In current Samba 3.2, the connect4 call in samr.idl makes the client_version being parsed as 16 bit. This is wrong, according to MS docs this is a 32 bit field. Result of this flaw is that Windows 2000 clients can't connect to SAMR. This means that certain netlogon.bat style scripts asking for group memberships of the user logging on will fail. 67ca76c288eb095ae has the fix for master, this needs to be applied to 3.2 and 3.3 as well.
We got reports on irc #samba (thanks law!) that this is prevents w2ksp4 to join, with the fix it succeeds.
Created attachment 4095 [details] patch for 3.2
Created attachment 4096 [details] patch for 3.3
Created attachment 4104 [details] patch for 3.2 with signed-off
Created attachment 4105 [details] patch for 3.3 with signed-off
Patches are upstream. Closing out bug report.
Patches will be included in 3.2.12, 3.3.5 and 3.4.0.