Re: Huge log flooding: NT_STATUS_NO_SUCH_USER for NT Authority after upgrade to samba 4.21.1

On Tue, 10 Mar 2026 11:02:12 +0100
banda bassotti <[email protected]> wrote:

>  Hi Roland, unfortunately I haven't received your reply, 

I have no idea why you haven't received it, the mailing list did, Spam
filter ????

> so I'm
> writing directly here. Below is the smb.conf you requested.
> 
> [global]
>         dns forwarder = 192.168.1.3
>         realm = INTERNAL.LAN
>         ad dc functional level = 2016
>         server role = active directory domain controller
>         workgroup = INTERNAL
>         interfaces = 192.168.1.2,127.0.0.1
>         bind interfaces only = Yes
>         log level = 1 auth_json_audit:3@/var/log/samba-auth.log
>         idmap_ldb:use rfc2307 = yes
>         printcap name = /dev/null
>         load printers = no
>         disable spoolss = yes
>         printing = bsd
>         password hash userPassword schemes = CryptSHA256 CryptSHA512
>         password hash gpg key ids = XXXX
>         host msdfs = yes
>         server string = DC
>         template shell = /bin/bash
>         template homedir = /home/%U
>         usershare path =
> # Security
>         kdc default domain supported enctypes = 16
>         kdc supported enctypes = 16
>         restrict anonymous = 2
>         disable netbios = yes
>         ntlm auth = mschapv2-and-ntlmv2-only
>         rpc server dynamic port range = 50000-55000
>         kerberos encryption types = strong
>         full_audit:failure = none
>         full_audit:success = pwrite write renameat
>         full_audit:prefix = IP=%I|USER=%u|MACHINE=%m|VOLUME=%S
>         full_audit:facility = local7
>         full_audit:priority = NOTICE
>         tls enabled = yes
>         tls keyfile = /var/lib/samba/private/tls/internal.lan.key
>         tls certfile = /var/lib/samba/private/tls/internal.lan.crt
>         tls cafile = /var/lib/samba/private/tls/ca.crt
> 
>         smbd profiling level = on
>         username map = /etc/samba/user.map
> 
> [sysvol]
>         path = /var/lib/samba/sysvol
>         read only = No
>         vfs objects = dfs_samba4, acl_xattr, full_audit
> 
> [netlogon]
>         path = /var/lib/samba/sysvol/internal.lan/scripts
>         read only = No
>         vfs objects = dfs_samba4, acl_xattr, full_audit
> 

In your original post there was this line:

   "remoteAddress": "ipv4:10.10.235.171:49775",

Yet, the smb.conf above has this:

       interfaces = 192.168.1.2,127.0.0.1

10.10.235.xxx != 192.168.1.xxx

There was also this line in the original post:

   "logonServer": "UCSDC1",

Now, (I did ask about this) to me, 'UCS' usually stands for
'Univention Corporate Server', the only problem being, as far as I
understand, a 'Univention Corporate Server' doesn't use a Samba AD DC,
they use their own connector between AD and an openldap server.

Can you please confirm just what you have ?

Rowland
 



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba