Hello, First of all, thank you for samba <3 and sorry if I'm not clear - I'll do my best providing everything requested ! === DESCRIPTION === A Lexmark MX410de printer (firmware LW90.SB4.P231) fails to join the AD domain hosted by Samba 4.22.8. The join is triggered via the printer embedded web server: Settings > "Join an Active Directory Domain" (Domain, User, Password). The printer reports a generic failure. Packet capture shows the join sequence stops at the SMB Session Setup phase. === ENVIRONMENT === - Samba 4.24.3+dfsg-1~bpo13+1 backport on Debian 13 (trixie) - Two AD DCs: dc1 (10.0.0.1, PDC) and dc2 (10.0.0.2) - Domain: AD.HOME, functional level 2016 (migrated from 2008) - Client: Lexmark MX410de firmware LW90.SB4.P231 (latest available as of June 2026) - No prior GSSAPI/Kerberos configuration on the printer === OBSERVED JOIN SEQUENCE (packet capture, tshark) === 1. CLDAP UDP ping × 3 → success (flags=0x00000005) 2. SMB Negotiate Protocol Request (SMB1) → SMB2 Negotiate Protocol Response 3. TGS-REQ for cifs/dc1.ad.home (AES256) → TGS-REP: ticket obtained OK 4. SMB2 Session Setup Request (1860 bytes): SPNEGO negTokenInit: mechTypes: [Kerberos5, NTLMSSP] mechToken: Kerberos AP-REQ SMB2 Session Setup Response (165 bytes): Status: STATUS_MORE_PROCESSING_REQUIRED SPNEGO negTokenResp: negState: request-mic (3) Blob length: 23 bytes Session Flags: Encrypt=False 5. [No further Session Setup from client — join fails] === ROOT CAUSE === Samba returns negState=request-mic(3) in the SPNEGO Session Setup response because the client proposes both Kerberos and NTLMSSP in its negTokenInit (RFC 4178 section 3.2 — Samba requests a MIC to protect against mechType downgrade attacks). The Lexmark firmware does not implement the MIC response and abandons the SMB handshake after receiving request-mic. Note: with ntlm auth = disabled in smb.conf, Samba still advertises NTLMSSP in the SMB2 Negotiate response SecurityBlob and still requests MIC when the client proposes multiple mechanisms. === CLDAP FLAGS (secondary issue) === CLDAP UDP response returns flags=0x00000005: DS_SERVER_DS (0x001) set DS_SERVER_LDAP (0x004) set DS_SERVER_PDC NOT set DS_SERVER_GC NOT set DS_SERVER_KDC NOT set DS_SERVER_TIMESERV NOT set DS_SERVER_WRITABLE NOT set This DC is not an RODC (UAC=532480, primaryGroupID=516). These incomplete flags may also contribute to the join failure (client may reject the DC as unsuitable before or after the SMB phase). === SMB.CONF (relevant parameters) === [global] ad dc functional level = 2016 realm = AD.HOME workgroup = AD server role = active directory domain controller ldap server require strong auth = yes restrict anonymous = 2 ntlm auth = disabled nt hash store = never reject md5 servers = true disable netbios = yes smb ports = 445 client min protocol = SMB3 smb encrypt = if_required server services = -dns tls enabled = yes tls verify peer = as_strict_as_possible idmap_ldb:use rfc2307 = yes