Hi, I recently contacted Jelmer Vernooij, and he suggested that I file a bug report.

I've been setting up a new PDC using mysql as the samba backend and I've discovered a problem that you or someone else might have run into. There isn't much documentation out there about using mysql as a backend, so I thought you might shed some light on the situation.

Specs:
Samba 3.0.21
MySQL 14.7, Dist 4.1.16 (pc-linux-gnu i686, readline 4.3)
RedHat Linux Enterprise 3.2.3-20 (Kernel 2.4.21-4, gcc 3.2.3)

Here's what happens:
When a new computer account is added to the server (an account is made in linux using 'adduser', as usual). Now, one of two things can happen when joining to the domain:
1. Adding the computer using "pdbedit -a -m -u MACHINENAME"
   - The computer adds to the database, but the lm password is NOT "XXXXX...XXX", but an actual hash of something, and the nt password is set to some hash (where these come from, I don't know)
   - Now, on the windows computer (either 2000 or XP/XPSP1/XPSP2), joining to the domain will fail. I don't remember the error, but this isn't the interesting part. I think this might have something to do with the computer not being able to work with the password in created in the database.

2. Adding the computer by just using the windows maching (not using pdbedit).
   - The computer adds to the database, and sets its password XXX..XXX:SOMEHASHPW
   but at the same time, EVERY password in the database is set to the password created by the machine.

I have used a temporary solution to get around this, but that will start to fail soon.
This is what I've been doing:
1. Backup the database 'domain'
2. Add the computer to the domain
3. Copied the password hash for the new machine
4. Restored the database (because all of the passwords have been changed)
5. use 'pdbedit -a -m -u MACHINE'
6. Copy the password back for the machine.
7. And then backup the database again.

And now there's another problem with this solution. All day I've had to keep restoring the database because something is updating all the passwords. Whether this is a user 'trying' to add to the domain, or if it's something else, I don't know. Right now I've disabled update/delete permissions for 'samba' in the database. This should protect the user and machine passwords for now, but I need to get to a solution.