Huge log flooding: NT_STATUS_NO_SUCH_USER for NT Authority after upgrade to samba 4.21.1

Hi everyone,

After upgrading my environment from samba 4.10 to version 4.21, I’ve
noticed a massive amount of log flooding.
My Samba logs are filling up with tens of thousands of entries like this:

{
"timestamp": "2026-03-09T07:45:32.235933+0100",
"type": "KDC Authorization",
"KDC Authorization": {
   "version": {
    "major": 1,
    "minor": 0
   },
   "status": "NT_STATUS_NO_SUCH_USER",
   "localAddress": null,
   "remoteAddress": "ipv4:10.10.235.171:49775",
   "serviceDescription": "krbtgt/NT\\ [email protected]",
   "authType": "TGS-REQ with Ticket-Granting Ticket",
   "domain": null,
   "account": null,
   "sid": null,
   "logonServer": "UCSDC1",
   "authTime": "2026-03-09T07:45:32.234291+0100",
   "serverPolicyAccessCheck": null
 }
}

It seems that clients (like 10.10.235.171 in the example) are trying to
request a Kerberos ticket for the “NT Authority” identity,
which the KDC obviously cannot find in the database.

best, bb.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba