winbind: get_kdc_ip_string: get_kdc_list fail NT_STATUS_NO_LOGON_SERVERS

Hi!

I'm facing a repeated issue with winbind on a samba-provided AD domain.
On a regular basis I see the following logging from winbindd:

[2026/02/04 00:34:52.524857,  0, traceid=683] 
source3/libads/kerberos.c:1128(get_kdc_ip_string)
   get_kdc_ip_string: get_kdc_list fail NT_STATUS_NO_LOGON_SERVERS
[2026/02/04 00:34:52.530395,  0, traceid=684] 
source3/libads/kerberos.c:1128(get_kdc_ip_string)
   get_kdc_ip_string: get_kdc_list fail NT_STATUS_NO_LOGON_SERVERS
[2026/02/04 00:34:52.532037,  0, traceid=684] 
source3/libads/kerberos.c:1128(get_kdc_ip_string)
   get_kdc_ip_string: get_kdc_list fail NT_STATUS_NO_LOGON_SERVERS
[2026/02/04 00:34:52.534203,  0, traceid=685] 
source3/libads/kerberos.c:1128(get_kdc_ip_string)
   get_kdc_ip_string: get_kdc_list fail NT_STATUS_NO_LOGON_SERVERS
[2026/02/04 00:34:52.535875,  0, traceid=685] 
source3/libads/kerberos.c:1128(get_kdc_ip_string)
   get_kdc_ip_string: get_kdc_list fail NT_STATUS_NO_LOGON_SERVERS
[2026/02/04 00:34:52.538973,  0, traceid=686] 
source3/libads/kerberos.c:1128(get_kdc_ip_string)
   get_kdc_ip_string: get_kdc_list fail NT_STATUS_NO_LOGON_SERVERS
[2026/02/04 00:34:52.540486,  0, traceid=686] 
source3/libads/kerberos.c:1128(get_kdc_ip_string)
   get_kdc_ip_string: get_kdc_list fail NT_STATUS_NO_LOGON_SERVERS

These strings gets logged in batches in size of about 2-3 dozens,
just for today it happened at:

00:34:52
00:34:57
00:35:00
00:35:51
01:05:59
01:26:59
01:27:03
01:27:07
02:58:42
03:49:27
04:47:42
07:25:59
08:21:36
09:18:16
09:18:32

Connectivity with two AD-DCs in the domain is good, one is running on
the same machine (in a container) so is always immediately reachable,
another has been reachable without any single glitch today at least.
All AD-related DNS records are here, DNS always works.

Does this ring a bell to someone?

Maybe some hints about the debugging?  I'll try increasing the log level
for winbindd for a start..

Samba is from debian trixie (4.22.6+dfsg-0+deb13u1) - not the latest
by samba's standards, but should still work.

Thanks,

/mjt

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba