Re: Huge log flooding: NT_STATUS_NO_SUCH_USER for NT Authority after upgrade to samba 4.21.1

On Mon, 9 Mar 2026 17:38:59 +0100
banda bassotti via samba <[email protected]> wrote:

> Hi everyone,
> 
> After upgrading my environment from samba 4.10 to version 4.21, I’ve
> noticed a massive amount of log flooding.
> My Samba logs are filling up with tens of thousands of entries like
> this:
> 
> {
> "timestamp": "2026-03-09T07:45:32.235933+0100",
> "type": "KDC Authorization",
> "KDC Authorization": {
>    "version": {
>     "major": 1,
>     "minor": 0
>    },
>    "status": "NT_STATUS_NO_SUCH_USER",
>    "localAddress": null,
>    "remoteAddress": "ipv4:10.10.235.171:49775",
>    "serviceDescription": "krbtgt/NT\\ [email protected]",

That is probably the SID 'S-1-5-19' and as such is a local user, so
what is trying to authenticate ?
Possibly a virus scanner ???

>    "authType": "TGS-REQ with Ticket-Granting Ticket",
>    "domain": null,
>    "account": null,
>    "sid": null,
>    "logonServer": "UCSDC1",

Univention ?

>    "authTime": "2026-03-09T07:45:32.234291+0100",
>    "serverPolicyAccessCheck": null
>  }
> }
> 
> It seems that clients (like 10.10.235.171 in the example) are trying
> to request a Kerberos ticket for the “NT Authority” identity,
> which the KDC obviously cannot find in the database.
> 
> best, bb.

Can we start by seeing the smb.conf file.

Rowland

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba