[mlcdigital]

Here is the server’s /etc/smb.conf file…
[code][global]
encrypt passwords = yes
workgroup = SOMETHING
display charset = UTF-8-MAC
security = user
deadtime = 5
guest account = unknown
add machine script = /usr/bin/opendirectorypdbconfig -c create_computer_account -r %u -n “/LDAPv3/127.0.0.1”
add user script = /usr/bin/opendirectorypdbconfig -c create_user_account -r %u -n “/LDAPv3/127.0.0.1”
client ntlmv2 auth = no
preferred master = yes
defer sharing violations = no
allow trusted domains = no
netbios name = FileServer
lanman auth = YES
vfs objects = darwin_acls
wins support = yes
brlm = yes
max smbd processes = 0
server string = File and Print Server
logon drive = H:
os level = 20
domain logons = yes
passdb backend = opendirectorysam guest
dos charset = CP437
unix charset = UTF-8-MAC
auth methods = guest opendirectory
local master = yes
domain master = yes
map to guest = Never
use spnego = yes
printer admin = @admin, @staff
logon path = %Nprofiles%u
ntlm auth = YES
log level = 0
[Public]
vfs objects = darwin_acls
map archive = no
path = /Shared Items/Public
read only = no
inherit permissions = no
comment = macosx
create mask = 0644
guest ok = 0
directory mask = 0755
[homes]
root preexec = /usr/sbin/inituser %U
read only = no
comment = User Home Directories
browseable = no
create mode = 0750
[profiles]
oplocks = yes
path = /Users/Profiles
read only = no
strict locking = no
browseable = no
[printers]
printable = yes
path = /tmp
[netlogon]
oplocks = yes
path = /etc/netlogon
strict locking = no
browseable = no
write list = @admin
[Groups]
vfs objects = darwin_acls
map archive = no
path = /Groups
read only = no
inherit permissions = no
comment = macosx
create mask = 0644
guest ok = 0
directory mask = 0755
[Users]
vfs objects = darwin_acls
map archive = no
path = /Users
read only = no
inherit permissions = no
comment = macosx
create mask = 0644
guest ok = 0
directory mask = 0755
[/code]
When I try to join the domain via My Computer > Properties > Computer Name > Change or My Computer > Properties > Computer Name > Network ID I get these errors.
[code]The domain name SOMETHING might be a NetBIOS domain name. If this is the case, verify that the domain name is properly registered with WINS.

If you are certain that the name is not a NetBIOS domain name, then the following information can help you troubleshoot your DNS configuration.

The following error occurred when DNS was queried for the service location (SRV) resource record used to locate a domain controller for domain SOMETHING:

The error was: “DNS name does not exist.”
(error code 0x0000232B RCODE_NAME_ERROR)

The query was for the SRV record for _ldap._tcp.dc._msdcs.SOMETHING

Common causes of this error include the following:

– The DNS SRV record is not registered in DNS.

– One or more of the following zones do not include delegation to its child zone:

SOMETHING
. (the root zone)

For information about correcting this problem, click Help.[/code]
So then I go under my TCP/IP properties and force NetBIOS over TCP/IP but I still get the same error.
I have set Windows service role from PDC to Standalone and Stop/Start Service. Then changed the roll from Standalone to PDC and Stop/Start Service. I’ve also changed the roll and did a cold restart to the server.
I’ve not only cold restarted the server after most of the config changes I’ve also restarted the WinXP client after making changes to the server and/or client..

[mlcdigital]

It seems that my issue was due to corrupt samba cache and the admin password was way to complex.
As I wrote before; I’ve done a clean install -> Configured DNS -> Configured DHCP -> Configured OpenDirectory -> Tested DHCP, DNS, OpenDirectory, and Kerberos from a Mac OS X.4 client -> Configured Windows (Samba) as the PDC -> Tested it by binding a Win XP client but I ran into auth and profile issues.
The resolution to the auth issue was to keep password simple (no special characters ie: !@#$%^&*) so I changed it. After doing that I could bind to the domain.
The profile issue was resolved through Workgroup Manager under the Windows preferences.
Everything is resolved 🙂

[mlcdigital]

Since the server isn’t live and doesn’t have any users in the OD DB I started from scratch.
Installed OS X.4 Server -> Updated -> Setup DNS -> Setup DHCP -> Setup OpenDirectory -> Tested everything on a client machine (including Kerberos) -> Setup Windows (Samba) as PDC -> Tested Windows (Samba) by binding a Win XP client.
This time I was able to get an authentication box when I tried binding the WinXP client to the server but I get some kind of authentication errors.
[code]Your computer could not be joined to the domain because the following error has occurred:
No mapping between account names and security IDs was done.[/code]
I was reading someplace on AFP548.com about granting certain users in OD through terminal AD admin permissions.
Would this be my next step?

[mlcdigital]

It does give me errors when trying to bind to the domain…
[code]The domain name SOMETHING might be a NetBIOS domain name. If this is the case, verify that the domain name is properly registered with WINS.

If you are certain that the name is not a NetBIOS domain name, then the following information can help you troubleshoot your DNS configuration.

The following error occurred when DNS was queried for the service location (SRV) resource record used to locate a domain controller for domain SOMETHING:

The error was: “This operation returned because the timeout period expired.”
(error code 0x000005B4 ERROR_TIMEOUT)

The query was for the SRV record for _ldap._tcp.dc._msdcs.SOMETHING

The DNS servers used by this computer for name resolution are not responding. This computer is configured to use DNS servers with the following IP addresses:

10.1.0.1
10.1.0.2
10.1.0.3

Verify that this computer is connected to the network, that these are the correct DNS server IP addresses, and that at least one of the DNS servers is running.

For more information on how to correct this problem, click Help.[/code]
Windows service configured as PDC, Domain: SOMETHING, Enabled:WINS…
I’ve tried binding Mac OS X.4 to ActiveDirectory but I also get errors (don’t have them documented).
I know that NetBIOS/WINS isn’t working off the server correctly because the clients can’t even find the server. Also, I have the log settings at high in order to debug this but I get nothing as far as client connection requests/errors.

[mlcdigital]

I am binding to the domain two ways.
Right clicking My Computer -> Properties -> Computer Name -> Network ID -> Walk through the wizard to connect to a domain
And I’ve done it this way…
Right clicking My Computer -> Properties -> Computer Name -> Change -> Select Domain and input the domain -> I’m never prompted for an Admin Username/Password to join the domain.

I’ve built and designed Windows NT/2000/2003 Server domains/networks and understand DNS, DHCP, and NetBIOS/WINS/ActiveDirectory.
I’ve also designed Mac OS X.1/4 Server NetInfo/OpenDirectory networks.

The server is running DNS, DHCP, AFP, OD, and Kerberos perfectly. I’ve even tested the SingleSignOn capabilities with success.

What I have noticed in the Samba logs is that both IP/NICs are listening for WINS/NetBIOS. I know having more then one Master Browser on the network can/could cause trouble.
I configured both NICs to listen for OD/LDAP and WINS assuming that the server would do some traffic balancing decreasing latency/lag.

[mlcdigital]

Whelp guess what…???
I’ve enabled NetBIOS over TCP/IP as described at that site.
Then I tried binding to the domain via the Network ID wizard and the Change Name.
I got the same errors as before.
So then I installed the ‘NWLink IPX/SPX NetBIOS Compatible Transport Protocol’ and gave it a try binding the two ways listed above and it gave me the same errors.
I’ve restarted the Win XP machine after making these adjustments each and every time.
Is there something else that might be causing the conflict?

[mlcdigital]

I think my problem is bigger then that…
I’ve changed the Windows PDC Domain Settings on the Mac OS X.4 Server to SOMETHING and then tried binding to it via a Windows XP client.
I tried binding to the PDC from the Win XP client through simply changing the Domain under Computer Name and I also tried using the Network ID wizard.
These are the errors I get…
[code]
The domain name SOMETHING might be a NetBIOS domain name. If this is the case, verify that the domain name is properly registered with WINS.

If you are certain that the name is not a NetBIOS domain name, then the following information can help you troubleshoot your DNS configuration.

The following error occurred when DNS was queried for the service location (SRV) resource record used to locate a domain controller for domain SOMETHING:

The error was: “This operation returned because the timeout period expired.”
(error code 0x000005B4 ERROR_TIMEOUT)

The query was for the SRV record for _ldap._tcp.dc._msdcs.SOMETHING

The DNS servers used by this computer for name resolution are not responding. This computer is configured to use DNS servers with the following IP addresses:

10.1.0.1
10.1.0.2
10.1.0.3

Verify that this computer is connected to the network, that these are the correct DNS server IP addresses, and that at least one of the DNS servers is running.

For more information on how to correct this problem, click Help.[/code]

[code]
The domain name SOMETHING might be a NetBIOS domain name. If this is the case, verify that the domain name is properly registered with WINS.

If you are certain that the name is not a NetBIOS domain name, then the following information can help you troubleshoot your DNS configuration.

The following error occurred when DNS was queried for the service location (SRV) resource record used to locate a domain controller for domain SOMETHING:

The error was: “DNS server failure.”
(error code 0x0000232A RCODE_SERVER_FAILURE)

The query was for the SRV record for _ldap._tcp.dc._msdcs.SOMETHING

Common causes of this error include the following:

– The DNS servers used by this computer contain incorrect root hints. This computer is configured to use DNS servers with following IP addresses:

10.1.0.1
10.1.0.2
10.1.0.3

– One or more of the following zones contains incorrect delegation:

SOMETHING
. (the root zone)

For information about correcting this problem, click Help.[/code]

Here is the server configuration from DHCP to DNS…
DHCP supplied DNS Default Domain: something.com, Name Servers: 10.1.0.3, 10.1.0.2, 10.1.0.1, WINS Primary/Secondary: 10.1.0.3, 10.1.0.2, NBDD Server: 10.1.0.2, NBT Node Type: Mixed, NetBIOS Scope ID: SOMETHING
DNS: Name Servers: server.something.com, server.something.com points to 10.1.0.2 and 10.1.0.3, Server IP Address: 10.1.0.2

Again, I’ve release/renewed/flushed IP/DNS. I’ve rebooted the server and the client. LDAP, OpenDirectory, and Kerberos are working 100% on Mac OS X.x clients and the server.

What am I overlooking?

[mlcdigital]

So no . at all?
I’ve setup tons of Win2K AD servers in my career and have always used full domain names ‘something.com’ or fake ones like ‘something.local’.
I’ll have to try setting up the PDC on the Mac OS X.4 Server with the domain ‘something’ and see if I can bind to it with the XP machine.
I did try setting it up ‘something.local’ but that didn’t work.
Thanks for the replies…

[mlcdigital]

The following is the error I get when trying to bind Windows XP to the Mac OS X.4 PDC.

[code]
Note: This information is intended for a network administrator. If you are not your network’s administrator, notify the administrator that you received this information, which has been recorded in the file C:\WINDOWS\debug\dcdiag.txt.

The following error occurred when DNS was queried for the service location (SRV) resource record used to locate a domain controller for domain fake.domain.name:

The error was: "DNS name does not exist."
(error code 0x0000232B RCODE_NAME_ERROR)

The query was for the SRV record for _ldap._tcp.dc._msdcs.fake.domain.name

Common causes of this error include the following:

– The DNS SRV record is not registered in DNS.

– One or more of the following zones do not include delegation to its child zone:

fake.domain.name
domain.name
name
. (the root zone)

For information about correcting this problem, click Help.
[/code]

DNS is working just fine.
I can resolve the server name and domain name from the WinXP client.
OD and Kerberos is working perfect on the Mac OS X.4 Server.
I’ve ran ipconfig /flushdns /release /renew and have rebooted but this error still happens.

Any Ideas???!!!

[mlcdigital]

I was meaning to edit my post…

On the OS X server I am using the domain name something.com not pdc.something.com.
Then on an XP machine I try to bind to the domain something.com but I get errors that the domain doesn’t exist.

I am not binding the OS X clients via AD they are binding via DHCP supplied LDAPv3.

[mlcdigital]

I setup a Mac OS X.4 server several months ago.
It’s running all network services DHCP, DNS, OD, AD AFP, SMB…
Initially I set it up as a standalone server.
Configured DNS and DHCP verified and tested it but I had the dns server(s) under Network Config as 127.0.0.1 and firewall address so I changed it to the server’s network address.
Configured OD as “Master” and configured LDAP to point to the server by it’s DNS name.
All services show as running.

I get this error when trying to connect to the server using Kerberos authentication.

Client not found in Kerberos database

Below are the most recent log files from Server Admin

kadmin Log
Feb 06 16:36:34 localhost kadmind[63](debug): Got signal to request exit
Feb 06 16:36:34 localhost kadmind[63](info): finished, exiting
Feb 06 16:37:52 localhost kadmind[65](info): Seeding random number generator
Feb 06 16:37:52 localhost kadmind[65](info): No dictionary file specified, continuing without one.
Feb 06 16:37:52 localhost kadmind[65](info): starting

kdc Log
Feb 06 17:04:36 server.acton.k12.me.us krb5kdc[221](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 10.1.0.170: ISSUE: authtime 1139263476, etypes {rep=16 tkt=16 ses=16}, [email protected] for krbtgt/[email protected]
Feb 06 17:04:37 server.acton.k12.me.us krb5kdc[221](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) 10.1.0.170: UNKNOWN_SERVER: authtime 1139263476,  [email protected] for afpserver/[email protected], Server not found in Kerberos database

LDAP Log
Feb  6 15:44:07 server slapd[65]: <= bdb_equality_candidates: (apple-computers) index_param failed (18)\n
Feb  6 16:11:47 server slapd[65]: SASL [conn=13630] Failure: no user in database\n
Feb  6 16:37:52 localhost slapd[67]: @(#) $OpenLDAP: slapd 2.2.19 $\n
Feb  6 16:37:53 localhost slapd[67]: bdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December  3, 2003)\n
Feb  6 16:37:53 localhost slapd[67]: bdb_db_init: Initializing BDB database\n
Feb  6 16:37:53 localhost slapd[67]: slapd starting\n
Feb  6 16:45:11 server slapd[67]: connection_input: conn=29 deferring operation: awaiting write\n
Feb  6 17:12:12 server slapd[67]: SASL [conn=90] Failure: no user in database\n

Password Service Server Log
Feb  6 2006 17:04:14	KERBEROS-LOGIN-CHECK: user {0x4303712f46fde9440000000400000004, mcorey} authentication failed.
Feb  6 2006 17:04:14	QUIT: {no user} disconnected.
Feb  6 2006 17:04:36	KERBEROS-LOGIN-CHECK: user {0x00000000000000000000000000000001, admin} is in good standing.
Feb  6 2006 17:04:36	QUIT: {no user} disconnected.
Feb  6 2006 17:04:36	KERBEROS-LOGIN-CHECK: user {0x00000000000000000000000000000001, admin} authentication succeeded.
Feb  6 2006 17:04:36	QUIT: {no user} disconnected.
Feb  6 2006 17:12:12	KERBEROS-LOGIN-CHECK: no principal ([email protected])
Feb  6 2006 17:12:12	QUIT: {no user} disconnected.

After reading through this tread I’ve noticed that there is one thing that I haven’t done but probably need to do in order to remedy this issue and that is to demote OD to Standalone -> Reboot -> promote OD to Master/Primary.
I can’t and won’t do that because we already have 300 users in the database.
I’m not going to tell everyone that their passwords have all been reset and they need to change their passwords.
Is there a way around my issues without dropping the database and then importing the database?

[Author]

Posts