As pointed out several times, there's a logic error in winbind when handling disconnect of a connection to the nearby kdc.  The most recent report with debugging is this: https://lists.samba.org/archive/samba/2026-March/252709.html .

Basically, after receiving disconnect from LDAP, winbind declares that this kdc is dead, and tries the next one, instead of retrying the one which got disconnected.  But in case there's just one DC on the site, it finds the same DC, which is already marked dead, and, instead of trying other sites, it declares there's no logon servers.  The message referenced above has complete analysis.

This is happening for quite some time, at least since samba 4.18, and up to current 4.25-rc.

Besides this logic error, I really wonder why winbind keeps persistent connection to the DCs.  No windows machine does this.  Can't it drop the connection when idle, or use some other way (UDP?) to do the same, in order to free the resources?  On one of our bigger domanis, their admins complains to us about every samba server keeping persistent connection.

Thanks,

/mjt