122
Closing out bug report. Thanks!
This bug was referenced in samba v4-22-stable (Release samba-4.22.4): f7b28aa9cb4ffceff9ac5ffd650a172476d233a2 48ce6782a974ef6f983579ecf1dadebd741f71b2 213af0ed20bdd97157c8a08e6959d76c5f9d27aa a77d376ab5ac36ee0786d6d01b448665c9ad156c 10c00de2616b4fcb056a1c1f1300a08226a46d8c 02080bdbf6929c3e06092a49b7bf31e65b90d972 a7eaa61f728f73a4eaa458a1bd5c5129ac8eb31f 4a05b06b12a5640655e83914b92065c627762122
This bug was referenced in samba v4-21-stable (Release samba-4.21.8): 56b975c4ff461d79a0ca12cf61a3628315655aab 23eeafe43e90a62f586a521506ed3d3013852a4e 2994369b3bdf5b1fe35a6222a380bf0b6def4588 a9250ab504ea30dbf64bad54e5f7f4f7393de832 e56376504a82080b09ed50c320fddddc0769850d a0bf6a94267364c59c57a8c442ee0cf7860c3b73 ad604bb46f203caca18e4bd19d02e33f11621ea3 4750b7b59057bdd97fa34203a6344a2a8b3707b6